TSG-21670 策略验证支持Library查询

common/include/verify_policy.h

@@ -160,14 +160,16 @@ struct verify_policy_query
 
 extern struct verify_policy * g_verify_proxy;
 
-void *policy_scan_ctx_new(unsigned int thread_id, int vsys_id, int compile_table_id);
-void policy_scan_ctx_free(void * pme);
-size_t policy_verify_scan(int vsys_id, int compile_table_id, struct request_query_obj *query_obj, void *pme);
-void http_get_scan_status(struct request_query_obj *query_obj, int type, cJSON *attributes, cJSON  *data_obj, void *pme);
 int maat_table_init(struct verify_policy * verify, const char* profile_path);
-int http_hit_policy_list(struct verify_policy_query *verify_policy, int num, size_t hit_cnt, cJSON *data_obj, void *pme);
-void verify_policy_tunnle_add(void * pme);
 int policy_verify_regex_expression(const char *expression);
+int get_ip_entry_tag_ids(cJSON *hit_library, int vsys_id, struct ipaddr *ip_addr);
+int get_fqdn_entry_tag_ids(cJSON *hit_library, int vsys_id, const char *fqdn);
+int http_hit_policy_list(struct verify_policy_query *verify_policy, int num, size_t hit_cnt, cJSON *data_obj, void *pme);
+size_t policy_verify_scan(int vsys_id, int compile_table_id, struct request_query_obj *query_obj, void *pme);
+void policy_scan_ctx_free(void * pme);
 void verify_reload_loglevel();
+void verify_policy_tunnle_add(void * pme);
+void http_get_scan_status(struct request_query_obj *query_obj, int type, cJSON *attributes, cJSON  *data_obj, void *pme);
+void *policy_scan_ctx_new(unsigned int thread_id, int vsys_id, int compile_table_id);
 
 #endif

platform/src/verify_matcher.cpp

@@ -64,6 +64,8 @@ enum verify_profile_table
 	PROFILE_TUNNEL_ENDPOINT,
 	PROFILE_TUNNEL_LABEL,
 	PROFILE_APP_DI_DICT,
+	PROFILE_FQDN_ENTRY,
+	PROFILE_IP_ADDR_ENTRY,
 	PROFILE_TABLE_MAX,
 };
 
@@ -160,7 +162,14 @@ struct app_id_dict
 	int ref_cnt;
 	int app_id;
 	long long int group_id;
+	pthread_mutex_t lock;
+};
 
+struct library_entry_ctx
+{
+	int ref_cnt;
+	int entry_id;
+	char *tag_ids;
 	pthread_mutex_t lock;
 };
 
@@ -523,7 +532,6 @@ void tunnel_label_table_new_cb(const char *table_name, int table_id, const char*
 	*ad = tunnel;
 }
 
-
 const char *table_name_map[] = {"TSG_OBJ_IP_ASN_USER_DEFINED",
 								"TSG_OBJ_IP_ASN_BUILT_IN",
 								"TSG_IP_LOCATION_USER_DEFINED",
@@ -533,7 +541,9 @@ const char *table_name_map[] = {"TSG_OBJ_IP_ASN_USER_DEFINED",
 								"TSG_TUNNEL_CATALOG",
 								"TSG_TUNNEL_ENDPOINT",
 								"TSG_TUNNEL_LABEL",
-								"APP_ID_DICT"};
+								"APP_ID_DICT",
+								"FQDN_ENTRY",
+								"IP_ADDR_ENTRY"};
 
 int maat_tunnel_table_init(int profile_idx,int vsys_id,
 					   	   maat_ex_free_func_t* free_func,
@@ -700,6 +710,76 @@ void app_dict_table_dup_cb(int table_id, void **to, void **from, long argl, void
 	return;
 }
 
+void library_search_new_cb(const char *table_name, int table_id, const char* key, const char* table_line, void **ad, long argl, void* argp)
+{
+	int ret=0;
+	size_t offset=0, len=0;
+	char *entry_id_str=NULL;
+	struct library_entry_ctx *entry_ctx=ALLOC(struct library_entry_ctx, 1);
+
+	ret = maat_helper_read_column(table_line, 1, &offset, &len);
+	if(ret >= 0)
+	{
+		entry_id_str=ALLOC(char, len+1);
+		memcpy(entry_id_str, table_line+offset, len);
+		entry_ctx->entry_id=atoi(entry_id_str);
+		FREE(&entry_id_str);
+	}
+
+	ret = maat_helper_read_column(table_line, 2, &offset, &len);
+	if(ret >= 0)
+	{
+		entry_ctx->tag_ids=ALLOC(char, len+1);
+		memcpy(entry_ctx->tag_ids, table_line+offset, len);
+	}
+
+	entry_ctx->ref_cnt=1;
+	pthread_mutex_init(&(entry_ctx->lock), NULL);
+	*ad=entry_ctx;
+	return;
+}
+
+void library_search_free_cb(int table_id, void **ad, long argl, void* argp)
+{
+	if(*ad==NULL)
+	{
+		return;
+	}
+
+	struct library_entry_ctx *entry_ctx=(struct library_entry_ctx *)(*ad);
+	pthread_mutex_lock(&(entry_ctx->lock));
+	entry_ctx->ref_cnt--;
+	if(entry_ctx->ref_cnt>0)
+	{
+		pthread_mutex_unlock(&(entry_ctx->lock));
+		return;
+	}
+	pthread_mutex_unlock(&(entry_ctx->lock));
+	pthread_mutex_destroy(&(entry_ctx->lock));
+
+	if(entry_ctx->tag_ids)
+	{
+		FREE(&entry_ctx->tag_ids);
+	}
+	FREE(&entry_ctx);
+	*ad=NULL;
+	return;
+}
+
+void library_search_free(struct library_entry_ctx *entry_ctx)
+{
+	library_search_free_cb(0, (void **)&entry_ctx, 0, NULL);
+}
+
+void library_search_dup_cb(int table_id, void **to, void **from, long argl, void* argp)
+{
+	struct library_entry_ctx *entry_ctx=(struct library_entry_ctx *)(*from);
+	pthread_mutex_lock(&(entry_ctx->lock));
+	entry_ctx->ref_cnt++;
+	pthread_mutex_unlock(&(entry_ctx->lock));
+	*to=entry_ctx;
+}
+
 int maat_ip_table_init(int profile_idx,int vsys_id,
 					   maat_ex_free_func_t* free_func,
 					   maat_ex_dup_func_t* dup_func)
@@ -1429,6 +1509,62 @@ static int get_group_id_by_location(const struct ip_data_table* ip_location, siz
     return 0;
 }
 
+int get_fqdn_entry_tag_ids(cJSON *hit_library, int vsys_id, const char *fqdn)
+{
+	int ret=0, hit_fqdn_entry=0;
+	cJSON *fqdn_entry_item=NULL;
+	struct library_entry_ctx *entry_ctx[8]={0};
+
+	if(fqdn == NULL)
+	{
+		return 0;
+	}
+	ret=maat_fqdn_plugin_table_get_ex_data(g_policy_rt->feather[vsys_id], g_policy_rt->profile_table_id[PROFILE_FQDN_ENTRY], fqdn, (void **)entry_ctx, 8);
+	for(int i=0; i <ret; i++)
+	{
+		if(i < 8)
+		{
+			fqdn_entry_item=cJSON_CreateObject();
+			cJSON_AddNumberToObject(fqdn_entry_item, "entry_id", entry_ctx[i]->entry_id);
+			cJSON_AddStringToObject(fqdn_entry_item, "tag_ids", entry_ctx[i]->tag_ids);
+			cJSON_AddItemToArray(hit_library, fqdn_entry_item);
+			hit_fqdn_entry++;
+		}
+		library_search_free(entry_ctx[i]);
+	}
+	return hit_fqdn_entry; 
+}
+
+int get_ip_entry_tag_ids(cJSON *hit_library, int vsys_id, struct ipaddr *ip_addr)
+{
+	int ret=0, hit_ip_entry=0;
+	cJSON *ip_entry_item=NULL;
+	struct ip_addr dest_ip, source_ip;
+	struct library_entry_ctx *entry_ctx[8]={0};
+
+	if(ip_addr == NULL)
+	{
+		return 0;
+	}
+
+	ip_addr_to_address(ip_addr, &dest_ip, &source_ip);
+	ret = maat_ip_plugin_table_get_ex_data(g_policy_rt->feather[vsys_id], g_policy_rt->profile_table_id[PROFILE_IP_ADDR_ENTRY], &source_ip, (void **)&entry_ctx, 8);
+	for(int i=0; i <ret; i++)
+	{
+		if(i < 8)
+		{
+			ip_entry_item=cJSON_CreateObject();
+			cJSON_AddNumberToObject(ip_entry_item, "entry_id", entry_ctx[i]->entry_id);
+			cJSON_AddStringToObject(ip_entry_item, "tag_ids", entry_ctx[i]->tag_ids);
+			cJSON_AddItemToArray(hit_library, ip_entry_item);
+			hit_ip_entry++;
+		}
+		library_search_free(entry_ctx[i]);
+	}
+	
+	return hit_ip_entry;
+}
+
 int ip_location_scan(struct policy_scan_ctx *ctx, int vsys_id, struct ip_addr *sip, struct ip_addr *dip, int hit_cnt)
 {
 	int scan_ret=0, hit_cnt_ip=0;
@@ -2612,6 +2748,15 @@ int maat_table_init(struct verify_policy * verify, const char* profile_path)
 		{
 			goto error_out;
 		}
+		
+		for(int i=PROFILE_FQDN_ENTRY; i <=PROFILE_IP_ADDR_ENTRY; i++)
+		{
+			ret = maat_plugin_table_ex_init(i, vsys_id, library_search_new_cb, library_search_free_cb, library_search_dup_cb);
+			if(ret<0)
+			{
+				goto error_out;
+			}
+		}
 	}
 	ret = 0;
 error_out:

platform/src/verify_policy.cpp

@@ -18,6 +18,7 @@
 
 #include <event2/listener.h>
 #include <event2/http.h>
+#include <event2/keyvalq_struct.h>
 #include <cjson/cJSON.h>
 #include <event2/buffer.h>
 
@@ -204,9 +205,15 @@ struct ipaddr *ip_to_stream_addr(const char *clientIp1, unsigned int clientPort1
 		v6_addr->dest=serverPort1;
 		ip_addr->v6=v6_addr;
 	}
-	log_info(g_verify_proxy->logger, MODULE_VERIFY_POLICY, " [I]   %s, clientIp1=%s, clientPort1=%d, serverIp=%s, serverPort=%d, addr_type=%d, protocol=%d", buff,
+	if(buff != NULL)
+	{
+		log_info(g_verify_proxy->logger, MODULE_VERIFY_POLICY, "[I] %s, clientIp1=%s, clientPort1=%d, serverIp=%s, serverPort=%d, addr_type=%d, protocol=%d", buff,
 				 clientIp1, clientPort1, serverIp1, serverPort1, addr_type, *protocol);
-
+	}
+	else
+	{
+		log_info(g_verify_proxy->logger, MODULE_VERIFY_POLICY, "[I] Ip=%s, Port=%d, addr_type=%d", clientIp1, clientPort1, addr_type);
+	}
 	return ip_addr;
 }
 
@@ -274,7 +281,7 @@ static struct ipaddr * get_ip_from_json(cJSON *attributeValue, const char *attri
 
 	if(strcasecmp(attributeName, "ip_protocol") == 0)
 	{
-		log_info(g_verify_proxy->logger, MODULE_VERIFY_POLICY, "  [I]   %s, protocol=%d", buff, *protocol);
+		log_info(g_verify_proxy->logger, MODULE_VERIFY_POLICY, "[I] %s, protocol=%d", buff, *protocol);
 		return NULL;
 	}
 
@@ -416,29 +423,29 @@ finish:
 	return xret;
 }
 
-enum verify_type get_verify_type(cJSON* data_json)
+enum verify_type get_verify_type(cJSON* http_respone)
 {
 	cJSON *item = NULL;
-	enum verify_type q_type = VERIFY_TYPE_POLICY;
+	enum verify_type type = VERIFY_TYPE_POLICY;
 
-	item = cJSON_GetObjectItem(data_json,"verifyType");
+	item = cJSON_GetObjectItem(http_respone,"verifyType");
 	if(item && item->type==cJSON_String)
 	{
 		if(0 == strcasecmp(item->valuestring, "policy"))
 		{
-			q_type = VERIFY_TYPE_POLICY;
+			type = VERIFY_TYPE_POLICY;
 		}
 
 		if(0 == strcasecmp(item->valuestring, "regex"))
 		{
-			q_type = VERIFY_TYPE_REGEX;
+			type = VERIFY_TYPE_REGEX;
 		}
-		log_info(g_verify_proxy->logger, MODULE_VERIFY_POLICY, " [I]   verifyType= %s", item->valuestring);
+		log_info(g_verify_proxy->logger, MODULE_VERIFY_POLICY, "[I] verifyType= %s", item->valuestring);
 	}
-	return q_type;
+	return type;
 }
 
-static int get_query_result_regex(cJSON *verifylist_array_item, cJSON *data_obj)
+static int get_query_result_regex(cJSON *verifylist_array_item, cJSON *http_body)
 {
 	int cur_id=0, i=0, is_valid[32]={0};
 	cJSON *regexstr_obj[32],*attributes=NULL;
@@ -464,7 +471,7 @@ static int get_query_result_regex(cJSON *verifylist_array_item, cJSON *data_obj)
 	cJSON *verify_regex_obj=NULL;
 
 	cJSON *verifyRegex=cJSON_CreateArray();
-	cJSON_AddItemToObject(data_obj, "verifyRegex", verifyRegex);
+	cJSON_AddItemToObject(http_body, "verifyRegex", verifyRegex);
 	for (i = 0; i < cur_id; i++)
 	{
 		verify_regex_obj=cJSON_CreateObject();
@@ -494,7 +501,7 @@ static void get_count_form_attributeName(void *ctx, cJSON *subchild)
 	return;
 }
 
-int get_query_result_policy(cJSON *subitem, cJSON *data_obj, int thread_id)
+int get_query_result_policy(cJSON *verifylist_array_item, cJSON *http_body, int thread_id)
 {
 	int i = 0;
 	int hit_cnt = 0, xret =0;
@@ -502,7 +509,7 @@ int get_query_result_policy(cJSON *subitem, cJSON *data_obj, int thread_id)
 	struct verify_policy_query *verify_policy = NULL;
 
 	verify_policy = ALLOC(struct verify_policy_query, 1);
-	item = cJSON_GetObjectItem(subitem,"type");
+	item = cJSON_GetObjectItem(verifylist_array_item,"type");
 	if(item && item->type==cJSON_String)
 	{
 		verify_policy->compile_table_id = tsg_policy_type_str2idx(item->valuestring);
@@ -513,14 +520,14 @@ int get_query_result_policy(cJSON *subitem, cJSON *data_obj, int thread_id)
 		}
 	}
 
-	item = cJSON_GetObjectItem(subitem, "vsysId");
+	item = cJSON_GetObjectItem(verifylist_array_item, "vsysId");
 	if(item && item->type==cJSON_Number)
 	{
 		verify_policy->vsys_id = item->valueint;
 	}
 	log_info(g_verify_proxy->logger, MODULE_VERIFY_POLICY, "[I] vsysId= %d", verify_policy->vsys_id);
 
-	item = cJSON_GetObjectItem(subitem,"verifySession");
+	item = cJSON_GetObjectItem(verifylist_array_item,"verifySession");
 	if(item == NULL || item->type!=cJSON_Object)
 	{
 		goto free;
@@ -550,16 +557,16 @@ int get_query_result_policy(cJSON *subitem, cJSON *data_obj, int thread_id)
 			}
 			i++;
 		}
-		http_hit_policy_list(verify_policy, i, hit_cnt, data_obj, ctx);
+		http_hit_policy_list(verify_policy, i, hit_cnt, http_body, ctx);
 
 		int item = 0;
 		cJSON *verfifySession = cJSON_CreateObject();
-		cJSON_AddItemToObject(data_obj, "verifySession", verfifySession);
+		cJSON_AddItemToObject(http_body, "verifySession", verfifySession);
 		cJSON *attributes=cJSON_CreateArray();
 		cJSON_AddItemToObject(verfifySession, "attributes", attributes);
 		for (item = 0; item < i; item++)
 		{
-			http_get_scan_status(&verify_policy->request_object[item], verify_policy->compile_table_id, attributes,data_obj, ctx);
+			http_get_scan_status(&verify_policy->request_object[item], verify_policy->compile_table_id, attributes, http_body, ctx);
 		}
 		policy_scan_ctx_free(ctx);
 	}
@@ -574,55 +581,169 @@ free:
 	return hit_cnt;
 }
 
-cJSON *get_query_from_request(const char *data, ssize_t data_len, int thread_id)
+cJSON *get_verify_policy_query(const char *data, ssize_t data_len, int thread_id)
 {
 	int hit_cnt = 0;
 
-	cJSON* data_json = cJSON_Parse(data);
+	cJSON* http_request = cJSON_Parse(data);
-	if(data_json == NULL)
+	if(http_request == NULL)
 	{
 		log_fatal(g_verify_proxy->logger, MODULE_VERIFY_POLICY, "Failed to parse the request data.");
 		return NULL;
 	}
-	cJSON  *policy_obj=NULL, *data_obj=NULL;
+	cJSON  *http_respone=NULL, *http_body=NULL;
-	policy_obj=cJSON_CreateObject();
+	http_respone=cJSON_CreateObject();
 
-	cJSON_AddNumberToObject(policy_obj, "code", 200);
+	cJSON_AddNumberToObject(http_respone, "code", 200);
-	cJSON_AddStringToObject(policy_obj, "msg", "Success");
+	cJSON_AddStringToObject(http_respone, "msg", "Success");
 
-	data_obj = cJSON_CreateObject();
+	http_body = cJSON_CreateObject();
-	cJSON_AddItemToObject(policy_obj, "data", data_obj);
+	cJSON_AddItemToObject(http_respone, "data", http_body);
 
-	int verify_type=get_verify_type(data_json);
+	int type=get_verify_type(http_request);
 	cJSON *item = NULL, *subitem = NULL;
 
-	item = cJSON_GetObjectItem(data_json,"verifyList");
+	item = cJSON_GetObjectItem(http_request,"verifyList");
 	if(item && item->type==cJSON_Array)
 	{
 		for (subitem = item->child; subitem != NULL; subitem = subitem->next)
 		{
-			if(verify_type == VERIFY_TYPE_REGEX)
+			if(type == VERIFY_TYPE_REGEX)
 			{
-				log_info(g_verify_proxy->logger, MODULE_VERIFY_POLICY, " [I]   data= %.*s", (int)data_len, data);
+				log_info(g_verify_proxy->logger, MODULE_VERIFY_POLICY, "[I] data= %.*s", (int)data_len, data);
-				hit_cnt = get_query_result_regex(subitem, data_obj);
+				hit_cnt = get_query_result_regex(subitem, http_body);
 			}
 
-			if(verify_type == VERIFY_TYPE_POLICY)
+			if(type == VERIFY_TYPE_POLICY)
 			{
-				hit_cnt = get_query_result_policy(subitem, data_obj, thread_id);
+				hit_cnt = get_query_result_policy(subitem, http_body, thread_id);
 			}
 		}
 		if (hit_cnt >= 0)
 		{
-			cJSON_AddBoolToObject(policy_obj, "success", true);
+			cJSON_AddBoolToObject(http_respone, "success", true);
 		}
 		else
 		{
-			cJSON_AddBoolToObject(policy_obj, "success", false);
+			cJSON_AddBoolToObject(http_respone, "success", false);
 		}
 	}
-	cJSON_Delete(data_json);
+	cJSON_Delete(http_request);
-	return policy_obj;
+	return http_respone;
+}
+
+int http_get_headers(struct evhttp_request *evh_req, struct evkeyvalq *headers)
+{
+	int xret = -1;
+
+	const char *uri = evhttp_request_get_uri(evh_req);
+	if(!uri)
+	{
+		return xret;
+	}
+	return evhttp_parse_query(uri, headers);
+}
+
+int http_get_int_param(struct evhttp_request *evh_req, const char *key)
+{
+	int xret=-1;
+	struct evkeyvalq headers;
+	
+	xret = http_get_headers(evh_req, &headers);
+	if(xret != 0)
+	{
+		return -1;
+	}
+	const char *value = evhttp_find_header(&headers, key);
+	if (value)
+	{
+		xret = atoi(value);
+	}
+	evhttp_clear_headers(&headers);
+	return xret;
+}
+
+char *http_get_string_param(struct evhttp_request *evh_req, const char *key)
+{
+	int xret=-1;
+	char *param=NULL;
+	struct evkeyvalq headers;
+
+	xret = http_get_headers(evh_req, &headers);
+	if(xret != 0)
+	{
+		return NULL;
+	}
+	const char *value = evhttp_find_header(&headers, key);
+	if (value)
+	{
+		param = strdup(value);
+	}
+	evhttp_clear_headers(&headers);
+	return param;
+}
+
+int get_ip_type(const char *ip)
+{
+    struct sockaddr_in sa;
+    struct sockaddr_in6 sa6;
+    int addr_type = 0;
+
+    if (inet_pton(AF_INET, ip, &(sa.sin_addr)) > 0)
+	{
+        addr_type = 4;
+    } 
+	else if (inet_pton(AF_INET6, ip, &(sa6.sin6_addr)) > 0) 
+	{
+        addr_type = 6;
+    }
+    return addr_type;
+}
+
+cJSON *get_library_search_query(struct evhttp_request *evh_req)
+{
+	int hit_library_cnt=0;
+	cJSON *http_respone=cJSON_CreateObject();
+	cJSON_AddNumberToObject(http_respone, "code", 200);
+	cJSON_AddStringToObject(http_respone, "msg", "Success");
+
+	cJSON *http_body = cJSON_CreateObject();
+	cJSON_AddItemToObject(http_respone, "data", http_body);
+
+	cJSON *hit_library=cJSON_CreateArray();
+	cJSON_AddItemToObject(http_body, "hit_library", hit_library);
+
+	int vsys_id = http_get_int_param(evh_req, "vsys_id");
+	if(vsys_id < 0)
+	{
+		return NULL;
+	}
+
+	char *ip = http_get_string_param(evh_req, "ip");
+	if(ip) 
+	{
+		struct ipaddr *ip_addr = ip_to_stream_addr(ip, 0, "0.0.0.0", 0, get_ip_type(ip), NULL, 0);
+		hit_library_cnt=get_ip_entry_tag_ids(hit_library, vsys_id, ip_addr);
+		FREE(&ip);
+		ipaddr_free(ip_addr);
+	}
+	
+	char *fqdn = http_get_string_param(evh_req, "fqdn");
+	if(fqdn)
+	{
+		hit_library_cnt=get_fqdn_entry_tag_ids(hit_library, vsys_id, fqdn);
+		FREE(&fqdn);
+	}
+
+	if (hit_library_cnt > 0)
+	{
+		cJSON_AddBoolToObject(http_body, "success", true);
+	}
+	else
+	{
+		cJSON_AddBoolToObject(http_body, "success", false);
+	}
+	return http_respone;
 }
 
 static int evhttp_socket_send(struct evhttp_request *req, char *sendbuf)
@@ -649,9 +770,9 @@ done:
     return 0;
 }
 
-void evhttp_request_cb(struct evhttp_request *evh_req, void *arg)
+void verify_policy_request_cb(struct evhttp_request *evh_req, void *arg)
 {
-	char *policy_payload= NULL; cJSON  *policy_obj;
+	char *http_payload_string= NULL; cJSON  *http_payload=NULL;
 	struct evbuffer * evbuf_body = NULL;
 	char *input = NULL; ssize_t inputlen=0;
 
@@ -662,6 +783,8 @@ void evhttp_request_cb(struct evhttp_request *evh_req, void *arg)
 		log_fatal(g_verify_proxy->logger, MODULE_VERIFY_POLICY, "FAILED (post type)");
 		goto error;
 	}
+	log_info(g_verify_proxy->logger, MODULE_VERIFY_POLICY, "[I] Request policy verify: %s", evhttp_request_get_uri(evh_req));
+
 	evbuf_body = evhttp_request_get_input_buffer(evh_req);
 	if (!evbuf_body || 0==(inputlen = evbuffer_get_length(evbuf_body)) ||!(input = (char *)evbuffer_pullup(evbuf_body,inputlen)))
 	{
@@ -669,18 +792,49 @@ void evhttp_request_cb(struct evhttp_request *evh_req, void *arg)
 		goto error;
 	}
 
- 	policy_obj = get_query_from_request(input, inputlen, thread_ctx->id);
+ 	http_payload = get_verify_policy_query(input, inputlen, thread_ctx->id);
-	if(policy_obj == NULL)
+	if(http_payload == NULL)
 	{
 		goto error;
 	}
 
-	policy_payload = cJSON_PrintUnformatted(policy_obj);
+	http_payload_string = cJSON_PrintUnformatted(http_payload);
-	log_info(g_verify_proxy->logger, MODULE_VERIFY_POLICY, "[O]   %s", policy_payload);
+	log_info(g_verify_proxy->logger, MODULE_VERIFY_POLICY, "[O] %s", http_payload_string);
-	evhttp_socket_send(evh_req, policy_payload);
+	evhttp_socket_send(evh_req, http_payload_string);
 
-	cJSON_Delete(policy_obj);
+	cJSON_Delete(http_payload);
-	free(policy_payload);
+	free(http_payload_string);
+
+	goto finish;
+
+error:
+	evhttp_send_error(evh_req, HTTP_BADREQUEST, 0);
+finish:
+	return;
+}
+
+void library_search_request_cb(struct evhttp_request *evh_req, void *arg)
+{
+	char *http_payload_string= NULL; cJSON  *http_payload=NULL;
+
+	if (evhttp_request_get_command(evh_req) != EVHTTP_REQ_POST)
+	{
+		log_fatal(g_verify_proxy->logger, MODULE_VERIFY_POLICY, "FAILED (post type)");
+		goto error;
+	}
+	log_info(g_verify_proxy->logger, MODULE_VERIFY_POLICY, "[I] Request library search: %s", evhttp_request_get_uri(evh_req));
+
+	http_payload = get_library_search_query(evh_req);
+	if(http_payload == NULL)
+	{
+		goto error;
+	}
+	http_payload_string = cJSON_PrintUnformatted(http_payload);
+	log_info(g_verify_proxy->logger, MODULE_VERIFY_POLICY, "[O] %s", http_payload_string);
+	evhttp_socket_send(evh_req, http_payload_string);
+
+	cJSON_Delete(http_payload);
+	free(http_payload_string);
 
 	goto finish;
 
@@ -708,13 +862,13 @@ void * verify_policy_thread_func(void * arg)
 		goto error;
 	}
 
-	evhttp_set_cb(thread_ctx->http, "/v1/policy/verify", evhttp_request_cb, thread_ctx);
+	evhttp_set_cb(thread_ctx->http, "/v1/policy/trouble_shooting/policy_verification", verify_policy_request_cb, thread_ctx);
+	evhttp_set_cb(thread_ctx->http, "/v1/policy/trouble_shooting/library_search", library_search_request_cb, thread_ctx);
 
 	bound = evhttp_accept_socket_with_handle(thread_ctx->http, thread_ctx->accept_fd);
-	if (bound != NULL)
+	if (bound == NULL)
 	{
-		log_info(g_verify_proxy->logger, MODULE_VERIFY_POLICY, "Bound(%p) to port %d - Awaiting connections ... ", bound,
+		goto error;
-						g_verify_proxy->listen_port);
 	}
 	log_fatal(g_verify_proxy->logger, MODULE_VERIFY_POLICY, "Work thread %u is run...", thread_ctx->id);
 

resource/table_info.conf

@@ -1195,5 +1195,29 @@
         "table_name":"ATTR_TUNNEL_IP_IN_IP_ENDPOINT",
         "table_type":"virtual",
         "physical_table": "TSG_OBJ_IP"
+    },
+    {
+        "table_id":125,
+        "table_name":"FQDN_ENTRY",
+        "table_type":"fqdn_plugin",
+        "valid_column":5,
+        "custom": {
+            "item_id":1,
+            "suffix_match_method":4,
+            "fqdn":3
+        }
+    },
+    {
+        "table_id":126,
+        "table_name":"IP_ADDR_ENTRY",
+        "table_type":"ip_plugin",
+		"valid_column":8,
+        "custom": {
+            "item_id":1,
+            "ip_type":3,
+            "start_ip":5,
+            "end_ip":6,
+			"addr_format":4
+        }
     }
 ]

resource/table_info_simple.conf

@@ -1119,5 +1119,29 @@
         "table_name":"ATTR_TUNNEL_IP_IN_IP_ENDPOINT",
         "table_type":"virtual",
         "physical_table": "TSG_OBJ_IP"
+    },
+    {
+        "table_id":125,
+        "table_name":"FQDN_ENTRY",
+        "table_type":"fqdn_plugin",
+        "valid_column":5,
+        "custom": {
+            "item_id":1,
+            "suffix_match_method":4,
+            "fqdn":3
+        }
+    },
+    {
+        "table_id":126,
+        "table_name":"IP_ADDR_ENTRY",
+        "table_type":"ip_plugin",
+		"valid_column":8,
+        "custom": {
+            "item_id":1,
+            "ip_type":3,
+            "start_ip":5,
+            "end_ip":6,
+			"addr_format":4
+        }
     }
 ]

resource/verify-policy.json

@@ -45,8 +45,8 @@
                     "virtual_table": "ATTR_SOURCE_IP",
                     "regions": [
                         {
-                            "table_type": "ip_plus",
+                            "table_type": "ip",
-                            "table_name": "TSG_OBJ_IP_ADDR",
+                            "table_name": "TSG_IP_ADDR",
                             "table_content": {
                                 "addr_type": "ipv4",
                                 "addr_format": "range",
@@ -322,6 +322,20 @@
                 "0\t3\t126.com\t1\t701\t1",
                 "1\t4\tbaidu.com\t1\t702\t1"
             ]
+        },
+	    {
+            "table_name": "FQDN_ENTRY",
+            "table_content": [
+                "1\t2,4,5\twww.126.com\t1\t1",
+                "2\t6,7,8\twww.baidu.com\t1\t1"
+            ]
+        },
+        {
+            "table_name": "IP_ADDR_ENTRY",
+            "table_content": [
+                "1\t2,4,5\t4\tsingle\t192.168.55.4\t192.168.55.4\t0\t1",
+                "1\t2,4,5\t4\tsingle\t192.168.55.4\t192.168.55.4\t0\t1"
+            ]
         }
     ]
 }