diff --git a/common/include/verify_policy.h b/common/include/verify_policy.h index 4793949..9eb5f93 100644 --- a/common/include/verify_policy.h +++ b/common/include/verify_policy.h @@ -123,7 +123,7 @@ struct verify_policy_query_obj struct verify_policy_query { enum verify_policy_type type; - struct verify_policy_query_obj query_obj[32]; + struct verify_policy_query_obj verify_object[32]; }; extern struct verify_policy * g_verify_proxy; diff --git a/platform/src/verify_policy.cpp b/platform/src/verify_policy.cpp index 6d49d8c..5a33ef7 100644 --- a/platform/src/verify_policy.cpp +++ b/platform/src/verify_policy.cpp @@ -64,7 +64,7 @@ enum verify_policy_type tsg_policy_type_str2idx(const char *action_str) { const char * policy_name[__SCAN_POLICY_MAX]; policy_name[PXY_TABLE_SECURITY] = "tsg_security"; - policy_name[PXY_TABLE_MANIPULATION] = "proxy_manipulation"; + policy_name[PXY_TABLE_MANIPULATION] = "pxy_manipulation"; policy_name[PXY_TABLE_DEFENCE] = "active_defence"; size_t i = 0; @@ -180,12 +180,86 @@ void ipaddr_free(struct ipaddr *ip_addr) free(ip_addr); } +static struct ipaddr * get_ip_from_json(cJSON *attributeValue) +{ + cJSON* item = NULL; + int addr_type=0, __attribute__((__unused__))protocol=0; + char *clientIp1=NULL,*serverIp1=NULL; + unsigned int clientPort1=0,serverPort1=0; + + item = cJSON_GetObjectItem(attributeValue,"clientIp"); + if(item && item->type==cJSON_String) clientIp1 = item->valuestring; + item = cJSON_GetObjectItem(attributeValue,"serverIp"); + if(item && item->type==cJSON_String) serverIp1 = (item->valuestring); + item = cJSON_GetObjectItem(attributeValue,"clientPort"); + if(item && item->type==cJSON_String) clientPort1 =atoi(item->valuestring); + item = cJSON_GetObjectItem(attributeValue,"serverPort"); + if(item && item->type==cJSON_String) serverPort1 =atoi(item->valuestring); + item = cJSON_GetObjectItem(attributeValue,"protocol"); + if(item && item->type==cJSON_Number) protocol = item->valueint; + item=cJSON_GetObjectItem(attributeValue,"addrType"); + if(item && item->type==cJSON_Number) addr_type = item->valueint; + + struct ipaddr *ip_addr = NULL; + ip_addr = ip_to_stream_addr(clientIp1, clientPort1, serverIp1, serverPort1, addr_type); + + return ip_addr; +} + +static int get_attribute_from_json(int curr_id, cJSON* subchild, struct verify_policy_query *policy_query) +{ + int xret = -1; + char buff[VERIFY_STRING_MAX], *p = NULL; + cJSON* item = NULL, *attributeValue=NULL; + + p = buff; + item = cJSON_GetObjectItem(subchild, "attributeName"); + if(item && item->type==cJSON_String) + { + policy_query->verify_object[curr_id].attri_name = item->valuestring; + p += snprintf(p, sizeof(buff) - (p - buff), "attributeName = %s",policy_query->verify_object[curr_id].attri_name); + } + policy_query->verify_object[curr_id].attributes=cJSON_Duplicate(subchild, 1); + + item = cJSON_GetObjectItem(subchild, "tableName"); + if(item && item->type==cJSON_String) + { + policy_query->verify_object[curr_id].protocol_field = protoco_field_type_str2idx(policy_query->type, item->valuestring, buff, &p); + if ((policy_query->type == PXY_TABLE_MANIPULATION && policy_query->verify_object[curr_id].protocol_field == __SCAN_TABLE_MAX) + || (policy_query->type == PXY_TABLE_SECURITY && policy_query->verify_object[curr_id].protocol_field == __SECURITY_TABLE_MAX)) + { + mesa_runtime_log(RLOG_LV_FATAL, MODULE_NAME, "policy table name error, table name = %s", item->valuestring); + goto finish; + } + } + attributeValue = cJSON_GetObjectItem(subchild, "attributeValue"); + if(attributeValue == NULL || attributeValue->type!=cJSON_Object) + { + goto finish; + } + if(0 == strcasecmp(policy_query->verify_object[curr_id].attri_name, "ip")) + { + policy_query->verify_object[curr_id].ip_addr = get_ip_from_json(attributeValue); + goto end; + } + item = cJSON_GetObjectItem(attributeValue,"string"); + { + policy_query->verify_object[curr_id].keyword = item->valuestring; + p += snprintf(p, sizeof(buff) - (p - buff), ", content = %s",policy_query->verify_object[curr_id].keyword); + } + mesa_runtime_log(RLOG_LV_DEBUG, MODULE_NAME, "[I] %s", buff); + memset(buff, 0, VERIFY_STRING_MAX); +end: + xret = 1; +finish: + return xret; +} + cJSON *get_query_from_request(const char *data, int thread_id) { int i = 0; int hit_cnt = -1; - char buff[VERIFY_STRING_MAX], *p = NULL; - struct verify_policy_query *policy_query = NULL; + struct verify_policy_query *verify_policy = NULL; cJSON* data_json = cJSON_Parse(data); if(data_json == NULL) @@ -202,21 +276,20 @@ cJSON *get_query_from_request(const char *data, int thread_id) data_obj = cJSON_CreateObject(); cJSON_AddItemToObject(policy_obj, "data", data_obj); - cJSON* item = NULL, *subitem = NULL, *subchild = NULL; - cJSON* attributes=NULL, *attributeValue=NULL; + cJSON* item = NULL, *subitem = NULL, *subchild = NULL, *attributes=NULL; item = cJSON_GetObjectItem(data_json,"verifyList"); if(item && item->type==cJSON_Array) { for (subitem = item->child; subitem != NULL; subitem = subitem->next) { - policy_query = ALLOC(struct verify_policy_query, 1); + verify_policy = ALLOC(struct verify_policy_query, 1); item = cJSON_GetObjectItem(subitem,"policyType"); if(item && item->type==cJSON_String) { - policy_query->type = tsg_policy_type_str2idx(item->valuestring); - if (policy_query->type >= __SCAN_POLICY_MAX) + verify_policy->type = tsg_policy_type_str2idx(item->valuestring); + if (verify_policy->type >= __SCAN_POLICY_MAX) { - mesa_runtime_log(RLOG_LV_FATAL, MODULE_NAME, "policy type error, policy id = %d", policy_query->type); + mesa_runtime_log(RLOG_LV_FATAL, MODULE_NAME, "policy type error, policy id = %d", verify_policy->type); goto free; } } @@ -232,66 +305,17 @@ cJSON *get_query_from_request(const char *data, int thread_id) for (subchild = attributes->child; subchild != NULL; subchild = subchild->next) { - p = buff; - item = cJSON_GetObjectItem(subchild, "attributeName"); - if(item && item->type==cJSON_String) - { - policy_query->query_obj[i].attri_name = item->valuestring; - p += snprintf(p, sizeof(buff) - (p - buff), "attributeName = %s",policy_query->query_obj[i].attri_name); - } - policy_query->query_obj[i].attributes=cJSON_Duplicate(subchild, 1); - - item = cJSON_GetObjectItem(subchild, "tableName"); - if(item && item->type==cJSON_String) - { - policy_query->query_obj[i].protocol_field = protoco_field_type_str2idx(policy_query->type, item->valuestring, buff, &p); - if ((policy_query->type == PXY_TABLE_MANIPULATION && policy_query->query_obj[i].protocol_field == __SCAN_TABLE_MAX) - || (policy_query->type == PXY_TABLE_SECURITY && policy_query->query_obj[i].protocol_field == __SECURITY_TABLE_MAX)) - { - mesa_runtime_log(RLOG_LV_FATAL, MODULE_NAME, "policy table name error, table name = %s", item->valuestring); - goto free; - } - } - attributeValue = cJSON_GetObjectItem(subchild, "attributeValue"); - if(attributeValue == NULL || attributeValue->type!=cJSON_Object) + hit_cnt = get_attribute_from_json(i, subchild, verify_policy); + if (hit_cnt < 0) { goto free; } - if(0 == strcasecmp(policy_query->query_obj[i].attri_name, "ip")) + hit_cnt = http_scan(verify_policy->type, &verify_policy->verify_object[i], data_obj, ctx); + if(0 == strcasecmp(verify_policy->verify_object[i].attri_name, "ip")) { - int addr_type=0, __attribute__((__unused__))protocol=0; - char *clientIp1=NULL,*serverIp1=NULL; - unsigned int clientPort1=0,serverPort1=0; - item = cJSON_GetObjectItem(attributeValue,"clientIp"); - if(item && item->type==cJSON_String) clientIp1 = item->valuestring; - item = cJSON_GetObjectItem(attributeValue,"serverIp"); - if(item && item->type==cJSON_String) serverIp1 = (item->valuestring); - item = cJSON_GetObjectItem(attributeValue,"clientPort"); - if(item && item->type==cJSON_String) clientPort1 =atoi(item->valuestring); - item = cJSON_GetObjectItem(attributeValue,"serverPort"); - if(item && item->type==cJSON_String) serverPort1 =atoi(item->valuestring); - item = cJSON_GetObjectItem(attributeValue,"protocol"); - if(item && item->type==cJSON_Number) protocol = item->valueint; - item=cJSON_GetObjectItem(attributeValue,"addrType"); - if(item && item->type==cJSON_Number) addr_type = item->valueint; - policy_query->query_obj[i].ip_addr = ip_to_stream_addr(clientIp1, clientPort1, serverIp1, serverPort1, addr_type); - - hit_cnt = http_scan(policy_query->type, &policy_query->query_obj[i], data_obj, ctx); - - ipaddr_free(policy_query->query_obj[i].ip_addr); - i++; - continue; + ipaddr_free(verify_policy->verify_object[i].ip_addr); } - item = cJSON_GetObjectItem(attributeValue,"string"); - { - policy_query->query_obj[i].keyword = item->valuestring; - p += snprintf(p, sizeof(buff) - (p - buff), ", content = %s",policy_query->query_obj[i].keyword); - } - mesa_runtime_log(RLOG_LV_DEBUG, MODULE_NAME, "[I] %s", buff); - - hit_cnt = http_scan(policy_query->type, &policy_query->query_obj[i], data_obj, ctx); i++; - memset(buff, 0, VERIFY_STRING_MAX); } int item = 0; cJSON *verfifySession = cJSON_CreateObject(); @@ -300,20 +324,20 @@ cJSON *get_query_from_request(const char *data, int thread_id) cJSON_AddItemToObject(verfifySession, "attributes", attributes); for (item = 0; item < i; item++) { - get_scan_status(&policy_query->query_obj[item], attributes,data_obj, ctx); + get_scan_status(&verify_policy->verify_object[item], attributes,data_obj, ctx); } pangu_http_ctx_free(ctx); } i=0; - FREE(&policy_query); + FREE(&verify_policy); } goto end; free: - if (policy_query) - { - FREE(&policy_query); - } + if (verify_policy) + { + FREE(&verify_policy); + } end: if (hit_cnt >= 0) { diff --git a/scan/src/pangu_http.cpp b/scan/src/pangu_http.cpp index 8b672ab..cbceaea 100644 --- a/scan/src/pangu_http.cpp +++ b/scan/src/pangu_http.cpp @@ -122,6 +122,57 @@ static inline int action_cmp(enum pangu_action a1, enum pangu_action a2) return pangu_action_weight[a1] - pangu_action_weight[a2]; } +static enum pangu_action decide_ctrl_action(const struct Maat_rule_t * hit_rules, size_t n_hit, + struct Maat_rule_t ** enforce_rules, size_t * n_enforce) +{ + size_t n_monit = 0, exist_enforce_num = 0, i = 0; + const struct Maat_rule_t * prior_rule = hit_rules; + struct Maat_rule_t monit_rule[n_hit]; + enum pangu_action prior_action = PG_ACTION_NONE; + + + for (i = 0; i < n_hit; i++) + { + unsigned char __expand_action = (unsigned char) hit_rules[i].action; + enum pangu_action __action = (enum pangu_action) __expand_action; + + if (__action == PG_ACTION_MONIT) + { + memcpy(monit_rule + n_monit, hit_rules + i, sizeof(struct Maat_rule_t)); + n_monit++; + } + else + { + continue; + } + } + + exist_enforce_num = *n_enforce; + if (prior_action == PG_ACTION_MONIT) + { + *n_enforce += n_monit; + } + else + { + *n_enforce += n_monit + 1; + } + + *enforce_rules = (struct Maat_rule_t *) realloc(*enforce_rules, sizeof(struct Maat_rule_t) * (*n_enforce)); + if (prior_action == PG_ACTION_MONIT) + { + memcpy(*enforce_rules + exist_enforce_num, monit_rule, n_monit * sizeof(struct Maat_rule_t)); + } + else + { + memmove(*enforce_rules+1, *enforce_rules, exist_enforce_num*sizeof(struct Maat_rule_t)); + memcpy(*enforce_rules, prior_rule, sizeof(struct Maat_rule_t)); + memcpy(*enforce_rules + exist_enforce_num + 1, monit_rule, n_monit * sizeof(struct Maat_rule_t)); + } + + return prior_action; +} + +#if 0 static enum pangu_action decide_ctrl_action(const struct Maat_rule_t * hit_rules, size_t n_hit, struct Maat_rule_t ** enforce_rules, size_t * n_enforce) { @@ -193,6 +244,7 @@ static enum pangu_action decide_ctrl_action(const struct Maat_rule_t * hit_rules return prior_action; } +#endif void get_scan_status(struct verify_policy_query_obj *query_obj, cJSON *attributes, cJSON *data_obj, void *pme) { @@ -216,6 +268,10 @@ void get_scan_status(struct verify_policy_query_obj *query_obj, cJSON *attribute cJSON_AddItemToArray(hitPaths, histObj); cJSON_AddNumberToObject(histObj, "itemId", ctx->hit_path[i].region_id); cJSON_AddNumberToObject(histObj, "objectId", ctx->hit_path[i].sub_group_id); + if (ctx->hit_path[i].top_group_id < 0) + { + ctx->hit_path[i].top_group_id = ctx->hit_path[i].sub_group_id; + } cJSON_AddNumberToObject(histObj, "topObjectId", ctx->hit_path[i].top_group_id); if(ctx->hit_path[i].compile_id > 0) { @@ -225,10 +281,52 @@ void get_scan_status(struct verify_policy_query_obj *query_obj, cJSON *attribute } } +static int http_hit_policy_list(Maat_feather_t maat, size_t hit_cnt, cJSON *data_obj, void *pme) +{ + size_t i=0, ret = 0; + + struct pangu_http_ctx * ctx = (struct pangu_http_ctx *) pme; + + if (hit_cnt <= 0) + { + return 0; + } + + ret = Maat_rule_sort_by_evaluation_order(maat, ctx->result, hit_cnt); + if (ret != hit_cnt) + { + return 0; + } + ctx->action = decide_ctrl_action(ctx->result, hit_cnt, &ctx->enforce_rules, &ctx->n_enforce); + ctx->hit_cnt = hit_cnt; + cJSON *hit_obj=NULL, *policy_obj=NULL; + hit_obj=cJSON_CreateArray(); + cJSON_AddItemToObject(data_obj, "hitPolicyList", hit_obj); + if (ctx->hit_cnt >= 1) + { + for (i = 0; i < ctx->hit_cnt; i++) + { + policy_obj=cJSON_CreateObject(); + cJSON_AddNumberToObject(policy_obj, "policyId",ctx->result[i].config_id); + cJSON_AddStringToObject(policy_obj, "policyName", ""); + if (ctx->enforce_rules[0].config_id == ctx->result[i].config_id) + { + cJSON_AddBoolToObject(policy_obj, "isExecutePolicy", true); + } + else + { + cJSON_AddBoolToObject(policy_obj, "isExecutePolicy", false); + } + cJSON_AddItemToArray(hit_obj, policy_obj); + } + } + return 0; +} + size_t http_scan(enum verify_policy_type policy_type, struct verify_policy_query_obj *query_obj, cJSON *data_obj, void *pme) { int scan_ret=0, n_read; - size_t hit_cnt=0, i=0; + size_t hit_cnt=0; struct http_field_name req_fields[]={ {"User-Agent", TFE_HTTP_USER_AGENT}, {"Cookie", TFE_HTTP_COOKIE}}; @@ -277,6 +375,7 @@ size_t http_scan(enum verify_policy_type policy_type, struct verify_policy_query query_obj->nth_scan = ctx->hit_path[ctx->n_read].Nth_scan; ctx->n_read=n_read; goto decide; + } scan_ret = Maat_full_scan_string(g_pangu_rt->maat[policy_type], g_pangu_rt->scan_table_id[policy_type][protocol_field], CHARSET_UTF8, value, strlen(value), @@ -290,32 +389,7 @@ size_t http_scan(enum verify_policy_type policy_type, struct verify_policy_query query_obj->nth_scan = ctx->hit_path[ctx->n_read].Nth_scan; ctx->n_read=n_read; decide: - if (hit_cnt > 0) - { - ctx->action = decide_ctrl_action(ctx->result, hit_cnt, &ctx->enforce_rules, &ctx->n_enforce); - ctx->hit_cnt = hit_cnt; - cJSON *hit_obj=NULL, *policy_obj=NULL; - hit_obj=cJSON_CreateArray(); - cJSON_AddItemToObject(data_obj, "hitPolicyList", hit_obj); - if (ctx->hit_cnt >= 1) - { - for (i = 0; i < ctx->hit_cnt; i++) - { - policy_obj=cJSON_CreateObject(); - cJSON_AddNumberToObject(policy_obj, "policyId",ctx->result[i].config_id); - cJSON_AddStringToObject(policy_obj, "policyName", ""); - if (ctx->enforce_rules[0].config_id == ctx->result[i].config_id) - { - cJSON_AddBoolToObject(policy_obj, "isExecutePolicy", true); - } - else - { - cJSON_AddBoolToObject(policy_obj, "isExecutePolicy", false); - } - cJSON_AddItemToArray(hit_obj, policy_obj); - } - } - } + http_hit_policy_list(g_pangu_rt->maat[policy_type], hit_cnt, data_obj, (void *)ctx); return hit_cnt; }