diff --git a/common/CMakeLists.txt b/common/CMakeLists.txt index 5e6708b..69c6ce7 100644 --- a/common/CMakeLists.txt +++ b/common/CMakeLists.txt @@ -1,4 +1,4 @@ -add_library(common src/tfe_utils.cpp src/tfe_types.cpp src/tfe_future.cpp src/tfe_http.cpp src/tfe_plugin.cpp src/tfe_rpc.cpp src/tfe_cmsg.cpp src/tfe_kafka_logger.cpp src/tfe_resource.cpp) + add_library(common src/tfe_utils.cpp src/tfe_types.cpp src/tfe_future.cpp src/tfe_http.cpp src/tfe_plugin.cpp src/tfe_rpc.cpp src/tfe_cmsg.cpp src/tfe_kafka_logger.cpp src/tfe_resource.cpp src/tfe_scan.cpp) target_include_directories(common PUBLIC ${CMAKE_CURRENT_LIST_DIR}/include) target_link_libraries(common PUBLIC libevent-static libevent-static-openssl libevent-static-pthreads) target_link_libraries(common PUBLIC MESA_handle_logger cjson) diff --git a/common/include/tfe_cmsg.h b/common/include/tfe_cmsg.h index e7c0142..e932432 100644 --- a/common/include/tfe_cmsg.h +++ b/common/include/tfe_cmsg.h @@ -29,18 +29,18 @@ enum tfe_cmsg_tlv_type TFE_CMSG_POLICY_ID = 0x10, TFE_CMSG_STREAM_TRACE_ID = 0x11, - TFE_CMSG_SSL_INTERCEPT_STATE, //size uint64_t, 0-passthrough, 1-intercept, 2-shutdown, referer from enum ssl_stream_action - TFE_CMSG_SSL_SERVER_SIDE_LATENCY, //size uint64_t, milisecond - TFE_CMSG_SSL_CLIENT_SIDE_LATENCY, //size uint64_t, milisecond - TFE_CMSG_SSL_SERVER_SIDE_VERSION, //string, SSLv3 TLSv1 TLSv1.1 TLSv1.2 TLSv1.3 unknown - TFE_CMSG_SSL_CLIENT_SIDE_VERSION, - TFE_CMSG_SSL_PINNING_STATE, //size uint64_t, 0-not pinning 1-pinning 2-maybe pinning - TFE_CMSG_SSL_CERT_VERIFY, - TFE_CMSG_SSL_ERROR, //string + TFE_CMSG_SSL_INTERCEPT_STATE, //size uint64_t, 0-passthrough, 1-intercept, 2-shutdown, referer from enum ssl_stream_action + TFE_CMSG_SSL_SERVER_SIDE_LATENCY, //size uint64_t, milisecond + TFE_CMSG_SSL_CLIENT_SIDE_LATENCY, //size uint64_t, milisecond + TFE_CMSG_SSL_SERVER_SIDE_VERSION, //string, SSLv3 TLSv1 TLSv1.1 TLSv1.2 TLSv1.3 unknown + TFE_CMSG_SSL_CLIENT_SIDE_VERSION, + TFE_CMSG_SSL_PINNING_STATE, //size uint64_t, 0-not pinning 1-pinning 2-maybe pinning + TFE_CMSG_SSL_CERT_VERIFY, + TFE_CMSG_SSL_ERROR, //string - /* Original Traffic's src & dst MAC address */ - TFE_CMSG_SRC_MAC, - TFE_CMSG_DST_MAC, + /* Original Traffic's src & dst MAC address */ + TFE_CMSG_SRC_MAC, + TFE_CMSG_DST_MAC, /* TCP option information */ TFE_CMSG_DOWNSTREAM_TCP_NODELAY, @@ -61,6 +61,22 @@ enum tfe_cmsg_tlv_type TFE_CMSG_TCP_PASSTHROUGH, + /* Share tsg scan result */ + TFE_CMSG_SRC_SUB_ID, // string max size 256 + TFE_CMSG_DST_SUB_ID, // string max size 256 + TFE_CMSG_SRC_ASN, // string max size 64 + TFE_CMSG_DST_ASN, // string max size 64 + TFE_CMSG_SRC_ORGANIZATION, // string max size 256 + TFE_CMSG_DST_ORGANIZATION, // string max size 256 + TFE_CMSG_SRC_IP_LOCATION_COUNTRY, // string max size 256 + TFE_CMSG_DST_IP_LOCATION_COUNTRY, // string max size 256 + TFE_CMSG_SRC_IP_LOCATION_PROVINE, // string max size 256 + TFE_CMSG_DST_IP_LOCATION_PROVINE, // string max size 256 + TFE_CMSG_SRC_IP_LOCATION_CITY, // string max size 256 + TFE_CMSG_DST_IP_LOCATION_CITY, // string max size 256 + + /* Add new cmsg here */ + /* Add new cmsg here */ /* Add new cmsg here */ /* MAX cmsg num */ diff --git a/common/include/tfe_resource.h b/common/include/tfe_resource.h index 22da084..83e9b23 100644 --- a/common/include/tfe_resource.h +++ b/common/include/tfe_resource.h @@ -3,40 +3,20 @@ enum RESOURCE_TYPE { STATIC_MAAT, - DYNAMINC_MAAT, KAFKA_LOGGER, DEVICE_ID, }; enum TABLE_TYPE { - TABLE_IP_ASN_USER_DEFINED, - TABLE_IP_ASN_BUILT_IN, - TABLE_IP_LOCATION_USER_DEFINED, - TABLE_IP_LOCATION_BUILT_IN, TABLE_SECURITY_SOURCE_ASN, TABLE_SECURITY_DESTINATION_ASN, TABLE_SECURITY_SOURCE_LOCATION, TABLE_SECURITY_DESTINATION_LOCATION, + TABLE_OBJ_SUBSCRIBER_ID, TABLE_TYPE_MAX }; -struct ip_data_table -{ - int profile_id; - int ref_cnt; - - char *asn; - char *organization; - - char *country_full; - char *province_full; - char *city_full; - - pthread_mutex_t lock; -}; - int tfe_bussiness_resouce_init(); void *tfe_bussiness_resouce_get(enum RESOURCE_TYPE type); -int tfe_bussiness_tableid_get(enum TABLE_TYPE type); -void ip_table_free(struct ip_data_table *ip_asn); \ No newline at end of file +int tfe_bussiness_tableid_get(enum TABLE_TYPE type); \ No newline at end of file diff --git a/common/include/tfe_scan.h b/common/include/tfe_scan.h new file mode 100644 index 0000000..50170ba --- /dev/null +++ b/common/include/tfe_scan.h @@ -0,0 +1,11 @@ +#pragma once + +#include +#define MAX_SCAN_RESULT 16 + +int tfe_scan_subscribe_id(const struct tfe_stream *stream, struct Maat_rule_t *result, scan_status_t *scan_mid, + int hit_cnt, unsigned int thread_id, void *logger, const char *addr); +int tfe_scan_ip_asn(const struct tfe_stream *stream, struct Maat_rule_t *result, scan_status_t *scan_mid, + int hit_cnt, unsigned int thread_id, void *logger, const char *addr, char **asn_server, char **asn_client); +int tfe_scan_ip_location(const struct tfe_stream *stream, struct Maat_rule_t *result, scan_status_t *scan_mid, + int hit_cnt, unsigned int thread_id, void *logger, const char *addr, char **location_server, char **location_client); \ No newline at end of file diff --git a/common/include/tfe_types.h b/common/include/tfe_types.h index 8290977..1d42b3c 100644 --- a/common/include/tfe_types.h +++ b/common/include/tfe_types.h @@ -158,5 +158,4 @@ struct tfe_stream_addr * tfe_stream_addr_reverse(struct tfe_stream_addr * orin); //Follow function's returned pointer should be passed to free to release the allocated storage when it is no longer needed. char* tfe_string_addr_create_by_fd(int fd, enum tfe_conn_dir dir); char * tfe_stream_addr_to_str(const struct tfe_stream_addr * addr); -int tfe_stream_addr_str_split(char* addr_str, const char** sip, const char** sport, const char** dip, const char** dport); -int tfe_stream_addr_to_address(const struct tfe_stream_addr *addr, struct ip_address *dest_ip, struct ip_address *source_ip); \ No newline at end of file +int tfe_stream_addr_str_split(char* addr_str, const char** sip, const char** sport, const char** dip, const char** dport); \ No newline at end of file diff --git a/common/include/tfe_utils.h b/common/include/tfe_utils.h index 1ced90a..c059c64 100644 --- a/common/include/tfe_utils.h +++ b/common/include/tfe_utils.h @@ -175,5 +175,4 @@ char *tfe_read_file(const char *filename, size_t *filelen); const char * tfe_version(); int __wrapper_MESA_htable_set_opt(MESA_htable_handle table, enum MESA_htable_opt opt_type, unsigned value); int __wrapper_MESA_htable_set_opt(MESA_htable_handle table, enum MESA_htable_opt opt_type, void * val, size_t len); -int tfe_decode_base64url(u_char *dst, u_char *src); -char *tfe_unescape(char *s); \ No newline at end of file +int tfe_decode_base64url(u_char *dst, u_char *src); \ No newline at end of file diff --git a/common/src/tfe_resource.cpp b/common/src/tfe_resource.cpp index 1403db1..4b84d62 100644 --- a/common/src/tfe_resource.cpp +++ b/common/src/tfe_resource.cpp @@ -1,10 +1,9 @@ -#include -#include -#include -#include -#include -#include #include +#include +#include +#include +#include +#include #define MAAT_INPUT_JSON 0 #define MAAT_INPUT_REDIS 1 @@ -13,13 +12,12 @@ struct maat_table_info { int id; - char *name; + const char *name; Maat_plugin_EX_new_func_t *new_func; Maat_plugin_EX_dup_func_t *dup_func; Maat_plugin_EX_free_func_t *free_func; }; static Maat_feather_t static_maat = NULL; -static Maat_feather_t dynamic_maat = NULL; static tfe_kafka_logger_t *kafka_logger = NULL; static char *device_id = NULL; @@ -32,7 +30,7 @@ static Maat_feather_t create_maat_feather(const char *instance_name, const char char redis_server[TFE_STRING_MAX] = {0}; char redis_port_range[TFE_STRING_MAX] = {0}; char accept_tags[TFE_STRING_MAX] = {0}; - char accept_path[TFE_PATH_MAX]={0}; + char accept_path[TFE_PATH_MAX] = {0}; int redis_port_begin = 0, redis_port_end = 0; int redis_port_select = 0; int redis_db_idx = 0; @@ -135,9 +133,9 @@ static Maat_feather_t create_maat_feather(const char *instance_name, const char Maat_set_feather_opt(target, MAAT_OPT_SCAN_DETAIL, &scan_detail, sizeof(scan_detail)); if (strlen(accept_path) > 0) { - MESA_load_profile_string_def(accept_path, "maat", "ACCEPT_TAGS", accept_tags, sizeof(accept_tags), "{\"tags\":[{\"tag\":\"device_id\",\"value\":\"device_1\"}]}"); + MESA_load_profile_string_def(accept_path, "maat", "ACCEPT_TAGS", accept_tags, sizeof(accept_tags), "{\"tags\":[{\"tag\":\"device_id\",\"value\":\"device_1\"}]}"); Maat_set_feather_opt(target, MAAT_OPT_ACCEPT_TAGS, &accept_tags, sizeof(accept_tags)); - TFE_LOG_INFO(logger, "tfe accept tags : %s", accept_tags); + TFE_LOG_INFO(logger, "tfe accept tags : %s", accept_tags); } ret = Maat_initiate_feather(target); @@ -233,129 +231,7 @@ finish: return (char *)device_def_id; } -static void ip_asn_table_new_cb(int table_id, const char *key, const char *table_line, MAAT_PLUGIN_EX_DATA *ad, long argl, void *argp) -{ - int addr_type; - int ret = 0, profile_id = 0, is_valid = 0; - char start_ip[40], end_ip[40], asn[40] = {0}; - char organization[TFE_PATH_MAX]; - - ret = sscanf(table_line, "%d\t%d\t%s\t%s\t%s\t%s\t%d", &profile_id, &addr_type, start_ip, end_ip, asn, organization, &is_valid); - if (ret != 7) - { - TFE_LOG_ERROR(g_default_logger, "Policy table parse ip ASN failed, ret:%d, %s", ret, table_line); - return; - } - tfe_unescape(organization); - - struct ip_data_table *ip_asn = ALLOC(struct ip_data_table, 1); - memset(ip_asn, 0, sizeof(struct ip_data_table)); - ip_asn->profile_id = profile_id; - ip_asn->asn = tfe_strdup(asn); - ip_asn->organization = tfe_strdup(organization); - ip_asn->ref_cnt = 1; - pthread_mutex_init(&(ip_asn->lock), NULL); - - TFE_LOG_INFO(g_default_logger, "Policy table add success %d", profile_id); - - *ad = ip_asn; -} - -static void ip_location_table_new_cb(int table_id, const char *key, const char *table_line, MAAT_PLUGIN_EX_DATA *ad, long argl, void *argp) -{ - int ret = 0, profile_id = 0, is_valid = 0; - int geoname_id = 0, addr_type = 0; - double latitude, longitude, coords; - char language[40], start_ip[40], end_ip[40]; - char continent_abbr[TFE_PATH_MAX], continent_full[TFE_PATH_MAX]; - char country_abbr[TFE_PATH_MAX], province_abbr[TFE_PATH_MAX], time_zone[TFE_PATH_MAX]; - char country_full[TFE_PATH_MAX], province_full[TFE_PATH_MAX], city_full[TFE_PATH_MAX]; - - ret = sscanf(table_line, "%d\t%d\t%d\t%s\t%s\t%lf\t%lf\t%lf\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%d", &profile_id, &geoname_id, - &addr_type, start_ip, end_ip, &latitude, &longitude, &coords, language, - continent_abbr, continent_full, country_abbr, country_full, province_abbr, province_full, - city_full, time_zone, &is_valid); - - if (ret != 18) - { - TFE_LOG_ERROR(g_default_logger, "Policy table parse ip location failed, ret:%d, %s", ret, table_line); - return; - } - tfe_unescape(continent_full); - tfe_unescape(country_full); - tfe_unescape(province_full); - tfe_unescape(city_full); - - struct ip_data_table *ip_asn = ALLOC(struct ip_data_table, 1); - memset(ip_asn, 0, sizeof(struct ip_data_table)); - ip_asn->profile_id = profile_id; - ip_asn->country_full = tfe_strdup(country_full); - ip_asn->province_full = tfe_strdup(province_full); - ip_asn->city_full = tfe_strdup(city_full); - ip_asn->ref_cnt = 1; - pthread_mutex_init(&(ip_asn->lock), NULL); - - TFE_LOG_INFO(g_default_logger, "Policy table add success %d", profile_id); - - *ad = ip_asn; -} - -static void ip_table_dup_cb(int table_id, MAAT_PLUGIN_EX_DATA *to, MAAT_PLUGIN_EX_DATA *from, long argl, void *argp) -{ - struct ip_data_table *ip_asn = (struct ip_data_table *)(*from); - pthread_mutex_lock(&(ip_asn->lock)); - ip_asn->ref_cnt++; - pthread_mutex_unlock(&(ip_asn->lock)); - *to = ip_asn; -} - -static void ip_table_free_cb(int table_id, MAAT_PLUGIN_EX_DATA *ad, long argl, void *argp) -{ - if (*ad == NULL) - { - return; - } - struct ip_data_table *ip_asn = (struct ip_data_table *)(*ad); - pthread_mutex_lock(&(ip_asn->lock)); - ip_asn->ref_cnt--; - if (ip_asn->ref_cnt > 0) - { - pthread_mutex_unlock(&(ip_asn->lock)); - return; - } - pthread_mutex_unlock(&(ip_asn->lock)); - pthread_mutex_destroy(&(ip_asn->lock)); - - if (ip_asn->asn) - FREE(&ip_asn->asn); - if (ip_asn->organization) - FREE(&ip_asn->organization); - if (ip_asn->country_full) - FREE(&ip_asn->country_full); - if (ip_asn->province_full) - FREE(&ip_asn->province_full); - if (ip_asn->city_full) - FREE(&ip_asn->city_full); - - FREE(&ip_asn); - *ad = NULL; - return; -} - -void ip_table_free(struct ip_data_table *ip_asn) -{ - ip_table_free_cb(0, (void **)&ip_asn, 0, NULL); -} - static struct maat_table_info maat_pub_tables[TABLE_TYPE_MAX] = { - // TABLE_IP_ASN_USER_DEFINED - {0, "TSG_IP_ASN_USER_DEFINED", ip_asn_table_new_cb, ip_table_dup_cb, ip_table_free_cb}, - // TABLE_IP_ASN_BUILT_IN - {0, "TSG_IP_ASN_BUILT_IN", ip_asn_table_new_cb, ip_table_dup_cb, ip_table_free_cb}, - // TABLE_IP_LOCATION_USER_DEFINED - {0, "TSG_IP_LOCATION_USER_DEFINED", ip_location_table_new_cb, ip_table_dup_cb, ip_table_free_cb}, - // TABLE_IP_LOCATION_BUILT_IN - {0, "TSG_IP_LOCATION_BUILT_IN", ip_location_table_new_cb, ip_table_dup_cb, ip_table_free_cb}, // TABLE_SECURITY_SOURCE_ASN {0, "TSG_SECURITY_SOURCE_ASN", NULL, NULL, NULL}, // TABLE_SECURITY_DESTINATION_ASN @@ -363,8 +239,9 @@ static struct maat_table_info maat_pub_tables[TABLE_TYPE_MAX] = { // TABLE_SECURITY_SOURCE_LOCATION {0, "TSG_SECURITY_SOURCE_LOCATION", NULL, NULL, NULL}, // TABLE_SECURITY_DESTINATION_LOCATION - {0, "TSG_SECURITY_DESTINATION_LOCATION", NULL, NULL, NULL} -}; + {0, "TSG_SECURITY_DESTINATION_LOCATION", NULL, NULL, NULL}, + // TABLE_OBJ_SUBSCRIBER_ID + {0, "TSG_OBJ_SUBSCRIBER_ID", NULL, NULL, NULL}}; static int register_maat_table() { @@ -397,12 +274,6 @@ int tfe_bussiness_resouce_init() return -1; } - dynamic_maat = create_maat_feather("dyn", profile_path, "DYNAMIC_MAAT", thread_num, g_default_logger); - if (!dynamic_maat) - { - return -1; - } - kafka_logger = create_kafka_logger(profile_path, "kafka", g_default_logger); if (!kafka_logger) { @@ -425,8 +296,6 @@ void *tfe_bussiness_resouce_get(enum RESOURCE_TYPE type) { case STATIC_MAAT: return static_maat; - case DYNAMINC_MAAT: - return dynamic_maat; case KAFKA_LOGGER: return kafka_logger; case DEVICE_ID: diff --git a/common/src/tfe_scan.cpp b/common/src/tfe_scan.cpp new file mode 100644 index 0000000..5e7ec5b --- /dev/null +++ b/common/src/tfe_scan.cpp @@ -0,0 +1,251 @@ +#include +#include +#include + +int tfe_scan_subscribe_id(const struct tfe_stream *stream, struct Maat_rule_t *result, scan_status_t *scan_mid, + int hit_cnt, unsigned int thread_id, void *logger, const char *addr) +{ + int scan_ret = 0; + int hit_cnt_ip = 0; + uint16_t opt_out_size; + char dest_subscribe_id[TFE_STRING_MAX] = {0}; + char source_subscribe_id[TFE_STRING_MAX] = {0}; + struct tfe_cmsg *cmsg = tfe_stream_get0_cmsg(stream); + if (cmsg != NULL) + { + scan_ret = tfe_cmsg_get_value(cmsg, TFE_CMSG_SRC_SUB_ID, (unsigned char *)source_subscribe_id, sizeof(source_subscribe_id), &opt_out_size); + if (scan_ret != 0) + { + TFE_LOG_ERROR(logger, "fetch src sub id from cmsg failed, ret: %d addr: %s", scan_ret, addr); + } + scan_ret = tfe_cmsg_get_value(cmsg, TFE_CMSG_DST_SUB_ID, (unsigned char *)dest_subscribe_id, sizeof(dest_subscribe_id), &opt_out_size); + if (scan_ret != 0) + { + TFE_LOG_ERROR(logger, "fetch dst sub id from cmsg failed, ret: %d addr: %s", scan_ret, addr); + } + } + TFE_LOG_DEBUG(logger, "fetch src sub id:%s dst sub id:%s addr: %s", source_subscribe_id, dest_subscribe_id, addr); + + if (strlen(source_subscribe_id)) + { + scan_ret = Maat_full_scan_string(tfe_bussiness_resouce_get(STATIC_MAAT), tfe_bussiness_tableid_get(TABLE_OBJ_SUBSCRIBER_ID), + CHARSET_UTF8, source_subscribe_id, strlen(source_subscribe_id), + result + hit_cnt + hit_cnt_ip, NULL, MAX_SCAN_RESULT - hit_cnt - hit_cnt_ip, + scan_mid, (int)thread_id); + if (scan_ret > 0) + { + TFE_LOG_INFO(logger, "Scan src TSG_OBJ_SUBSCRIBER_ID, Hit subid: %s scan ret: %d policy_id: %d service: %d action: %d addr: %s", + source_subscribe_id, scan_ret, result[hit_cnt + hit_cnt_ip].config_id, result[hit_cnt + hit_cnt_ip].service_id, result[hit_cnt + hit_cnt_ip].action, addr); + hit_cnt_ip += scan_ret; + } + else + { + TFE_LOG_INFO(logger, "Scan src TSG_OBJ_SUBSCRIBER_ID, NO hit subid: %s scan ret: %d addr: %s", + source_subscribe_id, scan_ret, addr); + } + } + + if (strlen(dest_subscribe_id)) + { + scan_ret = Maat_full_scan_string(tfe_bussiness_resouce_get(STATIC_MAAT), tfe_bussiness_tableid_get(TABLE_OBJ_SUBSCRIBER_ID), + CHARSET_UTF8, dest_subscribe_id, strlen(dest_subscribe_id), + result + hit_cnt + hit_cnt_ip, NULL, MAX_SCAN_RESULT - hit_cnt - hit_cnt_ip, + scan_mid, (int)thread_id); + if (scan_ret > 0) + { + TFE_LOG_INFO(logger, "Scan dst TSG_OBJ_SUBSCRIBER_ID, Hit subid: %s scan ret: %d policy_id: %d service: %d action: %d addr: %s", + dest_subscribe_id, scan_ret, result[hit_cnt + hit_cnt_ip].config_id, result[hit_cnt + hit_cnt_ip].service_id, result[hit_cnt + hit_cnt_ip].action, addr); + hit_cnt_ip += scan_ret; + } + else + { + TFE_LOG_INFO(logger, "Scan dst TSG_OBJ_SUBSCRIBER_ID, NO hit subid: %s scan ret: %d addr: %s", + dest_subscribe_id, scan_ret, addr); + } + } + + return hit_cnt_ip; +} + +int tfe_scan_ip_location(const struct tfe_stream *stream, struct Maat_rule_t *result, scan_status_t *scan_mid, + int hit_cnt, unsigned int thread_id, void *logger, const char *addr, char **location_server, char **location_client) +{ + int scan_ret = 0; + int hit_cnt_ip = 0; + uint16_t opt_out_size; + char buff[TFE_STRING_MAX] = {0}; + char src_city[TFE_STRING_MAX] = {0}; + char dst_city[TFE_STRING_MAX] = {0}; + char src_provine[TFE_STRING_MAX] = {0}; + char dst_provine[TFE_STRING_MAX] = {0}; + char src_country[TFE_STRING_MAX] = {0}; + char dst_country[TFE_STRING_MAX] = {0}; + struct tfe_cmsg *cmsg = tfe_stream_get0_cmsg(stream); + if (cmsg != NULL) + { + scan_ret = tfe_cmsg_get_value(cmsg, TFE_CMSG_SRC_IP_LOCATION_COUNTRY, (unsigned char *)src_country, sizeof(src_country), &opt_out_size); + if (scan_ret != 0) + { + TFE_LOG_ERROR(logger, "fetch src country from cmsg failed, ret: %d addr: %s", scan_ret, addr); + } + scan_ret = tfe_cmsg_get_value(cmsg, TFE_CMSG_DST_IP_LOCATION_COUNTRY, (unsigned char *)dst_country, sizeof(dst_country), &opt_out_size); + if (scan_ret != 0) + { + TFE_LOG_ERROR(logger, "fetch dst country from cmsg failed, ret: %d addr: %s", scan_ret, addr); + } + scan_ret = tfe_cmsg_get_value(cmsg, TFE_CMSG_SRC_IP_LOCATION_PROVINE, (unsigned char *)src_provine, sizeof(src_provine), &opt_out_size); + if (scan_ret != 0) + { + TFE_LOG_ERROR(logger, "fetch src provine from cmsg failed, ret: %d addr: %s", scan_ret, addr); + } + scan_ret = tfe_cmsg_get_value(cmsg, TFE_CMSG_DST_IP_LOCATION_PROVINE, (unsigned char *)dst_provine, sizeof(dst_provine), &opt_out_size); + if (scan_ret != 0) + { + TFE_LOG_ERROR(logger, "fetch dst provine from cmsg failed, ret: %d addr: %s", scan_ret, addr); + } + scan_ret = tfe_cmsg_get_value(cmsg, TFE_CMSG_SRC_IP_LOCATION_CITY, (unsigned char *)src_city, sizeof(src_city), &opt_out_size); + if (scan_ret != 0) + { + TFE_LOG_ERROR(logger, "fetch src city from cmsg failed, ret: %d addr: %s", scan_ret, addr); + } + scan_ret = tfe_cmsg_get_value(cmsg, TFE_CMSG_DST_IP_LOCATION_CITY, (unsigned char *)dst_city, sizeof(dst_city), &opt_out_size); + if (scan_ret != 0) + { + TFE_LOG_ERROR(logger, "fetch dst city from cmsg failed, ret: %d addr: %s", scan_ret, addr); + } + } + TFE_LOG_DEBUG(logger, "fetch src country:%s provine:%s city:%s; dst country:%s provine:%s city:%s addr: %s", src_country, src_provine, src_city, dst_country, dst_provine, dst_city, addr); + + if (strlen(dst_country) || strlen(dst_city)) + { + memset(buff, 0, sizeof(buff)); + snprintf(buff, sizeof(buff), "%s.%s.", dst_country, dst_city); + scan_ret = Maat_full_scan_string(tfe_bussiness_resouce_get(STATIC_MAAT), tfe_bussiness_tableid_get(TABLE_SECURITY_DESTINATION_LOCATION), + CHARSET_GBK, buff, strlen(buff), + result + hit_cnt + hit_cnt_ip, NULL, MAX_SCAN_RESULT - hit_cnt - hit_cnt_ip, + scan_mid, (int)thread_id); + if (scan_ret > 0) + { + TFE_LOG_INFO(logger, "Scan TSG_SECURITY_DESTINATION_LOCATION, Hit location: %s scan ret: %d policy_id: %d service: %d action: %d addr: %s", + buff, scan_ret, result[hit_cnt + hit_cnt_ip].config_id, result[hit_cnt + hit_cnt_ip].service_id, result[hit_cnt + hit_cnt_ip].action, addr); + hit_cnt_ip += scan_ret; + } + else + { + TFE_LOG_INFO(logger, "Scan TSG_SECURITY_DESTINATION_LOCATION, NO hit location: %s scan ret: %d addr: %s", + buff, scan_ret, addr); + } + memset(buff, 0, sizeof(buff)); + snprintf(buff, sizeof(buff), "%s,%s,%s", dst_city, dst_provine, dst_country); + *location_server = tfe_strdup(buff); + } + if (strlen(src_country) || strlen(src_city)) + { + memset(buff, 0, sizeof(buff)); + snprintf(buff, sizeof(buff), "%s.%s.", src_country, src_city); + scan_ret = Maat_full_scan_string(tfe_bussiness_resouce_get(STATIC_MAAT), tfe_bussiness_tableid_get(TABLE_SECURITY_SOURCE_LOCATION), + CHARSET_GBK, buff, strlen(buff), + result + hit_cnt + hit_cnt_ip, NULL, MAX_SCAN_RESULT - hit_cnt - hit_cnt_ip, + scan_mid, (int)thread_id); + if (scan_ret > 0) + { + TFE_LOG_INFO(logger, "Scan TSG_SECURITY_SOURCE_LOCATION, Hit location: %s scan ret: %d policy_id: %d service: %d action: %d addr: %s", + buff, scan_ret, result[hit_cnt + hit_cnt_ip].config_id, result[hit_cnt + hit_cnt_ip].service_id, result[hit_cnt + hit_cnt_ip].action, addr); + hit_cnt_ip += scan_ret; + } + else + { + TFE_LOG_INFO(logger, "Scan TSG_SECURITY_SOURCE_LOCATION, NO hit location: %s scan ret: %d addr: %s", + buff, scan_ret, addr); + } + + memset(buff, 0, sizeof(buff)); + snprintf(buff, sizeof(buff), "%s,%s,%s", src_city, src_provine, src_country); + *location_client = tfe_strdup(buff); + } + + return hit_cnt_ip; +} + +int tfe_scan_ip_asn(const struct tfe_stream *stream, struct Maat_rule_t *result, scan_status_t *scan_mid, + int hit_cnt, unsigned int thread_id, void *logger, const char *addr, char **asn_server, char **asn_client) +{ + int scan_ret = 0; + int hit_cnt_ip = 0; + uint16_t opt_out_size; + char buff[TFE_STRING_MAX] = {0}; + char src_asn[TFE_STRING_MAX] = {0}; + char dst_asn[TFE_STRING_MAX] = {0}; + char src_org[TFE_STRING_MAX] = {0}; + char dst_org[TFE_STRING_MAX] = {0}; + struct tfe_cmsg *cmsg = tfe_stream_get0_cmsg(stream); + if (cmsg != NULL) + { + scan_ret = tfe_cmsg_get_value(cmsg, TFE_CMSG_SRC_ASN, (unsigned char *)src_asn, sizeof(src_asn), &opt_out_size); + if (scan_ret != 0) + { + TFE_LOG_ERROR(logger, "fetch src asn from cmsg failed, ret: %d addr: %s", scan_ret, addr); + } + scan_ret = tfe_cmsg_get_value(cmsg, TFE_CMSG_DST_ASN, (unsigned char *)dst_asn, sizeof(dst_asn), &opt_out_size); + if (scan_ret != 0) + { + TFE_LOG_ERROR(logger, "fetch dst asn from cmsg failed, ret: %d addr: %s", scan_ret, addr); + } + scan_ret = tfe_cmsg_get_value(cmsg, TFE_CMSG_SRC_ORGANIZATION, (unsigned char *)src_org, sizeof(src_org), &opt_out_size); + if (scan_ret != 0) + { + TFE_LOG_ERROR(logger, "fetch src org from cmsg failed, ret: %d addr: %s", scan_ret, addr); + } + scan_ret = tfe_cmsg_get_value(cmsg, TFE_CMSG_DST_ORGANIZATION, (unsigned char *)dst_org, sizeof(dst_org), &opt_out_size); + if (scan_ret != 0) + { + TFE_LOG_ERROR(logger, "fetch dst org from cmsg failed, ret: %d addr: %s", scan_ret, addr); + } + } + TFE_LOG_DEBUG(logger, "fetch src asn:%s org:%s; dst asn:%s org:%s addr: %s", src_asn, src_org, dst_asn, dst_org, addr); + + if (strlen(dst_asn)) + { + scan_ret = Maat_full_scan_string(tfe_bussiness_resouce_get(STATIC_MAAT), tfe_bussiness_tableid_get(TABLE_SECURITY_DESTINATION_ASN), + CHARSET_UTF8, dst_asn, strlen(dst_asn), + result + hit_cnt + hit_cnt_ip, NULL, MAX_SCAN_RESULT - hit_cnt - hit_cnt_ip, + scan_mid, (int)thread_id); + if (scan_ret > 0) + { + TFE_LOG_INFO(logger, "Scan TSG_SECURITY_DESTINATION_ASN, Hit asn: %s scan ret: %d policy_id: %d service: %d action: %d addr: %s", + dst_asn, scan_ret, result[hit_cnt + hit_cnt_ip].config_id, result[hit_cnt + hit_cnt_ip].service_id, result[hit_cnt + hit_cnt_ip].action, addr); + hit_cnt_ip += scan_ret; + } + else + { + TFE_LOG_INFO(logger, "Scan TSG_SECURITY_DESTINATION_ASN, NO hit asn: %s scan ret: %d addr: %s", + dst_asn, scan_ret, addr); + } + memset(buff, 0, sizeof(buff)); + snprintf(buff, sizeof(buff), "%s(%s)", dst_asn, dst_org); + *asn_server = tfe_strdup(buff); + } + if (strlen(src_asn)) + { + scan_ret = Maat_full_scan_string(tfe_bussiness_resouce_get(STATIC_MAAT), tfe_bussiness_tableid_get(TABLE_SECURITY_SOURCE_ASN), + CHARSET_UTF8, src_asn, strlen(src_asn), + result + hit_cnt + hit_cnt_ip, NULL, MAX_SCAN_RESULT - hit_cnt - hit_cnt_ip, + scan_mid, (int)thread_id); + if (scan_ret > 0) + { + TFE_LOG_INFO(logger, "Scan TSG_SECURITY_SOURCE_ASN, Hit asn: %s scan ret: %d policy_id: %d service: %d action: %d addr: %s", + src_asn, scan_ret, result[hit_cnt + hit_cnt_ip].config_id, result[hit_cnt + hit_cnt_ip].service_id, result[hit_cnt + hit_cnt_ip].action, addr); + hit_cnt_ip += scan_ret; + } + else + { + TFE_LOG_INFO(logger, "Scan TSG_SECURITY_SOURCE_ASN, NO hit asn: %s scan ret: %d addr: %s", + src_asn, scan_ret, addr); + } + + memset(buff, 0, sizeof(buff)); + snprintf(buff, sizeof(buff), "%s(%s)", src_asn, src_org); + *asn_client = tfe_strdup(buff); + } + return hit_cnt_ip; +} \ No newline at end of file diff --git a/common/src/tfe_types.cpp b/common/src/tfe_types.cpp index 8fe98a6..a642874 100644 --- a/common/src/tfe_types.cpp +++ b/common/src/tfe_types.cpp @@ -202,28 +202,4 @@ char * tfe_string_addr_create_by_fd(int fd, enum tfe_conn_dir dir) } tfe_stream_addr_free(stream_addr); return addr_str; -} - -int tfe_stream_addr_to_address(const struct tfe_stream_addr *addr, struct ip_address *dest_ip, struct ip_address *source_ip) -{ - if(addr==NULL) return -1; - if (addr->addrtype == TFE_ADDR_STREAM_TUPLE4_V4) - { - const struct tfe_stream_addr_tuple4_v4 * tuple4_v4 = addr->tuple4_v4; - source_ip->ip_type=4; - source_ip->ipv4=tuple4_v4->saddr.s_addr; - - dest_ip->ip_type=4; - dest_ip->ipv4=tuple4_v4->daddr.s_addr; - } - if (addr->addrtype == TFE_ADDR_STREAM_TUPLE4_V6) - { - const struct tfe_stream_addr_tuple4_v6 * tuple4_v6 = addr->tuple4_v6; - source_ip->ip_type=6; - memcpy((char *)(source_ip->ipv6), tuple4_v6->saddr.__in6_u.__u6_addr32, IPV6_ADDR_LEN); - - dest_ip->ip_type=6; - memcpy((char *)(dest_ip->ipv6),tuple4_v6->daddr.__in6_u.__u6_addr32, IPV6_ADDR_LEN); - } - return 0; } \ No newline at end of file diff --git a/common/src/tfe_utils.cpp b/common/src/tfe_utils.cpp index 61d7c9b..8f2fd38 100644 --- a/common/src/tfe_utils.cpp +++ b/common/src/tfe_utils.cpp @@ -226,41 +226,4 @@ int tfe_decode_base64url(u_char *dst, u_char *src) }; return tfe_decode_base64_internal(dst, src, basis64); -} - -char *tfe_unescape(char *s) -{ - int i=0,j=0; - int len=strlen(s); - for(i=0,j=0;i -#define MAX_SCAN_RESULT 16 #define DOH_CTX_MAGIC_NUM 20200601 #define REQ_METHOD_IS_GET(method) ((method == TFE_HTTP_METHOD_GET) ? 1 : 0) @@ -199,172 +199,6 @@ static struct Maat_rule_t *doh_fetch_rule(Maat_rule_t *result, int result_num) return p_result; } -static int doh_ip_location_scan(struct Maat_rule_t *result, struct ip_address *sip, struct ip_address *dip, int hit_cnt, unsigned int thread_id, struct doh_ctx *ctx) -{ - int scan_ret = 0, hit_cnt_ip = 0; - char buff[TFE_STRING_MAX] = {0}; - struct ip_data_table *ip_location_client = NULL, *ip_location_server = NULL; - int is_src_use_user_defined = 1; - int is_dst_use_user_defined = 1; - - Maat_ip_plugin_get_EX_data(g_doh_conf->maat, tfe_bussiness_tableid_get(TABLE_IP_LOCATION_USER_DEFINED), sip, (void **)&ip_location_client, 1); - Maat_ip_plugin_get_EX_data(g_doh_conf->maat, tfe_bussiness_tableid_get(TABLE_IP_LOCATION_USER_DEFINED), dip, (void **)&ip_location_server, 1); - - if (ip_location_client == NULL) - { - is_src_use_user_defined = 0; - Maat_ip_plugin_get_EX_data(g_doh_conf->maat, tfe_bussiness_tableid_get(TABLE_IP_LOCATION_BUILT_IN), sip, (void **)&ip_location_client, 1); - } - if (ip_location_server == NULL) - { - is_dst_use_user_defined = 0; - Maat_ip_plugin_get_EX_data(g_doh_conf->maat, tfe_bussiness_tableid_get(TABLE_IP_LOCATION_BUILT_IN), dip, (void **)&ip_location_server, 1); - } - - if (ip_location_server != NULL) - { - TFE_LOG_INFO(g_doh_conf->local_logger, "scan dst ip use IP_LOCATION_%s, profile_id: %d ref_cnt: %d asn: %s organization: %s country: %s province: %s city: %s addr: %s", - (is_dst_use_user_defined ? "USER_DEFINED" : "BUILT_IN"), ip_location_server->profile_id, ip_location_server->ref_cnt, ip_location_server->asn, - ip_location_server->organization, ip_location_server->country_full, ip_location_server->province_full, ip_location_server->city_full, ctx->addr_string); - - snprintf(buff, sizeof(buff), "%s.%s.", ip_location_server->country_full, ip_location_server->city_full); - scan_ret = Maat_full_scan_string(g_doh_conf->maat, tfe_bussiness_tableid_get(TABLE_SECURITY_DESTINATION_LOCATION), - CHARSET_GBK, buff, strlen(buff), - result + hit_cnt + hit_cnt_ip, NULL, MAX_SCAN_RESULT - hit_cnt - hit_cnt_ip, - &(ctx->scan_mid), (int)thread_id); - if (scan_ret > 0) - { - TFE_LOG_INFO(g_doh_conf->local_logger, "SCAN_DST_LOCATION, Hit location: %s scan ret: %d policy_id: %d service: %d action: %d addr: %s", - buff, scan_ret, result[hit_cnt + hit_cnt_ip].config_id, result[hit_cnt + hit_cnt_ip].service_id, result[hit_cnt + hit_cnt_ip].action, ctx->addr_string); - hit_cnt_ip += scan_ret; - } - else - { - TFE_LOG_INFO(g_doh_conf->local_logger, "SCAN_DST_LOCATION, NO hit location: %s scan ret: %d addr: %s", - buff, scan_ret, ctx->addr_string); - } - - memset(buff, 0, sizeof(buff)); - snprintf(buff, sizeof(buff), "%s,%s,%s", ip_location_server->city_full, ip_location_server->province_full, ip_location_server->country_full); - ctx->location_server = tfe_strdup(buff); - } - if (ip_location_client != NULL) - { - TFE_LOG_INFO(g_doh_conf->local_logger, "scan src ip use IP_LOCATION_%s, profile_id: %d ref_cnt: %d asn: %s organization: %s country: %s province: %s city: %s addr: %s", - (is_src_use_user_defined ? "USER_DEFINED" : "BUILT_IN"), ip_location_client->profile_id, ip_location_client->ref_cnt, ip_location_client->asn, - ip_location_client->organization, ip_location_client->country_full, ip_location_client->province_full, ip_location_client->city_full, ctx->addr_string); - - snprintf(buff, sizeof(buff), "%s.%s.", ip_location_client->country_full, ip_location_client->city_full); - scan_ret = Maat_full_scan_string(g_doh_conf->maat, tfe_bussiness_tableid_get(TABLE_SECURITY_SOURCE_LOCATION), - CHARSET_GBK, buff, strlen(buff), - result + hit_cnt + hit_cnt_ip, NULL, MAX_SCAN_RESULT - hit_cnt - hit_cnt_ip, - &(ctx->scan_mid), (int)thread_id); - if (scan_ret > 0) - { - TFE_LOG_INFO(g_doh_conf->local_logger, "SCAN_SRC_LOCATION, Hit location: %s scan ret: %d policy_id: %d service: %d action: %d addr: %s", - buff, scan_ret, result[hit_cnt + hit_cnt_ip].config_id, result[hit_cnt + hit_cnt_ip].service_id, result[hit_cnt + hit_cnt_ip].action, ctx->addr_string); - hit_cnt_ip += scan_ret; - } - else - { - TFE_LOG_INFO(g_doh_conf->local_logger, "SCAN_SRC_LOCATION, NO hit location: %s scan ret: %d addr: %s", - buff, scan_ret, ctx->addr_string); - } - - memset(buff, 0, sizeof(buff)); - snprintf(buff, sizeof(buff), "%s,%s,%s", ip_location_client->city_full, ip_location_client->province_full, ip_location_client->country_full); - ctx->location_client = tfe_strdup(buff); - } - - if (ip_location_server) - ip_table_free(ip_location_server); - if (ip_location_client) - ip_table_free(ip_location_client); - return hit_cnt_ip; -} - -static int doh_ip_asn_scan(struct Maat_rule_t *result, struct ip_address *sip, struct ip_address *dip, int hit_cnt, unsigned int thread_id, struct doh_ctx *ctx) -{ - int scan_ret = 0, hit_cnt_ip = 0; - char buff[TFE_STRING_MAX] = {0}; - struct ip_data_table *ip_asn_client = NULL, *ip_asn_server = NULL; - int is_src_use_user_defined = 1; - int is_dst_use_user_defined = 1; - - Maat_ip_plugin_get_EX_data(g_doh_conf->maat, tfe_bussiness_tableid_get(TABLE_IP_ASN_USER_DEFINED), sip, (void **)&ip_asn_client, 1); - Maat_ip_plugin_get_EX_data(g_doh_conf->maat, tfe_bussiness_tableid_get(TABLE_IP_ASN_USER_DEFINED), dip, (void **)&ip_asn_server, 1); - - if (ip_asn_client == NULL) - { - is_src_use_user_defined = 0; - Maat_ip_plugin_get_EX_data(g_doh_conf->maat, tfe_bussiness_tableid_get(TABLE_IP_ASN_BUILT_IN), sip, (void **)&ip_asn_client, 1); - } - if (ip_asn_server == NULL) - { - is_dst_use_user_defined = 0; - Maat_ip_plugin_get_EX_data(g_doh_conf->maat, tfe_bussiness_tableid_get(TABLE_IP_ASN_BUILT_IN), dip, (void **)&ip_asn_server, 1); - } - - if (ip_asn_server != NULL) - { - TFE_LOG_INFO(g_doh_conf->local_logger, "scan dst ip use IP_ASN_%s, profile_id: %d ref_cnt: %d asn: %s organization: %s country: %s province: %s city: %s addr: %s", - (is_dst_use_user_defined ? "USER_DEFINED" : "BUILT_IN"), ip_asn_server->profile_id, ip_asn_server->ref_cnt, ip_asn_server->asn, - ip_asn_server->organization, ip_asn_server->country_full, ip_asn_server->province_full, ip_asn_server->city_full, ctx->addr_string); - - scan_ret = Maat_full_scan_string(g_doh_conf->maat, tfe_bussiness_tableid_get(TABLE_SECURITY_DESTINATION_ASN), - CHARSET_UTF8, ip_asn_server->asn, strlen(ip_asn_server->asn), - result + hit_cnt + hit_cnt_ip, NULL, MAX_SCAN_RESULT - hit_cnt - hit_cnt_ip, - &(ctx->scan_mid), (int)thread_id); - if (scan_ret > 0) - { - TFE_LOG_INFO(g_doh_conf->local_logger, "SCAN_DST_ASN, Hit asn: %s scan ret: %d policy_id: %d service: %d action: %d addr: %s", - ip_asn_server->asn, scan_ret, result[hit_cnt + hit_cnt_ip].config_id, result[hit_cnt + hit_cnt_ip].service_id, result[hit_cnt + hit_cnt_ip].action, ctx->addr_string); - hit_cnt_ip += scan_ret; - } - else - { - TFE_LOG_INFO(g_doh_conf->local_logger, "SCAN_DST_ASN, NO hit asn: %s scan ret: %d addr: %s", - ip_asn_server->asn, scan_ret, ctx->addr_string); - } - - memset(buff, 0, sizeof(buff)); - snprintf(buff, sizeof(buff), "%s(%s)", ip_asn_server->asn, ip_asn_server->organization); - ctx->asn_server = tfe_strdup(buff); - } - if (ip_asn_client != NULL) - { - TFE_LOG_INFO(g_doh_conf->local_logger, "scan src ip use IP_ASN_%s, profile_id: %d ref_cnt: %d asn: %s organization: %s country: %s province: %s city: %s addr: %s", - (is_src_use_user_defined ? "USER_DEFINED" : "BUILT_IN"), ip_asn_client->profile_id, ip_asn_client->ref_cnt, ip_asn_client->asn, - ip_asn_client->organization, ip_asn_client->country_full, ip_asn_client->province_full, ip_asn_client->city_full, ctx->addr_string); - - scan_ret = Maat_full_scan_string(g_doh_conf->maat, tfe_bussiness_tableid_get(TABLE_SECURITY_SOURCE_ASN), - CHARSET_UTF8, ip_asn_client->asn, strlen(ip_asn_client->asn), - result + hit_cnt + hit_cnt_ip, NULL, MAX_SCAN_RESULT - hit_cnt - hit_cnt_ip, - &(ctx->scan_mid), (int)thread_id); - if (scan_ret > 0) - { - TFE_LOG_INFO(g_doh_conf->local_logger, "SCAN_SRC_ASN, Hit asn: %s scan ret: %d policy_id: %d service: %d action: %d addr: %s", - ip_asn_client->asn, scan_ret, result[hit_cnt + hit_cnt_ip].config_id, result[hit_cnt + hit_cnt_ip].service_id, result[hit_cnt + hit_cnt_ip].action, ctx->addr_string); - hit_cnt_ip += scan_ret; - } - else - { - TFE_LOG_INFO(g_doh_conf->local_logger, "SCAN_SRC_ASN, NO hit asn: %s scan ret: %d addr: %s", - ip_asn_client->asn, scan_ret, ctx->addr_string); - } - - memset(buff, 0, sizeof(buff)); - snprintf(buff, sizeof(buff), "%s(%s)", ip_asn_client->asn, ip_asn_client->organization); - ctx->asn_client = tfe_strdup(buff); - } - if (ip_asn_server) - ip_table_free(ip_asn_server); - if (ip_asn_client) - ip_table_free(ip_asn_client); - - return hit_cnt_ip; -} - static void doh_maat_scan(const struct tfe_stream *stream, const struct tfe_http_session *session, struct doh_ctx *ctx, char *qname, int qtype) { int hit_cnt = 0; @@ -374,15 +208,19 @@ static void doh_maat_scan(const struct tfe_stream *stream, const struct tfe_http struct Maat_rule_t *p_result = NULL; struct Maat_rule_t result[MAX_SCAN_RESULT]; - struct ip_address dest_ip, source_ip; - tfe_stream_addr_to_address(stream->addr, &dest_ip, &source_ip); - scan_ret = doh_ip_location_scan(result, &source_ip, &dest_ip, hit_cnt, ctx->thread_id, ctx); + scan_ret = tfe_scan_subscribe_id(stream, result, &(ctx->scan_mid), hit_cnt, ctx->thread_id, g_doh_conf->local_logger, ctx->addr_string); + if (scan_ret > 0) + { + hit_cnt += scan_ret; + } + + scan_ret = tfe_scan_ip_location(stream, result, &(ctx->scan_mid), hit_cnt, ctx->thread_id, g_doh_conf->local_logger, ctx->addr_string, &(ctx->location_server), &(ctx->location_client)); if (scan_ret > 0) { hit_cnt += scan_ret; } - scan_ret = doh_ip_asn_scan(result, &source_ip, &dest_ip, hit_cnt, ctx->thread_id, ctx); + scan_ret = tfe_scan_ip_asn(stream, result, &(ctx->scan_mid), hit_cnt, ctx->thread_id, g_doh_conf->local_logger, ctx->addr_string, &(ctx->asn_server), &(ctx->asn_client)); if (scan_ret > 0) { hit_cnt += scan_ret; @@ -396,15 +234,15 @@ static void doh_maat_scan(const struct tfe_stream *stream, const struct tfe_http host, strlen(host), result + hit_cnt, NULL, MAX_SCAN_RESULT - hit_cnt, &(ctx->scan_mid), ctx->thread_id); if (scan_ret > 0) { - TFE_LOG_INFO(g_doh_conf->local_logger, "SCAN_HOST, Hit host: %s scan ret: %d policy_id: %d service: %d action: %d addr: %s", - host, scan_ret, result[hit_cnt].config_id, result[hit_cnt].service_id, result[hit_cnt].action, ctx->addr_string); - hit_cnt += scan_ret; + TFE_LOG_INFO(g_doh_conf->local_logger, "Scan %s, Hit host: %s scan ret: %d policy_id: %d service: %d action: %d addr: %s", + g_doh_conf->tables[TYPE_HOST].name, host, scan_ret, result[hit_cnt].config_id, result[hit_cnt].service_id, result[hit_cnt].action, ctx->addr_string); + hit_cnt += scan_ret; } else { - TFE_LOG_INFO(g_doh_conf->local_logger, "SCAN_HOST, NO hit host: %s scan ret: %d addr: %s", - host, scan_ret, ctx->addr_string); - } + TFE_LOG_INFO(g_doh_conf->local_logger, "Scan %s, NO hit host: %s scan ret: %d addr: %s", + g_doh_conf->tables[TYPE_HOST].name, host, scan_ret, ctx->addr_string); + } } // scan addr @@ -413,45 +251,45 @@ static void doh_maat_scan(const struct tfe_stream *stream, const struct tfe_http 0, result + hit_cnt, MAX_SCAN_RESULT - hit_cnt, &(ctx->scan_mid), ctx->thread_id); if (scan_ret > 0) { - TFE_LOG_INFO(g_doh_conf->local_logger, "SCAN_ADDR, Hit addr: %s scan ret: %d policy_id: %d service: %d action: %d", - ctx->addr_string, scan_ret, result[hit_cnt].config_id, result[hit_cnt].service_id, result[hit_cnt].action); - hit_cnt += scan_ret; + TFE_LOG_INFO(g_doh_conf->local_logger, "Scan %s, Hit addr: %s scan ret: %d policy_id: %d service: %d action: %d", + g_doh_conf->tables[TYPE_ADDR].name, ctx->addr_string, scan_ret, result[hit_cnt].config_id, result[hit_cnt].service_id, result[hit_cnt].action); + hit_cnt += scan_ret; } else { - TFE_LOG_INFO(g_doh_conf->local_logger, "SCAN_ADDR, NO hit addr: %s scan ret: %d", - ctx->addr_string, scan_ret); - } + TFE_LOG_INFO(g_doh_conf->local_logger, "Scan %s, NO hit addr: %s scan ret: %d", + g_doh_conf->tables[TYPE_ADDR].name, ctx->addr_string, scan_ret); + } // scan appid scan_ret = Maat_full_scan_string(g_doh_conf->maat, g_doh_conf->tables[TYPE_APPID].id, CHARSET_UTF8, app_id, strlen(app_id), result + hit_cnt, NULL, MAX_SCAN_RESULT - hit_cnt, &(ctx->scan_mid), ctx->thread_id); if (scan_ret > 0) { - TFE_LOG_INFO(g_doh_conf->local_logger, "SCAN_APPID, Hit proto: %s scan ret: %d policy_id: %d service: %d action: %d addr: %s", - app_id, scan_ret, result[hit_cnt].config_id, result[hit_cnt].service_id, result[hit_cnt].action, ctx->addr_string); - hit_cnt += scan_ret; + TFE_LOG_INFO(g_doh_conf->local_logger, "Scan %s, Hit proto: %s scan ret: %d policy_id: %d service: %d action: %d addr: %s", + g_doh_conf->tables[TYPE_APPID].name, app_id, scan_ret, result[hit_cnt].config_id, result[hit_cnt].service_id, result[hit_cnt].action, ctx->addr_string); + hit_cnt += scan_ret; } else { - TFE_LOG_INFO(g_doh_conf->local_logger, "SCAN_APPID, NO hit proto: %s scan ret: %d addr: %s", - app_id, scan_ret, ctx->addr_string); - } + TFE_LOG_INFO(g_doh_conf->local_logger, "Scan %s, NO hit proto: %s scan ret: %d addr: %s", + g_doh_conf->tables[TYPE_APPID].name, app_id, scan_ret, ctx->addr_string); + } // scan qname scan_ret = Maat_full_scan_string(g_doh_conf->maat, g_doh_conf->tables[TYPE_QNAME].id, CHARSET_UTF8, qname, strlen(qname), result + hit_cnt, NULL, MAX_SCAN_RESULT - hit_cnt, &(ctx->scan_mid), ctx->thread_id); if (scan_ret > 0) { - TFE_LOG_INFO(g_doh_conf->local_logger, "SCAN_QNAME, Hit domain: %s scan ret: %d qtype: %d policy_id: %d service: %d action: %d addr: %s", - qname, scan_ret, qtype, result[hit_cnt].config_id, result[hit_cnt].service_id, result[hit_cnt].action, ctx->addr_string); - hit_cnt += scan_ret; + TFE_LOG_INFO(g_doh_conf->local_logger, "Scan %s, Hit domain: %s scan ret: %d qtype: %d policy_id: %d service: %d action: %d addr: %s", + g_doh_conf->tables[TYPE_QNAME].name, qname, scan_ret, qtype, result[hit_cnt].config_id, result[hit_cnt].service_id, result[hit_cnt].action, ctx->addr_string); + hit_cnt += scan_ret; } else { - TFE_LOG_INFO(g_doh_conf->local_logger, "SCAN_QNAME, NO hit domain: %s scan ret: %d addr: %s", - qname, scan_ret, ctx->addr_string); - } + TFE_LOG_INFO(g_doh_conf->local_logger, "Scan %s, NO hit domain: %s scan ret: %d addr: %s", + g_doh_conf->tables[TYPE_QNAME].name, qname, scan_ret, ctx->addr_string); + } if (hit_cnt) { diff --git a/plugin/business/doh/src/pub.h b/plugin/business/doh/src/pub.h index dbf7288..f59367d 100644 --- a/plugin/business/doh/src/pub.h +++ b/plugin/business/doh/src/pub.h @@ -7,7 +7,6 @@ extern "C" #endif #include -#include #include #include #include diff --git a/plugin/business/pangu-http/src/pangu_http.cpp b/plugin/business/pangu-http/src/pangu_http.cpp index bb65058..d6003dc 100644 --- a/plugin/business/pangu-http/src/pangu_http.cpp +++ b/plugin/business/pangu-http/src/pangu_http.cpp @@ -8,6 +8,7 @@ #include #include #include +#include #include #include @@ -28,7 +29,6 @@ #include "ratelimiter.h" -#define MAX_SCAN_RESULT 16 #define MAX_EDIT_ZONE_NUM 64 enum pangu_action //Bigger action number is prior. @@ -64,7 +64,6 @@ enum scan_table PXY_CTRL_HTTP_REQ_BODY, PXY_CTRL_HTTP_RES_HDR, PXY_CTRL_HTTP_RES_BODY, - PXY_CTRL_SUBSCRIBE_ID, PXY_CTRL_APP_ID, __SCAN_TABLE_MAX }; @@ -127,8 +126,6 @@ struct policy_action_param struct pangu_rt { Maat_feather_t maat; - Maat_feather_t dyn_maat; - int subscriber_id_table_id; struct pangu_logger * send_logger; void * local_logger; int log_level; @@ -297,57 +294,6 @@ void trusted_CA_update_finish_cb(void* u_para) } } -static int get_column_pos(const char* line, int column_seq, size_t *offset, size_t *len) -{ - const char* seps=" \t"; - char* saveptr=NULL, *subtoken=NULL, *str=NULL; - char* dup_line=tfe_strdup(line); - int i=0, ret=-1; - for (str = dup_line; ; str = NULL) - { - subtoken = strtok_r(str, seps, &saveptr); - if (subtoken == NULL) - break; - if(i==column_seq-1) - { - *offset=subtoken-dup_line; - *len=strlen(subtoken); - ret=0; - break; - } - i++; - } - free(dup_line); - return ret; -} - -void subscribe_id_dup_cb(int table_id, MAAT_PLUGIN_EX_DATA* to, MAAT_PLUGIN_EX_DATA* from, long argl, void* argp) -{ - *to = tfe_strdup((char*)*from); - return; -} -void subscribe_id_new_cb(int table_id, const char* key, const char* table_line, MAAT_PLUGIN_EX_DATA* ad, long argl, void* argp) -{ - int ret=0; - size_t subscribe_id_offset, len; - ret=get_column_pos(table_line, 4, &subscribe_id_offset, &len); - if(ret<0) - { - TFE_LOG_ERROR(g_pangu_rt->local_logger, "Add subscribe ID faild: %s", table_line); - return; - } - *ad=ALLOC(char, len+1); - memcpy(*ad, table_line+subscribe_id_offset, len); - TFE_LOG_INFO(g_pangu_rt->local_logger, "Add subscribe ID: %s", (char*)*ad); - return; -} -void subscribe_id_free_cb(int table_id, MAAT_PLUGIN_EX_DATA* ad, long argl, void* argp) -{ - TFE_LOG_INFO(g_pangu_rt->local_logger, "Delete subscribe ID: %s", (char*)*ad); - free(*ad); - *ad=NULL; -} - static enum manipulate_action manipulate_action_str2idx(const char *action_str) { const char *clue_action_map[__MA_ACTION_MAX]; @@ -792,7 +738,6 @@ int pangu_policy_init(const char* profile_path, const char* static_section, cons table_name[PXY_CTRL_HTTP_REQ_BODY] = "TSG_FIELD_HTTP_REQ_CONTENT"; table_name[PXY_CTRL_HTTP_RES_HDR] = "TSG_FIELD_HTTP_RES_HDR"; table_name[PXY_CTRL_HTTP_RES_BODY] = "TSG_FIELD_HTTP_RES_CONTENT"; - table_name[PXY_CTRL_SUBSCRIBE_ID] = "TSG_OBJ_SUBSCRIBER_ID"; table_name[PXY_CTRL_APP_ID] = "TSG_OBJ_APP_ID"; for (int i = 0; i < __SCAN_TABLE_MAX; i++) { @@ -841,22 +786,6 @@ int pangu_policy_init(const char* profile_path, const char* static_section, cons } } - g_pangu_rt->dyn_maat = (Maat_feather_t)tfe_bussiness_resouce_get(DYNAMINC_MAAT); - g_pangu_rt->subscriber_id_table_id=Maat_table_register(g_pangu_rt->dyn_maat, "TSG_DYN_SUBSCRIBER_IP"); - ret=Maat_plugin_EX_register(g_pangu_rt->dyn_maat, - g_pangu_rt->subscriber_id_table_id, - subscribe_id_new_cb, - subscribe_id_free_cb, - subscribe_id_dup_cb, - NULL, - 0, - NULL); - if(ret!=0) - { - TFE_LOG_ERROR(NULL, "Pangu HTTP Dynamic Maat TSG_DYN_SUBSCRIBER_IP EX data register failed."); - goto error_out; - } - error_out: return ret; } @@ -2405,151 +2334,6 @@ void cache_write(const struct tfe_http_session * session, enum tfe_http_event ev } } -int http_ip_subscribe_id_scan(struct Maat_rule_t *result, const char* sip, const char* dip, int hit_cnt, unsigned int thread_id, struct pangu_http_ctx * ctx) -{ - int scan_ret=0, hit_cnt_ip=0; - char* source_subscribe_id=NULL, *dest_subscribe_id=NULL; - - source_subscribe_id=(char*)Maat_plugin_get_EX_data(g_pangu_rt->dyn_maat, g_pangu_rt->subscriber_id_table_id, sip); - dest_subscribe_id=(char*)Maat_plugin_get_EX_data(g_pangu_rt->dyn_maat, g_pangu_rt->subscriber_id_table_id, dip); - - if(source_subscribe_id!=NULL) - { - scan_ret = Maat_full_scan_string(g_pangu_rt->maat, g_pangu_rt->scan_table_id[PXY_CTRL_SUBSCRIBE_ID], - CHARSET_UTF8, source_subscribe_id, strlen(source_subscribe_id), - result+hit_cnt, NULL, MAX_SCAN_RESULT-hit_cnt, - &(ctx->scan_mid), (int) thread_id); - if(scan_ret>0) - { - hit_cnt_ip+=scan_ret; - } - } - if(dest_subscribe_id!=NULL) - { - scan_ret = Maat_full_scan_string(g_pangu_rt->maat, g_pangu_rt->scan_table_id[PXY_CTRL_SUBSCRIBE_ID], - CHARSET_UTF8, dest_subscribe_id, strlen(dest_subscribe_id), - result+hit_cnt, NULL, MAX_SCAN_RESULT-hit_cnt, - &(ctx->scan_mid), (int) thread_id); - if(scan_ret>0) - { - hit_cnt_ip+=scan_ret; - } - } - if(source_subscribe_id!=NULL) - free(source_subscribe_id); - if(dest_subscribe_id!=NULL) - free(dest_subscribe_id); - return hit_cnt_ip; -} - -int http_ip_location_scan(struct Maat_rule_t *result, struct ip_address *sip, struct ip_address *dip, int hit_cnt, unsigned int thread_id, struct pangu_http_ctx * ctx ) -{ - int scan_ret=0, hit_cnt_ip=0; - char buff[TFE_STRING_MAX]={0}; - struct ip_data_table* ip_location_client=NULL, *ip_location_server=NULL; - - Maat_ip_plugin_get_EX_data(g_pangu_rt->maat, tfe_bussiness_tableid_get(TABLE_IP_LOCATION_USER_DEFINED), sip, (void **)&ip_location_client, 1); - Maat_ip_plugin_get_EX_data(g_pangu_rt->maat, tfe_bussiness_tableid_get(TABLE_IP_LOCATION_USER_DEFINED), dip, (void **)&ip_location_server, 1); - - if (ip_location_client == NULL) - { - Maat_ip_plugin_get_EX_data(g_pangu_rt->maat, tfe_bussiness_tableid_get(TABLE_IP_LOCATION_BUILT_IN), sip, (void **)&ip_location_client, 1); - } - if (ip_location_server == NULL) - { - Maat_ip_plugin_get_EX_data(g_pangu_rt->maat, tfe_bussiness_tableid_get(TABLE_IP_LOCATION_BUILT_IN), dip, (void **)&ip_location_server, 1); - } - - if(ip_location_server!=NULL) - { - snprintf(buff, sizeof(buff), "%s.%s.", ip_location_server->country_full, ip_location_server->city_full); - scan_ret = Maat_full_scan_string(g_pangu_rt->maat, tfe_bussiness_tableid_get(TABLE_SECURITY_DESTINATION_LOCATION), - CHARSET_GBK, buff, strlen(buff), - result+hit_cnt, NULL, MAX_SCAN_RESULT-hit_cnt, - &(ctx->scan_mid), (int) thread_id); - if(scan_ret>0) - { - hit_cnt_ip+=scan_ret; - } - memset(buff,0,sizeof(buff)); - snprintf(buff, sizeof(buff), "%s,%s,%s", ip_location_server->city_full, ip_location_server->province_full, ip_location_server->country_full); - ctx->ip_ctx.location_server=tfe_strdup(buff); - } - if(ip_location_client!=NULL) - { - snprintf(buff, sizeof(buff), "%s.%s.", ip_location_client->country_full, ip_location_client->city_full); - scan_ret = Maat_full_scan_string(g_pangu_rt->maat, tfe_bussiness_tableid_get(TABLE_SECURITY_SOURCE_LOCATION), - CHARSET_GBK, buff, strlen(buff), - result+hit_cnt+hit_cnt_ip, NULL, MAX_SCAN_RESULT-hit_cnt-hit_cnt_ip, - &(ctx->scan_mid), (int) thread_id); - if(scan_ret>0) - { - hit_cnt_ip+=scan_ret; - } - memset(buff,0,sizeof(buff)); - snprintf(buff, sizeof(buff), "%s,%s,%s", ip_location_client->city_full, ip_location_client->province_full, ip_location_client->country_full); - ctx->ip_ctx.location_client=tfe_strdup(buff); - } - - if(ip_location_server) - ip_table_free(ip_location_server); - if(ip_location_client) - ip_table_free(ip_location_client); - return hit_cnt_ip; -} - -int http_ip_asn_scan(struct Maat_rule_t *result, struct ip_address* sip, struct ip_address* dip, int hit_cnt, unsigned int thread_id, struct pangu_http_ctx * ctx) -{ - int scan_ret=0, hit_cnt_ip=0; - char buff[TFE_STRING_MAX]={0}; - struct ip_data_table* ip_asn_client=NULL, *ip_asn_server=NULL; - - Maat_ip_plugin_get_EX_data(g_pangu_rt->maat, tfe_bussiness_tableid_get(TABLE_IP_ASN_USER_DEFINED), sip, (void **)&ip_asn_client, 1); - Maat_ip_plugin_get_EX_data(g_pangu_rt->maat, tfe_bussiness_tableid_get(TABLE_IP_ASN_USER_DEFINED), dip, (void **)&ip_asn_server, 1); - - if (ip_asn_client == NULL) - { - Maat_ip_plugin_get_EX_data(g_pangu_rt->maat, tfe_bussiness_tableid_get(TABLE_IP_ASN_BUILT_IN), sip, (void **)&ip_asn_client, 1); - } - if (ip_asn_server == NULL) - { - Maat_ip_plugin_get_EX_data(g_pangu_rt->maat, tfe_bussiness_tableid_get(TABLE_IP_ASN_BUILT_IN), dip, (void **)&ip_asn_server, 1); - } - - if(ip_asn_server!=NULL) - { - scan_ret = Maat_full_scan_string(g_pangu_rt->maat, tfe_bussiness_tableid_get(TABLE_SECURITY_DESTINATION_ASN), - CHARSET_UTF8, ip_asn_server->asn, strlen(ip_asn_server->asn), - result+hit_cnt, NULL, MAX_SCAN_RESULT-hit_cnt, - &(ctx->scan_mid), (int) thread_id); - - if(scan_ret>0) - { - hit_cnt_ip+=scan_ret; - } - snprintf(buff, sizeof(buff), "%s(%s)", ip_asn_server->asn, ip_asn_server->organization); - ctx->ip_ctx.asn_server=tfe_strdup(buff); - } - if(ip_asn_client!=NULL) - { - scan_ret = Maat_full_scan_string(g_pangu_rt->maat, tfe_bussiness_tableid_get(TABLE_SECURITY_SOURCE_ASN), - CHARSET_UTF8, ip_asn_client->asn, strlen(ip_asn_client->asn), - result+hit_cnt+hit_cnt_ip, NULL, MAX_SCAN_RESULT-hit_cnt-hit_cnt_ip, - &(ctx->scan_mid), (int) thread_id); - if(scan_ret>0) - { - hit_cnt_ip+=scan_ret; - } - snprintf(buff, sizeof(buff), "%s(%s)", ip_asn_client->asn, ip_asn_client->organization); - ctx->ip_ctx.asn_client=tfe_strdup(buff); - } - if(ip_asn_server) - ip_table_free(ip_asn_server); - if(ip_asn_client) - ip_table_free(ip_asn_client); - return hit_cnt_ip; -} - void pangu_on_http_begin(const struct tfe_stream * stream, const struct tfe_http_session * session, unsigned int thread_id, void ** pme) { @@ -2562,30 +2346,23 @@ void pangu_on_http_begin(const struct tfe_stream * stream, struct Maat_rule_t result[MAX_SCAN_RESULT]; struct ipaddr sapp_addr; int hit_cnt = 0, scan_ret=0; - UNUSED int tmp=0; assert(ctx == NULL); ATOMIC_INC(&(g_pangu_rt->stat_val[STAT_SESSION])); ctx = pangu_http_ctx_new(thread_id); char* addr_string=tfe_stream_addr_to_str(stream->addr); - const char* sip=NULL, *dip=NULL; - tmp=tfe_stream_addr_str_split(addr_string, &sip, NULL, &dip, NULL); - assert(tmp==0); - - scan_ret = http_ip_subscribe_id_scan(result, sip, dip, hit_cnt, thread_id, ctx); + scan_ret = tfe_scan_subscribe_id(stream, result, &(ctx->scan_mid), hit_cnt, ctx->thread_id, g_pangu_rt->local_logger, addr_string); if(scan_ret>0) { hit_cnt+=scan_ret; } - struct ip_address dest_ip, source_ip; - tfe_stream_addr_to_address(stream->addr, &dest_ip, &source_ip); - scan_ret = http_ip_location_scan(result, &source_ip, &dest_ip, hit_cnt, thread_id, ctx); + scan_ret = tfe_scan_ip_location(stream, result, &(ctx->scan_mid), hit_cnt, ctx->thread_id, g_pangu_rt->local_logger, addr_string, &(ctx->ip_ctx.location_server), &(ctx->ip_ctx.location_client)); if(scan_ret>0) { hit_cnt+=scan_ret; } - scan_ret = http_ip_asn_scan(result, &source_ip, &dest_ip, hit_cnt, thread_id, ctx); + scan_ret = tfe_scan_ip_asn(stream, result, &(ctx->scan_mid), hit_cnt, ctx->thread_id, g_pangu_rt->local_logger, addr_string, &(ctx->ip_ctx.asn_server), &(ctx->ip_ctx.asn_client)); if(scan_ret>0) { hit_cnt+=scan_ret; diff --git a/resource/pangu/dynamic_maat_table_info.conf b/resource/pangu/dynamic_maat_table_info.conf deleted file mode 100644 index e83c303..0000000 --- a/resource/pangu/dynamic_maat_table_info.conf +++ /dev/null @@ -1,19 +0,0 @@ -#each collumn seperate with '\t' -#id (0~65535) -#name string -#type one of ip,expr,expr_plus,digest,intval,compile or plugin -#src_charset one of GBK,BIG5,UNICODE,UTF8 -#dst_charset combined by GBK,BIG5,UNICODE,UTF8,seperate with '/' -#do_merege [yes/no] -#cross cache [number] -#quick mode [quickon/quickoff], default [quickoff] -#For ip/intval/digest/compile/group -#id name type -# -#For plugin table -#id name type json_descr -# -#For expr/expr_plus Table -#id name type src_charset dst_charset do_merge cross_cache quick_mode - -1 TSG_DYN_SUBSCRIBER_IP plugin {"key":3,"valid":5} diff --git a/resource/pangu/table_info.conf b/resource/pangu/table_info.conf index 6785295..024c48d 100644 --- a/resource/pangu/table_info.conf +++ b/resource/pangu/table_info.conf @@ -49,15 +49,11 @@ 28 TSG_SECURITY_COMPILE plugin {"key":1,"valid":8} 29 PXY_PROFILE_TRAFFIC_MIRROR plugin {"key":1,"valid":4} 30 TSG_PROFILE_DECRYPTION plugin {"key":1,"valid":4} -31 TSG_IP_ASN_BUILT_IN ip_plugin {"row_id":1,"ip_type":2,"start_ip":3,"end_ip":4,"valid":7,"estimate_size":4194304} -32 TSG_IP_ASN_USER_DEFINED ip_plugin {"row_id":1,"ip_type":2,"start_ip":3,"end_ip":4,"valid":7,"estimate_size":4194304} -33 TSG_IP_LOCATION_BUILT_IN ip_plugin {"row_id":1,"ip_type":3,"start_ip":4,"end_ip":5,"valid":18,"estimate_size":4194304} -34 TSG_IP_LOCATION_USER_DEFINED ip_plugin {"row_id":1,"ip_type":3,"start_ip":4,"end_ip":5,"valid":18,"estimate_size":4194304} -35 TSG_OBJ_AS_NUMBER expr UTF8 UTF8/GBK yes 0 -36 TSG_SECURITY_SOURCE_ASN virtual TSG_OBJ_AS_NUMBER -- -37 TSG_SECURITY_DESTINATION_ASN virtual TSG_OBJ_AS_NUMBER -- -38 TSG_OBJ_GEO_LOCATION expr UTF8 UTF8/GBK yes 0 -39 TSG_SECURITY_SOURCE_LOCATION virtual TSG_OBJ_GEO_LOCATION -- -40 TSG_SECURITY_DESTINATION_LOCATION virtual TSG_OBJ_GEO_LOCATION -- -41 TSG_FIELD_DOH_QNAME virtual TSG_OBJ_FQDN -- -42 TSG_FIELD_DOH_HOST virtual TSG_OBJ_FQDN -- \ No newline at end of file +31 TSG_OBJ_AS_NUMBER expr UTF8 UTF8/GBK yes 0 +32 TSG_SECURITY_SOURCE_ASN virtual TSG_OBJ_AS_NUMBER -- +33 TSG_SECURITY_DESTINATION_ASN virtual TSG_OBJ_AS_NUMBER -- +34 TSG_OBJ_GEO_LOCATION expr UTF8 UTF8/GBK yes 0 +35 TSG_SECURITY_SOURCE_LOCATION virtual TSG_OBJ_GEO_LOCATION -- +36 TSG_SECURITY_DESTINATION_LOCATION virtual TSG_OBJ_GEO_LOCATION -- +37 TSG_FIELD_DOH_QNAME virtual TSG_OBJ_FQDN -- +38 TSG_FIELD_DOH_HOST virtual TSG_OBJ_FQDN -- \ No newline at end of file