create version

5 files changed, 766 insertions, 0 deletions

diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
new file mode 100644
index 0000000..5304d76
--- /dev/null
+++ b/src/CMakeLists.txt
@@ -0,0 +1,19 @@
+cmake_minimum_required(VERSION 2.8)
+
+add_definitions(-fPIC)
+
+set(SRC fw_dns_plug.cpp fw_dns_rule.cpp) 
+
+include_directories(${CMAKE_SOURCE_DIR}/src)
+include_directories(/opt/MESA/include/)
+include_directories(/opt/MESA/include/tsg/)
+
+set(FW_DNS_PLUG_DEPEND_DYN_LIB  MESA_handle_logger MESA_prof_load maatframe pthread MESA_field_stat2)
+
+add_library(fw_dns_plug SHARED ${SRC})
+target_link_libraries(fw_dns_plug ${FW_DNS_PLUG_DEPEND_DYN_LIB})
+set_target_properties(fw_dns_plug  PROPERTIES PREFIX "")
+
+install(TARGETS fw_dns_plug DESTINATION ${CMAKE_INSTALL_PREFIX}/plug/business/fw_dns_plug)
+install(FILES ../bin/fw_dns_plug.inf DESTINATION ${CMAKE_INSTALL_PREFIX}/plug/business/fw_dns_plug)
+
diff --git a/src/fw_dns_plug.cpp b/src/fw_dns_plug.cpp
new file mode 100644
index 0000000..34cb993
--- /dev/null
+++ b/src/fw_dns_plug.cpp
@@ -0,0 +1,500 @@
+#include <stdio.h>
+#include <arpa/inet.h>
+
+#include <MESA/stream.h>
+#include <MESA/dns.h>
+#include <MESA/cJSON.h>
+#include <MESA_prof_load.h>
+#include <MESA/Maat_rule.h>
+#include <MESA/MESA_handle_logger.h>
+
+#include "tsg_rule.h"
+#include "tsg_send_log.h"
+#include "fw_dns_plug.h"
+
+
+char *g_fw_dns_conffile=(char *)"tsgconf/main.conf";
+char FW_DNS_PLUG_VERSION_20191206=0;
+struct _fw_dns_plug g_fw_dns_plug_info;
+
+enum TSG_ETHOD_TYPE
+{
+	TSG_METHOD_TYPE_UNKNOWN=0,
+	TSG_METHOD_TYPE_DROP,
+	TSG_METHOD_TYPE_REDIRECTION,
+	TSG_METHOD_TYPE_MAX
+};
+
+const struct _str2index method2index[TSG_METHOD_TYPE_MAX]={	{TSG_METHOD_TYPE_UNKNOWN, 7, (char *)"unknown"},
+													{TSG_METHOD_TYPE_DROP, 4, (char *)"drop"},
+													{TSG_METHOD_TYPE_REDIRECTION, 8, (char *)"redirect"}
+	};
+
+int tsg_get_method_id(char *method)
+{
+	int i=0;
+
+	for(i=0; i<TSG_METHOD_TYPE_MAX; i++)
+	{
+		if(method2index[i].len==(int)strlen(method) && (strncasecmp(method2index[i].type, method, method2index[i].len))==0)
+		{
+			return method2index[i].index;
+		}
+	}
+
+	return -1;
+}
+
+static int get_answer_ttl(cJSON *object)
+{
+	int min=0;
+	int max=0;
+	cJSON *item=NULL;
+
+	item=cJSON_GetObjectItem(object, "min");
+	min=item->valueint;
+
+	item=cJSON_GetObjectItem(object, "max");
+	max=item->valueint;
+
+	return (rand()%(max-min+1)+min);
+}
+
+static cJSON * get_answer_records(cJSON *object, int qtype)
+{
+	int i=0;
+	cJSON *item=NULL;
+	int resolution_size=0;
+	int answer_type=DNS_TYPE_UNKNOWN;
+	
+	cJSON *resolution_array=cJSON_GetObjectItem(object, "resolution");
+	resolution_size=cJSON_GetArraySize(resolution_array);
+	for(i=0; i<resolution_size; i++)
+	{
+		item=cJSON_GetArrayItem(resolution_array, i);
+		cJSON *tmp=cJSON_GetObjectItem(item, "qtype");
+		
+		answer_type=fw_dns_type2index(tmp->valuestring);
+		if(answer_type==qtype)
+		{
+			return cJSON_GetObjectItem(item, "answer");
+		}
+	}
+
+	return NULL;
+}
+
+static char fw_dns_action(struct streaminfo *a_stream, dns_info_t *dns_info, Maat_rule_t *p_result, const void *a_packet)
+{
+	int record_id=0;
+	int i=0,used_num=0;
+	int answer_size=0,ret=0;
+	int payload_len=0,ttl=0;
+	dns_hdr_t *dns_hdr = NULL;
+	cJSON *item=NULL;
+	cJSON *a_item=NULL;
+	cJSON *object=NULL;
+	cJSON *answer_array=NULL;
+	char *tmp_buff=NULL;
+	unsigned char senddir=0;
+	char state=PROT_STATE_GIVEME;
+	int answer_type=DNS_TYPE_UNKNOWN;
+	int method_type=TSG_METHOD_TYPE_UNKNOWN;
+	cheat_pkt_opt_t cheat_opt[MAX_ANSWER_RECORDS_NUM];
+	unsigned char cheat_pkt_payload[MAX_CHEAT_PKT_PAYLOAD_LEN];
+	
+	if(p_result->serv_def_len<128)
+	{
+		object=cJSON_Parse(p_result->service_defined);
+
+		MESA_handle_runtime_log(g_fw_dns_plug_info.logger, 
+								RLOG_LV_DEBUG,
+								"DO_ACTION",
+								"Hit policy_id: %d service: %d action: %d user_reagion: %s domain: %s qtype: %d addr: %s",
+								p_result->config_id,
+								p_result->service_id,
+								p_result->action,
+								p_result->service_defined,
+								(char *)dns_info->query_question.qname,
+								dns_info->query_question.qtype,
+								printaddr(&a_stream->addr, a_stream->threadnum)
+								);
+	}
+	else
+	{
+		tmp_buff=(char *)calloc(1, p_result->serv_def_len+1);
+		Maat_read_rule(g_tsg_maat_feather, p_result, MAAT_RULE_SERV_DEFINE, tmp_buff, p_result->serv_def_len);
+		object=cJSON_Parse(tmp_buff);
+
+		MESA_handle_runtime_log(g_fw_dns_plug_info.logger, 
+								RLOG_LV_DEBUG,
+								"DO_ACTION",
+								"Hit policy_id: %d service: %d action: %d user_reagion: %s domain: %s qtype: %d addr: %s",
+								p_result->config_id,
+								p_result->service_id,
+								p_result->action,
+								tmp_buff,
+								(char *)dns_info->query_question.qname,
+								dns_info->query_question.qtype,
+								printaddr(&a_stream->addr, a_stream->threadnum)
+								);
+	}
+
+	if(object==NULL)
+	{
+		MESA_handle_runtime_log(g_fw_dns_plug_info.logger, 
+								RLOG_LV_FATAL,
+								"DO_ACTION",
+								"Hit policy_id: %d service: %d action: %d user_reagion: %s domain: %s qtype: %d addr: %s",
+								p_result->config_id,
+								p_result->service_id,
+								p_result->action,
+								(tmp_buff==NULL) ? p_result->service_defined : tmp_buff,
+								(char *)dns_info->query_question.qname,
+								dns_info->query_question.qtype,
+								printaddr(&a_stream->addr, a_stream->threadnum)
+								);
+
+		if(tmp_buff!=NULL)
+		{
+			free(tmp_buff);
+			tmp_buff=NULL;
+		}
+		
+		return PROT_STATE_GIVEME;
+	}
+	
+	item=cJSON_GetObjectItem(object, "method");
+	if(item!=NULL)
+	{
+		method_type=tsg_get_method_id(item->valuestring);
+	}
+	
+	switch(method_type)
+	{
+		case	TSG_METHOD_TYPE_DROP:
+			state=PROT_STATE_DROPME|PROT_STATE_DROPPKT;
+			break;
+		case	TSG_METHOD_TYPE_REDIRECTION:
+			answer_array=get_answer_records(object, dns_info->query_question.qtype);
+			if(answer_array!=NULL)
+			{
+				memset(cheat_opt, 0, sizeof(cheat_opt));
+				answer_size=cJSON_GetArraySize(answer_array);
+				for(i=0; i<answer_size; i++)
+				{
+					item=cJSON_GetArrayItem(answer_array, i);
+					a_item=cJSON_GetObjectItem(item, "atype");
+					answer_type=fw_dns_type2index(a_item->valuestring);
+
+					a_item=cJSON_GetObjectItem(item, "ttl");
+					ttl=get_answer_ttl(a_item);
+						
+					a_item=cJSON_GetObjectItem(item, "value");
+					if(a_item!=NULL)
+					{
+						cheat_opt[used_num].res_type=answer_type;
+						cheat_opt[used_num].cfg_type=answer_type;
+						cheat_opt[used_num].ttl=ttl;
+
+						switch(answer_type)
+						{
+							case	DNS_TYPE_A:
+								cheat_opt[used_num].res_len=sizeof(unsigned int);
+								inet_pton(AF_INET, a_item->valuestring, (void *)cheat_opt[used_num].res_info);
+								break;
+							case	DNS_TYPE_AAAA:
+								cheat_opt[used_num].res_len=IPV6_ADDR_LEN;
+								inet_pton(AF_INET6, a_item->valuestring, (void *)cheat_opt[used_num].res_info);
+								break;
+							default:
+								cheat_opt[used_num].res_len=(strlen(a_item->valuestring) > sizeof(cheat_opt[used_num].res_info)-1) ? sizeof(cheat_opt[used_num].res_info)-1 : strlen(a_item->valuestring);
+								memcpy(cheat_opt[used_num].res_info, a_item->valuestring, cheat_opt[used_num].res_len);
+								break;
+						}
+						used_num++;
+					}
+					else
+					{
+						a_item=cJSON_GetObjectItem(object, "record_id");
+						record_id=a_item->valueint;
+
+						a_item=cJSON_GetObjectItem(object, "selected_num");
+						used_num+=get_cheat_opt(record_id, a_item->valueint, ttl, answer_type, cheat_opt+used_num, MAX_ANSWER_RECORDS_NUM-used_num);
+					}
+					
+				}
+
+				memset(cheat_pkt_payload, 0, MAX_CHEAT_PKT_PAYLOAD_LEN);
+
+				dns_hdr = (dns_hdr_t *)cheat_pkt_payload;
+				dns_hdr->id = dns_info->hdr_info.id;
+				dns_hdr->qdcount = 1;
+				dns_hdr->ancount = used_num;
+				
+				payload_len=build_cheat_pkt(cheat_pkt_payload, MAX_CHEAT_PKT_PAYLOAD_LEN, &dns_info->query_question, cheat_opt, used_num);
+				if(payload_len==-1)
+				{
+					return -1;
+				}
+
+				senddir = MESA_dir_reverse(a_stream->routedir);
+				ret=MESA_inject_pkt(a_stream, (const char *)cheat_pkt_payload, payload_len, (const char *)a_packet, senddir);
+				if(ret<0)
+				{
+					MESA_handle_runtime_log(g_fw_dns_plug_info.logger,
+												RLOG_LV_FATAL,
+												"SEND_CHEAT_PKT",
+												"Return of MESA_inject_pkt_feedback function is %d, qname: %s qtype: %d cfg_id: %d service: %d addr: %s",
+												ret,
+												dns_info->query_question.qname,
+												dns_info->query_question.qtype,
+												p_result->config_id,
+												p_result->service_id,
+												printaddr(&a_stream->addr, a_stream->threadnum)
+												);
+				}
+
+				state=PROT_STATE_DROPME|PROT_STATE_DROPPKT;
+			}
+			else
+			{
+				MESA_handle_runtime_log(g_fw_dns_plug_info.logger, 
+										RLOG_LV_FATAL,
+										"DO_ACTION",
+										"Hit policy_id: %d service: %d action: %d user_reagion: %s domain: %s qtype: %d addr: %s",
+										p_result->config_id,
+										p_result->service_id,
+										p_result->action,
+										(tmp_buff==NULL) ? p_result->service_defined : tmp_buff,
+										(char *)dns_info->query_question.qname,
+										dns_info->query_question.qtype,
+										printaddr(&a_stream->addr, a_stream->threadnum)
+									);
+				state=PROT_STATE_GIVEME;
+			}
+			break;
+		default:
+			break;
+	}
+	
+	cJSON_Delete(object);
+	object=NULL;
+	return state;
+}
+
+static int fw_dns_send_log(struct streaminfo *a_stream, dns_info_t *dns_info, struct Maat_rule_t *result, int result_num, int thread_seq)
+{
+	int i=0;
+	dns_rr_t *rr=NULL;
+	tsg_log_t log_msg;
+	int cname_use_len=0,dns_sec=1;
+	struct TLD_handle_t *handle=NULL;
+	char cname[4096]={0},*rr_buf=NULL;
+	int cname_size=sizeof(cname);
+	
+	handle=TLD_create(thread_seq);
+	
+	TLD_append(handle, (char *)"dns_qr", (void *)(long)dns_info->hdr_info.qr, TLD_TYPE_LONG);
+	TLD_append(handle, (char *)"dns_aa", (void *)(long)dns_info->hdr_info.aa, TLD_TYPE_LONG);
+	TLD_append(handle, (char *)"dns_message_id", (void *)(long)dns_info->hdr_info.id, TLD_TYPE_LONG);
+	TLD_append(handle, (char *)"dns_opcode", (void *)(long)dns_info->hdr_info.opcode, TLD_TYPE_LONG);
+	TLD_append(handle, (char *)"dns_ra", (void *)(long)dns_info->hdr_info.ra, TLD_TYPE_LONG);
+	TLD_append(handle, (char *)"dns_rcode", (void *)(long)dns_info->hdr_info.rcode, TLD_TYPE_LONG);
+	TLD_append(handle, (char *)"dns_rd", (void *)(long)dns_info->hdr_info.rd, TLD_TYPE_LONG);
+	TLD_append(handle, (char *)"dns_tc", (void *)(long)dns_info->hdr_info.tc, TLD_TYPE_LONG);
+	TLD_append(handle, (char *)"dns_qdcount", (void *)(long)dns_info->hdr_info.qdcount, TLD_TYPE_LONG);
+	TLD_append(handle, (char *)"dns_ancount", (void *)(long)dns_info->hdr_info.ancount, TLD_TYPE_LONG);
+	TLD_append(handle, (char *)"dns_nscount", (void *)(long)dns_info->hdr_info.aucount, TLD_TYPE_LONG);
+	TLD_append(handle, (char *)"dns_arcount", (void *)(long)dns_info->hdr_info.adcount, TLD_TYPE_LONG);
+
+	if((strlen((char *)dns_info->query_question.qname)) >0)
+	{
+		TLD_append(handle, (char *)"dns_qname", (void *)dns_info->query_question.qname, TLD_TYPE_STRING);		
+		TLD_append(handle, (char *)"dns_qtype", (void *)(long)dns_info->query_question.qtype, TLD_TYPE_LONG);		
+		TLD_append(handle, (char *)"dns_qclass", (void *)(long)dns_info->query_question.qclass, TLD_TYPE_LONG);
+	}
+
+	for(i=0; i<dns_info->rr_count && dns_info->rr != NULL; i++)
+	{
+		rr = &dns_info->rr[i];
+		if(rr!=NULL && rr->type==DNS_TYPE_CNAME)
+		{
+			if(rr->rdata.cname != NULL && cname_size-cname_use_len > (int)strlen((const char *)rr->rdata.cname))
+			{
+				snprintf(cname+cname_use_len, cname_size-cname_use_len, "%s,", rr->rdata.cname);
+				cname_use_len += strlen((const char *)rr->rdata.cname);
+			}
+		}
+	}
+	
+	TLD_append(handle, (char *)"dns_cname", (void *)cname, TLD_TYPE_STRING);
+
+	cJSON * object=cJSON_CreateObject();
+	get_rr_str2json(object, dns_info, &dns_sec);
+	rr_buf=cJSON_PrintUnformatted(object);
+	TLD_append(handle, (char *)"dns_rr", (void *)rr_buf, TLD_TYPE_STRING);
+	free(rr_buf);
+	rr_buf=NULL;
+	
+	TLD_append(handle, (char *)"dns_sub", (void *)(long)dns_sec, TLD_TYPE_LONG);
+
+	TLD_append(handle, (char *)"common_schema_type", (void *)"DNS", TLD_TYPE_STRING);
+
+	log_msg.a_stream=a_stream;
+	log_msg.result=result;
+	log_msg.result_num=result_num;
+	
+	tsg_send_log(g_tsg_log_instance, handle, &log_msg, thread_seq);
+	
+	return 0;
+}
+
+extern "C" char FW_DNS_PLUG_ENTRY(stSessionInfo* session_info,  void **pme, int thread_seq,struct streaminfo *a_stream,const void *a_packet)
+{
+	int ret=0,hit_num=0;
+	scan_status_t mid=NULL;
+	char state=PROT_STATE_GIVEME;
+	struct Maat_rule_t result[MAX_RESULT_NUM], *p_result=NULL;
+	dns_info_t *dns_info=(dns_info_t *)session_info->app_info;
+
+	if(dns_info==NULL || strlen((char *)dns_info->query_question.qname)==0)
+	{		
+		MESA_handle_runtime_log(g_fw_dns_plug_info.logger, 
+					RLOG_LV_FATAL,
+					"DNS_PLUG",
+					"Qname is %s, addr: %s",
+					(dns_info==NULL) ? "NULL" : ((strlen((char *)dns_info->query_question.qname)==0) ? "NULL" : (char *)dns_info->query_question.qname),
+					printaddr(&a_stream->addr, thread_seq)
+					);
+		return state;
+	}
+	
+	ret=tsg_scan_nesting_addr(g_tsg_maat_feather, a_stream, PROTO_DNS, &mid, result, MAX_RESULT_NUM-hit_num);
+	if(ret>0)
+	{
+		MESA_handle_runtime_log(g_fw_dns_plug_info.logger, 
+								RLOG_LV_DEBUG,
+								"SCAN_NEST_ADDR",
+								"Hit policy_id: %d service: %d action: %d domain: %s qtype: %d addr: %s",								
+								result[hit_num].config_id,
+								result[hit_num].service_id,
+								result[hit_num].action,
+								(char *)dns_info->query_question.qname,
+								dns_info->query_question.qtype,
+								printaddr(&a_stream->addr, thread_seq)
+								);
+		hit_num+=ret;
+	}
+	else
+	{
+		MESA_handle_runtime_log(g_fw_dns_plug_info.logger, 
+								RLOG_LV_DEBUG,
+								"SCAN_NEST_ADDR",
+								"Scan domain: %s qtype: %d ret: %d addr: %s",
+								(char *)dns_info->query_question.qname,
+								dns_info->query_question.qtype,
+								ret,
+								printaddr(&a_stream->addr, thread_seq)
+								);
+								
+	}
+	
+	ret=Maat_full_scan_string(g_tsg_maat_feather,
+							g_fw_dns_plug_info.table_qname_id,
+							CHARSET_UTF8,
+							(char *)dns_info->query_question.qname,
+							strlen((char *)dns_info->query_question.qname),
+							result+hit_num, 
+							NULL,
+							MAX_RESULT_NUM-hit_num,
+							&mid,
+							thread_seq);
+
+	if(ret>0)
+	{
+		MESA_handle_runtime_log(g_fw_dns_plug_info.logger, 
+								RLOG_LV_DEBUG,
+								"SCAN_DOMAIN",
+								"Hit domain: %s qtype: %d policy_id: %d service: %d action: %d addr: %s",
+								(char *)dns_info->query_question.qname,
+								dns_info->query_question.qtype,
+								result[hit_num].config_id,
+								result[hit_num].service_id,
+								result[hit_num].action,
+								printaddr(&a_stream->addr, thread_seq)
+								);
+		hit_num+=ret;
+	}
+	else
+	{
+		MESA_handle_runtime_log(g_fw_dns_plug_info.logger, 
+								RLOG_LV_DEBUG,
+								"SCAN_DOMAIN",
+								"Scan domain: %s qtype: %d ret: %d addr: %s",
+								(char *)dns_info->query_question.qname,
+								dns_info->query_question.qtype,
+								ret,
+								printaddr(&a_stream->addr, thread_seq)
+								);
+								
+	}
+
+	if(hit_num>0)
+	{
+		p_result=tsg_fetch_deny_rule(result, hit_num);
+		
+		if(p_result!=NULL)
+		{
+			state=fw_dns_action(a_stream, dns_info, p_result, a_packet);
+			hit_num=1;
+		}
+
+		fw_dns_send_log(a_stream, dns_info, result, hit_num, thread_seq);
+	}
+
+
+	return state;
+}
+
+extern "C" int FW_DNS_PLUG_INIT(void)
+{
+	int level=30,ret=0;
+	char log_path[256]={0};
+	memset(&g_fw_dns_plug_info, 0, sizeof(g_fw_dns_plug_info));
+
+	MESA_load_profile_int_def(g_fw_dns_conffile, "DNS_PLUG", "LOG_LEVEL", &level, 30);
+	MESA_load_profile_string_def(g_fw_dns_conffile, "DNS_PLUG", "LOG_PATH", log_path, sizeof(log_path), "tsglog/fw_dns_plug/fw_dns_plug");
+
+
+	MESA_load_profile_string_def(g_fw_dns_conffile, "DNS_PLUG", "TABLE_QNAME", g_fw_dns_plug_info.table_qname, MAX_TABLE_NAME_LEN, "TSG_FIELD_DNS_QNAME");
+
+	g_fw_dns_plug_info.logger=MESA_create_runtime_log_handle(log_path, level);
+	if(g_fw_dns_plug_info.logger==NULL)
+	{
+		printf("MESA_create_runtime_log_handle failed, log_path: %s level: %d", (log_path==NULL) ? NULL : log_path, level);
+		return -1;
+	}
+
+	g_fw_dns_plug_info.table_qname_id=Maat_table_register(g_tsg_maat_feather, g_fw_dns_plug_info.table_qname);
+	if(g_fw_dns_plug_info.table_qname_id<0)
+	{
+		MESA_handle_runtime_log(g_fw_dns_plug_info.logger, RLOG_LV_FATAL, "REGISTER_TABLE", "Maat_table_register failed, table_name: %s", g_fw_dns_plug_info.table_qname);
+		return -1;
+	}
+
+	ret=fw_dns_rule_init(g_fw_dns_conffile, g_fw_dns_plug_info.logger);
+	if(ret<0)
+	{
+		return -1;
+	}
+	
+	return 0;
+}
+
+
+extern "C" void FW_DNS_PLUG_DESTORY(void)
+{
+	return ;
+}
+
diff --git a/src/fw_dns_plug.h b/src/fw_dns_plug.h
new file mode 100644
index 0000000..ea95307
--- /dev/null
+++ b/src/fw_dns_plug.h
@@ -0,0 +1,15 @@
+#ifndef	__FW_DNS_PLUG_H__
+#define	__FW_DNS_PLUG_H__
+
+#include "fw_dns_rule.h"
+
+#define	MAX_ANSWER_RECORDS_NUM	32
+
+struct _fw_dns_plug
+{
+	int table_qname_id;
+	char table_qname[MAX_TABLE_NAME_LEN];
+	void *logger;
+};
+
+#endif
\ No newline at end of file
diff --git a/src/fw_dns_rule.cpp b/src/fw_dns_rule.cpp
new file mode 100644
index 0000000..3756a4d
--- /dev/null
+++ b/src/fw_dns_rule.cpp
@@ -0,0 +1,196 @@
+#include <stdio.h>
+#include <arpa/inet.h>
+
+#include <MESA/stream.h>
+#include <MESA/dns.h>
+#include <MESA/cJSON.h>
+
+#include <MESA_prof_load.h>
+#include <MESA/Maat_rule.h>
+#include <MESA/MESA_handle_logger.h>
+
+#include "tsg_rule.h"
+#include "fw_dns_rule.h"
+
+fw_dns_rule_t g_fw_dns_rule_info;
+char FW_DNS_RULE_VERSION_20191201=0;
+
+struct _str2index str2index[]={{DNS_TYPE_CNAME,	5, (char *)"CNAME"},
+								{DNS_TYPE_MX,	2, (char *)"MX"},
+								{DNS_TYPE_A, 	1, (char *)"A"},
+								{DNS_TYPE_NS,	2, (char *)"NS"},
+								{DNS_TYPE_AAAA,	4, (char *)"AAAA"},
+								{DNS_TYPE_TXT,	3, (char *)"TXT"},
+								{DNS_TYPE_PTR,	3, (char *)"PTR"}
+								};
+
+int fw_dns_type2index(char *type)
+{
+	int i=0;
+	
+	for(i=0; i<(int)(sizeof(str2index)/sizeof(struct _str2index)); i++)
+	{
+		if(str2index[i].len==(int)strlen(type) && (strncasecmp(str2index[i].type, type, str2index[i].len))==0)
+		{
+			return str2index[i].index;
+		}
+	}
+
+	return -1;
+}
+
+int get_cheat_opt(int record_id, int select_num, int ttl, int atype, cheat_pkt_opt_t* cheat_opt, int cheat_opt_num)
+{
+	int i=0,idx=0;
+	int used_num=0,real_num=0;
+	cb_rule_t *cb_rule=NULL;
+	
+	real_num=(select_num>cheat_opt_num) ? cheat_opt_num : select_num;
+	
+	cb_rule=(cb_rule_t *)Maat_plugin_get_EX_data(g_tsg_maat_feather, g_fw_dns_rule_info.table_records_id, (char *)&record_id);
+	if(cb_rule!=NULL && real_num>0)
+	{
+		idx = (cb_rule->record_num>=real_num) ? (random()%(cb_rule->record_num-real_num+1)) : 0;
+		for(i=0; i<real_num && i+idx<cb_rule->record_num; i++)
+		{
+			cheat_opt[used_num].ttl=ttl;
+			cheat_opt[used_num].res_type=atype;
+			cheat_opt[used_num].cfg_type=atype;
+			switch(atype)
+			{
+				case	DNS_TYPE_A:
+					cheat_opt[used_num].res_len=sizeof(unsigned int);
+					break;
+				case	DNS_TYPE_AAAA:
+					cheat_opt[used_num].res_len=IPV6_ADDR_LEN;
+					break;
+				default:					
+					cheat_opt[used_num].res_len=MIN(strlen((char *)(cb_rule->record_values[i+idx])), sizeof(cheat_opt[used_num].res_info)-1);
+					break;
+			}
+			
+			memcpy(cheat_opt[used_num].res_info, (char *)(cb_rule->record_values[i+idx]), cheat_opt[used_num].res_len);
+			used_num++;
+		}
+	}
+	
+	return used_num;
+}
+
+
+void fw_dns_EX_data_create(int table_id, const char* key, const char* table_line, MAAT_PLUGIN_EX_DATA* ad, long argl, void *argp)
+{
+	int i=0;
+	cJSON *pSub=NULL;
+	cb_rule_t *cb_rule=(cb_rule_t *)calloc(1, sizeof(cb_rule_t));
+	char *tmp_records=(char *)calloc(1, strlen(table_line)+1);
+		
+	sscanf(table_line, "%d	%s	%s	%s	%d", &cb_rule->record_id, cb_rule->record_name, cb_rule->record_type, tmp_records, &cb_rule->is_valid);
+
+	int index=fw_dns_type2index(cb_rule->record_type);
+
+	cJSON *tmp_array=cJSON_Parse(tmp_records);	
+	if(tmp_array != NULL)
+	{
+		cb_rule->record_num=cJSON_GetArraySize(tmp_array);
+		*cb_rule->record_values=(void *)malloc(cb_rule->record_num*sizeof(void *));
+		
+		for(i=0; i<cb_rule->record_num; i++)
+		{
+			pSub = cJSON_GetArrayItem(tmp_array, i);
+			if(NULL==pSub )
+			{
+				continue; 
+			}
+
+			switch(index)
+			{
+				case	DNS_TYPE_A:
+					cb_rule->record_values[i]=calloc(1, sizeof(unsigned int));
+					inet_pton(AF_INET, pSub->valuestring, cb_rule->record_values[i]);
+					break;
+				case	DNS_TYPE_AAAA:
+					cb_rule->record_values[i]=calloc(1, IPV6_ADDR_LEN);
+					inet_pton(AF_INET6, pSub->valuestring, cb_rule->record_values[i]);
+					break;
+				case	DNS_TYPE_MX:
+					break;
+				case	DNS_TYPE_NS:
+				case	DNS_TYPE_TXT:
+				case	DNS_TYPE_PTR:
+				case	DNS_TYPE_CNAME:
+					cb_rule->record_values[i]=calloc(1, strlen(pSub->valuestring)+1);
+					memcpy(cb_rule->record_values[i], pSub->valuestring, strlen(pSub->valuestring));
+					break;
+				default:
+					continue;	
+			}
+		}
+	}
+
+	free(tmp_records);
+}
+
+void fw_dns_EX_data_free(int table_id, MAAT_PLUGIN_EX_DATA* ad, long argl, void *argp)
+{
+	int i=0;
+	cb_rule_t *cb_rule=(cb_rule_t *)*ad;
+	
+	if(cb_rule!=NULL)
+	{
+		for(i=0; i<cb_rule->record_num; i++)
+		{
+			free(cb_rule->record_values[i]);
+			cb_rule->record_values[i]=NULL;
+		}
+		free(*cb_rule->record_values);
+		*cb_rule->record_values=NULL;
+
+		free(cb_rule);
+		cb_rule=NULL;
+	}
+}
+void fw_dns_EX_data_dup(int table_id, MAAT_PLUGIN_EX_DATA *to, MAAT_PLUGIN_EX_DATA *from, long argl, void *argp)
+{
+	
+}
+
+int fw_dns_EX_data_key2index(const char* key)
+{
+	return 0;
+}
+
+
+int fw_dns_rule_init(const char *conffile, void *logger)
+{
+	int ret=0;
+	long arg=0;
+	memset(&g_fw_dns_rule_info, 0, sizeof(g_fw_dns_rule_info));
+	
+	MESA_load_profile_string_def(conffile, "DNS_PLUG", "TABLE_RECORDS", g_fw_dns_rule_info.table_records_name, MAX_TABLE_NAME_LEN, (char *)"FW_PROFILE_DNS_RECORDS");
+
+	g_fw_dns_rule_info.table_records_id=Maat_table_register(g_tsg_maat_feather, g_fw_dns_rule_info.table_records_name);
+	if(g_fw_dns_rule_info.table_records_id<0)
+	{
+		MESA_handle_runtime_log(logger, RLOG_LV_FATAL, "REGISTER_TABLE", "Maat_table_register failed, table_name: %s", g_fw_dns_rule_info.table_records_name);
+		return -1;
+	}
+
+	ret=Maat_plugin_EX_register(g_tsg_maat_feather,
+								g_fw_dns_rule_info.table_records_id,
+								fw_dns_EX_data_create,
+								fw_dns_EX_data_free,
+								fw_dns_EX_data_dup,
+								fw_dns_EX_data_key2index,
+								arg, 
+								NULL);
+
+	if(ret<0)
+	{
+		MESA_handle_runtime_log(logger, RLOG_LV_FATAL, "REGISTER_TABLE", "Maat_plugin_EX_register failed, table_name: %s", g_fw_dns_rule_info.table_records_name);
+		return -1;
+	}
+
+	return 0;
+}
+
diff --git a/src/fw_dns_rule.h b/src/fw_dns_rule.h
new file mode 100644
index 0000000..5933b71
--- /dev/null
+++ b/src/fw_dns_rule.h
@@ -0,0 +1,36 @@
+#ifndef	__FW_DNS_RULE_H__
+#define	__FW_DNS_RULE_H__
+
+#define	MIN(a, b) ((a>b) ? b: a)
+
+#define	MAX_TABLE_NAME_LEN	32
+
+struct _str2index
+{
+	int index;
+	int len;
+	char *type;
+};
+
+typedef struct _cb_rule
+{
+	int record_id;
+	int record_num;
+	int is_valid;
+	char record_type[128];
+	char record_name[MAX_TABLE_NAME_LEN];
+	void **record_values;
+}cb_rule_t;
+
+typedef struct _fw_dns_rule
+{
+	int table_records_id;
+	char table_records_name[MAX_TABLE_NAME_LEN];
+}fw_dns_rule_t;
+
+
+int fw_dns_type2index(char *type);
+int fw_dns_rule_init(const char *conffile, void *logger);
+int get_cheat_opt(int record_id, int select_num, int ttl, int atype, cheat_pkt_opt_t* cheat_opt, int cheat_opt_num);
+	
+#endif