gfwleak/tango-verify-policy
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

日志接口支持按文件大小存储日志，并对 table_name 表的结构体进行了优化

Browse Source
This commit is contained in:
fengweihao
2024-08-14 17:57:30 +08:00
parent 1b76ae68fb
commit 6dc39cc922
10 changed files with 523 additions and 292 deletions
Download Patch File Download Diff File Expand all files Collapse all files

50
test/resource/HitPolicyRequest.json
View File

@@ -152,6 +152,56 @@
}
],
"verify_type": "policy"
},
{
"__item_id": 5,
"vsys_id": 1,
"verify_list": [
{
"type": "pxy_manipulation",
"vsys_id": 1,
"verify_session": {
"attributes": [
{
"attribute_type": "ip",
"table_name": "ATTR_SOURCE_IP",
"attribute_name": "source",
"attribute_value": {
"ip": "192.168.0.2",
"port":"8080",
"addr_type": 4
}
},
{
"attribute_type": "ip",
"table_name": "ATTR_DESTINATION_IP",
"attribute_name": "destination",
"attribute_value": {
"ip": "192.168.0.3",
"addr_type": 4
}
},
{
"attribute_type": "string",
"table_name": "ATTR_SERVER_FQDN",
"attribute_name": "server_fqdn",
"attribute_value": {
"string": "www.baidu.com"
}
},
{
"attribute_type": "string",
"table_name": "ATTR_SSL_SAN",
"attribute_name": "ssl_san",
"attribute_value": {
"string": "www.baidu.com"
}
}
]
}
}
],
"verify_type": "policy"
}
]
}

158
test/resource/HitPolicyResult.json
View File

@@ -191,6 +191,164 @@
}
},
"success": true
},
{
"code": 200,
"msg": "Success",
"data": {
"hitPolicyList": [
{
"id": 1024,
"policyName": "",
"is_execute_policy": true,
"top_object_list": [
{
"object_id": 10231,
"table_name": "ATTR_SOURCE_IP",
"not_flag": 0,
"nth_clause": 0
},
{
"object_id": 10232,
"table_name": "ATTR_DESTINATION_IP",
"not_flag": 0,
"nth_clause": 1
},
{
"object_id": 10234,
"table_name": "ATTR_SERVER_FQDN",
"not_flag": 0,
"nth_clause": 2
},
{
"object_id": 10235,
"table_name": "ATTR_SSL_SAN",
"not_flag": 0,
"nth_clause": 3
}
]
},
{
"id": 1023,
"policyName": "",
"is_execute_policy": false,
"top_object_list": [
{
"object_id": 10231,
"table_name": "ATTR_SOURCE_IP",
"not_flag": 0,
"nth_clause": 0
},
{
"object_id": 10232,
"table_name": "ATTR_DESTINATION_IP",
"not_flag": 0,
"nth_clause": 1
},
{
"object_id": 10234,
"table_name": "ATTR_SERVER_FQDN",
"not_flag": 0,
"nth_clause": 2
},
{
"object_id": 10235,
"table_name": "ATTR_SSL_SAN",
"not_flag": 0,
"nth_clause": 3
}
]
}
],
"verify_session": {
"attributes": [
{
"attribute_type": "ip",
"table_name": "ATTR_SOURCE_IP",
"attribute_name": "source",
"attribute_value": {
"ip": "192.168.0.2",
"port": "8080",
"addr_type": 4
},
"hit_paths": [
{
"item_id": 2,
"superior_object_id": 10231
}
]
},
{
"attribute_type": "ip",
"table_name": "ATTR_DESTINATION_IP",
"attribute_name": "destination",
"attribute_value": {
"ip": "192.168.0.3",
"addr_type": 4
},
"hit_paths": [
{
"item_id": 3,
"superior_object_id": 10232
}
]
},
{
"attribute_type": "string",
"table_name": "ATTR_SERVER_FQDN",
"attribute_name": "server_fqdn",
"attribute_value": {
"string": "www.baidu.com"
},
"hit_paths": [
{
"entry_id": 2,
"tag_id": 2
},
{
"entry_id": 2,
"tag_id": 3
},
{
"item_id": 5,
"superior_object_id": 10235
},
{
"item_id": 4,
"superior_object_id": 10234
}
]
},
{
"attribute_type": "string",
"table_name": "ATTR_SSL_SAN",
"attribute_name": "ssl_san",
"attribute_value": {
"string": "www.baidu.com"
},
"hit_paths": [
{
"entry_id": 2,
"tag_id": 2
},
{
"entry_id": 2,
"tag_id": 3
},
{
"item_id": 5,
"superior_object_id": 10235
},
{
"item_id": 4,
"superior_object_id": 10234
}
]
}
]
}
},
"success": true
}
]
}

101
test/resource/VerifyPolicyHit.json
View File

@@ -1,101 +0,0 @@
{
"compile_table": "PXY_CTRL_COMPILE",
"group2compile_table": "GROUP_PXY_CTRL_COMPILE_RELATION",
"group2group_table": "GROUP_GROUP_RELATION",
"rules": [
{
"compile_id": 1021,
"service": 1,
"action": 48,
"do_blacklist": 1,
"do_log": 1,
"effective_range": 0,
"tags":"anything",
"user_region": "anything",
"is_valid": "yes",
"groups": [
{
"not_flag": 0,
"group_id": 101,
"group_name":"IPv4TCPSoureVeiryPolicy01",
"virtual_table": "ATTR_SOURCE_IP",
"regions": [
{
"table_type": "ip",
"table_name": "TSG_OBJ_IP_ADDR",
"table_content": {
"addr_type": "ipv4",
"addr_format": "range",
"ip1": "192.168.0.1",
"ip2": "192.168.0.1"
}
}
]
}
]
},
{
"compile_id": 1022,
"service": 1,
"action": 48,
"do_blacklist": 1,
"do_log": 1,
"effective_range": 0,
"tags":"anything",
"user_region": "anything",
"is_valid": "yes",
"groups": [
{
"group_id": 11,
"group_name": "IPv4TCPSoureEntry.11",
"virtual_table": "ATTR_SOURCE_IP"
},
{
"group_id": 12,
"group_name": "IPv4TCPSoureEntry.12",
"virtual_table": "ATTR_INTERNAL_IP"
},
{
"group_id": 1,
"group_name": "FQDNEntry.1",
"virtual_table": "ATTR_SERVER_FQDN"
}
]
}
],
"plugin_table": [
{
"table_name": "FQDN_ENTRY",
"table_content": [
"1\t1\twww.126.com\t1\t1",
"2\t2,3\twww.baidu.com\t1\t1",
"4\t4,5,6\twww.qq.com\t1\t1"
]
},
{
"table_name": "IP_ADDR_ENTRY",
"table_content": [
"1\t11\t4\tsingle\t192.168.1.1\t192.168.1.1\t1",
"2\t12,13\t4\tsingle\t192.168.1.2\t192.168.1.2\t1",
"4\t14,15,16\t4\trange\t192.168.1.3\t192.168.1.3\t1"
]
},
{
"table_name": "LIBRARY_TAG",
"table_content": [
"1\tnone\twebsite_category\tfqdn1\tsearch\\bengines\t1",
"2\tnone\twebsite_category\tfqdn2\tRecreation\band\bHobbies\t1",
"3\tnone\twebsite_category\tfqdn3\tbusiness\t1",
"4\tnone\twebsite_category\tfqdn4\tsearch bengines\t1",
"5\tnone\twebsite_category\tfqdn5\tsearch\\bengines\t1",
"6\tnone\twebsite_category\tfqdn6\tsearch\\bengines\t1",
"11\tnone\tgeoip\tadministrative_area\tColombia.Departamento\bdel\bVaupes\t1",
"12\tnone\tgeoip\tadministrative_area\tColombia.Departamento\bdel\bVaupes.Mitú\t1",
"13\tnone\tgeoip\tadministrative_area\tColombia.Antioquia.Marinilla\t1",
"14\tnone\tgeoip\tsuper_administrative_area\tColombia.Departamento\bdel\bVaupes\t1",
"15\tnone\tgeoip\tadministrative_area\tGermany.Bavaria.Mauern\t1",
"16\tnone\tgeoip\tadministrative_area\tGermany.Bavaria.Mellrichstadt\t1"
]
}
]
}

114
test/resource/VerifyPolicyManipulation.json
View File

@@ -61,6 +61,120 @@
"virtual_table": "ATTR_SERVER_FQDN"
}
]
},
{
"compile_id": 1023,
"service": 1,
"action": 48,
"do_blacklist": 1,
"do_log": 1,
"effective_range": 0,
"tags":"anything",
"user_region": "anything",
"is_valid": "yes",
"groups": [
{
"not_flag": 0,
"group_id": 10231,
"group_name":"IPv4TCPSoureVeiryPolicy02",
"virtual_table": "ATTR_SOURCE_IP",
"regions": [
{
"table_type": "ip",
"table_name": "TSG_OBJ_IP_ADDR",
"table_content": {
"addr_type": "ipv4",
"addr_format": "range",
"ip1": "192.168.0.2",
"ip2": "192.168.0.2"
}
}
]
},
{
"not_flag": 0,
"group_id": 10232,
"group_name":"IPv4TCPDestinationVeiryPolicy01",
"virtual_table": "ATTR_DESTINATION_IP",
"regions": [
{
"table_type": "ip",
"table_name": "TSG_OBJ_IP_ADDR",
"table_content": {
"addr_type": "ipv4",
"addr_format": "range",
"ip1": "192.168.0.3",
"ip2": "192.168.0.3"
}
}
]
},
{
"virtual_table":"ATTR_SERVER_FQDN",
"group_name":"ServerFqdnVeiryPolicy01",
"group_id":10234,
"not_flag":0,
"regions": [
{
"table_name": "TSG_OBJ_FQDN",
"table_type": "expr",
"table_content": {
"keywords": "baidu.com",
"expr_type": "regex",
"match_method": "sub",
"format": "uncase plain"
}
}
]
},
{
"virtual_table":"ATTR_SSL_SAN",
"group_name":"SslSanVeiryPolicy01",
"group_id":10235,
"not_flag":0,
"regions": [
{
"table_name": "TSG_OBJ_FQDN",
"table_type": "expr",
"table_content": {
"keywords": "baidu.com",
"expr_type": "regex",
"match_method": "sub",
"format": "uncase plain"
}
}
]
}
]
},
{
"compile_id": 1024,
"service": 1,
"action": 48,
"do_blacklist": 1,
"do_log": 1,
"effective_range": 0,
"tags":"anything",
"user_region": "anything",
"is_valid": "yes",
"groups": [
{
"group_name":"IPv4TCPSoureVeiryPolicy02",
"virtual_table":"ATTR_SOURCE_IP"
},
{
"group_name":"IPv4TCPDestinationVeiryPolicy01",
"virtual_table":"ATTR_DESTINATION_IP"
},
{
"group_name":"ServerFqdnVeiryPolicy01",
"virtual_table":"ATTR_SERVER_FQDN"
},
{
"group_name":"SslSanVeiryPolicy01",
"virtual_table":"ATTR_SSL_SAN"
}
]
}
],
"plugin_table": [

30
test/verify_policy_test.cpp
View File

@@ -90,7 +90,7 @@ static char *select_hit_policy_request_item(int gtest_id)
TEST(LibrarySearch, HitFqdnEntry)
{
const char *hit_policy_request = "{\"ip\":null,\"fqdn\":\"www.126.com\",\"vsys_id\":1}";
const char *hit_policy_result="{\"code\":200,\"msg\":\"Success\",\"data\":{\"hit_library\":[{\"tag_ids\":\"1\"}]},\"success\":true}";
const char *hit_policy_result="{\"code\":200,\"msg\":\"Success\",\"data\":{\"hit_library\":[{\"entry_id\":1,\"tag_ids\":\"1\"}]},\"success\":true}";
cJSON *result_json = get_library_search_query(hit_policy_request, strlen(hit_policy_request));
ASSERT_TRUE(result_json != NULL);
@@ -105,7 +105,7 @@ TEST(LibrarySearch, HitFqdnEntry)
FREE(&hit_policy_list);
hit_policy_request = "{\"ip\":null,\"fqdn\":\"www.baidu.com\",\"vsys_id\":1}";
hit_policy_result="{\"code\":200,\"msg\":\"Success\",\"data\":{\"hit_library\":[{\"tag_ids\":\"2,3\"}]},\"success\":true}";
hit_policy_result="{\"code\":200,\"msg\":\"Success\",\"data\":{\"hit_library\":[{\"entry_id\":2,\"tag_ids\":\"2,3\"}]},\"success\":true}";
result_json = get_library_search_query(hit_policy_request, strlen(hit_policy_request));
ASSERT_TRUE(result_json != NULL);
@@ -120,7 +120,7 @@ TEST(LibrarySearch, HitFqdnEntry)
FREE(&hit_policy_list);
hit_policy_request = "{\"ip\":null,\"fqdn\":\"www.qq.com\",\"vsys_id\":1}";
hit_policy_result="{\"code\":200,\"msg\":\"Success\",\"data\":{\"hit_library\":[{\"tag_ids\":\"4,5,6\"}]},\"success\":true}";
hit_policy_result="{\"code\":200,\"msg\":\"Success\",\"data\":{\"hit_library\":[{\"entry_id\":4,\"tag_ids\":\"4,5,6\"}]},\"success\":true}";
result_json = get_library_search_query(hit_policy_request, strlen(hit_policy_request));
ASSERT_TRUE(result_json != NULL);
@@ -231,7 +231,6 @@ TEST(VerifyPolicy, CheckRegexExpression)
cJSON_Delete(result_json);
FREE(&hit_policy_query);
}
TEST(VerifyPolicy, HitIpPolicy)
@@ -278,6 +277,28 @@ TEST(VerifyPolicy, HitLibraryPolicy)
FREE(&hit_policy_result);
}
TEST(VerifyPolicy, HitMultiplePolicy)
{
char *hit_policy_request = select_hit_policy_request_item(5);
ASSERT_TRUE(hit_policy_request != NULL);
char *hit_policy_result = select_hit_policy_result_item(5);
ASSERT_TRUE(hit_policy_result != NULL);
cJSON *result_json = get_verify_policy_query(hit_policy_request, strlen(hit_policy_request), 1);
ASSERT_TRUE(result_json != NULL);
char *hit_policy_query = cJSON_PrintUnformatted(result_json);
ASSERT_TRUE(hit_policy_query != NULL);
int equal = strncasecmp(hit_policy_query, hit_policy_result, strlen(hit_policy_result));
EXPECT_EQ(equal, 0);
cJSON_Delete(result_json);
FREE(&hit_policy_query);
FREE(&hit_policy_request);
FREE(&hit_policy_result);
}
static void reload_maat_config(const char * main_profile)
{
verify_policy_table_free(main_profile);
@@ -343,7 +364,6 @@ TEST(VerifyPolicy, HitTunnelEndpointPolicy)
char *hit_policy_query = cJSON_PrintUnformatted(result_json);
ASSERT_TRUE(hit_policy_query != NULL);
printf("hit_policy_query =%s\n", hit_policy_query);
int equal = strncasecmp(hit_policy_query, hit_policy_result, strlen(hit_policy_result));
EXPECT_EQ(equal, 0);