gfwleak/tango-tfe
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix the scanning interface for UUID objects and adapt to changes in the APP_ID_DICT dictionary table.

Browse Source
This commit is contained in:
fengweihao
2024-10-12 11:20:39 +08:00
parent c9ae13042d
commit b7fb2d8a42
4 changed files with 151 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files

37
common/src/tfe_scan.cpp
View File

@@ -3,12 +3,12 @@
#include <tfe_scan.h>
#include <MESA/stream.h>
static int scan_string(uuid_t *result, struct maat_state *scan_mid, int hit_cnt,const char *data, const char *table_name, const char *attribute_name)
static int scan_object(uuid_t *result, struct maat_state *scan_mid, int hit_cnt, struct maat_hit_object objects, const char *table_name, const char *attribute_name)
{
size_t n_hit_result=0;
int scan_ret=0, hit_cnt_group=0;
scan_ret = maat_scan_string(tfe_get_maat_handle(), table_name, attribute_name, data, strlen(data), result+hit_cnt+hit_cnt_group,
scan_ret = maat_scan_object(tfe_get_maat_handle(), table_name, attribute_name, &objects, 1, result+hit_cnt+hit_cnt_group,
MAX_SCAN_RESULT-hit_cnt-hit_cnt_group, &n_hit_result, scan_mid);
if(scan_ret == MAAT_SCAN_HIT)
{
@@ -210,6 +210,7 @@ int tfe_get_library_tags(const struct tfe_stream *stream, cJSON *common_obj, tfe
int tfe_scan_ip_tags(const struct tfe_stream *stream, uuid_t *result, struct maat_state *scan_mid, int hit_cnt, void *logger)
{
size_t n_hit_result = 0;
struct maat_hit_object objects;
char tag_id_array[128][UUID_STRING_SIZE];
char result_str[UUID_STRING_SIZE]={0};
int scan_ret = 0, hit_cnt_ip = 0, n_tag_ids = 0;
@@ -225,7 +226,9 @@ int tfe_scan_ip_tags(const struct tfe_stream *stream, uuid_t *result, struct maa
for (int i = 0; i < n_tag_ids; i++)
{
scan_ret = maat_scan_string(tfe_get_maat_handle(), "TSG_OBJ_IP_ADDR", "ATTR_SOURCE_IP", tag_id_array[i], strlen(tag_id_array[i]), result+hit_cnt+hit_cnt_ip,
memset(&objects, 0, sizeof(objects));
uuid_copy(objects.object_uuid, opt_val[i]);
scan_ret = maat_scan_object(tfe_get_maat_handle(), "TSG_OBJ_IP_ADDR", "ATTR_SOURCE_IP", &objects, 1, result+hit_cnt+hit_cnt_ip,
MAX_SCAN_RESULT-hit_cnt-hit_cnt_ip, &n_hit_result, scan_mid);
if(scan_ret == MAAT_SCAN_HIT)
{
@@ -258,7 +261,9 @@ int tfe_scan_ip_tags(const struct tfe_stream *stream, uuid_t *result, struct maa
for (int i = 0; i < n_tag_ids; i++)
{
scan_ret = maat_scan_string(tfe_get_maat_handle(), "TSG_OBJ_IP_ADDR", "ATTR_DESTINATION_IP", tag_id_array[i], strlen(tag_id_array[i]), result+hit_cnt+hit_cnt_ip,
memset(&objects, 0, sizeof(objects));
uuid_copy(objects.object_uuid, opt_val[i]);
scan_ret = maat_scan_object(tfe_get_maat_handle(), "TSG_OBJ_IP_ADDR", "ATTR_DESTINATION_IP", &objects, 1, result+hit_cnt+hit_cnt_ip,
MAX_SCAN_RESULT-hit_cnt-hit_cnt_ip, &n_hit_result, scan_mid);
if(scan_ret==MAAT_SCAN_HIT)
{
@@ -283,6 +288,7 @@ int tfe_scan_ip_tags(const struct tfe_stream *stream, uuid_t *result, struct maa
int tfe_scan_fqdn_tags(const struct tfe_stream *stream, uuid_t *result, struct maat_state *scan_mid, int hit_cnt, void *logger)
{
uuid_t opt_val[128]={0};
struct maat_hit_object objects;
char tag_id_array[128][UUID_STRING_SIZE];
int scan_ret = 0, hit_cnt_fqdn = 0, n_tag_ids = 0;
@@ -296,7 +302,9 @@ int tfe_scan_fqdn_tags(const struct tfe_stream *stream, uuid_t *result, struct m
for (int i = 0; i < n_tag_ids; i++)
{
scan_ret = scan_string(result, scan_mid, hit_cnt, tag_id_array[i], "TSG_OBJ_FQDN", "ATTR_SERVER_FQDN");
memset(&objects, 0, sizeof(objects));
uuid_copy(objects.object_uuid, opt_val[i]);
scan_ret = scan_object(result, scan_mid, hit_cnt, objects, "TSG_OBJ_FQDN", "ATTR_SERVER_FQDN");
if (scan_ret > 0)
{
char result_str[UUID_STRING_SIZE]={0};
@@ -317,11 +325,14 @@ int tfe_scan_app_id(uuid_t *result, struct maat_state *scan_mid, int hit_cnt, lo
int scan_ret = 0;
int hit_app_id = 0;
size_t n_hit_result = 0;
struct maat_hit_object objects;
struct app_id_dict *app_dict = (struct app_id_dict*)maat_plugin_table_get_ex_data(tfe_get_maat_handle(), "APP_ID_DICT", (const char *)&app_id, sizeof(long long));
if(app_dict!=NULL)
{
scan_ret=maat_scan_integer(tfe_get_maat_handle(), "APP_ID_DICT", "ATTR_APP_ID", app_dict->object_id, result+hit_cnt+hit_app_id,
memset(&objects, 0, sizeof(objects));
uuid_copy(objects.object_uuid, app_dict->object_uuid);
scan_ret=maat_scan_object(tfe_get_maat_handle(), "APP_ID_DICT", "ATTR_APP_ID", &objects, 1, result+hit_cnt+hit_app_id,
MAX_SCAN_RESULT-hit_cnt-hit_app_id, &n_hit_result, scan_mid);
if(scan_ret==MAAT_SCAN_HIT)
{
@@ -452,10 +463,15 @@ int tfe_scan_ipv4_addr(const struct tfe_stream *stream, uuid_t *result, struct m
{
int scan_ret = 0;
int hit_cnt_ip = 0;
uuid_t objects_uuid;
size_t n_hit_result = 0;
struct maat_hit_object objects;
const char *protocol_uuid =PROTOCOL_TCP_UUID_ID;
scan_ret = maat_scan_string(tfe_get_maat_handle(), "TSG_OBJ_IP_PROTOCOL", "ATTR_IP_PROTOCOL", protocol_uuid, strlen(protocol_uuid), result+hit_cnt+hit_cnt_ip,
memset(&objects, 0, sizeof(objects));
uuid_parse(protocol_uuid, objects_uuid);
uuid_copy(objects.object_uuid, objects_uuid);
scan_ret = maat_scan_object(tfe_get_maat_handle(), "TSG_OBJ_IP_PROTOCOL", "ATTR_IP_PROTOCOL", &objects, 1, result+hit_cnt+hit_cnt_ip,
MAX_SCAN_RESULT-hit_cnt-hit_cnt_ip, &n_hit_result, scan_mid);
if(scan_ret==MAAT_SCAN_HIT)
{
@@ -512,9 +528,14 @@ int tfe_scan_ipv6_addr(const struct tfe_stream *stream, uuid_t *result, struct m
int scan_ret = 0;
int hit_cnt_ip = 0;
size_t n_hit_result = 0;
uuid_t objects_uuid;
struct maat_hit_object objects;
const char *protocol_uuid =PROTOCOL_TCP_UUID_ID;
scan_ret = maat_scan_string(tfe_get_maat_handle(), "TSG_OBJ_IP_PROTOCOL", "ATTR_IP_PROTOCOL", protocol_uuid, strlen(protocol_uuid), result+hit_cnt+hit_cnt_ip,
memset(&objects, 0, sizeof(objects));
uuid_parse(protocol_uuid, objects_uuid);
uuid_copy(objects.object_uuid, objects_uuid);
scan_ret = maat_scan_object(tfe_get_maat_handle(), "TSG_OBJ_IP_PROTOCOL", "ATTR_IP_PROTOCOL", &objects, 1, result+hit_cnt+hit_cnt_ip,
MAX_SCAN_RESULT-hit_cnt-hit_cnt_ip, &n_hit_result, scan_mid);
if(scan_ret==MAAT_SCAN_HIT)
{