diff options
| -rw-r--r-- | bin/tsg_log_field.conf | 1 | ||||
| -rw-r--r-- | inc/app_label.h | 1 | ||||
| -rw-r--r-- | src/tsg_entry.cpp | 22 | ||||
| -rw-r--r-- | src/tsg_entry.h | 13 | ||||
| -rw-r--r-- | src/tsg_rule.cpp | 2 | ||||
| -rw-r--r-- | src/tsg_send_log.cpp | 224 | ||||
| -rw-r--r-- | src/tsg_send_log_internal.h | 1 | ||||
| -rw-r--r-- | src/tsg_ssl_utils.cpp | 6 |
8 files changed, 154 insertions, 116 deletions
diff --git a/bin/tsg_log_field.conf b/bin/tsg_log_field.conf index dce8498..6086a7b 100644 --- a/bin/tsg_log_field.conf +++ b/bin/tsg_log_field.conf @@ -89,3 +89,4 @@ STRING common_apn 75 STRING common_imsi 76 STRING common_imei 77 STRING common_phone_number 78 +STRING common_userdefine_app_name 79 diff --git a/inc/app_label.h b/inc/app_label.h index 99cf3ce..fdb0fdf 100644 --- a/inc/app_label.h +++ b/inc/app_label.h @@ -24,6 +24,7 @@ enum APP_IDENTIFY_ORIGIN ORIGIN_USER_DEFINE, ORIGIN_DKPT, ORIGIN_QM_ENGINE, + ORIGIN_BUILT_IN, ORIGIN_MAX }; diff --git a/src/tsg_entry.cpp b/src/tsg_entry.cpp index 09af37f..64fa751 100644 --- a/src/tsg_entry.cpp +++ b/src/tsg_entry.cpp @@ -69,17 +69,7 @@ id2field_t g_tsg_fs2_field[TSG_FS2_MAX]={{0, TSG_FS2_TCP_LINKS, "tcp_links"}, {0, TSG_FS2_APP_DPKT_RESULT, "D_result"}, {0, TSG_FS2_APP_Q_RESULT, "Q_result"}, {0, TSG_FS2_APP_USER_RESULT, "U_result"}, - {0, TSG_FS2_APP_ONLY_DPKT_RESULT, "only_D_result"}, - {0, TSG_FS2_APP_ONLY_Q_RESULT, "only_Q_result"}, - {0, TSG_FS2_APP_ONLY_USER_RESULT, "only_U_result"}, - {0, TSG_FS2_APP_DQ_SAME_RESULT, "DQ_same_result"}, - {0, TSG_FS2_APP_DQ_DIFF_RESULT, "DQ_diff_result"}, - {0, TSG_FS2_APP_DU_SAME_RESULT, "DU_same_result"}, - {0, TSG_FS2_APP_DU_DIFF_RESULT, "DU_diff_result"}, - {0, TSG_FS2_APP_QU_SAME_RESULT, "QU_same_result"}, - {0, TSG_FS2_APP_QU_DIFF_RESULT, "QU_diff_result"}, - {0, TSG_FS2_APP_DQU_SAME_RESULT, "DQU_same_result"}, - {0, TSG_FS2_APP_DQU_DIFF_RESULT, "DQU_diff_result"} + {0, TSG_FS2_APP_BUILT_IN_RESULT, "B_result"} }; id2field_t g_tsg_proto_name2id[PROTO_MAX]={{PROTO_UNKONWN, 0, "unknown"}, @@ -1340,6 +1330,9 @@ static int app_identify_result_cb(const struct streaminfo *a_stream, int bridge_ case ORIGIN_USER_DEFINE: FS_operate(g_tsg_para.fs2_handle, g_tsg_para.fs2_field_id[TSG_FS2_APP_USER_RESULT], 0, FS_OP_ADD, 1); break; + case ORIGIN_BUILT_IN: + FS_operate(g_tsg_para.fs2_handle, g_tsg_para.fs2_field_id[TSG_FS2_APP_BUILT_IN_RESULT], 0, FS_OP_ADD, 1); + break; case ORIGIN_BASIC_PROTOCOL: if(context->proto==PROTO_UNKONWN || context->proto==PROTO_APP) { @@ -1613,6 +1606,13 @@ extern "C" int TSG_MASTER_INIT() MESA_handle_runtime_log(g_tsg_para.logger, RLOG_LV_FATAL, "PROJECT_REGISTER", "Register %s failed.", label_buff); } + MESA_load_profile_string_def(tsg_conffile, "SYSTEM", "LINKINFO", label_buff, sizeof(label_buff), "mirror_linkinfo_from_mac"); + g_tsg_para.linkinfo_project_id=project_customer_register(label_buff, PROJECT_VAL_TYPE_STRUCT); + if(g_tsg_para.linkinfo_project_id<0) + { + MESA_handle_runtime_log(g_tsg_para.logger, RLOG_LV_FATAL, "PROJECT_REGISTER", "Register %s failed.", label_buff); + } + MESA_load_profile_string_def(tsg_conffile, "SYSTEM", "APP_BRIDGE_NAME", label_buff, sizeof(label_buff), "APP_BRIDGE"); g_tsg_para.app_bridge_id=stream_bridge_build(label_buff, "w"); if(g_tsg_para.app_bridge_id<0) diff --git a/src/tsg_entry.h b/src/tsg_entry.h index f171f48..74c8e07 100644 --- a/src/tsg_entry.h +++ b/src/tsg_entry.h @@ -83,17 +83,7 @@ enum TSG_FS2_TYPE{ TSG_FS2_APP_DPKT_RESULT, TSG_FS2_APP_Q_RESULT, TSG_FS2_APP_USER_RESULT, - TSG_FS2_APP_ONLY_DPKT_RESULT, - TSG_FS2_APP_ONLY_Q_RESULT, - TSG_FS2_APP_ONLY_USER_RESULT, - TSG_FS2_APP_DQ_SAME_RESULT, - TSG_FS2_APP_DQ_DIFF_RESULT, - TSG_FS2_APP_DU_SAME_RESULT, - TSG_FS2_APP_DU_DIFF_RESULT, - TSG_FS2_APP_QU_SAME_RESULT, - TSG_FS2_APP_QU_DIFF_RESULT, - TSG_FS2_APP_DQU_SAME_RESULT, - TSG_FS2_APP_DQU_DIFF_RESULT, + TSG_FS2_APP_BUILT_IN_RESULT, TSG_FS2_MAX }; @@ -167,6 +157,7 @@ typedef struct _tsg_para int priority_project_id; int internal_project_id; int context_project_id; + int linkinfo_project_id; int gather_app_project_id; int app_bridge_id; int proto_flag; //tsg_protocol_t diff --git a/src/tsg_rule.cpp b/src/tsg_rule.cpp index e531ae3..5b92afc 100644 --- a/src/tsg_rule.cpp +++ b/src/tsg_rule.cpp @@ -1775,7 +1775,7 @@ int tsg_app_id2name(int app_id, char *app_name, int app_name_len, int is_joint_p dict=(struct app_id_dict_table *)Maat_plugin_get_EX_data(g_tsg_maat_feather, g_tsg_para.table_id[TABLE_APP_ID_DICT], (const char *)app_id_buff); if(dict!=NULL) { - if(dict->parent_app_id!=0) + if(dict->parent_app_id!=0 && is_joint_parent==1) { offset=snprintf(app_name, app_name_len, "%s.%s", dict->parent_app_name, dict->app_name); } diff --git a/src/tsg_send_log.cpp b/src/tsg_send_log.cpp index 5c2221d..805f567 100644 --- a/src/tsg_send_log.cpp +++ b/src/tsg_send_log.cpp @@ -25,8 +25,6 @@ char TSG_SEND_LOG_VERSION_20200729=0; struct tsg_log_instance_t *g_tsg_log_instance; -#define SET_FLAG(a, b, c) ((a)>0 ? (b)|=(c) : (a)) - const id2field_t tld_type[TLD_TYPE_MAX]={{TLD_TYPE_UNKNOWN, TLD_TYPE_UNKNOWN, "UNKOWN"}, {TLD_TYPE_LONG, TLD_TYPE_LONG, "LONG"}, {TLD_TYPE_STRING, TLD_TYPE_STRING, "STRING"}, @@ -114,6 +112,45 @@ static int set_tcp_isn(struct tsg_log_instance_t *_instance, struct TLD_handle_t return 1; } +static int set_linkinfo(struct tsg_log_instance_t *_instance, struct TLD_handle_t *_handle, struct streaminfo *a_stream) +{ + const char *linkinfo=(const char *)project_req_get_struct(a_stream, g_tsg_para.linkinfo_project_id); + if(linkinfo==NULL) + { + return 0; + } + + cJSON *item=NULL; + cJSON *object=cJSON_Parse(linkinfo); + if(object) + { + item=cJSON_GetObjectItem(object, "common_direction"); + if(item!=NULL) + { + TLD_append(_handle, (char *)"common_direction", (void *)(long)(item->valueint), TLD_TYPE_LONG); + } + + item=cJSON_GetObjectItem(object, "common_egress_link_id"); + if(item!=NULL) + { + TLD_append(_handle, (char *)"common_egress_link_id", (void *)(long)(item->valueint), TLD_TYPE_LONG); + } + + item=cJSON_GetObjectItem(object, "common_ingress_link_id"); + if(item!=NULL) + { + TLD_append(_handle, (char *)"common_ingress_link_id", (void *)(long)(item->valueint), TLD_TYPE_LONG); + } + + cJSON_Delete(object); + object=NULL; + + return 1; + } + + return 0; +} + static int set_asn(struct TLD_handle_t *_handle, struct streaminfo *a_stream, char *field_name, struct _asn_info_t *asn_info) { char buff[1024]={0}; @@ -368,6 +405,34 @@ static int set_packet_bytes(struct tsg_log_instance_t *_instance, struct TLD_han return 1; } + +static int set_userdefine_app(struct TLD_handle_t *_handle, char *field_name, struct app_identify_result *result, TLD_TYPE type) +{ + if(result==NULL || result->app_id_num<=0) + { + return 0; + } + + int i=0; + char app_name[256]={0}; + + cJSON *one_array=cJSON_CreateArray(); + + for(i=0; i<result->app_id_num; i++) + { + memset(app_name, 0, sizeof(app_name)); + tsg_app_id2name(result->app_id[i], app_name, sizeof(app_name), 1); + if(strnlen(app_name, sizeof(app_name)) > 0) + { + cJSON_AddStringToObject(one_array, field_name, app_name); + } + } + + TLD_append(_handle, field_name, one_array, TLD_TYPE_CJSON); + + return 1; +} + static int get_l7_protocol(struct app_identify_result *result, char *protocol_list, int protocol_list_len, int *flag) { int i=0,offset=0; @@ -396,6 +461,23 @@ static int get_l7_protocol(struct app_identify_result *result, char *protocol_li return 1; } +static unsigned int get_max_app_id(unsigned int *app_id_array, int app_id_num) +{ + int i=0; + unsigned int max_app_id=app_id_array[0]; + + for(i=1; i< app_id_num; i++) + { + if(max_app_id<app_id_array[i]) + { + max_app_id=app_id_array[i]; + } + } + + + return max_app_id; +} + static int get_app_id(struct app_identify_result *result, unsigned int *app_id, unsigned int *surrogate_id, int *flag) { if(result->app_id_num>0 && (*flag)==0) @@ -410,21 +492,33 @@ static int get_app_id(struct app_identify_result *result, unsigned int *app_id, return 0; } -static int get_app_id_list(struct app_identify_result *result, char *app_list, int app_list_len, char *surrogate_list, int surrogate_list_len) +static int get_app_id_list(cJSON *app_id_object, const char *field_name, struct app_identify_result *result) { int i=0; - int offset1=0,offset2=0; + + if(result->app_id_num==0) + { + return 0; + } + cJSON *one_object=NULL; + cJSON *one_array=cJSON_CreateArray(); + for(i=0; i<result->app_id_num; i++) { - offset1+=snprintf(app_list+offset1, app_list_len-offset1, "APP%d=%d;", result->origin, result->app_id[i]); - offset2+=snprintf(surrogate_list+offset2, surrogate_list_len-offset2, "SURROGATE%d=%d;", result->origin, result->surrogate_id[i]); + one_object=cJSON_CreateObject(); + cJSON_AddNumberToObject(one_object, "app_id", result->app_id[i]); + cJSON_AddNumberToObject(one_object, "surrogate_id", result->surrogate_id[i]); + + cJSON_AddItemToArray(one_array, one_object); } + cJSON_AddItemToObject(app_id_object, field_name, one_array); + return 1; } -static int get_app_name_list(struct app_identify_result *result, char *app_name, int app_name_len, int *flag, int is_joint_parent) +static int get_app_name_list(unsigned int *app_id_array, int app_id_num, char *app_name, int app_name_len, int *flag, int is_joint_parent) { int i=0; int offset=0; @@ -434,7 +528,7 @@ static int get_app_name_list(struct app_identify_result *result, char *app_name, return 0; } - for(i=0; i<result->app_id_num; i++) + for(i=0; i<app_id_num; i++) { (*flag)=1; @@ -444,7 +538,7 @@ static int get_app_name_list(struct app_identify_result *result, char *app_name, offset++; } - offset+=tsg_app_id2name(result->app_id[i], app_name+offset, app_name_len-offset, is_joint_parent); + offset+=tsg_app_id2name(app_id_array[i], app_name+offset, app_name_len-offset, is_joint_parent); } return 1; @@ -453,13 +547,11 @@ static int get_app_name_list(struct app_identify_result *result, char *app_name, static int set_app_id(struct tsg_log_instance_t *_instance, struct TLD_handle_t *_handle, struct streaminfo *a_stream) { int app_id_flag=0; - int app_offset=0; - int surrogate_offset=0; int l7_protocol_flag=0; - char app_list[512]={0}; char app_name[512]={0}; + unsigned int max_app_id=0; char protocol_list[256]={0}; - char surrogate_list[512]={0}; + unsigned int one_app_id=0; unsigned int one_surrogate_id=0; struct gather_app_result *label=NULL; @@ -495,99 +587,43 @@ static int set_app_id(struct tsg_log_instance_t *_instance, struct TLD_handle_t } else //string { - app_offset=0; - surrogate_offset=0; - get_app_id_list(&(label->result[ORIGIN_USER_DEFINE]), app_list+app_offset, sizeof(app_list)-app_offset, surrogate_list+surrogate_offset, sizeof(surrogate_list)-surrogate_offset); - - app_offset=strlen(app_list); - surrogate_offset=strlen(surrogate_list); - get_app_id_list(&(label->result[ORIGIN_DKPT]), app_list+app_offset, sizeof(app_list)-app_offset, surrogate_list+surrogate_offset, sizeof(surrogate_list)-surrogate_offset); + cJSON *app_id_object=cJSON_CreateObject(); + get_app_id_list(app_id_object, "USER_DEFINE", &(label->result[ORIGIN_USER_DEFINE])); + get_app_id_list(app_id_object, "BUILT_IN", &(label->result[ORIGIN_BUILT_IN])); + get_app_id_list(app_id_object, "DKPT", &(label->result[ORIGIN_DKPT])); + get_app_id_list(app_id_object, "THIRD", &(label->result[ORIGIN_QM_ENGINE])); + + TLD_append(_handle, _instance->id2field[LOG_COMMON_APP_ID].name, (void *)app_id_object, TLD_TYPE_CJSON); - app_offset=strlen(app_list); - surrogate_offset=strlen(surrogate_list); - get_app_id_list(&(label->result[ORIGIN_QM_ENGINE]), app_list+app_offset, sizeof(app_list)-app_offset, surrogate_list+surrogate_offset, sizeof(surrogate_list)-surrogate_offset); + set_userdefine_app(_handle, _instance->id2field[LOG_COMMON_USERDEFINE_APP].name, &(label->result[ORIGIN_USER_DEFINE]), TLD_TYPE_LONG); + + max_app_id=get_max_app_id(label->result[ORIGIN_USER_DEFINE].app_id, label->result[ORIGIN_USER_DEFINE].app_id_num); + if(max_app_id>0) + { + get_app_name_list(&max_app_id, 1, app_name, sizeof(app_name), &app_id_flag, 1); + } + + if(app_id_flag!=1) + { + get_app_name_list(label->result[ORIGIN_BUILT_IN].app_id, label->result[ORIGIN_BUILT_IN].app_id_num, app_name, sizeof(app_name), &app_id_flag, 1); + } - get_app_name_list(&(label->result[ORIGIN_USER_DEFINE]), app_name, sizeof(app_name), &app_id_flag, 1); if(app_id_flag!=1) { - get_app_name_list(&(label->result[ORIGIN_DKPT]), app_name, sizeof(app_name), &app_id_flag, 0); + get_app_name_list(label->result[ORIGIN_DKPT].app_id, label->result[ORIGIN_DKPT].app_id_num, app_name, sizeof(app_name), &app_id_flag, 0); } if(app_id_flag!=1) { - get_app_name_list(&(label->result[ORIGIN_QM_ENGINE]), app_name, sizeof(app_name), &app_id_flag, 1); + get_app_name_list(label->result[ORIGIN_QM_ENGINE].app_id, label->result[ORIGIN_QM_ENGINE].app_id_num, app_name, sizeof(app_name), &app_id_flag, 0); } if(app_id_flag==1) { - TLD_append(_handle, _instance->id2field[LOG_COMMON_APP_ID].name, (void *)app_list, TLD_TYPE_STRING); - TLD_append(_handle, _instance->id2field[LOG_COMMON_APP_SURROGATE_ID].name, (void *)surrogate_list, TLD_TYPE_STRING); - TLD_append(_handle, _instance->id2field[LOG_COMMON_APP_LABEL].name, (void *)app_name, TLD_TYPE_STRING); } } - app_id_flag=0; - SET_FLAG(label->result[ORIGIN_DKPT].app_id_num, app_id_flag, 1); - SET_FLAG(label->result[ORIGIN_QM_ENGINE].app_id_num, app_id_flag, 2); - SET_FLAG(label->result[ORIGIN_USER_DEFINE].app_id_num, app_id_flag, 4); - - switch(app_id_flag) - { - case 1: - FS_operate(g_tsg_para.fs2_handle, g_tsg_para.fs2_field_id[TSG_FS2_APP_ONLY_DPKT_RESULT], 0, FS_OP_ADD, 1); - break; - case 2: - FS_operate(g_tsg_para.fs2_handle, g_tsg_para.fs2_field_id[TSG_FS2_APP_ONLY_Q_RESULT], 0, FS_OP_ADD, 1); - break; - case 3: - if((label->result[ORIGIN_DKPT].app_id[label->result[ORIGIN_DKPT].app_id_num-1]) == (label->result[ORIGIN_QM_ENGINE].app_id[label->result[ORIGIN_QM_ENGINE].app_id_num-1])) - { - FS_operate(g_tsg_para.fs2_handle, g_tsg_para.fs2_field_id[TSG_FS2_APP_DQ_SAME_RESULT], 0, FS_OP_ADD, 1); - } - else - { - FS_operate(g_tsg_para.fs2_handle, g_tsg_para.fs2_field_id[TSG_FS2_APP_DQ_DIFF_RESULT], 0, FS_OP_ADD, 1); - } - break; - case 4: - FS_operate(g_tsg_para.fs2_handle, g_tsg_para.fs2_field_id[TSG_FS2_APP_ONLY_USER_RESULT], 0, FS_OP_ADD, 1); - break; - case 5: - if((label->result[ORIGIN_USER_DEFINE].app_id[label->result[ORIGIN_USER_DEFINE].app_id_num-1]) == (label->result[ORIGIN_DKPT].app_id[label->result[ORIGIN_DKPT].app_id_num-1])) - { - FS_operate(g_tsg_para.fs2_handle, g_tsg_para.fs2_field_id[TSG_FS2_APP_DU_SAME_RESULT], 0, FS_OP_ADD, 1); - } - else - { - FS_operate(g_tsg_para.fs2_handle, g_tsg_para.fs2_field_id[TSG_FS2_APP_DU_DIFF_RESULT], 0, FS_OP_ADD, 1); - } - break; - case 6: - if((label->result[ORIGIN_USER_DEFINE].app_id[label->result[ORIGIN_USER_DEFINE].app_id_num-1]) == (label->result[ORIGIN_QM_ENGINE].app_id[label->result[ORIGIN_QM_ENGINE].app_id_num-1])) - { - FS_operate(g_tsg_para.fs2_handle, g_tsg_para.fs2_field_id[TSG_FS2_APP_QU_SAME_RESULT], 0, FS_OP_ADD, 1); - } - else - { - FS_operate(g_tsg_para.fs2_handle, g_tsg_para.fs2_field_id[TSG_FS2_APP_QU_DIFF_RESULT], 0, FS_OP_ADD, 1); - } - break; - case 7: - if((label->result[ORIGIN_USER_DEFINE].app_id[label->result[ORIGIN_USER_DEFINE].app_id_num-1]) == (label->result[ORIGIN_QM_ENGINE].app_id[label->result[ORIGIN_QM_ENGINE].app_id_num-1]) && - (label->result[ORIGIN_USER_DEFINE].app_id[label->result[ORIGIN_USER_DEFINE].app_id_num-1]) == (label->result[ORIGIN_DKPT].app_id[label->result[ORIGIN_DKPT].app_id_num-1])) - { - FS_operate(g_tsg_para.fs2_handle, g_tsg_para.fs2_field_id[TSG_FS2_APP_DQU_SAME_RESULT], 0, FS_OP_ADD, 1); - } - else - { - FS_operate(g_tsg_para.fs2_handle, g_tsg_para.fs2_field_id[TSG_FS2_APP_DQU_DIFF_RESULT], 0, FS_OP_ADD, 1); - } - break; - default: - break; - } - return 1; } @@ -1039,6 +1075,7 @@ int set_session_attributes(struct tsg_log_instance_t *_instance, struct TLD_hand int TLD_append_streaminfo(struct tsg_log_instance_t *instance, struct TLD_handle_t *handle, struct streaminfo *a_stream) { + int ret=0; char *addr_proto=NULL; char stream_id_buff[128]={0}; unsigned long long stream_id=0; @@ -1051,10 +1088,15 @@ int TLD_append_streaminfo(struct tsg_log_instance_t *instance, struct TLD_handle return -1; } + ret=set_linkinfo(_instance, _handle, a_stream); + if(ret==0) + { + set_direction(_instance, _handle, a_stream); + } + set_app_id(_instance, _handle, a_stream); set_tcp_isn(_instance, _handle, a_stream); set_tuple4(_instance, _handle, a_stream); - set_direction(_instance, _handle, a_stream); set_address_list(_instance, _handle, a_stream); set_duraction(_instance, _handle, a_stream); set_packet_bytes(_instance, _handle, a_stream); diff --git a/src/tsg_send_log_internal.h b/src/tsg_send_log_internal.h index a88a372..209be8b 100644 --- a/src/tsg_send_log_internal.h +++ b/src/tsg_send_log_internal.h @@ -104,6 +104,7 @@ typedef enum _tsg_log_field_id LOG_COMMON_GTP_IMSI, LOG_COMMON_GTP_IMEI, LOG_COMMON_GTP_MSISDN, //PHONE_NUMBER + LOG_COMMON_USERDEFINE_APP, LOG_COMMON_MAX }tsg_log_field_id_t; diff --git a/src/tsg_ssl_utils.cpp b/src/tsg_ssl_utils.cpp index 5e86cfd..66cabc2 100644 --- a/src/tsg_ssl_utils.cpp +++ b/src/tsg_ssl_utils.cpp @@ -192,6 +192,8 @@ static char* parse_server_name_extension(const unsigned char* buff, size_t buff strncpy(sni, (const char*)buff + pos + 3, len); sni[len] = '\0'; *result = CHELLO_PARSE_SUCCESS; + default: + break; } pos += 3 + len; } @@ -373,8 +375,8 @@ struct ssl_chello* ssl_chello_parse(const unsigned char* buff, size_t buff_len, _chello->min_version.major = buff[1]; _chello->min_version.minor = buff[2]; _chello->min_version.ossl_format=(uint16_t)_chello->min_version.major<<8|_chello->min_version.minor; - _chello->max_version.major = -1; - _chello->max_version.minor = -1; + _chello->max_version.major = (uint8_t)(-1); + _chello->max_version.minor = (uint8_t)(-1); _chello->sni = NULL; _chello->alpn = NULL; _chello->cipher_suites = NULL; |