diff options
| -rw-r--r-- | common/include/tfe_resource.h | 4 | ||||
| -rw-r--r-- | common/src/tfe_resource.cpp | 8 | ||||
| -rw-r--r-- | common/src/tfe_scan.cpp | 37 | ||||
| -rw-r--r-- | resource/pangu/pangu_http.json | 122 |
4 files changed, 151 insertions, 20 deletions
diff --git a/common/include/tfe_resource.h b/common/include/tfe_resource.h index 91a42fa..a35e5cf 100644 --- a/common/include/tfe_resource.h +++ b/common/include/tfe_resource.h @@ -1,5 +1,7 @@ #pragma once +#include <uuid/uuid.h> + enum category_type { CATEGORY_TYPE_UNKNOWN = 0, @@ -17,7 +19,7 @@ struct app_id_dict { int ref_cnt; int app_id; - int object_id; + uuid_t object_uuid; pthread_mutex_t lock; }; diff --git a/common/src/tfe_resource.cpp b/common/src/tfe_resource.cpp index 07295c2..0c51392 100644 --- a/common/src/tfe_resource.cpp +++ b/common/src/tfe_resource.cpp @@ -247,12 +247,12 @@ void app_dict_table_new_cb(const char *table_name, const char* key, const char* app_dict->app_id = item->valueint; } - item = cJSON_GetObjectItem(app_id_dict_json, "object_id"); - if(item && item->type==cJSON_Number) + item = cJSON_GetObjectItem(app_id_dict_json, "uuid"); + if(item && item->type==cJSON_String) { - app_dict->object_id = item->valueint; + uuid_parse(item->valuestring, app_dict->object_uuid); } - + cJSON_Delete(app_id_dict_json); app_dict->ref_cnt=1; pthread_mutex_init(&(app_dict->lock), NULL); diff --git a/common/src/tfe_scan.cpp b/common/src/tfe_scan.cpp index 10ec11f..b2d7f13 100644 --- a/common/src/tfe_scan.cpp +++ b/common/src/tfe_scan.cpp @@ -3,12 +3,12 @@ #include <tfe_scan.h> #include <MESA/stream.h> -static int scan_string(uuid_t *result, struct maat_state *scan_mid, int hit_cnt,const char *data, const char *table_name, const char *attribute_name) +static int scan_object(uuid_t *result, struct maat_state *scan_mid, int hit_cnt, struct maat_hit_object objects, const char *table_name, const char *attribute_name) { size_t n_hit_result=0; int scan_ret=0, hit_cnt_group=0; - scan_ret = maat_scan_string(tfe_get_maat_handle(), table_name, attribute_name, data, strlen(data), result+hit_cnt+hit_cnt_group, + scan_ret = maat_scan_object(tfe_get_maat_handle(), table_name, attribute_name, &objects, 1, result+hit_cnt+hit_cnt_group, MAX_SCAN_RESULT-hit_cnt-hit_cnt_group, &n_hit_result, scan_mid); if(scan_ret == MAAT_SCAN_HIT) { @@ -210,6 +210,7 @@ int tfe_get_library_tags(const struct tfe_stream *stream, cJSON *common_obj, tfe int tfe_scan_ip_tags(const struct tfe_stream *stream, uuid_t *result, struct maat_state *scan_mid, int hit_cnt, void *logger) { size_t n_hit_result = 0; + struct maat_hit_object objects; char tag_id_array[128][UUID_STRING_SIZE]; char result_str[UUID_STRING_SIZE]={0}; int scan_ret = 0, hit_cnt_ip = 0, n_tag_ids = 0; @@ -225,7 +226,9 @@ int tfe_scan_ip_tags(const struct tfe_stream *stream, uuid_t *result, struct maa for (int i = 0; i < n_tag_ids; i++) { - scan_ret = maat_scan_string(tfe_get_maat_handle(), "TSG_OBJ_IP_ADDR", "ATTR_SOURCE_IP", tag_id_array[i], strlen(tag_id_array[i]), result+hit_cnt+hit_cnt_ip, + memset(&objects, 0, sizeof(objects)); + uuid_copy(objects.object_uuid, opt_val[i]); + scan_ret = maat_scan_object(tfe_get_maat_handle(), "TSG_OBJ_IP_ADDR", "ATTR_SOURCE_IP", &objects, 1, result+hit_cnt+hit_cnt_ip, MAX_SCAN_RESULT-hit_cnt-hit_cnt_ip, &n_hit_result, scan_mid); if(scan_ret == MAAT_SCAN_HIT) { @@ -258,7 +261,9 @@ int tfe_scan_ip_tags(const struct tfe_stream *stream, uuid_t *result, struct maa for (int i = 0; i < n_tag_ids; i++) { - scan_ret = maat_scan_string(tfe_get_maat_handle(), "TSG_OBJ_IP_ADDR", "ATTR_DESTINATION_IP", tag_id_array[i], strlen(tag_id_array[i]), result+hit_cnt+hit_cnt_ip, + memset(&objects, 0, sizeof(objects)); + uuid_copy(objects.object_uuid, opt_val[i]); + scan_ret = maat_scan_object(tfe_get_maat_handle(), "TSG_OBJ_IP_ADDR", "ATTR_DESTINATION_IP", &objects, 1, result+hit_cnt+hit_cnt_ip, MAX_SCAN_RESULT-hit_cnt-hit_cnt_ip, &n_hit_result, scan_mid); if(scan_ret==MAAT_SCAN_HIT) { @@ -283,6 +288,7 @@ int tfe_scan_ip_tags(const struct tfe_stream *stream, uuid_t *result, struct maa int tfe_scan_fqdn_tags(const struct tfe_stream *stream, uuid_t *result, struct maat_state *scan_mid, int hit_cnt, void *logger) { uuid_t opt_val[128]={0}; + struct maat_hit_object objects; char tag_id_array[128][UUID_STRING_SIZE]; int scan_ret = 0, hit_cnt_fqdn = 0, n_tag_ids = 0; @@ -296,7 +302,9 @@ int tfe_scan_fqdn_tags(const struct tfe_stream *stream, uuid_t *result, struct m for (int i = 0; i < n_tag_ids; i++) { - scan_ret = scan_string(result, scan_mid, hit_cnt, tag_id_array[i], "TSG_OBJ_FQDN", "ATTR_SERVER_FQDN"); + memset(&objects, 0, sizeof(objects)); + uuid_copy(objects.object_uuid, opt_val[i]); + scan_ret = scan_object(result, scan_mid, hit_cnt, objects, "TSG_OBJ_FQDN", "ATTR_SERVER_FQDN"); if (scan_ret > 0) { char result_str[UUID_STRING_SIZE]={0}; @@ -317,11 +325,14 @@ int tfe_scan_app_id(uuid_t *result, struct maat_state *scan_mid, int hit_cnt, lo int scan_ret = 0; int hit_app_id = 0; size_t n_hit_result = 0; + struct maat_hit_object objects; struct app_id_dict *app_dict = (struct app_id_dict*)maat_plugin_table_get_ex_data(tfe_get_maat_handle(), "APP_ID_DICT", (const char *)&app_id, sizeof(long long)); if(app_dict!=NULL) { - scan_ret=maat_scan_integer(tfe_get_maat_handle(), "APP_ID_DICT", "ATTR_APP_ID", app_dict->object_id, result+hit_cnt+hit_app_id, + memset(&objects, 0, sizeof(objects)); + uuid_copy(objects.object_uuid, app_dict->object_uuid); + scan_ret=maat_scan_object(tfe_get_maat_handle(), "APP_ID_DICT", "ATTR_APP_ID", &objects, 1, result+hit_cnt+hit_app_id, MAX_SCAN_RESULT-hit_cnt-hit_app_id, &n_hit_result, scan_mid); if(scan_ret==MAAT_SCAN_HIT) { @@ -452,10 +463,15 @@ int tfe_scan_ipv4_addr(const struct tfe_stream *stream, uuid_t *result, struct m { int scan_ret = 0; int hit_cnt_ip = 0; + uuid_t objects_uuid; size_t n_hit_result = 0; + struct maat_hit_object objects; const char *protocol_uuid =PROTOCOL_TCP_UUID_ID; - scan_ret = maat_scan_string(tfe_get_maat_handle(), "TSG_OBJ_IP_PROTOCOL", "ATTR_IP_PROTOCOL", protocol_uuid, strlen(protocol_uuid), result+hit_cnt+hit_cnt_ip, + memset(&objects, 0, sizeof(objects)); + uuid_parse(protocol_uuid, objects_uuid); + uuid_copy(objects.object_uuid, objects_uuid); + scan_ret = maat_scan_object(tfe_get_maat_handle(), "TSG_OBJ_IP_PROTOCOL", "ATTR_IP_PROTOCOL", &objects, 1, result+hit_cnt+hit_cnt_ip, MAX_SCAN_RESULT-hit_cnt-hit_cnt_ip, &n_hit_result, scan_mid); if(scan_ret==MAAT_SCAN_HIT) { @@ -512,9 +528,14 @@ int tfe_scan_ipv6_addr(const struct tfe_stream *stream, uuid_t *result, struct m int scan_ret = 0; int hit_cnt_ip = 0; size_t n_hit_result = 0; + uuid_t objects_uuid; + struct maat_hit_object objects; const char *protocol_uuid =PROTOCOL_TCP_UUID_ID; - scan_ret = maat_scan_string(tfe_get_maat_handle(), "TSG_OBJ_IP_PROTOCOL", "ATTR_IP_PROTOCOL", protocol_uuid, strlen(protocol_uuid), result+hit_cnt+hit_cnt_ip, + memset(&objects, 0, sizeof(objects)); + uuid_parse(protocol_uuid, objects_uuid); + uuid_copy(objects.object_uuid, objects_uuid); + scan_ret = maat_scan_object(tfe_get_maat_handle(), "TSG_OBJ_IP_PROTOCOL", "ATTR_IP_PROTOCOL", &objects, 1, result+hit_cnt+hit_cnt_ip, MAX_SCAN_RESULT-hit_cnt-hit_cnt_ip, &n_hit_result, scan_mid); if(scan_ret==MAAT_SCAN_HIT) { diff --git a/resource/pangu/pangu_http.json b/resource/pangu/pangu_http.json index 5798ee4..0ddf0c3 100644 --- a/resource/pangu/pangu_http.json +++ b/resource/pangu/pangu_http.json @@ -3,7 +3,7 @@ "object2object_table": "OBJECT_GROUP", "rules": [ { - "uuid": "40c9c6a7-70a9-48ae-9fba-ec7966edd3c6", + "uuid": "00001021-0000-0000-0000-000000000000", "service": 1, "action": "manipulate", "blacklist_option": 1, @@ -20,7 +20,115 @@ "table_name": "TSG_OBJ_URL", "table_type": "expr", "table_content": { - "keywords": "test123456", + "expression": "baidu.com", + "expr_type": "and" + } + } + ] + } + ] + }, + { + "attribute_name": "ATTR_APP_ID", + "negate_option": false, + "object_uuids": [ + "00000201-0000-0000-0000-000000000000" + ] + } + ] + }, + { + "uuid": "00001023-0000-0000-0000-000000000000", + "service": 1, + "action": "manipulate", + "blacklist_option": 1, + "log_option": "all", + "action_parameter": {"protocol":"http","method":"replace","rules":[{"search_in":"http_resp_body","find":"����","replace_with":"test"}]}, + "is_valid": "yes", + "conditions": [ + { + "attribute_name": "ATTR_SERVER_FQDN", + "objects": [ + { + "items": [ + { + "table_name": "TSG_OBJ_FQDN", + "table_type": "expr", + "table_content": { + "expression": "baidu.com", + "expr_type": "and" + } + } + ] + } + ] + } + ] + }, + { + "uuid": "00001026-0000-0000-0000-000000000000", + "service": 1, + "action": "manipulate", + "blacklist_option": 1, + "log_option": "all", + "action_parameter": {"protocol":"http","method":"block","code":403,"message":"error"}, + "is_valid": "yes", + "conditions": [ + { + "attribute_name": "ATTR_HTTP_REQ_HDR", + "objects": [ + { + "items": [ + { + "table_name": "TSG_OBJ_KEYWORD", + "table_type": "expr", + "table_content": { + "expression": "Chrome", + "expr_type": "and" + } + } + ] + } + ] + }, + { + "attribute_name": "ATTR_HTTP_REQ_HDR", + "objects": [ + { + "items": [ + { + "table_name": "TSG_OBJ_KEYWORD", + "table_type": "expr", + "table_content": { + "expression": "uid=12345678", + "expr_type": "and" + } + } + ] + } + ] + } + ] + }, + { + "uuid": "00001028-0000-0000-0000-000000000000", + "service": 1, + "action": "manipulate", + "blacklist_option": 1, + "log_option": "all", + "action_parameter": {"protocol":"http","method":"block","code":403,"message":"error"}, + "is_valid": "yes", + "conditions": [ + { + "attribute_name": "ATTR_HTTP_URL", + "objects": [ + { + "items": [ + { + "table_name": "TSG_OBJ_URL", + "table_type": "expr", + "table_content": { + "expression": "bing.com", "expr_type": "and" } } @@ -41,19 +149,19 @@ { "table_name": "TSG_PROFILE_RESPONSE_PAGES", "table_content": [ - {"uuid":"RESPONSE-PAGES-0000-0000-000000000001","profile_name":"404","format":"html","path":"./resource/pangu/policy_file/404.html","is_valid":1,"modified_time":"1716531859000000"} + {"uuid":"00000101-0000-0000-0000-000000000000","profile_name":"404","format":"html","path":"./resource/pangu/policy_file/404.html","is_valid":1,"modified_time":"1716531859000000"} ] }, { "table_name": "PXY_PROFILE_HIJACK_FILES", "table_content": [ - {"uuid":"HIJACK-FILES-0000-0000-000000000001","profile_name":"chakanqi","content_name":"chakanqi-947KB.exe","content_type":"application/x-msdos-program","path":"./resource/pangu/policy_file/chakanqi-947KB.exe","is_valid":1,"modified_time":"1716531859000000"} + {"uuid":"00000201-0000-0000-0000-000000000000","profile_name":"chakanqi","content_name":"chakanqi-947KB.exe","content_type":"application/x-msdos-program","path":"./resource/pangu/policy_file/chakanqi-947KB.exe","is_valid":1,"modified_time":"1716531859000000"} ] }, { "table_name": "PXY_PROFILE_INSERT_SCRIPTS", "table_content": [ - {"uuid":"INSERT-SCRIPTS-0000-0000-000000000001","profile_name":"time","format":"js","insert_on":"before_page_load","path":"./resource/pangu/policy_file/time.js","is_valid":1,"modified_time":"1716531859000000"} + {"uuid":"00000301-0000-0000-0000-000000000000","profile_name":"time","format":"js","insert_on":"before_page_load","path":"./resource/pangu/policy_file/time.js","is_valid":1,"modified_time":"1716531859000000"} ] }, { @@ -95,8 +203,8 @@ { "table_name": "APP_ID_DICT", "table_content": [ - {"app_id":67,"object_id":201,"app_name":"http","parent_app_id":0,"parent_app_name":null,"category":"general-internet","subcategory":"internet-utility","content":"unknown","risk":"1","characteristics":null,"deny_action":null,"depends_on_app_ids":"null","implicitly_uses_app_ids":"null","continue_scanning":0,"tcp_timeout":120,"udp_timeout":120,"tcp_half_close":0,"tcp_time_wait":0,"is_valid":1,"modified_time":"1716531859000000"}, - {"app_id":68,"object_id":68000,"app_name":"https","parent_app_id":0,"parent_app_name":null,"category":"general-internet","subcategory":"internet-utility","content":"unknown","risk":"1","characteristics":null,"deny_action":null,"depends_on_app_ids":"null","implicitly_uses_app_ids":"null","continue_scanning":0,"tcp_timeout":120,"udp_timeout":120,"tcp_half_close":0,"tcp_time_wait":0,"is_valid":1,"modified_time":"1716531859000000"} + {"app_id":67,"object_uuid":"00000201-0000-0000-0000-000000000000","app_name":"http","parent_app_id":0,"parent_app_name":null,"category":"general-internet","subcategory":"internet-utility","content":"unknown","risk":"1","characteristics":null,"deny_action":null,"depends_on_app_ids":"null","implicitly_uses_app_ids":"null","continue_scanning":0,"tcp_timeout":120,"udp_timeout":120,"tcp_half_close":0,"tcp_time_wait":0,"is_valid":1,"modified_time":"1716531859000000"}, + {"app_id":68,"object_uuid":"00068000-0000-0000-0000-000000000000","app_name":"https","parent_app_id":0,"parent_app_name":null,"category":"general-internet","subcategory":"internet-utility","content":"unknown","risk":"1","characteristics":null,"deny_action":null,"depends_on_app_ids":"null","implicitly_uses_app_ids":"null","continue_scanning":0,"tcp_timeout":120,"udp_timeout":120,"tcp_half_close":0,"tcp_time_wait":0,"is_valid":1,"modified_time":"1716531859000000"} ] } ] |