TSG-1274 适配策略优先级排序接口

common/include/verify_policy.h

@@ -123,7 +123,7 @@ struct verify_policy_query_obj
 struct verify_policy_query
 {
 	enum verify_policy_type type;
-	struct verify_policy_query_obj query_obj[32];
+	struct verify_policy_query_obj verify_object[32];
 };
 
 extern struct verify_policy * g_verify_proxy;

platform/src/verify_policy.cpp

@@ -64,7 +64,7 @@ enum verify_policy_type tsg_policy_type_str2idx(const char *action_str)
 {
 	const char * policy_name[__SCAN_POLICY_MAX];
 	policy_name[PXY_TABLE_SECURITY] = "tsg_security";
-	policy_name[PXY_TABLE_MANIPULATION] = "proxy_manipulation";
+	policy_name[PXY_TABLE_MANIPULATION] = "pxy_manipulation";
 	policy_name[PXY_TABLE_DEFENCE] = "active_defence";
 
 	size_t i = 0;
@@ -180,12 +180,86 @@ void ipaddr_free(struct ipaddr *ip_addr)
 	free(ip_addr);
 }
 
+static struct ipaddr * get_ip_from_json(cJSON *attributeValue)
+{
+	cJSON* item = NULL;
+	int addr_type=0, __attribute__((__unused__))protocol=0;
+	char *clientIp1=NULL,*serverIp1=NULL;
+	unsigned int clientPort1=0,serverPort1=0;
+
+	item = cJSON_GetObjectItem(attributeValue,"clientIp");
+	if(item && item->type==cJSON_String) clientIp1 = item->valuestring;
+	item = cJSON_GetObjectItem(attributeValue,"serverIp");
+	if(item && item->type==cJSON_String) serverIp1 = (item->valuestring);
+	item = cJSON_GetObjectItem(attributeValue,"clientPort");
+	if(item && item->type==cJSON_String) clientPort1 =atoi(item->valuestring);
+	item = cJSON_GetObjectItem(attributeValue,"serverPort");
+	if(item && item->type==cJSON_String) serverPort1 =atoi(item->valuestring);
+	item = cJSON_GetObjectItem(attributeValue,"protocol");
+	if(item && item->type==cJSON_Number) protocol = item->valueint;
+	item=cJSON_GetObjectItem(attributeValue,"addrType");
+	if(item && item->type==cJSON_Number) addr_type = item->valueint;
+
+	struct ipaddr *ip_addr = NULL;
+	ip_addr = ip_to_stream_addr(clientIp1, clientPort1, serverIp1, serverPort1, addr_type);
+
+	return ip_addr;
+}
+
+static int get_attribute_from_json(int curr_id, cJSON* subchild, struct verify_policy_query *policy_query)
+{
+	int xret = -1;
+	char buff[VERIFY_STRING_MAX], *p = NULL;
+	cJSON* item = NULL, *attributeValue=NULL;
+
+	p = buff;
+	item = cJSON_GetObjectItem(subchild, "attributeName");
+	if(item && item->type==cJSON_String)
+	{
+		policy_query->verify_object[curr_id].attri_name = item->valuestring;
+		p += snprintf(p, sizeof(buff) - (p - buff), "attributeName = %s",policy_query->verify_object[curr_id].attri_name);
+	}
+	policy_query->verify_object[curr_id].attributes=cJSON_Duplicate(subchild, 1);
+
+	item = cJSON_GetObjectItem(subchild, "tableName");
+	if(item && item->type==cJSON_String)
+	{
+		policy_query->verify_object[curr_id].protocol_field = protoco_field_type_str2idx(policy_query->type, item->valuestring, buff, &p);
+		if ((policy_query->type == PXY_TABLE_MANIPULATION && policy_query->verify_object[curr_id].protocol_field == __SCAN_TABLE_MAX)
+			|| (policy_query->type == PXY_TABLE_SECURITY && policy_query->verify_object[curr_id].protocol_field == __SECURITY_TABLE_MAX))
+		{
+			mesa_runtime_log(RLOG_LV_FATAL, MODULE_NAME, "policy table name error, table name = %s", item->valuestring);
+			goto finish;
+		}
+	}
+	attributeValue = cJSON_GetObjectItem(subchild, "attributeValue");
+	if(attributeValue == NULL || attributeValue->type!=cJSON_Object)
+	{
+		goto finish;
+	}
+	if(0 == strcasecmp(policy_query->verify_object[curr_id].attri_name, "ip"))
+	{
+		policy_query->verify_object[curr_id].ip_addr = get_ip_from_json(attributeValue);
+		goto end;
+	}
+	item = cJSON_GetObjectItem(attributeValue,"string");
+	{
+		policy_query->verify_object[curr_id].keyword = item->valuestring;
+		p += snprintf(p, sizeof(buff) - (p - buff), ", content = %s",policy_query->verify_object[curr_id].keyword);
+	}
+	mesa_runtime_log(RLOG_LV_DEBUG, MODULE_NAME, "[I]    %s", buff);
+	memset(buff, 0, VERIFY_STRING_MAX);
+end:
+	xret = 1;
+finish:
+	return xret;
+}
+
 cJSON *get_query_from_request(const char *data, int thread_id)
 {
 	int i = 0;
 	int hit_cnt = -1;
-	char buff[VERIFY_STRING_MAX], *p = NULL;
+	struct verify_policy_query *verify_policy = NULL;
-	struct verify_policy_query *policy_query = NULL;
 
 	cJSON* data_json = cJSON_Parse(data);
 	if(data_json == NULL)
@@ -202,21 +276,20 @@ cJSON *get_query_from_request(const char *data, int thread_id)
 	data_obj = cJSON_CreateObject();
 	cJSON_AddItemToObject(policy_obj, "data", data_obj);
 
-	cJSON* item = NULL, *subitem = NULL, *subchild = NULL;
+	cJSON* item = NULL, *subitem = NULL, *subchild = NULL, *attributes=NULL;
-	cJSON* attributes=NULL, *attributeValue=NULL;
 	item = cJSON_GetObjectItem(data_json,"verifyList");
 	if(item && item->type==cJSON_Array)
 	{
 		for (subitem = item->child; subitem != NULL; subitem = subitem->next)
 		{
-			policy_query = ALLOC(struct verify_policy_query, 1);
+			verify_policy = ALLOC(struct verify_policy_query, 1);
 			item = cJSON_GetObjectItem(subitem,"policyType");
 			if(item && item->type==cJSON_String)
 			{
-				policy_query->type = tsg_policy_type_str2idx(item->valuestring);
+				verify_policy->type = tsg_policy_type_str2idx(item->valuestring);
-				if (policy_query->type >= __SCAN_POLICY_MAX)
+				if (verify_policy->type >= __SCAN_POLICY_MAX)
 				{
-					mesa_runtime_log(RLOG_LV_FATAL, MODULE_NAME, "policy type error, policy id = %d", policy_query->type);
+					mesa_runtime_log(RLOG_LV_FATAL, MODULE_NAME, "policy type error, policy id = %d", verify_policy->type);
 					goto free;
 				}
 			}
@@ -232,66 +305,17 @@ cJSON *get_query_from_request(const char *data, int thread_id)
 
 				for (subchild = attributes->child; subchild != NULL; subchild = subchild->next)
 				{
-					p = buff;
+					hit_cnt = get_attribute_from_json(i, subchild, verify_policy);
-					item = cJSON_GetObjectItem(subchild, "attributeName");
+					if (hit_cnt < 0)
-					if(item && item->type==cJSON_String)
-					{
-						policy_query->query_obj[i].attri_name = item->valuestring;
-						p += snprintf(p, sizeof(buff) - (p - buff), "attributeName = %s",policy_query->query_obj[i].attri_name);
-					}
-					policy_query->query_obj[i].attributes=cJSON_Duplicate(subchild, 1);
-
-					item = cJSON_GetObjectItem(subchild, "tableName");
-					if(item && item->type==cJSON_String)
-					{
-						policy_query->query_obj[i].protocol_field = protoco_field_type_str2idx(policy_query->type, item->valuestring, buff, &p);
-						if ((policy_query->type == PXY_TABLE_MANIPULATION && policy_query->query_obj[i].protocol_field == __SCAN_TABLE_MAX)
-							|| (policy_query->type == PXY_TABLE_SECURITY && policy_query->query_obj[i].protocol_field == __SECURITY_TABLE_MAX))
-						{
-							mesa_runtime_log(RLOG_LV_FATAL, MODULE_NAME, "policy table name error, table name = %s", item->valuestring);
-							goto free;
-						}
-					}
-					attributeValue = cJSON_GetObjectItem(subchild, "attributeValue");
-					if(attributeValue == NULL || attributeValue->type!=cJSON_Object)
 					{
 						goto free;
 					}
-					if(0 == strcasecmp(policy_query->query_obj[i].attri_name, "ip"))
+					hit_cnt = http_scan(verify_policy->type, &verify_policy->verify_object[i], data_obj, ctx);
+					if(0 == strcasecmp(verify_policy->verify_object[i].attri_name, "ip"))
 					{
-						int addr_type=0, __attribute__((__unused__))protocol=0;
+						ipaddr_free(verify_policy->verify_object[i].ip_addr);
-						char *clientIp1=NULL,*serverIp1=NULL;
-						unsigned int clientPort1=0,serverPort1=0;
-						item = cJSON_GetObjectItem(attributeValue,"clientIp");
-						if(item && item->type==cJSON_String) clientIp1 = item->valuestring;
-						item = cJSON_GetObjectItem(attributeValue,"serverIp");
-						if(item && item->type==cJSON_String) serverIp1 = (item->valuestring);
-						item = cJSON_GetObjectItem(attributeValue,"clientPort");
-						if(item && item->type==cJSON_String) clientPort1 =atoi(item->valuestring);
-						item = cJSON_GetObjectItem(attributeValue,"serverPort");
-						if(item && item->type==cJSON_String) serverPort1 =atoi(item->valuestring);
-						item = cJSON_GetObjectItem(attributeValue,"protocol");
-						if(item && item->type==cJSON_Number) protocol = item->valueint;
-						item=cJSON_GetObjectItem(attributeValue,"addrType");
-						if(item && item->type==cJSON_Number) addr_type = item->valueint;
-						policy_query->query_obj[i].ip_addr = ip_to_stream_addr(clientIp1, clientPort1, serverIp1, serverPort1, addr_type);
-
-						hit_cnt = http_scan(policy_query->type, &policy_query->query_obj[i], data_obj, ctx);
-
-						ipaddr_free(policy_query->query_obj[i].ip_addr);
-						i++;
-						continue;
 					}
-					item = cJSON_GetObjectItem(attributeValue,"string");
-					{
-						policy_query->query_obj[i].keyword = item->valuestring;
-						p += snprintf(p, sizeof(buff) - (p - buff), ", content = %s",policy_query->query_obj[i].keyword);
-					}
-					mesa_runtime_log(RLOG_LV_DEBUG, MODULE_NAME, "[I]    %s", buff);
-
-					hit_cnt = http_scan(policy_query->type, &policy_query->query_obj[i], data_obj, ctx);
 					i++;
-					memset(buff, 0, VERIFY_STRING_MAX);
 				}
 				int item = 0;
 				cJSON *verfifySession = cJSON_CreateObject();
@@ -300,20 +324,20 @@ cJSON *get_query_from_request(const char *data, int thread_id)
 				cJSON_AddItemToObject(verfifySession, "attributes", attributes);
 				for (item = 0; item < i; item++)
 				{
-					get_scan_status(&policy_query->query_obj[item], attributes,data_obj, ctx);
+					get_scan_status(&verify_policy->verify_object[item], attributes,data_obj, ctx);
 				}
 				pangu_http_ctx_free(ctx);
 			}
 
 			i=0;
-			FREE(&policy_query);
+			FREE(&verify_policy);
 		}
 		goto end;
 free:
-	if (policy_query)
+		if (verify_policy)
-	{
+		{
-		FREE(&policy_query);
+			FREE(&verify_policy);
-	}
+		}
 end:
 		if (hit_cnt >= 0)
 		{

scan/src/pangu_http.cpp

@@ -122,6 +122,57 @@ static inline int action_cmp(enum pangu_action a1, enum pangu_action a2)
 	return pangu_action_weight[a1] - pangu_action_weight[a2];
 }
 
+static enum pangu_action decide_ctrl_action(const struct Maat_rule_t * hit_rules, size_t n_hit,
+	struct Maat_rule_t ** enforce_rules, size_t * n_enforce)
+{
+	size_t n_monit = 0, exist_enforce_num = 0, i = 0;
+	const struct Maat_rule_t * prior_rule = hit_rules;
+	struct Maat_rule_t monit_rule[n_hit];
+	enum pangu_action prior_action = PG_ACTION_NONE;
+
+
+	for (i = 0; i < n_hit; i++)
+	{
+		unsigned char __expand_action = (unsigned char) hit_rules[i].action;
+		enum pangu_action __action = (enum pangu_action) __expand_action;
+
+		if (__action == PG_ACTION_MONIT)
+		{
+			memcpy(monit_rule + n_monit, hit_rules + i, sizeof(struct Maat_rule_t));
+			n_monit++;
+		}
+		else
+		{
+			continue;
+		}
+	}
+
+	exist_enforce_num = *n_enforce;
+	if (prior_action == PG_ACTION_MONIT)
+	{
+		*n_enforce += n_monit;
+	}
+	else
+	{
+		*n_enforce += n_monit + 1;
+	}
+
+	*enforce_rules = (struct Maat_rule_t *) realloc(*enforce_rules, sizeof(struct Maat_rule_t) * (*n_enforce));
+	if (prior_action == PG_ACTION_MONIT)
+	{
+		memcpy(*enforce_rules + exist_enforce_num, monit_rule, n_monit * sizeof(struct Maat_rule_t));
+	}
+	else
+	{
+		memmove(*enforce_rules+1, *enforce_rules, exist_enforce_num*sizeof(struct Maat_rule_t));
+		memcpy(*enforce_rules, prior_rule, sizeof(struct Maat_rule_t));
+		memcpy(*enforce_rules + exist_enforce_num + 1, monit_rule, n_monit * sizeof(struct Maat_rule_t));
+	}
+
+	return prior_action;
+}
+
+#if 0
 static enum pangu_action decide_ctrl_action(const struct Maat_rule_t * hit_rules, size_t n_hit,
 	struct Maat_rule_t ** enforce_rules, size_t * n_enforce)
 {
@@ -193,6 +244,7 @@ static enum pangu_action decide_ctrl_action(const struct Maat_rule_t * hit_rules
 
 	return prior_action;
 }
+#endif
 
 void get_scan_status(struct verify_policy_query_obj *query_obj, cJSON *attributes, cJSON  *data_obj, void *pme)
 {
@@ -216,6 +268,10 @@ void get_scan_status(struct verify_policy_query_obj *query_obj, cJSON *attribute
 			cJSON_AddItemToArray(hitPaths, histObj);
 			cJSON_AddNumberToObject(histObj, "itemId", ctx->hit_path[i].region_id);
 			cJSON_AddNumberToObject(histObj, "objectId", ctx->hit_path[i].sub_group_id);
+			if (ctx->hit_path[i].top_group_id < 0)
+			{
+				ctx->hit_path[i].top_group_id = ctx->hit_path[i].sub_group_id;
+			}
 			cJSON_AddNumberToObject(histObj, "topObjectId", ctx->hit_path[i].top_group_id);
 			if(ctx->hit_path[i].compile_id > 0)
 			{
@@ -225,10 +281,52 @@ void get_scan_status(struct verify_policy_query_obj *query_obj, cJSON *attribute
 	}
 }
 
+static int http_hit_policy_list(Maat_feather_t maat, size_t hit_cnt, cJSON *data_obj, void *pme)
+{
+	size_t i=0, ret = 0;
+
+	struct pangu_http_ctx * ctx = (struct pangu_http_ctx *) pme;
+
+	if (hit_cnt <= 0)
+	{
+		return 0;
+	}
+
+	ret = Maat_rule_sort_by_evaluation_order(maat, ctx->result, hit_cnt);
+	if (ret != hit_cnt)
+	{
+		return 0;
+	}
+	ctx->action = decide_ctrl_action(ctx->result, hit_cnt, &ctx->enforce_rules, &ctx->n_enforce);
+	ctx->hit_cnt = hit_cnt;
+	cJSON  *hit_obj=NULL, *policy_obj=NULL;
+	hit_obj=cJSON_CreateArray();
+	cJSON_AddItemToObject(data_obj, "hitPolicyList", hit_obj);
+	if (ctx->hit_cnt >= 1)
+	{
+		for (i = 0; i < ctx->hit_cnt; i++)
+		{
+			policy_obj=cJSON_CreateObject();
+			cJSON_AddNumberToObject(policy_obj, "policyId",ctx->result[i].config_id);
+			cJSON_AddStringToObject(policy_obj, "policyName", "");
+			if (ctx->enforce_rules[0].config_id == ctx->result[i].config_id)
+			{
+				cJSON_AddBoolToObject(policy_obj, "isExecutePolicy", true);
+			}
+			else
+			{
+				cJSON_AddBoolToObject(policy_obj, "isExecutePolicy", false);
+			}
+			cJSON_AddItemToArray(hit_obj, policy_obj);
+		}
+	}
+	return 0;
+}
+
 size_t http_scan(enum verify_policy_type policy_type, struct verify_policy_query_obj *query_obj, cJSON *data_obj, void *pme)
 {
 	int scan_ret=0, n_read;
-	size_t hit_cnt=0, i=0;
+	size_t hit_cnt=0;
 
 	struct http_field_name req_fields[]={	{"User-Agent", TFE_HTTP_USER_AGENT},
 									        {"Cookie", TFE_HTTP_COOKIE}};
@@ -277,6 +375,7 @@ size_t http_scan(enum verify_policy_type policy_type, struct verify_policy_query
 		query_obj->nth_scan = ctx->hit_path[ctx->n_read].Nth_scan;
 		ctx->n_read=n_read;
 		goto decide;
+
 	}
 	scan_ret = Maat_full_scan_string(g_pangu_rt->maat[policy_type], g_pangu_rt->scan_table_id[policy_type][protocol_field],
 									CHARSET_UTF8, value, strlen(value),
@@ -290,32 +389,7 @@ size_t http_scan(enum verify_policy_type policy_type, struct verify_policy_query
 	query_obj->nth_scan = ctx->hit_path[ctx->n_read].Nth_scan;
 	ctx->n_read=n_read;
 decide:
-	if (hit_cnt > 0)
+	http_hit_policy_list(g_pangu_rt->maat[policy_type], hit_cnt, data_obj, (void *)ctx);
-	{
-		ctx->action = decide_ctrl_action(ctx->result, hit_cnt, &ctx->enforce_rules, &ctx->n_enforce);
-		ctx->hit_cnt = hit_cnt;
-		cJSON  *hit_obj=NULL, *policy_obj=NULL;
-		hit_obj=cJSON_CreateArray();
-		cJSON_AddItemToObject(data_obj, "hitPolicyList", hit_obj);
-		if (ctx->hit_cnt >= 1)
-		{
-			for (i = 0; i < ctx->hit_cnt; i++)
-			{
-				policy_obj=cJSON_CreateObject();
-				cJSON_AddNumberToObject(policy_obj, "policyId",ctx->result[i].config_id);
-				cJSON_AddStringToObject(policy_obj, "policyName", "");
-				if (ctx->enforce_rules[0].config_id == ctx->result[i].config_id)
-				{
-					cJSON_AddBoolToObject(policy_obj, "isExecutePolicy", true);
-				}
-				else
-				{
-					cJSON_AddBoolToObject(policy_obj, "isExecutePolicy", false);
-				}
-				cJSON_AddItemToArray(hit_obj, policy_obj);
-			}
-		}
-	}
 	return hit_cnt;
 }