diff options
| -rw-r--r-- | ci/travis.sh | 2 | ||||
| -rw-r--r-- | common/include/verify_policy.h | 2 | ||||
| -rw-r--r-- | conf/verify_policy.conf | 4 | ||||
| -rw-r--r-- | platform/CMakeLists.txt | 2 | ||||
| -rw-r--r-- | platform/src/verify_matcher.cpp | 1053 | ||||
| -rw-r--r-- | resource/table_info.conf | 1021 | ||||
| -rw-r--r-- | resource/table_info_simple.conf | 993 | ||||
| -rw-r--r-- | resource/verify-policy.json | 629 | ||||
| -rw-r--r-- | test/CMakeLists.txt | 2 | ||||
| -rw-r--r-- | test/resource/HitPolicyRequest.json | 87 | ||||
| -rw-r--r-- | test/resource/HitPolicyResult.json | 485 | ||||
| -rw-r--r-- | test/resource/VerifyPolicyManipulation.json | 778 | ||||
| -rw-r--r-- | test/verify_policy_test.cpp | 52 |
13 files changed, 1799 insertions, 3311 deletions
diff --git a/ci/travis.sh b/ci/travis.sh index 356baf1..b609f95 100644 --- a/ci/travis.sh +++ b/ci/travis.sh @@ -33,7 +33,7 @@ env | sort : "${COMPILER_IS_GNUCXX:=OFF}" # Install dependency from YUM -yum install -y libcjson-devel libmaatframe-devel libfieldstat4-devel libMESA_prof_load-devel sapp-devel +yum install -y libcjson-devel libmaatframe-devel libfieldstat4-devel libMESA_prof_load-devel sapp-devel libuuid-devel mkdir build || true cd build diff --git a/common/include/verify_policy.h b/common/include/verify_policy.h index 1856894..d35bc57 100644 --- a/common/include/verify_policy.h +++ b/common/include/verify_policy.h @@ -22,7 +22,7 @@ enum verify_type VERIFY_TYPE_REGEX }; -enum compile_table_typle +enum policy_rule_type { TSG_TABLE_SECURITY, PXY_TABLE_MANIPULATION, diff --git a/conf/verify_policy.conf b/conf/verify_policy.conf index 230464b..f4ee2c3 100644 --- a/conf/verify_policy.conf +++ b/conf/verify_policy.conf @@ -14,15 +14,13 @@ breakpad_upload_url="http://127.0.0.1/" thread-nu = 4 [maat] -# 0:json 1: redis 2: iris +# 0:json 1: redis maat_input_mode=1 table_info=./resource/table_info.conf json_cfg_file=./resource/verify-policy.json stat_switch=1 stat_file=log/maat_stat.db -full_cfg_dir=verify-policy/ -inc_cfg_dir=verify-policy/ maat_redis_server=192.168.40.131 maat_redis_port_range=7002 diff --git a/platform/CMakeLists.txt b/platform/CMakeLists.txt index 30a8a9b..c61c7ff 100644 --- a/platform/CMakeLists.txt +++ b/platform/CMakeLists.txt @@ -6,6 +6,6 @@ add_executable(verify-policy src/verify_policy.cpp src/verify_matcher.cpp) #target_include_directories(verify-policy PUBLIC ${CMAKE_CURRENT_LIST_DIR}/include) -target_link_libraries(verify-policy common cjson maatframe) +target_link_libraries(verify-policy common cjson maatframe uuid) target_link_libraries(verify-policy pthread dl libevent-static MESA_prof_load breakpad-client-static cjson ${SYSTEMD_LIBRARIES}) diff --git a/platform/src/verify_matcher.cpp b/platform/src/verify_matcher.cpp index bdb751e..491331a 100644 --- a/platform/src/verify_matcher.cpp +++ b/platform/src/verify_matcher.cpp @@ -18,6 +18,7 @@ #include <MESA/MESA_prof_load.h> #include <MESA/stream.h> +#include <uuid/uuid.h> #include <cjson/cJSON.h> #include "utils.h" @@ -25,7 +26,7 @@ #include "verify_policy.h" #define MAX_EX_DATA_LEN 16 -#define HIT_PATH_SIZE 4096 +#define HIT_PATH_SIZE 1024 #define MAX_SCAN_RESULT 16 #define MAX_REGEX_EXPRESS_NUM 32 #define MERGE_SCAN_NTH 128 @@ -82,6 +83,56 @@ const char * table_name[__TSG_OBJ_MAX] = [TSG_OBJ_TUNNEL_IP_IN_IP_ENDPOINT]="ATTR_TUNNEL_IP_IN_IP_ENDPOINT" }; +const char *scan_table_name[__TSG_OBJ_MAX] = +{ + [TSG_OBJ_SOURCE_ADDR] = "TSG_OBJ_IP_ADDR", + [TSG_OBJ_DESTINATION_ADDR]="TSG_OBJ_IP_ADDR", + [TSG_OBJ_SUBSCRIBE_ID] = "TSG_OBJ_SUBSCRIBER_ID", + [TSG_OBJ_APP_ID] = "APP_ID_DICT", + [TSG_OBJ_HTTP_URL] = "TSG_OBJ_URL", + [TSG_OBJ_HTTP_REQ_HDR] = "TSG_OBJ_KEYWORD", + [TSG_OBJ_HTTP_REQ_BODY] = "TSG_OBJ_KEYWORD", + [TSG_OBJ_HTTP_RES_HDR] = "TSG_OBJ_KEYWORD", + [TSG_OBJ_HTTP_RES_BODY] = "TSG_OBJ_KEYWORD", + [TSG_OBJ_SSL_CN] = "TSG_OBJ_FQDN", + [TSG_OBJ_SSL_SAN] = "TSG_OBJ_FQDN", + [TSG_OBJ_DOH_QNAME]="TSG_OBJ_FQDN", + [TSG_OBJ_DNS_QNAME] = "TSG_OBJ_FQDN", + [TSG_OBJ_MAIL_ACCOUNT] = "TSG_OBJ_ACCOUNT", + [TSG_OBJ_MAIL_FROM] = "TSG_OBJ_ACCOUNT", + [TSG_OBJ_MAIL_TO] = "TSG_OBJ_ACCOUNT", + [TSG_OBJ_MAIL_SUBJECT] = "TSG_OBJ_KEYWORD", + [TSG_OBJ_MAIL_CONTENT] = "TSG_OBJ_KEYWORD", + [TSG_OBJ_MAIL_ATT_NAME] = "TSG_OBJ_KEYWORD", + [TSG_OBJ_MAIL_ATT_CONTENT] = "TSG_OBJ_KEYWORD", + [TSG_OBJ_FTP_URI] = "TSG_OBJ_URL", + [TSG_OBJ_FTP_CONTENT] = "TSG_OBJ_KEYWORD", + [TSG_OBJ_FTP_ACCOUNT] = "TSG_OBJ_ACCOUNT", + [TSG_OBJ_SIP_FROM]="TSG_OBJ_ACCOUNT", + [TSG_OBJ_SIP_TO]="TSG_OBJ_ACCOUNT", + [TSG_OBJ_IMSI]="TSG_OBJ_IMSI", + [TSG_OBJ_PHONE_NUMBER]="TSG_OBJ_PHONE_NUMBER", + [TSG_OBJ_APN]="TSG_OBJ_APN", + [TSG_OBJ_TUNNEL]="TUNNEL_RULE", + [TSG_OBJ_FLAG]="TSG_OBJ_FLAG", + [TSG_OBJ_GTP_IMEI]="TSG_OBJ_IMEI", + [TSG_OBJ_DST_SERVER_FQDN]="TSG_OBJ_FQDN", + [TSG_OBJ_INTERNAL_ADDR]="IP_ADDR_ENTRY", + [TSG_OBJ_EXTERNAL_ADDR]="IP_ADDR_ENTRY", + [TSG_OBJ_SOURCE_PORT]="TSG_OBJ_PORT", + [TSG_OBJ_DESTINATION_PORT]="TSG_OBJ_PORT", + [TSG_OBJ_INTERNAL_PORT]="TSG_OBJ_PORT", + [TSG_OBJ_EXTERNAL_PORT]="TSG_OBJ_PORT", + [TSG_OBJ_IP_PROTOCOL]="TSG_OBJ_IP_PROTOCOL", + [TSG_OBJ_SSL_ECH]="TSG_OBJ_BOOLEAN", + [TSG_OBJ_SSL_ESNI]="TSG_OBJ_BOOLEAN", + [TSG_OBJ_SSL_NO_SNI]="TSG_OBJ_BOOLEAN", + [TSG_OBJ_TUNNEL_LEVEL]="TSG_OBJ_TUNNEL_LEVEL", + [TSG_OBJ_TUNNEL_GTP_ENDPOINT]="ATTR_TUNNEL_GTP_ENDPOINT", + [TSG_OBJ_TUNNEL_GRE_ENDPOINT]="ATTR_TUNNEL_GRE_ENDPOINT", + [TSG_OBJ_TUNNEL_IP_IN_IP_ENDPOINT]="ATTR_TUNNEL_IP_IN_IP_ENDPOINT" +}; + enum policy_action { PG_ACTION_NONE = 0, @@ -111,9 +162,6 @@ enum http_std_field enum verify_profile_table { - PROFILE_TUNNEL_CATALOG, - PROFILE_TUNNEL_ENDPOINT, - PROFILE_TUNNEL_LABEL, PROFILE_APP_DI_DICT, PROFILE_FQDN_ENTRY, PROFILE_IP_ADDR_ENTRY, @@ -131,9 +179,9 @@ struct http_field_name * the current hit path scan count needs to be recorded to correspond to the virtual table name */ struct library_tag_entry { - int tag_id; + char *uuid; + char *tag_uuid; int category; - long long entry_id; }; struct library_hit_path @@ -153,25 +201,12 @@ struct library_scan_path UT_array *ut_array_by_context; }; -struct tunnel_data_ctx -{ - int id; - int ref_cnt; - char *name; - char *type; - char *composition; - char *description; - - long long int group_id; - pthread_mutex_t lock; -}; - struct rule_data_ctx { int ref_cnt; - int config_id; int service_id; - unsigned char action; + unsigned char action; + uuid_t rule_uuid; pthread_mutex_t lock; }; @@ -179,7 +214,7 @@ struct app_id_dict { int ref_cnt; int app_id; - long long int group_id; + uuid_t object_uuid; pthread_mutex_t lock; }; @@ -207,10 +242,10 @@ enum category_type struct library_entry_ctx { int ref_cnt; - int entry_id; - int n_tag_ids; - char *tag_ids; - long long tag_id_array[MAX_TAG_ID_NUM]; + char *uuid; + int n_tag_uuids; + char *tag_uuids; + char *tag_uuid_array[MAX_TAG_ID_NUM]; pthread_mutex_t lock; }; @@ -218,7 +253,7 @@ struct library_entry_ctx struct library_tag_ctx { int ref_cnt; - int tag_id; + char *uuid; char *tag_key; char *tag_value; enum category_type category; @@ -240,7 +275,7 @@ struct policy_scan_ctx size_t n_enforce; struct rule_data_ctx *enforce_rules; int tunnel_attr_count; - long long result[MAX_SCAN_RESULT]; + uuid_t result[MAX_SCAN_RESULT]; struct library_scan_path scan_path; }; @@ -250,6 +285,7 @@ struct request_object_list int numeric; int merge_nth_scan_num; int merge_nth_scan[MERGE_SCAN_NTH]; + const char *table_name; char *string; char *tunnel_type; char *district_value; @@ -286,22 +322,79 @@ struct verify_policy_rt * g_policy_rt; #define MAAT_INPUT_REDIS 1 #define MAAT_INPUT_FILE 2 -#define BOOLEAN_TRUE_GROUP_ID 2 -#define BOOLEAN_FLASE_GROUP_ID 3 -#define PROTOCOL_ANY_GROUP_ID 4 -#define PROTOCOL_ICMP_GROUP_ID 5 -#define PROTOCOL_TCP_GROUP_ID 6 -#define PROTOCOL_UDP_GROUP_ID 7 +#define BOOLEAN_TRUE_OBJECT_UUID "00000000-0000-0000-0000-000000000002" +#define BOOLEAN_FLASE_OBJECT_UUID "00000000-0000-0000-0000-000000000003" +#define PROTOCOL_ANY_OBJECT_UUID "00000000-0000-0000-0000-000000000004" +#define PROTOCOL_ICMP_OBJECT_UUID "00000000-0000-0000-0000-000000000005" +#define PROTOCOL_TCP_OBJECT_UUID "00000000-0000-0000-0000-000000000006" +#define PROTOCOL_UDP_OBJECT_UUID "00000000-0000-0000-0000-000000000007" UT_icd ut_ulonglong_id_icd = {sizeof(struct library_hit_path), NULL, NULL, NULL}; +const char *get_conjunction_table_name(enum policy_rule_type rule_type) +{ + const char *conjunction_table_name_map[] = {"SECURITY_RULE_CONJUNCTION", "PXY_CTRL_RULE_CONJUNCTION", "TRAFFIC_SHAPING_RULE_CONJUNCTION", + "SERVICE_CHAINING_RULE_CONJUNCTION", "PXY_INTERCEPT_RULE_CONJUNCTION","STATISTICS_COMPILE_CONJUNCTION", + "MONITOR_RULE_CONJUNCTION", "DOS_PROTECTION_RULE_CONJUNCTION", "TUNNEL_RULE_CONJUNCTION"}; + size_t table_name_map_len = sizeof(conjunction_table_name_map)/sizeof(conjunction_table_name_map[0]); + + if(table_name_map_len < rule_type) + { + rule_type=TSG_TABLE_SECURITY; + log_error(g_verify_proxy->logger, MODULE_VERIFY_POLICY, "invalid policy rule type"); + } + return conjunction_table_name_map[rule_type]; +} + +const char *get_plugin_table_name(enum policy_rule_type rule_type) +{ + const char *plugin_table_name_map[] = {"SECURITY_RULE_PLUGIN", "PXY_CTRL_RULE_PLUGIN", "TRAFFIC_SHAPING_RULE_PLUGIN", + "SERVICE_CHAINING_RULE_PLUGIN", "PXY_INTERCEPT_RULE_PLUGIN", "STATISTICS_COMPILE_PLUGIN", + "MONITOR_RULE_PLUGIN", "DOS_PROTECTION_RULE_PLUGIN", "TUNNEL_RULE_PLUGIN"}; + + size_t table_name_map_len = sizeof(plugin_table_name_map)/sizeof(plugin_table_name_map[0]); + + if(table_name_map_len < rule_type) + { + rule_type=TSG_TABLE_SECURITY; + log_error(g_verify_proxy->logger, MODULE_VERIFY_POLICY, "invalid policy rule type"); + } + return plugin_table_name_map[rule_type]; +} + +unsigned long long int uuid_to_int64(uuid_t uuid) +{ + unsigned long long int uuid_int = 0; + for (int i = 0; i < 16; i++) { + uuid_int = (uuid_int << 8) | uuid[i]; + } + return uuid_int; +} + +int cJSON_AddUuidToObject(cJSON * const object, const char * const name, uuid_t uuid) +{ + char uuid_str[256]={0}; + uuid_unparse(uuid, uuid_str); + cJSON_AddStringToObject(object, name, uuid_str); + return 1; +} + +const char *get_scan_table_by_table_id(int table_id) +{ + if(table_id < 0 || table_id >= __TSG_OBJ_MAX) + { + return NULL; + } + return scan_table_name[table_id]; +} + struct policy_scan_ctx *policy_scan_ctx_new(unsigned int thread_id, int vsys_id, int compile_table_id) { struct policy_scan_ctx * ctx = ALLOC(struct policy_scan_ctx, 1); ctx->thread_id = thread_id; utarray_new(ctx->scan_path.ut_array_by_context, &ut_ulonglong_id_icd); ctx->scan_mid = maat_state_new(g_policy_rt->feather[vsys_id], thread_id); - maat_state_set_scan_compile_table(ctx->scan_mid, g_policy_rt->compile_table_id[compile_table_id]); + maat_state_set_scan_rule_table(ctx->scan_mid, get_conjunction_table_name((enum policy_rule_type)compile_table_id)); return ctx; } @@ -323,6 +416,19 @@ void policy_scan_ctx_free(struct policy_scan_ctx * ctx) ctx->tunnel_scan_mid = NULL; } + struct library_hit_path *library_entry=NULL; + while ((library_entry=(struct library_hit_path *)utarray_next(ctx->scan_path.ut_array_by_context, library_entry)) != NULL) + { + if(library_entry != NULL) + { + for(int i=0; i < library_entry->entry_num; i++) + { + if(library_entry->tag[i].uuid) FREE(&library_entry->tag[i].uuid); + if(library_entry->tag[i].tag_uuid) FREE(&library_entry->tag[i].tag_uuid); + } + } + + } utarray_free(ctx->scan_path.ut_array_by_context); FREE(&ctx); } @@ -388,212 +494,59 @@ static char* verify_unescape(char* s) } #endif -void tunnel_catalog_table_new_cb(const char *table_name, int table_id, const char* key, const char* table_line, void **ad, long argl, void* argp) -{ - int ret=0,tunnel_id=0,group_id=0,is_valid=0; - char tunnel_name[VERIFY_ARRAY_MAX]={0},tunnel_type[16]={0}; - char composition[VERIFY_ARRAY_MAX]={0}; - - ret=sscanf(table_line, "%d\t%s\t%s\t%s\t%d\t%d", &tunnel_id, tunnel_name, tunnel_type, composition, &group_id, &is_valid); - if(ret!=6) - { - log_fatal(g_verify_proxy->logger, MODULE_VERIFY_MATCHER, "Policy catalog table parse tunnel catalog failed, ret:%d, %s", ret, table_line); - return; - } - - struct tunnel_data_ctx *tunnel=ALLOC(struct tunnel_data_ctx, 1); - memset(tunnel, 0, sizeof(struct tunnel_data_ctx)); - tunnel->id=tunnel_id; - tunnel->name=strdup(tunnel_name); - tunnel->type=strdup(tunnel_type); - tunnel->composition=strdup(composition); - tunnel->group_id=group_id; - tunnel->ref_cnt=1; - pthread_mutex_init(&(tunnel->lock), NULL); - - log_debug(g_verify_proxy->logger, MODULE_VERIFY_MATCHER, "Policy table add success %d", tunnel_id); - *ad = tunnel; -} - -void tunnel_endpoint_table_new_cb(const char *table_name, int table_id, const char* key, const char* table_line, void **ad, long argl, void* argp) -{ - int ret=0,is_valid=0; - int endpoint_id=0,addr_type=0; - char start_ip[40], end_ip[40]; - char description[VERIFY_ARRAY_MAX]; - - ret=sscanf(table_line, "%d\t%d\t%s\t%s\t%s\t%d", &endpoint_id, &addr_type, start_ip, end_ip, description, &is_valid); - if(ret!=6) - { - log_fatal(g_verify_proxy->logger, MODULE_VERIFY_MATCHER, "Policy table parse tunnel end point failed, ret:%d, %s", ret, table_line); - return; - } - - struct tunnel_data_ctx* tunnel=ALLOC(struct tunnel_data_ctx, 1); - memset(tunnel, 0, sizeof(struct tunnel_data_ctx)); - tunnel->id=endpoint_id; - tunnel->description=strdup(description); - tunnel->ref_cnt=1; - pthread_mutex_init(&(tunnel->lock), NULL); - - log_debug(g_verify_proxy->logger, MODULE_VERIFY_MATCHER, "Policy endpoint table add success %d", endpoint_id); - *ad = tunnel; -} - -void tunnel_label_table_new_cb(const char *table_name, int table_id, const char* key, const char* table_line, void **ad, long argl, void* argp) -{ - int ret=0,is_valid=0; - int label_id=0; - - ret=sscanf(table_line, "%d\t%d", &label_id, &is_valid); - if(ret!=2) - { - log_fatal(g_verify_proxy->logger, MODULE_VERIFY_MATCHER, "Policy table tunnel label failed, ret:%d, %s", ret, table_line); - return; - } - - struct tunnel_data_ctx* tunnel=ALLOC(struct tunnel_data_ctx, 1); - memset(tunnel, 0, sizeof(struct tunnel_data_ctx)); - tunnel->id=label_id; - tunnel->ref_cnt=1; - pthread_mutex_init(&(tunnel->lock), NULL); - - log_debug(g_verify_proxy->logger, MODULE_VERIFY_MATCHER, "Policy label table add success %d", label_id); - *ad = tunnel; -} - const char *table_name_map[PROFILE_TABLE_MAX] = { - [PROFILE_TUNNEL_CATALOG]="TSG_TUNNEL_CATALOG", - [PROFILE_TUNNEL_ENDPOINT]="TSG_TUNNEL_ENDPOINT", - [PROFILE_TUNNEL_LABEL]="TSG_TUNNEL_LABEL", [PROFILE_APP_DI_DICT]="APP_ID_DICT", [PROFILE_FQDN_ENTRY]="FQDN_ENTRY", [PROFILE_IP_ADDR_ENTRY]="IP_ADDR_ENTRY", [PROFILE_LIBRARY_TAG]="LIBRARY_TAG" }; -int maat_tunnel_table_init(int profile_idx,int vsys_id, - maat_ex_free_func_t* free_func, - maat_ex_dup_func_t* dup_func) -{ - int table_id=0; - - maat_ex_new_func_t *new_func[] = { - [PROFILE_TUNNEL_CATALOG] = tunnel_catalog_table_new_cb, - [PROFILE_TUNNEL_ENDPOINT] = tunnel_endpoint_table_new_cb, - [PROFILE_TUNNEL_LABEL] = tunnel_label_table_new_cb - }; - - const char *table_name = table_name_map[profile_idx]; - table_id=g_policy_rt->profile_table_id[profile_idx]=maat_get_table_id(g_policy_rt->feather[vsys_id], table_name); - if(table_id > 0) - { - table_id=maat_plugin_table_ex_schema_register(g_policy_rt->feather[vsys_id], table_name, new_func[profile_idx], free_func, dup_func, 0, NULL); - return table_id; - } - log_fatal(g_verify_proxy->logger, MODULE_VERIFY_MATCHER, "Register table %s failed.", table_name); - return -1; -} - -void tunnel_table_free_data(int table_id, void **ad, long argl, void* argp) -{ - if(*ad==NULL) - { - return; - } - - struct tunnel_data_ctx *tunnel=(struct tunnel_data_ctx *)(*ad); - pthread_mutex_lock(&(tunnel->lock)); - tunnel->ref_cnt--; - if(tunnel->ref_cnt>0) - { - pthread_mutex_unlock(&(tunnel->lock)); - return; - } - pthread_mutex_unlock(&(tunnel->lock)); - pthread_mutex_destroy(&(tunnel->lock)); - - if(tunnel->name) - FREE(&tunnel->name); - if(tunnel->type) - FREE(&tunnel->type); - if(tunnel->composition) - FREE(&tunnel->composition); - if(tunnel->description) - FREE(&tunnel->description); - FREE(&tunnel); - - *ad=NULL; - return; -} - -void tunnel_table_free(struct tunnel_data_ctx* tunnel) -{ - tunnel_table_free_data(0, (void **)&tunnel, 0, NULL); -} - -void tunnel_table_dup_data(int table_id, void **to, void **from, long argl, void* argp) -{ - struct tunnel_data_ctx *tunnel=(struct tunnel_data_ctx *)(*from); - pthread_mutex_lock(&(tunnel->lock)); - tunnel->ref_cnt++; - pthread_mutex_unlock(&(tunnel->lock)); - *to=tunnel; - - return; -} - int maat_plugin_table_ex_init(int profile_idx, int vsys_id, maat_ex_new_func_t* new_func, maat_ex_free_func_t* free_func, maat_ex_dup_func_t* dup_func) { - int table_id=0, ret=0; - const char *table_name = table_name_map[profile_idx]; - table_id=g_policy_rt->profile_table_id[profile_idx]=maat_get_table_id(g_policy_rt->feather[vsys_id], table_name); - if(table_id >= 0) + int ret=maat_plugin_table_ex_schema_register(g_policy_rt->feather[vsys_id], table_name, new_func, free_func, dup_func, 0, NULL); + if(ret < 0) { - ret=maat_plugin_table_ex_schema_register(g_policy_rt->feather[vsys_id], table_name, new_func, free_func, dup_func, 0, NULL); - return ret; + log_fatal(g_verify_proxy->logger, MODULE_VERIFY_MATCHER, "Register maat plugin table %s failed.", table_name); } - log_fatal(g_verify_proxy->logger, MODULE_VERIFY_MATCHER, "Register maat plugin table %s failed.", table_name); - return -1; + return ret; } -void app_dict_table_new_cb(const char *table_name, int table_id, const char* key, const char* table_line, void **ad, long argl, void* argp) +void app_dict_table_new_cb(const char *table_name, const char* key, const char* table_line, void **ad, long argl, void* argp) { - int ret=0; - size_t offset=0, len=0; - char *app_id_str=NULL, *group_id_str=NULL; - struct app_id_dict *app_dict=ALLOC(struct app_id_dict, 1); + cJSON* app_id_dict_json = cJSON_Parse(table_line); + if(app_id_dict_json == NULL) + { + log_fatal(g_verify_proxy->logger, MODULE_VERIFY_POLICY, "APP_ID_DICT parse table_line failed. table_line:%s", table_line); + return; + } - ret = maat_helper_read_column(table_line, 1, &offset, &len); - if(ret >= 0) + struct app_id_dict *app_dict=ALLOC(struct app_id_dict, 1); + cJSON *item = cJSON_GetObjectItem(app_id_dict_json, "app_id"); + if(item && item->type==cJSON_Number) { - app_id_str=ALLOC(char, len+1); - memcpy(app_id_str, table_line+offset, len); - app_dict->app_id=atoi(app_id_str); - FREE(&app_id_str); + app_dict->app_id = item->valueint; } - ret = maat_helper_read_column(table_line, 18, &offset, &len); - if(ret >= 0) + item = cJSON_GetObjectItem(app_id_dict_json, "object_uuid"); + if(item && item->type==cJSON_String) { - group_id_str=ALLOC(char, len+1); - memcpy(group_id_str, table_line+offset, len); - app_dict->group_id=atoll(group_id_str); - FREE(&group_id_str); + uuid_parse(item->valuestring, app_dict->object_uuid); } + cJSON_Delete(app_id_dict_json); + app_dict->ref_cnt=1; pthread_mutex_init(&(app_dict->lock), NULL); *ad=app_dict; return; } -void app_dict_table_free_cb(int table_id, void **ad, long argl, void* argp) +void app_dict_table_free_cb(const char *table_name, void **ad, long argl, void* argp) { if(*ad==NULL) { @@ -621,7 +574,7 @@ void app_id_dict_free(struct app_id_dict *app_dict) app_dict_table_free_cb(0, (void **)&app_dict, 0, NULL); } -void app_dict_table_dup_cb(int table_id, void **to, void **from, long argl, void* argp) +void app_dict_table_dup_cb(const char *table_name, void **to, void **from, long argl, void* argp) { struct app_id_dict *app_dict=(struct app_id_dict *)(*from); pthread_mutex_lock(&(app_dict->lock)); @@ -632,7 +585,7 @@ void app_dict_table_dup_cb(int table_id, void **to, void **from, long argl, void return; } -int get_tag_id_array(char *tag_ids, long long *tag_id_array) +int get_tag_id_array(char *tag_ids, char *tag_uuid_array[]) { if(tag_ids==NULL) { @@ -646,66 +599,54 @@ int get_tag_id_array(char *tag_ids, long long *tag_id_array) char *tag_ids_str=strtok(tag_ids_tmp, ","); while(tag_ids_str!=NULL && n_tag_ids < MAX_TAG_ID_NUM) { - tag_id_array[n_tag_ids++]=strtoll(tag_ids_str, NULL, 10); + tag_uuid_array[n_tag_ids++]=strdup(tag_ids_str); tag_ids_str=strtok(NULL, ","); } FREE(&tag_ids_tmp); return n_tag_ids; } -void fqdn_entry_new_cb(const char *table_name, int table_id, const char* key, const char* table_line, void **ad, long argl, void* argp) +void fqdn_entry_new_cb(const char *table_name, const char* key, const char* table_line, void **ad, long argl, void* argp) { - int ret=0; - size_t offset=0, len=0; - char *entry_id_str=NULL; - struct library_entry_ctx *entry_ctx=ALLOC(struct library_entry_ctx, 1); - - ret = maat_helper_read_column(table_line, 1, &offset, &len); - if(ret >= 0) + cJSON* fqdn_entry_json = cJSON_Parse(table_line); + if(fqdn_entry_json == NULL) { - entry_id_str=ALLOC(char, len+1); - memcpy(entry_id_str, table_line+offset, len); - entry_ctx->entry_id=atoi(entry_id_str); - FREE(&entry_id_str); + log_fatal(g_verify_proxy->logger, MODULE_VERIFY_POLICY, "FQDN_ENTRY parse table_line failed. table_line:%s", table_line); + return; } - ret = maat_helper_read_column(table_line, 2, &offset, &len); - if(ret >= 0) + struct library_entry_ctx *entry_ctx=ALLOC(struct library_entry_ctx, 1); + cJSON *item = cJSON_GetObjectItem(fqdn_entry_json, "uuid"); + if(item && item->type==cJSON_String) { - entry_ctx->tag_ids=ALLOC(char, len+1); - memcpy(entry_ctx->tag_ids, table_line+offset, len); + entry_ctx->uuid=strdup(item->valuestring); } - entry_ctx->n_tag_ids = get_tag_id_array(entry_ctx->tag_ids, entry_ctx->tag_id_array); - entry_ctx->ref_cnt=1; - pthread_mutex_init(&(entry_ctx->lock), NULL); - *ad=entry_ctx; - return; -} + int n_tag_ids=0; + cJSON *tag_uuids_item = cJSON_GetObjectItem(fqdn_entry_json, "tag_uuids"); + entry_ctx->n_tag_uuids=cJSON_GetArraySize(tag_uuids_item); -void ip_addr_entry_new_cb(const char *table_name, int table_id, const char* key, const char* table_line, void **ad, long argl, void* argp) -{ - int ret=0; - size_t offset=0, len=0; - char *entry_id_str=NULL; - struct library_entry_ctx *entry_ctx=ALLOC(struct library_entry_ctx, 1); + entry_ctx->tag_uuids = ALLOC(char, entry_ctx->n_tag_uuids*UUID_STR_LEN); - ret = maat_helper_read_column(table_line, 1, &offset, &len); - if(ret >= 0) + if(entry_ctx->n_tag_uuids>0) { - entry_id_str=ALLOC(char, len+1); - memcpy(entry_id_str, table_line+offset, len); - entry_ctx->entry_id=atoi(entry_id_str); - FREE(&entry_id_str); + for(int i=0; i< entry_ctx->n_tag_uuids; i++) + { + cJSON *tag_uuids_sub=cJSON_GetArrayItem(tag_uuids_item, i); + if(tag_uuids_sub != NULL) + { + entry_ctx->tag_uuid_array[n_tag_ids]=strdup(tag_uuids_sub->valuestring); + n_tag_ids++; + } + strcat(entry_ctx->tag_uuids, tag_uuids_sub->valuestring); + if (i < entry_ctx->n_tag_uuids - 1) + { + strcat(entry_ctx->tag_uuids, ","); + } + } } - ret = maat_helper_read_column(table_line, 2, &offset, &len); - if(ret >= 0) - { - entry_ctx->tag_ids=ALLOC(char, len+1); - memcpy(entry_ctx->tag_ids, table_line+offset, len); - } - entry_ctx->n_tag_ids = get_tag_id_array(entry_ctx->tag_ids, entry_ctx->tag_id_array); + cJSON_Delete(fqdn_entry_json); entry_ctx->ref_cnt=1; pthread_mutex_init(&(entry_ctx->lock), NULL); @@ -713,8 +654,7 @@ void ip_addr_entry_new_cb(const char *table_name, int table_id, const char* key, return; } - -void library_entry_free_cb(int table_id, void **ad, long argl, void* argp) +void library_entry_free_cb(const char *table_name, void **ad, long argl, void* argp) { if(*ad==NULL) { @@ -732,9 +672,22 @@ void library_entry_free_cb(int table_id, void **ad, long argl, void* argp) pthread_mutex_unlock(&(entry_ctx->lock)); pthread_mutex_destroy(&(entry_ctx->lock)); - if(entry_ctx->tag_ids) + if(entry_ctx->uuid) + { + FREE(&entry_ctx->uuid); + } + + if(entry_ctx->tag_uuids) + { + FREE(&entry_ctx->tag_uuids); + } + + for(int i=0; i<entry_ctx->n_tag_uuids; i++) { - FREE(&entry_ctx->tag_ids); + if(entry_ctx->tag_uuid_array[i]) + { + FREE(&entry_ctx->tag_uuid_array[i]); + } } FREE(&entry_ctx); *ad=NULL; @@ -746,7 +699,7 @@ void library_entry_free(struct library_entry_ctx *entry_ctx) library_entry_free_cb(0, (void **)&entry_ctx, 0, NULL); } -void library_entry_dup_cb(int table_id, void **to, void **from, long argl, void* argp) +void library_entry_dup_cb(const char *table_name, void **to, void **from, long argl, void* argp) { struct library_entry_ctx *entry_ctx=(struct library_entry_ctx *)(*from); pthread_mutex_lock(&(entry_ctx->lock)); @@ -779,60 +732,54 @@ int get_category_type_str2idx(const char *category) return i; } -void library_tag_new_cb(const char *table_name, int table_id, const char* key, const char* table_line, void **ad, long argl, void* argp) +void library_tag_new_cb(const char *table_name, const char* key, const char* table_line, void **ad, long argl, void* argp) { - int ret=0; - size_t offset=0, len=0; - char statistics_option[VERIFY_ARRAY_MAX]={0}; - char category[VERIFY_ARRAY_MAX]={0}; + cJSON* library_tag_json = cJSON_Parse(table_line); + if(library_tag_json == NULL) + { + log_fatal(g_verify_proxy->logger, MODULE_VERIFY_POLICY, "LIBRARY_TAG parse table_line failed. table_line:%s", table_line); + return; + } struct library_tag_ctx *tag_ctx = ALLOC(struct library_tag_ctx, 1); - - ret = maat_helper_read_column(table_line, 1, &offset, &len); - if(ret >= 0) + cJSON *item = cJSON_GetObjectItem(library_tag_json, "uuid"); + if(item && item->type==cJSON_String) { - char *tag_id_str=ALLOC(char, len+1); - memcpy(tag_id_str, table_line+offset, len); - tag_ctx->tag_id=atoi(tag_id_str); - FREE(&tag_id_str); + tag_ctx->uuid=strdup(item->valuestring); } - ret = maat_helper_read_column(table_line, 2, &offset, &len); - if(ret >= 0) + item = cJSON_GetObjectItem(library_tag_json, "statistics_option"); + if(item && item->type==cJSON_String) { - memcpy(statistics_option, table_line+offset, len); - tag_ctx->option_type=(enum statistics_option_type)get_statistics_option_type_str2idx(statistics_option); + tag_ctx->option_type=(enum statistics_option_type)get_statistics_option_type_str2idx(item->valuestring); } - ret = maat_helper_read_column(table_line, 3, &offset, &len); - if(ret >= 0) + item = cJSON_GetObjectItem(library_tag_json, "category"); + if(item && item->type==cJSON_String) { - memcpy(category, table_line+offset, len); - tag_ctx->category=(enum category_type)get_category_type_str2idx(category); + tag_ctx->category=(enum category_type)get_category_type_str2idx(item->valuestring); } - ret = maat_helper_read_column(table_line, 4, &offset, &len); - if(ret >= 0) + item = cJSON_GetObjectItem(library_tag_json, "tag_key"); + if(item && item->type==cJSON_String) { - tag_ctx->tag_key=ALLOC(char, len+1); - memcpy(tag_ctx->tag_key, table_line+offset, len); + tag_ctx->tag_key=strdup(item->valuestring); } - ret = maat_helper_read_column(table_line, 5, &offset, &len); - if(ret >= 0) + item = cJSON_GetObjectItem(library_tag_json, "tag_value"); + if(item && item->type==cJSON_String) { - tag_ctx->tag_value=ALLOC(char, len+1); - memcpy(tag_ctx->tag_value, table_line+offset, len); + tag_ctx->tag_value=strdup(item->valuestring); } - tag_ctx->ref_cnt=1; pthread_mutex_init(&(tag_ctx->lock), NULL); + cJSON_Delete(library_tag_json); *ad=tag_ctx; return; } -void library_tag_free_cb(int table_id, void **ad, long argl, void* argp) +void library_tag_free_cb(const char *table_name, void **ad, long argl, void* argp) { if(*ad==NULL) { @@ -858,13 +805,17 @@ void library_tag_free_cb(int table_id, void **ad, long argl, void* argp) { FREE(&tag_ctx->tag_value); } + if(tag_ctx->uuid) + { + FREE(&tag_ctx->uuid); + } FREE(&tag_ctx); *ad=NULL; return; } -void library_tag_dup_cb(int table_id, void **to, void **from, long argl, void* argp) +void library_tag_dup_cb(const char *table_name, void **to, void **from, long argl, void* argp) { struct library_tag_ctx *tag_ctx=(struct library_tag_ctx *)(*from); pthread_mutex_lock(&(tag_ctx->lock)); @@ -880,35 +831,68 @@ void library_tag_free(struct library_tag_ctx *tag_ctx) library_tag_free_cb(0, (void **)&tag_ctx, 0, NULL); } -void compile_table_new_cb(const char *table_name, int table_id, const char* key, const char* table_line, void **ad, long argl, void* argp) +unsigned char action_type_str2idx(const char *action_str) { - int ret=0, group_num=0; - int config_id=0, service_id=0, action=0; - int do_log=0,do_blacklist=0,is_valid=0; - char effective_range[VERIFY_ARRAY_MAX]={0}; - char srv_def_large[VERIFY_STRING_MAX]={0}; + const char *action_name[__PG_ACTION_MAX]={0}; + action_name[PG_ACTION_NONE] = "none"; + action_name[PG_ACTION_MONIT] = "monitor"; + action_name[PG_ACTION_INTERCEPT] = "intercept"; + action_name[PG_ACTION_NO_INTERCEPT] = "no_intercept"; + action_name[PG_ACTION_ACTIVE_DEFENCE] = "active_defence"; + action_name[PG_ACTION_WANNAT] = "wannat"; + action_name[PG_ACTION_REJECT] = "deny"; + action_name[PG_ACTION_SHAPING] = "shaping"; + action_name[PG_ACTION_MANIPULATE] = "manipulate"; + action_name[PG_ACTION_SERVICE_CHAINING] = "service_chaining"; + action_name[PG_ACTION_WHITELIST] = "allow"; + action_name[PX_ACTION_SHUNT] = "shunt"; + action_name[PG_STATISTICS] = "statistics"; + + int action = 0; + for ( action = PG_ACTION_NONE; action < __PG_ACTION_MAX; action++) + { + if (action_name[action] != NULL && 0 == strcasecmp(action_str, action_name[action])) + break; + } + return action; +} - ret=sscanf(table_line, "%d\t%d\t%d\t%d\t%d\t%s\t%s\t%d\t%d", &config_id, &service_id, &action, &do_blacklist, &do_log,effective_range,srv_def_large,&group_num,&is_valid); - if(ret!=9) +void compile_table_new_cb(const char *table_name, const char* key, const char* table_line, void **ad, long argl, void* argp) +{ + cJSON* policy_rule_json = cJSON_Parse(table_line); + if(policy_rule_json == NULL) { - log_fatal(g_verify_proxy->logger, MODULE_VERIFY_MATCHER, "Security compile table parse failed, ret:%d, %s", ret, table_line); + log_fatal(g_verify_proxy->logger, MODULE_VERIFY_POLICY, "%s parse table_line failed. table_line:%s", table_name, table_line); return; } - do_log=do_log; - do_blacklist=do_blacklist; - is_valid=is_valid; struct rule_data_ctx *rule_ctx=ALLOC(struct rule_data_ctx, 1); - rule_ctx->config_id=config_id; - rule_ctx->action=action; - rule_ctx->service_id=service_id; + + cJSON *item = cJSON_GetObjectItem(policy_rule_json, "uuid"); + if(item && item->type==cJSON_String) + { + uuid_parse(item->valuestring, rule_ctx->rule_uuid); + } + item = cJSON_GetObjectItem(policy_rule_json, "action"); + if(item && item->type==cJSON_String) + { + rule_ctx->action=action_type_str2idx(item->valuestring); + } + item = cJSON_GetObjectItem(policy_rule_json, "service"); + if(item && item->type==cJSON_Number) + { + rule_ctx->service_id=item->valueint; + } + + cJSON_Delete(policy_rule_json); + rule_ctx->ref_cnt=1; pthread_mutex_init(&(rule_ctx->lock), NULL); *ad = rule_ctx; } -void compile_free_data(int table_id, void **ad, long argl, void* argp) +void compile_free_data(const char *table_name, void **ad, long argl, void* argp) { if(*ad==NULL) { @@ -924,7 +908,6 @@ void compile_free_data(int table_id, void **ad, long argl, void* argp) } pthread_mutex_unlock(&(rule_ctx->lock)); pthread_mutex_destroy(&(rule_ctx->lock)); - FREE(&rule_ctx); *ad=NULL; return; @@ -935,7 +918,7 @@ void compile_free(struct rule_data_ctx *compile_ctx) compile_free_data(0, (void **)&compile_ctx, 0, NULL); } -void compile_dup_data(int table_id, void **to, void **from, long argl, void* argp) +void compile_dup_data(const char *table_name, void **to, void **from, long argl, void *argp) { struct rule_data_ctx *rule_ctx=(struct rule_data_ctx *)(*from); pthread_mutex_lock(&(rule_ctx->lock)); @@ -958,7 +941,7 @@ static inline int multiple_hit_actions(enum policy_action __action) } } -static enum policy_action decide_policy_action(int vsys_id, int compile_table_id, long long *results, size_t n_hit, +static enum policy_action decide_policy_action(int vsys_id, int compile_table_id, uuid_t *results, size_t n_hit, struct rule_data_ctx ** enforce_rules, size_t * n_enforce, struct rule_data_ctx **hit_rules) { size_t n_monit = 0, exist_enforce_num = 0, i = 0; @@ -971,12 +954,12 @@ static enum policy_action decide_policy_action(int vsys_id, int compile_table_id return prior_action; } + char result_uuid_str[32]={0}; hit_rules_ex=ALLOC(struct rule_data_ctx, n_hit); for (i = 0; i < n_hit && i<MAX_SCAN_RESULT; i++) { - rule_ctx =(struct rule_data_ctx *)maat_plugin_table_get_ex_data(g_policy_rt->feather[vsys_id], - g_policy_rt->plugin_table_id[compile_table_id], - (const char *)&results[i], sizeof(long long)); + uuid_unparse(results[i], result_uuid_str); + rule_ctx =(struct rule_data_ctx *)maat_plugin_table_get_ex_data(g_policy_rt->feather[vsys_id], get_plugin_table_name((enum policy_rule_type)compile_table_id), result_uuid_str, strlen(result_uuid_str)); if(!rule_ctx) { continue; @@ -1005,7 +988,7 @@ static enum policy_action decide_policy_action(int vsys_id, int compile_table_id } else if (action_cmp(__action, prior_action) == 0) { - if (hit_rules_ex[i].config_id > prior_rule->config_id) + if(uuid_compare(hit_rules_ex[i].rule_uuid, prior_rule->rule_uuid) > 0) { prior_rule = hit_rules_ex + i; } @@ -1087,8 +1070,8 @@ void add_tag_ids_to_hit_paths(cJSON *hitPaths, int table_id, struct library_scan { histObj=cJSON_CreateObject(); cJSON_AddItemToArray(hitPaths, histObj); - cJSON_AddNumberToObject(histObj, "entry_id", ip_entry->tag[i].entry_id); - cJSON_AddNumberToObject(histObj, "tag_id", ip_entry->tag[i].tag_id); + cJSON_AddStringToObject(histObj, "entry_uuid", ip_entry->tag[i].uuid); + cJSON_AddStringToObject(histObj, "tag_uuid", ip_entry->tag[i].tag_uuid); } } } @@ -1097,13 +1080,13 @@ void add_tag_ids_to_hit_paths(cJSON *hitPaths, int table_id, struct library_scan } /*In the case of multiple hits, the hit path is append behavior to obtain the last hit path force***/ -int http_hit_policy_match(int result_config[], int cnt, int config) +int http_hit_policy_match(uuid_t result_config[], int cnt, uuid_t config) { int i = 0; for(i=0; i<cnt; i++) { - if(result_config[i] == config) + if(uuid_compare(result_config[i], config) == 0) { return 1; } @@ -1115,7 +1098,7 @@ int hit_rule_match_is_duplicate(struct maat_hit_path *src, struct maat_hit_path { for(int i = 0; i < result_cnt; i++) { - if(src[i].vtable_id == dest.vtable_id && src[i].top_group_id == dest.top_group_id) + if(src[i].top_object_uuid == dest.top_object_uuid) { return 1; } @@ -1138,18 +1121,27 @@ cJSON *get_tunnel_endpoint_attribute(cJSON *attributes) return NULL; } -int hit_object_exists_by_ids(cJSON* hitPaths, int item_id, int superior_object_id) +int hit_object_exists_by_ids(cJSON* hitPaths, uuid_t item_id, uuid_t superior_object_id) { cJSON *hitsObj=NULL; + uuid_t item_valuestring_uuid, superiorId_valuestring_uuid; /*In cases of multiple hits, although the compile_id is inconsistent, the item_id and superior_object_id remain consistent.**/ /*For tunnel_endpointa if hit non and tunnel_endpointb hit not logic the same nth_scan record will exist **/ for(hitsObj = hitPaths->child; hitsObj != NULL; hitsObj = hitsObj->next) { - cJSON *itemId = cJSON_GetObjectItem(hitsObj, "item_id"); - cJSON *superiorId = cJSON_GetObjectItem(hitsObj, "superior_object_id"); + cJSON *itemId = cJSON_GetObjectItem(hitsObj, "item_uuid"); + cJSON *superiorId = cJSON_GetObjectItem(hitsObj, "superior_object_uuid"); - if((itemId != NULL && itemId->valueint == item_id) && (superiorId != NULL && superiorId->valueint == superior_object_id)) + if(itemId==NULL || superiorId==NULL) + { + continue; + } + uuid_clear(item_valuestring_uuid); + uuid_parse(itemId->valuestring, item_valuestring_uuid); + uuid_clear(superiorId_valuestring_uuid); + uuid_parse(superiorId->valuestring, superiorId_valuestring_uuid); + if((uuid_compare(item_valuestring_uuid, item_id) == 0) && (uuid_compare(superiorId_valuestring_uuid, superior_object_id)==0)) { return 1; } @@ -1199,25 +1191,25 @@ void http_get_scan_status(struct request_object_list *request_object, int compil { if (request_object->merge_nth_scan[j] == ctx->hit_path[i].Nth_scan) { - if (ctx->hit_path[i].top_group_id < 0) + if(uuid_is_null(ctx->hit_path[i].top_object_uuid) == 1) { - ctx->hit_path[i].top_group_id = ctx->hit_path[i].sub_group_id; + uuid_copy(ctx->hit_path[i].top_object_uuid, ctx->hit_path[i].sub_object_uuid); } - if(hit_object_exists_by_ids(hitPaths, ctx->hit_path[i].item_id, ctx->hit_path[i].top_group_id)) + if(hit_object_exists_by_ids(hitPaths, ctx->hit_path[i].item_uuid, ctx->hit_path[i].top_object_uuid)) { break; } - if(ctx->hit_path[i].item_id < 0) + if(ctx->hit_path[i].item_uuid < 0) { continue; } histObj=cJSON_CreateObject(); cJSON_AddItemToArray(hitPaths, histObj); - cJSON_AddNumberToObject(histObj, "item_id", ctx->hit_path[i].item_id); - cJSON_AddNumberToObject(histObj, "superior_object_id", ctx->hit_path[i].top_group_id); + cJSON_AddUuidToObject(histObj, "item_uuid", ctx->hit_path[i].item_uuid); + cJSON_AddUuidToObject(histObj, "superior_object_uuid", ctx->hit_path[i].top_object_uuid); break; } } @@ -1268,7 +1260,7 @@ const char *get_library_virtual_table_name(int table_id) return table_name[table_id]; } -int add_tags_table_name(struct library_scan_path *ip_ctx, int Nth_scan, int top_group_id, cJSON *topObject) +int add_tags_table_name(struct library_scan_path *ip_ctx, int Nth_scan, uuid_t top_object_uuid, cJSON *topObject) { struct library_hit_path *ip_entry=NULL; @@ -1278,7 +1270,10 @@ int add_tags_table_name(struct library_scan_path *ip_ctx, int Nth_scan, int top_ { if(ip_entry->Nth_scan[i] == Nth_scan) { - cJSON_AddNumberToObject(topObject, "tag_id", top_group_id); + char tag_uuid_str[32]={0}; + uuid_unparse(top_object_uuid, tag_uuid_str); + //cJSON_AddNumberToObject(topObject, "tag_uuid", (double)uuid_to_int64(top_object_uuid)); + cJSON_AddStringToObject(topObject, "tag_uuid", tag_uuid_str); cJSON_AddStringToObject(topObject, "table_name", get_library_virtual_table_name(ip_entry->table_id)); goto finish; } @@ -1288,19 +1283,22 @@ finish: return 0; } -int add_object_table_name(UT_array *ut_array_by_object, int Nth_scan, int top_group_id, cJSON *topObject) +int add_object_table_name(UT_array *ut_array_by_object, int Nth_scan, uuid_t top_object_uuid, cJSON *topObject) { + char object_uuid_str[32]={0}; cJSON *attributeObj=NULL, *subchild=NULL; struct request_object_list *request_object=NULL; /*The priority of the tag is higher than that of the object_id.**/ - cJSON *tag_id = cJSON_GetObjectItem(topObject, "tag_id"); + cJSON *tag_id = cJSON_GetObjectItem(topObject, "tag_uuid"); if(tag_id != NULL) { - goto finish; + goto finish; } - cJSON_AddNumberToObject(topObject, "object_id", top_group_id); + uuid_unparse(top_object_uuid, object_uuid_str); + //cJSON_AddNumberToObject(topObject, "object_uuid", (double)uuid_to_int64(top_object_uuid)); + cJSON_AddStringToObject(topObject, "object_uuid", object_uuid_str); while ((request_object=(struct request_object_list *)utarray_next(ut_array_by_object, request_object)) != NULL) { for(int j=0; j<= request_object->merge_nth_scan_num; j++) @@ -1325,7 +1323,7 @@ int http_hit_policy_list(struct verify_policy_query *verify_policy, size_t hit_c { bool succeeded = false; size_t rules=0, i=0,j=0; - int result_config[MAX_SCAN_RESULT] = {0}; + uuid_t result_rule_uuid[MAX_SCAN_RESULT]={0}; int vsys_id = verify_policy->vsys_id; int compile_table_id = verify_policy->compile_table_id; @@ -1341,23 +1339,27 @@ int http_hit_policy_list(struct verify_policy_query *verify_policy, size_t hit_c cJSON *hit_obj=NULL, *policy_obj=NULL; cJSON *topObjectList=NULL, *topObject=NULL; hit_obj=cJSON_CreateArray(); - cJSON_AddItemToObject(data_obj, "hitPolicyList", hit_obj); + cJSON_AddItemToObject(data_obj, "hit_policy_list", hit_obj); if (ctx->hit_cnt >= 1) { for (i = 0; i < ctx->hit_cnt; i++) { - if(http_hit_policy_match(result_config, i, ctx->hit_rules[i].config_id)) + if(http_hit_policy_match(result_rule_uuid, i, ctx->hit_rules[i].rule_uuid)) { continue; } succeeded = false; policy_obj=cJSON_CreateObject(); - cJSON_AddNumberToObject(policy_obj, "id",ctx->hit_rules[i].config_id); + + char rule_uuid_str[32]={0}; + uuid_unparse(ctx->hit_rules[i].rule_uuid, rule_uuid_str); + cJSON_AddStringToObject(policy_obj, "uuid", rule_uuid_str); + //cJSON_AddNumberToObject(policy_obj, "uuid",(double)uuid_to_int64(ctx->hit_rules[i].rule_uuid)); cJSON_AddStringToObject(policy_obj, "policyName", ""); for (rules = 0; rules < ctx->n_enforce; rules++) { - if (ctx->enforce_rules[rules].config_id == ctx->hit_rules[i].config_id) + if(uuid_compare(ctx->enforce_rules[rules].rule_uuid, ctx->hit_rules[i].rule_uuid) == 0) { cJSON_AddBoolToObject(policy_obj, "is_execute_policy", true); succeeded = true; @@ -1368,14 +1370,14 @@ int http_hit_policy_list(struct verify_policy_query *verify_policy, size_t hit_c cJSON_AddBoolToObject(policy_obj, "is_execute_policy", false); } cJSON_AddItemToArray(hit_obj, policy_obj); - result_config[i] = ctx->hit_rules[i].config_id; + uuid_copy(result_rule_uuid[i], ctx->hit_rules[i].rule_uuid); struct maat_hit_path result_hit_path[MAX_SCAN_RESULT]={0}; int result_cnt=0; topObjectList=cJSON_CreateArray(); cJSON_AddItemToObject(policy_obj, "top_object_list", topObjectList); for(j=0; j<=(size_t)ctx->n_read; j++) { - if(ctx->hit_path[j].compile_id > 0 && ctx->hit_path[j].compile_id == ctx->hit_rules[i].config_id) + if(uuid_is_null(ctx->hit_path[j].rule_uuid) != 1 && uuid_compare(ctx->hit_path[j].rule_uuid,ctx->hit_rules[i].rule_uuid)==0) { if(hit_rule_match_is_duplicate(result_hit_path, ctx->hit_path[j], result_cnt)) { @@ -1387,10 +1389,10 @@ int http_hit_policy_list(struct verify_policy_query *verify_policy, size_t hit_c result_cnt++; } topObject=cJSON_CreateObject(); - add_tags_table_name(&ctx->scan_path, ctx->hit_path[j].Nth_scan, ctx->hit_path[j].top_group_id, topObject); - add_object_table_name(verify_policy->ut_array_by_object, ctx->hit_path[j].Nth_scan, ctx->hit_path[j].top_group_id, topObject); - cJSON_AddNumberToObject(topObject, "not_flag", ctx->hit_path[j].NOT_flag); - cJSON_AddNumberToObject(topObject, "nth_clause", ctx->hit_path[j].clause_index); + add_tags_table_name(&ctx->scan_path, ctx->hit_path[j].Nth_scan, ctx->hit_path[j].top_object_uuid, topObject); + add_object_table_name(verify_policy->ut_array_by_object, ctx->hit_path[j].Nth_scan, ctx->hit_path[j].top_object_uuid, topObject); + cJSON_AddNumberToObject(topObject, "negate_option", ctx->hit_path[j].negate_option); + cJSON_AddNumberToObject(topObject, "condition_index", ctx->hit_path[j].condition_index); cJSON_AddItemToArray(topObjectList, topObject); } } @@ -1421,26 +1423,29 @@ int ip_addr_to_address(struct ipaddr *ip_addr, struct ip_addr *dest_ip, struct i return 0; } -static int group_scan(struct policy_scan_ctx *ctx, int vsys_id, int hit_cnt, struct maat_hit_group hit_group, int table_id, int logic) +static int scan_object(struct policy_scan_ctx *ctx, int vsys_id, int hit_cnt, char *object_uuid_str, const char *table_name, const char *attribute_name) { size_t n_hit_result=0; + uuid_t objects_uuid; int scan_ret=0, hit_cnt_group=0; - scan_ret = maat_scan_group(g_policy_rt->feather[vsys_id], g_policy_rt->scan_table_id[table_id], &hit_group, 1, + struct maat_hit_object objects; + memset(&objects, 0, sizeof(objects)); + uuid_parse(object_uuid_str, objects_uuid); + uuid_copy(objects.object_uuid, objects_uuid); + + scan_ret = maat_scan_object(g_policy_rt->feather[vsys_id], table_name, attribute_name, &objects, 1, ctx->result+hit_cnt+hit_cnt_group, MAX_SCAN_RESULT-hit_cnt-hit_cnt_group, &n_hit_result, ctx->scan_mid); if(scan_ret == MAAT_SCAN_HIT) { hit_cnt_group+=n_hit_result; } - if(logic) - { - scan_ret = maat_scan_not_logic(g_policy_rt->feather[vsys_id], g_policy_rt->scan_table_id[table_id], ctx->result+hit_cnt+hit_cnt_group, + scan_ret = maat_scan_not_logic(g_policy_rt->feather[vsys_id], table_name, attribute_name, ctx->result+hit_cnt+hit_cnt_group, MAX_SCAN_RESULT-hit_cnt-hit_cnt_group, &n_hit_result, ctx->scan_mid); - if (scan_ret == MAAT_SCAN_HIT) - { - hit_cnt_group+=n_hit_result; - } + if (scan_ret == MAAT_SCAN_HIT) + { + hit_cnt_group+=n_hit_result; } return hit_cnt_group; } @@ -1486,18 +1491,18 @@ int get_fqdn_entry_tag_ids(cJSON *hit_library, int vsys_id, const char *fqdn) } library_entry_free(entry_ctx[i]); } - + char *tag_ids; int length = 0; if(n_tag_ids > 0) { fqdn_entry_item=cJSON_CreateObject(); for (int i = 0; i < n_tag_ids; i++) { - if (i == 0) + if (i == 0) { length = asprintf(&tag_ids, "%lld", tag_id_array[i]); - } - else + } + else { length = asprintf(&tag_ids, "%s,%lld", tag_ids, tag_id_array[i]); } @@ -1523,12 +1528,11 @@ int get_fqdn_entry_tag_ids(cJSON *hit_library, int vsys_id, const char *fqdn) log_info(g_verify_proxy->logger, MODULE_VERIFY_POLICY, "[I] fqdn=%s", fqdn); struct library_entry_ctx *entry_ctx[MAX_EX_DATA_LEN]={0}; - ret=maat_fqdn_plugin_table_get_ex_data(g_policy_rt->feather[vsys_id], g_policy_rt->profile_table_id[PROFILE_FQDN_ENTRY], fqdn, (void **)entry_ctx, MAX_EX_DATA_LEN); + ret=maat_fqdn_plugin_table_get_ex_data(g_policy_rt->feather[vsys_id], "FQDN_ENTRY", fqdn, (void **)entry_ctx, MAX_EX_DATA_LEN); for(int i=0; i < ret && i < MAX_EX_DATA_LEN; i++) { fqdn_entry_item=cJSON_CreateObject(); - cJSON_AddNumberToObject(fqdn_entry_item, "entry_id", entry_ctx[i]->entry_id); - cJSON_AddStringToObject(fqdn_entry_item, "tag_ids", entry_ctx[i]->tag_ids); + cJSON_AddStringToObject(fqdn_entry_item, "tag_uuids", entry_ctx[i]->tag_uuids); cJSON_AddItemToArray(hit_library, fqdn_entry_item); hit_fqdn_entry++; @@ -1552,11 +1556,11 @@ int get_ip_entry_tag_ids(cJSON *hit_library, int vsys_id, struct ipaddr *ip_addr ip_addr_to_address(ip_addr, &dest_ip, &source_ip); struct library_entry_ctx *entry_ctx[MAX_EX_DATA_LEN]={0}; - ret = maat_ip_plugin_table_get_ex_data(g_policy_rt->feather[vsys_id], g_policy_rt->profile_table_id[PROFILE_IP_ADDR_ENTRY], &source_ip, (void **)&entry_ctx, MAX_EX_DATA_LEN); + ret = maat_ip_plugin_table_get_ex_data(g_policy_rt->feather[vsys_id], "IP_ADDR_ENTRY", &source_ip, (void **)&entry_ctx, MAX_EX_DATA_LEN); for(int i=0; i < ret && i < MAX_EX_DATA_LEN; i++) { ip_entry_item=cJSON_CreateObject(); - cJSON_AddStringToObject(ip_entry_item, "tag_ids", entry_ctx[i]->tag_ids); + cJSON_AddStringToObject(ip_entry_item, "tag_uuids", entry_ctx[i]->tag_uuids); cJSON_AddItemToArray(hit_library, ip_entry_item); hit_ip_entry++; @@ -1565,10 +1569,9 @@ int get_ip_entry_tag_ids(cJSON *hit_library, int vsys_id, struct ipaddr *ip_addr return hit_ip_entry; } -enum category_type get_library_tag_category(long long tag_id, int vsys_id) +enum category_type get_library_tag_category(char *tag_uuid, int vsys_id) { - struct library_tag_ctx *tag_ctx =(struct library_tag_ctx *)maat_plugin_table_get_ex_data(g_policy_rt->feather[vsys_id], g_policy_rt->profile_table_id[PROFILE_LIBRARY_TAG], - (const char *)&tag_id, sizeof(long long)); + struct library_tag_ctx *tag_ctx =(struct library_tag_ctx *)maat_plugin_table_get_ex_data(g_policy_rt->feather[vsys_id], "LIBRARY_TAG", (const char *)tag_uuid, strlen(tag_uuid)); if(tag_ctx != NULL) { enum category_type category = tag_ctx->category; @@ -1582,7 +1585,6 @@ enum category_type get_library_tag_category(long long tag_id, int vsys_id) int ip_entry_scan(struct request_object_list *request, struct policy_scan_ctx *ctx, int vsys_id, int hit_cnt) { int scan_ret=0, hit_cnt_ip=0; - struct maat_hit_group hit_group; struct maat_hit_path hit_path[HIT_PATH_SIZE]; struct library_entry_ctx *source_ip_entry[MAX_EX_DATA_LEN]={0}; struct library_entry_ctx *destination_ip_entry[MAX_EX_DATA_LEN]={0}; @@ -1591,8 +1593,9 @@ int ip_entry_scan(struct request_object_list *request, struct policy_scan_ctx *c ip_addr_to_address(request->ip_addr, &dip, &sip); memset(hit_path, 0, sizeof(struct maat_hit_path)*HIT_PATH_SIZE); - int ret1 = maat_ip_plugin_table_get_ex_data(g_policy_rt->feather[vsys_id], g_policy_rt->profile_table_id[PROFILE_IP_ADDR_ENTRY], &sip, (void **)&source_ip_entry, MAX_EX_DATA_LEN); - int ret2 = maat_ip_plugin_table_get_ex_data(g_policy_rt->feather[vsys_id], g_policy_rt->profile_table_id[PROFILE_IP_ADDR_ENTRY], &dip, (void **)&destination_ip_entry, MAX_EX_DATA_LEN); + + int ret1 = maat_ip_plugin_table_get_ex_data(g_policy_rt->feather[vsys_id], "IP_ADDR_ENTRY", &sip, (void **)&source_ip_entry, MAX_EX_DATA_LEN); + int ret2 = maat_ip_plugin_table_get_ex_data(g_policy_rt->feather[vsys_id], "IP_ADDR_ENTRY", &dip, (void **)&destination_ip_entry, MAX_EX_DATA_LEN); struct library_hit_path ip_entry; memset(&ip_entry, 0, sizeof(ip_entry)); @@ -1606,25 +1609,18 @@ int ip_entry_scan(struct request_object_list *request, struct policy_scan_ctx *c continue; } - for(int tag_id=0; tag_id<source_ip_entry[i]->n_tag_ids; tag_id++) + for(int tag_id=0; tag_id<source_ip_entry[i]->n_tag_uuids; tag_id++) { - memset(&hit_group, 0, sizeof(hit_group)); - hit_group.group_id=source_ip_entry[i]->tag_id_array[tag_id]; - if(hit_group.group_id <= 0) - { - continue; - } - - scan_ret = group_scan(ctx, vsys_id, hit_cnt, hit_group, request->table_id, 1); + scan_ret = scan_object(ctx, vsys_id, hit_cnt, source_ip_entry[i]->tag_uuid_array[tag_id], "TSG_OBJ_IP_ADDR", request->table_name); if(scan_ret > 0) { hit_cnt_ip+=scan_ret; } ip_entry.table_id = request->table_id; - ip_entry.tag[ip_entry.entry_num].entry_id = source_ip_entry[i]->entry_id; - ip_entry.tag[ip_entry.entry_num].tag_id=source_ip_entry[i]->tag_id_array[tag_id]; - ip_entry.tag[ip_entry.entry_num].category = get_library_tag_category(source_ip_entry[i]->tag_id_array[tag_id], vsys_id); + ip_entry.tag[ip_entry.entry_num].uuid = strdup(source_ip_entry[i]->uuid); + ip_entry.tag[ip_entry.entry_num].tag_uuid = strdup(source_ip_entry[i]->tag_uuid_array[tag_id]); + ip_entry.tag[ip_entry.entry_num].category = get_library_tag_category(source_ip_entry[i]->tag_uuid_array[tag_id], vsys_id); ip_entry.entry_num++; ctx->n_read=maat_state_get_hit_paths(ctx->scan_mid, hit_path, HIT_PATH_SIZE); @@ -1647,25 +1643,18 @@ int ip_entry_scan(struct request_object_list *request, struct policy_scan_ctx *c continue; } - for(int tag_id=0; tag_id<destination_ip_entry[i]->n_tag_ids; tag_id++) + for(int tag_id=0; tag_id<destination_ip_entry[i]->n_tag_uuids; tag_id++) { - memset(&hit_group, 0, sizeof(hit_group)); - hit_group.group_id=destination_ip_entry[i]->tag_id_array[tag_id]; - if(hit_group.group_id <= 0) - { - continue; - } - - scan_ret = group_scan(ctx, vsys_id, hit_cnt, hit_group, request->table_id, 1); + scan_ret = scan_object(ctx, vsys_id, hit_cnt, destination_ip_entry[i]->tag_uuid_array[tag_id], "TSG_OBJ_IP_ADDR", request->table_name); if(scan_ret > 0) { hit_cnt_ip+=scan_ret; } ip_entry.table_id = request->table_id; - ip_entry.tag[ip_entry.entry_num].entry_id = destination_ip_entry[i]->entry_id; - ip_entry.tag[ip_entry.entry_num].tag_id=destination_ip_entry[i]->tag_id_array[tag_id]; - ip_entry.tag[ip_entry.entry_num].category = get_library_tag_category(destination_ip_entry[i]->tag_id_array[tag_id], vsys_id); + ip_entry.tag[ip_entry.entry_num].uuid = strdup(destination_ip_entry[i]->uuid); + ip_entry.tag[ip_entry.entry_num].tag_uuid=strdup(destination_ip_entry[i]->tag_uuid_array[tag_id]); + ip_entry.tag[ip_entry.entry_num].category = get_library_tag_category(destination_ip_entry[i]->tag_uuid_array[tag_id], vsys_id); ip_entry.entry_num++; ctx->n_read=maat_state_get_hit_paths(ctx->scan_mid, hit_path, HIT_PATH_SIZE); @@ -1684,14 +1673,14 @@ int ip_entry_scan(struct request_object_list *request, struct policy_scan_ctx *c int get_fqdn_category_id(struct request_object_list *request, struct policy_scan_ctx * ctx, int vsys_id, const char *fqdn, int table_id, int hit_cnt) { - size_t n_read=0, n_hit_result=0; + size_t n_read=0; int ret=0, hit_cnt_fqdn=0; struct library_entry_ctx *fqdn_entry_ctx[MAX_EX_DATA_LEN]={0}; struct library_hit_path fqdn_entry; memset(&fqdn_entry, 0, sizeof(fqdn_entry)); - ret=maat_fqdn_plugin_table_get_ex_data(g_policy_rt->feather[vsys_id], g_policy_rt->profile_table_id[PROFILE_FQDN_ENTRY], fqdn, (void **)fqdn_entry_ctx, MAX_EX_DATA_LEN); + ret=maat_fqdn_plugin_table_get_ex_data(g_policy_rt->feather[vsys_id], "FQDN_ENTRY", fqdn, (void **)fqdn_entry_ctx, MAX_EX_DATA_LEN); for(int i=0; i < ret && i < MAX_EX_DATA_LEN; i++) { if(fqdn_entry_ctx[i] == NULL) @@ -1699,33 +1688,24 @@ int get_fqdn_category_id(struct request_object_list *request, struct policy_scan continue; } - for(int tag_id=0; tag_id<fqdn_entry_ctx[i]->n_tag_ids; tag_id++) + for(int tag_id=0; tag_id<fqdn_entry_ctx[i]->n_tag_uuids; tag_id++) { fqdn_entry.table_id = request->table_id; - fqdn_entry.tag[fqdn_entry.entry_num].entry_id = fqdn_entry_ctx[i]->entry_id; - fqdn_entry.tag[fqdn_entry.entry_num].tag_id=fqdn_entry_ctx[i]->tag_id_array[tag_id]; + fqdn_entry.tag[fqdn_entry.entry_num].uuid=strdup(fqdn_entry_ctx[i]->uuid); + fqdn_entry.tag[fqdn_entry.entry_num].tag_uuid=strdup(fqdn_entry_ctx[i]->tag_uuid_array[tag_id]); fqdn_entry.entry_num++; } library_entry_free(fqdn_entry_ctx[i]); } - struct maat_hit_group hit_group; for(int i=0; i<fqdn_entry.entry_num; i++) { - memset(&hit_group, 0, sizeof(hit_group)); - hit_group.group_id=fqdn_entry.tag[i].tag_id; - ret=maat_scan_group(g_policy_rt->feather[vsys_id], g_policy_rt->scan_table_id[table_id], &hit_group, 1, - ctx->result+hit_cnt+hit_cnt_fqdn, MAX_SCAN_RESULT-hit_cnt-hit_cnt_fqdn, &n_hit_result, ctx->scan_mid); - if(ret == MAAT_SCAN_HIT) + char *uuid = fqdn_entry.tag[i].tag_uuid; + ret=scan_object(ctx, vsys_id, hit_cnt, uuid, "TSG_OBJ_FQDN", request->table_name); + if(ret > 0) { - hit_cnt_fqdn+=n_hit_result; - } - ret = maat_scan_not_logic(g_policy_rt->feather[vsys_id], g_policy_rt->scan_table_id[table_id], - ctx->result+hit_cnt+hit_cnt_fqdn, MAX_SCAN_RESULT-hit_cnt-hit_cnt_fqdn, &n_hit_result, ctx->scan_mid); - if (ret == MAAT_SCAN_HIT) - { - hit_cnt_fqdn+=n_hit_result; + hit_cnt_fqdn+=ret; } n_read=maat_state_get_hit_paths(ctx->scan_mid, ctx->hit_path, HIT_PATH_SIZE); if(ret >= MAAT_SCAN_OK) @@ -1746,12 +1726,12 @@ int tunnel_level_scan(struct request_object_list *request, struct policy_scan_ct { int n_read, hit_path_cnt=0; int scan_ret=0, hit_cnt_tunnel=0; - struct maat_hit_group hit_group; - int group_level_array[]={50, 51, 52, 53, 54, 55, 56, 57}; + const char *object_uuid_level_array[]={"00000000-0000-0000-0000-000000000050", "00000000-0000-0000-0000-000000000051", "00000000-0000-0000-0000-000000000052", + "00000000-0000-0000-0000-000000000053", "00000000-0000-0000-0000-000000000054", "00000000-0000-0000-0000-000000000055", + "00000000-0000-0000-0000-000000000056", "00000000-0000-0000-0000-000000000057"}; - memset(&hit_group, 0, sizeof(hit_group)); - hit_group.group_id=group_level_array[request->numeric]; - scan_ret = group_scan(ctx, vsys_id, hit_cnt, hit_group, request->table_id, 1); + const char *object_uuid=object_uuid_level_array[request->numeric]; + scan_ret = scan_object(ctx, vsys_id, hit_cnt, (char *)object_uuid, "TSG_OBJ_TUNNEL_LEVEL", request->table_name); if(scan_ret > 0) { hit_cnt_tunnel += scan_ret; @@ -1767,37 +1747,36 @@ int tunnel_level_scan(struct request_object_list *request, struct policy_scan_ct return hit_cnt_tunnel; } -int get_tunnel_type_table_id(char *tunnel_type) +const char* get_tunnel_type_table_id(char *tunnel_type) { - int table_id=TSG_OBJ_TUNNEL_GTP_ENDPOINT; - size_t i = 0; + const char *attribute_name="ATTR_TUNNEL_GTP_ENDPOINT"; const char *tunnel_type_map[] = {"GTP", "GRE", "IPv4/IPv6"}; if(tunnel_type == NULL) { - return table_id; + return attribute_name; } - for (i = 0; i < sizeof(tunnel_type_map) / sizeof(const char *); i++) + for (size_t i = 0; i < sizeof(tunnel_type_map) / sizeof(const char *); i++) { if (0 == strcasecmp(tunnel_type, tunnel_type_map[i])) { if(i == 0) { - table_id = TSG_OBJ_TUNNEL_GTP_ENDPOINT; + attribute_name = "ATTR_TUNNEL_GTP_ENDPOINT"; } if(i == 1) { - table_id = TSG_OBJ_TUNNEL_GRE_ENDPOINT; + attribute_name = "ATTR_TUNNEL_GRE_ENDPOINT"; } if(i == 2) { - table_id = TSG_OBJ_TUNNEL_IP_IN_IP_ENDPOINT; + attribute_name = "ATTR_TUNNEL_IP_IN_IP_ENDPOINT"; } break; } } - return table_id; + return attribute_name; } int tunnel_scan(struct request_object_list *request, struct policy_scan_ctx *ctx, int vsys_id, int hit_cnt, struct ipaddr *ip_addr) @@ -1805,23 +1784,23 @@ int tunnel_scan(struct request_object_list *request, struct policy_scan_ctx *ctx int logic =1; int i=0,hit_path_cnt=0; int n_read=0, hit_cnt_endpoint=0; - struct maat_hit_group hit_group; int scan_ret=0, hit_cnt_tunnel=0; size_t n_hit_result=0; - long long result[MAX_SCAN_RESULT]={0}; + struct maat_hit_object objects; + uuid_t result[MAX_SCAN_RESULT]={0}; int hit_cnt_group=0; if(ctx->tunnel_scan_mid == NULL) { ctx->tunnel_scan_mid = maat_state_new(g_policy_rt->feather[vsys_id], ctx->thread_id); - maat_state_set_scan_compile_table(ctx->tunnel_scan_mid, g_policy_rt->compile_table_id[TSG_TUNNEL]); + maat_state_set_scan_rule_table(ctx->tunnel_scan_mid, "TUNNEL_RULE_CONJUNCTION"); } - int tunnel_table_id = get_tunnel_type_table_id(request->tunnel_type); + const char *attribute_name = get_tunnel_type_table_id(request->tunnel_type); if (ip_addr->addrtype == ADDR_TYPE_IPV4) { - scan_ret = maat_scan_ipv4_port(g_policy_rt->feather[vsys_id], g_policy_rt->scan_table_id[tunnel_table_id], ip_addr->v4->saddr, ip_addr->v4->source, + scan_ret = maat_scan_ipv4_port(g_policy_rt->feather[vsys_id], "TSG_OBJ_IP_ADDR", attribute_name, ip_addr->v4->saddr, ip_addr->v4->source, result, MAX_SCAN_RESULT, &n_hit_result, ctx->tunnel_scan_mid); if(scan_ret == MAAT_SCAN_HIT) { @@ -1831,7 +1810,7 @@ int tunnel_scan(struct request_object_list *request, struct policy_scan_ctx *ctx if (ip_addr->addrtype == ADDR_TYPE_IPV6) { - scan_ret = maat_scan_ipv6_port(g_policy_rt->feather[vsys_id], g_policy_rt->scan_table_id[tunnel_table_id], ip_addr->v6->saddr, ip_addr->v6->source, + scan_ret = maat_scan_ipv6_port(g_policy_rt->feather[vsys_id], "TSG_OBJ_IP_ADDR", attribute_name, ip_addr->v6->saddr, ip_addr->v6->source, result, MAX_SCAN_RESULT, &n_hit_result, ctx->tunnel_scan_mid); if(scan_ret == MAAT_SCAN_HIT) { @@ -1839,7 +1818,7 @@ int tunnel_scan(struct request_object_list *request, struct policy_scan_ctx *ctx } } - scan_ret = maat_scan_not_logic(g_policy_rt->feather[vsys_id], g_policy_rt->scan_table_id[tunnel_table_id], result, MAX_SCAN_RESULT, + scan_ret = maat_scan_not_logic(g_policy_rt->feather[vsys_id], "TSG_OBJ_IP_ADDR", attribute_name, result, MAX_SCAN_RESULT, &n_hit_result, ctx->tunnel_scan_mid); if(scan_ret == MAAT_SCAN_HIT) { @@ -1858,12 +1837,12 @@ int tunnel_scan(struct request_object_list *request, struct policy_scan_ctx *ctx for(i = 0; i< hit_cnt_endpoint; i++) { - memset(&hit_group, 0, sizeof(hit_group)); - hit_group.group_id=result[i]; - if(hit_group.group_id != 0) + if(uuid_is_null(result[i]) != 1) { - scan_ret = maat_scan_group(g_policy_rt->feather[vsys_id], g_policy_rt->scan_table_id[TSG_OBJ_TUNNEL], &hit_group, 1, - ctx->result+hit_cnt+hit_cnt_group, MAX_SCAN_RESULT-hit_cnt-hit_cnt_group, &n_hit_result, ctx->scan_mid); + memset(&objects, 0, sizeof(objects)); + uuid_copy(objects.object_uuid, result[i]); + scan_ret = maat_scan_object(g_policy_rt->feather[vsys_id], "TUNNEL_RULE", "ATTR_TUNNEL", &objects, 1, + ctx->result+hit_cnt+hit_cnt_group, MAX_SCAN_RESULT-hit_cnt-hit_cnt_group, &n_hit_result, ctx->scan_mid); if(scan_ret == MAAT_SCAN_HIT) { hit_cnt_tunnel+=n_hit_result; @@ -1879,13 +1858,13 @@ int tunnel_scan(struct request_object_list *request, struct policy_scan_ctx *ctx } if(logic && scan_ret >= MAAT_SCAN_OK) { - scan_ret = maat_scan_not_logic(g_policy_rt->feather[vsys_id], g_policy_rt->scan_table_id[TSG_OBJ_TUNNEL], ctx->result+hit_cnt+hit_cnt_group, + scan_ret = maat_scan_not_logic(g_policy_rt->feather[vsys_id], "TUNNEL_RULE", "ATTR_TUNNEL", ctx->result+hit_cnt+hit_cnt_group, MAX_SCAN_RESULT-hit_cnt-hit_cnt_group, &n_hit_result, ctx->scan_mid); if (scan_ret == MAAT_SCAN_HIT) { hit_cnt_tunnel+=n_hit_result; } - if(scan_ret >= MAAT_SCAN_OK) + if(scan_ret >= MAAT_SCAN_HALF_HIT) { n_read=maat_state_get_hit_paths(ctx->scan_mid, ctx->hit_path, HIT_PATH_SIZE); request->merge_nth_scan[hit_path_cnt] = maat_state_get_scan_count(ctx->scan_mid); @@ -1902,21 +1881,30 @@ finish: static int app_id_scan(struct request_object_list *request, struct policy_scan_ctx *ctx, int vsys_id, int hit_cnt) { int n_read=0; + size_t n_hit_result=0; int scan_ret=0, hit_cnt_app_id=0; + struct maat_hit_object objects; struct app_id_dict *app_dict=NULL; - struct maat_hit_group hit_group; - app_dict = (struct app_id_dict*)maat_plugin_table_get_ex_data(g_policy_rt->feather[vsys_id], g_policy_rt->profile_table_id[PROFILE_APP_DI_DICT], (const char *)&(request->numeric), sizeof(long long)); + app_dict = (struct app_id_dict*)maat_plugin_table_get_ex_data(g_policy_rt->feather[vsys_id], "APP_ID_DICT", (const char *)&(request->numeric), sizeof(long long)); if(app_dict==NULL) { return 0; } - memset(&hit_group, 0, sizeof(hit_group)); - hit_group.group_id=app_dict->group_id; - scan_ret = group_scan(ctx, vsys_id, hit_cnt, hit_group, request->table_id, 1); - if(scan_ret > 0) + + memset(&objects, 0, sizeof(objects)); + uuid_copy(objects.object_uuid, app_dict->object_uuid); + scan_ret=maat_scan_object(g_policy_rt->feather[vsys_id], "APP_ID_DICT", "ATTR_APP_ID", &objects, 1, ctx->result+hit_cnt+hit_cnt_app_id, + MAX_SCAN_RESULT-hit_cnt-hit_cnt_app_id, &n_hit_result, ctx->scan_mid); + if(scan_ret == MAAT_SCAN_HIT) + { + hit_cnt_app_id+=n_hit_result; + } + scan_ret = maat_scan_not_logic(g_policy_rt->feather[vsys_id], "APP_ID_DICT", "ATTR_APP_ID", ctx->result+hit_cnt+hit_cnt_app_id, + MAX_SCAN_RESULT-hit_cnt-hit_cnt_app_id, &n_hit_result, ctx->scan_mid); + if (scan_ret == MAAT_SCAN_HIT) { - hit_cnt_app_id += scan_ret; + hit_cnt_app_id+=n_hit_result; } app_id_dict_free(app_dict); n_read=maat_state_get_hit_paths(ctx->scan_mid, ctx->hit_path, HIT_PATH_SIZE); @@ -1932,17 +1920,13 @@ static int flag_scan(struct request_object_list *request, struct policy_scan_ctx size_t n_hit_result=0; int flag=request->numeric; - int table_id = request->table_id; - scan_ret=maat_scan_flag(g_policy_rt->feather[vsys_id], g_policy_rt->scan_table_id[table_id], - flag, ctx->result+hit_cnt, MAX_SCAN_RESULT-hit_cnt, - &n_hit_result, ctx->scan_mid); + scan_ret=maat_scan_flag(g_policy_rt->feather[vsys_id], "TSG_OBJ_FLAG", "ATTR_FLAG", flag, ctx->result+hit_cnt, MAX_SCAN_RESULT-hit_cnt, &n_hit_result, ctx->scan_mid); if(scan_ret==MAAT_SCAN_HIT) { hit_cnt_flag+=n_hit_result; } - scan_ret = maat_scan_not_logic(g_policy_rt->feather[vsys_id], g_policy_rt->scan_table_id[table_id], ctx->result+hit_cnt, MAX_SCAN_RESULT-hit_cnt, - &n_hit_result, ctx->scan_mid); + scan_ret = maat_scan_not_logic(g_policy_rt->feather[vsys_id], "TSG_OBJ_FLAG", "ATTR_FLAG", ctx->result+hit_cnt, MAX_SCAN_RESULT-hit_cnt, &n_hit_result, ctx->scan_mid); if (scan_ret == MAAT_SCAN_HIT) { hit_cnt_flag+=n_hit_result; @@ -1958,24 +1942,22 @@ static int http_hdr_scan(struct request_object_list *request, struct policy_scan int n_read=0; int scan_ret=0, hit_cnt_hdr=0; size_t n_hit_result=0; + const char *scan_table_name=get_scan_table_by_table_id(request->table_id); if(!request->district_value || !request->string) { return hit_cnt_hdr; } - int table_id = request->table_id; const char *value = request->string; - const char * str_field_name = request->district_value; - maat_state_set_scan_district(ctx->scan_mid, g_policy_rt->scan_table_id[table_id], str_field_name, strlen(str_field_name)); - scan_ret = maat_scan_string(g_policy_rt->feather[vsys_id], g_policy_rt->scan_table_id[table_id], + scan_ret = maat_scan_string(g_policy_rt->feather[vsys_id], scan_table_name, request->table_name, value, strlen(value), ctx->result + hit_cnt, MAX_SCAN_RESULT - hit_cnt, &n_hit_result, ctx->scan_mid); if (scan_ret == MAAT_SCAN_HIT) { hit_cnt_hdr += n_hit_result; } - scan_ret = maat_scan_not_logic(g_policy_rt->feather[vsys_id], g_policy_rt->scan_table_id[table_id], ctx->result + hit_cnt, MAX_SCAN_RESULT - hit_cnt, + scan_ret = maat_scan_not_logic(g_policy_rt->feather[vsys_id], scan_table_name, request->table_name, ctx->result + hit_cnt, MAX_SCAN_RESULT - hit_cnt, &n_hit_result, ctx->scan_mid); if (scan_ret == MAAT_SCAN_HIT) { @@ -1996,20 +1978,20 @@ enum ip_protocol_type PROCOCOL_UDP=17, }; -static int get_group_id_by_protocol(int protocol) +const char *get_object_uuid_by_protocol(int protocol) { switch(protocol) { case PROCOCOL_ANY: - return PROTOCOL_ANY_GROUP_ID; + return PROTOCOL_ANY_OBJECT_UUID; case PROTOCOL_ICMP: - return PROTOCOL_ICMP_GROUP_ID; + return PROTOCOL_ICMP_OBJECT_UUID; case PROCOCOL_TCP: - return PROTOCOL_TCP_GROUP_ID; + return PROTOCOL_TCP_OBJECT_UUID; case PROCOCOL_UDP: - return PROTOCOL_UDP_GROUP_ID; + return PROTOCOL_UDP_OBJECT_UUID; default: - return 0; + return NULL; } } @@ -2017,13 +1999,11 @@ static int protocol_scan(struct request_object_list *request, struct policy_scan { int n_read=0; int scan_ret=0, hit_cnt_protocol=0; - struct maat_hit_group hit_group; - memset(&hit_group, 0, sizeof(hit_group)); - hit_group.group_id=get_group_id_by_protocol(request->numeric); - if(hit_group.group_id != 0) + const char *object_uuid=get_object_uuid_by_protocol(request->numeric); + if(object_uuid != NULL) { - scan_ret = group_scan(ctx, vsys_id, hit_cnt, hit_group, TSG_OBJ_IP_PROTOCOL, 1); + scan_ret = scan_object(ctx, vsys_id, hit_cnt, (char *)object_uuid, "TSG_OBJ_IP_PROTOCOL", request->table_name); if(scan_ret > 0) { hit_cnt_protocol+=scan_ret; @@ -2040,19 +2020,18 @@ static int ip_addr_scan(struct request_object_list *request, struct policy_scan_ int n_read=0; int scan_ret=0, hit_cnt_ip=0; size_t n_hit_result=0; - int table_id = request->table_id; if (request->ip_addr->addrtype == ADDR_TYPE_IPV4) { if(0 == strcasecmp(request->attribute_name, "source") || 0 == strcasecmp(request->attribute_name, "internal")) { - scan_ret = maat_scan_ipv4_port(g_policy_rt->feather[vsys_id], g_policy_rt->scan_table_id[table_id], request->ip_addr->v4->saddr, request->ip_addr->v4->source, + scan_ret = maat_scan_ipv4_port(g_policy_rt->feather[vsys_id], "TSG_OBJ_IP_ADDR", request->table_name, request->ip_addr->v4->saddr, request->ip_addr->v4->source, ctx->result+hit_cnt+hit_cnt_ip, MAX_SCAN_RESULT-hit_cnt-hit_cnt_ip, &n_hit_result, ctx->scan_mid); if(scan_ret == MAAT_SCAN_HIT) { hit_cnt_ip+=n_hit_result; } - scan_ret = maat_scan_not_logic(g_policy_rt->feather[vsys_id], g_policy_rt->scan_table_id[table_id], ctx->result+hit_cnt+hit_cnt_ip, MAX_SCAN_RESULT-hit_cnt-hit_cnt_ip, + scan_ret = maat_scan_not_logic(g_policy_rt->feather[vsys_id], "TSG_OBJ_IP_ADDR", request->table_name, ctx->result+hit_cnt+hit_cnt_ip, MAX_SCAN_RESULT-hit_cnt-hit_cnt_ip, &n_hit_result, ctx->scan_mid); if (scan_ret == MAAT_SCAN_HIT) { @@ -2061,13 +2040,13 @@ static int ip_addr_scan(struct request_object_list *request, struct policy_scan_ } if(0 == strcasecmp(request->attribute_name, "destination") || 0 == strcasecmp(request->attribute_name, "external")) { - scan_ret = maat_scan_ipv4_port(g_policy_rt->feather[vsys_id], g_policy_rt->scan_table_id[table_id], request->ip_addr->v4->daddr, request->ip_addr->v4->dest, + scan_ret = maat_scan_ipv4_port(g_policy_rt->feather[vsys_id], "TSG_OBJ_IP_ADDR", request->table_name, request->ip_addr->v4->daddr, request->ip_addr->v4->dest, ctx->result+hit_cnt+hit_cnt_ip, MAX_SCAN_RESULT-hit_cnt-hit_cnt_ip, &n_hit_result, ctx->scan_mid); if(scan_ret == MAAT_SCAN_HIT) { hit_cnt_ip+=n_hit_result; } - scan_ret = maat_scan_not_logic(g_policy_rt->feather[vsys_id], g_policy_rt->scan_table_id[table_id], ctx->result+hit_cnt+hit_cnt_ip, MAX_SCAN_RESULT-hit_cnt-hit_cnt_ip, + scan_ret = maat_scan_not_logic(g_policy_rt->feather[vsys_id], "TSG_OBJ_IP_ADDR", request->table_name, ctx->result+hit_cnt+hit_cnt_ip, MAX_SCAN_RESULT-hit_cnt-hit_cnt_ip, &n_hit_result, ctx->scan_mid); if (scan_ret == MAAT_SCAN_HIT) { @@ -2085,13 +2064,13 @@ static int ip_addr_scan(struct request_object_list *request, struct policy_scan_ { if(0 == strcasecmp(request->attribute_name, "source") || 0 == strcasecmp(request->attribute_name, "internal")) { - scan_ret = maat_scan_ipv6_port(g_policy_rt->feather[vsys_id], g_policy_rt->scan_table_id[table_id], request->ip_addr->v6->saddr,request->ip_addr->v6->source, + scan_ret = maat_scan_ipv6_port(g_policy_rt->feather[vsys_id], "TSG_OBJ_IP_ADDR", request->table_name, request->ip_addr->v6->saddr,request->ip_addr->v6->source, ctx->result+hit_cnt+hit_cnt_ip, MAX_SCAN_RESULT-hit_cnt-hit_cnt_ip, &n_hit_result, ctx->scan_mid); if (scan_ret == MAAT_SCAN_HIT) { hit_cnt_ip+=n_hit_result; } - scan_ret = maat_scan_not_logic(g_policy_rt->feather[vsys_id], g_policy_rt->scan_table_id[table_id], ctx->result+hit_cnt+hit_cnt_ip, MAX_SCAN_RESULT-hit_cnt-hit_cnt_ip, + scan_ret = maat_scan_not_logic(g_policy_rt->feather[vsys_id], "TSG_OBJ_IP_ADDR", request->table_name, ctx->result+hit_cnt+hit_cnt_ip, MAX_SCAN_RESULT-hit_cnt-hit_cnt_ip, &n_hit_result, ctx->scan_mid); if (scan_ret == MAAT_SCAN_HIT) { @@ -2100,13 +2079,13 @@ static int ip_addr_scan(struct request_object_list *request, struct policy_scan_ } if(0 == strcasecmp(request->attribute_name, "destination") || 0 == strcasecmp(request->attribute_name, "external")) { - scan_ret = maat_scan_ipv6_port(g_policy_rt->feather[vsys_id], g_policy_rt->scan_table_id[table_id], request->ip_addr->v6->daddr,request->ip_addr->v6->dest, + scan_ret = maat_scan_ipv6_port(g_policy_rt->feather[vsys_id], "TSG_OBJ_IP_ADDR", request->table_name, request->ip_addr->v6->daddr, request->ip_addr->v6->dest, ctx->result+hit_cnt+hit_cnt_ip, MAX_SCAN_RESULT-hit_cnt-hit_cnt_ip, &n_hit_result, ctx->scan_mid); if (scan_ret == MAAT_SCAN_HIT) { hit_cnt_ip+=n_hit_result; } - scan_ret = maat_scan_not_logic(g_policy_rt->feather[vsys_id], g_policy_rt->scan_table_id[table_id], ctx->result+hit_cnt+hit_cnt_ip, MAX_SCAN_RESULT-hit_cnt-hit_cnt_ip, + scan_ret = maat_scan_not_logic(g_policy_rt->feather[vsys_id], "TSG_OBJ_IP_ADDR", request->table_name, ctx->result+hit_cnt+hit_cnt_ip, MAX_SCAN_RESULT-hit_cnt-hit_cnt_ip, &n_hit_result, ctx->scan_mid); if (scan_ret == MAAT_SCAN_HIT) { @@ -2127,11 +2106,9 @@ static int ssl_extension_scan(struct request_object_list *request, struct policy { int n_read=0; int scan_ret=0, hit_cnt_ssl=0; - struct maat_hit_group hit_group; - memset(&hit_group, 0, sizeof(hit_group)); - hit_group.group_id=(request->numeric == 1 ? BOOLEAN_TRUE_GROUP_ID : BOOLEAN_FLASE_GROUP_ID); - scan_ret =group_scan(ctx, vsys_id, hit_cnt, hit_group, request->table_id, 1); + const char *object_uuid=(request->numeric == 1 ? BOOLEAN_TRUE_OBJECT_UUID : BOOLEAN_FLASE_OBJECT_UUID); + scan_ret =scan_object(ctx, vsys_id, hit_cnt, (char *)object_uuid, "TSG_OBJ_BOOLEAN", request->table_name); if(scan_ret > 0) { hit_cnt_ssl += scan_ret; @@ -2147,16 +2124,15 @@ static int port_scan(struct request_object_list *request, struct policy_scan_ctx int n_read=0; int scan_ret=0, hit_cnt_port=0; size_t n_hit_result=0; - int table_id = request->table_id; int port = atoi(request->string); - scan_ret=maat_scan_integer(g_policy_rt->feather[vsys_id], g_policy_rt->scan_table_id[table_id], port, ctx->result+hit_cnt+hit_cnt_port, + scan_ret=maat_scan_integer(g_policy_rt->feather[vsys_id], "TSG_OBJ_PORT", request->table_name, port, ctx->result+hit_cnt+hit_cnt_port, MAX_SCAN_RESULT-hit_cnt-hit_cnt_port, &n_hit_result, ctx->scan_mid); if(scan_ret == MAAT_SCAN_HIT) { hit_cnt_port+=n_hit_result; } - scan_ret = maat_scan_not_logic(g_policy_rt->feather[vsys_id], g_policy_rt->scan_table_id[table_id], ctx->result+hit_cnt+hit_cnt_port, + scan_ret = maat_scan_not_logic(g_policy_rt->feather[vsys_id], "TSG_OBJ_PORT", request->table_name, ctx->result+hit_cnt+hit_cnt_port, MAX_SCAN_RESULT-hit_cnt-hit_cnt_port, &n_hit_result, ctx->scan_mid); if (scan_ret == MAAT_SCAN_HIT) { @@ -2275,15 +2251,15 @@ size_t policy_verify_scan(int vsys_id, int compile_table_id, struct request_obje } } - scan_ret = maat_scan_string(g_policy_rt->feather[vsys_id], g_policy_rt->scan_table_id[table_id], + scan_ret = maat_scan_string(g_policy_rt->feather[vsys_id], get_scan_table_by_table_id(request_object->table_id),request_object->table_name, value, strlen(value), ctx->result+hit_cnt, MAX_SCAN_RESULT-hit_cnt, &n_hit_result, ctx->scan_mid); if(scan_ret==MAAT_SCAN_HIT) { hit_cnt+=n_hit_result; } - scan_ret = maat_scan_not_logic(g_policy_rt->feather[vsys_id], g_policy_rt->scan_table_id[table_id], ctx->result+hit_cnt, MAX_SCAN_RESULT-hit_cnt, - &n_hit_result, ctx->scan_mid); + scan_ret = maat_scan_not_logic(g_policy_rt->feather[vsys_id], get_scan_table_by_table_id(request_object->table_id),request_object->table_name, + ctx->result+hit_cnt, MAX_SCAN_RESULT-hit_cnt,&n_hit_result, ctx->scan_mid); if (scan_ret == MAAT_SCAN_HIT) { hit_cnt+=n_hit_result; @@ -2620,6 +2596,7 @@ static int get_attribute_from_json(struct request_object_list *request_object, c item = cJSON_GetObjectItem(subchild, "table_name"); if(item && item->type==cJSON_String) { + request_object->table_name = item->valuestring; request_object->table_id = protoco_field_type_str2idx(item->valuestring, buff, &p); if(request_object->table_id == __TSG_OBJ_MAX) { @@ -2969,9 +2946,6 @@ static struct maat *create_maat_feather(const char * instance_name, const char * case MAAT_INPUT_REDIS: maat_options_set_redis(opts, redis_ip, redis_port_select, db_index); break; - case MAAT_INPUT_FILE: - maat_options_set_iris(opts, ful_cfg_dir, inc_cfg_dir); - break; default: log_fatal(g_verify_proxy->logger, MODULE_VERIFY_MATCHER, "Invalid MAAT Input Mode: %d.", input_mode); goto error_out; break; @@ -2993,12 +2967,6 @@ static struct maat *create_maat_feather(const char * instance_name, const char * maat_options_set_stat_file(opts, maat_stat_db_file); } - if(g_policy_rt->load_library != 1) - { - memset(table_info, 0, sizeof(table_info)); - sprintf(table_info, "%s", "./resource/table_info_simple.conf"); - } - target = maat_new(opts, table_info); if (!target) { @@ -3018,33 +2986,22 @@ error_out: return NULL; } -int maat_complie_plugin_table_init(int vsys_id, int compile_type_id) +int maat_complie_plugin_table_init(int vsys_id) { - int table_id=0; - const char *table_name=NULL; - - const char *conjunction_table_name_map[] = {"SECURITY_COMPILE_CONJUNCTION", "PXY_CTRL_COMPILE_CONJUNCTION", "TRAFFIC_SHAPING_COMPILE_CONJUNCTION", - "SERVICE_CHAINING_COMPILE_CONJUNCTION", "PXY_INTERCEPT_COMPILE_CONJUNCTION","STATISTICS_COMPILE_CONJUNCTION", - "MONITOR_COMPILE_CONJUNCTION", "DOS_PROTECTION_COMPILE_CONJUNCTION", "TUNNEL_COMPILE_CONJUNCTION"}; - - table_name = conjunction_table_name_map[compile_type_id]; - table_id=g_policy_rt->compile_table_id[compile_type_id]=maat_get_table_id(g_policy_rt->feather[vsys_id], table_name); - if(table_id < 0) - { - return table_id; - } - - const char *plugin_table_name_map[] = {"SECURITY_COMPILE_PLUGIN", "PXY_CTRL_COMPILE_PLUGIN", "TRAFFIC_SHAPING_COMPILE_PLUGIN", - "SERVICE_CHAINING_COMPILE_PLUGIN", "PXY_INTERCEPT_COMPILE_PLUGIN", "STATISTICS_COMPILE_PLUGIN", - "MONITOR_COMPILE_PLUGIN", "DOS_PROTECTION_COMPILE_PLUGIN", "TUNNEL_COMPILE_PLUGIN"}; - - table_name = plugin_table_name_map[compile_type_id]; - table_id = g_policy_rt->plugin_table_id[compile_type_id]=maat_get_table_id(g_policy_rt->feather[vsys_id], table_name); - if(table_id >=0 ) + int ret=0; + const char *plugin_table_name_map[] = {"SECURITY_RULE_PLUGIN", "PXY_CTRL_RULE_PLUGIN", "TRAFFIC_SHAPING_RULE_PLUGIN", + "SERVICE_CHAINING_RULE_PLUGIN", "PXY_INTERCEPT_RULE_PLUGIN", "STATISTICS_COMPILE_PLUGIN", + "MONITOR_RULE_PLUGIN", "DOS_PROTECTION_RULE_PLUGIN", "TUNNEL_RULE_PLUGIN"}; + for(int i = 0; i < PXY_TABLE_DEFENCE; i++) { - maat_plugin_table_ex_schema_register(g_policy_rt->feather[vsys_id], table_name, compile_table_new_cb, compile_free_data, compile_dup_data, 0,NULL); + const char * table_name = plugin_table_name_map[i]; + ret = maat_plugin_table_ex_schema_register(g_policy_rt->feather[vsys_id], table_name, compile_table_new_cb, compile_free_data, compile_dup_data, 0,NULL); + if(ret<0) + { + continue; + } } - return table_id; + return ret; } void verify_reload_loglevel() @@ -3072,14 +3029,12 @@ int verify_policy_table_init(struct verify_policy * verify, const char* profile_ { int ret = -1; int vsys_id=0; int load_vsys_num=0, load_start_vsys=0; - char log_path[VERIFY_PATH_MAX]; + char log_path[VERIFY_PATH_MAX] = {0}; - snprintf(log_path, sizeof(log_path), "logs/maat.log"); g_policy_rt = ALLOC(struct verify_policy_rt, 1); g_policy_rt->local_logger = verify->logger; g_policy_rt->thread_num = verify->nr_work_threads; - MESA_load_profile_int_def(profile_path, "MAAT", "load_library", &(g_policy_rt->load_library), 1); MESA_load_profile_int_def(profile_path, "MAAT", "load_vsys_num", &(load_vsys_num), 255); MESA_load_profile_int_def(profile_path, "MAAT", "load_start_vsys", &(load_start_vsys), 0); load_vsys_num = load_vsys_num > VSYS_ID_MAX ? VSYS_ID_MAX : load_vsys_num; @@ -3087,64 +3042,40 @@ int verify_policy_table_init(struct verify_policy * verify, const char* profile_ for(vsys_id=load_start_vsys; vsys_id < load_vsys_num; vsys_id++) { + memset(log_path, 0, sizeof(log_path)); + snprintf(log_path, sizeof(log_path), "logs/log/maat.db%d.log", vsys_id); g_policy_rt->feather[vsys_id] = create_maat_feather("static", profile_path, "MAAT", g_policy_rt->thread_num, log_path, vsys_id); if (!g_policy_rt->feather[vsys_id]) { goto error_out; } - for (int i = 0; i < __TSG_OBJ_MAX; i++) + ret = maat_complie_plugin_table_init(vsys_id); + if(ret<0) { - g_policy_rt->scan_table_id[i] = maat_get_table_id(g_policy_rt->feather[vsys_id], table_name[i]); - if (g_policy_rt->scan_table_id[i] < 0) - { - log_fatal(g_policy_rt->local_logger, MODULE_VERIFY_MATCHER, "Maat table %s register failed.", table_name[i]); - goto error_out; - } - log_debug(g_policy_rt->local_logger, MODULE_VERIFY_MATCHER, "Register maat %p, table name %s, table id %d", g_policy_rt->feather[vsys_id], table_name[i], g_policy_rt->scan_table_id[i]); + goto error_out; } - for(int i = 0; i < PXY_TABLE_DEFENCE; i++) + ret = maat_plugin_table_ex_init(PROFILE_APP_DI_DICT, vsys_id, app_dict_table_new_cb, app_dict_table_free_cb, app_dict_table_dup_cb); + if(ret<0) { - ret = maat_complie_plugin_table_init(vsys_id, i); - if(ret<0) - { - goto error_out; - } + goto error_out; } - for(int i=0; i <=PROFILE_TUNNEL_LABEL; i++) + ret = maat_plugin_table_ex_init(PROFILE_FQDN_ENTRY, vsys_id, fqdn_entry_new_cb, library_entry_free_cb, library_entry_dup_cb); + if(ret<0) { - ret = maat_tunnel_table_init(i, vsys_id, tunnel_table_free_data, tunnel_table_dup_data); - if(ret<0) - { - goto error_out; - } + goto error_out; } - - ret = maat_plugin_table_ex_init(PROFILE_APP_DI_DICT, vsys_id, app_dict_table_new_cb, app_dict_table_free_cb, app_dict_table_dup_cb); + ret = maat_plugin_table_ex_init(PROFILE_IP_ADDR_ENTRY, vsys_id, fqdn_entry_new_cb, library_entry_free_cb, library_entry_dup_cb); if(ret<0) { goto error_out; } - - if(g_policy_rt->load_library) + ret = maat_plugin_table_ex_init(PROFILE_LIBRARY_TAG, vsys_id, library_tag_new_cb, library_tag_free_cb, library_tag_dup_cb); + if(ret<0) { - ret = maat_plugin_table_ex_init(PROFILE_FQDN_ENTRY, vsys_id, fqdn_entry_new_cb, library_entry_free_cb, library_entry_dup_cb); - if(ret<0) - { - goto error_out; - } - ret = maat_plugin_table_ex_init(PROFILE_IP_ADDR_ENTRY, vsys_id, ip_addr_entry_new_cb, library_entry_free_cb, library_entry_dup_cb); - if(ret<0) - { - goto error_out; - } - ret = maat_plugin_table_ex_init(PROFILE_LIBRARY_TAG, vsys_id, library_tag_new_cb, library_tag_free_cb, library_tag_dup_cb); - if(ret<0) - { - goto error_out; - } + goto error_out; } } ret = 0; diff --git a/resource/table_info.conf b/resource/table_info.conf index 305457a..c4afbd9 100644 --- a/resource/table_info.conf +++ b/resource/table_info.conf @@ -1,1028 +1,335 @@ [ { "table_id":0, - "table_name":"SECURITY_COMPILE", - "table_type":"compile", - "user_region_encoded":"escape", - "valid_column":9, - "custom": { - "compile_id":1, - "tags":6, - "clause_num":8 - } + "table_name":"SECURITY_RULE", + "table_type":"rule" }, { "table_id":1, - "table_name":"SECURITY_COMPILE_CONJUNCTION", - "db_tables":["SECURITY_COMPILE"], - "default_compile_table":1, - "table_type":"compile", - "user_region_encoded":"escape", - "valid_column":9, - "custom": { - "compile_id":1, - "tags":6, - "clause_num":8 - } + "table_name":"SECURITY_RULE_CONJUNCTION", + "db_tables":["SECURITY_RULE"], + "default_rule_table":1, + "table_type":"rule" }, { "table_id":2, - "table_name":"SECURITY_COMPILE_PLUGIN", - "db_tables":["SECURITY_COMPILE"], + "table_name":"SECURITY_RULE_PLUGIN", + "db_tables":["SECURITY_RULE"], "table_type":"plugin", - "valid_column":9, "custom": { - "key":1, - "key_type":"integer", - "key_len":8 + "key_name":"uuid", + "key_type":"pointer" } }, { "table_id":3, - "table_name":"GROUP_SECURITY_COMPILE_RELATION", - "table_type":"group2compile", - "associated_compile_table_id":1, - "valid_column":6, - "custom": { - "group_id":1, - "compile_id":2, - "not_flag":3, - "virtual_table_name":4, - "clause_index":5 - } + "table_name":"PXY_CTRL_RULE", + "table_type":"rule" }, { "table_id":4, - "table_name":"PXY_CTRL_COMPILE", - "table_type":"compile", - "user_region_encoded":"escape", - "valid_column":9, - "custom": { - "compile_id":1, - "tags":6, - "clause_num":8 - } - }, - { - "table_id":5, - "table_name":"PXY_CTRL_COMPILE_CONJUNCTION", - "db_tables":["PXY_CTRL_COMPILE"], - "default_compile_table":1, - "table_type":"compile", - "user_region_encoded":"escape", - "valid_column":9, - "custom": { - "compile_id":1, - "tags":6, - "clause_num":8 - } + "table_name":"PXY_CTRL_RULE_CONJUNCTION", + "db_tables":["PXY_CTRL_RULE"], + "default_rule_table":1, + "table_type":"rule" }, { - "table_id":6, - "table_name":"PXY_CTRL_COMPILE_PLUGIN", - "db_tables":["PXY_CTRL_COMPILE"], + "table_id":5, + "table_name":"PXY_CTRL_RULE_PLUGIN", + "db_tables":["PXY_CTRL_RULE"], "table_type":"plugin", - "valid_column":9, "custom": { - "key":1, - "key_type":"integer", - "key_len": 8 + "key_name":"uuid", + "key_type":"pointer" } }, { + "table_id":6, + "table_name":"TRAFFIC_SHAPING_RULE", + "table_type":"rule" + }, + { "table_id":7, - "table_name":"GROUP_PXY_CTRL_COMPILE_RELATION", - "table_type":"group2compile", - "associated_compile_table_id":5, - "valid_column":6, - "custom": { - "group_id":1, - "compile_id":2, - "not_flag":3, - "virtual_table_name":4, - "clause_index":5 - } + "table_name":"TRAFFIC_SHAPING_RULE_CONJUNCTION", + "db_tables":["TRAFFIC_SHAPING_RULE"], + "default_rule_table":1, + "table_type":"rule" }, - { + { "table_id":8, - "table_name":"TRAFFIC_SHAPING_COMPILE", - "table_type":"compile", - "user_region_encoded":"escape", - "valid_column":9, + "table_name":"TRAFFIC_SHAPING_RULE_PLUGIN", + "db_tables":["TRAFFIC_SHAPING_RULE"], + "table_type":"plugin", "custom": { - "compile_id":1, - "tags":6, - "clause_num":8 + "key_name":"uuid", + "key_type":"pointer" } }, { "table_id":9, - "table_name":"TRAFFIC_SHAPING_COMPILE_CONJUNCTION", - "db_tables":["TRAFFIC_SHAPING_COMPILE"], - "default_compile_table":1, - "table_type":"compile", - "user_region_encoded":"escape", - "valid_column":9, - "custom": { - "compile_id":1, - "tags":6, - "clause_num":8 - } + "table_name":"SERVICE_CHAINING_RULE", + "table_type":"rule" }, - { + { "table_id":10, - "table_name":"TRAFFIC_SHAPING_COMPILE_PLUGIN", - "db_tables":["TRAFFIC_SHAPING_COMPILE"], - "table_type":"plugin", - "valid_column":9, - "custom": { - "key":1, - "key_type":"integer", - "key_len": 8 - } + "table_name":"SERVICE_CHAINING_RULE_CONJUNCTION", + "db_tables":["SERVICE_CHAINING_RULE"], + "default_rule_table":1, + "table_type":"rule" }, - { + { "table_id":11, - "table_name":"GROUP_SHAPING_COMPILE_RELATION", - "table_type":"group2compile", - "associated_compile_table_id":9, - "valid_column":6, + "table_name":"SERVICE_CHAINING_RULE_PLUGIN", + "db_tables":["SERVICE_CHAINING_RULE"], + "table_type":"plugin", "custom": { - "group_id":1, - "compile_id":2, - "not_flag":3, - "virtual_table_name":4, - "clause_index":5 + "key_name":"uuid", + "key_type":"pointer" } }, - { + { "table_id":12, - "table_name":"SERVICE_CHAINING_COMPILE", - "table_type":"compile", - "user_region_encoded":"escape", - "valid_column":9, - "custom": { - "compile_id":1, - "tags":6, - "clause_num":8 - } + "table_name":"PXY_INTERCEPT_RULE", + "table_type":"rule" }, { "table_id":13, - "table_name":"SERVICE_CHAINING_COMPILE_CONJUNCTION", - "db_tables":["SERVICE_CHAINING_COMPILE"], - "default_compile_table":1, - "table_type":"compile", - "user_region_encoded":"escape", - "valid_column":9, - "custom": { - "compile_id":1, - "tags":6, - "clause_num":8 - } + "table_name":"PXY_INTERCEPT_RULE_CONJUNCTION", + "db_tables":["PXY_INTERCEPT_RULE"], + "default_rule_table":1, + "table_type":"rule" }, - { + { "table_id":14, - "table_name":"SERVICE_CHAINING_COMPILE_PLUGIN", - "db_tables":["SERVICE_CHAINING_COMPILE"], + "table_name":"PXY_INTERCEPT_RULE_PLUGIN", + "db_tables":["PXY_INTERCEPT_RULE"], "table_type":"plugin", - "valid_column":9, "custom": { - "key":1, - "key_type":"integer", - "key_len": 8 + "key_name":"uuid", + "key_type":"pointer" } }, { "table_id":15, - "table_name":"GROUP_SERVICE_CHAINING_COMPILE_RELATION", - "table_type":"group2compile", - "associated_compile_table_id":13, - "valid_column":6, - "custom": { - "group_id":1, - "compile_id":2, - "not_flag":3, - "virtual_table_name":4, - "clause_index":5 - } + "table_name":"STATISTICS_COMPILE", + "table_type":"rule" }, { "table_id":16, - "table_name":"PXY_INTERCEPT_COMPILE", - "table_type":"compile", - "user_region_encoded":"escape", - "valid_column":9, - "custom": { - "compile_id":1, - "tags":6, - "clause_num":8 - } + "table_name":"STATISTICS_COMPILE_CONJUNCTION", + "db_tables":["STATISTICS_COMPILE"], + "default_rule_table":1, + "table_type":"rule" }, { "table_id":17, - "table_name":"PXY_INTERCEPT_COMPILE_CONJUNCTION", - "db_tables":["PXY_INTERCEPT_COMPILE"], - "default_compile_table":1, - "table_type":"compile", - "user_region_encoded":"escape", - "valid_column":9, + "table_name":"STATISTICS_COMPILE_PLUGIN", + "db_tables":["STATISTICS_COMPILE"], + "table_type":"plugin", "custom": { - "compile_id":1, - "tags":6, - "clause_num":8 - } + "key_name":"uuid", + "key_type":"pointer" + } }, { "table_id":18, - "table_name":"PXY_INTERCEPT_COMPILE_PLUGIN", - "db_tables":["PXY_INTERCEPT_COMPILE"], - "table_type":"plugin", - "valid_column":9, - "custom": { - "key":1, - "key_type":"integer", - "key_len":8 - } + "table_name":"MONITOR_RULE", + "table_type":"rule" }, { "table_id":19, - "table_name":"GROUP_PXY_INTERCEPT_COMPILE_RELATION", - "table_type":"group2compile", - "associated_compile_table_id":17, - "valid_column":6, - "custom": { - "group_id":1, - "compile_id":2, - "not_flag":3, - "virtual_table_name":4, - "clause_index":5 - } + "table_name":"MONITOR_RULE_CONJUNCTION", + "db_tables":["MONITOR_RULE"], + "default_rule_table":1, + "table_type":"rule" }, { "table_id":20, - "table_name":"STATISTICS_COMPILE", - "table_type":"compile", - "user_region_encoded":"escape", - "valid_column":9, + "table_name":"MONITOR_RULE_PLUGIN", + "db_tables":["MONITOR_RULE"], + "table_type":"plugin", "custom": { - "compile_id":1, - "tags":6, - "clause_num":8 + "key_name":"uuid", + "key_type":"pointer" } }, { "table_id":21, - "table_name":"STATISTICS_COMPILE_CONJUNCTION", - "db_tables":["STATISTICS_COMPILE"], - "default_compile_table":1, - "table_type":"compile", - "user_region_encoded":"escape", - "valid_column":9, - "custom": { - "compile_id":1, - "tags":6, - "clause_num":8 - } + "table_name":"DOS_PROTECTION_RULE", + "table_type":"rule" }, { "table_id":22, - "table_name":"STATISTICS_COMPILE_PLUGIN", - "db_tables":["STATISTICS_COMPILE"], - "table_type":"plugin", - "valid_column":9, - "custom": { - "key":1, - "key_type":"integer", - "key_len": 8 - } + "table_name":"DOS_PROTECTION_RULE_CONJUNCTION", + "db_tables":["DOS_PROTECTION_RULE"], + "default_rule_table":1, + "table_type":"rule" }, { "table_id":23, - "table_name":"GROUP_STATISTICS_COMPILE_RELATION", - "table_type":"group2compile", - "associated_compile_table_id":21, - "valid_column":6, + "table_name":"DOS_PROTECTION_RULE_PLUGIN", + "db_tables":["DOS_PROTECTION_RULE"], + "table_type":"plugin", "custom": { - "group_id":1, - "compile_id":2, - "not_flag":3, - "virtual_table_name":4, - "clause_index":5 + "key_name":"uuid", + "key_type":"pointer" } }, { "table_id":24, - "table_name":"MONITOR_COMPILE", - "table_type":"compile", - "user_region_encoded":"escape", - "valid_column":9, - "custom": { - "compile_id":1, - "tags":6, - "clause_num":8 - } + "table_name":"TUNNEL_RULE", + "table_type":"rule" }, { "table_id":25, - "table_name":"MONITOR_COMPILE_CONJUNCTION", - "db_tables":["MONITOR_COMPILE"], - "default_compile_table":1, - "table_type":"compile", - "user_region_encoded":"escape", - "valid_column":9, - "custom": { - "compile_id":1, - "tags":6, - "clause_num":8 - } + "table_name":"TUNNEL_RULE_CONJUNCTION", + "db_tables":["TUNNEL_RULE"], + "default_rule_table":1, + "table_type":"rule" }, { "table_id":26, - "table_name":"MONITOR_COMPILE_PLUGIN", - "db_tables":["MONITOR_COMPILE"], + "table_name":"TUNNEL_RULE_PLUGIN", + "db_tables":["TUNNEL_RULE"], "table_type":"plugin", - "valid_column":9, "custom": { - "key":1, - "key_type":"integer", - "key_len": 8 + "key_name":"uuid", + "key_type":"pointer" } }, - { + { "table_id":27, - "table_name":"GROUP_MONITOR_COMPILE_RELATION", - "table_type":"group2compile", - "associated_compile_table_id":25, - "valid_column":6, - "custom": { - "group_id":1, - "compile_id":2, - "not_flag":3, - "virtual_table_name":4, - "clause_index":5 - } + "table_name":"OBJECT_GROUP", + "table_type":"object2object" }, { "table_id":28, - "table_name":"DOS_PROTECTION_COMPILE", - "table_type":"compile", - "user_region_encoded":"escape", - "valid_column":9, - "custom": { - "compile_id":1, - "tags":6, - "clause_num":8 - } + "table_name":"TSG_OBJ_IP_ADDR", + "table_type":"ip" }, { "table_id":29, - "table_name":"DOS_PROTECTION_COMPILE_CONJUNCTION", - "db_tables":["DOS_PROTECTION_COMPILE"], - "default_compile_table":1, - "table_type":"compile", - "user_region_encoded":"escape", - "valid_column":9, - "custom": { - "compile_id":1, - "tags":6, - "clause_num":8 - } - }, - { - "table_id":30, - "table_name":"DOS_PROTECTION_COMPILE_PLUGIN", - "db_tables":["DOS_PROTECTION_COMPILE"], - "table_type":"plugin", - "valid_column":9, - "custom": { - "key":1, - "key_type":"integer", - "key_len": 8 - } - }, - { - "table_id":31, - "table_name":"GROUP_DOS_PROTECTION_COMPILE_RELATION", - "table_type":"group2compile", - "associated_compile_table_id":29, - "valid_column":6, - "custom": { - "group_id":1, - "compile_id":2, - "not_flag":3, - "virtual_table_name":4, - "clause_index":5 - } - }, - { - "table_id":32, - "table_name":"TUNNEL_COMPILE", - "table_type":"compile", - "user_region_encoded":"escape", - "valid_column":9, - "custom": { - "compile_id":1, - "tags":6, - "clause_num":8 - } - }, - { - "table_id":33, - "table_name":"TUNNEL_COMPILE_CONJUNCTION", - "db_tables":["TUNNEL_COMPILE"], - "default_compile_table":1, - "table_type":"compile", - "user_region_encoded":"escape", - "valid_column":9, - "custom": { - "compile_id":1, - "tags":6, - "clause_num":8 - } - }, - { - "table_id":34, - "table_name":"TUNNEL_COMPILE_PLUGIN", - "db_tables":["TUNNEL_COMPILE"], - "table_type":"plugin", - "valid_column":9, - "custom": { - "key":1, - "key_type":"integer", - "key_len": 8 - } - }, - { - "table_id":35, - "table_name":"GROUP_TUNNEL_COMPILE_RELATION", - "table_type":"group2compile", - "associated_compile_table_id":33, - "valid_column":6, - "custom": { - "group_id":1, - "compile_id":2, - "not_flag":3, - "virtual_table_name":4, - "clause_index":5 - } - }, - { - "table_id":36, - "table_name":"OBJECT_GROUP", - "table_type":"group2group", - "valid_column":4, - "custom": { - "group_id":1, - "included_sub_group_ids":2, - "excluded_sub_group_ids":3 - } - }, - { - "table_id":37, - "table_name":"TSG_OBJ_IP", - "db_tables":["TSG_OBJ_IP_ADDR","TSG_OBJ_IP_LEARNING_ADDR"], - "table_type":"ip", - "valid_column":8, - "custom": { - "item_id":1, - "group_id":2, - "addr_type":3, - "addr_format":4, - "ip1":5, - "ip2":6, - "port":7 - } - }, - { - "table_id":38, "table_name":"TSG_OBJ_SUBSCRIBER_ID", - "table_type":"expr", - "valid_column":7, - "custom": { - "item_id":1, - "group_id":2, - "keywords":3, - "expr_type":4, - "match_method":5, - "is_hexbin":6 - } + "table_type":"expr" }, { - "table_id":39, + "table_id":30, "table_name":"TSG_OBJ_ACCOUNT", - "table_type":"expr", - "valid_column":7, - "custom": { - "item_id":1, - "group_id":2, - "keywords":3, - "expr_type":4, - "match_method":5, - "is_hexbin":6 - } + "table_type":"expr" }, { - "table_id":40, + "table_id":31, "table_name":"TSG_OBJ_URL", - "table_type":"expr", - "valid_column":7, - "custom": { - "item_id":1, - "group_id":2, - "keywords":3, - "expr_type":4, - "match_method":5, - "is_hexbin":6 - } + "table_type":"expr" }, { - "table_id":41, + "table_id":32, "table_name":"TSG_OBJ_FQDN", - "table_type":"expr", - "valid_column":7, - "custom": { - "item_id":1, - "group_id":2, - "keywords":3, - "expr_type":4, - "match_method":5, - "is_hexbin":6 - } + "table_type":"expr" }, { - "table_id":42, - "table_name":"TSG_OBJ_KEYWORDS", - "table_type":"expr", - "valid_column":7, - "custom": { - "item_id":1, - "group_id":2, - "keywords":3, - "expr_type":4, - "match_method":5, - "is_hexbin":6 - } - }, - { - "table_id":43, - "table_name":"TSG_OBJ_HTTP_SIGNATURE", - "table_type":"expr_plus", - "valid_column":8, - "custom": { - "item_id":1, - "group_id":2, - "district":3, - "keywords":4, - "expr_type":5, - "match_method":6, - "is_hexbin":7 - } - }, - { - "table_id":44, - "table_name":"ATTR_HTTP_URL", - "table_type":"virtual", - "physical_table": "TSG_OBJ_URL" - }, - { - "table_id":45, - "table_name":"ATTR_HTTP_REQ_HDR", - "table_type":"virtual", - "physical_table": "TSG_OBJ_HTTP_SIGNATURE" - }, - { - "table_id":46, - "table_name":"ATTR_HTTP_RES_HDR", - "table_type":"virtual", - "physical_table": "TSG_OBJ_HTTP_SIGNATURE" - }, - { - "table_id":47, - "table_name":"ATTR_HTTP_REQ_BODY", - "table_type":"virtual", - "physical_table": "TSG_OBJ_KEYWORDS" - }, - { - "table_id":48, - "table_name":"ATTR_HTTP_RES_BODY", - "table_type":"virtual", - "physical_table": "TSG_OBJ_KEYWORDS" - }, - { - "table_id":49, - "table_name":"ATTR_SSL_CN", - "table_type":"virtual", - "physical_table": "TSG_OBJ_FQDN" - }, - { - "table_id":50, - "table_name":"ATTR_SSL_SAN", - "table_type":"virtual", - "physical_table": "TSG_OBJ_FQDN" - }, - { - "table_id":51, - "table_name":"ATTR_DNS_QNAME", - "table_type":"virtual", - "physical_table": "TSG_OBJ_FQDN" - }, - { - "table_id":52, - "table_name":"ATTR_MAIL_ACCOUNT", - "table_type":"virtual", - "physical_table": "TSG_OBJ_ACCOUNT" - }, - { - "table_id":53, - "table_name":"ATTR_MAIL_FROM", - "table_type":"virtual", - "physical_table": "TSG_OBJ_ACCOUNT" - }, - { - "table_id":54, - "table_name":"ATTR_MAIL_TO", - "table_type":"virtual", - "physical_table": "TSG_OBJ_ACCOUNT" - }, - { - "table_id":55, - "table_name":"ATTR_MAIL_SUBJECT", - "table_type":"virtual", - "physical_table": "TSG_OBJ_KEYWORDS" - }, - { - "table_id":56, - "table_name":"ATTR_MAIL_CONTENT", - "table_type":"virtual", - "physical_table": "TSG_OBJ_KEYWORDS" - }, - { - "table_id":57, - "table_name":"ATTR_MAIL_ATT_NAME", - "table_type":"virtual", - "physical_table": "TSG_OBJ_KEYWORDS" - }, - { - "table_id":58, - "table_name":"ATTR_MAIL_ATT_CONTENT", - "table_type":"virtual", - "physical_table": "TSG_OBJ_KEYWORDS" - }, - { - "table_id":59, - "table_name":"ATTR_FTP_URI", - "table_type":"virtual", - "physical_table": "TSG_OBJ_URL" - }, - { - "table_id":60, - "table_name":"ATTR_FTP_CONTENT", - "table_type":"virtual", - "physical_table": "TSG_OBJ_KEYWORDS" - }, - { - "table_id":61, - "table_name":"ATTR_FTP_ACCOUNT", - "table_type":"virtual", - "physical_table": "TSG_OBJ_ACCOUNT" - }, - { - "table_id":62, - "table_name":"ATTR_SOURCE_IP", - "table_type":"virtual", - "physical_table": "TSG_OBJ_IP" - }, - { - "table_id":63, - "table_name":"ATTR_DESTINATION_IP", - "table_type":"virtual", - "physical_table": "TSG_OBJ_IP" - }, - { - "table_id":64, - "table_name":"ATTR_SIP_ORIGINATOR_DESCRIPTION", - "table_type":"virtual", - "physical_table": "TSG_OBJ_ACCOUNT" - }, - { - "table_id":65, - "table_name":"ATTR_SIP_RESPONDER_DESCRIPTION", - "table_type":"virtual", - "physical_table": "TSG_OBJ_ACCOUNT" + "table_id":33, + "table_name":"TSG_OBJ_KEYWORD", + "table_type":"expr" }, { - "table_id":66, + "table_id":34, "table_name":"TSG_OBJ_IMSI", - "table_type":"expr", - "valid_column":7, - "custom": { - "item_id":1, - "group_id":2, - "keywords":3, - "expr_type":4, - "match_method":5, - "is_hexbin":6 - } + "table_type":"expr" }, { - "table_id":67, + "table_id":35, "table_name":"TSG_OBJ_PHONE_NUMBER", - "table_type":"expr", - "valid_column":7, - "custom": { - "item_id":1, - "group_id":2, - "keywords":3, - "expr_type":4, - "match_method":5, - "is_hexbin":6 - } + "table_type":"expr" }, { - "table_id":68, + "table_id":36, "table_name":"TSG_OBJ_APN", - "table_type":"expr", - "valid_column":7, - "custom": { - "item_id":1, - "group_id":2, - "keywords":3, - "expr_type":4, - "match_method":5, - "is_hexbin":6 - } - }, - { - "table_id":69, - "table_name":"ATTR_GTP_IMSI", - "table_type":"virtual", - "physical_table": "TSG_OBJ_IMSI" - }, - { - "table_id":70, - "table_name":"ATTR_GTP_PHONE_NUMBER", - "table_type":"virtual", - "physical_table": "TSG_OBJ_PHONE_NUMBER" - }, - { - "table_id":71, - "table_name":"ATTR_GTP_APN", - "table_type":"virtual", - "physical_table": "TSG_OBJ_APN" + "table_type":"expr" }, { - "table_id":72, + "table_id":37, "table_name":"TSG_TUNNEL_CATALOG", "table_type":"bool_plugin", - "valid_column":6, "custom": { - "item_id":1, - "bool_expr":4 + "key_name":"uuid", + "key_type":"pointer" } }, { - "table_id":73, + "table_id":38, "table_name":"TSG_TUNNEL_ENDPOINT", "table_type":"ip_plugin", - "valid_column":6, "custom": { - "item_id":1, - "ip_type":2, - "start_ip":3, - "end_ip":4 + "key_name":"uuid", + "key_type":"pointer" } }, { - "table_id":74, - "table_name":"TSG_TUNNEL_LABEL", - "table_type":"plugin", - "valid_column":4, - "custom": { - "key":1, - "key_type":"pointer", - "tag":3 - } - }, - { - "table_id":75, - "table_name":"ATTR_TUNNEL", - "table_type":"virtual", - "physical_table": "TSG_TUNNEL_CATALOG" - }, - { - "table_id":76, + "table_id":39, "table_name":"TSG_OBJ_FLAG", - "table_type":"flag", - "valid_column":5, - "custom": { - "item_id":1, - "group_id":2, - "flag":3, - "flag_mask":4 - } - }, - { - "table_id":77, - "table_name":"ATTR_FLAG", - "table_type":"virtual", - "physical_table": "TSG_OBJ_FLAG" + "table_type":"flag" }, { - "table_id":78, - "table_name":"ATTR_DOH_QNAME", - "table_type":"virtual", - "physical_table": "TSG_OBJ_FQDN" - }, - { - "table_id":79, + "table_id":40, "table_name":"TSG_OBJ_IMEI", - "table_type":"expr", - "valid_column":7, - "custom": { - "item_id":1, - "group_id":2, - "keywords":3, - "expr_type":4, - "match_method":5, - "is_hexbin":6 - } - }, - { - "table_id":80, - "table_name":"ATTR_GTP_IMEI", - "table_type":"virtual", - "physical_table": "TSG_OBJ_IMEI" + "table_type":"expr" }, { - "table_id":81, + "table_id":41, "table_name": "APP_ID_DICT", "table_type": "plugin", - "valid_column": 19, "custom": { - "key": 1, - "key_type": "integer", - "key_len": 8 + "key_type":"integer", + "key_len":8, + "key_name":"app_id" } }, { - "table_id":82, - "table_name":"ATTR_SUBSCRIBER_ID", - "table_type":"virtual", - "physical_table": "TSG_OBJ_SUBSCRIBER_ID" - }, - { - "table_id":83, - "table_name":"ATTR_APP_ID", - "table_type":"virtual", - "physical_table": "APP_ID_DICT" - }, - { - "table_id":84, - "table_name": "ATTR_SERVER_FQDN", - "table_type": "virtual", - "physical_table": "TSG_OBJ_FQDN" - }, - { - "table_id":85, - "table_name":"ATTR_INTERNAL_IP", - "table_type":"virtual", - "physical_table": "TSG_OBJ_IP" - }, - { - "table_id":86, - "table_name":"ATTR_EXTERNAL_IP", - "table_type":"virtual", - "physical_table": "TSG_OBJ_IP" - }, - { - "table_id":87, - "table_name": "TSG_IP_PROTOCOL", - "table_type": "plugin", - "valid_column": 4, - "custom": { - "key": 1, - "key_type": "integer", - "key_len": 8 - } + "table_id":42, + "table_name":"TSG_OBJ_IP_PROTOCOL", + "table_type":"expr" }, { - "table_id":88, + "table_id":43, "table_name":"TSG_OBJ_PORT", - "table_type":"interval", - "valid_column":5, - "custom": { - "item_id":1, - "group_id":2, - "low_boundary":3, - "up_boundary":4 - } - }, - { - "table_id":89, - "table_name": "ATTR_SOURCE_PORT", - "table_type": "virtual", - "physical_table": "TSG_OBJ_PORT" - }, - { - "table_id":90, - "table_name": "ATTR_DESTINATION_PORT", - "table_type": "virtual", - "physical_table": "TSG_OBJ_PORT" - }, - { - "table_id":91, - "table_name": "ATTR_INTERNAL_PORT", - "table_type": "virtual", - "physical_table": "TSG_OBJ_PORT" + "table_type":"interval" }, { - "table_id":92, - "table_name": "ATTR_EXTERNAL_PORT", - "table_type": "virtual", - "physical_table": "TSG_OBJ_PORT" - }, - { - "table_id":93, - "table_name": "ATTR_IP_PROTOCOL", - "table_type": "virtual", - "physical_table": "TSG_IP_PROTOCOL" - }, - { - "table_id":94, - "table_name": "ATTR_SSL_ECH", - "table_type": "virtual", - "physical_table": "TSG_OBJ_FQDN" - }, - { - "table_id":95, - "table_name": "ATTR_SSL_ESNI", - "table_type": "virtual", - "physical_table": "TSG_OBJ_FQDN" - }, - { - "table_id":96, - "table_name": "ATTR_SSL_NO_SNI", - "table_type": "virtual", - "physical_table": "TSG_OBJ_FQDN" - }, - { - "table_id":97, - "table_name":"ATTR_TUNNEL_LEVEL", - "table_type":"virtual", - "physical_table": "TSG_TUNNEL_CATALOG" - }, - { - "table_id":98, - "table_name":"ATTR_TUNNEL_GTP_ENDPOINT", - "table_type":"virtual", - "physical_table": "TSG_OBJ_IP" - }, - { - "table_id":99, - "table_name":"ATTR_TUNNEL_GRE_ENDPOINT", - "table_type":"virtual", - "physical_table": "TSG_OBJ_IP" - }, - { - "table_id":100, - "table_name":"ATTR_TUNNEL_IP_IN_IP_ENDPOINT", - "table_type":"virtual", - "physical_table": "TSG_OBJ_IP" - }, - { - "table_id": 101, + "table_id":44, "table_name": "LIBRARY_TAG", "table_type": "plugin", - "valid_column": 6, "custom": { - "key": 1, - "key_type": "integer", - "key_len": 8 + "key_name":"uuid", + "key_type":"pointer" } }, { - "table_id":102, + "table_id":45, "table_name":"FQDN_ENTRY", "table_type":"fqdn_plugin", - "valid_column":5, "custom": { - "item_id":1, - "suffix_match_method":4, - "fqdn":3 + "key_name":"uuid", + "key_type":"pointer" } }, { - "table_id":103, + "table_id":46, "table_name":"IP_ADDR_ENTRY", "table_type":"ip_plugin", - "valid_column":7, "custom": { - "item_id":1, - "ip_type":3, - "start_ip":5, - "end_ip":6, - "addr_format":4 + "key_name":"uuid", + "key_type":"pointer" } + }, + { + "table_id":47, + "table_name":"TSG_OBJ_TUNNEL_LEVEL", + "table_type":"interval" + }, + { + "table_id": 48, + "table_name": "TSG_OBJ_BOOLEAN", + "table_type": "expr" } ]
\ No newline at end of file diff --git a/resource/table_info_simple.conf b/resource/table_info_simple.conf deleted file mode 100644 index d661c32..0000000 --- a/resource/table_info_simple.conf +++ /dev/null @@ -1,993 +0,0 @@ -[ - { - "table_id":0, - "table_name":"SECURITY_COMPILE", - "table_type":"compile", - "user_region_encoded":"escape", - "valid_column":9, - "custom": { - "compile_id":1, - "tags":6, - "clause_num":8 - } - }, - { - "table_id":1, - "table_name":"SECURITY_COMPILE_CONJUNCTION", - "db_tables":["SECURITY_COMPILE"], - "default_compile_table":1, - "table_type":"compile", - "user_region_encoded":"escape", - "valid_column":9, - "custom": { - "compile_id":1, - "tags":6, - "clause_num":8 - } - }, - { - "table_id":2, - "table_name":"SECURITY_COMPILE_PLUGIN", - "db_tables":["SECURITY_COMPILE"], - "table_type":"plugin", - "valid_column":9, - "custom": { - "key":1, - "key_type":"integer", - "key_len":8 - } - }, - { - "table_id":3, - "table_name":"GROUP_SECURITY_COMPILE_RELATION", - "table_type":"group2compile", - "associated_compile_table_id":1, - "valid_column":6, - "custom": { - "group_id":1, - "compile_id":2, - "not_flag":3, - "virtual_table_name":4, - "clause_index":5 - } - }, - { - "table_id":4, - "table_name":"PXY_CTRL_COMPILE", - "table_type":"compile", - "user_region_encoded":"escape", - "valid_column":9, - "custom": { - "compile_id":1, - "tags":6, - "clause_num":8 - } - }, - { - "table_id":5, - "table_name":"PXY_CTRL_COMPILE_CONJUNCTION", - "db_tables":["PXY_CTRL_COMPILE"], - "default_compile_table":1, - "table_type":"compile", - "user_region_encoded":"escape", - "valid_column":9, - "custom": { - "compile_id":1, - "tags":6, - "clause_num":8 - } - }, - { - "table_id":6, - "table_name":"PXY_CTRL_COMPILE_PLUGIN", - "db_tables":["PXY_CTRL_COMPILE"], - "table_type":"plugin", - "valid_column":9, - "custom": { - "key":1, - "key_type":"integer", - "key_len": 8 - } - }, - { - "table_id":7, - "table_name":"GROUP_PXY_CTRL_COMPILE_RELATION", - "table_type":"group2compile", - "associated_compile_table_id":5, - "valid_column":6, - "custom": { - "group_id":1, - "compile_id":2, - "not_flag":3, - "virtual_table_name":4, - "clause_index":5 - } - }, - { - "table_id":8, - "table_name":"TRAFFIC_SHAPING_COMPILE", - "table_type":"compile", - "user_region_encoded":"escape", - "valid_column":9, - "custom": { - "compile_id":1, - "tags":6, - "clause_num":8 - } - }, - { - "table_id":9, - "table_name":"TRAFFIC_SHAPING_COMPILE_CONJUNCTION", - "db_tables":["TRAFFIC_SHAPING_COMPILE"], - "default_compile_table":1, - "table_type":"compile", - "user_region_encoded":"escape", - "valid_column":9, - "custom": { - "compile_id":1, - "tags":6, - "clause_num":8 - } - }, - { - "table_id":10, - "table_name":"TRAFFIC_SHAPING_COMPILE_PLUGIN", - "db_tables":["TRAFFIC_SHAPING_COMPILE"], - "table_type":"plugin", - "valid_column":9, - "custom": { - "key":1, - "key_type":"integer", - "key_len": 8 - } - }, - { - "table_id":11, - "table_name":"GROUP_SHAPING_COMPILE_RELATION", - "table_type":"group2compile", - "associated_compile_table_id":9, - "valid_column":6, - "custom": { - "group_id":1, - "compile_id":2, - "not_flag":3, - "virtual_table_name":4, - "clause_index":5 - } - }, - { - "table_id":12, - "table_name":"SERVICE_CHAINING_COMPILE", - "table_type":"compile", - "user_region_encoded":"escape", - "valid_column":9, - "custom": { - "compile_id":1, - "tags":6, - "clause_num":8 - } - }, - { - "table_id":13, - "table_name":"SERVICE_CHAINING_COMPILE_CONJUNCTION", - "db_tables":["SERVICE_CHAINING_COMPILE"], - "default_compile_table":1, - "table_type":"compile", - "user_region_encoded":"escape", - "valid_column":9, - "custom": { - "compile_id":1, - "tags":6, - "clause_num":8 - } - }, - { - "table_id":14, - "table_name":"SERVICE_CHAINING_COMPILE_PLUGIN", - "db_tables":["SERVICE_CHAINING_COMPILE"], - "table_type":"plugin", - "valid_column":9, - "custom": { - "key":1, - "key_type":"integer", - "key_len": 8 - } - }, - { - "table_id":15, - "table_name":"GROUP_SERVICE_CHAINING_COMPILE_RELATION", - "table_type":"group2compile", - "associated_compile_table_id":13, - "valid_column":6, - "custom": { - "group_id":1, - "compile_id":2, - "not_flag":3, - "virtual_table_name":4, - "clause_index":5 - } - }, - { - "table_id":16, - "table_name":"PXY_INTERCEPT_COMPILE", - "table_type":"compile", - "user_region_encoded":"escape", - "valid_column":9, - "custom": { - "compile_id":1, - "tags":6, - "clause_num":8 - } - }, - { - "table_id":17, - "table_name":"PXY_INTERCEPT_COMPILE_CONJUNCTION", - "db_tables":["PXY_INTERCEPT_COMPILE"], - "default_compile_table":1, - "table_type":"compile", - "user_region_encoded":"escape", - "valid_column":9, - "custom": { - "compile_id":1, - "tags":6, - "clause_num":8 - } - }, - { - "table_id":18, - "table_name":"PXY_INTERCEPT_COMPILE_PLUGIN", - "db_tables":["PXY_INTERCEPT_COMPILE"], - "table_type":"plugin", - "valid_column":9, - "custom": { - "key":1, - "key_type":"integer", - "key_len":8 - } - }, - { - "table_id":19, - "table_name":"GROUP_PXY_INTERCEPT_COMPILE_RELATION", - "table_type":"group2compile", - "associated_compile_table_id":17, - "valid_column":6, - "custom": { - "group_id":1, - "compile_id":2, - "not_flag":3, - "virtual_table_name":4, - "clause_index":5 - } - }, - { - "table_id":20, - "table_name":"STATISTICS_COMPILE", - "table_type":"compile", - "user_region_encoded":"escape", - "valid_column":9, - "custom": { - "compile_id":1, - "tags":6, - "clause_num":8 - } - }, - { - "table_id":21, - "table_name":"STATISTICS_COMPILE_CONJUNCTION", - "db_tables":["STATISTICS_COMPILE"], - "default_compile_table":1, - "table_type":"compile", - "user_region_encoded":"escape", - "valid_column":9, - "custom": { - "compile_id":1, - "tags":6, - "clause_num":8 - } - }, - { - "table_id":22, - "table_name":"STATISTICS_COMPILE_PLUGIN", - "db_tables":["STATISTICS_COMPILE"], - "table_type":"plugin", - "valid_column":9, - "custom": { - "key":1, - "key_type":"integer", - "key_len": 8 - } - }, - { - "table_id":23, - "table_name":"GROUP_STATISTICS_COMPILE_RELATION", - "table_type":"group2compile", - "associated_compile_table_id":21, - "valid_column":6, - "custom": { - "group_id":1, - "compile_id":2, - "not_flag":3, - "virtual_table_name":4, - "clause_index":5 - } - }, - { - "table_id":24, - "table_name":"MONITOR_COMPILE", - "table_type":"compile", - "user_region_encoded":"escape", - "valid_column":9, - "custom": { - "compile_id":1, - "tags":6, - "clause_num":8 - } - }, - { - "table_id":25, - "table_name":"MONITOR_COMPILE_CONJUNCTION", - "db_tables":["MONITOR_COMPILE"], - "default_compile_table":1, - "table_type":"compile", - "user_region_encoded":"escape", - "valid_column":9, - "custom": { - "compile_id":1, - "tags":6, - "clause_num":8 - } - }, - { - "table_id":26, - "table_name":"MONITOR_COMPILE_PLUGIN", - "db_tables":["MONITOR_COMPILE"], - "table_type":"plugin", - "valid_column":9, - "custom": { - "key":1, - "key_type":"integer", - "key_len": 8 - } - }, - { - "table_id":27, - "table_name":"GROUP_MONITOR_COMPILE_RELATION", - "table_type":"group2compile", - "associated_compile_table_id":25, - "valid_column":6, - "custom": { - "group_id":1, - "compile_id":2, - "not_flag":3, - "virtual_table_name":4, - "clause_index":5 - } - }, - { - "table_id":28, - "table_name":"DOS_PROTECTION_COMPILE", - "table_type":"compile", - "user_region_encoded":"escape", - "valid_column":9, - "custom": { - "compile_id":1, - "tags":6, - "clause_num":8 - } - }, - { - "table_id":29, - "table_name":"DOS_PROTECTION_COMPILE_CONJUNCTION", - "db_tables":["DOS_PROTECTION_COMPILE"], - "default_compile_table":1, - "table_type":"compile", - "user_region_encoded":"escape", - "valid_column":9, - "custom": { - "compile_id":1, - "tags":6, - "clause_num":8 - } - }, - { - "table_id":30, - "table_name":"DOS_PROTECTION_COMPILE_PLUGIN", - "db_tables":["DOS_PROTECTION_COMPILE"], - "table_type":"plugin", - "valid_column":9, - "custom": { - "key":1, - "key_type":"integer", - "key_len": 8 - } - }, - { - "table_id":31, - "table_name":"GROUP_DOS_PROTECTION_COMPILE_RELATION", - "table_type":"group2compile", - "associated_compile_table_id":29, - "valid_column":6, - "custom": { - "group_id":1, - "compile_id":2, - "not_flag":3, - "virtual_table_name":4, - "clause_index":5 - } - }, - { - "table_id":32, - "table_name":"TUNNEL_COMPILE", - "table_type":"compile", - "user_region_encoded":"escape", - "valid_column":9, - "custom": { - "compile_id":1, - "tags":6, - "clause_num":8 - } - }, - { - "table_id":33, - "table_name":"TUNNEL_COMPILE_CONJUNCTION", - "db_tables":["TUNNEL_COMPILE"], - "default_compile_table":1, - "table_type":"compile", - "user_region_encoded":"escape", - "valid_column":9, - "custom": { - "compile_id":1, - "tags":6, - "clause_num":8 - } - }, - { - "table_id":34, - "table_name":"TUNNEL_COMPILE_PLUGIN", - "db_tables":["TUNNEL_COMPILE"], - "table_type":"plugin", - "valid_column":9, - "custom": { - "key":1, - "key_type":"integer", - "key_len": 8 - } - }, - { - "table_id":35, - "table_name":"GROUP_TUNNEL_COMPILE_RELATION", - "table_type":"group2compile", - "associated_compile_table_id":33, - "valid_column":6, - "custom": { - "group_id":1, - "compile_id":2, - "not_flag":3, - "virtual_table_name":4, - "clause_index":5 - } - }, - { - "table_id":36, - "table_name":"OBJECT_GROUP", - "table_type":"group2group", - "valid_column":4, - "custom": { - "group_id":1, - "included_sub_group_ids":2, - "excluded_sub_group_ids":3 - } - }, - { - "table_id":37, - "table_name":"TSG_OBJ_IP", - "db_tables":["TSG_OBJ_IP_ADDR","TSG_OBJ_IP_LEARNING_ADDR"], - "table_type":"ip", - "valid_column":8, - "custom": { - "item_id":1, - "group_id":2, - "addr_type":3, - "addr_format":4, - "ip1":5, - "ip2":6, - "port":7 - } - }, - { - "table_id":38, - "table_name":"TSG_OBJ_SUBSCRIBER_ID", - "table_type":"expr", - "valid_column":7, - "custom": { - "item_id":1, - "group_id":2, - "keywords":3, - "expr_type":4, - "match_method":5, - "is_hexbin":6 - } - }, - { - "table_id":39, - "table_name":"TSG_OBJ_ACCOUNT", - "table_type":"expr", - "valid_column":7, - "custom": { - "item_id":1, - "group_id":2, - "keywords":3, - "expr_type":4, - "match_method":5, - "is_hexbin":6 - } - }, - { - "table_id":40, - "table_name":"TSG_OBJ_URL", - "table_type":"expr", - "valid_column":7, - "custom": { - "item_id":1, - "group_id":2, - "keywords":3, - "expr_type":4, - "match_method":5, - "is_hexbin":6 - } - }, - { - "table_id":41, - "table_name":"TSG_OBJ_FQDN", - "table_type":"expr", - "valid_column":7, - "custom": { - "item_id":1, - "group_id":2, - "keywords":3, - "expr_type":4, - "match_method":5, - "is_hexbin":6 - } - }, - { - "table_id":42, - "table_name":"TSG_OBJ_KEYWORDS", - "table_type":"expr", - "valid_column":7, - "custom": { - "item_id":1, - "group_id":2, - "keywords":3, - "expr_type":4, - "match_method":5, - "is_hexbin":6 - } - }, - { - "table_id":43, - "table_name":"TSG_OBJ_HTTP_SIGNATURE", - "table_type":"expr_plus", - "valid_column":8, - "custom": { - "item_id":1, - "group_id":2, - "district":3, - "keywords":4, - "expr_type":5, - "match_method":6, - "is_hexbin":7 - } - }, - { - "table_id":44, - "table_name":"ATTR_HTTP_URL", - "table_type":"virtual", - "physical_table": "TSG_OBJ_URL" - }, - { - "table_id":45, - "table_name":"ATTR_HTTP_REQ_HDR", - "table_type":"virtual", - "physical_table": "TSG_OBJ_HTTP_SIGNATURE" - }, - { - "table_id":46, - "table_name":"ATTR_HTTP_RES_HDR", - "table_type":"virtual", - "physical_table": "TSG_OBJ_HTTP_SIGNATURE" - }, - { - "table_id":47, - "table_name":"ATTR_HTTP_REQ_BODY", - "table_type":"virtual", - "physical_table": "TSG_OBJ_KEYWORDS" - }, - { - "table_id":48, - "table_name":"ATTR_HTTP_RES_BODY", - "table_type":"virtual", - "physical_table": "TSG_OBJ_KEYWORDS" - }, - { - "table_id":49, - "table_name":"ATTR_SSL_CN", - "table_type":"virtual", - "physical_table": "TSG_OBJ_FQDN" - }, - { - "table_id":50, - "table_name":"ATTR_SSL_SAN", - "table_type":"virtual", - "physical_table": "TSG_OBJ_FQDN" - }, - { - "table_id":51, - "table_name":"ATTR_DNS_QNAME", - "table_type":"virtual", - "physical_table": "TSG_OBJ_FQDN" - }, - { - "table_id":52, - "table_name":"ATTR_MAIL_ACCOUNT", - "table_type":"virtual", - "physical_table": "TSG_OBJ_ACCOUNT" - }, - { - "table_id":53, - "table_name":"ATTR_MAIL_FROM", - "table_type":"virtual", - "physical_table": "TSG_OBJ_ACCOUNT" - }, - { - "table_id":54, - "table_name":"ATTR_MAIL_TO", - "table_type":"virtual", - "physical_table": "TSG_OBJ_ACCOUNT" - }, - { - "table_id":55, - "table_name":"ATTR_MAIL_SUBJECT", - "table_type":"virtual", - "physical_table": "TSG_OBJ_KEYWORDS" - }, - { - "table_id":56, - "table_name":"ATTR_MAIL_CONTENT", - "table_type":"virtual", - "physical_table": "TSG_OBJ_KEYWORDS" - }, - { - "table_id":57, - "table_name":"ATTR_MAIL_ATT_NAME", - "table_type":"virtual", - "physical_table": "TSG_OBJ_KEYWORDS" - }, - { - "table_id":58, - "table_name":"ATTR_MAIL_ATT_CONTENT", - "table_type":"virtual", - "physical_table": "TSG_OBJ_KEYWORDS" - }, - { - "table_id":59, - "table_name":"ATTR_FTP_URI", - "table_type":"virtual", - "physical_table": "TSG_OBJ_URL" - }, - { - "table_id":60, - "table_name":"ATTR_FTP_CONTENT", - "table_type":"virtual", - "physical_table": "TSG_OBJ_KEYWORDS" - }, - { - "table_id":61, - "table_name":"ATTR_FTP_ACCOUNT", - "table_type":"virtual", - "physical_table": "TSG_OBJ_ACCOUNT" - }, - { - "table_id":62, - "table_name":"ATTR_SOURCE_IP", - "table_type":"virtual", - "physical_table": "TSG_OBJ_IP" - }, - { - "table_id":63, - "table_name":"ATTR_DESTINATION_IP", - "table_type":"virtual", - "physical_table": "TSG_OBJ_IP" - }, - { - "table_id":64, - "table_name":"ATTR_SIP_ORIGINATOR_DESCRIPTION", - "table_type":"virtual", - "physical_table": "TSG_OBJ_ACCOUNT" - }, - { - "table_id":65, - "table_name":"ATTR_SIP_RESPONDER_DESCRIPTION", - "table_type":"virtual", - "physical_table": "TSG_OBJ_ACCOUNT" - }, - { - "table_id":66, - "table_name":"TSG_OBJ_IMSI", - "table_type":"expr", - "valid_column":7, - "custom": { - "item_id":1, - "group_id":2, - "keywords":3, - "expr_type":4, - "match_method":5, - "is_hexbin":6 - } - }, - { - "table_id":67, - "table_name":"TSG_OBJ_PHONE_NUMBER", - "table_type":"expr", - "valid_column":7, - "custom": { - "item_id":1, - "group_id":2, - "keywords":3, - "expr_type":4, - "match_method":5, - "is_hexbin":6 - } - }, - { - "table_id":68, - "table_name":"TSG_OBJ_APN", - "table_type":"expr", - "valid_column":7, - "custom": { - "item_id":1, - "group_id":2, - "keywords":3, - "expr_type":4, - "match_method":5, - "is_hexbin":6 - } - }, - { - "table_id":69, - "table_name":"ATTR_GTP_IMSI", - "table_type":"virtual", - "physical_table": "TSG_OBJ_IMSI" - }, - { - "table_id":70, - "table_name":"ATTR_GTP_PHONE_NUMBER", - "table_type":"virtual", - "physical_table": "TSG_OBJ_PHONE_NUMBER" - }, - { - "table_id":71, - "table_name":"ATTR_GTP_APN", - "table_type":"virtual", - "physical_table": "TSG_OBJ_APN" - }, - { - "table_id":72, - "table_name":"TSG_TUNNEL_CATALOG", - "table_type":"bool_plugin", - "valid_column":6, - "custom": { - "item_id":1, - "bool_expr":4 - } - }, - { - "table_id":73, - "table_name":"TSG_TUNNEL_ENDPOINT", - "table_type":"ip_plugin", - "valid_column":6, - "custom": { - "item_id":1, - "ip_type":2, - "start_ip":3, - "end_ip":4 - } - }, - { - "table_id":74, - "table_name":"TSG_TUNNEL_LABEL", - "table_type":"plugin", - "valid_column":4, - "custom": { - "key":1, - "key_type":"pointer", - "tag":3 - } - }, - { - "table_id":75, - "table_name":"ATTR_TUNNEL", - "table_type":"virtual", - "physical_table": "TSG_TUNNEL_CATALOG" - }, - { - "table_id":76, - "table_name":"TSG_OBJ_FLAG", - "table_type":"flag", - "valid_column":5, - "custom": { - "item_id":1, - "group_id":2, - "flag":3, - "flag_mask":4 - } - }, - { - "table_id":77, - "table_name":"ATTR_FLAG", - "table_type":"virtual", - "physical_table": "TSG_OBJ_FLAG" - }, - { - "table_id":78, - "table_name":"ATTR_DOH_QNAME", - "table_type":"virtual", - "physical_table": "TSG_OBJ_FQDN" - }, - { - "table_id":79, - "table_name":"TSG_OBJ_IMEI", - "table_type":"expr", - "valid_column":7, - "custom": { - "item_id":1, - "group_id":2, - "keywords":3, - "expr_type":4, - "match_method":5, - "is_hexbin":6 - } - }, - { - "table_id":80, - "table_name":"ATTR_GTP_IMEI", - "table_type":"virtual", - "physical_table": "TSG_OBJ_IMEI" - }, - { - "table_id":81, - "table_name": "APP_ID_DICT", - "table_type": "plugin", - "valid_column": 19, - "custom": { - "key": 1, - "key_type": "integer", - "key_len": 8 - } - }, - { - "table_id":82, - "table_name":"ATTR_SUBSCRIBER_ID", - "table_type":"virtual", - "physical_table": "TSG_OBJ_SUBSCRIBER_ID" - }, - { - "table_id":83, - "table_name":"ATTR_APP_ID", - "table_type":"virtual", - "physical_table": "APP_ID_DICT" - }, - { - "table_id":84, - "table_name": "ATTR_SERVER_FQDN", - "table_type": "virtual", - "physical_table": "TSG_OBJ_FQDN" - }, - { - "table_id":85, - "table_name":"ATTR_INTERNAL_IP", - "table_type":"virtual", - "physical_table": "TSG_OBJ_IP" - }, - { - "table_id":86, - "table_name":"ATTR_EXTERNAL_IP", - "table_type":"virtual", - "physical_table": "TSG_OBJ_IP" - }, - { - "table_id":87, - "table_name": "TSG_IP_PROTOCOL", - "table_type": "plugin", - "valid_column": 4, - "custom": { - "key": 1, - "key_type": "integer", - "key_len": 8 - } - }, - { - "table_id":88, - "table_name":"TSG_OBJ_PORT", - "table_type":"interval", - "valid_column":5, - "custom": { - "item_id":1, - "group_id":2, - "low_boundary":3, - "up_boundary":4 - } - }, - { - "table_id":89, - "table_name": "ATTR_SOURCE_PORT", - "table_type": "virtual", - "physical_table": "TSG_OBJ_PORT" - }, - { - "table_id":90, - "table_name": "ATTR_DESTINATION_PORT", - "table_type": "virtual", - "physical_table": "TSG_OBJ_PORT" - }, - { - "table_id":91, - "table_name": "ATTR_INTERNAL_PORT", - "table_type": "virtual", - "physical_table": "TSG_OBJ_PORT" - }, - { - "table_id":92, - "table_name": "ATTR_EXTERNAL_PORT", - "table_type": "virtual", - "physical_table": "TSG_OBJ_PORT" - }, - { - "table_id":93, - "table_name": "ATTR_IP_PROTOCOL", - "table_type": "virtual", - "physical_table": "TSG_IP_PROTOCOL" - }, - { - "table_id":94, - "table_name": "ATTR_SSL_ECH", - "table_type": "virtual", - "physical_table": "TSG_OBJ_FQDN" - }, - { - "table_id":95, - "table_name": "ATTR_SSL_ESNI", - "table_type": "virtual", - "physical_table": "TSG_OBJ_FQDN" - }, - { - "table_id":96, - "table_name": "ATTR_SSL_NO_SNI", - "table_type": "virtual", - "physical_table": "TSG_OBJ_FQDN" - }, - { - "table_id":97, - "table_name":"ATTR_TUNNEL_LEVEL", - "table_type":"virtual", - "physical_table": "TSG_TUNNEL_CATALOG" - }, - { - "table_id":98, - "table_name":"ATTR_TUNNEL_GTP_ENDPOINT", - "table_type":"virtual", - "physical_table": "TSG_OBJ_IP" - }, - { - "table_id":99, - "table_name":"ATTR_TUNNEL_GRE_ENDPOINT", - "table_type":"virtual", - "physical_table": "TSG_OBJ_IP" - }, - { - "table_id":100, - "table_name":"ATTR_TUNNEL_IP_IN_IP_ENDPOINT", - "table_type":"virtual", - "physical_table": "TSG_OBJ_IP" - } -]
\ No newline at end of file diff --git a/resource/verify-policy.json b/resource/verify-policy.json index cc03616..abdbe4f 100644 --- a/resource/verify-policy.json +++ b/resource/verify-policy.json @@ -1,480 +1,281 @@ { - "compile_table": "PXY_CTRL_COMPILE", - "group2compile_table": "GROUP_PXY_CTRL_COMPILE_RELATION", - "group2group_table": "GROUP_GROUP_RELATION", + "rule_table": "PXY_CTRL_RULE", + "object2object_table": "OBJECT_GROUP", "rules": [ - { - "compile_id": 1021, + { + "uuid": "40c9c6a7-70a9-48ae-9fba-ec7966edd3c6", "service": 1, - "action": 48, - "do_blacklist": 1, - "do_log": 1, - "effective_range": 0, - "tags":"{\"tag_sets\":[[{\"tag\":\"device_id\",\"value\":[\"device_3\",\"device_4\"]}]]}", - "user_region": "{\"protocol\":\"http\",\"method\":\"redirect\",\"code\":302,\"to\":\"https://www.jd.com\"}", - "is_valid": "yes", - "groups": [ + "action": "manipulate", + "blacklist_option": 1, + "log_option": "all", + "action_parameter": "anything", + "is_valid": "yes", + "and_conditions": [ { - "virtual_table":"ATTR_HTTP_URL", - "group_name":"http_url", - "group_id":101, - "not_flag":0, - "regions": [ - { - "table_name": "TSG_OBJ_URL", - "table_type": "expr", - "table_content": { - "keywords": "baidu.com", - "expr_type": "regex", - "match_method": "sub", - "format": "uncase plain" - } - } - ] - }, - { - "virtual_table":"ATTR_SERVER_FQDN", - "group_name":"http_fqdn", - "group_id":1011, - "not_flag":0, - "regions": [ - { - "table_name": "TSG_OBJ_FQDN", - "table_type": "expr", - "table_content": { - "keywords": "baidu.com", - "expr_type": "regex", - "match_method": "sub", - "format": "uncase plain" - } - } - ] - }, - { - "virtual_table":"ATTR_SSL_SAN", - "group_name":"ssl_san", - "group_id":11011, - "not_flag":0, - "regions": [ + "attribute_name": "ATTR_HTTP_URL", + "objects": [ { - "table_name": "TSG_OBJ_FQDN", - "table_type": "expr", - "table_content": { - "keywords": "baidu.com", - "expr_type": "regex", - "match_method": "sub", - "format": "uncase plain" - } + "items": [ + { + "table_name": "TSG_OBJ_URL", + "table_type": "expr", + "table_content": { + "expression": "test123456", + "expr_type": "and" + } + } + ] } ] - }, - { - "virtual_table":"ATTR_APP_ID", - "group_name":"app_id", - "group_id":201, - "not_flag":0 } ] }, { - "compile_id": 1022, + "uuid": "00600010-0000-0000-0000-000000000000", "service": 1, - "action": 48, - "do_blacklist": 1, - "do_log": 1, - "effective_range": 0, - "tags":"{\"tag_sets\":[[{\"tag\":\"device_id\",\"value\":[\"device_3\",\"device_4\"]}]]}", - "user_region": "{\"protocol\":\"http\",\"method\":\"redirect\",\"code\":302,\"to\":\"https://www.jd.com\"}", + "action": "manipulate", + "blacklist_option": 1, + "log_option": "all", + "action_parameter": "anything", "is_valid": "yes", - "groups": [ + "and_conditions": [ { - "group_name":"http_fqdn", - "virtual_table":"ATTR_SERVER_FQDN" - }, - { - "group_name":"ssl_san", - "virtual_table":"ATTR_SSL_SAN" - }, - { - "not_flag": 0, - "group_id": 604, - "group_name":"IPv4TCPSoureServiceChaining604", - "virtual_table": "ATTR_SOURCE_IP", - "regions": [ + "attribute_name": "ATTR_SOURCE_IP", + "objects": [ { - "table_type": "ip", - "table_name": "TSG_OBJ_IP_ADDR", - "table_content": { - "addr_type": "ipv4", - "addr_format": "range", - "ip1": "192.168.55.4", - "ip2": "192.168.55.4" - } + "object_name": "IPv4TCPSoureVeiryPolicy01", + "uuid": "00500100-0000-0000-0000-000000000000", + "items": [ + { + "table_type": "ip", + "table_name": "TSG_OBJ_IP_ADDR", + "table_content": { + "ip": "192.168.55.4", + "port": "80" + } + } + ] } - ] - }, - { - "group_id": 9, - "group_name": "ip.source.ip12", - "virtual_table": "ATTR_SOURCE_IP" + ] }, - { - "group_id": 10, - "group_name": "ip.source.ip13", - "virtual_table": "ATTR_DESTINATION_IP" + { + "attribute_name": "ATTR_APP_ID", + "negate_option": false, + "object_uuids": [ + "00000201-0000-0000-0000-000000000000" + ] }, - { - "group_id": 6, - "group_name": "host.fqdn6", - "virtual_table": "ATTR_SERVER_FQDN" + { + "attribute_name": "ATTR_HTTP_REQ_HDR", + "objects": [ + { + "items": [ + { + "table_name": "TSG_OBJ_KEYWORD", + "table_type": "expr", + "table_content": { + "expression": "test", + "expr_type": "and" + } + } + ] + } + ] }, - { - "group_id": 9, - "group_name": "ip.source.ip14", - "virtual_table": "ATTR_INTERNAL_IP" + { + "attribute_name": "ATTR_IP_PROTOCOL", + "negate_option": false, + "object_uuids": [ + "00000000-0000-0000-0000-000000000006" + ] }, - { - "group_id": 10, - "group_name": "ip.source.ip15", - "virtual_table": "ATTR_EXTERNAL_IP" + { + "attribute_name": "ATTR_SOURCE_PORT", + "objects": [ + { + "object_name": "IPv4TCPPortVeiryPolicy01", + "uuid": "00500200-0000-0000-0000-000000000000", + "items": [ + { + "table_name": "TSG_OBJ_PORT", + "table_type": "interval", + "table_content": { + "interval": "1-100" + } + } + ] + } + ] + }, + { + "attribute_name": "ATTR_TUNNEL_LEVEL", + "negate_option": false, + "object_uuids": [ + "00000000-0000-0000-0000-000000000050" + ] + }, + { + "attribute_name": "ATTR_FLAG", + "objects": [ + { + "object_name": "FlagVeiryPolicy01", + "uuid": "00500300-0000-0000-0000-000000000000", + "items": [ + { + "table_type": "flag", + "table_name": "TSG_OBJ_FLAG", + "table_content": { + "flag": 15, + "mask": 15 + } + } + ] + } + ] + }, + { + "attribute_name": "ATTR_SSL_ECH", + "negate_option": false, + "object_uuids": [ + "00000000-0000-0000-0000-000000000002" + ] } ] }, { - "compile_id": 11022, - "service": 1, - "action": 48, - "do_blacklist": 1, - "do_log": 1, - "effective_range": 0, - "tags":"{\"tag_sets\":[[{\"tag\":\"device_id\",\"value\":[\"device_3\",\"device_4\"]}]]}", - "user_region": "{\"protocol\":\"http\",\"method\":\"redirect\",\"code\":302,\"to\":\"https://www.jd.com\"}", - "is_valid": "no", - "groups": [ + "uuid": "00000011-0000-0000-0000-000000000000", + "service": 1, + "action": "manipulate", + "blacklist_option": 1, + "log_option": "all", + "action_parameter": "anything", + "is_valid": "yes", + "and_conditions": [ { - "not_flag": 0, - "group_id": 704, - "group_name":"IPv4TCPSoureServiceChaining604", - "virtual_table": "ATTR_SOURCE_IP", - "regions": [ - { - "table_type": "ip", - "table_name": "TSG_OBJ_IP_ADDR", - "table_content": { - "addr_type": "ipv4", - "addr_format": "range", - "ip1": "192.168.55.7", - "ip2": "192.168.55.7" - } - } - ] - } - ] - }, + "attribute_name": "ATTR_SOURCE_IP", + "negate_option": false, + "object_uuids": [ + "00000070-0000-0000-0000-000000000000" + ] + } + ] + }, { - "compile_id": 11023, + "uuid": "00000012-0000-0000-0000-000000000000", "service": 1, - "action": 48, - "do_blacklist": 1, - "do_log": 1, - "effective_range": 0, - "tags":"{\"tag_sets\":[[{\"tag\":\"device_id\",\"value\":[\"device_3\",\"device_4\"]}]]}", - "user_region": "{\"protocol\":\"http\",\"method\":\"redirect\",\"code\":302,\"to\":\"https://www.jd.com\"}", - "is_valid": "yes", - "groups": [ + "action": "manipulate", + "blacklist_option": 1, + "log_option": "all", + "action_parameter": "anything", + "is_valid": "yes", + "and_conditions": [ { - "not_flag": 0, - "group_id": 604, - "group_name":"IPv4TCPSoureServiceChaining604", - "virtual_table": "ATTR_SOURCE_IP", - "regions": [ + "attribute_name": "ATTR_SOURCE_IP", + "objects": [ { - "table_type": "ip", - "table_name": "TSG_OBJ_IP_ADDR", - "table_content": { - "addr_type": "ipv4", - "addr_format": "range", - "ip1": "192.168.55.4", - "ip2": "192.168.55.4" - } + "object_name": "IPv4TCPSoureVeiryPolicy02", + "uuid": "00000101-0000-0000-0000-000000000000", + "items": [ + { + "table_type": "ip", + "table_name": "TSG_OBJ_IP_ADDR", + "table_content": { + "ip": "192.168.0.2/32", + "port": "80" + } + } + ] } - ] - }, - { - "group_id": 9, - "group_name": "ip.source.ip12", - "virtual_table": "ATTR_SOURCE_IP" - }, - { - "group_id": 10, - "group_name": "ip.source.ip13", - "virtual_table": "ATTR_DESTINATION_IP" + ] }, { - "group_id": 9, - "group_name": "ip.source.ip14", - "virtual_table": "ATTR_INTERNAL_IP" - } - ] - }, - { - "compile_id": 1023, - "service": 1, - "action": 48, - "do_blacklist": 1, - "do_log": 1, - "effective_range": 0, - "user_region": "{\"protocol\":\"http\",\"method\":\"replace\",\"rules\":[{\"search_in\":\"http_resp_body\",\"find\":\"éźçź±\",\"replace_with\":\"test\"}]}", - "is_valid": "yes", - "groups": [ - { - "virtual_table":"ATTR_HTTP_HOST_VIRTUAL", - "group_name":"http_fqdn", - "group_id":102, - "not_flag":0, - "regions": [ + "attribute_name": "ATTR_DESTINATION_IP", + "objects": [ { - "table_name": "TSG_OBJ_FQDN", - "table_type": "expr", - "table_content": { - "keywords": "www.126.com", - "expr_type": "regex", - "match_method": "sub", - "format": "uncase plain" - } + "object_name": "IPv4TCPDestinationVeiryPolicy01", + "uuid": "00000102-0000-0000-0000-000000000000", + "items": [ + { + "table_type": "ip", + "table_name": "TSG_OBJ_IP_ADDR", + "table_content": { + "ip": "192.168.0.3/32", + "port": "80" + } + } + ] } ] - } - ] - }, - { - "compile_id": 1024, - "service": 1, - "action": 48, - "do_blacklist": 1, - "do_log": 1, - "effective_range": 0, - "user_region":"{\"protocol\":\"http\",\"method\":\"replace\",\"rules\":[{\"search_in\":\"http_resp_body\",\"find\":\"莊ć·ç»ćœ\",\"replace_with\":\"Login\"}]}", - "is_valid": "yes", - "groups": [ - { - "group_name":"http_fqdn", - "virtual_table":"ATTR_HTTP_HOST", - "not_flag":0 - } - ] - }, - { - "compile_id": 1025, - "service": 1, - "action": 48, - "do_blacklist": 1, - "do_log": 1, - "effective_range": 0, - "user_region": "{\"protocol\":\"http\",\"method\":\"replace\",\"rules\":[{\"search_in\":\"http_resp_body\",\"find\":\"äŒć\",\"replace_with\":\"çšæ·\"}]}", - "is_valid": "yes", - "groups": [ - { - "group_name":"http_fqdn", - "virtual_table":"ATTR_DOH_QNAME", - "not_flag":0 - } - ] - }, - { - "compile_id": 1026, - "service": 1, - "action": 48, - "do_blacklist": 1, - "do_log": 1, - "effective_range": 0, - "user_region": "{\"protocol\":\"http\",\"method\":\"block\",\"code\":403,\"message\":\"error\"}", - "is_valid": "yes", - "groups": [ - { - "virtual_table":"ATTR_HTTP_REQ_HDR", - "group_name":"http_signature_ua", - "group_id":103, - "not_flag":0, - "regions": [ + }, + { + "attribute_name": "ATTR_SERVER_FQDN", + "objects": [ { - "table_name": "TSG_OBJ_HTTP_SIGNATURE", - "table_type": "expr_plus", - "table_content": { - "district": "User-Agent", - "keywords": "Chrome", - "expr_type": "none", - "match_method": "sub", - "format": "uncase plain" - } + "items": [ + { + "table_name": "TSG_OBJ_FQDN", + "table_type": "expr", + "table_content": { + "expression": "baidu.com", + "expr_type": "and" + } + } + ] } ] }, { - - "virtual_table":"ATTR_HTTP_REQ_HDR", - "group_name":"http_signature_cookie", - "group_id":104, - "not_flag":0, - "regions": [ - { - "table_name": "TSG_OBJ_HTTP_SIGNATURE", - "table_type": "expr_plus", - "table_content": { - "district": "Cookie", - "keywords": "uid=12345678", - "expr_type": "none", - "match_method": "sub", - "format": "uncase plain" - } - } - ] - } - ] - }, - { - "compile_id": 1027, - "service": 1, - "action": 48, - "do_blacklist": 1, - "do_log": 1, - "effective_range": 0, - "user_region": "test", - "is_valid": "yes", - "groups": [ - { - "virtual_table":"ATTR_HTTP_URL", - "group_name":"http_url_bing", - "group_id": 105, - "not_flag":0, - "regions": [ + "attribute_name": "ATTR_SSL_SAN", + "objects": [ { - "table_name": "TSG_OBJ_URL", - "table_type": "expr", - "table_content": { - "keywords": "bing.com", - "expr_type": "regex", - "match_method": "sub", - "format": "uncase plain" - } + "items": [ + { + "table_name": "TSG_OBJ_FQDN", + "table_type": "expr", + "table_content": { + "expression": "baidu.com", + "expr_type": "and" + } + } + ] } ] - } - ] - }, - { - "compile_id": 1028, - "service": 1, - "action": 48, - "do_blacklist": 1, - "do_log": 1, - "effective_range": 0, - "user_region": "{\"protocol\":\"http\",\"method\":\"block\",\"code\":403,\"message\":\"error\"}", - "is_valid": "yes", - "groups": [ - { - "group_name":"http_url_bing", - "virtual_table":"ATTR_HTTP_URL" } ] } - ], + ], "plugin_table": [ { - "table_name": "TSG_PROFILE_TRAFFIC_MIRROR", - "table_content": [ - "1234\ttest-traffic-mirror\t[1,2,3,4,5,6,7,8,9]\t1" - ] - }, - { - "table_name": "TSG_PROFILE_RESPONSE_PAGES", - "table_content": [ - "101\t404\thtml\t./resource/pangu/policy_file/404.html\t1" - ] - }, - { - "table_name": "PXY_PROFILE_HIJACK_FILES", - "table_content": [ - "201\tchakanqi\tchakanqi-947KB.exe\tapplication/x-msdos-program\t./resource/pangu/policy_file/chakanqi-947KB.exe\t1" - ] - }, - { - "table_name": "PXY_PROFILE_INSERT_SCRIPTS", - "table_content": [ - "301\ttime\tjs\t./resource/pangu/policy_file/time.js\tbefore_page_load\t1" - ] - }, - { - "table_name": "PXY_PROFILE_DECRYPTION", - "table_content": [ - "0\ttest\t{\"dynamic_bypass\":{\"ev_cert\":0,\"cert_transparency\":0,\"mutual_authentication\":1,\"cert_pinning\":1,\"protocol_errors\":1,\"trusted_root_cert_is_not_installed_on_client\":1},\"protocol_version\":{\"min\":\"ssl3\",\"max\":\"ssl3\",\"mirror_client\":1,\"allow_http2\":1},\"certificate_checks\":{\"approach\":{\"cn\":1,\"issuer\":1,\"self-signed\":1,\"expiration\":0},\"fail_action\":\"pass-through\"}}\t1", - "3\ttest\t{\"dynamic_bypass\":{\"ev_cert\":1,\"cert_transparency\":1,\"mutual_authentication\":1,\"cert_pinning\":1,\"protocol_errors\":1,\"trusted_root_cert_is_not_installed_on_client\":0},\"protocol_version\":{\"min\":\"ssl3\",\"max\":\"tls13\",\"mirror_client\":1,\"allow_http2\":1},\"certificate_checks\":{\"approach\":{\"cn\":1,\"issuer\":1,\"self-signed\":1,\"expiration\":1},\"fail_action\":\"fail-close\"}}\t1", - "4\ttest\t{\"dynamic_bypass\":{\"ev_cert\":0,\"cert_transparency\":0,\"mutual_authentication\":0,\"cert_pinning\":0,\"protocol_errors\":0,\"trusted_root_cert_is_not_installed_on_client\":0},\"protocol_version\":{\"min\":\"ssl3\",\"max\":\"ssl3\",\"mirror_client\":0,\"allow_http2\":0},\"certificate_checks\":{\"approach\":{\"cn\":0,\"issuer\":0,\"self-signed\":0,\"expiration\":0},\"fail_action\":\"pass-through\"}}\t1" - ] - }, - { - "table_name": "PXY_INTERCEPT_COMPILE", - "table_content": [ - "0\t0\t2\t1\t1\t{}\t{\"vsys_id\":1,\"protocol\":\"SSL\",\"keyring_for_trusted\":765,\"keyring_for_untrusted\":10,\"decryption\":0,\"tcp_option_profile\":1,\"traffic_mirror\":{\"enable\":0}}\t1\t1\t2", - "255119\t0\t2\t1\t1\t{}\t{\"vsys_id\":1,\"protocol\":\"SSL\",\"keyring_for_trusted\":1,\"keyring_for_untrusted\":10,\"decryption\":0,\"tcp_option_profile\":1,\"traffic_mirror\":{\"enable\":1,\"mirror_profile\":1234}}\t1\t1\t2" - ] - }, - { - "table_name": "SERVICE_CHAINING_COMPILE", + "table_name": "APP_ID_DICT", "table_content": [ - "1\t0\t2\t1\t1\t{}\t{\"targeted_traffic\":\"raw\",\"sff_profiles\":[1]}\t1\t2", - "2\t0\t2\t1\t1\t{}\t{\"targeted_traffic\":\"decrypted\",\"sff_profiles\":[1]}\t1\t2" + {"app_id":67,"object_uuid":"00000201-0000-0000-0000-000000000000","app_name":"http","is_valid":1}, + {"app_id":68,"object_uuid":"00068000-0000-0000-0000-000000000000","app_name":"https","is_valid":1} ] }, { - "table_name": "PXY_PROFILE_TCP_OPTION", + "table_name": "IP_ADDR_ENTRY", "table_content": [ - "1\t0\t0\t{\"tcp_maxseg\":{\"enable\":0,\"maxseg\":1500},\"nodelay\":1,\"keep_alive\":{\"enable\":1,\"tcp_keepcnt\":8,\"tcp_keepidle\":30,\"tcp_keepintvl\":15},\"ttl\":70,\"user_timeout\":600}\t{\"tcp_maxseg\":{\"enable\":0,\"maxseg\":1500},\"nodelay\":1,\"keep_alive\":{\"enable\":1,\"tcp_keepcnt\":8,\"tcp_keepidle\":30,\"tcp_keepintvl\":15},\"ttl\":75,\"user_timeout\":600}\t1" + {"uuid":"00000064-0000-0000-0000-000000000000","tag_uuids":["00000068-0000-0000-0000-000000000000","00000069-0000-0000-0000-000000000000"],"ip":"192.168.55.1/24","is_valid":1,"modified_time":"1716531859000000"}, + {"uuid":"00000065-0000-0000-0000-000000000000","tag_uuids":["00000070-0000-0000-0000-000000000000"],"ip":"192.168.54.1/24","is_valid":1,"modified_time":"1716531859000000"} ] }, { - "table_name": "PXY_SSL_FINGERPRINT", - "table_content": [ - "1\t599f223c2c9ee5702f5762913889dc21\t0\t1", - "2\teb149984fc9c44d85ed7f12c90d818be\t1\t0", - "3\te6573e91e6eb777c0933c5b8f97f10cd\t1\t1" - ] - }, - { - "table_name": "APP_ID_DICT", - "table_content": [ - "67\thttp\t0\tnull\tnetworking\tinfrastructure\tnetwork-protocol\t3\tused-by-malware,vulnerability,widely-used\tnull\tnull\t{\"method\":\"drop\",\"after_n_packets\":0,\"send_icmp_unreachable\":1,\"send_tcp_reset\":1}\t0\t60\t120\t30\t30\t201\t1", - "68\thttps\t0\tnull\tnetworking\tinfrastructure\tnetwork-protocol\t3\tused-by-malware,vulnerability,widely-used\tnull\tnull\t{\"method\":\"rate_limit\",\"bps\":1000}\t0\t0\t0\t0\t0\t68000\t1" - ] - }, - { "table_name": "FQDN_ENTRY", "table_content": [ - "1\t2,4,5\twww.126.com\t1\t1", - "2\t6,7,8\twww.baidu.com\t1\t1" - ] - }, - { - "table_name": "IP_ADDR_ENTRY", - "table_content": [ - "7\t12,14,15\t4\tsingle\t192.168.55.5\t192.168.55.5\t1", - "8\t22,24,25\t4\tsingle\t192.168.55.5\t192.168.55.5\t1", - "9\t9,15\t4\trange\t192.168.55.4\t192.168.55.4\t1", - "10\t10\t4\trange\t192.168.55.6\t192.168.55.6\t1" + {"uuid":"00000066-0000-0000-0000-000000000000","tag_uuids":["00000071-0000-0000-0000-000000000000"],"fqdn":"www.126.com","is_valid":1,"modified_time":"1716531859000000"}, + {"uuid":"00000067-0000-0000-0000-000000000000","tag_uuids":["00000072-0000-0000-0000-000000000000"],"fqdn":"www.baidu.com","is_valid":1,"modified_time":"1716531859000000"} ] }, - { + { "table_name": "LIBRARY_TAG", "table_content": [ - "6\tnone\twebsite_category\twebsite_category\tsearch\\bengines\t1", - "7\tnone\twebsite_category\twebsite_category\tbusiness\t1", - "8\tnone\twebsite_category\twebsite_category\tsearch\\bengines\t1", - "12\tnone\tgeoip\ttest1\ttest1\t1", - "14\tnone\tgeoip\ttest2\ttest2\t1", - "15\tnone\tgeoip\ttest3\ttest3\t1", - "9\tnone\tgeoip\ttest4\ttest4\t1", - "10\tnone\tgeoip\ttest5\ttest5\t1" + {"uuid":"00000068-0000-0000-0000-000000000000","statistics_option":"brief","category":"geoip_city","tag_key":"Country","tag_value":"China","is_valid":1,"modified_time":"1716531859000000"}, + {"uuid":"00000069-0000-0000-0000-000000000000","statistics_option":"brief","category":"geoip_city","tag_key":"Country","tag_value":"China","is_valid":1,"modified_time":"1716531859000000"}, + {"uuid":"00000070-0000-0000-0000-000000000000","statistics_option":"brief","category":"geoip_city","tag_key":"Country","tag_value":"China","is_valid":1,"modified_time":"1716531859000000"}, + {"uuid":"00000071-0000-0000-0000-000000000000","statistics_option":"brief","category":"geoip_city","tag_key":"Country","tag_value":"China","is_valid":1,"modified_time":"1716531859000000"}, + {"uuid":"00000072-0000-0000-0000-000000000000","statistics_option":"brief","category":"geoip_city","tag_key":"Country","tag_value":"China","is_valid":1,"modified_time":"1716531859000000"} ] } + ] } diff --git a/test/CMakeLists.txt b/test/CMakeLists.txt index 751ee83..90c98df 100644 --- a/test/CMakeLists.txt +++ b/test/CMakeLists.txt @@ -2,7 +2,7 @@ cmake_minimum_required(VERSION 3.5) include_directories(${CMAKE_SOURCE_DIR}/common/include) add_executable(verify_policy_test verify_policy_test.cpp ${CMAKE_SOURCE_DIR}/platform/src/verify_matcher.cpp) -target_link_libraries(verify_policy_test common MESA_prof_load maatframe cjson gtest) +target_link_libraries(verify_policy_test common MESA_prof_load maatframe cjson uuid gtest) set(CMAKE_BUILD_DIR ${CMAKE_SOURCE_DIR}/build) set(TEST_RUN_DIR ${CMAKE_BUILD_DIR}/test) diff --git a/test/resource/HitPolicyRequest.json b/test/resource/HitPolicyRequest.json index 6b28f1b..4085387 100644 --- a/test/resource/HitPolicyRequest.json +++ b/test/resource/HitPolicyRequest.json @@ -83,6 +83,7 @@ "attribute_name": "tunnel_endpointa", "attribute_value": { "ip": "192.168.0.4", + "port":80, "tunnel_type":"gtp", "addr_type": 4 } @@ -168,7 +169,7 @@ "attribute_name": "source", "attribute_value": { "ip": "192.168.0.2", - "port":"8080", + "port": "80", "addr_type": 4 } }, @@ -178,6 +179,7 @@ "attribute_name": "destination", "attribute_value": { "ip": "192.168.0.3", + "port": "80", "addr_type": 4 } }, @@ -300,6 +302,89 @@ } ], "verify_type": "policy" + }, + { + "__item_id": 8, + "vsys_id": 1, + "verify_list": [ + { + "type": "pxy_manipulation", + "vsys_id": 1, + "verify_session": { + "attributes": [ + { + "attribute_type": "ip", + "table_name": "ATTR_SOURCE_IP", + "attribute_name": "source", + "attribute_value": { + "ip": "192.168.55.4", + "port": "80", + "addr_type": 4 + } + }, + { + "attribute_type": "ip", + "table_name": "ATTR_IP_PROTOCOL", + "attribute_name": "ip_protocol", + "attribute_value": { + "addr_type": 4, + "protocol": 6 + } + }, + { + "attribute_type": "port", + "table_name": "ATTR_SOURCE_PORT", + "attribute_name": "source", + "attribute_value": { + "port": "80" + } + }, + { + "attribute_type": "numeric", + "table_name": "ATTR_APP_ID", + "attribute_name": "app_id", + "attribute_value": { + "numeric": 67 + } + }, + { + "attribute_type": "string", + "table_name": "ATTR_HTTP_REQ_HDR", + "attribute_name": "req_hdr", + "attribute_value": { + "district":"User-Agent", + "string":"test" + } + }, + { + "attribute_type": "string", + "table_name": "ATTR_TUNNEL_LEVEL", + "attribute_name": "tunnel_level", + "attribute_value": { + "numeric": 60 + } + }, + { + "attribute_type": "flag", + "table_name": "ATTR_FLAG", + "attribute_name": "flag", + "attribute_value": { + "numeric": 15 + } + }, + { + "attribute_type": "boolean", + "table_name": "ATTR_SSL_ECH", + "attribute_name": "esni", + "attribute_value": { + "numeric": 1 + } + } + ] + } + } + ], + "verify_type": "policy" } ] }
\ No newline at end of file diff --git a/test/resource/HitPolicyResult.json b/test/resource/HitPolicyResult.json index bd72357..ce6f681 100644 --- a/test/resource/HitPolicyResult.json +++ b/test/resource/HitPolicyResult.json @@ -4,17 +4,17 @@ "code": 200, "msg": "Success", "data": { - "hitPolicyList": [ + "hit_policy_list": [ { - "id": 1021, + "uuid": "00001021-0000-0000-0000-000000000000", "policyName": "", "is_execute_policy": true, "top_object_list": [ { - "object_id": 101, + "object_uuid": "00005000-0000-0000-0000-000000000000", "table_name": "ATTR_SOURCE_IP", - "not_flag": 0, - "nth_clause": 0 + "negate_option": 0, + "condition_index": 0 } ] } @@ -32,8 +32,8 @@ }, "hit_paths": [ { - "item_id": 1, - "superior_object_id": 101 + "item_uuid": "00000000-0000-0000-0000-000000001000", + "superior_object_uuid": "00005000-0000-0000-0000-000000000000" } ] } @@ -43,91 +43,91 @@ "success": true }, { - "code": 200, - "msg": "Success", + "code": 200, + "msg": "Success", "data": { - "hitPolicyList": [ + "hit_policy_list": [ { - "id": 1022, - "policyName": "", - "is_execute_policy": true, + "uuid": "00001022-0000-0000-0000-000000000000", + "policyName": "", + "is_execute_policy": true, "top_object_list": [ { - "tag_id": 11, - "table_name": "ATTR_SOURCE_IP", - "not_flag": 0, - "nth_clause": 0 - }, + "tag_uuid": "00000011-0000-0000-0000-000000000000", + "table_name": "ATTR_SOURCE_IP", + "negate_option": 0, + "condition_index": 0 + }, { - "tag_id": 12, - "table_name": "ATTR_INTERNAL_IP", - "not_flag": 0, - "nth_clause": 1 - }, + "tag_uuid": "00000012-0000-0000-0000-000000000000", + "table_name": "ATTR_INTERNAL_IP", + "negate_option": 0, + "condition_index": 1 + }, { - "tag_id": 1, - "table_name": "ATTR_SERVER_FQDN", - "not_flag": 0, - "nth_clause": 2 + "tag_uuid": "00000001-0000-0000-0000-000000000000", + "table_name": "ATTR_SERVER_FQDN", + "negate_option": 0, + "condition_index": 2 } ] } - ], + ], "verify_session": { "attributes": [ { - "attribute_type": "ip", - "table_name": "ATTR_SOURCE_IP", - "attribute_name": "source", + "attribute_type": "ip", + "table_name": "ATTR_SOURCE_IP", + "attribute_name": "source", "attribute_value": { - "ip": "192.168.1.1", - "port": "8080", + "ip": "192.168.1.1", + "port": "8080", "addr_type": 4 - }, + }, "hit_paths": [ { - "entry_id": 1, - "tag_id": 11 + "entry_uuid": "00000001-0000-0000-0000-000000000000", + "tag_uuid": "00000011-0000-0000-0000-000000000000" } ] - }, + }, { - "attribute_type": "ip", - "table_name": "ATTR_INTERNAL_IP", - "attribute_name": "internal", + "attribute_type": "ip", + "table_name": "ATTR_INTERNAL_IP", + "attribute_name": "internal", "attribute_value": { - "ip": "192.168.1.2", - "port": "80", + "ip": "192.168.1.2", + "port": "80", "addr_type": 4 - }, + }, "hit_paths": [ { - "entry_id": 2, - "tag_id": 12 - }, + "entry_uuid": "00000002-0000-0000-0000-000000000000", + "tag_uuid": "00000012-0000-0000-0000-000000000000" + }, { - "entry_id": 2, - "tag_id": 13 + "entry_uuid": "00000002-0000-0000-0000-000000000000", + "tag_uuid": "00000013-0000-0000-0000-000000000000" } ] - }, + }, { - "attribute_type": "string", - "table_name": "ATTR_SERVER_FQDN", - "attribute_name": "server_fqdn", + "attribute_type": "string", + "table_name": "ATTR_SERVER_FQDN", + "attribute_name": "server_fqdn", "attribute_value": { "string": "www.126.com" - }, + }, "hit_paths": [ { - "entry_id": 1, - "tag_id": 1 + "entry_uuid": "00000001-0000-0000-0000-000000000000", + "tag_uuid": "00000001-0000-0000-0000-000000000000" } ] } ] } - }, + }, "success": true }, { @@ -140,8 +140,8 @@ "table_name": "ATTR_TUNNEL", "attribute_name": "tunnel_endpoint_object", "hit_paths": [{ - "item_id": 0, - "superior_object_id": 3021 + "item_uuid": "00000000-0000-0000-0000-000000000000", + "superior_object_uuid": "00003021-0000-0000-0000-000000000000" }] }] } @@ -153,15 +153,19 @@ "msg": "Success", "data": { "verify_session": { - "attributes": [{ - "attribute_type": "ip", - "table_name": "ATTR_TUNNEL", - "attribute_name": "tunnel_endpoint_object", - "hit_paths": [{ - "item_id": 0, - "superior_object_id": 3022 - }] - }] + "attributes": [ + { + "attribute_type": "ip", + "table_name": "ATTR_TUNNEL", + "attribute_name": "tunnel_endpoint_object", + "hit_paths": [ + { + "item_uuid": "00000000-0000-0000-0000-000000000000", + "superior_object_uuid": "00003022-0000-0000-0000-000000000000" + } + ] + } + ] } }, "success": true @@ -178,12 +182,12 @@ "attribute_name": "tunnel_endpoint_object", "hit_paths": [ { - "item_id": 0, - "superior_object_id": 3022 + "item_uuid": "00000000-0000-0000-0000-000000000000", + "superior_object_uuid": "00003022-0000-0000-0000-000000000000" }, { - "item_id": 0, - "superior_object_id": 3023 + "item_uuid": "00000000-0000-0000-0000-000000000000", + "superior_object_uuid": "00003023-0000-0000-0000-000000000000" } ] } @@ -196,66 +200,66 @@ "code": 200, "msg": "Success", "data": { - "hitPolicyList": [ + "hit_policy_list": [ { - "id": 1024, + "uuid": "00001024-0000-0000-0000-000000000000", "policyName": "", "is_execute_policy": true, "top_object_list": [ { - "object_id": 10231, + "object_uuid": "00005001-0000-0000-0000-000000000000", "table_name": "ATTR_SOURCE_IP", - "not_flag": 0, - "nth_clause": 0 + "negate_option": 0, + "condition_index": 0 }, { - "object_id": 10232, + "object_uuid": "00005002-0000-0000-0000-000000000000", "table_name": "ATTR_DESTINATION_IP", - "not_flag": 0, - "nth_clause": 1 + "negate_option": 0, + "condition_index": 1 }, { - "object_id": 10234, + "object_uuid": "00005003-0000-0000-0000-000000000000", "table_name": "ATTR_SERVER_FQDN", - "not_flag": 0, - "nth_clause": 2 + "negate_option": 0, + "condition_index": 2 }, { - "object_id": 10235, + "object_uuid": "00005004-0000-0000-0000-000000000000", "table_name": "ATTR_SSL_SAN", - "not_flag": 0, - "nth_clause": 3 + "negate_option": 0, + "condition_index": 3 } ] }, { - "id": 1023, + "uuid": "00001023-0000-0000-0000-000000000000", "policyName": "", "is_execute_policy": false, "top_object_list": [ { - "object_id": 10231, + "object_uuid": "00005001-0000-0000-0000-000000000000", "table_name": "ATTR_SOURCE_IP", - "not_flag": 0, - "nth_clause": 0 + "negate_option": 0, + "condition_index": 0 }, { - "object_id": 10232, + "object_uuid": "00005002-0000-0000-0000-000000000000", "table_name": "ATTR_DESTINATION_IP", - "not_flag": 0, - "nth_clause": 1 + "negate_option": 0, + "condition_index": 1 }, { - "object_id": 10234, + "object_uuid": "00005003-0000-0000-0000-000000000000", "table_name": "ATTR_SERVER_FQDN", - "not_flag": 0, - "nth_clause": 2 + "negate_option": 0, + "condition_index": 2 }, { - "object_id": 10235, + "object_uuid": "00005004-0000-0000-0000-000000000000", "table_name": "ATTR_SSL_SAN", - "not_flag": 0, - "nth_clause": 3 + "negate_option": 0, + "condition_index": 3 } ] } @@ -268,13 +272,13 @@ "attribute_name": "source", "attribute_value": { "ip": "192.168.0.2", - "port": "8080", + "port": "80", "addr_type": 4 }, "hit_paths": [ { - "item_id": 2, - "superior_object_id": 10231 + "item_uuid": "00000000-0000-0000-0000-000000001001", + "superior_object_uuid": "00005001-0000-0000-0000-000000000000" } ] }, @@ -284,12 +288,13 @@ "attribute_name": "destination", "attribute_value": { "ip": "192.168.0.3", + "port": "80", "addr_type": 4 }, "hit_paths": [ { - "item_id": 3, - "superior_object_id": 10232 + "item_uuid": "00000000-0000-0000-0000-000000001002", + "superior_object_uuid": "00005002-0000-0000-0000-000000000000" } ] }, @@ -302,20 +307,20 @@ }, "hit_paths": [ { - "entry_id": 2, - "tag_id": 2 + "entry_uuid": "00000002-0000-0000-0000-000000000000", + "tag_uuid": "00000002-0000-0000-0000-000000000000" }, { - "entry_id": 2, - "tag_id": 3 + "entry_uuid": "00000002-0000-0000-0000-000000000000", + "tag_uuid": "00000003-0000-0000-0000-000000000000" }, { - "item_id": 5, - "superior_object_id": 10235 + "item_uuid": "00000000-0000-0000-0000-000000001004", + "superior_object_uuid": "00005004-0000-0000-0000-000000000000" }, { - "item_id": 4, - "superior_object_id": 10234 + "item_uuid": "00000000-0000-0000-0000-000000001003", + "superior_object_uuid": "00005003-0000-0000-0000-000000000000" } ] }, @@ -328,20 +333,20 @@ }, "hit_paths": [ { - "entry_id": 2, - "tag_id": 2 + "entry_uuid": "00000002-0000-0000-0000-000000000000", + "tag_uuid": "00000002-0000-0000-0000-000000000000" }, { - "entry_id": 2, - "tag_id": 3 + "entry_uuid": "00000002-0000-0000-0000-000000000000", + "tag_uuid": "00000003-0000-0000-0000-000000000000" }, { - "item_id": 5, - "superior_object_id": 10235 + "item_uuid": "00000000-0000-0000-0000-000000001004", + "superior_object_uuid": "00005004-0000-0000-0000-000000000000" }, { - "item_id": 4, - "superior_object_id": 10234 + "item_uuid": "00000000-0000-0000-0000-000000001003", + "superior_object_uuid": "00005003-0000-0000-0000-000000000000" } ] } @@ -354,30 +359,30 @@ "code": 200, "msg": "Success", "data": { - "hitPolicyList": [ + "hit_policy_list": [ { - "id": 1026, + "uuid": "00001026-0000-0000-0000-000000000000", "policyName": "", "is_execute_policy": true, "top_object_list": [ { - "object_id": 3022, + "object_uuid": "00003022-0000-0000-0000-000000000000", "table_name": "ATTR_TUNNEL", - "not_flag": 0, - "nth_clause": 0 + "negate_option": 0, + "condition_index": 0 } ] }, { - "id": 1025, + "uuid": "00001025-0000-0000-0000-000000000000", "policyName": "", - "is_execute_policy": false, + "is_execute_policy": true, "top_object_list": [ { - "object_id": 3023, + "object_uuid": "00003023-0000-0000-0000-000000000000", "table_name": "ATTR_TUNNEL", - "not_flag": 0, - "nth_clause": 0 + "negate_option": 0, + "condition_index": 0 } ] } @@ -394,8 +399,8 @@ }, "hit_paths": [ { - "item_id": 0, - "superior_object_id": 6 + "item_uuid": "00000000-0000-0000-0000-000000000000", + "superior_object_uuid": "00000000-0000-0000-0000-000000000006" } ] }, @@ -405,12 +410,12 @@ "attribute_name": "tunnel_endpoint_object", "hit_paths": [ { - "item_id": 0, - "superior_object_id": 3022 + "item_uuid": "00000000-0000-0000-0000-000000000000", + "superior_object_uuid": "00003022-0000-0000-0000-000000000000" }, { - "item_id": 0, - "superior_object_id": 3023 + "item_uuid": "00000000-0000-0000-0000-000000000000", + "superior_object_uuid": "00003023-0000-0000-0000-000000000000" } ] }, @@ -425,8 +430,8 @@ }, "hit_paths": [ { - "entry_id": 1, - "tag_id": 11 + "entry_uuid": "00000001-0000-0000-0000-000000000000", + "tag_uuid": "00000011-0000-0000-0000-000000000000" } ] } @@ -439,17 +444,17 @@ "code": 200, "msg": "Success", "data": { - "hitPolicyList": [ + "hit_policy_list": [ { - "id": 1027, + "uuid": "00001027-0000-0000-0000-000000000000", "policyName": "", "is_execute_policy": true, "top_object_list": [ { - "object_id": 3022, + "object_uuid": "00003022-0000-0000-0000-000000000000", "table_name": "ATTR_TUNNEL", - "not_flag": 1, - "nth_clause": 0 + "negate_option": 1, + "condition_index": 0 } ] } @@ -466,8 +471,8 @@ }, "hit_paths": [ { - "item_id": 0, - "superior_object_id": 6 + "item_uuid": "00000000-0000-0000-0000-000000000000", + "superior_object_uuid": "00000000-0000-0000-0000-000000000006" } ] }, @@ -477,8 +482,196 @@ "attribute_name": "tunnel_endpoint_object", "hit_paths": [ { - "item_id": 0, - "superior_object_id": 3021 + "item_uuid": "00000000-0000-0000-0000-000000000000", + "superior_object_uuid": "00003021-0000-0000-0000-000000000000" + }, + { + "item_uuid": "00000000-0000-0000-0000-000000000000", + "superior_object_uuid": "00003022-0000-0000-0000-000000000000" + } + ] + } + ] + } + }, + "success": true + }, + { + "code": 200, + "msg": "Success", + "data": { + "hit_policy_list": [ + { + "uuid": "00600010-0000-0000-0000-000000000000", + "policyName": "", + "is_execute_policy": true, + "top_object_list": [ + { + "object_uuid": "00500100-0000-0000-0000-000000000000", + "table_name": "ATTR_SOURCE_IP", + "negate_option": 0, + "condition_index": 0 + }, + { + "object_uuid": "00000000-0000-0000-0000-000000000006", + "table_name": "ATTR_IP_PROTOCOL", + "negate_option": 0, + "condition_index": 3 + }, + { + "object_uuid": "00500200-0000-0000-0000-000000000000", + "table_name": "ATTR_SOURCE_PORT", + "negate_option": 0, + "condition_index": 4 + }, + { + "object_uuid": "00000201-0000-0000-0000-000000000000", + "table_name": "ATTR_APP_ID", + "negate_option": 0, + "condition_index": 1 + }, + { + "object_uuid": "00000000-0000-0000-0000-000000001000", + "table_name": "ATTR_HTTP_REQ_HDR", + "negate_option": 0, + "condition_index": 2 + }, + { + "object_uuid": "00000000-0000-0000-0000-000000000050", + "table_name": "ATTR_TUNNEL_LEVEL", + "negate_option": 0, + "condition_index": 5 + }, + { + "object_uuid": "00500300-0000-0000-0000-000000000000", + "table_name": "ATTR_FLAG", + "negate_option": 0, + "condition_index": 6 + }, + { + "object_uuid": "00000000-0000-0000-0000-000000000002", + "table_name": "ATTR_SSL_ECH", + "negate_option": 0, + "condition_index": 7 + } + ] + } + ], + "verify_session": { + "attributes": [ + { + "attribute_type": "ip", + "table_name": "ATTR_SOURCE_IP", + "attribute_name": "source", + "attribute_value": { + "ip": "192.168.55.4", + "port": "80", + "addr_type": 4 + }, + "hit_paths": [ + { + "item_uuid": "00000000-0000-0000-0000-000000001009", + "superior_object_uuid": "00500100-0000-0000-0000-000000000000" + } + ] + }, + { + "attribute_type": "ip", + "table_name": "ATTR_IP_PROTOCOL", + "attribute_name": "ip_protocol", + "attribute_value": { + "addr_type": 4, + "protocol": 6 + }, + "hit_paths": [ + { + "item_uuid": "00000000-0000-0000-0000-000000000000", + "superior_object_uuid": "00000000-0000-0000-0000-000000000006" + } + ] + }, + { + "attribute_type": "port", + "table_name": "ATTR_SOURCE_PORT", + "attribute_name": "source", + "attribute_value": { + "port": "80" + }, + "hit_paths": [ + { + "item_uuid": "00000000-0000-0000-0000-000000001011", + "superior_object_uuid": "00500200-0000-0000-0000-000000000000" + } + ] + }, + { + "attribute_type": "numeric", + "table_name": "ATTR_APP_ID", + "attribute_name": "app_id", + "attribute_value": { + "numeric": 67 + }, + "hit_paths": [ + { + "item_uuid": "00000000-0000-0000-0000-000000000000", + "superior_object_uuid": "00000201-0000-0000-0000-000000000000" + } + ] + }, + { + "attribute_type": "string", + "table_name": "ATTR_HTTP_REQ_HDR", + "attribute_name": "req_hdr", + "attribute_value": { + "district": "User-Agent", + "string": "test" + }, + "hit_paths": [ + { + "item_uuid": "00000000-0000-0000-0000-000000001010", + "superior_object_uuid": "00000000-0000-0000-0000-000000001000" + } + ] + }, + { + "attribute_type": "string", + "table_name": "ATTR_TUNNEL_LEVEL", + "attribute_name": "tunnel_level", + "attribute_value": { + "numeric": 60 + }, + "hit_paths": [ + { + "item_uuid": "00000000-0000-0000-0000-000000000000", + "superior_object_uuid": "00000000-0000-0000-0000-000000000050" + } + ] + }, + { + "attribute_type": "flag", + "table_name": "ATTR_FLAG", + "attribute_name": "flag", + "attribute_value": { + "numeric": 15 + }, + "hit_paths": [ + { + "item_uuid": "00000000-0000-0000-0000-000000001012", + "superior_object_uuid": "00500300-0000-0000-0000-000000000000" + } + ] + }, + { + "attribute_type": "boolean", + "table_name": "ATTR_SSL_ECH", + "attribute_name": "esni", + "attribute_value": { + "numeric": 1 + }, + "hit_paths": [ + { + "item_uuid": "00000000-0000-0000-0000-000000000000", + "superior_object_uuid": "00000000-0000-0000-0000-000000000002" } ] } diff --git a/test/resource/VerifyPolicyManipulation.json b/test/resource/VerifyPolicyManipulation.json index c51c220..f201311 100644 --- a/test/resource/VerifyPolicyManipulation.json +++ b/test/resource/VerifyPolicyManipulation.json @@ -1,353 +1,476 @@ { - "compile_table": "PXY_CTRL_COMPILE", - "group2compile_table": "GROUP_PXY_CTRL_COMPILE_RELATION", - "group2group_table": "GROUP_GROUP_RELATION", + "rule_table": "PXY_CTRL_RULE", + "object2object_table": "OBJECT_GROUP", "rules": [ - { - "compile_id": 1021, + { + "uuid": "00001021-0000-0000-0000-000000000000", "service": 1, - "action": 48, - "do_blacklist": 1, - "do_log": 1, - "effective_range": 0, - "tags":"anything", - "user_region": "anything", - "is_valid": "yes", - "groups": [ + "action": "manipulate", + "blacklist_option": 1, + "log_option": "all", + "action_parameter": "anything", + "is_valid": "yes", + "and_conditions": [ { - "not_flag": 0, - "group_id": 101, - "group_name":"IPv4TCPSoureVeiryPolicy01", - "virtual_table": "ATTR_SOURCE_IP", - "regions": [ + "attribute_name": "ATTR_SOURCE_IP", + "objects": [ { - "table_type": "ip", - "table_name": "TSG_OBJ_IP_ADDR", - "table_content": { - "addr_type": "ipv4", - "addr_format": "range", - "ip1": "192.168.0.1", - "ip2": "192.168.0.1" - } + "object_name": "IPv4TCPSoureVeiryPolicy01", + "uuid": "00005000-0000-0000-0000-000000000000", + "items": [ + { + "table_type": "ip", + "table_name": "TSG_OBJ_IP_ADDR", + "table_content": { + "ip": "192.168.0.1/32", + "port": "8080" + } + } + ] } - ] + ] } ] }, - { - "compile_id": 1022, - "service": 1, - "action": 48, - "do_blacklist": 1, - "do_log": 1, - "effective_range": 0, - "tags":"anything", - "user_region": "anything", - "is_valid": "yes", - "groups": [ + { + "uuid": "00001022-0000-0000-0000-000000000000", + "service": 1, + "action": "manipulate", + "blacklist_option": 1, + "log_option": "all", + "action_parameter": "anything", + "is_valid": "yes", + "and_conditions": [ { - "group_id": 11, - "group_name": "IPv4TCPSoureEntry.11", - "virtual_table": "ATTR_SOURCE_IP" - }, - { - "group_id": 12, - "group_name": "IPv4TCPSoureEntry.12", - "virtual_table": "ATTR_INTERNAL_IP" - }, - { - "group_id": 1, - "group_name": "FQDNEntry.1", - "virtual_table": "ATTR_SERVER_FQDN" - } - ] - }, - { - "compile_id": 1023, + "object_name": "IPv4TCPSoureEntry.11", + "attribute_name": "ATTR_SOURCE_IP", + "negate_option": false, + "object_uuids": [ + "00000011-0000-0000-0000-000000000000" + ] + }, + { + "object_name": "IPv4TCPSoureEntry.12", + "attribute_name": "ATTR_INTERNAL_IP", + "negate_option": false, + "object_uuids": [ + "00000012-0000-0000-0000-000000000000" + ] + }, + { + "object_name": "FQDNEntry.1", + "attribute_name": "ATTR_SERVER_FQDN", + "negate_option": false, + "object_uuids": [ + "00000001-0000-0000-0000-000000000000" + ] + } + ] + }, + { + "uuid": "00001023-0000-0000-0000-000000000000", "service": 1, - "action": 48, - "do_blacklist": 1, - "do_log": 1, - "effective_range": 0, - "tags":"anything", - "user_region": "anything", - "is_valid": "yes", - "groups": [ + "action": "manipulate", + "blacklist_option": 1, + "log_option": "all", + "action_parameter": "anything", + "is_valid": "yes", + "and_conditions": [ { - "not_flag": 0, - "group_id": 10231, - "group_name":"IPv4TCPSoureVeiryPolicy02", - "virtual_table": "ATTR_SOURCE_IP", - "regions": [ + "attribute_name": "ATTR_SOURCE_IP", + "objects": [ { - "table_type": "ip", - "table_name": "TSG_OBJ_IP_ADDR", - "table_content": { - "addr_type": "ipv4", - "addr_format": "range", - "ip1": "192.168.0.2", - "ip2": "192.168.0.2" - } + "object_name": "IPv4TCPSoureVeiryPolicy02", + "uuid": "00005001-0000-0000-0000-000000000000", + "items": [ + { + "table_type": "ip", + "table_name": "TSG_OBJ_IP_ADDR", + "table_content": { + "ip": "192.168.0.2/32", + "port": "80" + } + } + ] } - ] + ] }, - { - "not_flag": 0, - "group_id": 10232, - "group_name":"IPv4TCPDestinationVeiryPolicy01", - "virtual_table": "ATTR_DESTINATION_IP", - "regions": [ + { + "attribute_name": "ATTR_DESTINATION_IP", + "objects": [ { - "table_type": "ip", - "table_name": "TSG_OBJ_IP_ADDR", - "table_content": { - "addr_type": "ipv4", - "addr_format": "range", - "ip1": "192.168.0.3", - "ip2": "192.168.0.3" - } + "object_name": "IPv4TCPDestinationVeiryPolicy01", + "uuid": "00005002-0000-0000-0000-000000000000", + "items": [ + { + "table_type": "ip", + "table_name": "TSG_OBJ_IP_ADDR", + "table_content": { + "ip": "192.168.0.3/32", + "port": "80" + } + } + ] } - ] + ] }, - { - "virtual_table":"ATTR_SERVER_FQDN", - "group_name":"ServerFqdnVeiryPolicy01", - "group_id":10234, - "not_flag":0, - "regions": [ + { + "attribute_name": "ATTR_SERVER_FQDN", + "objects": [ { - "table_name": "TSG_OBJ_FQDN", - "table_type": "expr", - "table_content": { - "keywords": "baidu.com", - "expr_type": "regex", - "match_method": "sub", - "format": "uncase plain" - } + "object_name":"ServerFqdnVeiryPolicy01", + "uuid": "00005003-0000-0000-0000-000000000000", + "items": [ + { + "table_name": "TSG_OBJ_FQDN", + "table_type": "expr", + "table_content": { + "expression": "baidu.com", + "expr_type": "and" + } + } + ] } ] }, { - "virtual_table":"ATTR_SSL_SAN", - "group_name":"SslSanVeiryPolicy01", - "group_id":10235, - "not_flag":0, - "regions": [ + "attribute_name": "ATTR_SSL_SAN", + "objects": [ { - "table_name": "TSG_OBJ_FQDN", - "table_type": "expr", - "table_content": { - "keywords": "baidu.com", - "expr_type": "regex", - "match_method": "sub", - "format": "uncase plain" - } + "object_name":"SslSanVeiryPolicy01", + "uuid": "00005004-0000-0000-0000-000000000000", + "items": [ + { + "table_name": "TSG_OBJ_FQDN", + "table_type": "expr", + "table_content": { + "expression": "baidu.com", + "expr_type": "and" + } + } + ] } ] } ] }, + { + "uuid": "00001024-0000-0000-0000-000000000000", + "service": 1, + "action": "manipulate", + "blacklist_option": 1, + "log_option": "all", + "action_parameter": "anything", + "is_valid": "yes", + "and_conditions": [ + { + "object_name": "IPv4TCPSoureVeiryPolicy02", + "attribute_name": "ATTR_SOURCE_IP", + "negate_option": false, + "object_uuids": [ + "00005001-0000-0000-0000-000000000000" + ] + }, + { + "object_name": "IPv4TCPDestinationVeiryPolicy01", + "attribute_name": "ATTR_DESTINATION_IP", + "negate_option": false, + "object_uuids": [ + "00005002-0000-0000-0000-000000000000" + ] + }, + { + "object_name": "ServerFqdnVeiryPolicy01", + "attribute_name": "ATTR_SERVER_FQDN", + "negate_option": false, + "object_uuids": [ + "00005003-0000-0000-0000-000000000000" + ] + }, + { + "object_name": "SslSanVeiryPolicy01", + "attribute_name": "ATTR_SSL_SAN", + "negate_option": false, + "object_uuids": [ + "00005004-0000-0000-0000-000000000000" + ] + } + ] + }, + { + "uuid": "00003021-0000-0000-0000-000000000000", + "service": 1, + "action": "monitor", + "blacklist_option": 1, + "log_option": "all", + "action_parameter": "anything", + "rule_table_name": "TUNNEL_RULE", + "is_valid": "yes", + "and_conditions": [ + { + "attribute_name": "ATTR_TUNNEL_GTP_ENDPOINT", + "objects": [ + { + "object_name": "TunnelIpv4TCPSoureVeiryPolicy01", + "uuid": "00005005-0000-0000-0000-000000000000", + "items": [ + { + "table_type": "ip", + "table_name": "TSG_OBJ_IP_ADDR", + "table_content": { + "ip": "192.168.0.4" + } + } + ] + } + ] + } + ] + }, + { + "uuid": "00003022-0000-0000-0000-000000000000", + "service": 1, + "action": "monitor", + "blacklist_option": 1, + "log_option": "all", + "action_parameter": "anything", + "rule_table_name": "TUNNEL_RULE", + "is_valid": "yes", + "and_conditions": [ + { + "attribute_name": "ATTR_TUNNEL_GTP_ENDPOINT", + "objects": [ + { + "object_name": "TunnelIpv4TCPSoureVeiryPolicy02", + "uuid": "00005006-0000-0000-0000-000000000000", + "items": [ + { + "table_type": "ip", + "table_name": "TSG_OBJ_IP_ADDR", + "table_content": { + "ip": "192.168.0.5/32" + } + } + ] + } + ] + } + ] + }, + { + "uuid": "00003023-0000-0000-0000-000000000000", + "service": 1, + "action": "monitor", + "blacklist_option": 1, + "log_option": "all", + "action_parameter": "anything", + "rule_table_name": "TUNNEL_RULE", + "is_valid": "yes", + "and_conditions": [ + { + "attribute_name": "ATTR_TUNNEL_GTP_ENDPOINT", + "objects": [ + { + "object_name": "TunnelIpv4TCPSoureVeiryPolicy03", + "uuid": "00005007-0000-0000-0000-000000000000", + "items": [ + { + "table_type": "ip", + "table_name": "TSG_OBJ_IP_ADDR", + "table_content": { + "ip": "192.168.0.5/32" + } + } + ] + } + ] + }, + { + "attribute_name": "ATTR_TUNNEL_GTP_ENDPOINT", + "objects": [ + { + "object_name": "TunnelIpv4TCPSoureVeiryPolicy04", + "uuid": "00005008-0000-0000-0000-000000000000", + "items": [ + { + "table_type": "ip", + "table_name": "TSG_OBJ_IP_ADDR", + "table_content": { + "ip": "192.168.0.6/32" + } + } + ] + } + ] + } + ] + }, { - "compile_id": 1024, - "service": 1, - "action": 48, - "do_blacklist": 1, - "do_log": 1, - "effective_range": 0, - "tags":"anything", - "user_region": "anything", - "is_valid": "yes", - "groups": [ + "uuid": "00001025-0000-0000-0000-000000000000", + "service": 1, + "action": "monitor", + "blacklist_option": 1, + "log_option": "all", + "action_parameter": "anything", + "is_valid": "yes", + "and_conditions": [ { - "group_name":"IPv4TCPSoureVeiryPolicy02", - "virtual_table":"ATTR_SOURCE_IP" - }, - { - "group_name":"IPv4TCPDestinationVeiryPolicy01", - "virtual_table":"ATTR_DESTINATION_IP" - }, - { - "group_name":"ServerFqdnVeiryPolicy01", - "virtual_table":"ATTR_SERVER_FQDN" - }, - { - "group_name":"SslSanVeiryPolicy01", - "virtual_table":"ATTR_SSL_SAN" - } - ] - }, + "object_name": "TunnelEndpointVeiryPolicy01", + "attribute_name": "ATTR_TUNNEL", + "negate_option": false, + "object_uuids": [ + "00003023-0000-0000-0000-000000000000" + ] + } + ] + }, { - "compile_id": 3021, - "service": 13, - "action": 1, - "do_blacklist": 0, - "do_log": 1, - "tags": "{}", - "user_region": "anything", - "evaluation_order": "0.0", - "compile_table_name": "TUNNEL_COMPILE", + "uuid": "00001026-0000-0000-0000-000000000000", + "service": 1, + "action": "monitor", + "blacklist_option": 1, + "log_option": "all", + "action_parameter": "anything", + "is_valid": "yes", + "and_conditions": [ + { + "object_name": "TunnelEndpointVeiryPolicy03", + "attribute_name": "ATTR_TUNNEL", + "negate_option": false, + "object_uuids": [ + "00003022-0000-0000-0000-000000000000" + ] + } + ] + }, + { + "uuid": "00001027-0000-0000-0000-000000000000", + "service": 1, + "action": "monitor", + "blacklist_option": 1, + "log_option": "all", + "action_parameter": "anything", + "is_valid": "yes", + "and_conditions": [ + { + "object_name": "TunnelEndpointVeiryPolicy03", + "attribute_name": "ATTR_TUNNEL", + "negate_option": true, + "object_uuids": [ + "00003022-0000-0000-0000-000000000000" + ] + } + ] + }, + { + "uuid": "00600010-0000-0000-0000-000000000000", + "service": 1, + "action": "manipulate", + "blacklist_option": 1, + "log_option": "all", + "action_parameter": "anything", "is_valid": "yes", - "groups": [ + "and_conditions": [ { - "not_flag": 0, - "group_id": 248, - "group_name": "TunnelIpv4TCPSoureVeiryPolicy01", - "virtual_table": "ATTR_TUNNEL_GTP_ENDPOINT", - "g2c_table_name": "GROUP_TUNNEL_COMPILE_RELATION", - "regions": [ + "attribute_name": "ATTR_SOURCE_IP", + "objects": [ { - "table_name": "TSG_OBJ_IP_ADDR", - "table_type": "ip", - "table_content": { - "addr_type": "ipv4", - "addr_format": "range", - "ip1": "192.168.0.4", - "ip2": "192.168.0.4" - } + "object_name": "IPv4TCPSoureVeiryPolicy01", + "uuid": "00500100-0000-0000-0000-000000000000", + "items": [ + { + "table_type": "ip", + "table_name": "TSG_OBJ_IP_ADDR", + "table_content": { + "ip": "192.168.55.4", + "port": "80" + } + } + ] } ] - } - ] - }, - { - "compile_id": 3022, - "service": 13, - "action": 1, - "do_blacklist": 0, - "do_log": 1, - "tags": "{}", - "user_region": "anything", - "evaluation_order": "0.0", - "compile_table_name": "TUNNEL_COMPILE", - "is_valid": "yes", - "groups": [ + }, { - "not_flag": 0, - "group_id": 2, - "group_name": "TunnelIpv4TCPSoureVeiryPolicy02", - "virtual_table": "ATTR_TUNNEL_GTP_ENDPOINT", - "g2c_table_name": "GROUP_TUNNEL_COMPILE_RELATION", - "regions": [ - { - "table_name": "TSG_OBJ_IP_ADDR", - "table_type": "ip", - "table_content": { - "addr_type": "ipv4", - "addr_format": "range", - "ip1": "192.168.0.5", - "ip2": "192.168.0.5" - } - } + "attribute_name": "ATTR_APP_ID", + "negate_option": false, + "object_uuids": [ + "00000201-0000-0000-0000-000000000000" ] - } - ] - }, - { - "compile_id": 3023, - "service": 13, - "action": 1, - "do_blacklist": 0, - "do_log": 1, - "tags": "{}", - "user_region": "anything", - "evaluation_order": "0.0", - "compile_table_name": "TUNNEL_COMPILE", - "is_valid": "yes", - "groups": [ + }, { - "not_flag": 0, - "group_id": 3, - "group_name": "TunnelIpv4TCPSoureVeiryPolicy03", - "virtual_table": "ATTR_TUNNEL_GTP_ENDPOINT", - "g2c_table_name": "GROUP_TUNNEL_COMPILE_RELATION", - "regions": [ + "attribute_name": "ATTR_HTTP_REQ_HDR", + "objects": [ { - "table_name": "TSG_OBJ_IP_ADDR", - "table_type": "ip", - "table_content": { - "addr_type": "ipv4", - "addr_format": "range", - "ip1": "192.168.0.5", - "ip2": "192.168.0.5" - } + "items": [ + { + "table_name": "TSG_OBJ_KEYWORD", + "table_type": "expr", + "table_content": { + "expression": "test", + "expr_type": "and" + } + } + ] } ] }, - { - "not_flag": 0, - "group_id": 4, - "group_name": "TunnelIpv4TCPSoureVeiryPolicy04", - "virtual_table": "ATTR_TUNNEL_GTP_ENDPOINT", - "g2c_table_name": "GROUP_TUNNEL_COMPILE_RELATION", - "regions": [ - { - "table_name": "TSG_OBJ_IP_ADDR", - "table_type": "ip", - "table_content": { - "addr_type": "ipv4", - "addr_format": "range", - "ip1": "192.168.0.6", - "ip2": "192.168.0.6" - } - } + { + "attribute_name": "ATTR_IP_PROTOCOL", + "negate_option": false, + "object_uuids": [ + "00000000-0000-0000-0000-000000000006" + ] + }, + { + "attribute_name": "ATTR_SOURCE_PORT", + "objects": [ + { + "object_name": "IPv4TCPPortVeiryPolicy01", + "uuid": "00500200-0000-0000-0000-000000000000", + "items": [ + { + "table_name": "TSG_OBJ_PORT", + "table_type": "interval", + "table_content": { + "interval": "1-100" + } + } + ] + } + ] + }, + { + "attribute_name": "ATTR_TUNNEL_LEVEL", + "negate_option": false, + "object_uuids": [ + "00000000-0000-0000-0000-000000000050" + ] + }, + { + "attribute_name": "ATTR_FLAG", + "objects": [ + { + "object_name": "FlagVeiryPolicy01", + "uuid": "00500300-0000-0000-0000-000000000000", + "items": [ + { + "table_type": "flag", + "table_name": "TSG_OBJ_FLAG", + "table_content": { + "flag": 15, + "mask": 15 + } + } + ] + } + ] + }, + { + "attribute_name": "ATTR_SSL_ECH", + "negate_option": false, + "object_uuids": [ + "00000000-0000-0000-0000-000000000002" ] - } - ] - }, - { - "compile_id": 1025, - "service": 1, - "action": 48, - "do_blacklist": 1, - "do_log": 1, - "effective_range": 0, - "tags":"anything", - "user_region": "anything", - "is_valid": "yes", - "groups": [ - { - "not_flag":0, - "group_id": 3023, - "group_name":"TunnelEndpointVeiryPolicy01", - "virtual_table":"ATTR_TUNNEL" - } - ] - }, - { - "compile_id": 1026, - "service": 1, - "action": 48, - "do_blacklist": 1, - "do_log": 1, - "effective_range": 0, - "tags":"anything", - "user_region": "anything", - "is_valid": "yes", - "groups": [ - { - "not_flag":0, - "group_id": 3022, - "group_name":"TunnelEndpointVeiryPolicy03", - "virtual_table":"ATTR_TUNNEL" - } - ] - }, - { - "compile_id": 1027, - "service": 1, - "action": 48, - "do_blacklist": 1, - "do_log": 1, - "effective_range": 0, - "tags":"anything", - "user_region": "anything", - "is_valid": "yes", - "groups": [ - { - "not_flag":1, - "group_id": 3022, - "group_name":"TunnelEndpointVeiryPolicy03", - "virtual_table":"ATTR_TUNNEL" } ] } @@ -356,35 +479,42 @@ { "table_name": "FQDN_ENTRY", "table_content": [ - "1\t1\twww.126.com\t1\t1", - "2\t2,3\twww.baidu.com\t1\t1", - "4\t4,5,6\twww.qq.com\t1\t1" + {"uuid":"00000001-0000-0000-0000-000000000000","tag_uuids":["00000001-0000-0000-0000-000000000000"],"fqdn":"www.126.com","is_valid":1}, + {"uuid":"00000002-0000-0000-0000-000000000000","tag_uuids":["00000002-0000-0000-0000-000000000000","00000003-0000-0000-0000-000000000000"],"fqdn":"www.baidu.com","is_valid":1}, + {"uuid":"00000004-0000-0000-0000-000000000000","tag_uuids":["00000004-0000-0000-0000-000000000000","00000005-0000-0000-0000-000000000000","00000006-0000-0000-0000-000000000000"],"fqdn":"www.qq.com","is_valid":1} ] }, { "table_name": "IP_ADDR_ENTRY", "table_content": [ - "1\t11\t4\tsingle\t192.168.1.1\t192.168.1.1\t1", - "2\t12,13\t4\tsingle\t192.168.1.2\t192.168.1.2\t1", - "4\t14,15,16\t4\trange\t192.168.1.3\t192.168.1.3\t1" + {"uuid":"00000001-0000-0000-0000-000000000000","tag_uuids":["00000011-0000-0000-0000-000000000000"],"ip":"192.168.1.1/32","is_valid":1}, + {"uuid":"00000002-0000-0000-0000-000000000000","tag_uuids":["00000012-0000-0000-0000-000000000000","00000013-0000-0000-0000-000000000000"],"ip":"192.168.1.2/32","is_valid":1}, + {"uuid":"00000004-0000-0000-0000-000000000000","tag_uuids":["00000014-0000-0000-0000-000000000000","00000015-0000-0000-0000-000000000000","00000016-0000-0000-0000-000000000000"],"ip":"192.168.1.3/32","is_valid":1} ] }, { "table_name": "LIBRARY_TAG", "table_content": [ - "1\tnone\twebsite_category\tfqdn1\tsearch\\bengines\t1", - "2\tnone\twebsite_category\tfqdn2\tRecreation\band\bHobbies\t1", - "3\tnone\twebsite_category\tfqdn3\tbusiness\t1", - "4\tnone\twebsite_category\tfqdn4\tsearch bengines\t1", - "5\tnone\twebsite_category\tfqdn5\tsearch\\bengines\t1", - "6\tnone\twebsite_category\tfqdn6\tsearch\\bengines\t1", - "11\tnone\tgeoip\tadministrative_area\tColombia.Departamento\bdel\bVaupes\t1", - "12\tnone\tgeoip\tadministrative_area\tColombia.Departamento\bdel\bVaupes.MitĂș\t1", - "13\tnone\tgeoip\tadministrative_area\tColombia.Antioquia.Marinilla\t1", - "14\tnone\tgeoip\tsuper_administrative_area\tColombia.Departamento\bdel\bVaupes\t1", - "15\tnone\tgeoip\tadministrative_area\tGermany.Bavaria.Mauern\t1", - "16\tnone\tgeoip\tadministrative_area\tGermany.Bavaria.Mellrichstadt\t1" + {"uuid":"00000001-0000-0000-0000-000000000000","statistics_option":"none","category":"website_category","tag_key":"fqdn1","tag_value":"search\\bengines","is_valid":1}, + {"uuid":"00000002-0000-0000-0000-000000000000","statistics_option":"none","category":"website_category","tag_key":"fqdn2","tag_value":"Recreation\band\bHobbies","is_valid":1}, + {"uuid":"00000003-0000-0000-0000-000000000000","statistics_option":"none","category":"website_category","tag_key":"fqdn3","tag_value":"business","is_valid":1}, + {"uuid":"00000004-0000-0000-0000-000000000000","statistics_option":"none","category":"website_category","tag_key":"fqdn4","tag_value":"search bengines","is_valid":1}, + {"uuid":"00000005-0000-0000-0000-000000000000","statistics_option":"none","category":"website_category","tag_key":"fqdn5","tag_value":"search\\bengines","is_valid":1}, + {"uuid":"00000006-0000-0000-0000-000000000000","statistics_option":"none","category":"website_category","tag_key":"fqdn6","tag_value":"search\\bengines","is_valid":1}, + {"uuid":"00000011-0000-0000-0000-000000000000","statistics_option":"none","category":"geoip","tag_key":"administrative_area","tag_value":"Colombia.Departamento","is_valid":1}, + {"uuid":"00000012-0000-0000-0000-000000000000","statistics_option":"none","category":"geoip","tag_key":"administrative_area","tag_value":"Colombia.Departamento\bdel\bVaupes.MitĂș","is_valid":1}, + {"uuid":"00000013-0000-0000-0000-000000000000","statistics_option":"none","category":"geoip","tag_key":"administrative_area","tag_value":"Colombia.Antioquia.Marinilla","is_valid":1}, + {"uuid":"00000014-0000-0000-0000-000000000000","statistics_option":"none","category":"geoip","tag_key":"tsuper_administrative_area","tag_value":"Colombia.Departamento\bdel\bVaupes","is_valid":1}, + {"uuid":"00000015-0000-0000-0000-000000000000","statistics_option":"none","category":"geoip","tag_key":"administrative_area","tag_value":"Germany.Bavaria.Mauern","is_valid":1}, + {"uuid":"00000016-0000-0000-0000-000000000000","statistics_option":"none","category":"geoip","tag_key":"administrative_area","tag_value":"Germany.Bavaria.Mellrichstadt","is_valid":1} ] - } + }, + { + "table_name": "APP_ID_DICT", + "table_content": [ + {"app_id":67,"object_uuid":"00000201-0000-0000-0000-000000000000","app_name":"http","is_valid":1}, + {"app_id":68,"object_uuid":"00068000-0000-0000-0000-000000000000","app_name":"https","is_valid":1} + ] + } ] } diff --git a/test/verify_policy_test.cpp b/test/verify_policy_test.cpp index 446c70c..d46c396 100644 --- a/test/verify_policy_test.cpp +++ b/test/verify_policy_test.cpp @@ -90,7 +90,7 @@ static char *select_hit_policy_request_item(int gtest_id) TEST(LibrarySearch, HitFqdnEntry) { const char *hit_policy_request = "{\"ip\":null,\"fqdn\":\"www.126.com\",\"vsys_id\":1}"; - const char *hit_policy_result="{\"code\":200,\"msg\":\"Success\",\"data\":{\"hit_library\":[{\"entry_id\":1,\"tag_ids\":\"1\"}]},\"success\":true}"; + const char *hit_policy_result="{\"code\":200,\"msg\":\"Success\",\"data\":{\"hit_library\":[{\"tag_uuids\":\"00000001-0000-0000-0000-000000000000\"}]},\"success\":true}"; cJSON *result_json = get_library_search_query(hit_policy_request, strlen(hit_policy_request)); ASSERT_TRUE(result_json != NULL); @@ -105,7 +105,7 @@ TEST(LibrarySearch, HitFqdnEntry) FREE(&hit_policy_list); hit_policy_request = "{\"ip\":null,\"fqdn\":\"www.baidu.com\",\"vsys_id\":1}"; - hit_policy_result="{\"code\":200,\"msg\":\"Success\",\"data\":{\"hit_library\":[{\"entry_id\":2,\"tag_ids\":\"2,3\"}]},\"success\":true}"; + hit_policy_result="{\"code\":200,\"msg\":\"Success\",\"data\":{\"hit_library\":[{\"tag_uuids\":\"00000002-0000-0000-0000-000000000000,00000003-0000-0000-0000-000000000000\"}]},\"success\":true}"; result_json = get_library_search_query(hit_policy_request, strlen(hit_policy_request)); ASSERT_TRUE(result_json != NULL); @@ -120,7 +120,7 @@ TEST(LibrarySearch, HitFqdnEntry) FREE(&hit_policy_list); hit_policy_request = "{\"ip\":null,\"fqdn\":\"www.qq.com\",\"vsys_id\":1}"; - hit_policy_result="{\"code\":200,\"msg\":\"Success\",\"data\":{\"hit_library\":[{\"entry_id\":4,\"tag_ids\":\"4,5,6\"}]},\"success\":true}"; + hit_policy_result="{\"code\":200,\"msg\":\"Success\",\"data\":{\"hit_library\":[{\"tag_uuids\":\"00000004-0000-0000-0000-000000000000,00000005-0000-0000-0000-000000000000,00000006-0000-0000-0000-000000000000\"}]},\"success\":true}"; result_json = get_library_search_query(hit_policy_request, strlen(hit_policy_request)); ASSERT_TRUE(result_json != NULL); @@ -138,7 +138,7 @@ TEST(LibrarySearch, HitFqdnEntry) TEST(LibrarySearch, HitIpEntry) { const char *hit_policy_request = "{\"ip\":\"192.168.1.1\",\"fqdn\":null,\"vsys_id\":1}"; - const char *hit_policy_result="{\"code\":200,\"msg\":\"Success\",\"data\":{\"hit_library\":[{\"tag_ids\":\"11\"}]},\"success\":true}"; + const char *hit_policy_result="{\"code\":200,\"msg\":\"Success\",\"data\":{\"hit_library\":[{\"tag_uuids\":\"00000011-0000-0000-0000-000000000000\"}]},\"success\":true}"; cJSON *result_json = get_library_search_query(hit_policy_request, strlen(hit_policy_request)); ASSERT_TRUE(result_json != NULL); @@ -146,6 +146,7 @@ TEST(LibrarySearch, HitIpEntry) char *hit_policy_list = cJSON_PrintUnformatted(result_json); ASSERT_TRUE(hit_policy_list != NULL); + printf("hit_policy_list = %s\n", hit_policy_list); int equal = strncasecmp(hit_policy_list, hit_policy_result, strlen(hit_policy_result)); EXPECT_EQ(equal, 0); @@ -153,7 +154,7 @@ TEST(LibrarySearch, HitIpEntry) FREE(&hit_policy_list); hit_policy_request ="{\"ip\":\"192.168.1.2\",\"fqdn\":null,\"vsys_id\":1}"; - hit_policy_result="{\"code\":200,\"msg\":\"Success\",\"data\":{\"hit_library\":[{\"tag_ids\":\"12,13\"}]},\"success\":true}"; + hit_policy_result="{\"code\":200,\"msg\":\"Success\",\"data\":{\"hit_library\":[{\"tag_uuids\":\"00000012-0000-0000-0000-000000000000,00000013-0000-0000-0000-000000000000\"}]},\"success\":true}"; result_json = get_library_search_query(hit_policy_request, strlen(hit_policy_request)); ASSERT_TRUE(result_json != NULL); @@ -161,6 +162,7 @@ TEST(LibrarySearch, HitIpEntry) hit_policy_list = cJSON_PrintUnformatted(result_json); ASSERT_TRUE(hit_policy_list != NULL); + printf("hit_policy_list = %s\n", hit_policy_list); equal = strncasecmp(hit_policy_list, hit_policy_result, strlen(hit_policy_result)); EXPECT_EQ(equal, 0); @@ -168,7 +170,7 @@ TEST(LibrarySearch, HitIpEntry) FREE(&hit_policy_list); hit_policy_request = "{\"ip\":\"192.168.1.3\",\"fqdn\":null,\"vsys_id\":1}"; - hit_policy_result="{\"code\":200,\"msg\":\"Success\",\"data\":{\"hit_library\":[{\"tag_ids\":\"14,15,16\"}]},\"success\":true}"; + hit_policy_result="{\"code\":200,\"msg\":\"Success\",\"data\":{\"hit_library\":[{\"tag_uuids\":\"00000014-0000-0000-0000-000000000000,00000015-0000-0000-0000-000000000000,00000016-0000-0000-0000-000000000000\"}]},\"success\":true}"; result_json = get_library_search_query(hit_policy_request, strlen(hit_policy_request)); ASSERT_TRUE(result_json != NULL); @@ -176,6 +178,7 @@ TEST(LibrarySearch, HitIpEntry) hit_policy_list = cJSON_PrintUnformatted(result_json); ASSERT_TRUE(hit_policy_list != NULL); + printf("hit_policy_list = %s\n", hit_policy_list); equal = strncasecmp(hit_policy_list, hit_policy_result, strlen(hit_policy_result)); EXPECT_EQ(equal, 0); @@ -246,6 +249,9 @@ TEST(VerifyPolicy, HitIpPolicy) char *hit_policy_query = cJSON_PrintUnformatted(result_json); ASSERT_TRUE(hit_policy_query != NULL); + printf("hit_policy_query = %s\n", hit_policy_query); + printf("hit_policy_result = %s\n", hit_policy_result); + int equal = strncasecmp(hit_policy_query, hit_policy_result, strlen(hit_policy_result)); EXPECT_EQ(equal, 0); @@ -268,6 +274,9 @@ TEST(VerifyPolicy, HitLibraryPolicy) char *hit_policy_query = cJSON_PrintUnformatted(result_json); ASSERT_TRUE(hit_policy_query != NULL); + printf("hit_policy_query = %s\n", hit_policy_query); + printf("hit_policy_result = %s\n", hit_policy_result); + int equal = strncasecmp(hit_policy_query, hit_policy_result, strlen(hit_policy_result)); EXPECT_EQ(equal, 0); @@ -290,6 +299,9 @@ TEST(VerifyPolicy, HitMultiplePolicy) char *hit_policy_query = cJSON_PrintUnformatted(result_json); ASSERT_TRUE(hit_policy_query != NULL); + printf("hit_policy_query = %s\n", hit_policy_query); + printf("hit_policy_result = %s\n", hit_policy_result); + int equal = strncasecmp(hit_policy_query, hit_policy_result, strlen(hit_policy_result)); EXPECT_EQ(equal, 0); @@ -334,8 +346,6 @@ TEST(VerifyPolicy, HitTunnelEndpointaPolicy_1027) char *hit_policy_query = cJSON_PrintUnformatted(result_json); ASSERT_TRUE(hit_policy_query != NULL); - printf("hit_policy_query = %s\n", hit_policy_query); - int equal = strncasecmp(hit_policy_query, hit_policy_result, strlen(hit_policy_result)); EXPECT_EQ(equal, 0); @@ -412,6 +422,32 @@ TEST(VerifyPolicy, HitTunnelEndpointPolicy) FREE(&hit_policy_result); } +TEST(VerifyPolicy, HitAllObjectPolicy) +{ + char *hit_policy_request = select_hit_policy_request_item(8); + ASSERT_TRUE(hit_policy_request != NULL); + char *hit_policy_result = select_hit_policy_result_item(8); + ASSERT_TRUE(hit_policy_result != NULL); + + cJSON *result_json = get_verify_policy_query(hit_policy_request, strlen(hit_policy_request), 1); + ASSERT_TRUE(result_json != NULL); + + char *hit_policy_query = cJSON_PrintUnformatted(result_json); + ASSERT_TRUE(hit_policy_query != NULL); + + printf("hit_policy_request = %s\n", hit_policy_request); + printf("hit_policy_query = %s\n", hit_policy_query); + printf("hit_policy_result = %s\n", hit_policy_result); + + int equal = strncasecmp(hit_policy_query, hit_policy_result, strlen(hit_policy_result)); + EXPECT_EQ(equal, 0); + + cJSON_Delete(result_json); + FREE(&hit_policy_query); + FREE(&hit_policy_request); + FREE(&hit_policy_result); +} + static char *read_json_file(const char *filename, size_t *input_sz) { FILE* fp=NULL; |