gfwleak/tango-verify-policy
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

适配服务分类(fqdn_cat)

Browse Source
This commit is contained in:
fengweihao
2020-10-13 19:17:39 +08:00
parent f8667773b6
commit 492f7c2ed8
7 changed files with 285 additions and 93 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
common/include/verify_policy.h
View File

@@ -148,7 +148,7 @@ void * pangu_http_ctx_new(unsigned int thread_id);
void pangu_http_ctx_free(void * pme); void pangu_http_ctx_free(void * pme);
size_t http_policy_scan(enum verify_policy_type policy_type, struct verify_policy_query_obj *query_obj, cJSON *data_obj, void *pme); size_t verify_policy_scan(enum verify_policy_type policy_type, struct verify_policy_query_obj *query_obj, cJSON *data_obj, void *pme);
void http_get_scan_status(struct verify_policy_query_obj *query_obj, cJSON *attributes, cJSON *data_obj, void *pme); void http_get_scan_status(struct verify_policy_query_obj *query_obj, cJSON *attributes, cJSON *data_obj, void *pme);

2
conf/verify_policy.conf
View File

@@ -3,7 +3,7 @@
DEBUG_SWITCH = 1 DEBUG_SWITCH = 1
#10:DEBUG, 20:INFO, 30:FATAL #10:DEBUG, 20:INFO, 30:FATAL
RUN_LOG_LEVEL = 10 RUN_LOG_LEVEL = 10
RUN_LOG_PATH = ./logs RUN_LOG_PATH = "conf/zlog.conf"
disable_coredump=0 disable_coredump=0
enable_breakpad=1 enable_breakpad=1

6
platform/src/verify_policy.cpp
View File

@@ -49,7 +49,7 @@ const char * version()
static int signals[] = {SIGHUP, SIGPIPE, SIGUSR1}; static int signals[] = {SIGHUP, SIGPIPE, SIGUSR1};
extern int pangu_policy_init(struct verify_policy * verify, const char* profile_path); extern int proxy_policy_init(struct verify_policy * verify, const char* profile_path);
static int verify_policy_init(struct verify_policy * verify, const char *profile) static int verify_policy_init(struct verify_policy * verify, const char *profile)
{ {
@@ -327,7 +327,7 @@ cJSON *get_query_from_request(const char *data, int thread_id)
{ {
goto free; goto free;
} }
hit_cnt = http_policy_scan(verify_policy->type, &verify_policy->verify_object[i], data_obj, ctx); hit_cnt = verify_policy_scan(verify_policy->type, &verify_policy->verify_object[i], data_obj, ctx);
if(0 == strcasecmp(verify_policy->verify_object[i].attri_name, "source") || if(0 == strcasecmp(verify_policy->verify_object[i].attri_name, "source") ||
0 == strcasecmp(verify_policy->verify_object[i].attri_name, "destination")) 0 == strcasecmp(verify_policy->verify_object[i].attri_name, "destination"))
{ {
@@ -873,7 +873,7 @@ int main(int argc, char * argv[])
ret = verify_policy_init(g_verify_proxy, main_profile); ret = verify_policy_init(g_verify_proxy, main_profile);
CHECK_OR_EXIT(ret == 0, "Failed at loading profile %s, Exit.", main_profile); CHECK_OR_EXIT(ret == 0, "Failed at loading profile %s, Exit.", main_profile);
ret = pangu_policy_init(g_verify_proxy, main_profile); ret = proxy_policy_init(g_verify_proxy, main_profile);
CHECK_OR_EXIT(ret == 0, "Failed at init panggu module, Exit."); CHECK_OR_EXIT(ret == 0, "Failed at init panggu module, Exit.");
clock_gettime(CLOCK_REALTIME, &(end_time)); clock_gettime(CLOCK_REALTIME, &(end_time));

50
resource/table_info_proxy.conf
View File

@@ -22,28 +22,28 @@
4 TSG_OBJ_URL expr UTF8 GBK/UNICODE/UTF8/url_encode_gb2312/url_encode_utf8 yes 0 quickoff 4 TSG_OBJ_URL expr UTF8 GBK/UNICODE/UTF8/url_encode_gb2312/url_encode_utf8 yes 0 quickoff
5 TSG_FIELD_HTTP_URL virtual TSG_OBJ_URL -- 5 TSG_FIELD_HTTP_URL virtual TSG_OBJ_URL --
6 TSG_OBJ_FQDN expr UTF8 GBK/UNICODE/UTF8/url_encode_gb2312/url_encode_utf8 yes 0 quickoff 6 TSG_OBJ_FQDN expr UTF8 GBK/UNICODE/UTF8/url_encode_gb2312/url_encode_utf8 yes 0 quickoff
6 TSG_OBJ_FQDN_CAT expr UTF8 GBK/UNICODE/UTF8/url_encode_gb2312/url_encode_utf8 yes 0 quickoff 7 TSG_OBJ_FQDN_CAT intval UTF8 UTF8 yes 0
7 TSG_FIELD_HTTP_HOST virtual TSG_OBJ_FQDN -- 8 TSG_FIELD_HTTP_HOST virtual ["TSG_OBJ_FQDN","TSG_OBJ_FQDN_CAT"] --
8 TSG_OBJ_HTTP_SIGNATURE expr_plus UTF8 UTF8 yes 0 quickoff 9 TSG_OBJ_HTTP_SIGNATURE expr_plus UTF8 UTF8 yes 0 quickoff
9 TSG_FIELD_HTTP_REQ_HDR virtual TSG_OBJ_HTTP_SIGNATURE -- 10 TSG_FIELD_HTTP_REQ_HDR virtual TSG_OBJ_HTTP_SIGNATURE --
10 TSG_FIELD_HTTP_RES_HDR virtual TSG_OBJ_HTTP_SIGNATURE -- 11 TSG_FIELD_HTTP_RES_HDR virtual TSG_OBJ_HTTP_SIGNATURE --
11 TSG_OBJ_KEYWORDS expr UTF8 GBK/UNICODE/UTF8/windows-1251 yes 128 quickoff 12 TSG_OBJ_KEYWORDS expr UTF8 GBK/UNICODE/UTF8/windows-1251 yes 128 quickoff
12 TSG_FIELD_HTTP_REQ_CONTENT virtual TSG_OBJ_KEYWORDS -- 13 TSG_FIELD_HTTP_REQ_CONTENT virtual TSG_OBJ_KEYWORDS --
13 TSG_FIELD_HTTP_RES_CONTENT virtual TSG_OBJ_KEYWORDS -- 14 TSG_FIELD_HTTP_RES_CONTENT virtual TSG_OBJ_KEYWORDS --
14 TSG_OBJ_SUBSCRIBER_ID expr UTF8 UTF8 yes 0 quickon 15 TSG_OBJ_SUBSCRIBER_ID expr UTF8 UTF8 yes 0 quickon
15 TSG_OBJ_APP_ID intval UTF8 UTF8 yes 0 16 TSG_OBJ_APP_ID intval UTF8 UTF8 yes 0
16 TSG_SECURITY_SOURCE_ADDR virtual TSG_OBJ_IP_ADDR -- 17 TSG_SECURITY_SOURCE_ADDR virtual TSG_OBJ_IP_ADDR --
17 TSG_SECURITY_DESTINATION_ADDR virtual TSG_OBJ_IP_ADDR -- 18 TSG_SECURITY_DESTINATION_ADDR virtual TSG_OBJ_IP_ADDR --
18 TSG_SECURITY_ADDR composition {"source":"TSG_SECURITY_SOURCE_ADDR","destination":"TSG_SECURITY_DESTINATION_ADDR"} 19 TSG_SECURITY_ADDR composition {"source":"TSG_SECURITY_SOURCE_ADDR","destination":"TSG_SECURITY_DESTINATION_ADDR"}
19 TSG_IP_ASN_BUILT_IN ip_plugin {"row_id":1,"ip_type":2,"start_ip":3,"end_ip":4,"valid":7,"estimate_size":4194304} 20 TSG_IP_ASN_BUILT_IN ip_plugin {"row_id":1,"ip_type":2,"start_ip":3,"end_ip":4,"valid":7,"estimate_size":4194304}
20 TSG_IP_ASN_USER_DEFINED ip_plugin {"row_id":1,"ip_type":2,"start_ip":3,"end_ip":4,"valid":7,"estimate_size":4194304} 21 TSG_IP_ASN_USER_DEFINED ip_plugin {"row_id":1,"ip_type":2,"start_ip":3,"end_ip":4,"valid":7,"estimate_size":4194304}
21 TSG_IP_LOCATION_BUILT_IN ip_plugin {"row_id":1,"ip_type":3,"start_ip":4,"end_ip":5,"valid":18,"estimate_size":4194304} 22 TSG_IP_LOCATION_BUILT_IN ip_plugin {"row_id":1,"ip_type":3,"start_ip":4,"end_ip":5,"valid":18,"estimate_size":4194304}
22 TSG_IP_LOCATION_USER_DEFINED ip_plugin {"row_id":1,"ip_type":3,"start_ip":4,"end_ip":5,"valid":18,"estimate_size":4194304} 23 TSG_IP_LOCATION_USER_DEFINED ip_plugin {"row_id":1,"ip_type":3,"start_ip":4,"end_ip":5,"valid":18,"estimate_size":4194304}
23 TSG_OBJ_AS_NUMBER expr UTF8 UTF8/GBK yes 0 24 TSG_OBJ_AS_NUMBER expr UTF8 UTF8/GBK yes 0
24 TSG_SECURITY_SOURCE_ASN virtual TSG_OBJ_AS_NUMBER -- 25 TSG_SECURITY_SOURCE_ASN virtual TSG_OBJ_AS_NUMBER --
25 TSG_SECURITY_DESTINATION_ASN virtual TSG_OBJ_AS_NUMBER -- 26 TSG_SECURITY_DESTINATION_ASN virtual TSG_OBJ_AS_NUMBER --
26 TSG_OBJ_GEO_LOCATION expr UTF8 UTF8/GBK yes 0 27 TSG_OBJ_GEO_LOCATION expr UTF8 UTF8/GBK yes 0
27 TSG_SECURITY_SOURCE_LOCATION virtual TSG_OBJ_GEO_LOCATION -- 28 TSG_SECURITY_SOURCE_LOCATION virtual TSG_OBJ_GEO_LOCATION --
28 TSG_SECURITY_DESTINATION_LOCATION virtual TSG_OBJ_GEO_LOCATION -- 29 TSG_SECURITY_DESTINATION_LOCATION virtual TSG_OBJ_GEO_LOCATION --
29 TSG_FIELD_DOH_QNAME virtual TSG_OBJ_FQDN -- 30 TSG_FIELD_DOH_QNAME virtual ["TSG_OBJ_FQDN","TSG_OBJ_FQDN_CAT"] --
30 TSG_FIELD_DOH_HOST virtual TSG_OBJ_FQDN -- 31 TSG_FIELD_DOH_HOST virtual ["TSG_OBJ_FQDN","TSG_OBJ_FQDN_CAT"] --

79
resource/table_info_security.conf
View File

@@ -16,44 +16,45 @@
5 TSG_OBJ_ACCOUNT expr UTF8 UTF8 yes 0 5 TSG_OBJ_ACCOUNT expr UTF8 UTF8 yes 0
6 TSG_OBJ_URL expr UTF8 UTF8/GBK yes 0 6 TSG_OBJ_URL expr UTF8 UTF8/GBK yes 0
7 TSG_OBJ_FQDN expr UTF8 UTF8 yes 0 7 TSG_OBJ_FQDN expr UTF8 UTF8 yes 0
7 TSG_OBJ_FQDN_CAT expr UTF8 UTF8 yes 0 8 TSG_OBJ_FQDN_CAT intval UTF8 UTF8 yes 0
8 TSG_OBJ_KEYWORDS expr UTF8 UTF8/GBK/windows-1251 yes 0 9 TSG_OBJ_KEYWORDS expr UTF8 UTF8/GBK/windows-1251 yes 0
9 TSG_OBJ_APP_ID intval UTF8 UTF8 yes 0 10 TSG_OBJ_APP_ID intval UTF8 UTF8 yes 0
10 TSG_OBJ_HTTP_SIGNATURE expr_plus UTF8 UTF8/GBK yes 0 11 TSG_OBJ_HTTP_SIGNATURE expr_plus UTF8 UTF8/GBK yes 0
11 TSG_FIELD_HTTP_HOST virtual TSG_OBJ_FQDN -- 12 TSG_FIELD_HTTP_HOST virtual ["TSG_OBJ_FQDN","TSG_OBJ_FQDN_CAT"] --
12 TSG_FIELD_HTTP_URL virtual TSG_OBJ_URL -- 13 TSG_FIELD_HTTP_URL virtual TSG_OBJ_URL --
13 TSG_FIELD_HTTP_REQ_HDR virtual TSG_OBJ_HTTP_SIGNATURE -- 14 TSG_FIELD_HTTP_REQ_HDR virtual TSG_OBJ_HTTP_SIGNATURE --
14 TSG_FIELD_HTTP_RES_HDR virtual TSG_OBJ_HTTP_SIGNATURE -- 15 TSG_FIELD_HTTP_RES_HDR virtual TSG_OBJ_HTTP_SIGNATURE --
15 TSG_FIELD_HTTP_REQ_CONTENT virtual TSG_OBJ_KEYWORDS -- 16 TSG_FIELD_HTTP_REQ_CONTENT virtual TSG_OBJ_KEYWORDS --
16 TSG_FIELD_HTTP_RES_CONTENT virtual TSG_OBJ_KEYWORDS -- 17 TSG_FIELD_HTTP_RES_CONTENT virtual TSG_OBJ_KEYWORDS --
17 TSG_FIELD_SSL_SNI virtual TSG_OBJ_FQDN -- 18 TSG_FIELD_SSL_SNI virtual ["TSG_OBJ_FQDN","TSG_OBJ_FQDN_CAT"] --
18 TSG_FIELD_SSL_CN virtual TSG_OBJ_FQDN -- 19 TSG_FIELD_SSL_CN virtual ["TSG_OBJ_FQDN","TSG_OBJ_FQDN_CAT"] --
19 TSG_FIELD_SSL_SAN virtual TSG_OBJ_FQDN -- 20 TSG_FIELD_SSL_SAN virtual ["TSG_OBJ_FQDN","TSG_OBJ_FQDN_CAT"] --
20 TSG_FIELD_DNS_QNAME virtual TSG_OBJ_FQDN -- 21 TSG_FIELD_DNS_QNAME virtual ["TSG_OBJ_FQDN","TSG_OBJ_FQDN_CAT"] --
21 TSG_FIELD_QUIC_SNI virtual TSG_OBJ_FQDN -- 22 TSG_FIELD_QUIC_SNI virtual ["TSG_OBJ_FQDN","TSG_OBJ_FQDN_CAT"] --
22 TSG_FIELD_MAIL_ACCOUNT virtual TSG_OBJ_ACCOUNT -- 23 TSG_FIELD_MAIL_ACCOUNT virtual TSG_OBJ_ACCOUNT --
23 TSG_FIELD_MAIL_FROM virtual TSG_OBJ_ACCOUNT -- 24 TSG_FIELD_MAIL_FROM virtual TSG_OBJ_ACCOUNT --
24 TSG_FIELD_MAIL_TO virtual TSG_OBJ_ACCOUNT -- 25 TSG_FIELD_MAIL_TO virtual TSG_OBJ_ACCOUNT --
25 TSG_FIELD_MAIL_SUBJECT virtual TSG_OBJ_KEYWORDS -- 26 TSG_FIELD_MAIL_SUBJECT virtual TSG_OBJ_KEYWORDS --
26 TSG_FIELD_MAIL_CONTENT virtual TSG_OBJ_KEYWORDS -- 27 TSG_FIELD_MAIL_CONTENT virtual TSG_OBJ_KEYWORDS --
27 TSG_FIELD_MAIL_ATT_NAME virtual TSG_OBJ_KEYWORDS -- 28 TSG_FIELD_MAIL_ATT_NAME virtual TSG_OBJ_KEYWORDS --
28 TSG_FIELD_MAIL_ATT_CONTENT virtual TSG_OBJ_KEYWORDS -- 29 TSG_FIELD_MAIL_ATT_CONTENT virtual TSG_OBJ_KEYWORDS --
29 TSG_FIELD_FTP_URI virtual TSG_OBJ_URL -- 30 TSG_FIELD_FTP_URI virtual TSG_OBJ_URL --
30 TSG_FIELD_FTP_CONTENT virtual TSG_OBJ_KEYWORDS -- 31 TSG_FIELD_FTP_CONTENT virtual TSG_OBJ_KEYWORDS --
31 TSG_FIELD_FTP_ACCOUNT virtual TSG_OBJ_ACCOUNT -- 32 TSG_FIELD_FTP_ACCOUNT virtual TSG_OBJ_ACCOUNT --
32 TSG_SECURITY_SOURCE_ADDR virtual TSG_OBJ_IP_ADDR -- 33 TSG_SECURITY_SOURCE_ADDR virtual TSG_OBJ_IP_ADDR --
33 TSG_SECURITY_DESTINATION_ADDR virtual TSG_OBJ_IP_ADDR -- 34 TSG_SECURITY_DESTINATION_ADDR virtual TSG_OBJ_IP_ADDR --
34 TSG_SECURITY_ADDR composition {"source":"TSG_SECURITY_SOURCE_ADDR","destination":"TSG_SECURITY_DESTINATION_ADDR"} 35 TSG_SECURITY_ADDR composition {"source":"TSG_SECURITY_SOURCE_ADDR","destination":"TSG_SECURITY_DESTINATION_ADDR"}
35 TSG_IP_ASN_BUILT_IN ip_plugin {"row_id":1,"ip_type":2,"start_ip":3,"end_ip":4,"valid":7,"estimate_size":4194304} 36 TSG_IP_ASN_BUILT_IN ip_plugin {"row_id":1,"ip_type":2,"start_ip":3,"end_ip":4,"valid":7,"estimate_size":4194304}
36 TSG_IP_ASN_USER_DEFINED ip_plugin {"row_id":1,"ip_type":2,"start_ip":3,"end_ip":4,"valid":7,"estimate_size":4194304} 37 TSG_IP_ASN_USER_DEFINED ip_plugin {"row_id":1,"ip_type":2,"start_ip":3,"end_ip":4,"valid":7,"estimate_size":4194304}
37 TSG_IP_LOCATION_BUILT_IN ip_plugin {"row_id":1,"ip_type":3,"start_ip":4,"end_ip":5,"valid":18,"estimate_size":4194304} 38 TSG_IP_LOCATION_BUILT_IN ip_plugin {"row_id":1,"ip_type":3,"start_ip":4,"end_ip":5,"valid":18,"estimate_size":4194304}
38 TSG_IP_LOCATION_USER_DEFINED ip_plugin {"row_id":1,"ip_type":3,"start_ip":4,"end_ip":5,"valid":18,"estimate_size":4194304} 39 TSG_IP_LOCATION_USER_DEFINED ip_plugin {"row_id":1,"ip_type":3,"start_ip":4,"end_ip":5,"valid":18,"estimate_size":4194304}
39 TSG_OBJ_AS_NUMBER expr UTF8 UTF8/GBK yes 0 40 TSG_OBJ_AS_NUMBER expr UTF8 UTF8/GBK yes 0
40 TSG_SECURITY_SOURCE_ASN virtual TSG_OBJ_AS_NUMBER -- 41 TSG_SECURITY_SOURCE_ASN virtual TSG_OBJ_AS_NUMBER --
41 TSG_SECURITY_DESTINATION_ASN virtual TSG_OBJ_AS_NUMBER -- 42 TSG_SECURITY_DESTINATION_ASN virtual TSG_OBJ_AS_NUMBER --
42 TSG_OBJ_GEO_LOCATION expr UTF8 UTF8/GBK yes 0 43 TSG_OBJ_GEO_LOCATION expr UTF8 UTF8/GBK yes 0
43 TSG_SECURITY_SOURCE_LOCATION virtual TSG_OBJ_GEO_LOCATION -- 44 TSG_SECURITY_SOURCE_LOCATION virtual TSG_OBJ_GEO_LOCATION --
44 TSG_SECURITY_DESTINATION_LOCATION virtual TSG_OBJ_GEO_LOCATION -- 45 TSG_SECURITY_DESTINATION_LOCATION virtual TSG_OBJ_GEO_LOCATION --
46 TSG_FQDN_CATEGORY_BUILT_IN fqdn_plugin {"row_id":1,"is_suffix_match":4,"fqdn":3,"valid":5} --
47 TSG_FQDN_CATEGORY_USER_DEFINED fqdn_plugin {"row_id":1,"is_suffix_match":4,"fqdn":3,"valid":5} --

2
scan/include/pangu_http.h
View File

@@ -8,6 +8,6 @@
#ifndef _PANGGU_HTTP_H #ifndef _PANGGU_HTTP_H
#define _PANGGU_HTTP_H #define _PANGGU_HTTP_H
extern int pangu_policy_init(struct verify_policy * verify, const char* profile_path); extern int proxy_policy_init(struct verify_policy * verify, const char* profile_path);
#endif #endif

213
scan/src/pangu_http.cpp
View File

@@ -53,7 +53,9 @@ enum verify_profile_table
POLICY_ASN_BUILT_IN, POLICY_ASN_BUILT_IN,
POLICY_LOCATION_USER_DEFINED, POLICY_LOCATION_USER_DEFINED,
POLICY_LOCATION_BUILT_IN, POLICY_LOCATION_BUILT_IN,
POLICY_PROFILE_TABLE_MAX POLICY_FQDN_CAT_USER_DEFINED,
POLICY_FQDN_CAT_BUILT_IN,
POLICY_PROFILE_TABLE_MAX,
}; };
struct ip_data_table struct ip_data_table
@@ -88,6 +90,16 @@ struct ip_data_ctx
char *location_server; char *location_server;
}; };
struct fqdn_category_t
{
int ref_cnt;
unsigned int category_id;
int match_method;
char fqdn[VERIFY_ARRAY_MAX];
pthread_mutex_t lock;
};
struct pangu_http_ctx struct pangu_http_ctx
{ {
enum pangu_action action; enum pangu_action action;
@@ -318,6 +330,32 @@ void ip_table_free(struct ip_data_table* ip_asn)
ip_table_free_cb(0, (void **)&ip_asn, 0, NULL); ip_table_free_cb(0, (void **)&ip_asn, 0, NULL);
} }
const char *table_name_map[] = {"TSG_IP_ASN_USER_DEFINED",
"TSG_IP_ASN_BUILT_IN",
"TSG_IP_LOCATION_USER_DEFINED",
"TSG_IP_LOCATION_BUILT_IN",
"TSG_FQDN_CATEGORY_BUILT_IN",
"TSG_FQDN_CATEGORY_USER_DEFINED"};
int maat_fqdn_cat_table_init(int profile_idx,
Maat_plugin_EX_new_func_t* new_func,
Maat_plugin_EX_free_func_t* free_func,
Maat_plugin_EX_dup_func_t* dup_func)
{
int table_id=0, ret=0;
const char *table_name = table_name_map[profile_idx];
table_id=g_pangu_rt->plolicy_table_id[profile_idx]=Maat_table_register(g_pangu_rt->maat[PXY_TABLE_SECURITY], table_name);
if(table_id >= 0)
{
ret=Maat_fqdn_plugin_EX_register(g_pangu_rt->maat[PXY_TABLE_SECURITY], table_id, new_func, free_func, dup_func,
0, NULL);
return ret;
}
mesa_runtime_log(RLOG_LV_FATAL, MODULE_NAME, "Register fqdn cat table %s failed.", table_name);
return -1;
}
int maat_ip_table_init(int profile_idx, int maat_ip_table_init(int profile_idx,
Maat_plugin_EX_free_func_t* free_func, Maat_plugin_EX_free_func_t* free_func,
Maat_plugin_EX_dup_func_t* dup_func) Maat_plugin_EX_dup_func_t* dup_func)
@@ -330,10 +368,6 @@ int maat_ip_table_init(int profile_idx,
[POLICY_LOCATION_USER_DEFINED] = ip_location_table_new_cb, [POLICY_LOCATION_USER_DEFINED] = ip_location_table_new_cb,
[POLICY_LOCATION_BUILT_IN] = ip_location_table_new_cb, [POLICY_LOCATION_BUILT_IN] = ip_location_table_new_cb,
}; };
const char *table_name_map[] = {"TSG_IP_ASN_USER_DEFINED",
"TSG_IP_ASN_BUILT_IN",
"TSG_IP_LOCATION_USER_DEFINED",
"TSG_IP_LOCATION_BUILT_IN"};
const char *table_name = table_name_map[profile_idx]; const char *table_name = table_name_map[profile_idx];
table_id=g_pangu_rt->plolicy_table_id[profile_idx]=Maat_table_register(g_pangu_rt->maat[PXY_TABLE_SECURITY], table_name); table_id=g_pangu_rt->plolicy_table_id[profile_idx]=Maat_table_register(g_pangu_rt->maat[PXY_TABLE_SECURITY], table_name);
@@ -343,10 +377,69 @@ int maat_ip_table_init(int profile_idx,
0, NULL); 0, NULL);
return 0; return 0;
} }
mesa_runtime_log(RLOG_LV_FATAL, MODULE_NAME, "Pangu HTTP register table %s failed.", table_name); mesa_runtime_log(RLOG_LV_FATAL, MODULE_NAME, "Register table %s failed.", table_name);
return -1; return -1;
} }
void fqdn_cat_dup_data(int table_id, MAAT_PLUGIN_EX_DATA *to, MAAT_PLUGIN_EX_DATA *from, long argl, void* argp)
{
struct fqdn_category_t *fqdn_cat=(struct fqdn_category_t *)(*from);
pthread_mutex_lock(&(fqdn_cat->lock));
fqdn_cat->ref_cnt++;
pthread_mutex_unlock(&(fqdn_cat->lock));
*to=fqdn_cat;
return;
}
void fqdn_cat_new_data(int table_id, const char* key, const char* table_line, MAAT_PLUGIN_EX_DATA* ad, long argl, void* argp)
{
int ret=0,id=0,is_valid=0;
struct fqdn_category_t *fqdn_cat = ALLOC(struct fqdn_category_t, 1);
ret=sscanf(table_line, "%d\t%u\t%s\t\t%d\t%d",&id, &fqdn_cat->category_id, fqdn_cat->fqdn, &fqdn_cat->match_method, &is_valid);
if(ret!=5)
{
FREE(&fqdn_cat);
mesa_runtime_log(RLOG_LV_FATAL, MODULE_NAME, "Parse fqdn category failed, ret: %d table_id: %d table_line: %s", ret, table_id, table_line);
return;
}
fqdn_cat->ref_cnt=1;
pthread_mutex_init(&(fqdn_cat->lock), NULL);
*ad=(MAAT_PLUGIN_EX_DATA)fqdn_cat;
return;
}
void fqdn_cat_free_data(int table_id, MAAT_PLUGIN_EX_DATA* ad, long argl, void* argp)
{
if(*ad==NULL)
{
return;
}
struct fqdn_category_t *fqdn_cat=(struct fqdn_category_t *)(*ad);
pthread_mutex_lock(&(fqdn_cat->lock));
fqdn_cat->ref_cnt--;
if(fqdn_cat->ref_cnt>0)
{
pthread_mutex_unlock(&(fqdn_cat->lock));
return;
}
pthread_mutex_unlock(&(fqdn_cat->lock));
pthread_mutex_destroy(&(fqdn_cat->lock));
FREE(&fqdn_cat);
*ad=NULL;
return;
}
void fqdn_cat_table_free(struct fqdn_category_t *fqdn_cat)
{
fqdn_cat_free_data(0, (void **)&fqdn_cat, 0, NULL);
}
#if 0 #if 0
static enum pangu_action decide_ctrl_action(const struct Maat_rule_t * hit_rules, size_t n_hit, static enum pangu_action decide_ctrl_action(const struct Maat_rule_t * hit_rules, size_t n_hit,
struct Maat_rule_t ** enforce_rules, size_t * n_enforce) struct Maat_rule_t ** enforce_rules, size_t * n_enforce)
@@ -660,7 +753,7 @@ int http_ip_location_scan(struct Maat_rule_t *result, struct ip_address *sip, st
snprintf(buff, sizeof(buff), "%s.%s.", ip_location_server->country_full, ip_location_server->city_full); snprintf(buff, sizeof(buff), "%s.%s.", ip_location_server->country_full, ip_location_server->city_full);
scan_ret = Maat_full_scan_string(g_pangu_rt->maat[policy_type], g_pangu_rt->scan_table_id[policy_type][ip_location_table], scan_ret = Maat_full_scan_string(g_pangu_rt->maat[policy_type], g_pangu_rt->scan_table_id[policy_type][ip_location_table],
CHARSET_GBK, buff, strlen(buff), CHARSET_GBK, buff, strlen(buff),
result+hit_cnt, NULL, MAX_SCAN_RESULT-hit_cnt, result+hit_cnt+hit_cnt_ip, NULL, MAX_SCAN_RESULT-hit_cnt-hit_cnt_ip,
&(ctx->scan_mid), (int) thread_id); &(ctx->scan_mid), (int) thread_id);
if(scan_ret>0) if(scan_ret>0)
{ {
@@ -723,7 +816,7 @@ int http_ip_asn_scan(struct Maat_rule_t *result, struct ip_address* sip, struct
ip_asn_table = (policy_type == PXY_TABLE_SECURITY) ? (int)PXY_SECURITY_IP_DST_ASN : (int)PXY_CTRL_IP_DST_ASN; ip_asn_table = (policy_type == PXY_TABLE_SECURITY) ? (int)PXY_SECURITY_IP_DST_ASN : (int)PXY_CTRL_IP_DST_ASN;
scan_ret = Maat_full_scan_string(g_pangu_rt->maat[policy_type], g_pangu_rt->scan_table_id[policy_type][ip_asn_table], scan_ret = Maat_full_scan_string(g_pangu_rt->maat[policy_type], g_pangu_rt->scan_table_id[policy_type][ip_asn_table],
CHARSET_UTF8, ip_asn_server->asn, strlen(ip_asn_server->asn), CHARSET_UTF8, ip_asn_server->asn, strlen(ip_asn_server->asn),
result+hit_cnt, NULL, MAX_SCAN_RESULT-hit_cnt, result+hit_cnt+hit_cnt_ip, NULL, MAX_SCAN_RESULT-hit_cnt-hit_cnt_ip,
&(ctx->scan_mid), (int) thread_id); &(ctx->scan_mid), (int) thread_id);
if(scan_ret>0) if(scan_ret>0)
@@ -755,7 +848,65 @@ int http_ip_asn_scan(struct Maat_rule_t *result, struct ip_address* sip, struct
return hit_cnt_ip; return hit_cnt_ip;
} }
size_t http_policy_scan(enum verify_policy_type policy_type, struct verify_policy_query_obj *query_obj, cJSON *data_obj, void *pme) int verify_get_fqdn_category_id(struct Maat_rule_t *result, const char *fqdn, int protocol_field, int hit_cnt, unsigned int thread_id, enum verify_policy_type policy_type, struct pangu_http_ctx * ctx)
{
int i=0,ret=0, hit_cnt_fqdn=0;
int category_user_num, category_built_num;
unsigned int category_id_user[8], category_id_built[8];
struct fqdn_category_t *fqdn_cat_user[8]={0},*fqdn_cat_built[8]={0};
ret=Maat_fqdn_plugin_get_EX_data(g_pangu_rt->maat[PXY_TABLE_SECURITY], g_pangu_rt->plolicy_table_id[POLICY_FQDN_CAT_USER_DEFINED], fqdn, (void **)fqdn_cat_user, 8);
for(i=0; i <ret; i++)
{
if(i < 8)
{
category_id_user[i] = fqdn_cat_user[i]->category_id;
}
fqdn_cat_table_free(fqdn_cat_user[i]);
}
category_user_num = i< 8 ? i : 8;
ret=Maat_fqdn_plugin_get_EX_data(g_pangu_rt->maat[PXY_TABLE_SECURITY], g_pangu_rt->plolicy_table_id[POLICY_FQDN_CAT_BUILT_IN], fqdn, (void **)fqdn_cat_built, 8);
for(i=0; i <ret; i++)
{
if(i < 8)
{
category_id_built[i] = fqdn_cat_built[i]->category_id;
}
fqdn_cat_table_free(fqdn_cat_built[i]);
}
category_built_num = i< 8 ? i : 8;
if(category_user_num > 0)
{
for(i=0; i<category_user_num; i++)
{
ret=Maat_scan_intval(g_pangu_rt->maat[policy_type], g_pangu_rt->scan_table_id[policy_type][protocol_field], category_id_user[i],
result+hit_cnt+hit_cnt_fqdn, MAX_SCAN_RESULT-hit_cnt-hit_cnt_fqdn, &(ctx->scan_mid),(int) thread_id);
if(ret>0)
{
hit_cnt_fqdn+=ret;
}
}
goto finish;
}
if (category_built_num > 0)
{
for(i=0; i<category_built_num; i++)
{
ret=Maat_scan_intval(g_pangu_rt->maat[policy_type], g_pangu_rt->scan_table_id[policy_type][protocol_field], category_id_built[i],
result+hit_cnt+hit_cnt_fqdn, MAX_SCAN_RESULT-hit_cnt-hit_cnt_fqdn, &(ctx->scan_mid),(int) thread_id);
if(ret>0)
{
hit_cnt_fqdn+=ret;
}
}
}
finish:
return hit_cnt_fqdn;
}
size_t verify_policy_scan(enum verify_policy_type policy_type, struct verify_policy_query_obj *query_obj, cJSON *data_obj, void *pme)
{ {
int scan_ret=0, n_read; int scan_ret=0, n_read;
size_t hit_cnt=0; size_t hit_cnt=0;
@@ -836,6 +987,33 @@ size_t http_policy_scan(enum verify_policy_type policy_type, struct verify_polic
goto decide; goto decide;
} }
if(policy_type == PXY_TABLE_SECURITY &&(protocol_field == PXY_SECURITY_HTTP_FQDN ||
protocol_field == PXY_SECURITY_HTTPS_SNI || protocol_field==PXY_SECURITY_HTTPS_CN || protocol_field==PXY_SECURITY_HTTPS_SAN ||
protocol_field==PXY_SECURITY_DNS_QNAME || protocol_field == PXY_SECURITY_QUIC_SNI))
{
scan_ret = verify_get_fqdn_category_id(ctx->result, value, protocol_field, hit_cnt, ctx->thread_id, policy_type, ctx);
if(scan_ret>0)
{
hit_cnt+=scan_ret;
}
n_read=Maat_get_scan_status(g_pangu_rt->maat[policy_type], &(ctx->scan_mid), MAAT_GET_SCAN_HIT_PATH, ctx->hit_path, sizeof(ctx->hit_path));
query_obj->nth_scan = ctx->hit_path[ctx->n_read].Nth_scan;
ctx->n_read=n_read;
}
if(policy_type == PXY_TABLE_MANIPULATION &&(protocol_field == PXY_CTRL_HTTP_FQDN ||
protocol_field == PXY_CTRL_DOH_QNAME || protocol_field==PXY_CTRL_DOH_HOST))
{
scan_ret = verify_get_fqdn_category_id(ctx->result, value, protocol_field, hit_cnt, ctx->thread_id, policy_type, ctx);
if(scan_ret>0)
{
hit_cnt+=scan_ret;
}
n_read=Maat_get_scan_status(g_pangu_rt->maat[policy_type], &(ctx->scan_mid), MAAT_GET_SCAN_HIT_PATH, ctx->hit_path, sizeof(ctx->hit_path));
query_obj->nth_scan = ctx->hit_path[ctx->n_read].Nth_scan;
ctx->n_read=n_read;
}
scan_ret = Maat_full_scan_string(g_pangu_rt->maat[policy_type], g_pangu_rt->scan_table_id[policy_type][protocol_field], scan_ret = Maat_full_scan_string(g_pangu_rt->maat[policy_type], g_pangu_rt->scan_table_id[policy_type][protocol_field],
CHARSET_UTF8, value, strlen(value), CHARSET_UTF8, value, strlen(value),
ctx->result+hit_cnt, NULL, MAX_SCAN_RESULT-hit_cnt, ctx->result+hit_cnt, NULL, MAX_SCAN_RESULT-hit_cnt,
@@ -845,8 +1023,11 @@ size_t http_policy_scan(enum verify_policy_type policy_type, struct verify_polic
hit_cnt+=scan_ret; hit_cnt+=scan_ret;
} }
n_read=Maat_get_scan_status(g_pangu_rt->maat[policy_type], &(ctx->scan_mid), MAAT_GET_SCAN_HIT_PATH, ctx->hit_path, sizeof(ctx->hit_path)); n_read=Maat_get_scan_status(g_pangu_rt->maat[policy_type], &(ctx->scan_mid), MAAT_GET_SCAN_HIT_PATH, ctx->hit_path, sizeof(ctx->hit_path));
if(scan_ret == -2 || scan_ret >0)
{
query_obj->nth_scan = ctx->hit_path[ctx->n_read].Nth_scan; query_obj->nth_scan = ctx->hit_path[ctx->n_read].Nth_scan;
ctx->n_read=n_read; ctx->n_read=n_read;
}
decide: decide:
http_hit_policy_list(g_pangu_rt->maat[policy_type], hit_cnt, data_obj, (void *)ctx); http_hit_policy_list(g_pangu_rt->maat[policy_type], hit_cnt, data_obj, (void *)ctx);
return hit_cnt; return hit_cnt;
@@ -991,7 +1172,7 @@ void subscribe_id_dup_cb(int table_id, MAAT_PLUGIN_EX_DATA* to, MAAT_PLUGIN_EX_D
return; return;
} }
int pangu_policy_init(struct verify_policy * verify, const char* profile_path) int proxy_policy_init(struct verify_policy * verify, const char* profile_path)
{ {
int ret = -1; int ret = -1;
@@ -1107,7 +1288,7 @@ int security_policy_init(struct verify_policy * verify, const char* profile_path
mesa_runtime_log(RLOG_LV_DEBUG, MODULE_NAME, "Security policy register maat %p, table name %s, table id %d", g_pangu_rt->maat[PXY_TABLE_SECURITY], table_name[i], g_pangu_rt->scan_table_id[PXY_TABLE_SECURITY][i]); mesa_runtime_log(RLOG_LV_DEBUG, MODULE_NAME, "Security policy register maat %p, table name %s, table id %d", g_pangu_rt->maat[PXY_TABLE_SECURITY], table_name[i], g_pangu_rt->scan_table_id[PXY_TABLE_SECURITY][i]);
} }
for(int i = POLICY_ASN_USER_DEFINED; i < POLICY_PROFILE_TABLE_MAX; i++) for(int i = POLICY_ASN_USER_DEFINED; i < POLICY_FQDN_CAT_USER_DEFINED; i++)
{ {
ret = maat_ip_table_init(i, ip_table_free_cb, ip_table_dup_cb); ret = maat_ip_table_init(i, ip_table_free_cb, ip_table_dup_cb);
if(ret<0) if(ret<0)
@@ -1115,6 +1296,16 @@ int security_policy_init(struct verify_policy * verify, const char* profile_path
goto error_out; goto error_out;
} }
} }
for(int i = POLICY_FQDN_CAT_USER_DEFINED; i < POLICY_PROFILE_TABLE_MAX; i++)
{
ret = maat_fqdn_cat_table_init(i, fqdn_cat_new_data, fqdn_cat_free_data, fqdn_cat_dup_data);
if(ret<0)
{
goto error_out;
}
}
ret = 0; ret = 0;
error_out: error_out:
return ret; return ret;