348 lines
16 KiB
C
348 lines
16 KiB
C
|
|
/*
|
|
*****************Maat Deep Packet Inspection Policy Framework********
|
|
* Maat is the Goddess of truth and justice in ancient Egyptian concept.
|
|
* Her feather was the measure that determined whether the souls (considered
|
|
* to reside in the heart) of the departed would reach the paradise of afterlife
|
|
* successfully.
|
|
* Author: zhengchao, MESA
|
|
* Version 2020-06-13 version 3.0.0
|
|
*********************************************************
|
|
*/
|
|
#ifndef H_MAAT_RULE_H_INCLUDE
|
|
#define H_MAAT_RULE_H_INCLUDE
|
|
#ifdef __cplusplus
|
|
extern "C"{
|
|
#endif
|
|
#include <MESA/stream.h>
|
|
enum MAAT_CHARSET
|
|
{
|
|
CHARSET_NONE=0,
|
|
CHARSET_GBK,
|
|
CHARSET_BIG5,
|
|
CHARSET_UNICODE,
|
|
CHARSET_UTF8, // 4
|
|
CHARSET_BIN, //5
|
|
CHARSET_UNICODE_ASCII_ESC, // Unicode Escape format, prefix backslash-u hex, e.g. "\u627;"
|
|
CHARSET_UNICODE_ASCII_ALIGNED,//Unicode Escape format, prefix backslash-u with 4 bytes aligned, e.g. "\u0627"
|
|
CHARSET_UNICODE_NCR_DEC, //SGML Numeric character reference,decimal base, e.g. "ا"
|
|
CHARSET_UNICODE_NCR_HEX, //SGML Numeric character reference,hexdecimal base, e.g. "ا"
|
|
CHARSET_URL_ENCODE_GB2312, //URL encode with GB2312, e.g. the chinese word "china" was encoded to %D6%D0%B9%FA
|
|
CHARSET_URL_ENCODE_UTF8, //11, URL encode with UTF8,e.g. the chinese word "china" was encoded to %E4%B8%AD%E5%9B%BD
|
|
CHARSET_WINDOWS1251,
|
|
__CHARSET_MAX
|
|
};
|
|
enum MAAT_ACTION
|
|
{
|
|
MAAT_ACTION_BLOCK=0,
|
|
MAAT_ACTION_MONIT,
|
|
MAAT_ACTION_WHITE
|
|
};
|
|
enum MAAT_POS_TYPE
|
|
{
|
|
MAAT_POSTYPE_EXPR=0,
|
|
MAAT_POSTYPE_REGEX
|
|
};
|
|
typedef void* scan_status_t;
|
|
typedef void* stream_para_t;
|
|
typedef void* Maat_feather_t;
|
|
|
|
|
|
#define MAX_SERVICE_DEFINE_LEN 128
|
|
#define MAX_HUGE_SERVICE_DEFINE_LEN (1024*4)
|
|
struct Maat_rule_t
|
|
{
|
|
int config_id;
|
|
int service_id;
|
|
unsigned char do_log;
|
|
unsigned char do_blacklist;
|
|
unsigned char action;
|
|
unsigned char reserved;
|
|
int serv_def_len;
|
|
char service_defined[MAX_SERVICE_DEFINE_LEN];
|
|
};
|
|
#define MAAT_RULE_UPDATE_TYPE_FULL 1
|
|
#define MAAT_RULE_UPDATE_TYPE_INC 2
|
|
typedef void Maat_start_callback_t(int update_type,void* u_para);
|
|
typedef void Maat_update_callback_t(int table_id,const char* table_line,void* u_para);
|
|
typedef void Maat_finish_callback_t(void* u_para);
|
|
|
|
|
|
|
|
|
|
|
|
//--------------------HITTING DETAIL DESCRIPTION BEGIN
|
|
|
|
#define MAAT_MAX_HIT_RULE_NUM 8
|
|
#define MAAT_MAX_EXPR_ITEM_NUM 8
|
|
#define MAAT_MAX_HIT_POS_NUM 8
|
|
#define MAAT_MAX_REGEX_GROUP_NUM 8
|
|
|
|
//NOTE position buffer as hitting_regex_pos and hit_pos,are ONLY valid before next scan or Maat_stream_scan_string_end
|
|
struct regex_pos_t
|
|
{
|
|
int group_num;
|
|
int hitting_regex_len;
|
|
const char* hitting_regex_pos;
|
|
int grouping_len[MAAT_MAX_REGEX_GROUP_NUM];
|
|
const char* grouping_pos[MAAT_MAX_REGEX_GROUP_NUM];
|
|
};
|
|
struct str_pos_t
|
|
{
|
|
int hit_len;
|
|
const char* hit_pos;
|
|
};
|
|
struct sub_item_pos_t
|
|
{
|
|
enum MAAT_POS_TYPE ruletype;
|
|
int hit_cnt;
|
|
union
|
|
{
|
|
struct regex_pos_t regex_pos[MAAT_MAX_HIT_POS_NUM];
|
|
struct str_pos_t substr_pos[MAAT_MAX_HIT_POS_NUM];
|
|
};
|
|
};
|
|
|
|
struct Maat_region_pos_t
|
|
{
|
|
|
|
int region_id;
|
|
int sub_item_num;
|
|
struct sub_item_pos_t sub_item_pos[MAAT_MAX_EXPR_ITEM_NUM];
|
|
};
|
|
|
|
struct Maat_hit_detail_t
|
|
{
|
|
int config_id;//set <0 if half hit;
|
|
int hit_region_cnt;
|
|
struct Maat_region_pos_t region_pos[MAAT_MAX_HIT_RULE_NUM];
|
|
};
|
|
//--------------------HITTING DETAIL DESCRIPTION END
|
|
|
|
//Abondon interface ,left for compatible.
|
|
Maat_feather_t Maat_summon_feather(int max_thread_num,
|
|
const char* table_info_path,
|
|
const char* ful_cfg_dir,
|
|
const char* inc_cfg_dir,
|
|
void*logger);//MESA_handle_logger
|
|
//Abondon interface ,left for compatible.
|
|
Maat_feather_t Maat_summon_feather_json(int max_thread_num,
|
|
const char* table_info_path,
|
|
const char* json_rule,
|
|
void* logger);
|
|
|
|
Maat_feather_t Maat_feather(int max_thread_num,const char* table_info_path,void* logger);
|
|
int Maat_initiate_feather(Maat_feather_t feather);
|
|
|
|
enum MAAT_INIT_OPT
|
|
{
|
|
MAAT_OPT_SCANDIR_INTERVAL_MS=1, //VALUE is interger, SIZE=sizeof(int). DEFAULT:1,000 milliseconds.
|
|
MAAT_OPT_EFFECT_INVERVAL_MS, //VALUE is interger, SIZE=sizeof(int). DEFAULT:60,000 milliseconds.
|
|
MAAT_OPT_FULL_CFG_DIR, //VALUE is a const char*, MUST end with '\0', SIZE= strlen(string+'\0')+1.DEFAULT: no default.
|
|
MAAT_OPT_INC_CFG_DIR, //VALUE is a const char*, MUST end with '\0', SIZE= strlen(string+'\0')+1.DEFAULT: no default.
|
|
MAAT_OPT_JSON_FILE_PATH, //VALUE is a const char*, MUST end with '\0', SIZE= strlen(string+'\0')+1.DEFAULT: no default.
|
|
MAAT_OPT_STAT_ON, //VALUE is NULL, SIZE is 0. MAAT_OPT_STAT_FILE_PATH must be set. Default: stat OFF.
|
|
MAAT_OPT_PERF_ON, //VALUE is NULL, SIZE is 0. MAAT_OPT_STAT_FILE_PATH must be set. Default: stat OFF.
|
|
MAAT_OPT_STAT_FILE_PATH, //VALUE is a const char*, MUST end with '\0', SIZE= strlen(string+'\0')+1. DEFAULT: no default.
|
|
MAAT_OPT_SCAN_DETAIL, //VALUE is interger *, SIZE=sizeof(int). 0: not return any detail;1: return hit pos, not include regex grouping.
|
|
// 2 return hit pos and regex grouping pos;DEFAULT:0
|
|
MAAT_OPT_INSTANCE_NAME, //VALUE is a const char*, MUST end with '\0', SIZE= strlen(string+'\0')+1, no more than 11 bytes.DEFAULT: MAAT_$tableinfo_path$.
|
|
MAAT_OPT_DECRYPT_KEY, //VALUE is a const char*, MUST end with '\0', SIZE= strlen(string+'\0')+1. No DEFAULT.
|
|
MAAT_OPT_REDIS_IP, //VALUE is a const char*, MUST end with '\0', SIZE= strlen(string+'\0')+1. No DEFAULT.
|
|
MAAT_OPT_REDIS_PORT, //VALUE is a unsigned short or a signed int, host order, SIZE= sizeof(unsigned short) or sizeof(int). No DEFAULT.
|
|
MAAT_OPT_REDIS_INDEX, //VALUE is interger *, 0~15, SIZE=sizeof(int). DEFAULT: 0.
|
|
MAAT_OPT_CMD_AUTO_NUMBERING, //VALUE is a interger *, 1 or 0, SIZE=sizeof(int). DEFAULT: 1.
|
|
MAAT_OPT_DEFERRED_LOAD, //VALUE is NULL,SIZE is 0. Default: Deffered initialization OFF.
|
|
MAAT_OPT_CUMULATIVE_UPDATE_OFF, //VALUE is NULL,SIZE is 0. Default: CUMMULATIVE UPDATE ON.
|
|
MAAT_OPT_LOAD_VERSION_FROM, //VALUE is a long long, SIZE=sizeof(long long). Default: Load the Latest. Only valid in redis mode, and maybe failed for too old.
|
|
//This option also disables background update.
|
|
MAAT_OPT_ENABLE_UPDATE, //VALUE is interger, SIZE=sizeof(int). 1: Enabled, 0:Disabled. DEFAULT: Backgroud update is enabled. Runtime setting is allowed.
|
|
MAAT_OPT_ACCEPT_TAGS, //VALUE is a const char*, MUST end with '\0', SIZE= strlen(string+'\0')+1. Format is a JSON, e.g.{"tags":[{"tag":"location","value":"Beijing/ChaoYang/Huayan/22A"},{"tag":"isp","value":"telecom"}]}
|
|
MAAT_OPT_FOREIGN_CONT_DIR, //VALUE is a const char*, MUST end with '\0', SIZE= strlen(string+'\0')+1. Specifies a local diretory to store foreign content. Default: []table_info_path]_files
|
|
MAAT_OPT_GARBAGE_COLLECTION_TIMEOUT_MS, //VALUE is interger, SIZE=sizeof(int). DEFAULT:10,000 milliseconds.
|
|
MAAT_OPT_JSON_IS_GZIPPED, //VALUE is NULL, SIZE is 0. Default: 0, Not compressed by gzip.
|
|
MAAT_OPT_STATUS_OUTPUT_PROMETHEUS //VALUE is a interger *, 1 or 0, SIZE=sizeof(int). DEFAULT: 1.
|
|
};
|
|
//return -1 if failed, return 0 on success;
|
|
int Maat_set_feather_opt(Maat_feather_t feather,enum MAAT_INIT_OPT type,const void* value,int size);
|
|
enum MAAT_STATE_OPT
|
|
{
|
|
MAAT_STATE_VERSION=1, //Get current maat version, if maat is in update progress, the updating version is returned. VALUE is long long, SIZE=sizeof(long long).
|
|
MAAT_STATE_LAST_UPDATING_TABLE, //Query at Maat_finish_callback_t to determine whether this table is the last one to update. VALUE is interger, SIZE=sizeof(int), 1:yes, 0: no
|
|
MAAT_STATE_IN_UPDATING
|
|
};
|
|
int Maat_read_state(Maat_feather_t feather, enum MAAT_STATE_OPT type, void* value, int size);
|
|
|
|
void Maat_burn_feather(Maat_feather_t feather);
|
|
|
|
//return table_id(>=0) if success,otherwise return -1;
|
|
int Maat_table_register(Maat_feather_t feather,const char* table_name);
|
|
//return 1 if success,otherwise return -1 incase invalid table_id or registed function number exceed 32;
|
|
int Maat_table_callback_register(Maat_feather_t feather,short table_id,
|
|
Maat_start_callback_t *start,//MAAT_RULE_UPDATE_TYPE_*,u_para
|
|
Maat_update_callback_t *update,//table line ,u_para
|
|
Maat_finish_callback_t *finish,//u_para
|
|
void* u_para);
|
|
|
|
#define MAX_HIT_REGION_NUM_PER_GROUP 128
|
|
|
|
struct Maat_hit_path_t
|
|
{
|
|
int Nth_scan;
|
|
int region_id;
|
|
int sub_group_id;
|
|
int top_group_id;
|
|
int virtual_table_id; // 0 is not a virtual table.
|
|
int compile_id;
|
|
};
|
|
enum MAAT_SCAN_OPT
|
|
{
|
|
MAAT_SET_SCAN_DISTRICT=1, //VALUE is a const char*, SIZE= strlen(string). DEFAULT: no default.
|
|
MAAT_SET_SCAN_LAST_REGION, //VALUE is NULL, SIZE=0. This option indicates that the follow scan is the last region of current scan combination.
|
|
MAAT_GET_SCAN_HIT_PATH //VALUE is struct Maat_hit_path_t*, an array of struct Maat_hit_path_t, SIZE= sizeof(struct Maat_hit_path_t)*N,
|
|
//Maat_get_scan_status returns actual got number.
|
|
};
|
|
//return 0 if success, return -1 when failed;
|
|
int Maat_set_scan_status(Maat_feather_t feather, scan_status_t* mid, enum MAAT_SCAN_OPT type, const void* value, int size);
|
|
|
|
//return >=0 if success, return -1 when failed;
|
|
int Maat_get_scan_status(Maat_feather_t feather, scan_status_t* mid, enum MAAT_SCAN_OPT type, void* value, int size);
|
|
|
|
//Return hit rule number, return -1 when error occurs,return -2 when hit current region
|
|
//mid MUST set to NULL before fist call
|
|
int Maat_scan_intval(Maat_feather_t feather,int table_id
|
|
,unsigned int intval
|
|
,struct Maat_rule_t*result,int rule_num
|
|
,scan_status_t *mid,int thread_num);
|
|
int Maat_scan_addr(Maat_feather_t feather,int table_id
|
|
,struct ipaddr* addr
|
|
,struct Maat_rule_t*result,int rule_num
|
|
,scan_status_t *mid,int thread_num);
|
|
int Maat_scan_proto_addr(Maat_feather_t feather,int table_id
|
|
,struct ipaddr* addr,unsigned short int proto
|
|
,struct Maat_rule_t*result,int rule_num
|
|
,scan_status_t *mid,int thread_num);
|
|
int Maat_full_scan_string(Maat_feather_t feather,int table_id
|
|
,enum MAAT_CHARSET charset,const char* data,int data_len
|
|
,struct Maat_rule_t*result,int* found_pos,int rule_num
|
|
,scan_status_t* mid,int thread_num);
|
|
//hit_detail could be NULL if not cared.
|
|
int Maat_full_scan_string_detail(Maat_feather_t feather,int table_id
|
|
,enum MAAT_CHARSET charset,const char* data,int data_len
|
|
,struct Maat_rule_t*result,int rule_num,struct Maat_hit_detail_t *hit_detail,int detail_num
|
|
,int* detail_ret,scan_status_t* mid,int thread_num);
|
|
|
|
stream_para_t Maat_stream_scan_string_start(Maat_feather_t feather,int table_id,int thread_num);
|
|
int Maat_stream_scan_string(stream_para_t* stream_para
|
|
,enum MAAT_CHARSET charset,const char* data,int data_len
|
|
,struct Maat_rule_t*result,int* found_pos,int rule_num
|
|
,scan_status_t* mid);
|
|
//hited_detail could be NULL if not cared.
|
|
int Maat_stream_scan_string_detail(stream_para_t* stream_para
|
|
,enum MAAT_CHARSET charset,const char* data,int data_len
|
|
,struct Maat_rule_t*result,int rule_num,struct Maat_hit_detail_t *hit_detail,int detail_num
|
|
,int* detail_ret,scan_status_t* mid);
|
|
void Maat_stream_scan_string_end(stream_para_t* stream_para);
|
|
|
|
stream_para_t Maat_stream_scan_digest_start(Maat_feather_t feather,int table_id,unsigned long long total_len,int thread_num);
|
|
int Maat_stream_scan_digest(stream_para_t* stream_para
|
|
,const char* data,int data_len,unsigned long long offset
|
|
,struct Maat_rule_t*result,int rule_num
|
|
,scan_status_t* mid);
|
|
void Maat_stream_scan_digest_end(stream_para_t* stream_para);
|
|
|
|
int Maat_similar_scan_string(Maat_feather_t feather,int table_id
|
|
,const char* data,int data_len
|
|
,struct Maat_rule_t*result,int rule_num
|
|
,scan_status_t* mid,int thread_num);
|
|
|
|
void Maat_clean_status(scan_status_t* mid);
|
|
|
|
typedef void* MAAT_RULE_EX_DATA;
|
|
// The idx parameter is the index: this will be the same value returned by Maat_rule_get_ex_new_index() when the functions were initially registered.
|
|
// Finally the argl and argp parameters are the values originally passed to the same corresponding parameters when Maat_rule_get_ex_new_index() was called.
|
|
typedef void Maat_rule_EX_new_func_t(int idx, const struct Maat_rule_t* rule, const char* srv_def_large,
|
|
MAAT_RULE_EX_DATA* ad, long argl, void *argp);
|
|
typedef void Maat_rule_EX_free_func_t(int idx, const struct Maat_rule_t* rule, const char* srv_def_large,
|
|
MAAT_RULE_EX_DATA* ad, long argl, void *argp);
|
|
typedef void Maat_rule_EX_dup_func_t(int idx, MAAT_RULE_EX_DATA *to, MAAT_RULE_EX_DATA *from, long argl, void *argp);
|
|
|
|
int Maat_rule_get_ex_new_index(Maat_feather_t feather, const char* compile_table_name,
|
|
Maat_rule_EX_new_func_t* new_func,
|
|
Maat_rule_EX_free_func_t* free_func,
|
|
Maat_rule_EX_dup_func_t* dup_func,
|
|
long argl, void *argp);
|
|
//returned data is duplicated by dup_func of Maat_rule_get_ex_new_index, caller is responsible to free the data.
|
|
MAAT_RULE_EX_DATA Maat_rule_get_ex_data(Maat_feather_t feather, const struct Maat_rule_t* rule, int idx);
|
|
|
|
//Sort rules by their evaluation order.
|
|
//rule_array will be modified with sorted rule.
|
|
//Return sortted rule number, maybe less than n_rule if some rules are invalid.
|
|
size_t Maat_rule_sort_by_evaluation_order(Maat_feather_t feather, struct Maat_rule_t* rule_array, size_t n_rule);
|
|
|
|
|
|
//Helper function for parsing space or tab seperated line.
|
|
//Nth_column: the Nth column is numberd from 1.
|
|
//Return 0 if success.
|
|
int Maat_helper_read_column(const char* line, int Nth_column, size_t *column_offset, size_t *column_len);
|
|
|
|
|
|
//Following functions are similar to Maat_rule_get_ex_data, except they are effective on plugin table.
|
|
typedef void* MAAT_PLUGIN_EX_DATA;
|
|
typedef void Maat_plugin_EX_new_func_t(int table_id, const char* key, const char* table_line, MAAT_PLUGIN_EX_DATA* ad, long argl, void *argp);
|
|
typedef void Maat_plugin_EX_free_func_t(int table_id, MAAT_PLUGIN_EX_DATA* ad, long argl, void *argp);
|
|
typedef void Maat_plugin_EX_dup_func_t(int table_id, MAAT_PLUGIN_EX_DATA *to, MAAT_PLUGIN_EX_DATA *from, long argl, void *argp);
|
|
typedef int Maat_plugin_EX_key2index_func_t(const char* key);
|
|
|
|
int Maat_plugin_EX_register(Maat_feather_t feather, int table_id,
|
|
Maat_plugin_EX_new_func_t* new_func,
|
|
Maat_plugin_EX_free_func_t* free_func,
|
|
Maat_plugin_EX_dup_func_t* dup_func,
|
|
Maat_plugin_EX_key2index_func_t* key2index_func,
|
|
long argl, void *argp);
|
|
//Data is duplicated by dup_func of Maat_plugin_EX_register, caller is responsible to FREE the data.
|
|
MAAT_PLUGIN_EX_DATA Maat_plugin_get_EX_data(Maat_feather_t feather, int table_id, const char* key);
|
|
|
|
|
|
int Maat_ip_plugin_EX_register(Maat_feather_t feather, int table_id,
|
|
Maat_plugin_EX_new_func_t* new_func,
|
|
Maat_plugin_EX_free_func_t* free_func,
|
|
Maat_plugin_EX_dup_func_t* dup_func,
|
|
long argl, void *argp);
|
|
|
|
struct ip_address
|
|
{
|
|
int ip_type; //4: IPv4, 6: IPv6
|
|
union
|
|
{
|
|
unsigned int ipv4; //network order
|
|
unsigned int ipv6[4];
|
|
};
|
|
};
|
|
|
|
int Maat_ip_plugin_get_EX_data(Maat_feather_t feather, int table_id, const struct ip_address* ip, MAAT_PLUGIN_EX_DATA* ex_data_array, size_t n_ex_data);
|
|
|
|
int Maat_fqdn_plugin_EX_register(Maat_feather_t feather, int table_id,
|
|
Maat_plugin_EX_new_func_t* new_func,
|
|
Maat_plugin_EX_free_func_t* free_func,
|
|
Maat_plugin_EX_dup_func_t* dup_func,
|
|
long argl, void *argp);
|
|
|
|
//Return order: Longger suffix first, then fqdn with bigger index first.
|
|
int Maat_fqdn_plugin_get_EX_data(Maat_feather_t feather, int table_id, const char* fqdn, MAAT_PLUGIN_EX_DATA* ex_data_array, size_t n_ex_data);
|
|
|
|
|
|
enum MAAT_RULE_OPT
|
|
{
|
|
MAAT_RULE_SERV_DEFINE //VALUE is a char* buffer,SIZE= buffer size.
|
|
};
|
|
int Maat_read_rule(Maat_feather_t feather, const struct Maat_rule_t* rule, enum MAAT_RULE_OPT type, void* value, int size);
|
|
|
|
#ifdef __cplusplus
|
|
}//end extern "C"
|
|
#endif
|
|
|
|
|
|
#endif // H_MAAT_RULE_H_INCLUDE
|
|
|