diff --git a/common/include/verify_policy.h b/common/include/verify_policy.h index c59c816..f6d8122 100644 --- a/common/include/verify_policy.h +++ b/common/include/verify_policy.h @@ -148,7 +148,7 @@ void * pangu_http_ctx_new(unsigned int thread_id); void pangu_http_ctx_free(void * pme); -size_t http_policy_scan(enum verify_policy_type policy_type, struct verify_policy_query_obj *query_obj, cJSON *data_obj, void *pme); +size_t verify_policy_scan(enum verify_policy_type policy_type, struct verify_policy_query_obj *query_obj, cJSON *data_obj, void *pme); void http_get_scan_status(struct verify_policy_query_obj *query_obj, cJSON *attributes, cJSON *data_obj, void *pme); diff --git a/conf/verify_policy.conf b/conf/verify_policy.conf index ada3195..f1e4943 100644 --- a/conf/verify_policy.conf +++ b/conf/verify_policy.conf @@ -3,7 +3,7 @@ DEBUG_SWITCH = 1 #10:DEBUG, 20:INFO, 30:FATAL RUN_LOG_LEVEL = 10 -RUN_LOG_PATH = ./logs +RUN_LOG_PATH = "conf/zlog.conf" disable_coredump=0 enable_breakpad=1 diff --git a/platform/src/verify_policy.cpp b/platform/src/verify_policy.cpp index eaa1915..7f0a295 100644 --- a/platform/src/verify_policy.cpp +++ b/platform/src/verify_policy.cpp @@ -49,7 +49,7 @@ const char * version() static int signals[] = {SIGHUP, SIGPIPE, SIGUSR1}; -extern int pangu_policy_init(struct verify_policy * verify, const char* profile_path); +extern int proxy_policy_init(struct verify_policy * verify, const char* profile_path); static int verify_policy_init(struct verify_policy * verify, const char *profile) { @@ -327,7 +327,7 @@ cJSON *get_query_from_request(const char *data, int thread_id) { goto free; } - hit_cnt = http_policy_scan(verify_policy->type, &verify_policy->verify_object[i], data_obj, ctx); + hit_cnt = verify_policy_scan(verify_policy->type, &verify_policy->verify_object[i], data_obj, ctx); if(0 == strcasecmp(verify_policy->verify_object[i].attri_name, "source") || 0 == strcasecmp(verify_policy->verify_object[i].attri_name, "destination")) { @@ -873,7 +873,7 @@ int main(int argc, char * argv[]) ret = verify_policy_init(g_verify_proxy, main_profile); CHECK_OR_EXIT(ret == 0, "Failed at loading profile %s, Exit.", main_profile); - ret = pangu_policy_init(g_verify_proxy, main_profile); + ret = proxy_policy_init(g_verify_proxy, main_profile); CHECK_OR_EXIT(ret == 0, "Failed at init panggu module, Exit."); clock_gettime(CLOCK_REALTIME, &(end_time)); diff --git a/resource/table_info_proxy.conf b/resource/table_info_proxy.conf index 1cda569..08089ef 100644 --- a/resource/table_info_proxy.conf +++ b/resource/table_info_proxy.conf @@ -15,35 +15,35 @@ # #For expr/expr_plus Table #id name type src_charset dst_charset do_merge cross_cache quick_mode -0 PXY_CTRL_COMPILE compile escape -- -1 GROUP_COMPILE_RELATION group2compile -- -2 GROUP_GROUP_RELATION group2group -- -3 TSG_OBJ_IP_ADDR ip_plus --- -4 TSG_OBJ_URL expr UTF8 GBK/UNICODE/UTF8/url_encode_gb2312/url_encode_utf8 yes 0 quickoff -5 TSG_FIELD_HTTP_URL virtual TSG_OBJ_URL -- -6 TSG_OBJ_FQDN expr UTF8 GBK/UNICODE/UTF8/url_encode_gb2312/url_encode_utf8 yes 0 quickoff -6 TSG_OBJ_FQDN_CAT expr UTF8 GBK/UNICODE/UTF8/url_encode_gb2312/url_encode_utf8 yes 0 quickoff -7 TSG_FIELD_HTTP_HOST virtual TSG_OBJ_FQDN -- -8 TSG_OBJ_HTTP_SIGNATURE expr_plus UTF8 UTF8 yes 0 quickoff -9 TSG_FIELD_HTTP_REQ_HDR virtual TSG_OBJ_HTTP_SIGNATURE -- -10 TSG_FIELD_HTTP_RES_HDR virtual TSG_OBJ_HTTP_SIGNATURE -- -11 TSG_OBJ_KEYWORDS expr UTF8 GBK/UNICODE/UTF8/windows-1251 yes 128 quickoff -12 TSG_FIELD_HTTP_REQ_CONTENT virtual TSG_OBJ_KEYWORDS -- -13 TSG_FIELD_HTTP_RES_CONTENT virtual TSG_OBJ_KEYWORDS -- -14 TSG_OBJ_SUBSCRIBER_ID expr UTF8 UTF8 yes 0 quickon -15 TSG_OBJ_APP_ID intval UTF8 UTF8 yes 0 -16 TSG_SECURITY_SOURCE_ADDR virtual TSG_OBJ_IP_ADDR -- -17 TSG_SECURITY_DESTINATION_ADDR virtual TSG_OBJ_IP_ADDR -- -18 TSG_SECURITY_ADDR composition {"source":"TSG_SECURITY_SOURCE_ADDR","destination":"TSG_SECURITY_DESTINATION_ADDR"} -19 TSG_IP_ASN_BUILT_IN ip_plugin {"row_id":1,"ip_type":2,"start_ip":3,"end_ip":4,"valid":7,"estimate_size":4194304} -20 TSG_IP_ASN_USER_DEFINED ip_plugin {"row_id":1,"ip_type":2,"start_ip":3,"end_ip":4,"valid":7,"estimate_size":4194304} -21 TSG_IP_LOCATION_BUILT_IN ip_plugin {"row_id":1,"ip_type":3,"start_ip":4,"end_ip":5,"valid":18,"estimate_size":4194304} -22 TSG_IP_LOCATION_USER_DEFINED ip_plugin {"row_id":1,"ip_type":3,"start_ip":4,"end_ip":5,"valid":18,"estimate_size":4194304} -23 TSG_OBJ_AS_NUMBER expr UTF8 UTF8/GBK yes 0 -24 TSG_SECURITY_SOURCE_ASN virtual TSG_OBJ_AS_NUMBER -- -25 TSG_SECURITY_DESTINATION_ASN virtual TSG_OBJ_AS_NUMBER -- -26 TSG_OBJ_GEO_LOCATION expr UTF8 UTF8/GBK yes 0 -27 TSG_SECURITY_SOURCE_LOCATION virtual TSG_OBJ_GEO_LOCATION -- -28 TSG_SECURITY_DESTINATION_LOCATION virtual TSG_OBJ_GEO_LOCATION -- -29 TSG_FIELD_DOH_QNAME virtual TSG_OBJ_FQDN -- -30 TSG_FIELD_DOH_HOST virtual TSG_OBJ_FQDN -- +0 PXY_CTRL_COMPILE compile escape -- +1 GROUP_COMPILE_RELATION group2compile -- +2 GROUP_GROUP_RELATION group2group -- +3 TSG_OBJ_IP_ADDR ip_plus --- +4 TSG_OBJ_URL expr UTF8 GBK/UNICODE/UTF8/url_encode_gb2312/url_encode_utf8 yes 0 quickoff +5 TSG_FIELD_HTTP_URL virtual TSG_OBJ_URL -- +6 TSG_OBJ_FQDN expr UTF8 GBK/UNICODE/UTF8/url_encode_gb2312/url_encode_utf8 yes 0 quickoff +7 TSG_OBJ_FQDN_CAT intval UTF8 UTF8 yes 0 +8 TSG_FIELD_HTTP_HOST virtual ["TSG_OBJ_FQDN","TSG_OBJ_FQDN_CAT"] -- +9 TSG_OBJ_HTTP_SIGNATURE expr_plus UTF8 UTF8 yes 0 quickoff +10 TSG_FIELD_HTTP_REQ_HDR virtual TSG_OBJ_HTTP_SIGNATURE -- +11 TSG_FIELD_HTTP_RES_HDR virtual TSG_OBJ_HTTP_SIGNATURE -- +12 TSG_OBJ_KEYWORDS expr UTF8 GBK/UNICODE/UTF8/windows-1251 yes 128 quickoff +13 TSG_FIELD_HTTP_REQ_CONTENT virtual TSG_OBJ_KEYWORDS -- +14 TSG_FIELD_HTTP_RES_CONTENT virtual TSG_OBJ_KEYWORDS -- +15 TSG_OBJ_SUBSCRIBER_ID expr UTF8 UTF8 yes 0 quickon +16 TSG_OBJ_APP_ID intval UTF8 UTF8 yes 0 +17 TSG_SECURITY_SOURCE_ADDR virtual TSG_OBJ_IP_ADDR -- +18 TSG_SECURITY_DESTINATION_ADDR virtual TSG_OBJ_IP_ADDR -- +19 TSG_SECURITY_ADDR composition {"source":"TSG_SECURITY_SOURCE_ADDR","destination":"TSG_SECURITY_DESTINATION_ADDR"} +20 TSG_IP_ASN_BUILT_IN ip_plugin {"row_id":1,"ip_type":2,"start_ip":3,"end_ip":4,"valid":7,"estimate_size":4194304} +21 TSG_IP_ASN_USER_DEFINED ip_plugin {"row_id":1,"ip_type":2,"start_ip":3,"end_ip":4,"valid":7,"estimate_size":4194304} +22 TSG_IP_LOCATION_BUILT_IN ip_plugin {"row_id":1,"ip_type":3,"start_ip":4,"end_ip":5,"valid":18,"estimate_size":4194304} +23 TSG_IP_LOCATION_USER_DEFINED ip_plugin {"row_id":1,"ip_type":3,"start_ip":4,"end_ip":5,"valid":18,"estimate_size":4194304} +24 TSG_OBJ_AS_NUMBER expr UTF8 UTF8/GBK yes 0 +25 TSG_SECURITY_SOURCE_ASN virtual TSG_OBJ_AS_NUMBER -- +26 TSG_SECURITY_DESTINATION_ASN virtual TSG_OBJ_AS_NUMBER -- +27 TSG_OBJ_GEO_LOCATION expr UTF8 UTF8/GBK yes 0 +28 TSG_SECURITY_SOURCE_LOCATION virtual TSG_OBJ_GEO_LOCATION -- +29 TSG_SECURITY_DESTINATION_LOCATION virtual TSG_OBJ_GEO_LOCATION -- +30 TSG_FIELD_DOH_QNAME virtual ["TSG_OBJ_FQDN","TSG_OBJ_FQDN_CAT"] -- +31 TSG_FIELD_DOH_HOST virtual ["TSG_OBJ_FQDN","TSG_OBJ_FQDN_CAT"] -- diff --git a/resource/table_info_security.conf b/resource/table_info_security.conf index 7d3ca97..c78adee 100644 --- a/resource/table_info_security.conf +++ b/resource/table_info_security.conf @@ -8,52 +8,53 @@ #cross cache 0~max #quickswitch quickon or quick off #id name type src_charset dst_charset do_merge cross_cache quickswitch -0 TSG_SECURITY_COMPILE compile escape -- -1 GROUP_COMPILE_RELATION group2compile -- -2 GROUP_GROUP_RELATION group2group -- +0 TSG_SECURITY_COMPILE compile escape -- +1 GROUP_COMPILE_RELATION group2compile -- +2 GROUP_GROUP_RELATION group2group -- 3 TSG_OBJ_IP_ADDR ip_plus UTF8 UTF8 no 0 4 TSG_OBJ_SUBSCRIBER_ID expr UTF8 UTF8 yes 0 5 TSG_OBJ_ACCOUNT expr UTF8 UTF8 yes 0 6 TSG_OBJ_URL expr UTF8 UTF8/GBK yes 0 7 TSG_OBJ_FQDN expr UTF8 UTF8 yes 0 -7 TSG_OBJ_FQDN_CAT expr UTF8 UTF8 yes 0 -8 TSG_OBJ_KEYWORDS expr UTF8 UTF8/GBK/windows-1251 yes 0 -9 TSG_OBJ_APP_ID intval UTF8 UTF8 yes 0 -10 TSG_OBJ_HTTP_SIGNATURE expr_plus UTF8 UTF8/GBK yes 0 -11 TSG_FIELD_HTTP_HOST virtual TSG_OBJ_FQDN -- -12 TSG_FIELD_HTTP_URL virtual TSG_OBJ_URL -- -13 TSG_FIELD_HTTP_REQ_HDR virtual TSG_OBJ_HTTP_SIGNATURE -- -14 TSG_FIELD_HTTP_RES_HDR virtual TSG_OBJ_HTTP_SIGNATURE -- -15 TSG_FIELD_HTTP_REQ_CONTENT virtual TSG_OBJ_KEYWORDS -- -16 TSG_FIELD_HTTP_RES_CONTENT virtual TSG_OBJ_KEYWORDS -- -17 TSG_FIELD_SSL_SNI virtual TSG_OBJ_FQDN -- -18 TSG_FIELD_SSL_CN virtual TSG_OBJ_FQDN -- -19 TSG_FIELD_SSL_SAN virtual TSG_OBJ_FQDN -- -20 TSG_FIELD_DNS_QNAME virtual TSG_OBJ_FQDN -- -21 TSG_FIELD_QUIC_SNI virtual TSG_OBJ_FQDN -- -22 TSG_FIELD_MAIL_ACCOUNT virtual TSG_OBJ_ACCOUNT -- -23 TSG_FIELD_MAIL_FROM virtual TSG_OBJ_ACCOUNT -- -24 TSG_FIELD_MAIL_TO virtual TSG_OBJ_ACCOUNT -- -25 TSG_FIELD_MAIL_SUBJECT virtual TSG_OBJ_KEYWORDS -- -26 TSG_FIELD_MAIL_CONTENT virtual TSG_OBJ_KEYWORDS -- -27 TSG_FIELD_MAIL_ATT_NAME virtual TSG_OBJ_KEYWORDS -- -28 TSG_FIELD_MAIL_ATT_CONTENT virtual TSG_OBJ_KEYWORDS -- -29 TSG_FIELD_FTP_URI virtual TSG_OBJ_URL -- -30 TSG_FIELD_FTP_CONTENT virtual TSG_OBJ_KEYWORDS -- -31 TSG_FIELD_FTP_ACCOUNT virtual TSG_OBJ_ACCOUNT -- -32 TSG_SECURITY_SOURCE_ADDR virtual TSG_OBJ_IP_ADDR -- -33 TSG_SECURITY_DESTINATION_ADDR virtual TSG_OBJ_IP_ADDR -- -34 TSG_SECURITY_ADDR composition {"source":"TSG_SECURITY_SOURCE_ADDR","destination":"TSG_SECURITY_DESTINATION_ADDR"} -35 TSG_IP_ASN_BUILT_IN ip_plugin {"row_id":1,"ip_type":2,"start_ip":3,"end_ip":4,"valid":7,"estimate_size":4194304} -36 TSG_IP_ASN_USER_DEFINED ip_plugin {"row_id":1,"ip_type":2,"start_ip":3,"end_ip":4,"valid":7,"estimate_size":4194304} -37 TSG_IP_LOCATION_BUILT_IN ip_plugin {"row_id":1,"ip_type":3,"start_ip":4,"end_ip":5,"valid":18,"estimate_size":4194304} -38 TSG_IP_LOCATION_USER_DEFINED ip_plugin {"row_id":1,"ip_type":3,"start_ip":4,"end_ip":5,"valid":18,"estimate_size":4194304} -39 TSG_OBJ_AS_NUMBER expr UTF8 UTF8/GBK yes 0 -40 TSG_SECURITY_SOURCE_ASN virtual TSG_OBJ_AS_NUMBER -- -41 TSG_SECURITY_DESTINATION_ASN virtual TSG_OBJ_AS_NUMBER -- -42 TSG_OBJ_GEO_LOCATION expr UTF8 UTF8/GBK yes 0 -43 TSG_SECURITY_SOURCE_LOCATION virtual TSG_OBJ_GEO_LOCATION -- -44 TSG_SECURITY_DESTINATION_LOCATION virtual TSG_OBJ_GEO_LOCATION -- - +8 TSG_OBJ_FQDN_CAT intval UTF8 UTF8 yes 0 +9 TSG_OBJ_KEYWORDS expr UTF8 UTF8/GBK/windows-1251 yes 0 +10 TSG_OBJ_APP_ID intval UTF8 UTF8 yes 0 +11 TSG_OBJ_HTTP_SIGNATURE expr_plus UTF8 UTF8/GBK yes 0 +12 TSG_FIELD_HTTP_HOST virtual ["TSG_OBJ_FQDN","TSG_OBJ_FQDN_CAT"] -- +13 TSG_FIELD_HTTP_URL virtual TSG_OBJ_URL -- +14 TSG_FIELD_HTTP_REQ_HDR virtual TSG_OBJ_HTTP_SIGNATURE -- +15 TSG_FIELD_HTTP_RES_HDR virtual TSG_OBJ_HTTP_SIGNATURE -- +16 TSG_FIELD_HTTP_REQ_CONTENT virtual TSG_OBJ_KEYWORDS -- +17 TSG_FIELD_HTTP_RES_CONTENT virtual TSG_OBJ_KEYWORDS -- +18 TSG_FIELD_SSL_SNI virtual ["TSG_OBJ_FQDN","TSG_OBJ_FQDN_CAT"] -- +19 TSG_FIELD_SSL_CN virtual ["TSG_OBJ_FQDN","TSG_OBJ_FQDN_CAT"] -- +20 TSG_FIELD_SSL_SAN virtual ["TSG_OBJ_FQDN","TSG_OBJ_FQDN_CAT"] -- +21 TSG_FIELD_DNS_QNAME virtual ["TSG_OBJ_FQDN","TSG_OBJ_FQDN_CAT"] -- +22 TSG_FIELD_QUIC_SNI virtual ["TSG_OBJ_FQDN","TSG_OBJ_FQDN_CAT"] -- +23 TSG_FIELD_MAIL_ACCOUNT virtual TSG_OBJ_ACCOUNT -- +24 TSG_FIELD_MAIL_FROM virtual TSG_OBJ_ACCOUNT -- +25 TSG_FIELD_MAIL_TO virtual TSG_OBJ_ACCOUNT -- +26 TSG_FIELD_MAIL_SUBJECT virtual TSG_OBJ_KEYWORDS -- +27 TSG_FIELD_MAIL_CONTENT virtual TSG_OBJ_KEYWORDS -- +28 TSG_FIELD_MAIL_ATT_NAME virtual TSG_OBJ_KEYWORDS -- +29 TSG_FIELD_MAIL_ATT_CONTENT virtual TSG_OBJ_KEYWORDS -- +30 TSG_FIELD_FTP_URI virtual TSG_OBJ_URL -- +31 TSG_FIELD_FTP_CONTENT virtual TSG_OBJ_KEYWORDS -- +32 TSG_FIELD_FTP_ACCOUNT virtual TSG_OBJ_ACCOUNT -- +33 TSG_SECURITY_SOURCE_ADDR virtual TSG_OBJ_IP_ADDR -- +34 TSG_SECURITY_DESTINATION_ADDR virtual TSG_OBJ_IP_ADDR -- +35 TSG_SECURITY_ADDR composition {"source":"TSG_SECURITY_SOURCE_ADDR","destination":"TSG_SECURITY_DESTINATION_ADDR"} +36 TSG_IP_ASN_BUILT_IN ip_plugin {"row_id":1,"ip_type":2,"start_ip":3,"end_ip":4,"valid":7,"estimate_size":4194304} +37 TSG_IP_ASN_USER_DEFINED ip_plugin {"row_id":1,"ip_type":2,"start_ip":3,"end_ip":4,"valid":7,"estimate_size":4194304} +38 TSG_IP_LOCATION_BUILT_IN ip_plugin {"row_id":1,"ip_type":3,"start_ip":4,"end_ip":5,"valid":18,"estimate_size":4194304} +39 TSG_IP_LOCATION_USER_DEFINED ip_plugin {"row_id":1,"ip_type":3,"start_ip":4,"end_ip":5,"valid":18,"estimate_size":4194304} +40 TSG_OBJ_AS_NUMBER expr UTF8 UTF8/GBK yes 0 +41 TSG_SECURITY_SOURCE_ASN virtual TSG_OBJ_AS_NUMBER -- +42 TSG_SECURITY_DESTINATION_ASN virtual TSG_OBJ_AS_NUMBER -- +43 TSG_OBJ_GEO_LOCATION expr UTF8 UTF8/GBK yes 0 +44 TSG_SECURITY_SOURCE_LOCATION virtual TSG_OBJ_GEO_LOCATION -- +45 TSG_SECURITY_DESTINATION_LOCATION virtual TSG_OBJ_GEO_LOCATION -- +46 TSG_FQDN_CATEGORY_BUILT_IN fqdn_plugin {"row_id":1,"is_suffix_match":4,"fqdn":3,"valid":5} -- +47 TSG_FQDN_CATEGORY_USER_DEFINED fqdn_plugin {"row_id":1,"is_suffix_match":4,"fqdn":3,"valid":5} -- diff --git a/scan/include/pangu_http.h b/scan/include/pangu_http.h index db00a10..07f3fe2 100644 --- a/scan/include/pangu_http.h +++ b/scan/include/pangu_http.h @@ -8,6 +8,6 @@ #ifndef _PANGGU_HTTP_H #define _PANGGU_HTTP_H -extern int pangu_policy_init(struct verify_policy * verify, const char* profile_path); +extern int proxy_policy_init(struct verify_policy * verify, const char* profile_path); #endif diff --git a/scan/src/pangu_http.cpp b/scan/src/pangu_http.cpp index dc14cb4..b338f33 100644 --- a/scan/src/pangu_http.cpp +++ b/scan/src/pangu_http.cpp @@ -53,7 +53,9 @@ enum verify_profile_table POLICY_ASN_BUILT_IN, POLICY_LOCATION_USER_DEFINED, POLICY_LOCATION_BUILT_IN, - POLICY_PROFILE_TABLE_MAX + POLICY_FQDN_CAT_USER_DEFINED, + POLICY_FQDN_CAT_BUILT_IN, + POLICY_PROFILE_TABLE_MAX, }; struct ip_data_table @@ -88,6 +90,16 @@ struct ip_data_ctx char *location_server; }; +struct fqdn_category_t +{ + int ref_cnt; + unsigned int category_id; + int match_method; + char fqdn[VERIFY_ARRAY_MAX]; + + pthread_mutex_t lock; +}; + struct pangu_http_ctx { enum pangu_action action; @@ -318,6 +330,32 @@ void ip_table_free(struct ip_data_table* ip_asn) ip_table_free_cb(0, (void **)&ip_asn, 0, NULL); } +const char *table_name_map[] = {"TSG_IP_ASN_USER_DEFINED", + "TSG_IP_ASN_BUILT_IN", + "TSG_IP_LOCATION_USER_DEFINED", + "TSG_IP_LOCATION_BUILT_IN", + "TSG_FQDN_CATEGORY_BUILT_IN", + "TSG_FQDN_CATEGORY_USER_DEFINED"}; + +int maat_fqdn_cat_table_init(int profile_idx, + Maat_plugin_EX_new_func_t* new_func, + Maat_plugin_EX_free_func_t* free_func, + Maat_plugin_EX_dup_func_t* dup_func) +{ + int table_id=0, ret=0; + + const char *table_name = table_name_map[profile_idx]; + table_id=g_pangu_rt->plolicy_table_id[profile_idx]=Maat_table_register(g_pangu_rt->maat[PXY_TABLE_SECURITY], table_name); + if(table_id >= 0) + { + ret=Maat_fqdn_plugin_EX_register(g_pangu_rt->maat[PXY_TABLE_SECURITY], table_id, new_func, free_func, dup_func, + 0, NULL); + return ret; + } + mesa_runtime_log(RLOG_LV_FATAL, MODULE_NAME, "Register fqdn cat table %s failed.", table_name); + return -1; +} + int maat_ip_table_init(int profile_idx, Maat_plugin_EX_free_func_t* free_func, Maat_plugin_EX_dup_func_t* dup_func) @@ -330,10 +368,6 @@ int maat_ip_table_init(int profile_idx, [POLICY_LOCATION_USER_DEFINED] = ip_location_table_new_cb, [POLICY_LOCATION_BUILT_IN] = ip_location_table_new_cb, }; - const char *table_name_map[] = {"TSG_IP_ASN_USER_DEFINED", - "TSG_IP_ASN_BUILT_IN", - "TSG_IP_LOCATION_USER_DEFINED", - "TSG_IP_LOCATION_BUILT_IN"}; const char *table_name = table_name_map[profile_idx]; table_id=g_pangu_rt->plolicy_table_id[profile_idx]=Maat_table_register(g_pangu_rt->maat[PXY_TABLE_SECURITY], table_name); @@ -343,10 +377,69 @@ int maat_ip_table_init(int profile_idx, 0, NULL); return 0; } - mesa_runtime_log(RLOG_LV_FATAL, MODULE_NAME, "Pangu HTTP register table %s failed.", table_name); + mesa_runtime_log(RLOG_LV_FATAL, MODULE_NAME, "Register table %s failed.", table_name); return -1; } +void fqdn_cat_dup_data(int table_id, MAAT_PLUGIN_EX_DATA *to, MAAT_PLUGIN_EX_DATA *from, long argl, void* argp) +{ + struct fqdn_category_t *fqdn_cat=(struct fqdn_category_t *)(*from); + pthread_mutex_lock(&(fqdn_cat->lock)); + fqdn_cat->ref_cnt++; + pthread_mutex_unlock(&(fqdn_cat->lock)); + *to=fqdn_cat; + + return; +} + +void fqdn_cat_new_data(int table_id, const char* key, const char* table_line, MAAT_PLUGIN_EX_DATA* ad, long argl, void* argp) +{ + int ret=0,id=0,is_valid=0; + + struct fqdn_category_t *fqdn_cat = ALLOC(struct fqdn_category_t, 1); + + ret=sscanf(table_line, "%d\t%u\t%s\t\t%d\t%d",&id, &fqdn_cat->category_id, fqdn_cat->fqdn, &fqdn_cat->match_method, &is_valid); + if(ret!=5) + { + FREE(&fqdn_cat); + mesa_runtime_log(RLOG_LV_FATAL, MODULE_NAME, "Parse fqdn category failed, ret: %d table_id: %d table_line: %s", ret, table_id, table_line); + return; + } + fqdn_cat->ref_cnt=1; + pthread_mutex_init(&(fqdn_cat->lock), NULL); + + *ad=(MAAT_PLUGIN_EX_DATA)fqdn_cat; + return; +} + +void fqdn_cat_free_data(int table_id, MAAT_PLUGIN_EX_DATA* ad, long argl, void* argp) +{ + if(*ad==NULL) + { + return; + } + + struct fqdn_category_t *fqdn_cat=(struct fqdn_category_t *)(*ad); + pthread_mutex_lock(&(fqdn_cat->lock)); + fqdn_cat->ref_cnt--; + if(fqdn_cat->ref_cnt>0) + { + pthread_mutex_unlock(&(fqdn_cat->lock)); + return; + } + pthread_mutex_unlock(&(fqdn_cat->lock)); + pthread_mutex_destroy(&(fqdn_cat->lock)); + + FREE(&fqdn_cat); + *ad=NULL; + return; +} + +void fqdn_cat_table_free(struct fqdn_category_t *fqdn_cat) +{ + fqdn_cat_free_data(0, (void **)&fqdn_cat, 0, NULL); +} + #if 0 static enum pangu_action decide_ctrl_action(const struct Maat_rule_t * hit_rules, size_t n_hit, struct Maat_rule_t ** enforce_rules, size_t * n_enforce) @@ -660,7 +753,7 @@ int http_ip_location_scan(struct Maat_rule_t *result, struct ip_address *sip, st snprintf(buff, sizeof(buff), "%s.%s.", ip_location_server->country_full, ip_location_server->city_full); scan_ret = Maat_full_scan_string(g_pangu_rt->maat[policy_type], g_pangu_rt->scan_table_id[policy_type][ip_location_table], CHARSET_GBK, buff, strlen(buff), - result+hit_cnt, NULL, MAX_SCAN_RESULT-hit_cnt, + result+hit_cnt+hit_cnt_ip, NULL, MAX_SCAN_RESULT-hit_cnt-hit_cnt_ip, &(ctx->scan_mid), (int) thread_id); if(scan_ret>0) { @@ -723,7 +816,7 @@ int http_ip_asn_scan(struct Maat_rule_t *result, struct ip_address* sip, struct ip_asn_table = (policy_type == PXY_TABLE_SECURITY) ? (int)PXY_SECURITY_IP_DST_ASN : (int)PXY_CTRL_IP_DST_ASN; scan_ret = Maat_full_scan_string(g_pangu_rt->maat[policy_type], g_pangu_rt->scan_table_id[policy_type][ip_asn_table], CHARSET_UTF8, ip_asn_server->asn, strlen(ip_asn_server->asn), - result+hit_cnt, NULL, MAX_SCAN_RESULT-hit_cnt, + result+hit_cnt+hit_cnt_ip, NULL, MAX_SCAN_RESULT-hit_cnt-hit_cnt_ip, &(ctx->scan_mid), (int) thread_id); if(scan_ret>0) @@ -755,7 +848,65 @@ int http_ip_asn_scan(struct Maat_rule_t *result, struct ip_address* sip, struct return hit_cnt_ip; } -size_t http_policy_scan(enum verify_policy_type policy_type, struct verify_policy_query_obj *query_obj, cJSON *data_obj, void *pme) +int verify_get_fqdn_category_id(struct Maat_rule_t *result, const char *fqdn, int protocol_field, int hit_cnt, unsigned int thread_id, enum verify_policy_type policy_type, struct pangu_http_ctx * ctx) +{ + int i=0,ret=0, hit_cnt_fqdn=0; + int category_user_num, category_built_num; + unsigned int category_id_user[8], category_id_built[8]; + struct fqdn_category_t *fqdn_cat_user[8]={0},*fqdn_cat_built[8]={0}; + + ret=Maat_fqdn_plugin_get_EX_data(g_pangu_rt->maat[PXY_TABLE_SECURITY], g_pangu_rt->plolicy_table_id[POLICY_FQDN_CAT_USER_DEFINED], fqdn, (void **)fqdn_cat_user, 8); + for(i=0; i category_id; + } + fqdn_cat_table_free(fqdn_cat_user[i]); + } + category_user_num = i< 8 ? i : 8; + + ret=Maat_fqdn_plugin_get_EX_data(g_pangu_rt->maat[PXY_TABLE_SECURITY], g_pangu_rt->plolicy_table_id[POLICY_FQDN_CAT_BUILT_IN], fqdn, (void **)fqdn_cat_built, 8); + for(i=0; i category_id; + } + fqdn_cat_table_free(fqdn_cat_built[i]); + } + category_built_num = i< 8 ? i : 8; + + if(category_user_num > 0) + { + for(i=0; imaat[policy_type], g_pangu_rt->scan_table_id[policy_type][protocol_field], category_id_user[i], + result+hit_cnt+hit_cnt_fqdn, MAX_SCAN_RESULT-hit_cnt-hit_cnt_fqdn, &(ctx->scan_mid),(int) thread_id); + if(ret>0) + { + hit_cnt_fqdn+=ret; + } + } + goto finish; + } + if (category_built_num > 0) + { + for(i=0; imaat[policy_type], g_pangu_rt->scan_table_id[policy_type][protocol_field], category_id_built[i], + result+hit_cnt+hit_cnt_fqdn, MAX_SCAN_RESULT-hit_cnt-hit_cnt_fqdn, &(ctx->scan_mid),(int) thread_id); + if(ret>0) + { + hit_cnt_fqdn+=ret; + } + } + } +finish: + return hit_cnt_fqdn; +} + +size_t verify_policy_scan(enum verify_policy_type policy_type, struct verify_policy_query_obj *query_obj, cJSON *data_obj, void *pme) { int scan_ret=0, n_read; size_t hit_cnt=0; @@ -836,6 +987,33 @@ size_t http_policy_scan(enum verify_policy_type policy_type, struct verify_polic goto decide; } + + if(policy_type == PXY_TABLE_SECURITY &&(protocol_field == PXY_SECURITY_HTTP_FQDN || + protocol_field == PXY_SECURITY_HTTPS_SNI || protocol_field==PXY_SECURITY_HTTPS_CN || protocol_field==PXY_SECURITY_HTTPS_SAN || + protocol_field==PXY_SECURITY_DNS_QNAME || protocol_field == PXY_SECURITY_QUIC_SNI)) + { + scan_ret = verify_get_fqdn_category_id(ctx->result, value, protocol_field, hit_cnt, ctx->thread_id, policy_type, ctx); + if(scan_ret>0) + { + hit_cnt+=scan_ret; + } + n_read=Maat_get_scan_status(g_pangu_rt->maat[policy_type], &(ctx->scan_mid), MAAT_GET_SCAN_HIT_PATH, ctx->hit_path, sizeof(ctx->hit_path)); + query_obj->nth_scan = ctx->hit_path[ctx->n_read].Nth_scan; + ctx->n_read=n_read; + } + + if(policy_type == PXY_TABLE_MANIPULATION &&(protocol_field == PXY_CTRL_HTTP_FQDN || + protocol_field == PXY_CTRL_DOH_QNAME || protocol_field==PXY_CTRL_DOH_HOST)) + { + scan_ret = verify_get_fqdn_category_id(ctx->result, value, protocol_field, hit_cnt, ctx->thread_id, policy_type, ctx); + if(scan_ret>0) + { + hit_cnt+=scan_ret; + } + n_read=Maat_get_scan_status(g_pangu_rt->maat[policy_type], &(ctx->scan_mid), MAAT_GET_SCAN_HIT_PATH, ctx->hit_path, sizeof(ctx->hit_path)); + query_obj->nth_scan = ctx->hit_path[ctx->n_read].Nth_scan; + ctx->n_read=n_read; + } scan_ret = Maat_full_scan_string(g_pangu_rt->maat[policy_type], g_pangu_rt->scan_table_id[policy_type][protocol_field], CHARSET_UTF8, value, strlen(value), ctx->result+hit_cnt, NULL, MAX_SCAN_RESULT-hit_cnt, @@ -845,8 +1023,11 @@ size_t http_policy_scan(enum verify_policy_type policy_type, struct verify_polic hit_cnt+=scan_ret; } n_read=Maat_get_scan_status(g_pangu_rt->maat[policy_type], &(ctx->scan_mid), MAAT_GET_SCAN_HIT_PATH, ctx->hit_path, sizeof(ctx->hit_path)); - query_obj->nth_scan = ctx->hit_path[ctx->n_read].Nth_scan; - ctx->n_read=n_read; + if(scan_ret == -2 || scan_ret >0) + { + query_obj->nth_scan = ctx->hit_path[ctx->n_read].Nth_scan; + ctx->n_read=n_read; + } decide: http_hit_policy_list(g_pangu_rt->maat[policy_type], hit_cnt, data_obj, (void *)ctx); return hit_cnt; @@ -991,7 +1172,7 @@ void subscribe_id_dup_cb(int table_id, MAAT_PLUGIN_EX_DATA* to, MAAT_PLUGIN_EX_D return; } -int pangu_policy_init(struct verify_policy * verify, const char* profile_path) +int proxy_policy_init(struct verify_policy * verify, const char* profile_path) { int ret = -1; @@ -1107,7 +1288,7 @@ int security_policy_init(struct verify_policy * verify, const char* profile_path mesa_runtime_log(RLOG_LV_DEBUG, MODULE_NAME, "Security policy register maat %p, table name %s, table id %d", g_pangu_rt->maat[PXY_TABLE_SECURITY], table_name[i], g_pangu_rt->scan_table_id[PXY_TABLE_SECURITY][i]); } - for(int i = POLICY_ASN_USER_DEFINED; i < POLICY_PROFILE_TABLE_MAX; i++) + for(int i = POLICY_ASN_USER_DEFINED; i < POLICY_FQDN_CAT_USER_DEFINED; i++) { ret = maat_ip_table_init(i, ip_table_free_cb, ip_table_dup_cb); if(ret<0) @@ -1115,6 +1296,16 @@ int security_policy_init(struct verify_policy * verify, const char* profile_path goto error_out; } } + + for(int i = POLICY_FQDN_CAT_USER_DEFINED; i < POLICY_PROFILE_TABLE_MAX; i++) + { + ret = maat_fqdn_cat_table_init(i, fqdn_cat_new_data, fqdn_cat_free_data, fqdn_cat_dup_data); + if(ret<0) + { + goto error_out; + } + } + ret = 0; error_out: return ret;