gfwleak/tango-tsg-container
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

修改firewall配置文件，达到kni发出数据包的目的

Browse Source
This commit is contained in:
fumingwei
2021-03-18 10:52:35 +08:00
parent fb0b4c321c
commit 67c83e2912
9 changed files with 160 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
dockerfile/firewall/config/sapp_run/etc/asymmetric_presence_layer.conf Normal file
View File

@@ -0,0 +1,18 @@
#用于指定哪些协议层, C2S, S2C两侧是不对称存在的, 常见的如vlan, mpls等,
#sapp创建新流时, 为了便于双向地址比较,
#sappv3是用配置文件skip_no_ip_layer跳过所有ethernet之上的非ip层, 此方式过于粗暴, mirror模式下还可以, 串联模式下就不对了.
#sappv4使用本配置文件, 满足条件的需要创建一层虚拟层, 但无实际地址, 也不做地址比对.
#layer name definition: ipv4, ipv6, ethernet,vlan, arp, gre, mpls, pppoe, tcp, udp, l2tp, ppp, pptp, gtp
#名称不区别大小写, name is case insensitive, ipv4 is euqal to IPV4
#
# asymmetric_layer_name: 表示哪一层协议是非对称存在的, 需要创建空的虚拟层
# under_of_this_asymmetric_layer: 表示非对称的下面一层的地址类型和层数
# upper_of_this_asymmetric_layer: 表示非对称的上面一层的地址类型和层数
# 需要同时满足under_of_this_asymmetric_layer和upper_of_this_asymmetric_layer才会创建虚拟层
# []表示某个层的index, 从最外层ethernet开始, 从0开始计数, *表示不关心具体在哪层,只要地址类型符合即可
#pattern: asymmetric_layer_name under_of_this_asymmetric_layer[layer_index] upper_of_this_asymmetric_layer[layer_index]
#mpls ethernet[0] ipv4[1]
#mpls ethernet[1] ipv4[2]
#mpls ethernet[0] ipv6[1]
#mpls ethernet[1] ipv6[2]

30
dockerfile/firewall/config/sapp_run/etc/kni/kni.conf
View File

@@ -1,33 +1,33 @@
[global]
log_path = ./log/kni/kni.log
log_level = 10
tfe_node_count = 3
manage_eth = ens1f3
deploy_mode = tun
tfe_node_count = 1
manage_eth = eth0
deploy_mode = normal
tun_name = tun_kni
src_mac_addr = 00:0e:c6:d6:72:c1
dst_mac_addr = fe:65:b7:03:50:bd
[tfe0]
enabled = 1
dev_eth_symbol = ens1f5
ip_addr = 192.168.100.2
dev_eth_symbol = virtio_user1
ip_addr = 172.16.1.2
[tfe1]
enabled = 1
dev_eth_symbol = ens1f6
ip_addr = 192.168.100.3
[tfe2]
enabled = 1
dev_eth_symbol = ens1f7
ip_addr = 192.168.100.4
#[tfe1]
#enabled = 1
#dev_eth_symbol = ens1f6
#ip_addr = 192.168.100.3
#
#[tfe2]
#enabled = 1
#dev_eth_symbol = ens1f7
#ip_addr = 192.168.100.4
[tfe_cmsg_receiver]
listen_eth = lo
listen_port = 2475
[watch_dog]
switch = 1
switch = 0
listen_eth = lo
listen_port = 2476
keepalive_idle = 2

16
dockerfile/firewall/config/sapp_run/etc/send_raw_pkt.conf Normal file
View File

@@ -0,0 +1,16 @@
#<23><><EFBFBD><EFBFBD>ԭʼ<D4AD><CABC><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>,
#<23><>ƽ̨<C6BD><CCA8><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ڲ<EFBFBD>ͬ<EFBFBD><CDAC><EFBFBD><EFBFBD><EFBFBD><EFBFBD>, <20>ײ<EFBFBD><D7B2><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Ҳ<EFBFBD><D2B2>ͬ,
#<23><><EFBFBD><EFBFBD>ͨģʽ<C4A3><CABD>ʹ<EFBFBD><CAB9><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>, DPDKģʽ<C4A3><CABD>ʹ<EFBFBD>ö˿ں<CBBF>, PFRINGģʽ<C4A3><CABD>ʹ<EFBFBD><CAB9>index<65><78>, <20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ģʽ.
#target_id<69><64><EFBFBD>ڱ<EFBFBD>ʾ<EFBFBD><CABE><EFBFBD>ĸ<EFBFBD><C4B8><EFBFBD><EFBFBD>ն˷<D5B6><CBB7><EFBFBD>,
#<23><><EFBFBD>ڷ<EFBFBD><DAB7>͵<EFBFBD><CDB5><EFBFBD><EFBFBD>ݰ<EFBFBD><DDB0>ײ<EFBFBD>MAC<41><43>Ŀ<EFBFBD><C4BF>IP<49><50>, <20><><EFBFBD>ϲ<EFBFBD><CFB2><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>, ƽֻ̨<CCA8><D6BB><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ԭʼ<D4AD><CABC>.
#target_id<69>൱<EFBFBD><E0B5B1><EFBFBD><EFBFBD><EFBFBD>ݿ<EFBFBD><DDBF><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
#(0:pag,1:pcap,2:dumpfile,3:pfring,4:DPDK,5:ppf,6:NPacket,7:qnf,8:N95,9:pcap-dumpfile-list,10:topsec,
##(11:ipfile, 12:marsio4, 13:agent_smith, 14:dpdk_vxlan, 15:marsio_vxlan, 16:pag_marsio
#target_id
0 pag p7p2 eth1 dna0 dpdk ppf npacket qnf n95 eth1 topsec eth1 virtio_user0 smith dpdk dpdk pag
#1 pag eth1 eth1 dna0 dpdk ppf npacket qnf n95 eth1 topsec eth1 p7p1 smith dpdk dpdk pag
#2 pag eth1 eth1 dna0 dpdk ppf npacket qnf n95 eth1 topsec eth1 p7p1 smith dpdk dpdk pag
#3 pag eth1 eth1 dna0 dpdk ppf npacket qnf n95 eth1 topsec eth1 p7p2 smith dpdk dpdk pag
#4 pag eth1 eth1 dna0 dpdk ppf npacket qnf n95 eth1 topsec eth1 p7p2 smith dpdk dpdk pag

8
dockerfile/firewall/config/sapp_run/plug/conflist.inf
View File

@@ -1,8 +1,8 @@
[platform]
#./plug/platform/g_device_plug/g_device_plug.inf
./plug/platform/wannat/wangw.inf
./plug/platform/wire_graft/wire_graft.inf
./plug/platform/http_healthcheck/http_healthcheck.inf
#./plug/platform/wannat/wangw.inf
#./plug/platform/wire_graft/wire_graft.inf
#./plug/platform/http_healthcheck/http_healthcheck.inf
./plug/platform/app_proto_identify/app_proto_identify.inf
./plug/platform/tsg_master/tsg_master.inf
@@ -19,7 +19,7 @@
[business]
./plug/business/tsg_conn_sketch/tsg_conn_sketch.inf
./plug/business/capture_packet_plug/capture_packet_plug.inf
#./plug/business/kni/kni.inf
./plug/business/kni/kni.inf
./plug/business/fw_ssl_plug/fw_ssl_plug.inf
./plug/business/fw_http_plug/fw_http_plug.inf
./plug/business/fw_dns_plug/fw_dns_plug.inf

72
dockerfile/firewall/config/sapp_run/tsgconf/tsg_maat.json Normal file
View File

@@ -0,0 +1,72 @@
{
"compile_table": "TSG_SECURITY_COMPILE",
"group_table": "GROUP_COMPILE_RELATION",
"rules": [
{
"compile_id": 6,
"service": 0,
"action": 2,
"do_blacklist": 0,
"do_log": 1,
"effective_rage": 0,
"user_region": "anything",
"is_valid": "yes",
"groups": [
{
"group_name": "HOST",
"virtual_table":"TSG_FIELD_HTTP_HOST",
"not_flag" : 0,
"regions": [
{
"table_name": "TSG_OBJ_FQDN",
"table_type": "expr",
"table_content": {
"keywords": "geedge.net",
"expr_type": "none",
"match_method": "suffix",
"format": "uncase plain"
}
}
]
}
]
},
{
"compile_id": 7,
"service": 0,
"action": 2,
"do_blacklist": 0,
"do_log": 1,
"effective_rage": 0,
"user_region": "anything",
"is_valid": "yes",
"groups": [
{
"group_name": "IP_ADDR_2",
"virtual_table":"TSG_SECURITY_SOURCE_ADDR",
"regions": [
{
"table_name": "TSG_OBJ_IP_ADDR",
"table_type": "ip_plus",
"table_content": {
"addr_type": "ipv4",
"src_ip": "192.168.50.37",
"mask_src_ip": "255.255.255.255",
"src_port": "0",
"mask_src_port": "65535",
"dst_ip": "0.0.0.0",
"mask_dst_ip": "255.255.255.255",
"dst_port": "0",
"mask_dst_port": "65535",
"protocol": 6,
"direction": "double"
}
}
]
}
]
}
]
}