1、kni.conf增加[send_log];2、log_debug支持TCP/UDP协议；3、IPV4/V6_entry中addr_type更正；4、redirect日志更新

6 files changed, 127 insertions, 10 deletions

diff --git a/bin/kniconf/kni.conf b/bin/kniconf/kni.conf
index 3a4a75a..9a2103e 100644
--- a/bin/kniconf/kni.conf
+++ b/bin/kniconf/kni.conf
@@ -53,6 +53,12 @@ table_info_path=./kniconf/maat_table_info.conf
 full_cfg_dir=/home/mesasoft/tango_rules/full/index
 inc_cfg_dir=/home/mesasoft/tango_rules/inc/index
 
+[send_log]
+send_log_switch=0
+NIC_NAME=eth0
+ENTRANCE_ID=0
+KAFKA_BROKERLIST=192.168.10.73:9092
+
 
 
 [Module]
diff --git a/bin/kniconf/maat_test.json.dnat b/bin/kniconf/maat_test.json.dnat
new file mode 100644
index 0000000..a95531b
--- /dev/null
+++ b/bin/kniconf/maat_test.json.dnat
@@ -0,0 +1,48 @@
+{
+    "compile_table": "PXY_INTERCEPT_COMPILE",
+    "group_table": "PXY_INTERCEPT_GROUP",
+    "rules": [
+        {
+            "compile_id": 1,
+            "service": 1,
+            "action":48,
+            "do_blacklist": 1,
+            "do_log": 1,
+            "effective_rage": 0,
+            "user_region": "spoofing_ip_pool=10;nat_type=dnat;",
+            "is_valid": "yes",
+            "groups": [
+                {
+                    "group_name": "Untitled",
+                    "regions": [
+                        {
+                            "table_name": "PXY_INTERCEPT_IP",
+                            "table_type": "ip",
+                            "table_content": {
+                                "addr_type": "ipv4",
+                                "src_ip": "192.168.11.80",
+                                "mask_src_ip": "255.255.255.255",
+                                "src_port": "0",
+                                "mask_src_port": "65535",
+                                "dst_ip": "61.135.169.125",
+                                "mask_dst_ip": "255.255.255.255",
+                                "dst_port": "0",
+                                "mask_dst_port": "65535",
+                                "protocol": 0,
+                                "direction": "double"
+                            }
+                        }
+                    ]
+                }
+            ]
+        }
+	],
+    "plugin_table": [
+		{
+		"table_name": "PXY_OBJ_SPOOFING_IP_POOL",
+		"table_content": [
+		"1\t4\t0\t123.57.35.217\t0\t0\t\t0\t0\t1\t123\t10\t{}\t20181217-0:22"
+				]
+			}
+		]
+	}
diff --git a/bin/kniconf/maat_test.json.snat b/bin/kniconf/maat_test.json.snat
new file mode 100644
index 0000000..e144d6a
--- /dev/null
+++ b/bin/kniconf/maat_test.json.snat
@@ -0,0 +1,48 @@
+{
+    "compile_table": "PXY_INTERCEPT_COMPILE",
+    "group_table": "PXY_INTERCEPT_GROUP",
+    "rules": [
+        {
+            "compile_id": 1,
+            "service": 1,
+            "action":48,
+            "do_blacklist": 1,
+            "do_log": 1,
+            "effective_rage": 0,
+            "user_region": "spoofing_ip_pool=10;nat_type=snat;",
+            "is_valid": "yes",
+            "groups": [
+                {
+                    "group_name": "Untitled",
+                    "regions": [
+                        {
+                            "table_name": "PXY_INTERCEPT_IP",
+                            "table_type": "ip",
+                            "table_content": {
+                                "addr_type": "ipv4",
+                                "src_ip": "192.168.11.80",
+                                "mask_src_ip": "255.255.255.255",
+                                "src_port": "0",
+                                "mask_src_port": "65535",
+                                "dst_ip": "0.0.0.0",
+                                "mask_dst_ip": "255.255.255.255",
+                                "dst_port": "0",
+                                "mask_dst_port": "65535",
+                                "protocol": 0,
+                                "direction": "double"
+                            }
+                        }
+                    ]
+                }
+            ]
+        }
+	],
+    "plugin_table": [
+		{
+		"table_name": "PXY_OBJ_SPOOFING_IP_POOL",
+		"table_content": [
+		"1\t4\t0\t192.168.11.127\t0\t0\t\t0\t0\t1\t123\t10\t{}\t20181217-0:22"
+				]
+			}
+		]
+	}
diff --git a/kni_comm.c b/kni_comm.c
index f871027..62882b2 100644
--- a/kni_comm.c
+++ b/kni_comm.c
@@ -126,10 +126,11 @@ int kni_log_debug(int level,char* module,const void* a_packet,const char* format
 	char saddr_str[INET6_ADDRSTRLEN ]={0};
 	char daddr_str[INET6_ADDRSTRLEN ]={0};
 
+	int protocol=0;
 	struct ip* ipv4_hdr = (struct ip*)a_packet;
     struct kni_ipv6_hdr* ipv6_hdr = (struct kni_ipv6_hdr*)a_packet;
-	struct tcphdr* tcphdr = NULL;
-	struct udphdr* udphdr = NULL;
+	struct kni_tcp_hdr* tcphdr=NULL;
+	struct kni_udp_hdr* udphdr=NULL;
 
 
 	char buf[4096] = {0};
@@ -143,11 +144,14 @@ int kni_log_debug(int level,char* module,const void* a_packet,const char* format
 
 	if(ipv4_hdr->ip_v==4)
 	{
-		tcphdr=(struct tcphdr*)((char*)ipv4_hdr+4*(ipv4_hdr->ip_hl));
+		tcphdr=(struct kni_tcp_hdr*)((char*)ipv4_hdr+4*(ipv4_hdr->ip_hl));
+		udphdr=(struct kni_udp_hdr*)((char*)ipv4_hdr+4*(ipv4_hdr->ip_hl));
 
 		inet_ntop(AF_INET, (void *)&((ipv4_hdr->ip_src).s_addr), saddr_str, INET_ADDRSTRLEN);
 		inet_ntop(AF_INET, (void *)&((ipv4_hdr->ip_dst).s_addr), daddr_str, INET_ADDRSTRLEN);
 
+		protocol = ipv4_hdr->ip_p;
+
 	}
 	else if((ipv6_hdr->ip6_flags[0] & 0xF0) == 0x60)
 	{
@@ -156,15 +160,26 @@ int kni_log_debug(int level,char* module,const void* a_packet,const char* format
 			return -1;
 		}
 	
-		tcphdr =(struct tcphdr*)( (unsigned char*)ipv6_hdr + sizeof(struct kni_ipv6_hdr));
+		tcphdr =(struct kni_tcp_hdr*)( (unsigned char*)ipv6_hdr + sizeof(struct kni_ipv6_hdr));
+		udphdr =(struct kni_udp_hdr*)( (unsigned char*)ipv6_hdr + sizeof(struct kni_ipv6_hdr));
 
 		inet_ntop(AF_INET6, (void *)&(ipv6_hdr->ip6_src), saddr_str, INET6_ADDRSTRLEN);
 		inet_ntop(AF_INET6, (void *)&(ipv6_hdr->ip6_dst), daddr_str, INET6_ADDRSTRLEN);
+
+		protocol= ipv6_hdr->ip6_nex_hdr;
 		
 	}
 	
-	sport=ntohs(tcphdr->source);
-	dport=ntohs(tcphdr->dest);
+	if(protocol == PROTO_TYPE_TCP)
+	{
+		sport=ntohs(tcphdr->th_sport);
+		dport=ntohs(tcphdr->th_dport);
+	}
+	else if(protocol == PROTO_TYPE_UDP)
+	{
+		sport=ntohs(udphdr->uh_sport);
+		dport=ntohs(udphdr->uh_dport);
+	}
 	
 
 	MESA_handle_runtime_log(g_kni_comminfo.logger,level,module,"addr:%s,%d,%s,%d %s",saddr_str,sport,daddr_str,dport,buf);
diff --git a/kni_entry.c b/kni_entry.c
index 6f934ba..b5b75a8 100644
--- a/kni_entry.c
+++ b/kni_entry.c
@@ -1113,7 +1113,7 @@ extern "C" char kni_ipv4_entry(const struct streaminfo *pstream,unsigned char ro
 		ret = process_redirect_pending(pstream,&pmeinfo,thread_seq,ipv4_hdr,0,routedir);
 		return ret;
 	}
-	else if(redirect_search_htable(pstream->addr.addrtype,&pmeinfo,thread_seq,ipv4_hdr,0) == 1)
+	else if(redirect_search_htable(ADDR_TYPE_IPV4,&pmeinfo,thread_seq,ipv4_hdr,0) == 1)
 	{
 		ret = process_redirect_data(pstream,&pmeinfo,thread_seq,ipv4_hdr,0,routedir);
 		return ret; 
@@ -1169,7 +1169,7 @@ extern "C" char kni_ipv6_entry(const struct streaminfo *pstream,unsigned char ro
 		ret = process_redirect_pending(pstream,&pmeinfo,thread_seq,ipv6_hdr,0,routedir);
 		return ret;
 	}
-	else if(redirect_search_htable(pstream->addr.addrtype,&pmeinfo,thread_seq,ipv6_hdr,0) == 1)
+	else if(redirect_search_htable(ADDR_TYPE_IPV6,&pmeinfo,thread_seq,ipv6_hdr,0) == 1)
 	{
 		ret = process_redirect_data(pstream,&pmeinfo,thread_seq,ipv6_hdr,0,routedir);
 		return ret; 
diff --git a/kni_redirect.c b/kni_redirect.c
index fb89262..e87be10 100644
--- a/kni_redirect.c
+++ b/kni_redirect.c
@@ -105,7 +105,7 @@ int redirect_search_htable(unsigned char addr_type,struct kni_pme_info* pmeinfo,
 	{
 		pmeinfo->action=KNI_ACTION_REDIRECT;
 	
-		kni_log_debug(RLOG_LV_DEBUG,(char*)"redirect",a_packet,"redirect_search_htable()");
+		kni_log_debug(RLOG_LV_DEBUG,(char*)"redirect_search_htable",a_packet,"search htable_data succ!");
 		kni_filestate2_set(thread_seq,FS_REDIRECT_REPLY,0,1);
 	}
 
@@ -528,7 +528,7 @@ int redirect_sendlog(const struct streaminfo* pstream,struct kni_pme_info* pmein
 	kni_send_log(&log_msg,(char*)"redirect",content);
 
 	
-	kni_log_debug(RLOG_LV_DEBUG,(char*)"redirect",a_packet,"process_redirect_pending(),%s",content);
+	kni_log_debug(RLOG_LV_DEBUG,(char*)"redirect_pending",a_packet,"content:%s",content);
 	kni_filestate2_set(thread_seq,FS_REDIRECT,0,1);
 
 	return 0;