1
# 基础规则示例
2
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
3
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
4
iptables -A INPUT -j DROP
5

6
# NAT 规则
7
iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination 10.0.0.1:8080
8

9
# 连接追踪
10
iptables -A FORWARD -m state --state ESTABLISHED -j ACCEPT

1
// 应用识别引擎示例
2
int app_identify(struct packet *pkt) {
3
    // 1. 端口识别
4
    int app = port_based_app(pkt->dst_port);
5
    if (app == APP_UNKNOWN) {
6
        // 2. DPI 深度检测
7
        app = dpi_scan(pkt->payload);
8
    }
9

10
    // 3. 行为分析
11
    if (app == APP_CLOUD) {
12
        if (detect_anomaly(pkt)) {
13
            return APP_BLOCKED;
14
        }
15
    }
16

17
    return app;
18
}

1
# 深信服 XDR/SIP 联动
2
threat_intel:
3
  enabled: true
4
  sync_interval: 60s
5
  feed_sources:
6
    - cloud_intel.sangfor.com
7
    - local_tip: 10.0.0.1
8

9
action:
10
  auto_block: true
11
  block_duration: 3600s

1
# 云防火墙策略示例
2
cloud_firewall:
3
  rules:
4
    - name: "禁止挖矿"
5
      src_ip: any
6
      dst_ip: any
7
      app: HTTP
8
      action: DROP
9
      alert: true
10

11
    - name: "只允许 HTTPS"
12
      src_ip: 10.0.0.0/8
13
      dst_ip: any
14
      protocol: TCP
15
      ports: [80, 443]
16
      action: ALLOW
17

18
  auto_remediate:
19
    bot_detect: true
20
    c2_block: true

1
# 云防火墙弹性配置
2
scaling:
3
  min_nodes: 2
4
  max_nodes: 10
5
  metric: cpu_usage
6
  threshold: 70%
7

8
  scale_up:
9
    period: 60s
10
    cool_down: 300s
11

12
  scale_down:
13
    period: 300s
14
    cool_down: 600s

1
// DPI 引擎核心结构
2
struct dpi_engine {
3
    // 协议栈解析
4
    struct proto_parser *http_parser;
5
    struct proto_parser *dns_parser;
6
    struct proto_parser *tls_parser;
7

8
    // 特征匹配
9
    struct match_engine *ac_automaton;
10
    struct match_engine *regex_engine;
11

12
    // 威胁检测
13
    struct threat_detector *malware_detector;
14
    struct threat_detector *c2_detector;
15
};
16

17
// HTTP 检测示例
18
int dpi_http_check(struct dpi_engine *engine, struct packet *pkt) {
19
    struct http_parser *hp = parse_http(pkt->payload);
20

21
    // URL 过滤
22
    if (url_blacklist_check(hp->host, hp->path)) {
23
        return ACTION_DROP;
24
    }
25

26
    // 关键字检测
27
    if (regex_match(engine->regex_engine, hp->body)) {
28
        return ACTION_ALERT;
29
    }
30

31
    return ACTION_ALLOW;
32
}

1
// 协议识别流程
2
enum ProtoID identify_protocol(struct packet *pkt) {
3
    // 1. 端口识别
4
    int port = pkt->dst_port;
5
    if (port == 443) return PROTO_HTTPS;
6

7
    // 2. 深度检测
8
    if (is_ssl_handshake(pkt->payload)) {
9
        return PROTO_TLS;
10
    }
11

12
    // 3. 行为分析
13
    if (detect_http_behavior(pkt)) {
14
        return PROTO_HTTP_PROXY;
15
    }
16

17
    return PROTO_UNKNOWN;
18
}

1
struct fw_rule {
2
    uint32_t rule_id;
3

4
    // 匹配条件
5
    struct match_cond {
6
        ip_addr_t src_ip;
7
        ip_addr_t dst_ip;
8
        uint16_t src_port_start;
9
        uint16_t src_port_end;
10
        uint8_t protocol;
11
        app_id_t app;
12
        user_id_t user;
13
    } match;
14

15
    // 动作
16
    enum fw_action {
17
        ACTION_ALLOW,
18
        ACTION_DROP,
19
        ACTION_LOG,
20
        ACTION_ALERT
21
    } action;
22

23
    // 时间范围
24
    struct time_range {
25
        uint8_t start_hour;
26
        uint8_t end_hour;
27
        uint32_t days_of_week;
28
    } time;
29
};

1
// 规则查找树
2
struct rule_tree {
3
    struct radix_tree *ip_tree;  // IP 前缀树
4
    struct hash_table *port_table;  // 端口哈希
5
    struct trie *app_trie;       // 应用识别
6

7
    struct rule_list *rules[MAX_RULE_COUNT];
8
};
9

10
// 快速匹配
11
enum fw_action match_packet(struct packet *pkt) {
12
    // 1. IP 树查找
13
    struct rule_list *rules = radix_lookup(ip_tree, pkt->src_ip);
14

15
    // 2. 端口匹配
16
    rules = filter_by_port(rules, pkt->dst_port);
17

18
    // 3. 应用过滤
19
    rules = filter_by_app(rules, pkt->app_id);
20

21
    // 4. 时间检查
22
    rules = filter_by_time(rules);
23

24
    return rules[0]->action;
25
}

1
cfw_features:
2
  # AI 威胁检测
3
  ai_detect:
4
    enabled: true
5
    model: threat_ai_v3
6
    confidence_threshold: 0.85
7

8
  # 威胁情报
9
  threat_intel:
10
    sources:
11
      - huawei_tip
12
      - cncert
13
      - custom_feed
14
    auto_block: true
15

16
  # 虚拟补丁
17
  virtual_patch:
18
    enabled: true
19
    auto_apply: critical_only

1
# 微隔离配置
2
microsegmentation:
3
  enabled: true
4

5
  policy_template:
6
    default_policy: deny
7
    allow_admin: true
8

9
  groups:
10
    - name: web_tier
11
      members: ["10.0.1.*"]
12
      allow_from: ["10.0.0.*"]
13

14
    - name: db_tier
15
      members: ["10.0.2.*"]
16
      allow_from: ["10.0.1.*"]

1
// 防火墙数据包处理流水线
2
struct firewall_pipeline {
3
    // 接收
4
    struct rte_mempool *mbuf_pool;
5
    struct rte_ring *packet_ring;
6

7
    // 检测引擎
8
    struct dpi_engine *dpi;
9
    struct rule_engine *rules;
10

11
    // 发送
12
    struct tx_queue *allow_queue;
13
    struct tx_queue *drop_queue;
14
};
15

16
int firewall_rx_process(struct firewall_pipeline *pipe) {
17
    struct rte_mbuf *pkts[MAX_PKT_BURST];
18

19
    uint16_t nb_rx = rte_eth_rx_burst(
20
        PORT_ID, QUEUE_ID, pkts, MAX_PKT_BURST);
21

22
    for (int i = 0; i < nb_rx; i++) {
23
        enum fw_action action = match_packet(pipe->rules, pkts[i]);
24

25
        if (action == ACTION_ALLOW) {
26
            rte_ring_enqueue(pipe->allow_queue, pkts[i]);
27
        } else {
28
            log_packet(pkts[i], action);
29
            rte_pktmbuf_free(pkts[i]);
30
        }
31
    }
32
}

1
// 连接表结构
2
struct conn_table {
3
    struct cuckoo_hash *ipv4_table;
4
    struct cuckoo_hash *ipv6_table;
5

6
    // 连接状态
7
    uint8_t *state;  // 连接状态机
8

9
    // 超时管理
10
    struct timer_wheel *timers;
11
};
12

13
// 连接处理
14
enum conn_state process_connection(struct conn_table *tbl, struct packet *pkt) {
15
    struct conn_key key = {pkt->src_ip, pkt->dst_ip, pkt->protocol};
16

17
    struct conn_entry *conn = hash_lookup(tbl, &key);
18

19
    if (conn == NULL) {
20
        conn = alloc_conn(&key);
21
        conn->state = STATE_NEW;
22
    }
23

24
    conn->last_pkt_time = get_timestamp();
25
    conn->packets++;
26
    conn->bytes += pkt->len;
27

28
    return update_state(conn, pkt);
29
}