gfwleak/tango-tfe
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix the scanning interface for UUID objects and adapt to changes in the APP_ID_DICT dictionary table.

Browse Source
This commit is contained in:
fengweihao
2024-10-12 11:20:39 +08:00
parent c9ae13042d
commit b7fb2d8a42
4 changed files with 151 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
common/include/tfe_resource.h
View File

@@ -1,5 +1,7 @@
#pragma once
#include <uuid/uuid.h>
enum category_type
{
CATEGORY_TYPE_UNKNOWN = 0,
@@ -17,7 +19,7 @@ struct app_id_dict
{
int ref_cnt;
int app_id;
int object_id;
uuid_t object_uuid;
pthread_mutex_t lock;
};

8
common/src/tfe_resource.cpp
View File

@@ -247,12 +247,12 @@ void app_dict_table_new_cb(const char *table_name, const char* key, const char*
app_dict->app_id = item->valueint;
}
item = cJSON_GetObjectItem(app_id_dict_json, "object_id");
if(item && item->type==cJSON_Number)
item = cJSON_GetObjectItem(app_id_dict_json, "uuid");
if(item && item->type==cJSON_String)
{
app_dict->object_id = item->valueint;
uuid_parse(item->valuestring, app_dict->object_uuid);
}
cJSON_Delete(app_id_dict_json);
app_dict->ref_cnt=1;
pthread_mutex_init(&(app_dict->lock), NULL);

37
common/src/tfe_scan.cpp
View File

@@ -3,12 +3,12 @@
#include <tfe_scan.h>
#include <MESA/stream.h>
static int scan_string(uuid_t *result, struct maat_state *scan_mid, int hit_cnt,const char *data, const char *table_name, const char *attribute_name)
static int scan_object(uuid_t *result, struct maat_state *scan_mid, int hit_cnt, struct maat_hit_object objects, const char *table_name, const char *attribute_name)
{
size_t n_hit_result=0;
int scan_ret=0, hit_cnt_group=0;
scan_ret = maat_scan_string(tfe_get_maat_handle(), table_name, attribute_name, data, strlen(data), result+hit_cnt+hit_cnt_group,
scan_ret = maat_scan_object(tfe_get_maat_handle(), table_name, attribute_name, &objects, 1, result+hit_cnt+hit_cnt_group,
MAX_SCAN_RESULT-hit_cnt-hit_cnt_group, &n_hit_result, scan_mid);
if(scan_ret == MAAT_SCAN_HIT)
{
@@ -210,6 +210,7 @@ int tfe_get_library_tags(const struct tfe_stream *stream, cJSON *common_obj, tfe
int tfe_scan_ip_tags(const struct tfe_stream *stream, uuid_t *result, struct maat_state *scan_mid, int hit_cnt, void *logger)
{
size_t n_hit_result = 0;
struct maat_hit_object objects;
char tag_id_array[128][UUID_STRING_SIZE];
char result_str[UUID_STRING_SIZE]={0};
int scan_ret = 0, hit_cnt_ip = 0, n_tag_ids = 0;
@@ -225,7 +226,9 @@ int tfe_scan_ip_tags(const struct tfe_stream *stream, uuid_t *result, struct maa
for (int i = 0; i < n_tag_ids; i++)
{
scan_ret = maat_scan_string(tfe_get_maat_handle(), "TSG_OBJ_IP_ADDR", "ATTR_SOURCE_IP", tag_id_array[i], strlen(tag_id_array[i]), result+hit_cnt+hit_cnt_ip,
memset(&objects, 0, sizeof(objects));
uuid_copy(objects.object_uuid, opt_val[i]);
scan_ret = maat_scan_object(tfe_get_maat_handle(), "TSG_OBJ_IP_ADDR", "ATTR_SOURCE_IP", &objects, 1, result+hit_cnt+hit_cnt_ip,
MAX_SCAN_RESULT-hit_cnt-hit_cnt_ip, &n_hit_result, scan_mid);
if(scan_ret == MAAT_SCAN_HIT)
{
@@ -258,7 +261,9 @@ int tfe_scan_ip_tags(const struct tfe_stream *stream, uuid_t *result, struct maa
for (int i = 0; i < n_tag_ids; i++)
{
scan_ret = maat_scan_string(tfe_get_maat_handle(), "TSG_OBJ_IP_ADDR", "ATTR_DESTINATION_IP", tag_id_array[i], strlen(tag_id_array[i]), result+hit_cnt+hit_cnt_ip,
memset(&objects, 0, sizeof(objects));
uuid_copy(objects.object_uuid, opt_val[i]);
scan_ret = maat_scan_object(tfe_get_maat_handle(), "TSG_OBJ_IP_ADDR", "ATTR_DESTINATION_IP", &objects, 1, result+hit_cnt+hit_cnt_ip,
MAX_SCAN_RESULT-hit_cnt-hit_cnt_ip, &n_hit_result, scan_mid);
if(scan_ret==MAAT_SCAN_HIT)
{
@@ -283,6 +288,7 @@ int tfe_scan_ip_tags(const struct tfe_stream *stream, uuid_t *result, struct maa
int tfe_scan_fqdn_tags(const struct tfe_stream *stream, uuid_t *result, struct maat_state *scan_mid, int hit_cnt, void *logger)
{
uuid_t opt_val[128]={0};
struct maat_hit_object objects;
char tag_id_array[128][UUID_STRING_SIZE];
int scan_ret = 0, hit_cnt_fqdn = 0, n_tag_ids = 0;
@@ -296,7 +302,9 @@ int tfe_scan_fqdn_tags(const struct tfe_stream *stream, uuid_t *result, struct m
for (int i = 0; i < n_tag_ids; i++)
{
scan_ret = scan_string(result, scan_mid, hit_cnt, tag_id_array[i], "TSG_OBJ_FQDN", "ATTR_SERVER_FQDN");
memset(&objects, 0, sizeof(objects));
uuid_copy(objects.object_uuid, opt_val[i]);
scan_ret = scan_object(result, scan_mid, hit_cnt, objects, "TSG_OBJ_FQDN", "ATTR_SERVER_FQDN");
if (scan_ret > 0)
{
char result_str[UUID_STRING_SIZE]={0};
@@ -317,11 +325,14 @@ int tfe_scan_app_id(uuid_t *result, struct maat_state *scan_mid, int hit_cnt, lo
int scan_ret = 0;
int hit_app_id = 0;
size_t n_hit_result = 0;
struct maat_hit_object objects;
struct app_id_dict *app_dict = (struct app_id_dict*)maat_plugin_table_get_ex_data(tfe_get_maat_handle(), "APP_ID_DICT", (const char *)&app_id, sizeof(long long));
if(app_dict!=NULL)
{
scan_ret=maat_scan_integer(tfe_get_maat_handle(), "APP_ID_DICT", "ATTR_APP_ID", app_dict->object_id, result+hit_cnt+hit_app_id,
memset(&objects, 0, sizeof(objects));
uuid_copy(objects.object_uuid, app_dict->object_uuid);
scan_ret=maat_scan_object(tfe_get_maat_handle(), "APP_ID_DICT", "ATTR_APP_ID", &objects, 1, result+hit_cnt+hit_app_id,
MAX_SCAN_RESULT-hit_cnt-hit_app_id, &n_hit_result, scan_mid);
if(scan_ret==MAAT_SCAN_HIT)
{
@@ -452,10 +463,15 @@ int tfe_scan_ipv4_addr(const struct tfe_stream *stream, uuid_t *result, struct m
{
int scan_ret = 0;
int hit_cnt_ip = 0;
uuid_t objects_uuid;
size_t n_hit_result = 0;
struct maat_hit_object objects;
const char *protocol_uuid =PROTOCOL_TCP_UUID_ID;
scan_ret = maat_scan_string(tfe_get_maat_handle(), "TSG_OBJ_IP_PROTOCOL", "ATTR_IP_PROTOCOL", protocol_uuid, strlen(protocol_uuid), result+hit_cnt+hit_cnt_ip,
memset(&objects, 0, sizeof(objects));
uuid_parse(protocol_uuid, objects_uuid);
uuid_copy(objects.object_uuid, objects_uuid);
scan_ret = maat_scan_object(tfe_get_maat_handle(), "TSG_OBJ_IP_PROTOCOL", "ATTR_IP_PROTOCOL", &objects, 1, result+hit_cnt+hit_cnt_ip,
MAX_SCAN_RESULT-hit_cnt-hit_cnt_ip, &n_hit_result, scan_mid);
if(scan_ret==MAAT_SCAN_HIT)
{
@@ -512,9 +528,14 @@ int tfe_scan_ipv6_addr(const struct tfe_stream *stream, uuid_t *result, struct m
int scan_ret = 0;
int hit_cnt_ip = 0;
size_t n_hit_result = 0;
uuid_t objects_uuid;
struct maat_hit_object objects;
const char *protocol_uuid =PROTOCOL_TCP_UUID_ID;
scan_ret = maat_scan_string(tfe_get_maat_handle(), "TSG_OBJ_IP_PROTOCOL", "ATTR_IP_PROTOCOL", protocol_uuid, strlen(protocol_uuid), result+hit_cnt+hit_cnt_ip,
memset(&objects, 0, sizeof(objects));
uuid_parse(protocol_uuid, objects_uuid);
uuid_copy(objects.object_uuid, objects_uuid);
scan_ret = maat_scan_object(tfe_get_maat_handle(), "TSG_OBJ_IP_PROTOCOL", "ATTR_IP_PROTOCOL", &objects, 1, result+hit_cnt+hit_cnt_ip,
MAX_SCAN_RESULT-hit_cnt-hit_cnt_ip, &n_hit_result, scan_mid);
if(scan_ret==MAAT_SCAN_HIT)
{

122
resource/pangu/pangu_http.json
View File

@@ -3,7 +3,7 @@
"object2object_table": "OBJECT_GROUP",
"rules": [
{
"uuid": "40c9c6a7-70a9-48ae-9fba-ec7966edd3c6",
"uuid": "00001021-0000-0000-0000-000000000000",
"service": 1,
"action": "manipulate",
"blacklist_option": 1,
@@ -20,7 +20,115 @@
"table_name": "TSG_OBJ_URL",
"table_type": "expr",
"table_content": {
"keywords": "test123456",
"expression": "baidu.com",
"expr_type": "and"
}
}
]
}
]
},
{
"attribute_name": "ATTR_APP_ID",
"negate_option": false,
"object_uuids": [
"00000201-0000-0000-0000-000000000000"
]
}
]
},
{
"uuid": "00001023-0000-0000-0000-000000000000",
"service": 1,
"action": "manipulate",
"blacklist_option": 1,
"log_option": "all",
"action_parameter": {"protocol":"http","method":"replace","rules":[{"search_in":"http_resp_body","find":"<22><><EFBFBD><EFBFBD>","replace_with":"test"}]},
"is_valid": "yes",
"conditions": [
{
"attribute_name": "ATTR_SERVER_FQDN",
"objects": [
{
"items": [
{
"table_name": "TSG_OBJ_FQDN",
"table_type": "expr",
"table_content": {
"expression": "baidu.com",
"expr_type": "and"
}
}
]
}
]
}
]
},
{
"uuid": "00001026-0000-0000-0000-000000000000",
"service": 1,
"action": "manipulate",
"blacklist_option": 1,
"log_option": "all",
"action_parameter": {"protocol":"http","method":"block","code":403,"message":"error"},
"is_valid": "yes",
"conditions": [
{
"attribute_name": "ATTR_HTTP_REQ_HDR",
"objects": [
{
"items": [
{
"table_name": "TSG_OBJ_KEYWORD",
"table_type": "expr",
"table_content": {
"expression": "Chrome",
"expr_type": "and"
}
}
]
}
]
},
{
"attribute_name": "ATTR_HTTP_REQ_HDR",
"objects": [
{
"items": [
{
"table_name": "TSG_OBJ_KEYWORD",
"table_type": "expr",
"table_content": {
"expression": "uid=12345678",
"expr_type": "and"
}
}
]
}
]
}
]
},
{
"uuid": "00001028-0000-0000-0000-000000000000",
"service": 1,
"action": "manipulate",
"blacklist_option": 1,
"log_option": "all",
"action_parameter": {"protocol":"http","method":"block","code":403,"message":"error"},
"is_valid": "yes",
"conditions": [
{
"attribute_name": "ATTR_HTTP_URL",
"objects": [
{
"items": [
{
"table_name": "TSG_OBJ_URL",
"table_type": "expr",
"table_content": {
"expression": "bing.com",
"expr_type": "and"
}
}
@@ -41,19 +149,19 @@
{
"table_name": "TSG_PROFILE_RESPONSE_PAGES",
"table_content": [
{"uuid":"RESPONSE-PAGES-0000-0000-000000000001","profile_name":"404","format":"html","path":"./resource/pangu/policy_file/404.html","is_valid":1,"modified_time":"1716531859000000"}
{"uuid":"00000101-0000-0000-0000-000000000000","profile_name":"404","format":"html","path":"./resource/pangu/policy_file/404.html","is_valid":1,"modified_time":"1716531859000000"}
]
},
{
"table_name": "PXY_PROFILE_HIJACK_FILES",
"table_content": [
{"uuid":"HIJACK-FILES-0000-0000-000000000001","profile_name":"chakanqi","content_name":"chakanqi-947KB.exe","content_type":"application/x-msdos-program","path":"./resource/pangu/policy_file/chakanqi-947KB.exe","is_valid":1,"modified_time":"1716531859000000"}
{"uuid":"00000201-0000-0000-0000-000000000000","profile_name":"chakanqi","content_name":"chakanqi-947KB.exe","content_type":"application/x-msdos-program","path":"./resource/pangu/policy_file/chakanqi-947KB.exe","is_valid":1,"modified_time":"1716531859000000"}
]
},
{
"table_name": "PXY_PROFILE_INSERT_SCRIPTS",
"table_content": [
{"uuid":"INSERT-SCRIPTS-0000-0000-000000000001","profile_name":"time","format":"js","insert_on":"before_page_load","path":"./resource/pangu/policy_file/time.js","is_valid":1,"modified_time":"1716531859000000"}
{"uuid":"00000301-0000-0000-0000-000000000000","profile_name":"time","format":"js","insert_on":"before_page_load","path":"./resource/pangu/policy_file/time.js","is_valid":1,"modified_time":"1716531859000000"}
]
},
{
@@ -95,8 +203,8 @@
{
"table_name": "APP_ID_DICT",
"table_content": [
{"app_id":67,"object_id":201,"app_name":"http","parent_app_id":0,"parent_app_name":null,"category":"general-internet","subcategory":"internet-utility","content":"unknown","risk":"1","characteristics":null,"deny_action":null,"depends_on_app_ids":"null","implicitly_uses_app_ids":"null","continue_scanning":0,"tcp_timeout":120,"udp_timeout":120,"tcp_half_close":0,"tcp_time_wait":0,"is_valid":1,"modified_time":"1716531859000000"},
{"app_id":68,"object_id":68000,"app_name":"https","parent_app_id":0,"parent_app_name":null,"category":"general-internet","subcategory":"internet-utility","content":"unknown","risk":"1","characteristics":null,"deny_action":null,"depends_on_app_ids":"null","implicitly_uses_app_ids":"null","continue_scanning":0,"tcp_timeout":120,"udp_timeout":120,"tcp_half_close":0,"tcp_time_wait":0,"is_valid":1,"modified_time":"1716531859000000"}
{"app_id":67,"object_uuid":"00000201-0000-0000-0000-000000000000","app_name":"http","parent_app_id":0,"parent_app_name":null,"category":"general-internet","subcategory":"internet-utility","content":"unknown","risk":"1","characteristics":null,"deny_action":null,"depends_on_app_ids":"null","implicitly_uses_app_ids":"null","continue_scanning":0,"tcp_timeout":120,"udp_timeout":120,"tcp_half_close":0,"tcp_time_wait":0,"is_valid":1,"modified_time":"1716531859000000"},
{"app_id":68,"object_uuid":"00068000-0000-0000-0000-000000000000","app_name":"https","parent_app_id":0,"parent_app_name":null,"category":"general-internet","subcategory":"internet-utility","content":"unknown","risk":"1","characteristics":null,"deny_action":null,"depends_on_app_ids":"null","implicitly_uses_app_ids":"null","continue_scanning":0,"tcp_timeout":120,"udp_timeout":120,"tcp_half_close":0,"tcp_time_wait":0,"is_valid":1,"modified_time":"1716531859000000"}
]
}
]