Fix the scanning interface for UUID objects and adapt to changes in the APP_ID_DICT dictionary table.

common/include/tfe_resource.h

@@ -1,5 +1,7 @@
 #pragma once
 
+#include <uuid/uuid.h>
+
 enum category_type
 {
 	CATEGORY_TYPE_UNKNOWN = 0,
@@ -17,7 +19,7 @@ struct app_id_dict
 {
 	int ref_cnt;
 	int app_id;
-	int object_id;
+	uuid_t object_uuid;
 
 	pthread_mutex_t lock;
 };

common/src/tfe_resource.cpp

@@ -247,10 +247,10 @@ void app_dict_table_new_cb(const char *table_name, const char* key, const char*
 		app_dict->app_id = item->valueint;
 	}
 
-	item = cJSON_GetObjectItem(app_id_dict_json, "object_id");
+	item = cJSON_GetObjectItem(app_id_dict_json, "uuid");
-	if(item && item->type==cJSON_Number)
+	if(item && item->type==cJSON_String)
 	{
-		app_dict->object_id = item->valueint;
+		uuid_parse(item->valuestring, app_dict->object_uuid);
 	}
 	
 	cJSON_Delete(app_id_dict_json);

common/src/tfe_scan.cpp

@@ -3,12 +3,12 @@
 #include <tfe_scan.h>
 #include <MESA/stream.h>
 
-static int scan_string(uuid_t *result, struct maat_state *scan_mid, int hit_cnt,const char *data, const char *table_name, const char *attribute_name)
+static int scan_object(uuid_t *result, struct maat_state *scan_mid, int hit_cnt, struct maat_hit_object objects, const char *table_name, const char *attribute_name)
 {
 	size_t n_hit_result=0;
 	int scan_ret=0, hit_cnt_group=0;
 
-	scan_ret = maat_scan_string(tfe_get_maat_handle(), table_name, attribute_name, data, strlen(data), result+hit_cnt+hit_cnt_group,
+	scan_ret = maat_scan_object(tfe_get_maat_handle(), table_name, attribute_name, &objects, 1, result+hit_cnt+hit_cnt_group,
 								MAX_SCAN_RESULT-hit_cnt-hit_cnt_group, &n_hit_result, scan_mid);
 	if(scan_ret == MAAT_SCAN_HIT)
 	{
@@ -210,6 +210,7 @@ int tfe_get_library_tags(const struct tfe_stream *stream, cJSON *common_obj, tfe
 int tfe_scan_ip_tags(const struct tfe_stream *stream, uuid_t *result, struct maat_state *scan_mid, int hit_cnt, void *logger)
 {
     size_t n_hit_result = 0;
+    struct maat_hit_object objects;
 	char tag_id_array[128][UUID_STRING_SIZE];
     char result_str[UUID_STRING_SIZE]={0};
     int scan_ret = 0, hit_cnt_ip = 0, n_tag_ids = 0;
@@ -225,7 +226,9 @@ int tfe_scan_ip_tags(const struct tfe_stream *stream, uuid_t *result, struct maa
 
     for (int i = 0; i < n_tag_ids; i++)
     {
-		scan_ret = maat_scan_string(tfe_get_maat_handle(), "TSG_OBJ_IP_ADDR", "ATTR_SOURCE_IP", tag_id_array[i], strlen(tag_id_array[i]), result+hit_cnt+hit_cnt_ip,
+        memset(&objects, 0, sizeof(objects));
+        uuid_copy(objects.object_uuid, opt_val[i]);
+		scan_ret = maat_scan_object(tfe_get_maat_handle(), "TSG_OBJ_IP_ADDR", "ATTR_SOURCE_IP", &objects, 1, result+hit_cnt+hit_cnt_ip,
 								    MAX_SCAN_RESULT-hit_cnt-hit_cnt_ip, &n_hit_result, scan_mid);
         if(scan_ret == MAAT_SCAN_HIT)
         {
@@ -258,7 +261,9 @@ int tfe_scan_ip_tags(const struct tfe_stream *stream, uuid_t *result, struct maa
 
     for (int i = 0; i < n_tag_ids; i++)
     {
-        scan_ret = maat_scan_string(tfe_get_maat_handle(), "TSG_OBJ_IP_ADDR", "ATTR_DESTINATION_IP", tag_id_array[i], strlen(tag_id_array[i]), result+hit_cnt+hit_cnt_ip,
+        memset(&objects, 0, sizeof(objects));
+        uuid_copy(objects.object_uuid, opt_val[i]);
+        scan_ret = maat_scan_object(tfe_get_maat_handle(), "TSG_OBJ_IP_ADDR", "ATTR_DESTINATION_IP", &objects, 1, result+hit_cnt+hit_cnt_ip,
 								    MAX_SCAN_RESULT-hit_cnt-hit_cnt_ip, &n_hit_result, scan_mid);
 		if(scan_ret==MAAT_SCAN_HIT)
 		{
@@ -283,6 +288,7 @@ int tfe_scan_ip_tags(const struct tfe_stream *stream, uuid_t *result, struct maa
 int tfe_scan_fqdn_tags(const struct tfe_stream *stream, uuid_t *result, struct maat_state *scan_mid, int hit_cnt, void *logger)
 {
     uuid_t opt_val[128]={0};
+    struct maat_hit_object objects;
     char tag_id_array[128][UUID_STRING_SIZE];
     int scan_ret = 0, hit_cnt_fqdn = 0, n_tag_ids = 0;
 
@@ -296,7 +302,9 @@ int tfe_scan_fqdn_tags(const struct tfe_stream *stream, uuid_t *result, struct m
 
     for (int i = 0; i < n_tag_ids; i++)
     {
-        scan_ret = scan_string(result, scan_mid, hit_cnt, tag_id_array[i], "TSG_OBJ_FQDN", "ATTR_SERVER_FQDN");
+        memset(&objects, 0, sizeof(objects));
+        uuid_copy(objects.object_uuid, opt_val[i]);
+        scan_ret = scan_object(result, scan_mid, hit_cnt, objects, "TSG_OBJ_FQDN", "ATTR_SERVER_FQDN");
         if (scan_ret > 0)
         {
             char result_str[UUID_STRING_SIZE]={0};
@@ -317,11 +325,14 @@ int tfe_scan_app_id(uuid_t *result, struct maat_state *scan_mid, int hit_cnt, lo
     int scan_ret = 0;
     int hit_app_id = 0;
     size_t n_hit_result = 0;
+    struct maat_hit_object objects;
 
 	struct app_id_dict *app_dict = (struct app_id_dict*)maat_plugin_table_get_ex_data(tfe_get_maat_handle(), "APP_ID_DICT", (const char *)&app_id, sizeof(long long));
 	if(app_dict!=NULL)
 	{
-        scan_ret=maat_scan_integer(tfe_get_maat_handle(), "APP_ID_DICT", "ATTR_APP_ID", app_dict->object_id, result+hit_cnt+hit_app_id,
+        memset(&objects, 0, sizeof(objects));
+        uuid_copy(objects.object_uuid, app_dict->object_uuid);
+        scan_ret=maat_scan_object(tfe_get_maat_handle(), "APP_ID_DICT", "ATTR_APP_ID", &objects, 1, result+hit_cnt+hit_app_id,
 							       MAX_SCAN_RESULT-hit_cnt-hit_app_id, &n_hit_result, scan_mid);
 		if(scan_ret==MAAT_SCAN_HIT)
 		{
@@ -452,10 +463,15 @@ int tfe_scan_ipv4_addr(const struct tfe_stream *stream, uuid_t *result, struct m
 {
     int scan_ret = 0;
     int hit_cnt_ip = 0;
+    uuid_t objects_uuid;
 	size_t n_hit_result = 0;
+    struct maat_hit_object objects;
 
     const char *protocol_uuid =PROTOCOL_TCP_UUID_ID;
-    scan_ret = maat_scan_string(tfe_get_maat_handle(), "TSG_OBJ_IP_PROTOCOL", "ATTR_IP_PROTOCOL", protocol_uuid, strlen(protocol_uuid), result+hit_cnt+hit_cnt_ip,
+    memset(&objects, 0, sizeof(objects));
+    uuid_parse(protocol_uuid, objects_uuid);			
+	uuid_copy(objects.object_uuid, objects_uuid);		
+    scan_ret = maat_scan_object(tfe_get_maat_handle(), "TSG_OBJ_IP_PROTOCOL", "ATTR_IP_PROTOCOL", &objects, 1, result+hit_cnt+hit_cnt_ip,
 								MAX_SCAN_RESULT-hit_cnt-hit_cnt_ip, &n_hit_result, scan_mid);
     if(scan_ret==MAAT_SCAN_HIT)
     {
@@ -512,9 +528,14 @@ int tfe_scan_ipv6_addr(const struct tfe_stream *stream, uuid_t *result, struct m
     int scan_ret = 0;
     int hit_cnt_ip = 0;
 	size_t n_hit_result = 0;
+    uuid_t objects_uuid;
+    struct maat_hit_object objects;
 
     const char *protocol_uuid =PROTOCOL_TCP_UUID_ID;
-    scan_ret = maat_scan_string(tfe_get_maat_handle(), "TSG_OBJ_IP_PROTOCOL", "ATTR_IP_PROTOCOL", protocol_uuid, strlen(protocol_uuid), result+hit_cnt+hit_cnt_ip,
+    memset(&objects, 0, sizeof(objects));
+    uuid_parse(protocol_uuid, objects_uuid);			
+	uuid_copy(objects.object_uuid, objects_uuid);		
+    scan_ret = maat_scan_object(tfe_get_maat_handle(), "TSG_OBJ_IP_PROTOCOL", "ATTR_IP_PROTOCOL", &objects, 1, result+hit_cnt+hit_cnt_ip,
                                 MAX_SCAN_RESULT-hit_cnt-hit_cnt_ip, &n_hit_result, scan_mid);
     if(scan_ret==MAAT_SCAN_HIT)
     {

resource/pangu/pangu_http.json

@@ -3,7 +3,7 @@
     "object2object_table": "OBJECT_GROUP",
     "rules": [
         {
-            "uuid": "40c9c6a7-70a9-48ae-9fba-ec7966edd3c6",
+            "uuid": "00001021-0000-0000-0000-000000000000",
             "service": 1,
             "action": "manipulate",
             "blacklist_option": 1,
@@ -20,7 +20,115 @@
                                     "table_name": "TSG_OBJ_URL",
                                     "table_type": "expr",
                                     "table_content": {
-                                        "keywords": "test123456",
+                                        "expression": "baidu.com",
+                                        "expr_type": "and"
+                                    }
+                                }
+                            ]
+                        }
+                    ]
+                },
+                {
+					"attribute_name": "ATTR_APP_ID",
+                    "negate_option": false,
+					"object_uuids": [
+                        "00000201-0000-0000-0000-000000000000"
+                    ]
+				}
+            ]
+        },
+        {
+            "uuid": "00001023-0000-0000-0000-000000000000",
+            "service": 1,
+            "action": "manipulate",
+            "blacklist_option": 1,
+            "log_option": "all",
+            "action_parameter": {"protocol":"http","method":"replace","rules":[{"search_in":"http_resp_body","find":"<22><><EFBFBD><EFBFBD>","replace_with":"test"}]},
+            "is_valid": "yes",
+            "conditions": [
+                {
+                    "attribute_name": "ATTR_SERVER_FQDN",
+                    "objects": [
+                        {
+                            "items": [
+                                {
+                                    "table_name": "TSG_OBJ_FQDN",
+                                    "table_type": "expr",
+                                    "table_content": {
+                                        "expression": "baidu.com",
+                                        "expr_type": "and"
+                                    }
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ]
+        },
+        {
+            "uuid": "00001026-0000-0000-0000-000000000000",
+            "service": 1,
+            "action": "manipulate",
+            "blacklist_option": 1,
+            "log_option": "all",
+            "action_parameter": {"protocol":"http","method":"block","code":403,"message":"error"},
+            "is_valid": "yes",
+            "conditions": [
+                {
+                    "attribute_name": "ATTR_HTTP_REQ_HDR",
+                    "objects": [
+                        {
+                            "items": [
+                                {
+                                    "table_name": "TSG_OBJ_KEYWORD",
+                                    "table_type": "expr",
+                                    "table_content": {
+                                        "expression": "Chrome",
+                                        "expr_type": "and"
+                                    }
+                                }
+                            ]
+                        }
+                    ]
+                },
+                {
+                    "attribute_name": "ATTR_HTTP_REQ_HDR",
+                    "objects": [
+                        {
+                            "items": [
+                                {
+                                    "table_name": "TSG_OBJ_KEYWORD",
+                                    "table_type": "expr",
+                                    "table_content": {
+                                        "expression": "uid=12345678",
+                                        "expr_type": "and"
+                                    }
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ]
+        },
+        {
+            "uuid": "00001028-0000-0000-0000-000000000000",
+            "service": 1,
+            "action": "manipulate",
+            "blacklist_option": 1,
+            "log_option": "all",
+            "action_parameter": {"protocol":"http","method":"block","code":403,"message":"error"},
+            "is_valid": "yes",
+            "conditions": [
+                {
+                    "attribute_name": "ATTR_HTTP_URL",
+                    "objects": [
+                        {
+                            "items": [
+                                {
+                                    "table_name": "TSG_OBJ_URL",
+                                    "table_type": "expr",
+                                    "table_content": {
+                                        "expression": "bing.com",
                                         "expr_type": "and"
                                     }
                                 }
@@ -41,19 +149,19 @@
         {
             "table_name": "TSG_PROFILE_RESPONSE_PAGES",
             "table_content": [
-                {"uuid":"RESPONSE-PAGES-0000-0000-000000000001","profile_name":"404","format":"html","path":"./resource/pangu/policy_file/404.html","is_valid":1,"modified_time":"1716531859000000"}
+                {"uuid":"00000101-0000-0000-0000-000000000000","profile_name":"404","format":"html","path":"./resource/pangu/policy_file/404.html","is_valid":1,"modified_time":"1716531859000000"}
             ]
         },
         {
             "table_name": "PXY_PROFILE_HIJACK_FILES",
             "table_content": [
-                {"uuid":"HIJACK-FILES-0000-0000-000000000001","profile_name":"chakanqi","content_name":"chakanqi-947KB.exe","content_type":"application/x-msdos-program","path":"./resource/pangu/policy_file/chakanqi-947KB.exe","is_valid":1,"modified_time":"1716531859000000"}
+                {"uuid":"00000201-0000-0000-0000-000000000000","profile_name":"chakanqi","content_name":"chakanqi-947KB.exe","content_type":"application/x-msdos-program","path":"./resource/pangu/policy_file/chakanqi-947KB.exe","is_valid":1,"modified_time":"1716531859000000"}
             ]
         },
 		{
             "table_name": "PXY_PROFILE_INSERT_SCRIPTS",
             "table_content": [
-                {"uuid":"INSERT-SCRIPTS-0000-0000-000000000001","profile_name":"time","format":"js","insert_on":"before_page_load","path":"./resource/pangu/policy_file/time.js","is_valid":1,"modified_time":"1716531859000000"}
+                {"uuid":"00000301-0000-0000-0000-000000000000","profile_name":"time","format":"js","insert_on":"before_page_load","path":"./resource/pangu/policy_file/time.js","is_valid":1,"modified_time":"1716531859000000"}
             ]
         },
 		{		
@@ -95,8 +203,8 @@
 		{
             "table_name": "APP_ID_DICT",
             "table_content": [
-	            {"app_id":67,"object_id":201,"app_name":"http","parent_app_id":0,"parent_app_name":null,"category":"general-internet","subcategory":"internet-utility","content":"unknown","risk":"1","characteristics":null,"deny_action":null,"depends_on_app_ids":"null","implicitly_uses_app_ids":"null","continue_scanning":0,"tcp_timeout":120,"udp_timeout":120,"tcp_half_close":0,"tcp_time_wait":0,"is_valid":1,"modified_time":"1716531859000000"},
+	            {"app_id":67,"object_uuid":"00000201-0000-0000-0000-000000000000","app_name":"http","parent_app_id":0,"parent_app_name":null,"category":"general-internet","subcategory":"internet-utility","content":"unknown","risk":"1","characteristics":null,"deny_action":null,"depends_on_app_ids":"null","implicitly_uses_app_ids":"null","continue_scanning":0,"tcp_timeout":120,"udp_timeout":120,"tcp_half_close":0,"tcp_time_wait":0,"is_valid":1,"modified_time":"1716531859000000"},
-                {"app_id":68,"object_id":68000,"app_name":"https","parent_app_id":0,"parent_app_name":null,"category":"general-internet","subcategory":"internet-utility","content":"unknown","risk":"1","characteristics":null,"deny_action":null,"depends_on_app_ids":"null","implicitly_uses_app_ids":"null","continue_scanning":0,"tcp_timeout":120,"udp_timeout":120,"tcp_half_close":0,"tcp_time_wait":0,"is_valid":1,"modified_time":"1716531859000000"}
+                {"app_id":68,"object_uuid":"00068000-0000-0000-0000-000000000000","app_name":"https","parent_app_id":0,"parent_app_name":null,"category":"general-internet","subcategory":"internet-utility","content":"unknown","risk":"1","characteristics":null,"deny_action":null,"depends_on_app_ids":"null","implicitly_uses_app_ids":"null","continue_scanning":0,"tcp_timeout":120,"udp_timeout":120,"tcp_half_close":0,"tcp_time_wait":0,"is_valid":1,"modified_time":"1716531859000000"}
             ]
         }
     ]