gfwleak/tango-tfe
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

TSG-2489 DOH 支持 IP 归属地

Browse Source 
* tfe maat IP 归属地回调表的注册从 pangu 移动到 tfe_resource 中
	* 修复 Pangu IP 归属地 SRC && DST 同时命中时 maat 计数的 bug
This commit is contained in:
luwenpeng
2020-07-15 11:30:11 +08:00
parent 39bff0023c
commit 444b9c7935
11 changed files with 518 additions and 264 deletions
Download Patch File Download Diff File Expand all files Collapse all files

32
common/include/tfe_resource.h
View File

@@ -8,5 +8,35 @@ enum RESOURCE_TYPE
DEVICE_ID, DEVICE_ID,
}; };
enum TABLE_TYPE
{
TABLE_IP_ASN_USER_DEFINED,
TABLE_IP_ASN_BUILT_IN,
TABLE_IP_LOCATION_USER_DEFINED,
TABLE_IP_LOCATION_BUILT_IN,
TABLE_SECURITY_SOURCE_ASN,
TABLE_SECURITY_DESTINATION_ASN,
TABLE_SECURITY_SOURCE_LOCATION,
TABLE_SECURITY_DESTINATION_LOCATION,
TABLE_TYPE_MAX
};
struct ip_data_table
{
int profile_id;
int ref_cnt;
char *asn;
char *organization;
char *country_full;
char *province_full;
char *city_full;
pthread_mutex_t lock;
};
int tfe_bussiness_resouce_init(); int tfe_bussiness_resouce_init();
void *tfe_bussiness_resouce_get(enum RESOURCE_TYPE type); void *tfe_bussiness_resouce_get(enum RESOURCE_TYPE type);
int tfe_bussiness_tableid_get(enum TABLE_TYPE type);
void ip_table_free(struct ip_data_table *ip_asn);

4
common/include/tfe_types.h
View File

@@ -159,6 +159,4 @@ struct tfe_stream_addr * tfe_stream_addr_reverse(struct tfe_stream_addr * orin);
char* tfe_string_addr_create_by_fd(int fd, enum tfe_conn_dir dir); char* tfe_string_addr_create_by_fd(int fd, enum tfe_conn_dir dir);
char * tfe_stream_addr_to_str(const struct tfe_stream_addr * addr); char * tfe_stream_addr_to_str(const struct tfe_stream_addr * addr);
int tfe_stream_addr_str_split(char* addr_str, const char** sip, const char** sport, const char** dip, const char** dport); int tfe_stream_addr_str_split(char* addr_str, const char** sip, const char** sport, const char** dip, const char** dport);
int tfe_stream_addr_to_address(const struct tfe_stream_addr *addr, struct ip_address *dest_ip, struct ip_address *source_ip);

2
common/include/tfe_utils.h
View File

@@ -176,4 +176,4 @@ const char * tfe_version();
int __wrapper_MESA_htable_set_opt(MESA_htable_handle table, enum MESA_htable_opt opt_type, unsigned value); int __wrapper_MESA_htable_set_opt(MESA_htable_handle table, enum MESA_htable_opt opt_type, unsigned value);
int __wrapper_MESA_htable_set_opt(MESA_htable_handle table, enum MESA_htable_opt opt_type, void * val, size_t len); int __wrapper_MESA_htable_set_opt(MESA_htable_handle table, enum MESA_htable_opt opt_type, void * val, size_t len);
int tfe_decode_base64url(u_char *dst, u_char *src); int tfe_decode_base64url(u_char *dst, u_char *src);
char *tfe_unescape(char *s);

175
common/src/tfe_resource.cpp
View File

@@ -10,6 +10,14 @@
#define MAAT_INPUT_REDIS 1 #define MAAT_INPUT_REDIS 1
#define MAAT_INPUT_FILE 2 #define MAAT_INPUT_FILE 2
struct maat_table_info
{
int id;
char *name;
Maat_plugin_EX_new_func_t *new_func;
Maat_plugin_EX_dup_func_t *dup_func;
Maat_plugin_EX_free_func_t *free_func;
};
static Maat_feather_t static_maat = NULL; static Maat_feather_t static_maat = NULL;
static Maat_feather_t dynamic_maat = NULL; static Maat_feather_t dynamic_maat = NULL;
static tfe_kafka_logger_t *kafka_logger = NULL; static tfe_kafka_logger_t *kafka_logger = NULL;
@@ -27,6 +35,7 @@ static Maat_feather_t create_maat_feather(const char *instance_name, const char
int redis_port_begin = 0, redis_port_end = 0; int redis_port_begin = 0, redis_port_end = 0;
int redis_port_select = 0; int redis_port_select = 0;
int redis_db_idx = 0; int redis_db_idx = 0;
int deferred_load_on = 0;
char json_cfg_file[TFE_STRING_MAX] = {0}, maat_stat_file[TFE_STRING_MAX] = {0}; char json_cfg_file[TFE_STRING_MAX] = {0}, maat_stat_file[TFE_STRING_MAX] = {0};
MESA_load_profile_int_def(profile, section, "maat_input_mode", &(input_mode), 0); MESA_load_profile_int_def(profile, section, "maat_input_mode", &(input_mode), 0);
@@ -42,6 +51,7 @@ static Maat_feather_t create_maat_feather(const char *instance_name, const char
MESA_load_profile_string_def(profile, section, "full_cfg_dir", ful_cfg_dir, sizeof(ful_cfg_dir), ""); MESA_load_profile_string_def(profile, section, "full_cfg_dir", ful_cfg_dir, sizeof(ful_cfg_dir), "");
MESA_load_profile_string_def(profile, section, "stat_file", maat_stat_file, sizeof(maat_stat_file), ""); MESA_load_profile_string_def(profile, section, "stat_file", maat_stat_file, sizeof(maat_stat_file), "");
MESA_load_profile_int_def(profile, section, "effect_interval_s", &(effect_interval), 60); MESA_load_profile_int_def(profile, section, "effect_interval_s", &(effect_interval), 60);
MESA_load_profile_int_def(profile, section, "deferred_load_on", &(deferred_load_on), 0);
effect_interval *= 1000; //convert s to ms effect_interval *= 1000; //convert s to ms
@@ -119,6 +129,7 @@ static Maat_feather_t create_maat_feather(const char *instance_name, const char
} }
} }
Maat_set_feather_opt(target, MAAT_OPT_DEFERRED_LOAD, &deferred_load_on, sizeof(deferred_load_on));
Maat_set_feather_opt(target, MAAT_OPT_EFFECT_INVERVAL_MS, &effect_interval, sizeof(effect_interval)); Maat_set_feather_opt(target, MAAT_OPT_EFFECT_INVERVAL_MS, &effect_interval, sizeof(effect_interval));
Maat_set_feather_opt(target, MAAT_OPT_SCAN_DETAIL, &scan_detail, sizeof(scan_detail)); Maat_set_feather_opt(target, MAAT_OPT_SCAN_DETAIL, &scan_detail, sizeof(scan_detail));
if (strlen(accept_tags) > 0) if (strlen(accept_tags) > 0)
@@ -219,6 +230,160 @@ finish:
return (char *)device_def_id; return (char *)device_def_id;
} }
static void ip_asn_table_new_cb(int table_id, const char *key, const char *table_line, MAAT_PLUGIN_EX_DATA *ad, long argl, void *argp)
{
int addr_type;
int ret = 0, profile_id = 0, is_valid = 0;
char start_ip[40], end_ip[40], asn[40] = {0};
char organization[TFE_PATH_MAX];
ret = sscanf(table_line, "%d\t%d\t%s\t%s\t%s\t%s\t%d", &profile_id, &addr_type, start_ip, end_ip, asn, organization, &is_valid);
if (ret != 7)
{
TFE_LOG_ERROR(g_default_logger, "Policy table parse ip ASN failed, ret:%d, %s", ret, table_line);
return;
}
tfe_unescape(organization);
struct ip_data_table *ip_asn = ALLOC(struct ip_data_table, 1);
memset(ip_asn, 0, sizeof(struct ip_data_table));
ip_asn->profile_id = profile_id;
ip_asn->asn = tfe_strdup(asn);
ip_asn->organization = tfe_strdup(organization);
ip_asn->ref_cnt = 1;
pthread_mutex_init(&(ip_asn->lock), NULL);
TFE_LOG_INFO(g_default_logger, "Policy table add success %d", profile_id);
*ad = ip_asn;
}
static void ip_location_table_new_cb(int table_id, const char *key, const char *table_line, MAAT_PLUGIN_EX_DATA *ad, long argl, void *argp)
{
int ret = 0, profile_id = 0, is_valid = 0;
int geoname_id = 0, addr_type = 0;
double latitude, longitude, coords;
char language[40], start_ip[40], end_ip[40];
char continent_abbr[TFE_PATH_MAX], continent_full[TFE_PATH_MAX];
char country_abbr[TFE_PATH_MAX], province_abbr[TFE_PATH_MAX], time_zone[TFE_PATH_MAX];
char country_full[TFE_PATH_MAX], province_full[TFE_PATH_MAX], city_full[TFE_PATH_MAX];
ret = sscanf(table_line, "%d\t%d\t%d\t%s\t%s\t%lf\t%lf\t%lf\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%d", &profile_id, &geoname_id,
&addr_type, start_ip, end_ip, &latitude, &longitude, &coords, language,
continent_abbr, continent_full, country_abbr, country_full, province_abbr, province_full,
city_full, time_zone, &is_valid);
if (ret != 18)
{
TFE_LOG_ERROR(g_default_logger, "Policy table parse ip location failed, ret:%d, %s", ret, table_line);
return;
}
tfe_unescape(continent_full);
tfe_unescape(country_full);
tfe_unescape(province_full);
tfe_unescape(city_full);
struct ip_data_table *ip_asn = ALLOC(struct ip_data_table, 1);
memset(ip_asn, 0, sizeof(struct ip_data_table));
ip_asn->profile_id = profile_id;
ip_asn->country_full = tfe_strdup(country_full);
ip_asn->province_full = tfe_strdup(province_full);
ip_asn->city_full = tfe_strdup(city_full);
ip_asn->ref_cnt = 1;
pthread_mutex_init(&(ip_asn->lock), NULL);
TFE_LOG_INFO(g_default_logger, "Policy table add success %d", profile_id);
*ad = ip_asn;
}
static void ip_table_dup_cb(int table_id, MAAT_PLUGIN_EX_DATA *to, MAAT_PLUGIN_EX_DATA *from, long argl, void *argp)
{
struct ip_data_table *ip_asn = (struct ip_data_table *)(*from);
pthread_mutex_lock(&(ip_asn->lock));
ip_asn->ref_cnt++;
pthread_mutex_unlock(&(ip_asn->lock));
*to = ip_asn;
}
static void ip_table_free_cb(int table_id, MAAT_PLUGIN_EX_DATA *ad, long argl, void *argp)
{
if (*ad == NULL)
{
return;
}
struct ip_data_table *ip_asn = (struct ip_data_table *)(*ad);
pthread_mutex_lock(&(ip_asn->lock));
ip_asn->ref_cnt--;
if (ip_asn->ref_cnt > 0)
{
pthread_mutex_unlock(&(ip_asn->lock));
return;
}
pthread_mutex_unlock(&(ip_asn->lock));
pthread_mutex_destroy(&(ip_asn->lock));
if (ip_asn->asn)
FREE(&ip_asn->asn);
if (ip_asn->organization)
FREE(&ip_asn->organization);
if (ip_asn->country_full)
FREE(&ip_asn->country_full);
if (ip_asn->province_full)
FREE(&ip_asn->province_full);
if (ip_asn->city_full)
FREE(&ip_asn->city_full);
FREE(&ip_asn);
*ad = NULL;
return;
}
void ip_table_free(struct ip_data_table *ip_asn)
{
ip_table_free_cb(0, (void **)&ip_asn, 0, NULL);
}
static struct maat_table_info maat_pub_tables[TABLE_TYPE_MAX] = {
// TABLE_IP_ASN_USER_DEFINED
{0, "TSG_IP_ASN_USER_DEFINED", ip_asn_table_new_cb, ip_table_dup_cb, ip_table_free_cb},
// TABLE_IP_ASN_BUILT_IN
{0, "TSG_IP_ASN_BUILT_IN", ip_asn_table_new_cb, ip_table_dup_cb, ip_table_free_cb},
// TABLE_IP_LOCATION_USER_DEFINED
{0, "TSG_IP_LOCATION_USER_DEFINED", ip_location_table_new_cb, ip_table_dup_cb, ip_table_free_cb},
// TABLE_IP_LOCATION_BUILT_IN
{0, "TSG_IP_LOCATION_BUILT_IN", ip_location_table_new_cb, ip_table_dup_cb, ip_table_free_cb},
// TABLE_SECURITY_SOURCE_ASN
{0, "TSG_SECURITY_SOURCE_ASN", NULL, NULL, NULL},
// TABLE_SECURITY_DESTINATION_ASN
{0, "TSG_SECURITY_DESTINATION_ASN", NULL, NULL, NULL},
// TABLE_SECURITY_SOURCE_LOCATION
{0, "TSG_SECURITY_SOURCE_LOCATION", NULL, NULL, NULL},
// TABLE_SECURITY_DESTINATION_LOCATION
{0, "TSG_SECURITY_DESTINATION_LOCATION", NULL, NULL, NULL}
};
static int register_maat_table()
{
for (int i = 0; i < TABLE_TYPE_MAX; i++)
{
maat_pub_tables[i].id = Maat_table_register(static_maat, maat_pub_tables[i].name);
if (maat_pub_tables[i].id < 0)
{
TFE_LOG_ERROR(g_default_logger, "Maat table %s register failed.", maat_pub_tables[i].name);
return -1;
}
if (maat_pub_tables[i].new_func || maat_pub_tables[i].dup_func || maat_pub_tables[i].free_func)
{
Maat_ip_plugin_EX_register(static_maat, maat_pub_tables[i].id, maat_pub_tables[i].new_func,
maat_pub_tables[i].free_func, maat_pub_tables[i].dup_func, 0, NULL);
}
}
return 0;
}
int tfe_bussiness_resouce_init() int tfe_bussiness_resouce_init()
{ {
const char *profile_path = "./conf/tfe/tfe.conf"; const char *profile_path = "./conf/tfe/tfe.conf";
@@ -243,6 +408,11 @@ int tfe_bussiness_resouce_init()
device_id = cerate_device_id(profile_path, "kafka", g_default_logger); device_id = cerate_device_id(profile_path, "kafka", g_default_logger);
if (register_maat_table())
{
return -1;
}
return 0; return 0;
} }
@@ -261,4 +431,9 @@ void *tfe_bussiness_resouce_get(enum RESOURCE_TYPE type)
default: default:
return NULL; return NULL;
} }
}
int tfe_bussiness_tableid_get(enum TABLE_TYPE type)
{
return maat_pub_tables[type].id;
} }

26
common/src/tfe_types.cpp
View File

@@ -1,6 +1,8 @@
#include "tfe_types.h" #include "tfe_types.h"
#include "tfe_utils.h" #include "tfe_utils.h"
#include <string.h> #include <string.h>
#include <MESA/Maat_rule.h>
const char * tfe_stream_conn_dir_to_str(enum tfe_conn_dir dir) const char * tfe_stream_conn_dir_to_str(enum tfe_conn_dir dir)
{ {
return (dir == CONN_DIR_DOWNSTREAM) ? "downstream" : "upstream"; return (dir == CONN_DIR_DOWNSTREAM) ? "downstream" : "upstream";
@@ -201,3 +203,27 @@ char * tfe_string_addr_create_by_fd(int fd, enum tfe_conn_dir dir)
tfe_stream_addr_free(stream_addr); tfe_stream_addr_free(stream_addr);
return addr_str; return addr_str;
} }
int tfe_stream_addr_to_address(const struct tfe_stream_addr *addr, struct ip_address *dest_ip, struct ip_address *source_ip)
{
if(addr==NULL) return -1;
if (addr->addrtype == TFE_ADDR_STREAM_TUPLE4_V4)
{
const struct tfe_stream_addr_tuple4_v4 * tuple4_v4 = addr->tuple4_v4;
source_ip->ip_type=4;
source_ip->ipv4=tuple4_v4->saddr.s_addr;
dest_ip->ip_type=4;
dest_ip->ipv4=tuple4_v4->daddr.s_addr;
}
if (addr->addrtype == TFE_ADDR_STREAM_TUPLE4_V6)
{
const struct tfe_stream_addr_tuple4_v6 * tuple4_v6 = addr->tuple4_v6;
source_ip->ip_type=6;
memcpy((char *)(source_ip->ipv6), tuple4_v6->saddr.__in6_u.__u6_addr32, IPV6_ADDR_LEN);
dest_ip->ip_type=6;
memcpy((char *)(dest_ip->ipv6),tuple4_v6->daddr.__in6_u.__u6_addr32, IPV6_ADDR_LEN);
}
return 0;
}

37
common/src/tfe_utils.cpp
View File

@@ -227,3 +227,40 @@ int tfe_decode_base64url(u_char *dst, u_char *src)
return tfe_decode_base64_internal(dst, src, basis64); return tfe_decode_base64_internal(dst, src, basis64);
} }
char *tfe_unescape(char *s)
{
int i=0,j=0;
int len=strlen(s);
for(i=0,j=0;i<len;i++)
{
if(s[i]=='\\')
{
switch(s[i+1])
{
case '&':
s[j]='&';
break;
case 'b':
s[j]=' ';//space,0x20;
break;
case '\\':
s[j]='\\';
break;
default:
s[j]=s[i];
i--; //undo the followed i++
break;
}
i++;
j++;
}
else
{
s[j]=s[i];
j++;
}
}
s[j]='\0';
return s;
}

4
plugin/business/doh/src/dns.cpp
View File

@@ -642,7 +642,7 @@ static int get_one_resource_record(char *msg, char **ptr, dns_rr_t *rr, char *en
memcpy(rr->rdata.unknown_data, *ptr, rr->rdlength); memcpy(rr->rdata.unknown_data, *ptr, rr->rdlength);
rr->rdata.unknown_data[rr->rdlength] = '\0'; rr->rdata.unknown_data[rr->rdlength] = '\0';
(*ptr) += rr->rdlength; (*ptr) += rr->rdlength;
printf("No support respone type, type: %d", rr->type); // printf("No support respone type, type: %d", rr->type);
break; break;
} }
@@ -1196,7 +1196,7 @@ int dns_package(dns_info_t *dns_info, char *out_buff, int buff_size)
} }
if (used_len > buff_size) if (used_len > buff_size)
{ {
printf("dns_package buff to short, %s, %d\n", __FILE__, __LINE__); // printf("dns_package buff to short, %s, %d\n", __FILE__, __LINE__);
return -1; return -1;
} }
} }

212
plugin/business/doh/src/doh.cpp
View File

@@ -199,6 +199,172 @@ static struct Maat_rule_t *doh_fetch_rule(Maat_rule_t *result, int result_num)
return p_result; return p_result;
} }
static int doh_ip_location_scan(struct Maat_rule_t *result, struct ip_address *sip, struct ip_address *dip, int hit_cnt, unsigned int thread_id, struct doh_ctx *ctx)
{
int scan_ret = 0, hit_cnt_ip = 0;
char buff[TFE_STRING_MAX] = {0};
struct ip_data_table *ip_location_client = NULL, *ip_location_server = NULL;
int is_src_use_user_defined = 1;
int is_dst_use_user_defined = 1;
Maat_ip_plugin_get_EX_data(g_doh_conf->maat, tfe_bussiness_tableid_get(TABLE_IP_LOCATION_USER_DEFINED), sip, (void **)&ip_location_client, 1);
Maat_ip_plugin_get_EX_data(g_doh_conf->maat, tfe_bussiness_tableid_get(TABLE_IP_LOCATION_USER_DEFINED), dip, (void **)&ip_location_server, 1);
if (ip_location_client == NULL)
{
is_src_use_user_defined = 0;
Maat_ip_plugin_get_EX_data(g_doh_conf->maat, tfe_bussiness_tableid_get(TABLE_IP_LOCATION_BUILT_IN), sip, (void **)&ip_location_client, 1);
}
if (ip_location_server == NULL)
{
is_dst_use_user_defined = 0;
Maat_ip_plugin_get_EX_data(g_doh_conf->maat, tfe_bussiness_tableid_get(TABLE_IP_LOCATION_BUILT_IN), dip, (void **)&ip_location_server, 1);
}
if (ip_location_server != NULL)
{
TFE_LOG_INFO(g_doh_conf->local_logger, "scan dst ip use IP_LOCATION_%s, profile_id: %d ref_cnt: %d asn: %s organization: %s country: %s province: %s city: %s addr: %s",
(is_dst_use_user_defined ? "USER_DEFINED" : "BUILT_IN"), ip_location_server->profile_id, ip_location_server->ref_cnt, ip_location_server->asn,
ip_location_server->organization, ip_location_server->country_full, ip_location_server->province_full, ip_location_server->city_full, ctx->addr_string);
snprintf(buff, sizeof(buff), "%s.%s.", ip_location_server->country_full, ip_location_server->city_full);
scan_ret = Maat_full_scan_string(g_doh_conf->maat, tfe_bussiness_tableid_get(TABLE_SECURITY_DESTINATION_LOCATION),
CHARSET_GBK, buff, strlen(buff),
result + hit_cnt + hit_cnt_ip, NULL, MAX_SCAN_RESULT - hit_cnt - hit_cnt_ip,
&(ctx->scan_mid), (int)thread_id);
if (scan_ret > 0)
{
TFE_LOG_INFO(g_doh_conf->local_logger, "SCAN_DST_LOCATION, Hit location: %s scan ret: %d policy_id: %d service: %d action: %d addr: %s",
buff, scan_ret, result[hit_cnt + hit_cnt_ip].config_id, result[hit_cnt + hit_cnt_ip].service_id, result[hit_cnt + hit_cnt_ip].action, ctx->addr_string);
hit_cnt_ip += scan_ret;
}
else
{
TFE_LOG_INFO(g_doh_conf->local_logger, "SCAN_DST_LOCATION, NO hit location: %s scan ret: %d addr: %s",
buff, scan_ret, ctx->addr_string);
}
memset(buff, 0, sizeof(buff));
snprintf(buff, sizeof(buff), "%s,%s,%s", ip_location_server->city_full, ip_location_server->province_full, ip_location_server->country_full);
ctx->location_server = tfe_strdup(buff);
}
if (ip_location_client != NULL)
{
TFE_LOG_INFO(g_doh_conf->local_logger, "scan src ip use IP_LOCATION_%s, profile_id: %d ref_cnt: %d asn: %s organization: %s country: %s province: %s city: %s addr: %s",
(is_src_use_user_defined ? "USER_DEFINED" : "BUILT_IN"), ip_location_client->profile_id, ip_location_client->ref_cnt, ip_location_client->asn,
ip_location_client->organization, ip_location_client->country_full, ip_location_client->province_full, ip_location_client->city_full, ctx->addr_string);
snprintf(buff, sizeof(buff), "%s.%s.", ip_location_client->country_full, ip_location_client->city_full);
scan_ret = Maat_full_scan_string(g_doh_conf->maat, tfe_bussiness_tableid_get(TABLE_SECURITY_SOURCE_LOCATION),
CHARSET_GBK, buff, strlen(buff),
result + hit_cnt + hit_cnt_ip, NULL, MAX_SCAN_RESULT - hit_cnt - hit_cnt_ip,
&(ctx->scan_mid), (int)thread_id);
if (scan_ret > 0)
{
TFE_LOG_INFO(g_doh_conf->local_logger, "SCAN_SRC_LOCATION, Hit location: %s scan ret: %d policy_id: %d service: %d action: %d addr: %s",
buff, scan_ret, result[hit_cnt + hit_cnt_ip].config_id, result[hit_cnt + hit_cnt_ip].service_id, result[hit_cnt + hit_cnt_ip].action, ctx->addr_string);
hit_cnt_ip += scan_ret;
}
else
{
TFE_LOG_INFO(g_doh_conf->local_logger, "SCAN_SRC_LOCATION, NO hit location: %s scan ret: %d addr: %s",
buff, scan_ret, ctx->addr_string);
}
memset(buff, 0, sizeof(buff));
snprintf(buff, sizeof(buff), "%s,%s,%s", ip_location_client->city_full, ip_location_client->province_full, ip_location_client->country_full);
ctx->location_client = tfe_strdup(buff);
}
if (ip_location_server)
ip_table_free(ip_location_server);
if (ip_location_client)
ip_table_free(ip_location_client);
return hit_cnt_ip;
}
static int doh_ip_asn_scan(struct Maat_rule_t *result, struct ip_address *sip, struct ip_address *dip, int hit_cnt, unsigned int thread_id, struct doh_ctx *ctx)
{
int scan_ret = 0, hit_cnt_ip = 0;
char buff[TFE_STRING_MAX] = {0};
struct ip_data_table *ip_asn_client = NULL, *ip_asn_server = NULL;
int is_src_use_user_defined = 1;
int is_dst_use_user_defined = 1;
Maat_ip_plugin_get_EX_data(g_doh_conf->maat, tfe_bussiness_tableid_get(TABLE_IP_ASN_USER_DEFINED), sip, (void **)&ip_asn_client, 1);
Maat_ip_plugin_get_EX_data(g_doh_conf->maat, tfe_bussiness_tableid_get(TABLE_IP_ASN_USER_DEFINED), dip, (void **)&ip_asn_server, 1);
if (ip_asn_client == NULL)
{
is_src_use_user_defined = 0;
Maat_ip_plugin_get_EX_data(g_doh_conf->maat, tfe_bussiness_tableid_get(TABLE_IP_ASN_BUILT_IN), sip, (void **)&ip_asn_client, 1);
}
if (ip_asn_server == NULL)
{
is_dst_use_user_defined = 0;
Maat_ip_plugin_get_EX_data(g_doh_conf->maat, tfe_bussiness_tableid_get(TABLE_IP_ASN_BUILT_IN), dip, (void **)&ip_asn_server, 1);
}
if (ip_asn_server != NULL)
{
TFE_LOG_INFO(g_doh_conf->local_logger, "scan dst ip use IP_ASN_%s, profile_id: %d ref_cnt: %d asn: %s organization: %s country: %s province: %s city: %s addr: %s",
(is_dst_use_user_defined ? "USER_DEFINED" : "BUILT_IN"), ip_asn_server->profile_id, ip_asn_server->ref_cnt, ip_asn_server->asn,
ip_asn_server->organization, ip_asn_server->country_full, ip_asn_server->province_full, ip_asn_server->city_full, ctx->addr_string);
scan_ret = Maat_full_scan_string(g_doh_conf->maat, tfe_bussiness_tableid_get(TABLE_SECURITY_DESTINATION_ASN),
CHARSET_UTF8, ip_asn_server->asn, strlen(ip_asn_server->asn),
result + hit_cnt + hit_cnt_ip, NULL, MAX_SCAN_RESULT - hit_cnt - hit_cnt_ip,
&(ctx->scan_mid), (int)thread_id);
if (scan_ret > 0)
{
TFE_LOG_INFO(g_doh_conf->local_logger, "SCAN_DST_ASN, Hit asn: %s scan ret: %d policy_id: %d service: %d action: %d addr: %s",
ip_asn_server->asn, scan_ret, result[hit_cnt + hit_cnt_ip].config_id, result[hit_cnt + hit_cnt_ip].service_id, result[hit_cnt + hit_cnt_ip].action, ctx->addr_string);
hit_cnt_ip += scan_ret;
}
else
{
TFE_LOG_INFO(g_doh_conf->local_logger, "SCAN_DST_ASN, NO hit asn: %s scan ret: %d addr: %s",
ip_asn_server->asn, scan_ret, ctx->addr_string);
}
memset(buff, 0, sizeof(buff));
snprintf(buff, sizeof(buff), "%s(%s)", ip_asn_server->asn, ip_asn_server->organization);
ctx->asn_server = tfe_strdup(buff);
}
if (ip_asn_client != NULL)
{
TFE_LOG_INFO(g_doh_conf->local_logger, "scan src ip use IP_ASN_%s, profile_id: %d ref_cnt: %d asn: %s organization: %s country: %s province: %s city: %s addr: %s",
(is_src_use_user_defined ? "USER_DEFINED" : "BUILT_IN"), ip_asn_client->profile_id, ip_asn_client->ref_cnt, ip_asn_client->asn,
ip_asn_client->organization, ip_asn_client->country_full, ip_asn_client->province_full, ip_asn_client->city_full, ctx->addr_string);
scan_ret = Maat_full_scan_string(g_doh_conf->maat, tfe_bussiness_tableid_get(TABLE_SECURITY_SOURCE_ASN),
CHARSET_UTF8, ip_asn_client->asn, strlen(ip_asn_client->asn),
result + hit_cnt + hit_cnt_ip, NULL, MAX_SCAN_RESULT - hit_cnt - hit_cnt_ip,
&(ctx->scan_mid), (int)thread_id);
if (scan_ret > 0)
{
TFE_LOG_INFO(g_doh_conf->local_logger, "SCAN_SRC_ASN, Hit asn: %s scan ret: %d policy_id: %d service: %d action: %d addr: %s",
ip_asn_client->asn, scan_ret, result[hit_cnt + hit_cnt_ip].config_id, result[hit_cnt + hit_cnt_ip].service_id, result[hit_cnt + hit_cnt_ip].action, ctx->addr_string);
hit_cnt_ip += scan_ret;
}
else
{
TFE_LOG_INFO(g_doh_conf->local_logger, "SCAN_SRC_ASN, NO hit asn: %s scan ret: %d addr: %s",
ip_asn_client->asn, scan_ret, ctx->addr_string);
}
memset(buff, 0, sizeof(buff));
snprintf(buff, sizeof(buff), "%s(%s)", ip_asn_client->asn, ip_asn_client->organization);
ctx->asn_client = tfe_strdup(buff);
}
if (ip_asn_server)
ip_table_free(ip_asn_server);
if (ip_asn_client)
ip_table_free(ip_asn_client);
return hit_cnt_ip;
}
static void doh_maat_scan(const struct tfe_stream *stream, const struct tfe_http_session *session, struct doh_ctx *ctx, char *qname, int qtype) static void doh_maat_scan(const struct tfe_stream *stream, const struct tfe_http_session *session, struct doh_ctx *ctx, char *qname, int qtype)
{ {
int hit_cnt = 0; int hit_cnt = 0;
@@ -208,6 +374,20 @@ static void doh_maat_scan(const struct tfe_stream *stream, const struct tfe_http
struct Maat_rule_t *p_result = NULL; struct Maat_rule_t *p_result = NULL;
struct Maat_rule_t result[MAX_SCAN_RESULT]; struct Maat_rule_t result[MAX_SCAN_RESULT];
struct ip_address dest_ip, source_ip;
tfe_stream_addr_to_address(stream->addr, &dest_ip, &source_ip);
scan_ret = doh_ip_location_scan(result, &source_ip, &dest_ip, hit_cnt, ctx->thread_id, ctx);
if (scan_ret > 0)
{
hit_cnt += scan_ret;
}
scan_ret = doh_ip_asn_scan(result, &source_ip, &dest_ip, hit_cnt, ctx->thread_id, ctx);
if (scan_ret > 0)
{
hit_cnt += scan_ret;
}
// scan server host // scan server host
const char *host = session->req->req_spec.host; const char *host = session->req->req_spec.host;
if (host) if (host)
@@ -216,9 +396,9 @@ static void doh_maat_scan(const struct tfe_stream *stream, const struct tfe_http
host, strlen(host), result + hit_cnt, NULL, MAX_SCAN_RESULT - hit_cnt, &(ctx->scan_mid), ctx->thread_id); host, strlen(host), result + hit_cnt, NULL, MAX_SCAN_RESULT - hit_cnt, &(ctx->scan_mid), ctx->thread_id);
if (scan_ret > 0) if (scan_ret > 0)
{ {
hit_cnt += scan_ret;
TFE_LOG_INFO(g_doh_conf->local_logger, "SCAN_HOST, Hit host: %s scan ret: %d policy_id: %d service: %d action: %d addr: %s", TFE_LOG_INFO(g_doh_conf->local_logger, "SCAN_HOST, Hit host: %s scan ret: %d policy_id: %d service: %d action: %d addr: %s",
host, scan_ret, result[hit_cnt].config_id, result[hit_cnt].service_id, result[hit_cnt].action, ctx->addr_string); host, scan_ret, result[hit_cnt].config_id, result[hit_cnt].service_id, result[hit_cnt].action, ctx->addr_string);
hit_cnt += scan_ret;
} }
else else
{ {
@@ -233,9 +413,9 @@ static void doh_maat_scan(const struct tfe_stream *stream, const struct tfe_http
0, result + hit_cnt, MAX_SCAN_RESULT - hit_cnt, &(ctx->scan_mid), ctx->thread_id); 0, result + hit_cnt, MAX_SCAN_RESULT - hit_cnt, &(ctx->scan_mid), ctx->thread_id);
if (scan_ret > 0) if (scan_ret > 0)
{ {
hit_cnt += scan_ret;
TFE_LOG_INFO(g_doh_conf->local_logger, "SCAN_ADDR, Hit addr: %s scan ret: %d policy_id: %d service: %d action: %d", TFE_LOG_INFO(g_doh_conf->local_logger, "SCAN_ADDR, Hit addr: %s scan ret: %d policy_id: %d service: %d action: %d",
ctx->addr_string, scan_ret, result[hit_cnt].config_id, result[hit_cnt].service_id, result[hit_cnt].action); ctx->addr_string, scan_ret, result[hit_cnt].config_id, result[hit_cnt].service_id, result[hit_cnt].action);
hit_cnt += scan_ret;
} }
else else
{ {
@@ -248,9 +428,9 @@ static void doh_maat_scan(const struct tfe_stream *stream, const struct tfe_http
app_id, strlen(app_id), result + hit_cnt, NULL, MAX_SCAN_RESULT - hit_cnt, &(ctx->scan_mid), ctx->thread_id); app_id, strlen(app_id), result + hit_cnt, NULL, MAX_SCAN_RESULT - hit_cnt, &(ctx->scan_mid), ctx->thread_id);
if (scan_ret > 0) if (scan_ret > 0)
{ {
hit_cnt += scan_ret;
TFE_LOG_INFO(g_doh_conf->local_logger, "SCAN_APPID, Hit proto: %s scan ret: %d policy_id: %d service: %d action: %d addr: %s", TFE_LOG_INFO(g_doh_conf->local_logger, "SCAN_APPID, Hit proto: %s scan ret: %d policy_id: %d service: %d action: %d addr: %s",
app_id, scan_ret, result[hit_cnt].config_id, result[hit_cnt].service_id, result[hit_cnt].action, ctx->addr_string); app_id, scan_ret, result[hit_cnt].config_id, result[hit_cnt].service_id, result[hit_cnt].action, ctx->addr_string);
hit_cnt += scan_ret;
} }
else else
{ {
@@ -263,9 +443,9 @@ static void doh_maat_scan(const struct tfe_stream *stream, const struct tfe_http
qname, strlen(qname), result + hit_cnt, NULL, MAX_SCAN_RESULT - hit_cnt, &(ctx->scan_mid), ctx->thread_id); qname, strlen(qname), result + hit_cnt, NULL, MAX_SCAN_RESULT - hit_cnt, &(ctx->scan_mid), ctx->thread_id);
if (scan_ret > 0) if (scan_ret > 0)
{ {
hit_cnt += scan_ret;
TFE_LOG_INFO(g_doh_conf->local_logger, "SCAN_QNAME, Hit domain: %s scan ret: %d qtype: %d policy_id: %d service: %d action: %d addr: %s", TFE_LOG_INFO(g_doh_conf->local_logger, "SCAN_QNAME, Hit domain: %s scan ret: %d qtype: %d policy_id: %d service: %d action: %d addr: %s",
qname, scan_ret, qtype, result[hit_cnt].config_id, result[hit_cnt].service_id, result[hit_cnt].action, ctx->addr_string); qname, scan_ret, qtype, result[hit_cnt].config_id, result[hit_cnt].service_id, result[hit_cnt].action, ctx->addr_string);
hit_cnt += scan_ret;
} }
else else
{ {
@@ -389,6 +569,30 @@ static void doh_ctx_free(struct doh_ctx *ctx)
ctx->addr_string = NULL; ctx->addr_string = NULL;
} }
if (ctx->asn_client)
{
free(ctx->asn_client);
ctx->asn_client = NULL;
}
if (ctx->asn_server)
{
free(ctx->asn_server);
ctx->asn_server = NULL;
}
if (ctx->location_client)
{
free(ctx->location_client);
ctx->location_client = NULL;
}
if (ctx->location_server)
{
free(ctx->location_server);
ctx->location_server = NULL;
}
FREE(&ctx); FREE(&ctx);
} }

17
plugin/business/doh/src/logger.cpp
View File

@@ -418,6 +418,23 @@ int doh_send_log(struct doh_conf *handle, const struct tfe_http_session *http, c
} }
} }
if (ctx->location_client)
{
cJSON_AddStringToObject(common_obj, "common_client_location", ctx->location_client);
}
if (ctx->location_server)
{
cJSON_AddStringToObject(common_obj, "common_server_location", ctx->location_server);
}
if (ctx->asn_client)
{
cJSON_AddStringToObject(common_obj, "common_client_asn", ctx->asn_client);
}
if (ctx->asn_server)
{
cJSON_AddStringToObject(common_obj, "common_server_asn", ctx->asn_server);
}
add_dns_info_to_log(common_obj, dns_info); add_dns_info_to_log(common_obj, dns_info);
for (size_t i = 0; i < result_num; i++) for (size_t i = 0; i < result_num; i++)
{ {

5
plugin/business/doh/src/pub.h
View File

@@ -89,6 +89,11 @@ struct doh_ctx
enum doh_content_type type; enum doh_content_type type;
struct evbuffer *http_req_body; struct evbuffer *http_req_body;
dns_info_t *doh_req; dns_info_t *doh_req;
char *asn_client;
char *asn_server;
char *location_client;
char *location_server;
}; };
int base64_encode(char *dst, int dstlen, const char *src, int srclen); int base64_encode(char *dst, int dstlen, const char *src, int srclen);

268
plugin/business/pangu-http/src/pangu_http.cpp
View File

@@ -65,10 +65,6 @@ enum scan_table
PXY_CTRL_HTTP_RES_HDR, PXY_CTRL_HTTP_RES_HDR,
PXY_CTRL_HTTP_RES_BODY, PXY_CTRL_HTTP_RES_BODY,
PXY_CTRL_SUBSCRIBE_ID, PXY_CTRL_SUBSCRIBE_ID,
PXY_CTRL_IP_SRC_ASN,
PXY_CTRL_IP_DST_ASN,
PXY_CTRL_IP_SRC_LOCATION,
PXY_CTRL_IP_DST_LOCATION,
PXY_CTRL_APP_ID, PXY_CTRL_APP_ID,
__SCAN_TABLE_MAX __SCAN_TABLE_MAX
}; };
@@ -95,10 +91,6 @@ enum manipulate_profile_table
POLICY_PROFLIE_TABLE_REJECT, POLICY_PROFLIE_TABLE_REJECT,
POLICY_PROFILE_TABLE_INSERT, POLICY_PROFILE_TABLE_INSERT,
POLICY_PROFILE_TABLE_HIJACK, POLICY_PROFILE_TABLE_HIJACK,
POLICY_ASN_USER_DEFINED,
POLICY_ASN_BUILT_IN,
POLICY_LOCATION_USER_DEFINED,
POLICY_LOCATION_BUILT_IN,
POLICY_PROFILE_TABLE_MAX POLICY_PROFILE_TABLE_MAX
}; };
@@ -115,22 +107,6 @@ struct manipulate_profile
pthread_mutex_t lock; pthread_mutex_t lock;
}; };
struct ip_data_table
{
int profile_id;
int ref_cnt;
char *asn;
char *organization;
char *country_full;
char *province_full;
char *city_full;
pthread_mutex_t lock;
};
struct policy_action_param struct policy_action_param
{ {
int ref_cnt; int ref_cnt;
@@ -767,161 +743,11 @@ int maat_table_init(const char* table_name,
return table_id; return table_id;
} }
static char* tfe_unescape(char* s)
{
int i=0,j=0;
int len=strlen(s);
for(i=0,j=0;i<len;i++)
{
if(s[i]=='\\')
{
switch(s[i+1])
{
case '&':
s[j]='&';
break;
case 'b':
s[j]=' ';//space,0x20;
break;
case '\\':
s[j]='\\';
break;
default:
s[j]=s[i];
i--; //undo the followed i++
break;
}
i++;
j++;
}
else
{
s[j]=s[i];
j++;
}
}
s[j]='\0';
return s;
}
void ip_asn_table_new_cb(int table_id, const char* key, const char* table_line, MAAT_PLUGIN_EX_DATA* ad, long argl, void* argp)
{
int addr_type;
int ret=0,profile_id=0,is_valid=0;
char start_ip[40], end_ip[40],asn[40]={0};
char organization[TFE_PATH_MAX];
ret=sscanf(table_line, "%d\t%d\t%s\t%s\t%s\t%s\t%d", &profile_id, &addr_type, start_ip, end_ip, asn, organization, &is_valid);
if(ret!=7)
{
TFE_LOG_ERROR(g_pangu_rt->local_logger, "Policy table parse ip ASN failed, ret:%d, %s", ret, table_line);
return;
}
tfe_unescape(organization);
struct ip_data_table* ip_asn=ALLOC(struct ip_data_table, 1);
memset(ip_asn, 0, sizeof(struct ip_data_table));
ip_asn->profile_id=profile_id;
ip_asn->asn=tfe_strdup(asn);
ip_asn->organization=tfe_strdup(organization);
ip_asn->ref_cnt=1;
pthread_mutex_init(&(ip_asn->lock), NULL);
TFE_LOG_INFO(g_pangu_rt->local_logger, "Policy table add success %d", profile_id);
*ad = ip_asn;
}
void ip_location_table_new_cb(int table_id, const char* key, const char* table_line, MAAT_PLUGIN_EX_DATA* ad, long argl, void* argp)
{
int ret=0,profile_id=0,is_valid=0;
int geoname_id=0, addr_type=0;
double latitude, longitude, coords;
char language[40], start_ip[40], end_ip[40];
char continent_abbr[TFE_PATH_MAX],continent_full[TFE_PATH_MAX];
char country_abbr[TFE_PATH_MAX],province_abbr[TFE_PATH_MAX], time_zone[TFE_PATH_MAX];
char country_full[TFE_PATH_MAX],province_full[TFE_PATH_MAX], city_full[TFE_PATH_MAX];
ret=sscanf(table_line, "%d\t%d\t%d\t%s\t%s\t%lf\t%lf\t%lf\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%d", &profile_id,&geoname_id,
&addr_type, start_ip,end_ip,&latitude,&longitude,&coords,language,
continent_abbr,continent_full, country_abbr,country_full,province_abbr,province_full,
city_full,time_zone,&is_valid);
if(ret!=18)
{
TFE_LOG_ERROR(g_pangu_rt->local_logger, "Policy table parse ip location failed, ret:%d, %s", ret, table_line);
return;
}
tfe_unescape(continent_full);
tfe_unescape(country_full);
tfe_unescape(province_full);
tfe_unescape(city_full);
struct ip_data_table* ip_asn=ALLOC(struct ip_data_table, 1);
memset(ip_asn, 0, sizeof(struct ip_data_table));
ip_asn->profile_id=profile_id;
ip_asn->country_full=tfe_strdup(country_full);
ip_asn->province_full=tfe_strdup(province_full);
ip_asn->city_full=tfe_strdup(city_full);
ip_asn->ref_cnt=1;
pthread_mutex_init(&(ip_asn->lock), NULL);
TFE_LOG_INFO(g_pangu_rt->local_logger, "Policy table add success %d", profile_id);
*ad = ip_asn;
}
void ip_table_dup_cb(int table_id, MAAT_PLUGIN_EX_DATA *to, MAAT_PLUGIN_EX_DATA *from, long argl, void* argp)
{
struct ip_data_table* ip_asn=(struct ip_data_table*)(*from);
pthread_mutex_lock(&(ip_asn->lock));
ip_asn->ref_cnt++;
pthread_mutex_unlock(&(ip_asn->lock));
*to=ip_asn;
}
void ip_table_free_cb(int table_id, MAAT_PLUGIN_EX_DATA* ad, long argl, void* argp)
{
if(*ad==NULL)
{
return;
}
struct ip_data_table* ip_asn=(struct ip_data_table*)(*ad);
pthread_mutex_lock(&(ip_asn->lock));
ip_asn->ref_cnt--;
if(ip_asn->ref_cnt>0)
{
pthread_mutex_unlock(&(ip_asn->lock));
return;
}
pthread_mutex_unlock(&(ip_asn->lock));
pthread_mutex_destroy(&(ip_asn->lock));
if(ip_asn->asn) FREE(&ip_asn->asn);
if(ip_asn->organization) FREE(&ip_asn->organization);
if(ip_asn->country_full) FREE(&ip_asn->country_full);
if(ip_asn->province_full) FREE(&ip_asn->province_full);
if(ip_asn->city_full) FREE(&ip_asn->city_full);
FREE(&ip_asn);
*ad=NULL;
return;
}
void ip_table_free(struct ip_data_table* ip_asn)
{
ip_table_free_cb(0, (void **)&ip_asn, 0, NULL);
}
const char* table_name_idx2str(int profile_idx) const char* table_name_idx2str(int profile_idx)
{ {
const char *table_name_map[] = {"TSG_PROFILE_RESPONSE_PAGES", const char *table_name_map[] = {"TSG_PROFILE_RESPONSE_PAGES",
"PXY_PROFILE_INSERT_SCRIPTS", "PXY_PROFILE_INSERT_SCRIPTS",
"PXY_PROFILE_HIJACK_FILES", "PXY_PROFILE_HIJACK_FILES"};
"TSG_IP_ASN_USER_DEFINED",
"TSG_IP_ASN_BUILT_IN",
"TSG_IP_LOCATION_USER_DEFINED",
"TSG_IP_LOCATION_BUILT_IN"};
return table_name_map[profile_idx]; return table_name_map[profile_idx];
} }
@@ -953,34 +779,6 @@ int maat_table_ex_init(int profile_idx,
return -1; return -1;
} }
int maat_ip_table_init(int profile_idx,
Maat_plugin_EX_free_func_t* free_func,
Maat_plugin_EX_dup_func_t* dup_func)
{
int table_id=0;
Maat_plugin_EX_new_func_t *new_func[] = {
[POLICY_PROFLIE_TABLE_REJECT] = NULL,
[POLICY_PROFILE_TABLE_INSERT] = NULL,
[POLICY_PROFILE_TABLE_HIJACK] = NULL,
[POLICY_ASN_USER_DEFINED] = ip_asn_table_new_cb,
[POLICY_ASN_BUILT_IN] = ip_asn_table_new_cb,
[POLICY_LOCATION_USER_DEFINED] = ip_location_table_new_cb,
[POLICY_LOCATION_BUILT_IN] = ip_location_table_new_cb,
};
const char *table_name = table_name_idx2str(profile_idx);
table_id=g_pangu_rt->plolicy_table_id[profile_idx]=Maat_table_register(g_pangu_rt->maat, table_name);
if(table_id >= 0)
{
table_id=Maat_ip_plugin_EX_register(g_pangu_rt->maat, table_id, new_func[profile_idx], free_func, dup_func,
0, NULL);
return 0;
}
TFE_LOG_INFO(NULL, "Pangu HTTP register table %s failed.", table_name);
return -1;
}
int pangu_policy_init(const char* profile_path, const char* static_section, const char* dynamic_section) int pangu_policy_init(const char* profile_path, const char* static_section, const char* dynamic_section)
{ {
int ret = 0; int ret = 0;
@@ -995,10 +793,6 @@ int pangu_policy_init(const char* profile_path, const char* static_section, cons
table_name[PXY_CTRL_HTTP_RES_HDR] = "TSG_FIELD_HTTP_RES_HDR"; table_name[PXY_CTRL_HTTP_RES_HDR] = "TSG_FIELD_HTTP_RES_HDR";
table_name[PXY_CTRL_HTTP_RES_BODY] = "TSG_FIELD_HTTP_RES_CONTENT"; table_name[PXY_CTRL_HTTP_RES_BODY] = "TSG_FIELD_HTTP_RES_CONTENT";
table_name[PXY_CTRL_SUBSCRIBE_ID] = "TSG_OBJ_SUBSCRIBER_ID"; table_name[PXY_CTRL_SUBSCRIBE_ID] = "TSG_OBJ_SUBSCRIBER_ID";
table_name[PXY_CTRL_IP_SRC_ASN]="TSG_SECURITY_SOURCE_ASN";
table_name[PXY_CTRL_IP_DST_ASN]="TSG_SECURITY_DESTINATION_ASN";
table_name[PXY_CTRL_IP_SRC_LOCATION]="TSG_SECURITY_SOURCE_LOCATION";
table_name[PXY_CTRL_IP_DST_LOCATION]="TSG_SECURITY_DESTINATION_LOCATION";
table_name[PXY_CTRL_APP_ID] = "TSG_OBJ_APP_ID"; table_name[PXY_CTRL_APP_ID] = "TSG_OBJ_APP_ID";
for (int i = 0; i < __SCAN_TABLE_MAX; i++) for (int i = 0; i < __SCAN_TABLE_MAX; i++)
{ {
@@ -1046,14 +840,6 @@ int pangu_policy_init(const char* profile_path, const char* static_section, cons
goto error_out; goto error_out;
} }
} }
for(int i = POLICY_ASN_USER_DEFINED; i < POLICY_PROFILE_TABLE_MAX; i++)
{
ret = maat_ip_table_init(i, ip_table_free_cb, ip_table_dup_cb);
if(ret<0)
{
goto error_out;
}
}
g_pangu_rt->dyn_maat = (Maat_feather_t)tfe_bussiness_resouce_get(DYNAMINC_MAAT); g_pangu_rt->dyn_maat = (Maat_feather_t)tfe_bussiness_resouce_get(DYNAMINC_MAAT);
g_pangu_rt->subscriber_id_table_id=Maat_table_register(g_pangu_rt->dyn_maat, "TSG_DYN_SUBSCRIBER_IP"); g_pangu_rt->subscriber_id_table_id=Maat_table_register(g_pangu_rt->dyn_maat, "TSG_DYN_SUBSCRIBER_IP");
@@ -2657,22 +2443,22 @@ int http_ip_location_scan(struct Maat_rule_t *result, struct ip_address *sip, st
char buff[TFE_STRING_MAX]={0}; char buff[TFE_STRING_MAX]={0};
struct ip_data_table* ip_location_client=NULL, *ip_location_server=NULL; struct ip_data_table* ip_location_client=NULL, *ip_location_server=NULL;
Maat_ip_plugin_get_EX_data(g_pangu_rt->maat, g_pangu_rt->plolicy_table_id[POLICY_LOCATION_USER_DEFINED], sip, (void **)&ip_location_client, 1); Maat_ip_plugin_get_EX_data(g_pangu_rt->maat, tfe_bussiness_tableid_get(TABLE_IP_LOCATION_USER_DEFINED), sip, (void **)&ip_location_client, 1);
Maat_ip_plugin_get_EX_data(g_pangu_rt->maat, g_pangu_rt->plolicy_table_id[POLICY_LOCATION_USER_DEFINED], dip, (void **)&ip_location_server, 1); Maat_ip_plugin_get_EX_data(g_pangu_rt->maat, tfe_bussiness_tableid_get(TABLE_IP_LOCATION_USER_DEFINED), dip, (void **)&ip_location_server, 1);
if (ip_location_client == NULL) if (ip_location_client == NULL)
{ {
Maat_ip_plugin_get_EX_data(g_pangu_rt->maat, g_pangu_rt->plolicy_table_id[POLICY_LOCATION_BUILT_IN], sip, (void **)&ip_location_client, 1); Maat_ip_plugin_get_EX_data(g_pangu_rt->maat, tfe_bussiness_tableid_get(TABLE_IP_LOCATION_BUILT_IN), sip, (void **)&ip_location_client, 1);
} }
if (ip_location_server == NULL) if (ip_location_server == NULL)
{ {
Maat_ip_plugin_get_EX_data(g_pangu_rt->maat, g_pangu_rt->plolicy_table_id[POLICY_LOCATION_BUILT_IN], dip, (void **)&ip_location_server, 1); Maat_ip_plugin_get_EX_data(g_pangu_rt->maat, tfe_bussiness_tableid_get(TABLE_IP_LOCATION_BUILT_IN), dip, (void **)&ip_location_server, 1);
} }
if(ip_location_server!=NULL) if(ip_location_server!=NULL)
{ {
snprintf(buff, sizeof(buff), "%s.%s.", ip_location_server->country_full, ip_location_server->city_full); snprintf(buff, sizeof(buff), "%s.%s.", ip_location_server->country_full, ip_location_server->city_full);
scan_ret = Maat_full_scan_string(g_pangu_rt->maat, g_pangu_rt->scan_table_id[PXY_CTRL_IP_DST_LOCATION], scan_ret = Maat_full_scan_string(g_pangu_rt->maat, tfe_bussiness_tableid_get(TABLE_SECURITY_DESTINATION_LOCATION),
CHARSET_GBK, buff, strlen(buff), CHARSET_GBK, buff, strlen(buff),
result+hit_cnt, NULL, MAX_SCAN_RESULT-hit_cnt, result+hit_cnt, NULL, MAX_SCAN_RESULT-hit_cnt,
&(ctx->scan_mid), (int) thread_id); &(ctx->scan_mid), (int) thread_id);
@@ -2687,9 +2473,9 @@ int http_ip_location_scan(struct Maat_rule_t *result, struct ip_address *sip, st
if(ip_location_client!=NULL) if(ip_location_client!=NULL)
{ {
snprintf(buff, sizeof(buff), "%s.%s.", ip_location_client->country_full, ip_location_client->city_full); snprintf(buff, sizeof(buff), "%s.%s.", ip_location_client->country_full, ip_location_client->city_full);
scan_ret = Maat_full_scan_string(g_pangu_rt->maat, g_pangu_rt->scan_table_id[PXY_CTRL_IP_SRC_LOCATION], scan_ret = Maat_full_scan_string(g_pangu_rt->maat, tfe_bussiness_tableid_get(TABLE_SECURITY_SOURCE_LOCATION),
CHARSET_GBK, buff, strlen(buff), CHARSET_GBK, buff, strlen(buff),
result+hit_cnt, NULL, MAX_SCAN_RESULT-hit_cnt, result+hit_cnt+hit_cnt_ip, NULL, MAX_SCAN_RESULT-hit_cnt-hit_cnt_ip,
&(ctx->scan_mid), (int) thread_id); &(ctx->scan_mid), (int) thread_id);
if(scan_ret>0) if(scan_ret>0)
{ {
@@ -2713,21 +2499,21 @@ int http_ip_asn_scan(struct Maat_rule_t *result, struct ip_address* sip, struct
char buff[TFE_STRING_MAX]={0}; char buff[TFE_STRING_MAX]={0};
struct ip_data_table* ip_asn_client=NULL, *ip_asn_server=NULL; struct ip_data_table* ip_asn_client=NULL, *ip_asn_server=NULL;
Maat_ip_plugin_get_EX_data(g_pangu_rt->maat, g_pangu_rt->plolicy_table_id[POLICY_ASN_USER_DEFINED], sip, (void **)&ip_asn_client, 1); Maat_ip_plugin_get_EX_data(g_pangu_rt->maat, tfe_bussiness_tableid_get(TABLE_IP_ASN_USER_DEFINED), sip, (void **)&ip_asn_client, 1);
Maat_ip_plugin_get_EX_data(g_pangu_rt->maat, g_pangu_rt->plolicy_table_id[POLICY_ASN_USER_DEFINED], dip, (void **)&ip_asn_server, 1); Maat_ip_plugin_get_EX_data(g_pangu_rt->maat, tfe_bussiness_tableid_get(TABLE_IP_ASN_USER_DEFINED), dip, (void **)&ip_asn_server, 1);
if (ip_asn_client == NULL) if (ip_asn_client == NULL)
{ {
Maat_ip_plugin_get_EX_data(g_pangu_rt->maat, g_pangu_rt->plolicy_table_id[POLICY_ASN_BUILT_IN], sip, (void **)&ip_asn_client, 1); Maat_ip_plugin_get_EX_data(g_pangu_rt->maat, tfe_bussiness_tableid_get(TABLE_IP_ASN_BUILT_IN), sip, (void **)&ip_asn_client, 1);
} }
if (ip_asn_server == NULL) if (ip_asn_server == NULL)
{ {
Maat_ip_plugin_get_EX_data(g_pangu_rt->maat, g_pangu_rt->plolicy_table_id[POLICY_ASN_BUILT_IN], dip, (void **)&ip_asn_server, 1); Maat_ip_plugin_get_EX_data(g_pangu_rt->maat, tfe_bussiness_tableid_get(TABLE_IP_ASN_BUILT_IN), dip, (void **)&ip_asn_server, 1);
} }
if(ip_asn_server!=NULL) if(ip_asn_server!=NULL)
{ {
scan_ret = Maat_full_scan_string(g_pangu_rt->maat, g_pangu_rt->scan_table_id[PXY_CTRL_IP_DST_ASN], scan_ret = Maat_full_scan_string(g_pangu_rt->maat, tfe_bussiness_tableid_get(TABLE_SECURITY_DESTINATION_ASN),
CHARSET_UTF8, ip_asn_server->asn, strlen(ip_asn_server->asn), CHARSET_UTF8, ip_asn_server->asn, strlen(ip_asn_server->asn),
result+hit_cnt, NULL, MAX_SCAN_RESULT-hit_cnt, result+hit_cnt, NULL, MAX_SCAN_RESULT-hit_cnt,
&(ctx->scan_mid), (int) thread_id); &(ctx->scan_mid), (int) thread_id);
@@ -2741,9 +2527,9 @@ int http_ip_asn_scan(struct Maat_rule_t *result, struct ip_address* sip, struct
} }
if(ip_asn_client!=NULL) if(ip_asn_client!=NULL)
{ {
scan_ret = Maat_full_scan_string(g_pangu_rt->maat, g_pangu_rt->scan_table_id[PXY_CTRL_IP_SRC_ASN], scan_ret = Maat_full_scan_string(g_pangu_rt->maat, tfe_bussiness_tableid_get(TABLE_SECURITY_SOURCE_ASN),
CHARSET_UTF8, ip_asn_client->asn, strlen(ip_asn_client->asn), CHARSET_UTF8, ip_asn_client->asn, strlen(ip_asn_client->asn),
result+hit_cnt, NULL, MAX_SCAN_RESULT-hit_cnt, result+hit_cnt+hit_cnt_ip, NULL, MAX_SCAN_RESULT-hit_cnt-hit_cnt_ip,
&(ctx->scan_mid), (int) thread_id); &(ctx->scan_mid), (int) thread_id);
if(scan_ret>0) if(scan_ret>0)
{ {
@@ -2759,30 +2545,6 @@ int http_ip_asn_scan(struct Maat_rule_t *result, struct ip_address* sip, struct
return hit_cnt_ip; return hit_cnt_ip;
} }
int tfe_stream_addr_to_address(const struct tfe_stream_addr *addr, struct ip_address *dest_ip, struct ip_address *source_ip)
{
if(addr==NULL) return -1;
if (addr->addrtype == TFE_ADDR_STREAM_TUPLE4_V4)
{
const struct tfe_stream_addr_tuple4_v4 * tuple4_v4 = addr->tuple4_v4;
source_ip->ip_type=4;
source_ip->ipv4=tuple4_v4->saddr.s_addr;
dest_ip->ip_type=4;
dest_ip->ipv4=tuple4_v4->daddr.s_addr;
}
if (addr->addrtype == TFE_ADDR_STREAM_TUPLE4_V6)
{
const struct tfe_stream_addr_tuple4_v6 * tuple4_v6 = addr->tuple4_v6;
source_ip->ip_type=6;
memcpy((char *)(source_ip->ipv6), tuple4_v6->saddr.__in6_u.__u6_addr32, IPV6_ADDR_LEN);
dest_ip->ip_type=6;
memcpy((char *)(dest_ip->ipv6),tuple4_v6->daddr.__in6_u.__u6_addr32, IPV6_ADDR_LEN);
}
return 0;
}
void pangu_on_http_begin(const struct tfe_stream * stream, void pangu_on_http_begin(const struct tfe_stream * stream,
const struct tfe_http_session * session, unsigned int thread_id, void ** pme) const struct tfe_http_session * session, unsigned int thread_id, void ** pme)
{ {