gfwleak/tango-verify-policy
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

TSG-9553 策略验证支持4级或以上定位库

Browse Source
This commit is contained in:
fengweihao
2022-02-10 14:05:19 +08:00
parent a1dd82c969
commit 4c6d1582dc
2 changed files with 96 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
resource/table_info_security.conf
View File

@@ -47,8 +47,8 @@
35 TSG_SECURITY_ADDR composition {"source":"TSG_SECURITY_SOURCE_ADDR","destination":"TSG_SECURITY_DESTINATION_ADDR"}
36 TSG_IP_ASN_BUILT_IN ip_plugin {"row_id":1,"ip_type":2,"start_ip":3,"end_ip":4,"valid":7,"estimate_size":4194304}
37 TSG_IP_ASN_USER_DEFINED ip_plugin {"row_id":1,"ip_type":2,"start_ip":3,"end_ip":4,"valid":7,"estimate_size":4194304}
38 TSG_IP_LOCATION_BUILT_IN ip_plugin {"row_id":1,"ip_type":3,"start_ip":4,"end_ip":5,"valid":18,"estimate_size":4194304}
39 TSG_IP_LOCATION_USER_DEFINED ip_plugin {"row_id":1,"ip_type":3,"start_ip":4,"end_ip":5,"valid":18,"estimate_size":4194304}
38 TSG_IP_LOCATION_BUILT_IN ip_plugin {"row_id":1,"ip_type":3,"start_ip":4,"end_ip":5,"valid":19,"estimate_size":4194304}
39 TSG_IP_LOCATION_USER_DEFINED ip_plugin {"row_id":1,"ip_type":3,"start_ip":4,"end_ip":5,"valid":19,"estimate_size":4194304}
40 TSG_OBJ_AS_NUMBER expr UTF8 UTF8/GBK yes 0
41 TSG_SECURITY_SOURCE_ASN virtual TSG_OBJ_AS_NUMBER --
42 TSG_SECURITY_DESTINATION_ASN virtual TSG_OBJ_AS_NUMBER --

105
scan/src/policy_scan.cpp
View File

@@ -70,6 +70,7 @@ struct ip_data_table
char *country_full;
char *province_full;
char *city_full;
char *subdivision_addr;
pthread_mutex_t lock;
};
@@ -127,6 +128,9 @@ struct pangu_rt
int plolicy_table_id[POLICY_PROFILE_TABLE_MAX];
int scan_table_id[__SCAN_POLICY_MAX][__SECURITY_TABLE_MAX];
};
static int ip_location_column_num =0;
struct pangu_rt * g_pangu_rt;
#define MAAT_INPUT_JSON 0
@@ -250,6 +254,23 @@ void ip_asn_table_new_cb(int table_id, const char* key, const char* table_line,
*ad = ip_asn;
}
static int get_column_num(const char* line)
{
const char* seps=" \t";
char* saveptr=NULL, *subtoken=NULL, *str=NULL;
char* dup_line=strdup(line);
int i=0;
for (str = dup_line; ; str = NULL)
{
subtoken = strtok_r(str, seps, &saveptr);
if (subtoken == NULL)
break;
i++;
}
free(dup_line);
return i;
}
void ip_location_table_new_cb(int table_id, const char* key, const char* table_line, MAAT_PLUGIN_EX_DATA* ad, long argl, void* argp)
{
int ret=0,profile_id=0,is_valid=0;
@@ -259,28 +280,58 @@ void ip_location_table_new_cb(int table_id, const char* key, const char* table_l
char continent_abbr[VERIFY_ARRAY_MAX],continent_full[VERIFY_ARRAY_MAX];
char country_abbr[VERIFY_ARRAY_MAX],province_abbr[VERIFY_ARRAY_MAX], time_zone[VERIFY_ARRAY_MAX];
char country_full[VERIFY_ARRAY_MAX],province_full[VERIFY_ARRAY_MAX], city_full[VERIFY_ARRAY_MAX];
char subdivision_addr[VERIFY_ARRAY_MAX];
ret=sscanf(table_line, "%d\t%d\t%d\t%s\t%s\t%lf\t%lf\t%lf\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%d", &profile_id,&geoname_id,
if(ip_location_column_num == 0)
{
ip_location_column_num = get_column_num(table_line);
}
if(ip_location_column_num == 20)
{
ret=sscanf(table_line, "%d\t%d\t%d\t%s\t%s\t%lf\t%lf\t%lf\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%d", &profile_id,&geoname_id,
&addr_type, start_ip,end_ip,&latitude,&longitude,&coords,language,
continent_abbr,continent_full, country_abbr,country_full,province_abbr,province_full,
city_full,time_zone,&is_valid);
city_full, time_zone,&is_valid);
if(ret!=18)
{
mesa_runtime_log(RLOG_LV_FATAL, MODULE_NAME, "Policy table parse ip location failed, ret:%d, %s", ret, table_line);
return;
if(ret!=18)
{
mesa_runtime_log(RLOG_LV_FATAL, MODULE_NAME, "Policy table parse ip location failed, ret:%d, %s", ret, table_line);
return;
}
}
else
{
ret=sscanf(table_line, "%d\t%d\t%d\t%s\t%s\t%lf\t%lf\t%lf\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%d", &profile_id,&geoname_id,
&addr_type, start_ip,end_ip,&latitude,&longitude,&coords,language,
continent_abbr,continent_full, country_abbr,country_full,province_abbr,province_full,
city_full, subdivision_addr, time_zone,&is_valid);
if(ret!=19)
{
mesa_runtime_log(RLOG_LV_FATAL, MODULE_NAME, "Policy table parse ip location failed, ret:%d, %s", ret, table_line);
return;
}
}
verify_unescape(continent_full);
verify_unescape(country_full);
verify_unescape(province_full);
verify_unescape(city_full);
if(ip_location_column_num != 20)
{
verify_unescape(subdivision_addr);
}
struct ip_data_table* ip_asn=ALLOC(struct ip_data_table, 1);
memset(ip_asn, 0, sizeof(struct ip_data_table));
ip_asn->profile_id=profile_id;
ip_asn->country_full=strdup(country_full);
ip_asn->province_full=strdup(province_full);
ip_asn->city_full=strdup(city_full);
if(ip_location_column_num != 20)
{
ip_asn->subdivision_addr=strdup(subdivision_addr);
}
ip_asn->ref_cnt=1;
pthread_mutex_init(&(ip_asn->lock), NULL);
mesa_runtime_log(RLOG_LV_DEBUG, MODULE_NAME, "Policy table add success %d", profile_id);
@@ -319,6 +370,7 @@ void ip_table_free_cb(int table_id, MAAT_PLUGIN_EX_DATA* ad, long argl, void* ar
if(ip_asn->country_full) FREE(&ip_asn->country_full);
if(ip_asn->province_full) FREE(&ip_asn->province_full);
if(ip_asn->city_full) FREE(&ip_asn->city_full);
if(ip_asn->subdivision_addr) FREE(&ip_asn->subdivision_addr);
FREE(&ip_asn);
*ad=NULL;
@@ -841,12 +893,28 @@ int http_ip_location_scan(struct Maat_rule_t *result, struct ip_address *sip, st
if(ip_location_server!=NULL)
{
memset(buff,0,sizeof(buff));
snprintf(buff, sizeof(buff), "%s,%s,%s", ip_location_server->city_full, ip_location_server->province_full, ip_location_server->country_full);
if(ip_location_server->subdivision_addr == NULL)
{
snprintf(buff, sizeof(buff), "%s,%s,%s", ip_location_server->country_full, ip_location_server->province_full, ip_location_server->city_full);
}
else
{
snprintf(buff, sizeof(buff), "%s,%s,%s,%s", ip_location_server->country_full, ip_location_server->province_full, ip_location_server->city_full, ip_location_server->subdivision_addr);
}
ctx->ip_ctx.location_server=strdup(buff);
ip_location_table = (policy_type == PXY_TABLE_SECURITY) ? (int)PXY_SECURITY_IP_DST_LOCATION : (int)PXY_CTRL_IP_DST_LOCATION;
memset(buff,0,sizeof(buff));
snprintf(buff, sizeof(buff), "%s.%s.", ip_location_server->country_full, ip_location_server->city_full);
if(ip_location_server->subdivision_addr == NULL)
{
snprintf(buff, sizeof(buff), "%s.%s.", ip_location_server->country_full, ip_location_server->city_full);
}
else
{
snprintf(buff, sizeof(buff),"%s.%s.%s.%s.", ip_location_server->country_full,ip_location_server->province_full, ip_location_server->city_full, ip_location_server->subdivision_addr);
}
scan_ret = Maat_full_scan_string(g_pangu_rt->maat[policy_type], g_pangu_rt->scan_table_id[policy_type][ip_location_table],
CHARSET_GBK, buff, strlen(buff),
result+hit_cnt+hit_cnt_ip, NULL, MAX_SCAN_RESULT-hit_cnt-hit_cnt_ip,
@@ -860,13 +928,28 @@ int http_ip_location_scan(struct Maat_rule_t *result, struct ip_address *sip, st
if(ip_location_client!=NULL)
{
memset(buff,0,sizeof(buff));
snprintf(buff, sizeof(buff), "%s,%s,%s", ip_location_client->city_full, ip_location_client->province_full, ip_location_client->country_full);
if(ip_location_client->subdivision_addr == NULL)
{
snprintf(buff, sizeof(buff), "%s,%s,%s", ip_location_client->country_full, ip_location_client->province_full, ip_location_client->city_full);
}
else
{
snprintf(buff, sizeof(buff), "%s,%s,%s,%s", ip_location_client->country_full, ip_location_client->province_full, ip_location_client->city_full, ip_location_client->subdivision_addr);
}
ctx->ip_ctx.location_client=strdup(buff);
ip_location_table = (policy_type == PXY_TABLE_SECURITY) ? (int)PXY_SECURITY_IP_SRC_LOCATION : (int)PXY_CTRL_IP_SRC_LOCATION;
memset(buff,0,sizeof(buff));
snprintf(buff, sizeof(buff), "%s.%s.", ip_location_client->country_full, ip_location_client->city_full);
if(ip_location_client->subdivision_addr == NULL)
{
snprintf(buff, sizeof(buff), "%s.%s.", ip_location_client->country_full, ip_location_client->city_full);
}
else
{
snprintf(buff, sizeof(buff),"%s.%s.%s.%s.", ip_location_client->country_full,ip_location_client->province_full, ip_location_client->city_full, ip_location_client->subdivision_addr);
}
scan_ret = Maat_full_scan_string(g_pangu_rt->maat[policy_type], g_pangu_rt->scan_table_id[policy_type][ip_location_table],
CHARSET_GBK, buff, strlen(buff),
result+hit_cnt+hit_cnt_ip, NULL, MAX_SCAN_RESULT-hit_cnt-hit_cnt_ip,