diff --git a/common/include/tfe_resource.h b/common/include/tfe_resource.h index 7ec59f1..22da084 100644 --- a/common/include/tfe_resource.h +++ b/common/include/tfe_resource.h @@ -8,5 +8,35 @@ enum RESOURCE_TYPE DEVICE_ID, }; +enum TABLE_TYPE +{ + TABLE_IP_ASN_USER_DEFINED, + TABLE_IP_ASN_BUILT_IN, + TABLE_IP_LOCATION_USER_DEFINED, + TABLE_IP_LOCATION_BUILT_IN, + TABLE_SECURITY_SOURCE_ASN, + TABLE_SECURITY_DESTINATION_ASN, + TABLE_SECURITY_SOURCE_LOCATION, + TABLE_SECURITY_DESTINATION_LOCATION, + TABLE_TYPE_MAX +}; + +struct ip_data_table +{ + int profile_id; + int ref_cnt; + + char *asn; + char *organization; + + char *country_full; + char *province_full; + char *city_full; + + pthread_mutex_t lock; +}; + int tfe_bussiness_resouce_init(); -void *tfe_bussiness_resouce_get(enum RESOURCE_TYPE type); \ No newline at end of file +void *tfe_bussiness_resouce_get(enum RESOURCE_TYPE type); +int tfe_bussiness_tableid_get(enum TABLE_TYPE type); +void ip_table_free(struct ip_data_table *ip_asn); \ No newline at end of file diff --git a/common/include/tfe_types.h b/common/include/tfe_types.h index c11ecd6..8290977 100644 --- a/common/include/tfe_types.h +++ b/common/include/tfe_types.h @@ -159,6 +159,4 @@ struct tfe_stream_addr * tfe_stream_addr_reverse(struct tfe_stream_addr * orin); char* tfe_string_addr_create_by_fd(int fd, enum tfe_conn_dir dir); char * tfe_stream_addr_to_str(const struct tfe_stream_addr * addr); int tfe_stream_addr_str_split(char* addr_str, const char** sip, const char** sport, const char** dip, const char** dport); - - - +int tfe_stream_addr_to_address(const struct tfe_stream_addr *addr, struct ip_address *dest_ip, struct ip_address *source_ip); \ No newline at end of file diff --git a/common/include/tfe_utils.h b/common/include/tfe_utils.h index acb6e12..1ced90a 100644 --- a/common/include/tfe_utils.h +++ b/common/include/tfe_utils.h @@ -176,4 +176,4 @@ const char * tfe_version(); int __wrapper_MESA_htable_set_opt(MESA_htable_handle table, enum MESA_htable_opt opt_type, unsigned value); int __wrapper_MESA_htable_set_opt(MESA_htable_handle table, enum MESA_htable_opt opt_type, void * val, size_t len); int tfe_decode_base64url(u_char *dst, u_char *src); - +char *tfe_unescape(char *s); \ No newline at end of file diff --git a/common/src/tfe_resource.cpp b/common/src/tfe_resource.cpp index 646bd18..5a3d8a8 100644 --- a/common/src/tfe_resource.cpp +++ b/common/src/tfe_resource.cpp @@ -10,6 +10,14 @@ #define MAAT_INPUT_REDIS 1 #define MAAT_INPUT_FILE 2 +struct maat_table_info +{ + int id; + char *name; + Maat_plugin_EX_new_func_t *new_func; + Maat_plugin_EX_dup_func_t *dup_func; + Maat_plugin_EX_free_func_t *free_func; +}; static Maat_feather_t static_maat = NULL; static Maat_feather_t dynamic_maat = NULL; static tfe_kafka_logger_t *kafka_logger = NULL; @@ -27,6 +35,7 @@ static Maat_feather_t create_maat_feather(const char *instance_name, const char int redis_port_begin = 0, redis_port_end = 0; int redis_port_select = 0; int redis_db_idx = 0; + int deferred_load_on = 0; char json_cfg_file[TFE_STRING_MAX] = {0}, maat_stat_file[TFE_STRING_MAX] = {0}; MESA_load_profile_int_def(profile, section, "maat_input_mode", &(input_mode), 0); @@ -42,6 +51,7 @@ static Maat_feather_t create_maat_feather(const char *instance_name, const char MESA_load_profile_string_def(profile, section, "full_cfg_dir", ful_cfg_dir, sizeof(ful_cfg_dir), ""); MESA_load_profile_string_def(profile, section, "stat_file", maat_stat_file, sizeof(maat_stat_file), ""); MESA_load_profile_int_def(profile, section, "effect_interval_s", &(effect_interval), 60); + MESA_load_profile_int_def(profile, section, "deferred_load_on", &(deferred_load_on), 0); effect_interval *= 1000; //convert s to ms @@ -119,6 +129,7 @@ static Maat_feather_t create_maat_feather(const char *instance_name, const char } } + Maat_set_feather_opt(target, MAAT_OPT_DEFERRED_LOAD, &deferred_load_on, sizeof(deferred_load_on)); Maat_set_feather_opt(target, MAAT_OPT_EFFECT_INVERVAL_MS, &effect_interval, sizeof(effect_interval)); Maat_set_feather_opt(target, MAAT_OPT_SCAN_DETAIL, &scan_detail, sizeof(scan_detail)); if (strlen(accept_tags) > 0) @@ -219,6 +230,160 @@ finish: return (char *)device_def_id; } +static void ip_asn_table_new_cb(int table_id, const char *key, const char *table_line, MAAT_PLUGIN_EX_DATA *ad, long argl, void *argp) +{ + int addr_type; + int ret = 0, profile_id = 0, is_valid = 0; + char start_ip[40], end_ip[40], asn[40] = {0}; + char organization[TFE_PATH_MAX]; + + ret = sscanf(table_line, "%d\t%d\t%s\t%s\t%s\t%s\t%d", &profile_id, &addr_type, start_ip, end_ip, asn, organization, &is_valid); + if (ret != 7) + { + TFE_LOG_ERROR(g_default_logger, "Policy table parse ip ASN failed, ret:%d, %s", ret, table_line); + return; + } + tfe_unescape(organization); + + struct ip_data_table *ip_asn = ALLOC(struct ip_data_table, 1); + memset(ip_asn, 0, sizeof(struct ip_data_table)); + ip_asn->profile_id = profile_id; + ip_asn->asn = tfe_strdup(asn); + ip_asn->organization = tfe_strdup(organization); + ip_asn->ref_cnt = 1; + pthread_mutex_init(&(ip_asn->lock), NULL); + + TFE_LOG_INFO(g_default_logger, "Policy table add success %d", profile_id); + + *ad = ip_asn; +} + +static void ip_location_table_new_cb(int table_id, const char *key, const char *table_line, MAAT_PLUGIN_EX_DATA *ad, long argl, void *argp) +{ + int ret = 0, profile_id = 0, is_valid = 0; + int geoname_id = 0, addr_type = 0; + double latitude, longitude, coords; + char language[40], start_ip[40], end_ip[40]; + char continent_abbr[TFE_PATH_MAX], continent_full[TFE_PATH_MAX]; + char country_abbr[TFE_PATH_MAX], province_abbr[TFE_PATH_MAX], time_zone[TFE_PATH_MAX]; + char country_full[TFE_PATH_MAX], province_full[TFE_PATH_MAX], city_full[TFE_PATH_MAX]; + + ret = sscanf(table_line, "%d\t%d\t%d\t%s\t%s\t%lf\t%lf\t%lf\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%d", &profile_id, &geoname_id, + &addr_type, start_ip, end_ip, &latitude, &longitude, &coords, language, + continent_abbr, continent_full, country_abbr, country_full, province_abbr, province_full, + city_full, time_zone, &is_valid); + + if (ret != 18) + { + TFE_LOG_ERROR(g_default_logger, "Policy table parse ip location failed, ret:%d, %s", ret, table_line); + return; + } + tfe_unescape(continent_full); + tfe_unescape(country_full); + tfe_unescape(province_full); + tfe_unescape(city_full); + + struct ip_data_table *ip_asn = ALLOC(struct ip_data_table, 1); + memset(ip_asn, 0, sizeof(struct ip_data_table)); + ip_asn->profile_id = profile_id; + ip_asn->country_full = tfe_strdup(country_full); + ip_asn->province_full = tfe_strdup(province_full); + ip_asn->city_full = tfe_strdup(city_full); + ip_asn->ref_cnt = 1; + pthread_mutex_init(&(ip_asn->lock), NULL); + + TFE_LOG_INFO(g_default_logger, "Policy table add success %d", profile_id); + + *ad = ip_asn; +} + +static void ip_table_dup_cb(int table_id, MAAT_PLUGIN_EX_DATA *to, MAAT_PLUGIN_EX_DATA *from, long argl, void *argp) +{ + struct ip_data_table *ip_asn = (struct ip_data_table *)(*from); + pthread_mutex_lock(&(ip_asn->lock)); + ip_asn->ref_cnt++; + pthread_mutex_unlock(&(ip_asn->lock)); + *to = ip_asn; +} + +static void ip_table_free_cb(int table_id, MAAT_PLUGIN_EX_DATA *ad, long argl, void *argp) +{ + if (*ad == NULL) + { + return; + } + struct ip_data_table *ip_asn = (struct ip_data_table *)(*ad); + pthread_mutex_lock(&(ip_asn->lock)); + ip_asn->ref_cnt--; + if (ip_asn->ref_cnt > 0) + { + pthread_mutex_unlock(&(ip_asn->lock)); + return; + } + pthread_mutex_unlock(&(ip_asn->lock)); + pthread_mutex_destroy(&(ip_asn->lock)); + + if (ip_asn->asn) + FREE(&ip_asn->asn); + if (ip_asn->organization) + FREE(&ip_asn->organization); + if (ip_asn->country_full) + FREE(&ip_asn->country_full); + if (ip_asn->province_full) + FREE(&ip_asn->province_full); + if (ip_asn->city_full) + FREE(&ip_asn->city_full); + + FREE(&ip_asn); + *ad = NULL; + return; +} + +void ip_table_free(struct ip_data_table *ip_asn) +{ + ip_table_free_cb(0, (void **)&ip_asn, 0, NULL); +} + +static struct maat_table_info maat_pub_tables[TABLE_TYPE_MAX] = { + // TABLE_IP_ASN_USER_DEFINED + {0, "TSG_IP_ASN_USER_DEFINED", ip_asn_table_new_cb, ip_table_dup_cb, ip_table_free_cb}, + // TABLE_IP_ASN_BUILT_IN + {0, "TSG_IP_ASN_BUILT_IN", ip_asn_table_new_cb, ip_table_dup_cb, ip_table_free_cb}, + // TABLE_IP_LOCATION_USER_DEFINED + {0, "TSG_IP_LOCATION_USER_DEFINED", ip_location_table_new_cb, ip_table_dup_cb, ip_table_free_cb}, + // TABLE_IP_LOCATION_BUILT_IN + {0, "TSG_IP_LOCATION_BUILT_IN", ip_location_table_new_cb, ip_table_dup_cb, ip_table_free_cb}, + // TABLE_SECURITY_SOURCE_ASN + {0, "TSG_SECURITY_SOURCE_ASN", NULL, NULL, NULL}, + // TABLE_SECURITY_DESTINATION_ASN + {0, "TSG_SECURITY_DESTINATION_ASN", NULL, NULL, NULL}, + // TABLE_SECURITY_SOURCE_LOCATION + {0, "TSG_SECURITY_SOURCE_LOCATION", NULL, NULL, NULL}, + // TABLE_SECURITY_DESTINATION_LOCATION + {0, "TSG_SECURITY_DESTINATION_LOCATION", NULL, NULL, NULL} +}; + +static int register_maat_table() +{ + for (int i = 0; i < TABLE_TYPE_MAX; i++) + { + maat_pub_tables[i].id = Maat_table_register(static_maat, maat_pub_tables[i].name); + if (maat_pub_tables[i].id < 0) + { + TFE_LOG_ERROR(g_default_logger, "Maat table %s register failed.", maat_pub_tables[i].name); + return -1; + } + + if (maat_pub_tables[i].new_func || maat_pub_tables[i].dup_func || maat_pub_tables[i].free_func) + { + Maat_ip_plugin_EX_register(static_maat, maat_pub_tables[i].id, maat_pub_tables[i].new_func, + maat_pub_tables[i].free_func, maat_pub_tables[i].dup_func, 0, NULL); + } + } + + return 0; +} + int tfe_bussiness_resouce_init() { const char *profile_path = "./conf/tfe/tfe.conf"; @@ -243,6 +408,11 @@ int tfe_bussiness_resouce_init() device_id = cerate_device_id(profile_path, "kafka", g_default_logger); + if (register_maat_table()) + { + return -1; + } + return 0; } @@ -261,4 +431,9 @@ void *tfe_bussiness_resouce_get(enum RESOURCE_TYPE type) default: return NULL; } +} + +int tfe_bussiness_tableid_get(enum TABLE_TYPE type) +{ + return maat_pub_tables[type].id; } \ No newline at end of file diff --git a/common/src/tfe_types.cpp b/common/src/tfe_types.cpp index 43829d6..8fe98a6 100644 --- a/common/src/tfe_types.cpp +++ b/common/src/tfe_types.cpp @@ -1,6 +1,8 @@ #include "tfe_types.h" #include "tfe_utils.h" #include +#include + const char * tfe_stream_conn_dir_to_str(enum tfe_conn_dir dir) { return (dir == CONN_DIR_DOWNSTREAM) ? "downstream" : "upstream"; @@ -201,3 +203,27 @@ char * tfe_string_addr_create_by_fd(int fd, enum tfe_conn_dir dir) tfe_stream_addr_free(stream_addr); return addr_str; } + +int tfe_stream_addr_to_address(const struct tfe_stream_addr *addr, struct ip_address *dest_ip, struct ip_address *source_ip) +{ + if(addr==NULL) return -1; + if (addr->addrtype == TFE_ADDR_STREAM_TUPLE4_V4) + { + const struct tfe_stream_addr_tuple4_v4 * tuple4_v4 = addr->tuple4_v4; + source_ip->ip_type=4; + source_ip->ipv4=tuple4_v4->saddr.s_addr; + + dest_ip->ip_type=4; + dest_ip->ipv4=tuple4_v4->daddr.s_addr; + } + if (addr->addrtype == TFE_ADDR_STREAM_TUPLE4_V6) + { + const struct tfe_stream_addr_tuple4_v6 * tuple4_v6 = addr->tuple4_v6; + source_ip->ip_type=6; + memcpy((char *)(source_ip->ipv6), tuple4_v6->saddr.__in6_u.__u6_addr32, IPV6_ADDR_LEN); + + dest_ip->ip_type=6; + memcpy((char *)(dest_ip->ipv6),tuple4_v6->daddr.__in6_u.__u6_addr32, IPV6_ADDR_LEN); + } + return 0; +} \ No newline at end of file diff --git a/common/src/tfe_utils.cpp b/common/src/tfe_utils.cpp index 2656a68..61d7c9b 100644 --- a/common/src/tfe_utils.cpp +++ b/common/src/tfe_utils.cpp @@ -227,3 +227,40 @@ int tfe_decode_base64url(u_char *dst, u_char *src) return tfe_decode_base64_internal(dst, src, basis64); } + +char *tfe_unescape(char *s) +{ + int i=0,j=0; + int len=strlen(s); + for(i=0,j=0;irdata.unknown_data, *ptr, rr->rdlength); rr->rdata.unknown_data[rr->rdlength] = '\0'; (*ptr) += rr->rdlength; - printf("No support respone type, type: %d", rr->type); + // printf("No support respone type, type: %d", rr->type); break; } @@ -1196,7 +1196,7 @@ int dns_package(dns_info_t *dns_info, char *out_buff, int buff_size) } if (used_len > buff_size) { - printf("dns_package buff to short, %s, %d\n", __FILE__, __LINE__); + // printf("dns_package buff to short, %s, %d\n", __FILE__, __LINE__); return -1; } } diff --git a/plugin/business/doh/src/doh.cpp b/plugin/business/doh/src/doh.cpp index a8cb8b8..fbd177c 100644 --- a/plugin/business/doh/src/doh.cpp +++ b/plugin/business/doh/src/doh.cpp @@ -199,6 +199,172 @@ static struct Maat_rule_t *doh_fetch_rule(Maat_rule_t *result, int result_num) return p_result; } +static int doh_ip_location_scan(struct Maat_rule_t *result, struct ip_address *sip, struct ip_address *dip, int hit_cnt, unsigned int thread_id, struct doh_ctx *ctx) +{ + int scan_ret = 0, hit_cnt_ip = 0; + char buff[TFE_STRING_MAX] = {0}; + struct ip_data_table *ip_location_client = NULL, *ip_location_server = NULL; + int is_src_use_user_defined = 1; + int is_dst_use_user_defined = 1; + + Maat_ip_plugin_get_EX_data(g_doh_conf->maat, tfe_bussiness_tableid_get(TABLE_IP_LOCATION_USER_DEFINED), sip, (void **)&ip_location_client, 1); + Maat_ip_plugin_get_EX_data(g_doh_conf->maat, tfe_bussiness_tableid_get(TABLE_IP_LOCATION_USER_DEFINED), dip, (void **)&ip_location_server, 1); + + if (ip_location_client == NULL) + { + is_src_use_user_defined = 0; + Maat_ip_plugin_get_EX_data(g_doh_conf->maat, tfe_bussiness_tableid_get(TABLE_IP_LOCATION_BUILT_IN), sip, (void **)&ip_location_client, 1); + } + if (ip_location_server == NULL) + { + is_dst_use_user_defined = 0; + Maat_ip_plugin_get_EX_data(g_doh_conf->maat, tfe_bussiness_tableid_get(TABLE_IP_LOCATION_BUILT_IN), dip, (void **)&ip_location_server, 1); + } + + if (ip_location_server != NULL) + { + TFE_LOG_INFO(g_doh_conf->local_logger, "scan dst ip use IP_LOCATION_%s, profile_id: %d ref_cnt: %d asn: %s organization: %s country: %s province: %s city: %s addr: %s", + (is_dst_use_user_defined ? "USER_DEFINED" : "BUILT_IN"), ip_location_server->profile_id, ip_location_server->ref_cnt, ip_location_server->asn, + ip_location_server->organization, ip_location_server->country_full, ip_location_server->province_full, ip_location_server->city_full, ctx->addr_string); + + snprintf(buff, sizeof(buff), "%s.%s.", ip_location_server->country_full, ip_location_server->city_full); + scan_ret = Maat_full_scan_string(g_doh_conf->maat, tfe_bussiness_tableid_get(TABLE_SECURITY_DESTINATION_LOCATION), + CHARSET_GBK, buff, strlen(buff), + result + hit_cnt + hit_cnt_ip, NULL, MAX_SCAN_RESULT - hit_cnt - hit_cnt_ip, + &(ctx->scan_mid), (int)thread_id); + if (scan_ret > 0) + { + TFE_LOG_INFO(g_doh_conf->local_logger, "SCAN_DST_LOCATION, Hit location: %s scan ret: %d policy_id: %d service: %d action: %d addr: %s", + buff, scan_ret, result[hit_cnt + hit_cnt_ip].config_id, result[hit_cnt + hit_cnt_ip].service_id, result[hit_cnt + hit_cnt_ip].action, ctx->addr_string); + hit_cnt_ip += scan_ret; + } + else + { + TFE_LOG_INFO(g_doh_conf->local_logger, "SCAN_DST_LOCATION, NO hit location: %s scan ret: %d addr: %s", + buff, scan_ret, ctx->addr_string); + } + + memset(buff, 0, sizeof(buff)); + snprintf(buff, sizeof(buff), "%s,%s,%s", ip_location_server->city_full, ip_location_server->province_full, ip_location_server->country_full); + ctx->location_server = tfe_strdup(buff); + } + if (ip_location_client != NULL) + { + TFE_LOG_INFO(g_doh_conf->local_logger, "scan src ip use IP_LOCATION_%s, profile_id: %d ref_cnt: %d asn: %s organization: %s country: %s province: %s city: %s addr: %s", + (is_src_use_user_defined ? "USER_DEFINED" : "BUILT_IN"), ip_location_client->profile_id, ip_location_client->ref_cnt, ip_location_client->asn, + ip_location_client->organization, ip_location_client->country_full, ip_location_client->province_full, ip_location_client->city_full, ctx->addr_string); + + snprintf(buff, sizeof(buff), "%s.%s.", ip_location_client->country_full, ip_location_client->city_full); + scan_ret = Maat_full_scan_string(g_doh_conf->maat, tfe_bussiness_tableid_get(TABLE_SECURITY_SOURCE_LOCATION), + CHARSET_GBK, buff, strlen(buff), + result + hit_cnt + hit_cnt_ip, NULL, MAX_SCAN_RESULT - hit_cnt - hit_cnt_ip, + &(ctx->scan_mid), (int)thread_id); + if (scan_ret > 0) + { + TFE_LOG_INFO(g_doh_conf->local_logger, "SCAN_SRC_LOCATION, Hit location: %s scan ret: %d policy_id: %d service: %d action: %d addr: %s", + buff, scan_ret, result[hit_cnt + hit_cnt_ip].config_id, result[hit_cnt + hit_cnt_ip].service_id, result[hit_cnt + hit_cnt_ip].action, ctx->addr_string); + hit_cnt_ip += scan_ret; + } + else + { + TFE_LOG_INFO(g_doh_conf->local_logger, "SCAN_SRC_LOCATION, NO hit location: %s scan ret: %d addr: %s", + buff, scan_ret, ctx->addr_string); + } + + memset(buff, 0, sizeof(buff)); + snprintf(buff, sizeof(buff), "%s,%s,%s", ip_location_client->city_full, ip_location_client->province_full, ip_location_client->country_full); + ctx->location_client = tfe_strdup(buff); + } + + if (ip_location_server) + ip_table_free(ip_location_server); + if (ip_location_client) + ip_table_free(ip_location_client); + return hit_cnt_ip; +} + +static int doh_ip_asn_scan(struct Maat_rule_t *result, struct ip_address *sip, struct ip_address *dip, int hit_cnt, unsigned int thread_id, struct doh_ctx *ctx) +{ + int scan_ret = 0, hit_cnt_ip = 0; + char buff[TFE_STRING_MAX] = {0}; + struct ip_data_table *ip_asn_client = NULL, *ip_asn_server = NULL; + int is_src_use_user_defined = 1; + int is_dst_use_user_defined = 1; + + Maat_ip_plugin_get_EX_data(g_doh_conf->maat, tfe_bussiness_tableid_get(TABLE_IP_ASN_USER_DEFINED), sip, (void **)&ip_asn_client, 1); + Maat_ip_plugin_get_EX_data(g_doh_conf->maat, tfe_bussiness_tableid_get(TABLE_IP_ASN_USER_DEFINED), dip, (void **)&ip_asn_server, 1); + + if (ip_asn_client == NULL) + { + is_src_use_user_defined = 0; + Maat_ip_plugin_get_EX_data(g_doh_conf->maat, tfe_bussiness_tableid_get(TABLE_IP_ASN_BUILT_IN), sip, (void **)&ip_asn_client, 1); + } + if (ip_asn_server == NULL) + { + is_dst_use_user_defined = 0; + Maat_ip_plugin_get_EX_data(g_doh_conf->maat, tfe_bussiness_tableid_get(TABLE_IP_ASN_BUILT_IN), dip, (void **)&ip_asn_server, 1); + } + + if (ip_asn_server != NULL) + { + TFE_LOG_INFO(g_doh_conf->local_logger, "scan dst ip use IP_ASN_%s, profile_id: %d ref_cnt: %d asn: %s organization: %s country: %s province: %s city: %s addr: %s", + (is_dst_use_user_defined ? "USER_DEFINED" : "BUILT_IN"), ip_asn_server->profile_id, ip_asn_server->ref_cnt, ip_asn_server->asn, + ip_asn_server->organization, ip_asn_server->country_full, ip_asn_server->province_full, ip_asn_server->city_full, ctx->addr_string); + + scan_ret = Maat_full_scan_string(g_doh_conf->maat, tfe_bussiness_tableid_get(TABLE_SECURITY_DESTINATION_ASN), + CHARSET_UTF8, ip_asn_server->asn, strlen(ip_asn_server->asn), + result + hit_cnt + hit_cnt_ip, NULL, MAX_SCAN_RESULT - hit_cnt - hit_cnt_ip, + &(ctx->scan_mid), (int)thread_id); + if (scan_ret > 0) + { + TFE_LOG_INFO(g_doh_conf->local_logger, "SCAN_DST_ASN, Hit asn: %s scan ret: %d policy_id: %d service: %d action: %d addr: %s", + ip_asn_server->asn, scan_ret, result[hit_cnt + hit_cnt_ip].config_id, result[hit_cnt + hit_cnt_ip].service_id, result[hit_cnt + hit_cnt_ip].action, ctx->addr_string); + hit_cnt_ip += scan_ret; + } + else + { + TFE_LOG_INFO(g_doh_conf->local_logger, "SCAN_DST_ASN, NO hit asn: %s scan ret: %d addr: %s", + ip_asn_server->asn, scan_ret, ctx->addr_string); + } + + memset(buff, 0, sizeof(buff)); + snprintf(buff, sizeof(buff), "%s(%s)", ip_asn_server->asn, ip_asn_server->organization); + ctx->asn_server = tfe_strdup(buff); + } + if (ip_asn_client != NULL) + { + TFE_LOG_INFO(g_doh_conf->local_logger, "scan src ip use IP_ASN_%s, profile_id: %d ref_cnt: %d asn: %s organization: %s country: %s province: %s city: %s addr: %s", + (is_src_use_user_defined ? "USER_DEFINED" : "BUILT_IN"), ip_asn_client->profile_id, ip_asn_client->ref_cnt, ip_asn_client->asn, + ip_asn_client->organization, ip_asn_client->country_full, ip_asn_client->province_full, ip_asn_client->city_full, ctx->addr_string); + + scan_ret = Maat_full_scan_string(g_doh_conf->maat, tfe_bussiness_tableid_get(TABLE_SECURITY_SOURCE_ASN), + CHARSET_UTF8, ip_asn_client->asn, strlen(ip_asn_client->asn), + result + hit_cnt + hit_cnt_ip, NULL, MAX_SCAN_RESULT - hit_cnt - hit_cnt_ip, + &(ctx->scan_mid), (int)thread_id); + if (scan_ret > 0) + { + TFE_LOG_INFO(g_doh_conf->local_logger, "SCAN_SRC_ASN, Hit asn: %s scan ret: %d policy_id: %d service: %d action: %d addr: %s", + ip_asn_client->asn, scan_ret, result[hit_cnt + hit_cnt_ip].config_id, result[hit_cnt + hit_cnt_ip].service_id, result[hit_cnt + hit_cnt_ip].action, ctx->addr_string); + hit_cnt_ip += scan_ret; + } + else + { + TFE_LOG_INFO(g_doh_conf->local_logger, "SCAN_SRC_ASN, NO hit asn: %s scan ret: %d addr: %s", + ip_asn_client->asn, scan_ret, ctx->addr_string); + } + + memset(buff, 0, sizeof(buff)); + snprintf(buff, sizeof(buff), "%s(%s)", ip_asn_client->asn, ip_asn_client->organization); + ctx->asn_client = tfe_strdup(buff); + } + if (ip_asn_server) + ip_table_free(ip_asn_server); + if (ip_asn_client) + ip_table_free(ip_asn_client); + + return hit_cnt_ip; +} + static void doh_maat_scan(const struct tfe_stream *stream, const struct tfe_http_session *session, struct doh_ctx *ctx, char *qname, int qtype) { int hit_cnt = 0; @@ -208,6 +374,20 @@ static void doh_maat_scan(const struct tfe_stream *stream, const struct tfe_http struct Maat_rule_t *p_result = NULL; struct Maat_rule_t result[MAX_SCAN_RESULT]; + struct ip_address dest_ip, source_ip; + tfe_stream_addr_to_address(stream->addr, &dest_ip, &source_ip); + scan_ret = doh_ip_location_scan(result, &source_ip, &dest_ip, hit_cnt, ctx->thread_id, ctx); + if (scan_ret > 0) + { + hit_cnt += scan_ret; + } + + scan_ret = doh_ip_asn_scan(result, &source_ip, &dest_ip, hit_cnt, ctx->thread_id, ctx); + if (scan_ret > 0) + { + hit_cnt += scan_ret; + } + // scan server host const char *host = session->req->req_spec.host; if (host) @@ -216,9 +396,9 @@ static void doh_maat_scan(const struct tfe_stream *stream, const struct tfe_http host, strlen(host), result + hit_cnt, NULL, MAX_SCAN_RESULT - hit_cnt, &(ctx->scan_mid), ctx->thread_id); if (scan_ret > 0) { - hit_cnt += scan_ret; TFE_LOG_INFO(g_doh_conf->local_logger, "SCAN_HOST, Hit host: %s scan ret: %d policy_id: %d service: %d action: %d addr: %s", host, scan_ret, result[hit_cnt].config_id, result[hit_cnt].service_id, result[hit_cnt].action, ctx->addr_string); + hit_cnt += scan_ret; } else { @@ -233,9 +413,9 @@ static void doh_maat_scan(const struct tfe_stream *stream, const struct tfe_http 0, result + hit_cnt, MAX_SCAN_RESULT - hit_cnt, &(ctx->scan_mid), ctx->thread_id); if (scan_ret > 0) { - hit_cnt += scan_ret; TFE_LOG_INFO(g_doh_conf->local_logger, "SCAN_ADDR, Hit addr: %s scan ret: %d policy_id: %d service: %d action: %d", ctx->addr_string, scan_ret, result[hit_cnt].config_id, result[hit_cnt].service_id, result[hit_cnt].action); + hit_cnt += scan_ret; } else { @@ -248,9 +428,9 @@ static void doh_maat_scan(const struct tfe_stream *stream, const struct tfe_http app_id, strlen(app_id), result + hit_cnt, NULL, MAX_SCAN_RESULT - hit_cnt, &(ctx->scan_mid), ctx->thread_id); if (scan_ret > 0) { - hit_cnt += scan_ret; TFE_LOG_INFO(g_doh_conf->local_logger, "SCAN_APPID, Hit proto: %s scan ret: %d policy_id: %d service: %d action: %d addr: %s", app_id, scan_ret, result[hit_cnt].config_id, result[hit_cnt].service_id, result[hit_cnt].action, ctx->addr_string); + hit_cnt += scan_ret; } else { @@ -263,9 +443,9 @@ static void doh_maat_scan(const struct tfe_stream *stream, const struct tfe_http qname, strlen(qname), result + hit_cnt, NULL, MAX_SCAN_RESULT - hit_cnt, &(ctx->scan_mid), ctx->thread_id); if (scan_ret > 0) { - hit_cnt += scan_ret; TFE_LOG_INFO(g_doh_conf->local_logger, "SCAN_QNAME, Hit domain: %s scan ret: %d qtype: %d policy_id: %d service: %d action: %d addr: %s", qname, scan_ret, qtype, result[hit_cnt].config_id, result[hit_cnt].service_id, result[hit_cnt].action, ctx->addr_string); + hit_cnt += scan_ret; } else { @@ -389,6 +569,30 @@ static void doh_ctx_free(struct doh_ctx *ctx) ctx->addr_string = NULL; } + if (ctx->asn_client) + { + free(ctx->asn_client); + ctx->asn_client = NULL; + } + + if (ctx->asn_server) + { + free(ctx->asn_server); + ctx->asn_server = NULL; + } + + if (ctx->location_client) + { + free(ctx->location_client); + ctx->location_client = NULL; + } + + if (ctx->location_server) + { + free(ctx->location_server); + ctx->location_server = NULL; + } + FREE(&ctx); } diff --git a/plugin/business/doh/src/logger.cpp b/plugin/business/doh/src/logger.cpp index e2f0e76..fc34a9d 100644 --- a/plugin/business/doh/src/logger.cpp +++ b/plugin/business/doh/src/logger.cpp @@ -418,6 +418,23 @@ int doh_send_log(struct doh_conf *handle, const struct tfe_http_session *http, c } } + if (ctx->location_client) + { + cJSON_AddStringToObject(common_obj, "common_client_location", ctx->location_client); + } + if (ctx->location_server) + { + cJSON_AddStringToObject(common_obj, "common_server_location", ctx->location_server); + } + if (ctx->asn_client) + { + cJSON_AddStringToObject(common_obj, "common_client_asn", ctx->asn_client); + } + if (ctx->asn_server) + { + cJSON_AddStringToObject(common_obj, "common_server_asn", ctx->asn_server); + } + add_dns_info_to_log(common_obj, dns_info); for (size_t i = 0; i < result_num; i++) { diff --git a/plugin/business/doh/src/pub.h b/plugin/business/doh/src/pub.h index 36a013a..dbf7288 100644 --- a/plugin/business/doh/src/pub.h +++ b/plugin/business/doh/src/pub.h @@ -89,6 +89,11 @@ struct doh_ctx enum doh_content_type type; struct evbuffer *http_req_body; dns_info_t *doh_req; + + char *asn_client; + char *asn_server; + char *location_client; + char *location_server; }; int base64_encode(char *dst, int dstlen, const char *src, int srclen); diff --git a/plugin/business/pangu-http/src/pangu_http.cpp b/plugin/business/pangu-http/src/pangu_http.cpp index e1b242e..fe4917e 100644 --- a/plugin/business/pangu-http/src/pangu_http.cpp +++ b/plugin/business/pangu-http/src/pangu_http.cpp @@ -65,10 +65,6 @@ enum scan_table PXY_CTRL_HTTP_RES_HDR, PXY_CTRL_HTTP_RES_BODY, PXY_CTRL_SUBSCRIBE_ID, - PXY_CTRL_IP_SRC_ASN, - PXY_CTRL_IP_DST_ASN, - PXY_CTRL_IP_SRC_LOCATION, - PXY_CTRL_IP_DST_LOCATION, PXY_CTRL_APP_ID, __SCAN_TABLE_MAX }; @@ -95,10 +91,6 @@ enum manipulate_profile_table POLICY_PROFLIE_TABLE_REJECT, POLICY_PROFILE_TABLE_INSERT, POLICY_PROFILE_TABLE_HIJACK, - POLICY_ASN_USER_DEFINED, - POLICY_ASN_BUILT_IN, - POLICY_LOCATION_USER_DEFINED, - POLICY_LOCATION_BUILT_IN, POLICY_PROFILE_TABLE_MAX }; @@ -115,22 +107,6 @@ struct manipulate_profile pthread_mutex_t lock; }; -struct ip_data_table -{ - int profile_id; - - int ref_cnt; - - char *asn; - char *organization; - - char *country_full; - char *province_full; - char *city_full; - - pthread_mutex_t lock; -}; - struct policy_action_param { int ref_cnt; @@ -767,161 +743,11 @@ int maat_table_init(const char* table_name, return table_id; } -static char* tfe_unescape(char* s) -{ - int i=0,j=0; - int len=strlen(s); - for(i=0,j=0;ilocal_logger, "Policy table parse ip ASN failed, ret:%d, %s", ret, table_line); - return; - } - tfe_unescape(organization); - - struct ip_data_table* ip_asn=ALLOC(struct ip_data_table, 1); - memset(ip_asn, 0, sizeof(struct ip_data_table)); - ip_asn->profile_id=profile_id; - ip_asn->asn=tfe_strdup(asn); - ip_asn->organization=tfe_strdup(organization); - ip_asn->ref_cnt=1; - pthread_mutex_init(&(ip_asn->lock), NULL); - - TFE_LOG_INFO(g_pangu_rt->local_logger, "Policy table add success %d", profile_id); - - *ad = ip_asn; -} - -void ip_location_table_new_cb(int table_id, const char* key, const char* table_line, MAAT_PLUGIN_EX_DATA* ad, long argl, void* argp) -{ - int ret=0,profile_id=0,is_valid=0; - int geoname_id=0, addr_type=0; - double latitude, longitude, coords; - char language[40], start_ip[40], end_ip[40]; - char continent_abbr[TFE_PATH_MAX],continent_full[TFE_PATH_MAX]; - char country_abbr[TFE_PATH_MAX],province_abbr[TFE_PATH_MAX], time_zone[TFE_PATH_MAX]; - char country_full[TFE_PATH_MAX],province_full[TFE_PATH_MAX], city_full[TFE_PATH_MAX]; - - ret=sscanf(table_line, "%d\t%d\t%d\t%s\t%s\t%lf\t%lf\t%lf\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%d", &profile_id,&geoname_id, - &addr_type, start_ip,end_ip,&latitude,&longitude,&coords,language, - continent_abbr,continent_full, country_abbr,country_full,province_abbr,province_full, - city_full,time_zone,&is_valid); - - if(ret!=18) - { - TFE_LOG_ERROR(g_pangu_rt->local_logger, "Policy table parse ip location failed, ret:%d, %s", ret, table_line); - return; - } - tfe_unescape(continent_full); - tfe_unescape(country_full); - tfe_unescape(province_full); - tfe_unescape(city_full); - - struct ip_data_table* ip_asn=ALLOC(struct ip_data_table, 1); - memset(ip_asn, 0, sizeof(struct ip_data_table)); - ip_asn->profile_id=profile_id; - ip_asn->country_full=tfe_strdup(country_full); - ip_asn->province_full=tfe_strdup(province_full); - ip_asn->city_full=tfe_strdup(city_full); - ip_asn->ref_cnt=1; - pthread_mutex_init(&(ip_asn->lock), NULL); - - TFE_LOG_INFO(g_pangu_rt->local_logger, "Policy table add success %d", profile_id); - - *ad = ip_asn; -} - -void ip_table_dup_cb(int table_id, MAAT_PLUGIN_EX_DATA *to, MAAT_PLUGIN_EX_DATA *from, long argl, void* argp) -{ - struct ip_data_table* ip_asn=(struct ip_data_table*)(*from); - pthread_mutex_lock(&(ip_asn->lock)); - ip_asn->ref_cnt++; - pthread_mutex_unlock(&(ip_asn->lock)); - *to=ip_asn; -} - -void ip_table_free_cb(int table_id, MAAT_PLUGIN_EX_DATA* ad, long argl, void* argp) -{ - if(*ad==NULL) - { - return; - } - struct ip_data_table* ip_asn=(struct ip_data_table*)(*ad); - pthread_mutex_lock(&(ip_asn->lock)); - ip_asn->ref_cnt--; - if(ip_asn->ref_cnt>0) - { - pthread_mutex_unlock(&(ip_asn->lock)); - return; - } - pthread_mutex_unlock(&(ip_asn->lock)); - pthread_mutex_destroy(&(ip_asn->lock)); - - if(ip_asn->asn) FREE(&ip_asn->asn); - if(ip_asn->organization) FREE(&ip_asn->organization); - if(ip_asn->country_full) FREE(&ip_asn->country_full); - if(ip_asn->province_full) FREE(&ip_asn->province_full); - if(ip_asn->city_full) FREE(&ip_asn->city_full); - - FREE(&ip_asn); - *ad=NULL; - return; -} - -void ip_table_free(struct ip_data_table* ip_asn) -{ - ip_table_free_cb(0, (void **)&ip_asn, 0, NULL); -} - const char* table_name_idx2str(int profile_idx) { const char *table_name_map[] = {"TSG_PROFILE_RESPONSE_PAGES", "PXY_PROFILE_INSERT_SCRIPTS", - "PXY_PROFILE_HIJACK_FILES", - "TSG_IP_ASN_USER_DEFINED", - "TSG_IP_ASN_BUILT_IN", - "TSG_IP_LOCATION_USER_DEFINED", - "TSG_IP_LOCATION_BUILT_IN"}; + "PXY_PROFILE_HIJACK_FILES"}; return table_name_map[profile_idx]; } @@ -953,34 +779,6 @@ int maat_table_ex_init(int profile_idx, return -1; } -int maat_ip_table_init(int profile_idx, - Maat_plugin_EX_free_func_t* free_func, - Maat_plugin_EX_dup_func_t* dup_func) -{ - int table_id=0; - - Maat_plugin_EX_new_func_t *new_func[] = { - [POLICY_PROFLIE_TABLE_REJECT] = NULL, - [POLICY_PROFILE_TABLE_INSERT] = NULL, - [POLICY_PROFILE_TABLE_HIJACK] = NULL, - [POLICY_ASN_USER_DEFINED] = ip_asn_table_new_cb, - [POLICY_ASN_BUILT_IN] = ip_asn_table_new_cb, - [POLICY_LOCATION_USER_DEFINED] = ip_location_table_new_cb, - [POLICY_LOCATION_BUILT_IN] = ip_location_table_new_cb, - }; - - const char *table_name = table_name_idx2str(profile_idx); - table_id=g_pangu_rt->plolicy_table_id[profile_idx]=Maat_table_register(g_pangu_rt->maat, table_name); - if(table_id >= 0) - { - table_id=Maat_ip_plugin_EX_register(g_pangu_rt->maat, table_id, new_func[profile_idx], free_func, dup_func, - 0, NULL); - return 0; - } - TFE_LOG_INFO(NULL, "Pangu HTTP register table %s failed.", table_name); - return -1; -} - int pangu_policy_init(const char* profile_path, const char* static_section, const char* dynamic_section) { int ret = 0; @@ -995,10 +793,6 @@ int pangu_policy_init(const char* profile_path, const char* static_section, cons table_name[PXY_CTRL_HTTP_RES_HDR] = "TSG_FIELD_HTTP_RES_HDR"; table_name[PXY_CTRL_HTTP_RES_BODY] = "TSG_FIELD_HTTP_RES_CONTENT"; table_name[PXY_CTRL_SUBSCRIBE_ID] = "TSG_OBJ_SUBSCRIBER_ID"; - table_name[PXY_CTRL_IP_SRC_ASN]="TSG_SECURITY_SOURCE_ASN"; - table_name[PXY_CTRL_IP_DST_ASN]="TSG_SECURITY_DESTINATION_ASN"; - table_name[PXY_CTRL_IP_SRC_LOCATION]="TSG_SECURITY_SOURCE_LOCATION"; - table_name[PXY_CTRL_IP_DST_LOCATION]="TSG_SECURITY_DESTINATION_LOCATION"; table_name[PXY_CTRL_APP_ID] = "TSG_OBJ_APP_ID"; for (int i = 0; i < __SCAN_TABLE_MAX; i++) { @@ -1046,14 +840,6 @@ int pangu_policy_init(const char* profile_path, const char* static_section, cons goto error_out; } } - for(int i = POLICY_ASN_USER_DEFINED; i < POLICY_PROFILE_TABLE_MAX; i++) - { - ret = maat_ip_table_init(i, ip_table_free_cb, ip_table_dup_cb); - if(ret<0) - { - goto error_out; - } - } g_pangu_rt->dyn_maat = (Maat_feather_t)tfe_bussiness_resouce_get(DYNAMINC_MAAT); g_pangu_rt->subscriber_id_table_id=Maat_table_register(g_pangu_rt->dyn_maat, "TSG_DYN_SUBSCRIBER_IP"); @@ -2657,22 +2443,22 @@ int http_ip_location_scan(struct Maat_rule_t *result, struct ip_address *sip, st char buff[TFE_STRING_MAX]={0}; struct ip_data_table* ip_location_client=NULL, *ip_location_server=NULL; - Maat_ip_plugin_get_EX_data(g_pangu_rt->maat, g_pangu_rt->plolicy_table_id[POLICY_LOCATION_USER_DEFINED], sip, (void **)&ip_location_client, 1); - Maat_ip_plugin_get_EX_data(g_pangu_rt->maat, g_pangu_rt->plolicy_table_id[POLICY_LOCATION_USER_DEFINED], dip, (void **)&ip_location_server, 1); + Maat_ip_plugin_get_EX_data(g_pangu_rt->maat, tfe_bussiness_tableid_get(TABLE_IP_LOCATION_USER_DEFINED), sip, (void **)&ip_location_client, 1); + Maat_ip_plugin_get_EX_data(g_pangu_rt->maat, tfe_bussiness_tableid_get(TABLE_IP_LOCATION_USER_DEFINED), dip, (void **)&ip_location_server, 1); if (ip_location_client == NULL) { - Maat_ip_plugin_get_EX_data(g_pangu_rt->maat, g_pangu_rt->plolicy_table_id[POLICY_LOCATION_BUILT_IN], sip, (void **)&ip_location_client, 1); + Maat_ip_plugin_get_EX_data(g_pangu_rt->maat, tfe_bussiness_tableid_get(TABLE_IP_LOCATION_BUILT_IN), sip, (void **)&ip_location_client, 1); } if (ip_location_server == NULL) { - Maat_ip_plugin_get_EX_data(g_pangu_rt->maat, g_pangu_rt->plolicy_table_id[POLICY_LOCATION_BUILT_IN], dip, (void **)&ip_location_server, 1); + Maat_ip_plugin_get_EX_data(g_pangu_rt->maat, tfe_bussiness_tableid_get(TABLE_IP_LOCATION_BUILT_IN), dip, (void **)&ip_location_server, 1); } if(ip_location_server!=NULL) { snprintf(buff, sizeof(buff), "%s.%s.", ip_location_server->country_full, ip_location_server->city_full); - scan_ret = Maat_full_scan_string(g_pangu_rt->maat, g_pangu_rt->scan_table_id[PXY_CTRL_IP_DST_LOCATION], + scan_ret = Maat_full_scan_string(g_pangu_rt->maat, tfe_bussiness_tableid_get(TABLE_SECURITY_DESTINATION_LOCATION), CHARSET_GBK, buff, strlen(buff), result+hit_cnt, NULL, MAX_SCAN_RESULT-hit_cnt, &(ctx->scan_mid), (int) thread_id); @@ -2687,9 +2473,9 @@ int http_ip_location_scan(struct Maat_rule_t *result, struct ip_address *sip, st if(ip_location_client!=NULL) { snprintf(buff, sizeof(buff), "%s.%s.", ip_location_client->country_full, ip_location_client->city_full); - scan_ret = Maat_full_scan_string(g_pangu_rt->maat, g_pangu_rt->scan_table_id[PXY_CTRL_IP_SRC_LOCATION], + scan_ret = Maat_full_scan_string(g_pangu_rt->maat, tfe_bussiness_tableid_get(TABLE_SECURITY_SOURCE_LOCATION), CHARSET_GBK, buff, strlen(buff), - result+hit_cnt, NULL, MAX_SCAN_RESULT-hit_cnt, + result+hit_cnt+hit_cnt_ip, NULL, MAX_SCAN_RESULT-hit_cnt-hit_cnt_ip, &(ctx->scan_mid), (int) thread_id); if(scan_ret>0) { @@ -2713,21 +2499,21 @@ int http_ip_asn_scan(struct Maat_rule_t *result, struct ip_address* sip, struct char buff[TFE_STRING_MAX]={0}; struct ip_data_table* ip_asn_client=NULL, *ip_asn_server=NULL; - Maat_ip_plugin_get_EX_data(g_pangu_rt->maat, g_pangu_rt->plolicy_table_id[POLICY_ASN_USER_DEFINED], sip, (void **)&ip_asn_client, 1); - Maat_ip_plugin_get_EX_data(g_pangu_rt->maat, g_pangu_rt->plolicy_table_id[POLICY_ASN_USER_DEFINED], dip, (void **)&ip_asn_server, 1); + Maat_ip_plugin_get_EX_data(g_pangu_rt->maat, tfe_bussiness_tableid_get(TABLE_IP_ASN_USER_DEFINED), sip, (void **)&ip_asn_client, 1); + Maat_ip_plugin_get_EX_data(g_pangu_rt->maat, tfe_bussiness_tableid_get(TABLE_IP_ASN_USER_DEFINED), dip, (void **)&ip_asn_server, 1); if (ip_asn_client == NULL) { - Maat_ip_plugin_get_EX_data(g_pangu_rt->maat, g_pangu_rt->plolicy_table_id[POLICY_ASN_BUILT_IN], sip, (void **)&ip_asn_client, 1); + Maat_ip_plugin_get_EX_data(g_pangu_rt->maat, tfe_bussiness_tableid_get(TABLE_IP_ASN_BUILT_IN), sip, (void **)&ip_asn_client, 1); } if (ip_asn_server == NULL) { - Maat_ip_plugin_get_EX_data(g_pangu_rt->maat, g_pangu_rt->plolicy_table_id[POLICY_ASN_BUILT_IN], dip, (void **)&ip_asn_server, 1); + Maat_ip_plugin_get_EX_data(g_pangu_rt->maat, tfe_bussiness_tableid_get(TABLE_IP_ASN_BUILT_IN), dip, (void **)&ip_asn_server, 1); } if(ip_asn_server!=NULL) { - scan_ret = Maat_full_scan_string(g_pangu_rt->maat, g_pangu_rt->scan_table_id[PXY_CTRL_IP_DST_ASN], + scan_ret = Maat_full_scan_string(g_pangu_rt->maat, tfe_bussiness_tableid_get(TABLE_SECURITY_DESTINATION_ASN), CHARSET_UTF8, ip_asn_server->asn, strlen(ip_asn_server->asn), result+hit_cnt, NULL, MAX_SCAN_RESULT-hit_cnt, &(ctx->scan_mid), (int) thread_id); @@ -2741,9 +2527,9 @@ int http_ip_asn_scan(struct Maat_rule_t *result, struct ip_address* sip, struct } if(ip_asn_client!=NULL) { - scan_ret = Maat_full_scan_string(g_pangu_rt->maat, g_pangu_rt->scan_table_id[PXY_CTRL_IP_SRC_ASN], + scan_ret = Maat_full_scan_string(g_pangu_rt->maat, tfe_bussiness_tableid_get(TABLE_SECURITY_SOURCE_ASN), CHARSET_UTF8, ip_asn_client->asn, strlen(ip_asn_client->asn), - result+hit_cnt, NULL, MAX_SCAN_RESULT-hit_cnt, + result+hit_cnt+hit_cnt_ip, NULL, MAX_SCAN_RESULT-hit_cnt-hit_cnt_ip, &(ctx->scan_mid), (int) thread_id); if(scan_ret>0) { @@ -2759,30 +2545,6 @@ int http_ip_asn_scan(struct Maat_rule_t *result, struct ip_address* sip, struct return hit_cnt_ip; } -int tfe_stream_addr_to_address(const struct tfe_stream_addr *addr, struct ip_address *dest_ip, struct ip_address *source_ip) -{ - if(addr==NULL) return -1; - if (addr->addrtype == TFE_ADDR_STREAM_TUPLE4_V4) - { - const struct tfe_stream_addr_tuple4_v4 * tuple4_v4 = addr->tuple4_v4; - source_ip->ip_type=4; - source_ip->ipv4=tuple4_v4->saddr.s_addr; - - dest_ip->ip_type=4; - dest_ip->ipv4=tuple4_v4->daddr.s_addr; - } - if (addr->addrtype == TFE_ADDR_STREAM_TUPLE4_V6) - { - const struct tfe_stream_addr_tuple4_v6 * tuple4_v6 = addr->tuple4_v6; - source_ip->ip_type=6; - memcpy((char *)(source_ip->ipv6), tuple4_v6->saddr.__in6_u.__u6_addr32, IPV6_ADDR_LEN); - - dest_ip->ip_type=6; - memcpy((char *)(dest_ip->ipv6),tuple4_v6->daddr.__in6_u.__u6_addr32, IPV6_ADDR_LEN); - } - return 0; -} - void pangu_on_http_begin(const struct tfe_stream * stream, const struct tfe_http_session * session, unsigned int thread_id, void ** pme) {