TSG-1531 TFE 新增 DOH 插件
1.DOH 协议解析 2.DOH 协议还原 3.DOH POST请求 early response 4.DOH 策略扫描 5.tfe plugin 支持多个 bussiness 插件调用 6.Maat_feather 的创建从 pangu 剥离(涉及pangu/doh/ssl-policy) 7.增加 kafka 日志 8.增加测试用例
This commit is contained in:
luwenpeng
170
resource/pangu/doh.json
Normal file
170
resource/pangu/doh.json
Normal file
@@ -0,0 +1,170 @@
|
||||
{
|
||||
"compile_table": "PXY_CTRL_COMPILE",
|
||||
"group_table": "GROUP_COMPILE_RELATION",
|
||||
"rules": [
|
||||
{
|
||||
"compile_id": 1021,
|
||||
"service": 1,
|
||||
"action": 48,
|
||||
"do_blacklist": 1,
|
||||
"do_log": 1,
|
||||
"effective_range": 0,
|
||||
"user_region": "{\"protocol\":\"http\",\"method\":\"redirect\",\"code\":302,\"to\":\"https://www.jd.com\"}",
|
||||
"is_valid": "yes",
|
||||
"groups": [
|
||||
{
|
||||
"group_name":"http_url",
|
||||
"not_flag":0,
|
||||
"regions": [
|
||||
{
|
||||
"table_name": "TSG_OBJ_URL",
|
||||
"table_type": "string",
|
||||
"table_content": {
|
||||
"keywords": "baidu.com",
|
||||
"expr_type": "regex",
|
||||
"match_method": "sub",
|
||||
"format": "uncase plain"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"compile_id": 1022,
|
||||
"service": 1,
|
||||
"action": 48,
|
||||
"do_blacklist": 1,
|
||||
"do_log": 1,
|
||||
"effective_range": 0,
|
||||
"user_region": "{\"protocol\":\"http\",\"method\":\"redirect\",\"code\":302,\"to\":\"https://www.jd.com\"}",
|
||||
"is_valid": "yes",
|
||||
"groups": [
|
||||
{
|
||||
"group_name":"http_url",
|
||||
"virtual_table":"TSG_FIELD_HTTP_URL",
|
||||
"not_flag":0
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"compile_id": 1023,
|
||||
"service": 1,
|
||||
"action": 48,
|
||||
"do_blacklist": 1,
|
||||
"do_log": 1,
|
||||
"effective_range": 0,
|
||||
"user_region": "{\"protocol\":\"http\",\"method\":\"replace\",\"rules\":[{\"search_in\":\"http_resp_body\",\"find\":\"邮箱\",\"replace_with\":\"test\"}]}",
|
||||
"is_valid": "yes",
|
||||
"groups": [
|
||||
{
|
||||
"group_name":"http_fqdn",
|
||||
"not_flag":0,
|
||||
"regions": [
|
||||
{
|
||||
"table_name": "TSG_OBJ_FQDN",
|
||||
"table_type": "string",
|
||||
"table_content": {
|
||||
"keywords": "www.126.com",
|
||||
"expr_type": "regex",
|
||||
"match_method": "sub",
|
||||
"format": "uncase plain"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"compile_id": 1024,
|
||||
"service": 1,
|
||||
"action": 48,
|
||||
"do_blacklist": 1,
|
||||
"do_log": 1,
|
||||
"effective_range": 0,
|
||||
"user_region":"{\"protocol\":\"http\",\"method\":\"replace\",\"rules\":[{\"search_in\":\"http_resp_body\",\"find\":\"大师\",\"replace_with\":\"小小\"}]}",
|
||||
"is_valid": "yes",
|
||||
"groups": [
|
||||
{
|
||||
"group_name":"http_fqdn",
|
||||
"virtual_table":"TSG_FIELD_HTTP_HOST",
|
||||
"not_flag":0
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"compile_id": 1025,
|
||||
"service": 1,
|
||||
"action": 48,
|
||||
"do_blacklist": 1,
|
||||
"do_log": 1,
|
||||
"effective_range": 0,
|
||||
"user_region": "{\"protocol\":\"DoH\",\"method\":\"redirect\",\"resolution\":[{\"qtype\":\"A\",\"answer\":[{\"atype\":\"CNAME\",\"value\":\"www.abc.com\",\"ttl\":{\"min\":60,\"max\":300}},{\"atype\":\"A\",\"value\":\"1.1.1.1\",\"ttl\":{\"min\":60,\"max\":300}}]},{\"qtype\":\"AAAA\",\"answer\":[{\"atype\":\"AAAA\",\"value\":\"aaaa:ffff:00\",\"ttl\":{\"min\":60,\"max\":300}},{\"atype\":\"CNAME\",\"value\":\"abc.com.cn\",\"ttl\":{\"min\":60,\"max\":300}}]}]}",
|
||||
"is_valid": "yes",
|
||||
"groups": [
|
||||
{
|
||||
"group_name":"http_fqdn",
|
||||
"virtual_table":"TSG_FIELD_DOH_QNAME",
|
||||
"not_flag":0
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"compile_id": 1026,
|
||||
"service": 1,
|
||||
"action": 48,
|
||||
"do_blacklist": 1,
|
||||
"do_log": 1,
|
||||
"effective_range": 0,
|
||||
"user_region": "{\"protocol\":\"DoH\",\"method\":\"redirect\",\"resolution\":[{\"qtype\":\"A\",\"answer\":[{\"atype\":\"CNAME\",\"value\":\"www.a.shifen.com\",\"ttl\":{\"min\":10,\"max\":10}},{\"atype\":\"A\",\"value\":\"182.61.200.6\",\"ttl\":{\"min\":20,\"max\":30}},{\"atype\":\"A\",\"value\":\"182.61.200.7\",\"ttl\":{\"min\":60,\"max\":61}}]},{\"qtype\":\"AAAA\",\"answer\":[{\"atype\":\"CNAME\",\"value\":\"www.taobao.com.danuoyi.tbcache.com\",\"ttl\":{\"min\":100,\"max\":100}},{\"atype\":\"AAAA\",\"value\":\"2408:871a:2800:4:3::3fa\",\"ttl\":{\"min\":200,\"max\":300}},{\"atype\":\"AAAA\",\"value\":\"2408:871a:2800:2:3::3fa\",\"ttl\":{\"min\":600,\"max\":310}}]}]}",
|
||||
"is_valid": "yes",
|
||||
"groups": [
|
||||
{
|
||||
"group_name":"http_fqdn",
|
||||
"virtual_table":"TSG_FIELD_DOH_QNAME",
|
||||
"not_flag":0
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"plugin_table": [
|
||||
{
|
||||
"table_name": "TSG_PROFILE_RESPONSE_PAGES",
|
||||
"table_content": [
|
||||
"101\t404\thtml\t./resource/pangu/policy_file/404.html\t1",
|
||||
"102\tHTTP403\ttemplate\t./resource/pangu/HTTP403.html\t1"
|
||||
]
|
||||
},
|
||||
{
|
||||
"table_name": "PXY_PROFILE_HIJACK_FILES",
|
||||
"table_content": [
|
||||
"201\tchakanqi\tchakanqi-947KB.exe\tapplication/x-msdos-program\t./resource/pangu/policy_file/chakanqi-947KB.exe\t1",
|
||||
"202\tWPS8648\tWPS8648-132M.exe\tapplication/x-msdos-program\t./resource/pangu/policy_file/WPS8648-132M.exe\t1"
|
||||
]
|
||||
},
|
||||
{
|
||||
"table_name": "PXY_PROFILE_INSERT_SCRIPTS",
|
||||
"table_content": [
|
||||
"301\ttime\tjs\t./resource/pangu/policy_file/time.js\tbefore_page_load\t1",
|
||||
"302\tu1\tcss\t./resource/pangu/policy_file/u1.css\tbefore_page_load\t1",
|
||||
"303\tu1\tjs\t./resource/pangu/policy_file/alert.js\tbefore_page_load\t1"
|
||||
]
|
||||
},
|
||||
{
|
||||
"table_name": "TSG_PROFILE_DECRYPTION",
|
||||
"table_content": [
|
||||
"0\ttest\t{\"dynamic_bypass\":{\"ev_cert\":0,\"cert_transparency\":0,\"mutual_authentication\":1,\"cert_pinning\":1,\"protocol_errors\":1,\"trusted_root_cert_is_not_installed_on_client\":1},\"protocol_version\":{\"min\":\"ssl3\",\"max\":\"ssl3\",\"mirror_client\":1,\"allow_http2\":1},\"certificate_checks\":{\"approach\":{\"cn\":1,\"issuer\":1,\"self-signed\":1,\"expiration\":0},\"fail_action\":\"pass-through\"}}\t1",
|
||||
"3\ttest\t{\"dynamic_bypass\":{\"ev_cert\":1,\"cert_transparency\":1,\"mutual_authentication\":1,\"cert_pinning\":1,\"protocol_errors\":1,\"trusted_root_cert_is_not_installed_on_client\":0},\"protocol_version\":{\"min\":\"ssl3\",\"max\":\"tls13\",\"mirror_client\":1,\"allow_http2\":1},\"certificate_checks\":{\"approach\":{\"cn\":1,\"issuer\":1,\"self-signed\":1,\"expiration\":1},\"fail_action\":\"fail-close\"}}\t1",
|
||||
"4\ttest\t{\"dynamic_bypass\":{\"ev_cert\":0,\"cert_transparency\":0,\"mutual_authentication\":0,\"cert_pinning\":0,\"protocol_errors\":0,\"trusted_root_cert_is_not_installed_on_client\":0},\"protocol_version\":{\"min\":\"ssl3\",\"max\":\"ssl3\",\"mirror_client\":0,\"allow_http2\":0},\"certificate_checks\":{\"approach\":{\"cn\":0,\"issuer\":0,\"self-signed\":0,\"expiration\":0},\"fail_action\":\"pass-through\"}}\t1"
|
||||
]
|
||||
},
|
||||
{
|
||||
"table_name": "TSG_SECURITY_COMPILE",
|
||||
"table_content": [
|
||||
"0\t0\t2\t1\t1\t{}\t{\"protocol\":\"SSL\",\"keyring\":765,\"decryption\":0},\"decrypt_mirror\":{\"enable\":0}}\t1\t2",
|
||||
"656\t0\t2\t1\t1\t{}\t{\"protocol\":\"SSL\",\"keyring\":1,\"decryption\":0},\"decrypt_mirror\":{\"enable\":0}}\t1\t2",
|
||||
"49\t0\t2\t1\t1\t{}\t{\"protocol\":\"SSL\",\"keyring\":1,\"decryption\":0},\"decrypt_mirror\":{\"enable\":0}}\t1\t2"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -58,4 +58,5 @@
|
||||
38 TSG_OBJ_GEO_LOCATION expr UTF8 UTF8/GBK yes 0
|
||||
39 TSG_SECURITY_SOURCE_LOCATION virtual TSG_OBJ_GEO_LOCATION --
|
||||
40 TSG_SECURITY_DESTINATION_LOCATION virtual TSG_OBJ_GEO_LOCATION --
|
||||
|
||||
41 TSG_FIELD_DOH_QNAME virtual TSG_OBJ_FQDN --
|
||||
42 TSG_FIELD_DOH_HOST virtual TSG_OBJ_FQDN --
|
||||
|
||||
Reference in New Issue
Block a user