bugfix: TSG-7930 策略验证增加拦截排除对象扫描

common/include/verify_policy.h

@@ -84,6 +84,7 @@ enum security_scan_table
     PXY_SECURITY_IMSI,
     PXY_SECURITY_PHONE_NUMBER,
     PXY_SECURITY_APN,
+    PXY_SECURITY_EXCLUSION_SSL_SNI,
     PXY_SECURITY_IP_SRC_ASN,
     PXY_SECURITY_IP_DST_ASN,
     PXY_SECURITY_IP_SRC_LOCATION,
@@ -110,7 +111,7 @@ enum http_ev_bit_number
 	SUBSCRIBE_ID
 };
 
-enum tfe_http_event
+enum policy_http_event
 {
 	EV_HTTP_IP = 1ULL << IP_BITNUM,
 	EV_HTTP_URL = 1ULL << URL_BITNUM,

platform/src/verify_policy.cpp

@@ -143,7 +143,8 @@ int protoco_field_type_str2idx(enum verify_policy_type type, const char *action_
 			table_name[PXY_SECURITY_IMSI]="TSG_FILED_GTP_IMSI";
 			table_name[PXY_SECURITY_PHONE_NUMBER]="TSG_FILED_GTP_PHONE_NUMBER";
 			table_name[PXY_SECURITY_APN]="TSG_FILED_GTP_APN";
-			scan_table_max = PXY_SECURITY_APN;
+			table_name[PXY_SECURITY_EXCLUSION_SSL_SNI]="TSG_DECYPTION_EXCLUSION_SSL_SNI";
+			scan_table_max = PXY_SECURITY_EXCLUSION_SSL_SNI;
 			break;
 		case PXY_TABLE_WANNAT:
 			table_name[PXY_WANNAT_SOURCE_ADDR]="TSG_SECURITY_SOURCE_ADDR";

resource/table_info_proxy.conf

@@ -28,9 +28,9 @@
 9	TSG_OBJ_HTTP_SIGNATURE  expr_plus       UTF8    UTF8    yes     0       quickoff
 10	TSG_FIELD_HTTP_REQ_HDR  virtual TSG_OBJ_HTTP_SIGNATURE  --
 11	TSG_FIELD_HTTP_RES_HDR  virtual TSG_OBJ_HTTP_SIGNATURE  --
-12	TSG_OBJ_KEYWORDS expr   UTF8    GBK/UNICODE/UTF8/windows-1251        yes     128     quickoff
+12	TSG_OBJ_KEYWORDS expr   UTF8	GBK/BIG5/UNICODE/UTF8/unicode_ascii_esc/unicode_ascii_aligned/unicode_ncr_dec/unicode_ncr_hex/windows-1251	yes     128     quickoff
-13	TSG_FIELD_HTTP_REQ_BODY		virtual TSG_OBJ_KEYWORDS --
+13	TSG_FIELD_HTTP_REQ_BODY	virtual TSG_OBJ_KEYWORDS --
-14	TSG_FIELD_HTTP_RES_BODY		virtual TSG_OBJ_KEYWORDS --
+14	TSG_FIELD_HTTP_RES_BODY	virtual TSG_OBJ_KEYWORDS --
 15	TSG_OBJ_SUBSCRIBER_ID   expr    UTF8    UTF8    yes     0       quickon
 16	TSG_OBJ_APP_ID	intval	UTF8	UTF8	yes	0
 17	TSG_SECURITY_SOURCE_ADDR	virtual	TSG_OBJ_IP_ADDR	--

resource/table_info_security.conf

@@ -65,3 +65,4 @@
 53	TSG_FILED_GTP_IMSI	virtual	TSG_OBJ_IMSI	--
 54	TSG_FILED_GTP_PHONE_NUMBER	virtual	TSG_OBJ_PHONE_NUMBER	--
 55	TSG_FILED_GTP_APN	virtual	TSG_OBJ_APN	--
+56	TSG_DECYPTION_EXCLUSION_SSL_SNI	virtual	["TSG_OBJ_FQDN","TSG_OBJ_FQDN_CAT"]	--

scan/src/policy_scan.cpp

@@ -113,6 +113,7 @@ struct pangu_http_ctx
 	int n_read;
 	struct Maat_hit_path_t hit_path[2048];
 
+	int region_id;
 	struct ip_data_ctx ip_ctx;
 	int thread_id;
 };
@@ -725,6 +726,13 @@ void http_get_scan_status(struct verify_policy_query_obj *query_obj, int type, c
 					k++;
 					cJSON_AddNumberToObject(histObj, "policyId", ctx->hit_path[i].compile_id);
 				}
+				if(ctx->region_id >0)
+				{
+					if(ctx->hit_path[i].region_id == ctx->region_id)
+					{
+						cJSON_AddNumberToObject(histObj, "policyId", 1);
+					}
+				}
 			}
 		}
 
@@ -1007,6 +1015,38 @@ finish:
 	return hit_cnt_fqdn;
 }
 
+static int verify_intercept_exclusion(struct Maat_rule_t *result, const char *value, int protocol_field, int hit_cnt, unsigned int thread_id, enum verify_policy_type policy_type,
+								struct pangu_http_ctx * ctx, struct verify_policy_query_obj *query_obj)
+{
+	int i=0;
+	int hit_cnt_fqdn=0,hit_path_cnt=0;
+	int ret=0, n_read=0;
+
+	ret=Maat_full_scan_string(g_pangu_rt->maat[policy_type], g_pangu_rt->scan_table_id[policy_type][PXY_SECURITY_EXCLUSION_SSL_SNI],
+					       CHARSET_UTF8, value, strlen(value), result+hit_cnt+hit_cnt_fqdn, NULL, MAX_SCAN_RESULT-hit_cnt-hit_cnt_fqdn, &(ctx->scan_mid),(int) thread_id);
+	if(ret>0)
+	{
+		hit_cnt_fqdn+=ret;
+		n_read=Maat_get_scan_status(g_pangu_rt->maat[policy_type], &(ctx->scan_mid), MAAT_GET_SCAN_HIT_PATH, ctx->hit_path, sizeof(ctx->hit_path));
+		if(ret >0)
+		{
+			for(i=ctx->n_read; i<n_read; i++)
+			{
+				if(ctx->hit_path[i].compile_id > 0)
+				{
+					ctx->region_id = ctx->hit_path[i].region_id;
+				}
+			}
+			query_obj->nth_scan[hit_path_cnt] = ctx->hit_path[ctx->n_read].Nth_scan;
+			ctx->n_read=n_read;
+			hit_path_cnt++;
+		}
+	}
+
+	query_obj->nth_scan_num = hit_path_cnt;
+	return hit_cnt_fqdn;
+}
+
 size_t verify_policy_scan(enum verify_policy_type policy_type, struct verify_policy_query_obj *query_obj, cJSON *data_obj, void *pme)
 {
 	int scan_ret=0, n_read;
@@ -1079,6 +1119,15 @@ size_t verify_policy_scan(enum verify_policy_type policy_type, struct verify_pol
 		}
 	}
 
+	if(policy_type == PXY_TABLE_SECURITY &&(protocol_field == PXY_SECURITY_HTTPS_SNI || protocol_field == PXY_SECURITY_HTTP_FQDN))
+	{
+		scan_ret = verify_intercept_exclusion(ctx->result, value, protocol_field, hit_cnt, ctx->thread_id, policy_type, ctx, query_obj);
+		if(scan_ret>0)
+		{
+			hit_cnt+=scan_ret;
+		}
+	}
+
 	if(policy_type == PXY_TABLE_SECURITY &&(protocol_field == PXY_SECURITY_HTTP_FQDN ||
 	   protocol_field == PXY_SECURITY_HTTPS_SNI || protocol_field==PXY_SECURITY_HTTPS_CN || protocol_field==PXY_SECURITY_HTTPS_SAN ||
        protocol_field==PXY_SECURITY_DNS_QNAME || protocol_field == PXY_SECURITY_QUIC_SNI))
@@ -1115,7 +1164,6 @@ size_t verify_policy_scan(enum verify_policy_type policy_type, struct verify_pol
 	}
 decide:
 	ctx->hit_cnt = hit_cnt;
-	//http_hit_policy_list(g_pangu_rt->maat[policy_type], hit_cnt, data_obj, (void *)ctx);
 	return hit_cnt;
 }
 
@@ -1398,6 +1446,7 @@ int security_policy_init(struct verify_policy * verify, const char* profile_path
 	table_name[PXY_SECURITY_IMSI]="TSG_FILED_GTP_IMSI";
 	table_name[PXY_SECURITY_PHONE_NUMBER]="TSG_FILED_GTP_PHONE_NUMBER";
 	table_name[PXY_SECURITY_APN]="TSG_FILED_GTP_APN";
+	table_name[PXY_SECURITY_EXCLUSION_SSL_SNI]="TSG_DECYPTION_EXCLUSION_SSL_SNI";
 
 	for (int i = 0; i < __SECURITY_TABLE_MAX; i++)
 	{