diff options
47 files changed, 1454 insertions, 2055 deletions
diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index 666e385..eb7c574 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -7,6 +7,7 @@ variables: INSTALL_DEPENDENCY_LIBRARY: systemd-devel libbreakpad_mini numactl-devel zlib-devel vim-common libMESA_handle_logger-devel libcjson-devel libMESA_field_stat2-devel sapp sapp-devel framework_env libMESA_prof_load-devel http-devel dns-devel ftp-devel mail-devel ssl-devel librdkafka-devel libmaatframe-devel quic-devel mesa_sip-devel gtp-devel libMESA_htable-devel libasan mrzcpd rapidjson-devel libMESA_jump_layer-devel stratum-devel rdp-devel dtls-devel stages: +- analysis - build - test - package @@ -45,6 +46,54 @@ stages: tags: - share +run_cppcheck_for_centos7: + stage: analysis + image: $BUILD_IMAGE_CENTOS7 + script: + - mkdir build || true + - cd build + - cmake3 -DCMAKE_EXPORT_COMPILE_COMMANDS=ON .. + - cppcheck --project=compile_commands.json + --enable=all + --error-exitcode=1 + --suppress=unusedFunction + --suppress=missingInclude + --suppress=uselessAssignmentPtrArg + --suppress=unreachableCode + --suppress=internalAstError + --suppress=unmatchedSuppression + --suppress=memleakOnRealloc + --suppress=internalAstError + --suppress=unmatchedSuppression + --suppress=redundantAssignment + --suppress=constParameter + tags: + - share + +run_cppcheck_for_centos8: + stage: analysis + image: $BUILD_IMAGE_CENTOS8 + script: + - mkdir build || true + - cd build + - cmake3 -DCMAKE_EXPORT_COMPILE_COMMANDS=ON .. + - cppcheck --project=compile_commands.json + --enable=all + --error-exitcode=1 + --suppress=unusedFunction + --suppress=missingInclude + --suppress=uselessAssignmentPtrArg + --suppress=unreachableCode + --suppress=internalAstError + --suppress=unmatchedSuppression + --suppress=memleakOnRealloc + --suppress=internalAstError + --suppress=unmatchedSuppression + --suppress=redundantAssignment + --suppress=constParameter + tags: + - share + run_test_for_centos7: stage: test extends: .build_by_travis_for_centos7 @@ -53,9 +102,7 @@ run_test_for_centos7: - ./ci/travis.sh - cd build - make test - - cd testing - - ./gtest_rule - - ./gtest_master + - ctest --verbose run_test_for_centos8: stage: test @@ -65,9 +112,7 @@ run_test_for_centos8: - ./ci/travis.sh - cd build - make test - - cd testing - - ./gtest_rule - - ./gtest_master + - ctest --verbose branch_build_debug_for_centos7: stage: build diff --git a/CMakeLists.txt b/CMakeLists.txt index 9944579..c480e23 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -14,6 +14,29 @@ set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -g") include_directories(${PROJECT_SOURCE_DIR}/inc/) include_directories(/opt/MESA/include/) +#for cppcheck +find_program(CMAKE_CXX_CPPCHECK NAMES cppcheck) +if (CMAKE_CXX_CPPCHECK) + list( + APPEND CMAKE_CXX_CPPCHECK + "--enable=all" + "--error-exitcode=1" + "--suppress=unreachableCode" + "--suppress=unusedFunction" + "--suppress=missingInclude" + "--suppress=uselessAssignmentPtrArg" + "--suppress=unmatchedSuppression" + "--suppress=internalAstError" + "--suppress=unmatchedSuppression" + "--suppress=memleakOnRealloc" + "--suppress=redundantAssignment" + "--suppress=constParameter" + ) + set(CMAKE_C_CPPCHECK ${CMAKE_CXX_CPPCHECK}) +else() + message(FATAL_ERROR "Could not find the program cppcheck.") +endif() + #for ASAN set(ASAN_OPTION "OFF" CACHE STRING " set asan type chosen by the user, using OFF as default") set_property(CACHE ASAN_OPTION PROPERTY STRINGS OFF ADDRESS THREAD) diff --git a/bin/tsg_static_tableinfo.conf b/bin/tsg_static_tableinfo.conf index dd9fa64..e73a70a 100644 --- a/bin/tsg_static_tableinfo.conf +++ b/bin/tsg_static_tableinfo.conf @@ -93,4 +93,4 @@ 79 TSG_SECURITY_TUNNEL virtual TSG_OBJ_TUNNEL_ID -- 80 TSG_OBJ_FLAG flag -- 81 TSG_SECURITY_FLAG virtual TSG_OBJ_FLAG -- -82 TRAFFIC_SHAPING_PROFILE plugin {"key":1,"valid":8}
\ No newline at end of file +82 TRAFFIC_SHAPING_PROFILE plugin {"key":1,"valid":7}
\ No newline at end of file diff --git a/ctest/CMakeLists.txt b/ctest/CMakeLists.txt index ba5a437..1179b3b 100644 --- a/ctest/CMakeLists.txt +++ b/ctest/CMakeLists.txt @@ -11,7 +11,9 @@ add_test(NAME COPY_GTEST_TABLEINFO COMMAND sh -c "cp -r ${CMAKE_SOURCE_DIR}/bin/ add_test(NAME COPY_GTEST_MAAT_RULE COMMAND sh -c "cp -r ${CMAKE_SOURCE_DIR}/test/bin/gtest_maat.json ${CMAKE_BINARY_DIR}/testing/tsgconf/tsg_maat.json") add_test(NAME COPY_GTEST_RULE_BIN COMMAND sh -c "cp ${CMAKE_BINARY_DIR}/test/src/gtest_rule ${CMAKE_BINARY_DIR}/testing/") -add_test(NAME COPY_GTEST_MASTER COMMAND sh -c "cp -r ${CMAKE_BINARY_DIR}/test/src/gtest_master ${CMAKE_BINARY_DIR}/testing/") +add_test(NAME COPY_GTEST_MASTER_BIN COMMAND sh -c "cp ${CMAKE_BINARY_DIR}/test/src/gtest_master ${CMAKE_BINARY_DIR}/testing/") -add_test(NAME FAKE_TEST COMMAND sh -c "pwd") +set(GTEST_RUN_DIR ${CMAKE_BINARY_DIR}/testing) +add_test(NAME GTEST_RULE COMMAND gtest_rule WORKING_DIRECTORY ${GTEST_RUN_DIR}) +add_test(NAME GTEST_MASTER COMMAND gtest_master WORKING_DIRECTORY ${GTEST_RUN_DIR}) diff --git a/inc/tsg_label.h b/inc/tsg_label.h index 03258e7..bcd401b 100644 --- a/inc/tsg_label.h +++ b/inc/tsg_label.h @@ -7,7 +7,6 @@ #define MAX_VLAN_ID_NUM 32 #define MAX_RESULT_NUM 8 -#define MAX_DOMAIN_LEN 2048 typedef enum _tsg_protocol { diff --git a/inc/tsg_rule.h b/inc/tsg_rule.h index 42f3542..6e5853c 100644 --- a/inc/tsg_rule.h +++ b/inc/tsg_rule.h @@ -8,6 +8,10 @@ #define TSG_DOMAIN_MAX 256 #define MAX_APP_ID_PROPERTY_LEN 128 +#ifndef MAX_DOMAIN_LEN +#define MAX_DOMAIN_LEN 2048 +#endif + #define TSG_ACTION_NONE 0x00 #define TSG_ACTION_MONITOR 0x01 #define TSG_ACTION_INTERCEPT 0x02 @@ -90,5 +94,6 @@ int tsg_scan_app_id_policy(Maat_feather_t maat_feather, const struct streaminfo int tsg_scan_fqdn_category_id(Maat_feather_t maat_feather, const struct streaminfo *a_stream, struct Maat_rule_t *result, int result_num, scan_status_t *mid, int table_id, unsigned int *category_id, int category_id_num, int thread_seq); int tsg_notify_hited_monitor_result(const struct streaminfo *a_stream, struct Maat_rule_t *result, int result_num, int thread_seq); int tsg_notify_hited_shaping_result(const struct streaminfo *a_stream, struct Maat_rule_t *result, int result_num, int thread_seq); +int tsg_notify_hited_security_result(const struct streaminfo *a_stream, struct Maat_rule_t *result, int result_num, int thread_seq); #endif diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt index 57058f5..2efdb3b 100644 --- a/src/CMakeLists.txt +++ b/src/CMakeLists.txt @@ -2,7 +2,7 @@ cmake_minimum_required(VERSION 2.8) add_definitions(-fPIC) -set(SRC tsg_entry.cpp tsg_rule.cpp tsg_ssl_utils.cpp tsg_send_log.cpp tsg_statistic.cpp tsg_ssh_utils.cpp tsg_gtp_signaling.cpp tsg_action.cpp tsg_leaky_bucket.cpp tsg_dns.cpp tsg_icmp.cpp tsg_tamper.cpp) +set(SRC tsg_entry.cpp tsg_rule.cpp tsg_ssl_utils.cpp tsg_send_log.cpp tsg_statistic.cpp tsg_ssh_utils.cpp tsg_gtp_signaling.cpp tsg_action.cpp tsg_leaky_bucket.cpp tsg_dns.cpp tsg_icmp.cpp tsg_tamper.cpp tsg_bridge.cpp) include_directories(${CMAKE_SOURCE_DIR}/inc) include_directories(/opt/MESA/include/MESA/) diff --git a/src/tsg_action.cpp b/src/tsg_action.cpp index e9edde6..7d75494 100644 --- a/src/tsg_action.cpp +++ b/src/tsg_action.cpp @@ -125,14 +125,13 @@ static int get_http_header(char *buff, int len, int code, char *user_define) static int get_tcp_mss_option(const struct streaminfo *a_stream, int type, void *out) { - int i=0,ret=0; int tcp_opt_num=0; struct tcp_option *tcp_opt=NULL; - ret=MESA_get_stream_opt(a_stream, MSO_TCP_SYN_OPT, (void *)&tcp_opt, &tcp_opt_num); + int ret=MESA_get_stream_opt(a_stream, MSO_TCP_SYN_OPT, (void *)&tcp_opt, &tcp_opt_num); if(ret>0) { - for(i=0; i<tcp_opt_num; i++) + for(int i=0; i<tcp_opt_num; i++) { if(tcp_opt[i].type!=type) { @@ -156,8 +155,6 @@ static int get_tcp_mss_option(const struct streaminfo *a_stream, int type, void static void template_generate(const struct streaminfo *a_stream, int status_code, int policy_id, const char* message, char **page_buff, size_t *page_size, int thread_seq) { - int used_len=0; - char *tmp_buff=NULL; std::string page_output, msg_output; ctemplate::Template *tpl=NULL; ctemplate::TemplateDictionary dict("pg_page_dict"); //dict is automatically finalized after function returned. @@ -173,8 +170,8 @@ static void template_generate(const struct streaminfo *a_stream, int status_code tpl_message->Expand(&msg_output, &dict_msg); - used_len=msg_output.length(); - tmp_buff=(char *)dictator_malloc(a_stream->threadnum, (used_len+1)*sizeof(char)); + int used_len=msg_output.length(); + char *tmp_buff=(char *)dictator_malloc(a_stream->threadnum, (used_len+1)*sizeof(char)); memcpy(tmp_buff, msg_output.c_str(), used_len); tmp_buff[used_len]='\0'; @@ -537,18 +534,16 @@ static int http_get_redirect_url(const struct streaminfo *a_stream, struct Maat_ static unsigned char do_action_reset(const struct streaminfo *a_stream, Maat_rule_t *p_result, tsg_protocol_t protocol) { - int ret=0,opt_value=0; - struct rst_tcp_para rst_paras={0}; - if(a_stream->type==STREAM_TYPE_TCP) { + struct rst_tcp_para rst_paras={0}; rst_paras.rst_pkt_num=g_tsg_para.reset.pkt_num; rst_paras.signature_seed1=g_tsg_para.reset.seed1; rst_paras.signature_seed2=g_tsg_para.reset.seed2; rst_paras.th_flags=g_tsg_para.reset.th_flags; rst_paras.__pad_no_use=0; rst_paras.dir=g_tsg_para.reset.dir; - ret=MESA_rst_tcp((struct streaminfo *)a_stream, &rst_paras, sizeof(rst_paras)); + int ret=MESA_rst_tcp((struct streaminfo *)a_stream, &rst_paras, sizeof(rst_paras)); if(ret<0) { MESA_handle_runtime_log(g_tsg_para.logger, @@ -564,7 +559,7 @@ static unsigned char do_action_reset(const struct streaminfo *a_stream, Maat_rul if(g_tsg_para.reset.remedy==1) { - opt_value=1; + int opt_value=1; MESA_set_stream_opt(a_stream, MSO_TCP_RST_REMEDY, (void *)&opt_value, sizeof(opt_value)); } @@ -597,12 +592,12 @@ static unsigned char do_action_tamper(const struct streaminfo *a_stream, Maat_ru return STATE_DROPME|STATE_DROPPKT; } - struct tcpall_context * _context=(struct tcpall_context *)get_struct_project(a_stream, g_tsg_para.tcpall_project_id); + struct tcpall_context * _context=(struct tcpall_context *)tsg_get_xxx_from_bridge(a_stream, g_tsg_para.bridge[BRIDGE_TYPE_ALL_CONTEXT].id); if(_context==NULL) { _context=(struct tcpall_context *)dictator_malloc(a_stream->threadnum, sizeof(struct tcpall_context)); memset(_context, 0, sizeof(struct tcpall_context)); - set_struct_project(a_stream, g_tsg_para.tcpall_project_id, (void *)_context); + tsg_set_xxx_to_bridge(a_stream, g_tsg_para.bridge[BRIDGE_TYPE_ALL_CONTEXT].id, (void *)_context); _context->method_type=TSG_METHOD_TYPE_TAMPER; _context->tamper_count = 0; } @@ -695,7 +690,6 @@ static unsigned char do_action_ratelimit(const struct streaminfo *a_stream, Maat static unsigned char do_action_block_mail(const struct streaminfo *a_stream, Maat_rule_t *p_result, struct compile_user_region *user_region) { char *payload=NULL; - unsigned char raw_route_dir=0; switch(user_region->deny->code) { @@ -711,7 +705,7 @@ static unsigned char do_action_block_mail(const struct streaminfo *a_stream, Maa if(payload!=NULL) { - raw_route_dir=(a_stream->curdir==DIR_C2S) ? MESA_dir_reverse(a_stream->routedir) : a_stream->routedir; + unsigned char raw_route_dir=(a_stream->curdir==DIR_C2S) ? MESA_dir_reverse(a_stream->routedir) : a_stream->routedir; tsg_send_inject_packet(a_stream, SIO_DEFAULT, payload, strlen(payload), raw_route_dir); } diff --git a/src/tsg_bridge.cpp b/src/tsg_bridge.cpp new file mode 100644 index 0000000..2b2d06d --- /dev/null +++ b/src/tsg_bridge.cpp @@ -0,0 +1,188 @@ +#include <stdio.h> +#include <string.h> +#include <stdlib.h> + +#include <MESA/MESA_prof_load.h> +#include <MESA/MESA_handle_logger.h> + +#include "tsg_bridge.h" +#include "tsg_variable.h" + +extern int app_identify_result_cb(const struct streaminfo *a_stream, int bridge_id, void *data); +extern int session_flags_identify_result_cb(const struct streaminfo *a_stream, int bridge_id, void *data); + +void free_context_label(const struct streaminfo *a_stream, int bridge_id, void *data) +{ + struct master_context *context=(struct master_context *)data; + if(context!=NULL) + { + if(context->domain!=NULL) + { + dictator_free(a_stream->threadnum, (void *)context->domain); + context->domain=NULL; + } + + if(context->quic_ua!=NULL) + { + dictator_free(a_stream->threadnum, (void *)context->quic_ua); + context->quic_ua=NULL; + } + + if(context->mid!=NULL) + { + Maat_clean_status(&context->mid); + context->mid=NULL; + } + + dictator_free(a_stream->threadnum, (void *)context); + context=NULL; + } + + data=NULL; + + return ; +} + +void free_tcpall_label(const struct streaminfo *a_stream, int bridge_id, void *data) +{ + if(data!=NULL) + { + struct tcpall_context *context=(struct tcpall_context *)data; + if(context->para!=NULL) + { + switch(context->method_type) + { + case TSG_METHOD_TYPE_RATE_LIMIT: + destroy_bucket(&(context->bucket), a_stream->threadnum); + break; + default: + break; + } + } + + dictator_free(a_stream->threadnum, data); + data=NULL; + } + + return ; +} + +void free_shaping_result(const struct streaminfo *stream, int bridge_id, void *data) +{ + if(data!=NULL) + { + dictator_free(stream->threadnum, data); + data=NULL; + } +} + +void free_policy_label(const struct streaminfo *a_stream, int bridge_id, void *data) +{ + if(data!=NULL) + { + struct policy_priority_label *priority_label=(struct policy_priority_label *)data; + if(priority_label->para!=NULL) + { + dictator_free(a_stream->threadnum, priority_label->para); + priority_label->para=NULL; + } + dictator_free(a_stream->threadnum, data); + data=NULL; + } +} + +void free_gather_app_result(const struct streaminfo *a_stream, int bridge_id, void *data) +{ + if(data!=NULL) + { + dictator_free(a_stream->threadnum, data); + data=NULL; + } +} + +int tsg_set_xxx_to_bridge(const struct streaminfo *a_stream, int bridge_id, void *data) +{ + if(a_stream==NULL || bridge_id<0) + { + return 0; + } + + int ret=stream_bridge_async_data_put(a_stream, bridge_id, data); + if(ret<0) + { + MESA_handle_runtime_log(g_tsg_para.logger, RLOG_LV_FATAL, "BRIDGE", "Add project failed, bridge_id: %d addr: %s", bridge_id, PRINTADDR(a_stream, g_tsg_para.level)); + return 0; + } + + return 1; +} + +void *tsg_get_xxx_from_bridge(const struct streaminfo *a_stream, int bridge_id) +{ + if(a_stream!=NULL || bridge_id>=0) + { + return stream_bridge_async_data_get(a_stream, bridge_id); + } + + return NULL; +} + +int tsg_init_bridge(const char *conffile) +{ + MESA_load_profile_string_def(conffile, "SYSTEM", "APP_IDENTIFY_RESULT_BRIDGE", g_tsg_para.bridge[BRIDGE_TYPE_APP_IDENTIFY_RESULT].name, MAX_BRIDGE_NAME_LEN, "APP_IDENTIFY_RESULT_BRIDGE"); + g_tsg_para.bridge[BRIDGE_TYPE_APP_IDENTIFY_RESULT].sync_cb=app_identify_result_cb; + + MESA_load_profile_string_def(conffile, "SYSTEM", "SKETCH_NOTIFY_BRIDGE_NAME", g_tsg_para.bridge[BRIDGE_TYPE_RECV_CONN_SKETCH_DATA].name, MAX_BRIDGE_NAME_LEN, "TSG_CONN_SKETCH_NOTIFY_DATA"); + MESA_load_profile_string_def(conffile, "SYSTEM", "MASTER_NOTIFY_BRIDGE_NAME", g_tsg_para.bridge[BRIDGE_TYPE_SEND_CONN_SKETCH_DATA].name, MAX_BRIDGE_NAME_LEN, "TSG_MASTER_NOTIFY_DATA"); + + MESA_load_profile_string_def(conffile, "SESSION_FLAGS", "FLAGS_NOTIFY_BRIDGE_NAME", g_tsg_para.bridge[BRIDGE_TYPE_NOTIFY_FLAGS].name, MAX_BRIDGE_NAME_LEN, "SESSION_FLAGS_SYNC_NOTIFY_DATA"); + g_tsg_para.bridge[BRIDGE_TYPE_NOTIFY_FLAGS].sync_cb=session_flags_identify_result_cb; + + MESA_load_profile_string_def(conffile, "SYSTEM", "SHAPING_RESULT_BRIDGE_NAME", g_tsg_para.bridge[BRIDGE_TYPE_NOTIFY_SHAPING_RESULT].name, MAX_BRIDGE_NAME_LEN, "NOTIFY_SHAPING_RESULT"); + g_tsg_para.bridge[BRIDGE_TYPE_NOTIFY_SHAPING_RESULT].free_cb=free_shaping_result; + + MESA_load_profile_string_def(conffile, "SYSTEM", "DATA_CONTEXT_BRIDGE_NAME", g_tsg_para.bridge[BRIDGE_TYPE_DATA_CONTEXT].name, MAX_BRIDGE_NAME_LEN, "TSG_DATA_CONTEXT"); + g_tsg_para.bridge[BRIDGE_TYPE_DATA_CONTEXT].free_cb=free_context_label; + + MESA_load_profile_string_def(conffile, "SYSTEM", "ALL_RESULT_BRIDGE_NAME", g_tsg_para.bridge[BRIDGE_TYPE_ALL_CONTEXT].name, MAX_BRIDGE_NAME_LEN, "TSG_ALL_CONTEXT"); + g_tsg_para.bridge[BRIDGE_TYPE_ALL_CONTEXT].free_cb=free_tcpall_label; + + MESA_load_profile_string_def(conffile, "SYSTEM", "GATHER_APP_RESULT_BRIDGE_NAME", g_tsg_para.bridge[BRIDGE_TYPE_GATHER_APP_RESULT].name, MAX_BRIDGE_NAME_LEN, "GATHER_APP_IDENTIFY_RESULT"); + g_tsg_para.bridge[BRIDGE_TYPE_GATHER_APP_RESULT].free_cb=free_gather_app_result; + + MESA_load_profile_string_def(conffile, "SYSTEM", "POLICY_PRIORITY_BRIDGE_NAME", g_tsg_para.bridge[BRIDGE_TYPE_POLICY_PRIORITY].name, MAX_BRIDGE_NAME_LEN, "TSG_POLICY_PRIORITY"); + g_tsg_para.bridge[BRIDGE_TYPE_POLICY_PRIORITY].free_cb=free_policy_label; + + for(int i=0; i<BRIDGE_TYPE_MAX; i++) + { + g_tsg_para.bridge[i].id=stream_bridge_build(g_tsg_para.bridge[i].name, "w"); + if(g_tsg_para.bridge[i].id<0) + { + MESA_handle_runtime_log(g_tsg_para.logger, RLOG_LV_FATAL, "INIT_BRIDGE", "stream_bridge_build is error, bridge_name: %s", g_tsg_para.bridge[i].name); + return -1; + } + + if(g_tsg_para.bridge[i].sync_cb) + { + int ret=stream_bridge_register_data_sync_cb(g_tsg_para.bridge[i].id, g_tsg_para.bridge[i].sync_cb); + if(ret<0) + { + MESA_handle_runtime_log(g_tsg_para.logger, RLOG_LV_FATAL, "BRIDGE_SYNC_CB", "Register callback failed, bridge_name: %d", g_tsg_para.bridge[i].name); + return -1; + } + } + + if(g_tsg_para.bridge[i].free_cb) + { + int ret=stream_bridge_register_data_free_cb(g_tsg_para.bridge[i].id, g_tsg_para.bridge[i].free_cb); + if(ret<0) + { + MESA_handle_runtime_log(g_tsg_para.logger, RLOG_LV_FATAL, "BRIDGE_FREE_CB", "Register async free callback failed, bridge_name: %d", g_tsg_para.bridge[i].name); + return -1; + } + } + } + + return 0; +} + diff --git a/src/tsg_bridge.h b/src/tsg_bridge.h new file mode 100644 index 0000000..9371ecf --- /dev/null +++ b/src/tsg_bridge.h @@ -0,0 +1,130 @@ +#pragma once + +#include <MESA/stream.h> +#include <MESA/Maat_rule.h> + +#include "tsg_rule.h" +#include "app_label.h" +#include "tsg_leaky_bucket.h" + +#ifndef MAX_BRIDGE_NAME_LEN +#define MAX_BRIDGE_NAME_LEN 64 +#endif + +enum BRIDGE_TYPE +{ + BRIDGE_TYPE_SEND_CONN_SKETCH_DATA=0, + BRIDGE_TYPE_RECV_CONN_SKETCH_DATA, + BRIDGE_TYPE_APP_IDENTIFY_RESULT, + BRIDGE_TYPE_NOTIFY_FLAGS, + BRIDGE_TYPE_NOTIFY_SHAPING_RESULT, //sync and async + BRIDGE_TYPE_DATA_CONTEXT, //async + BRIDGE_TYPE_ALL_CONTEXT, //async + BRIDGE_TYPE_GATHER_APP_RESULT, //async + BRIDGE_TYPE_POLICY_PRIORITY, //async + BRIDGE_TYPE_MAX +}; + +struct app_attributes +{ + unsigned int app_id; + unsigned int surrogate_id; + unsigned int packet_sequence; +}; + +struct gather_app_result +{ + int app_num; + enum APP_IDENTIFY_ORIGIN origin; + struct app_attributes attributes[MAX_APP_ID_NUM]; +}; + +struct policy_priority_label +{ + tsg_protocol_t proto; //enum _tsg_protocol (tsg_types.h) + int domain_len; + int result_type; //enum _PULL_RESULT_TYPE (tsg_rule.h) + int security_result_num; + union + { + char *http_url; + char *quic_ua; + void *para; + }; + char domain[MAX_DOMAIN_LEN]; + struct Maat_rule_t security_result[MAX_RESULT_NUM]; +}; + +struct hited_app_para +{ + int hited_app_id; + int after_n_packets; +}; + +struct master_context +{ + unsigned char is_esni; + unsigned char is_hited_allow; + unsigned char deal_pkt_num; + unsigned char is_app_link; + unsigned char sync_cb_state; + unsigned short timeout; + tsg_protocol_t proto; + int hited_app_id; // only app + unsigned int quic_version; + unsigned long session_flag; + char *domain; + union + { + char *http_url; + char *quic_ua; + void *para; + }; + scan_status_t mid; + struct hited_app_para hited_para; // l7 protocol and app + long long last_scan_time; +}; + +struct tcpall_context +{ + char udp_data_dropme; + char set_latency_flag; + char direction; + char padding[5]; + enum TSG_METHOD_TYPE method_type; + tsg_protocol_t protocol; + union + { + struct leaky_bucket *bucket; + long tamper_count; + int default_policy_after_n_packets; + struct hited_app_para hited_para; + void *para; + }; +}; + +struct udp_context +{ + struct master_context *data_entry; + struct tcpall_context *all_entry; +}; + +struct bridge_info +{ + int id; + char name[MAX_BRIDGE_NAME_LEN]; + stream_bridge_free_cb_t *free_cb; + stream_bridge_sync_cb_t *sync_cb; +}; + +int tsg_init_bridge(const char *conffile); + +void free_context_label(const struct streaminfo *stream, int bridge_id, void *data); +void free_tcpall_label(const struct streaminfo *stream, int bridge_id, void *data); +void free_policy_label(const struct streaminfo *stream, int bridge_id, void *data); +void free_shaping_result(const struct streaminfo *stream, int bridge_id, void *data); +void free_gather_app_result(const struct streaminfo *stream, int bridge_id, void *data); + +void *tsg_get_xxx_from_bridge(const struct streaminfo *a_stream, int bridge_id); +int tsg_set_xxx_to_bridge(const struct streaminfo *a_stream, int bridge_id, void *data); + diff --git a/src/tsg_dns.cpp b/src/tsg_dns.cpp index af331c7..5f52262 100644 --- a/src/tsg_dns.cpp +++ b/src/tsg_dns.cpp @@ -34,9 +34,8 @@ static int record_hton_uint32(char *payload, unsigned int value) return 4; } -static int compress_domain_record(unsigned char *domain, int domain_len, u_char *result) +static int compress_domain_record(const unsigned char *domain, int domain_len, u_char *result) { - int section_len = 0; int result_pos = 1; int domain_pos = 0; @@ -45,9 +44,9 @@ static int compress_domain_record(unsigned char *domain, int domain_len, u_char return -1; } - while((domain[domain_pos] != '\n')||(domain[domain_pos] != '\0')) + while((domain[domain_pos] != '\n') && (domain[domain_pos] != '\0')) { - section_len = 0; + int section_len = 0; while((domain[domain_pos] != '.') &&(domain[domain_pos] != '\n')&&(domain[domain_pos] != '\0')) { result[result_pos] = domain[domain_pos]; @@ -122,26 +121,26 @@ int dns_set_response_question(char *payload, int payload_len, dns_query_question int dns_set_response_records(char *payload, int payload_len, struct dns_record_val *record_val, int record_val_num, int max_ttl, int min_ttl) { - int i=0,ttl=0,used_len=0; + int used_len=0; unsigned short compress_len=0; unsigned char compress_name[DNS_MAX_NAME+1]={0}; - for(i=0; i<record_val_num; i++) + for(int i=0; i<record_val_num; i++) { used_len+=record_hton_uint16(payload+used_len, (unsigned short)0xc00c); used_len+=record_hton_uint16(payload+used_len, (unsigned short)(record_val[i].answer_type));//type used_len+=record_hton_uint16(payload+used_len, (unsigned short)1); //class - ttl=random_integer(max_ttl, min_ttl)+min_ttl; + int ttl=random_integer(max_ttl, min_ttl)+min_ttl; used_len+=record_hton_uint32(payload+used_len, (unsigned int)ttl);//ttl switch(record_val[i].answer_type) { - case DNS_TYPE_A: + case DNS_TYPE_A: used_len+=record_hton_uint16(payload+used_len, (unsigned short)(record_val[i].len)); //len used_len+=record_set_uint32(payload+used_len, (unsigned int)(record_val[i].v4_addr.s_addr)); //IPv4 break; - case DNS_TYPE_AAAA: + case DNS_TYPE_AAAA: used_len+=record_hton_uint16(payload+used_len, (unsigned short)(record_val[i].len)); //len memcpy(payload+used_len, record_val[i].v6_addr.s6_addr, record_val[i].len); //IPv6 used_len+=record_val[i].len; @@ -191,22 +190,21 @@ static int dns_set_answer_records(char *payload, int payload_len, struct dns_ans { return 0; } - - char profile_id[128]={0}; - int idx=0, used_len=0, record_num=0; - struct dns_profile_records *profile_records=NULL; + + int used_len=0; if(answer_records->record_val.selected_flag==1) - { + { + char profile_id[128]={0}; snprintf(profile_id, sizeof(profile_id), "%d", answer_records->record_val.selected.profile_id); - profile_records=(struct dns_profile_records *)Maat_plugin_get_EX_data(g_tsg_maat_feather, g_tsg_para.table_id[TABLE_DNS_PROFILE_RECORD], profile_id); + struct dns_profile_records *profile_records=(struct dns_profile_records *)Maat_plugin_get_EX_data(g_tsg_maat_feather, g_tsg_para.table_id[TABLE_DNS_PROFILE_RECORD], profile_id); if(profile_records==NULL) { return 0; } - record_num=MIN(answer_records->record_val.selected.selected_num, profile_records->record_num); - idx=random_integer(profile_records->record_num, record_num); + int record_num=MIN(answer_records->record_val.selected.selected_num, profile_records->record_num); + int idx=random_integer(profile_records->record_num, record_num); used_len+=dns_set_response_records(payload+used_len, payload_len-used_len, profile_records->record_val+idx, record_num, answer_records->max_ttl, answer_records->min_ttl); (*answer_record_num)+=record_num; diff --git a/src/tsg_entry.cpp b/src/tsg_entry.cpp index a29442b..35312a7 100644 --- a/src/tsg_entry.cpp +++ b/src/tsg_entry.cpp @@ -50,17 +50,11 @@ static __attribute__((__used__)) const char * GIT_VERSION_UNKNOWN = NULL; } #endif -struct session_record_ctx -{ - struct TLD_handle_t *log; - tsg_protocol_t proto_type; -}; - char TSG_MASTER_VERSION_20200805 = 0; const char *tsg_conffile="tsgconf/main.conf"; g_tsg_para_t g_tsg_para; -id2field_t g_tsg_fs2_field[TSG_FS2_MAX]={{0, TSG_FS2_TCP_LINKS, "tcp_links"}, +struct id2field g_tsg_fs2_field[TSG_FS2_MAX]={{0, TSG_FS2_TCP_LINKS, "tcp_links"}, {0, TSG_FS2_UDP_LINKS, "udp_links"}, {0, TSG_FS2_BYPASS, "bypass"}, {0, TSG_FS2_HIT_ADDR, "hit_addr"}, @@ -111,7 +105,7 @@ id2field_t g_tsg_fs2_field[TSG_FS2_MAX]={{0, TSG_FS2_TCP_LINKS, "tcp_links"}, {0, TSG_FS2_TUNNEL_LABEL_DEL, "t_label_del"} }; -id2field_t g_tsg_proto_name2id[PROTO_MAX]={{PROTO_UNKONWN, 0, "unknown"}, +struct id2field g_tsg_proto_name2id[PROTO_MAX]={{PROTO_UNKONWN, 0, "unknown"}, {PROTO_IPv4, 0, "IPV4"}, {PROTO_IPv6, 0, "IPV6"}, {PROTO_TCP, 0, "TCP"}, @@ -140,6 +134,75 @@ id2field_t g_tsg_proto_name2id[PROTO_MAX]={{PROTO_UNKONWN, 0, "unknown"}, #define DECCRYPTION_EXCLUSION_ALLOW_POLICY_ID 1 +static int init_page_template(const char *conffile) +{ + char page_path[256]; + memset(page_path, 0, sizeof(page_path)); + MESA_load_profile_string_def(conffile, "HTTP_PLUG", "PAGE403", page_path, sizeof(page_path), "./tsgconf/HTTP403.html"); + g_tsg_para.tpl_403 = ctemplate::Template::GetTemplate(page_path, ctemplate::DO_NOT_STRIP); + + memset(page_path, 0, sizeof(page_path)); + MESA_load_profile_string_def(conffile, "HTTP_PLUG", "PAGE404", page_path, sizeof(page_path), "./tsgconf/HTTP404.html"); + g_tsg_para.tpl_404 = ctemplate::Template::GetTemplate(page_path, ctemplate::DO_NOT_STRIP); + + memset(page_path, 0, sizeof(page_path)); + MESA_load_profile_string_def(conffile, "HTTP_PLUG", "PAGE200", page_path, sizeof(page_path), "./tsgconf/HTTP200.html"); + g_tsg_para.tpl_200 = ctemplate::Template::GetTemplate(page_path, ctemplate::DO_NOT_STRIP); + + memset(page_path, 0, sizeof(page_path)); + MESA_load_profile_string_def(conffile, "HTTP_PLUG", "PAGE204", page_path, sizeof(page_path), "./tsgconf/HTTP204.html"); + g_tsg_para.tpl_204 = ctemplate::Template::GetTemplate(page_path, ctemplate::DO_NOT_STRIP); + + return 0; +} + +static int init_fs2_handle(const char *conffile) +{ + int value=0,cycle=0; + int output_prometheus=0; + unsigned short fs_server_port=0; + char app_name[128]={0}; + char fs_server_ip[MAX_IPV4_LEN]={0}; + char fs_output_path[128]={0}; + + MESA_load_profile_int_def(conffile, "FIELD_STAT", "CYCLE", &cycle, 30); + MESA_load_profile_short_nodef(conffile, "FIELD_STAT","TELEGRAF_PORT", (short *)&(fs_server_port)); + MESA_load_profile_string_nodef(conffile,"FIELD_STAT","TELEGRAF_IP",fs_server_ip, sizeof(fs_server_ip)); + MESA_load_profile_string_def(conffile,"FIELD_STAT","OUTPUT_PATH",fs_output_path, sizeof(fs_output_path), "tsg_stat.log"); + MESA_load_profile_string_def(conffile,"FIELD_STAT","APP_NAME", app_name, sizeof(app_name), "tsg_master"); + MESA_load_profile_int_def(conffile, "FIELD_STAT", "PROMETHEUS", &output_prometheus, 1); + + g_tsg_para.fs2_handle=FS_create_handle(); + + value=1;//Rewrite + FS_set_para(g_tsg_para.fs2_handle, PRINT_MODE, &value, sizeof(value)); + value=1;//Do not create stat thread + FS_set_para(g_tsg_para.fs2_handle, CREATE_THREAD, &value, sizeof(value)); + + FS_set_para(g_tsg_para.fs2_handle, STAT_CYCLE, &cycle, sizeof(cycle)); + FS_set_para(g_tsg_para.fs2_handle, APP_NAME, app_name, strlen(app_name)+1); + FS_set_para(g_tsg_para.fs2_handle, OUTPUT_DEVICE, fs_output_path, strlen(fs_output_path)+1); + + value=1; + FS_set_para(g_tsg_para.fs2_handle, OUTPUT_PROMETHEUS, &output_prometheus, sizeof(output_prometheus)); + + if(fs_server_port > 0 && strlen(fs_server_ip) > 0) + { + FS_set_para(g_tsg_para.fs2_handle, STATS_SERVER_IP,fs_server_ip, strlen(fs_server_ip)+1); + FS_set_para(g_tsg_para.fs2_handle, STATS_SERVER_PORT,&(fs_server_port), sizeof(fs_server_port)); + } + + value=FS_OUTPUT_INFLUX_LINE; + FS_set_para(g_tsg_para.fs2_handle, STATS_FORMAT, &value, sizeof(value)); + + for(int i=0; i<TSG_FS2_MAX; i++) + { + g_tsg_para.fs2_field_id[i]=FS_register(g_tsg_para.fs2_handle, FS_STYLE_FIELD, FS_CALC_SPEED, g_tsg_fs2_field[i].name); + } + + return 0; +} + static int init_context(void **pme, int thread_seq) { *pme=dictator_malloc(thread_seq, sizeof(struct master_context)); @@ -150,17 +213,16 @@ static int init_context(void **pme, int thread_seq) static int tsg_get_sn(char *filename, char *device_sn, int device_sn_len) { - int ret=0,flags=0; - char buff[4096]={0}; - cJSON *object=NULL; + int flags=0; FILE *fp=fopen(filename, "rb"); if(fp) { - ret=fread(buff, sizeof(buff), 1, fp); + char buff[4096]={0}; + int ret=fread(buff, sizeof(buff), 1, fp); if(ret<(int)sizeof(buff)) { - object=cJSON_Parse(buff); + cJSON *object=cJSON_Parse(buff); if(object) { cJSON *item=cJSON_GetObjectItem(object, "sn"); @@ -336,36 +398,6 @@ static int print_hit_path(const struct streaminfo *a_stream, struct master_conte return 1; } -static int is_only_monitor(struct Maat_rule_t *result, int hit_cnt) -{ - int i=0; - - for(i=0; i<hit_cnt; i++) - { - if(result[i].action==TSG_ACTION_BYPASS || result[i].action==TSG_ACTION_INTERCEPT || result[i].action==TSG_ACTION_DENY) - { - return 0; - } - } - - return 1; -} - -static int is_hited_allow(struct Maat_rule_t *result, int hit_cnt) -{ - int i=0; - - for(i=0; i<hit_cnt; i++) - { - if(result[i].action==TSG_ACTION_BYPASS) - { - return 1; - } - } - - return 0; -} - static int is_dns_protocol(const struct streaminfo *a_stream) { struct stream_tuple4_v4 *tpl4 = NULL; @@ -427,36 +459,6 @@ static int is_deny_application(Maat_rule_t *p_result) return ret; } -static int is_alone_business(tsg_protocol_t proto, unsigned int hited_app_id) -{ - unsigned int l7_proto_id=0; - switch(proto) - { - case PROTO_HTTP: - case PROTO_MAIL: - case PROTO_DNS: - case PROTO_FTP: - case PROTO_SSL: - case PROTO_SIP: - case PROTO_QUIC: - case PROTO_SMTP: - case PROTO_IMAP: - case PROTO_POP3: - case PROTO_RTP: - case PROTO_DTLS: - l7_proto_id=tsg_l7_protocol_name2id(g_tsg_proto_name2id[proto].name); - if(l7_proto_id==hited_app_id) - { - return 1; - } - break; - default: - break; - } - - return 0; -} - long long get_current_time_ms(void) { int size=sizeof(long long); @@ -466,38 +468,6 @@ long long get_current_time_ms(void) return current_time_ms; } -int set_struct_project(const struct streaminfo *a_stream, int project_id, void *data) -{ - if(a_stream==NULL || project_id<0) - { - return 0; - } - - int ret=project_req_add_struct((struct streaminfo *)a_stream, project_id, data); - if(ret<0) - { - MESA_handle_runtime_log(g_tsg_para.logger, - RLOG_LV_FATAL, - "PROJECT", - "Add project failed, project_id: %d addr: %s", - project_id, - PRINTADDR(a_stream, g_tsg_para.level) - ); - return 0; - } - - return 1; -} - -const void *get_struct_project(const struct streaminfo *a_stream, int project_id) -{ - if(a_stream==NULL || project_id<0) - { - return NULL; - } - - return project_req_get_struct(a_stream, project_id); -} static int get_table_id(tsg_protocol_t protocol) { switch(protocol) @@ -643,7 +613,7 @@ int set_hited_app_id(const struct streaminfo *a_stream, unsigned int hited_app_i { struct gather_app_result *gather_result=NULL; - gather_result=(struct gather_app_result *)get_struct_project(a_stream, g_tsg_para.gather_app_project_id); + gather_result=(struct gather_app_result *)tsg_get_xxx_from_bridge(a_stream, g_tsg_para.bridge[BRIDGE_TYPE_GATHER_APP_RESULT].id); if(gather_result==NULL) { return 0; @@ -657,6 +627,7 @@ int set_hited_app_id(const struct streaminfo *a_stream, unsigned int hited_app_i return 1; } +#if 0 static int master_send_log(const struct streaminfo *a_stream, struct Maat_rule_t *p_result, int result_num, struct master_context *context, int thread_seq) { tsg_log_t log_msg; @@ -677,20 +648,20 @@ static int master_send_log(const struct streaminfo *a_stream, struct Maat_rule_t log_msg.result=p_result; log_msg.result_num=result_num; - if(p_result[0].action==TSG_ACTION_MONITOR && g_tsg_para.bridge_id[BRIDGE_TYPE_RECV_CONN_SKETCH_DATA]>=0) + if(p_result[0].action==TSG_ACTION_MONITOR && g_tsg_para.bridge[BRIDGE_TYPE_RECV_CONN_SKETCH_DATA].id>=0) { switch(proto) { case PROTO_SSH: case PROTO_RDP: case PROTO_STRATUM: - notify=(struct tsg_conn_sketch_notify_data *)stream_bridge_async_data_get(a_stream, g_tsg_para.bridge_id[BRIDGE_TYPE_RECV_CONN_SKETCH_DATA]); + notify=(struct tsg_conn_sketch_notify_data *)tsg_get_xxx_from_bridge(a_stream, g_tsg_para.bridge[BRIDGE_TYPE_RECV_CONN_SKETCH_DATA].id); if (notify != NULL && notify->pdata.TLD_handle!=NULL && (notify->protocol== PROTO_SSH || notify->protocol== PROTO_STRATUM || notify->protocol== PROTO_RDP)) { TLD_handle = TLD_duplicate(notify->pdata.TLD_handle); if (TLD_handle!=NULL) { - tsg_send_log(g_tsg_log_instance, TLD_handle, &log_msg, thread_seq); + tsg_send_log(g_tsg_log_instance, TLD_handle, &log_msg, thread_seq); tsg_set_policy_flow((struct streaminfo *)a_stream, p_result, thread_seq); return 1; } @@ -788,14 +759,12 @@ static int master_send_log(const struct streaminfo *a_stream, struct Maat_rule_t return 1; } - +#endif static int tsg_proto_name2flag(char *proto_list, int *flag) { - int i=0; - char *s=NULL,*e=NULL; - - s=proto_list; + char *e=NULL; + char *s=proto_list; while(s) { e=index(s, ';'); @@ -804,7 +773,7 @@ static int tsg_proto_name2flag(char *proto_list, int *flag) break; } - for(i=0; i< PROTO_MAX; i++) + for(int i=0; i< PROTO_MAX; i++) { if((strncasecmp(s, g_tsg_proto_name2id[i].name, e-s))==0) { @@ -813,107 +782,12 @@ static int tsg_proto_name2flag(char *proto_list, int *flag) } } - s=e+1; + s=e+1; } return 0; } -static void free_context_label(int thread_seq, void *project_req_value) -{ - struct master_context *context=(struct master_context *)project_req_value; - if(context!=NULL) - { - if(context->domain!=NULL) - { - dictator_free(thread_seq, (void *)context->domain); - context->domain=NULL; - } - - if(context->quic_ua!=NULL) - { - dictator_free(thread_seq, (void *)context->quic_ua); - context->quic_ua=NULL; - } - - if(context->result!=NULL) - { - dictator_free(thread_seq, (void *)context->result); - context->result=NULL; - } - - if(context->mid!=NULL) - { - Maat_clean_status(&context->mid); - context->mid=NULL; - } - - dictator_free(thread_seq, (void *)context); - context=NULL; - } - - project_req_value=NULL; - - return ; -} - -static void free_tcpall_label(int thread_seq, void *project_req_value) -{ - if(project_req_value!=NULL) - { - struct tcpall_context *context=(struct tcpall_context *)project_req_value; - if(context->para!=NULL) - { - switch(context->method_type) - { - case TSG_METHOD_TYPE_RATE_LIMIT: - destroy_bucket(&(context->bucket), thread_seq); - break; - default: - break; - } - } - - dictator_free(thread_seq, project_req_value); - project_req_value=NULL; - } - - return ; -} - -void free_shaping_result(const struct streaminfo *stream, int bridge_id, void *data) -{ - if(data!=NULL) - { - dictator_free(stream->threadnum, data); - data=NULL; - } -} - -void free_policy_label(int thread_seq, void *project_req_value) -{ - if(project_req_value!=NULL) - { - struct policy_priority_label *priority_label=(struct policy_priority_label *)project_req_value; - if(priority_label->para!=NULL) - { - dictator_free(thread_seq, priority_label->para); - priority_label->para=NULL; - } - dictator_free(thread_seq, project_req_value); - project_req_value=NULL; - } -} - -void free_gather_app_result(int thread_seq, void *project_req_value) -{ - if(project_req_value!=NULL) - { - dictator_free(thread_seq, project_req_value); - project_req_value=NULL; - } -} - static char *malloc_copy_string(char *origin, int length, int thread_seq) { if(length<=0 && origin==NULL) @@ -928,127 +802,6 @@ static char *malloc_copy_string(char *origin, int length, int thread_seq) return dest; } -static void copy_monitor_result(const struct streaminfo *a_stream, struct master_context *context, struct Maat_rule_t *p_result, int result_num, int thread_seq) -{ - int i=0; - - if(context->result==NULL) - { - context->result=(struct Maat_rule_t *)dictator_malloc(thread_seq, sizeof(struct Maat_rule_t)*MAX_RESULT_NUM); - - for(i=0; i<result_num && p_result[i].action!=TSG_ACTION_INTERCEPT && context->hit_cnt<MAX_RESULT_NUM; i++) // SSL Decryption Exclusion - { - memcpy(context->result+context->hit_cnt, &p_result[i], sizeof(struct Maat_rule_t)); - context->hit_cnt+=1; - } - } - else - { - if(context->result[0].action==TSG_ACTION_MONITOR) - { - for(i=0; i<result_num && p_result[i].action!=TSG_ACTION_INTERCEPT && context->hit_cnt<MAX_RESULT_NUM; i++) // SSL Decryption Exclusion - { - memcpy(context->result+context->hit_cnt, &p_result[i], sizeof(struct Maat_rule_t)); - context->hit_cnt+=1; - } - } - } - - MESA_handle_runtime_log(g_tsg_para.logger, - RLOG_LV_DEBUG, - "MONITOR", - "Hit monitor policy, policy_id: %d service: %d action: %d addr: %s", - p_result[0].config_id, - p_result[0].service_id, - (unsigned char)p_result[0].action, - PRINTADDR(a_stream, g_tsg_para.level) - ); - -} - -static void copy_bypass_result(const struct streaminfo *a_stream, struct master_context *context, struct Maat_rule_t *p_result, int thread_seq) -{ - if(context->result==NULL) - { - context->hit_cnt=1; - context->result=(struct Maat_rule_t *)dictator_malloc(thread_seq, sizeof(struct Maat_rule_t)); - - memcpy(context->result, p_result, sizeof(struct Maat_rule_t)); - } - else - { - if(context->result[0].action==TSG_ACTION_BYPASS) - { - if(p_result->config_id>context->result[0].config_id) - { - context->hit_cnt=1; - memcpy(&(context->result[0]), p_result, sizeof(struct Maat_rule_t)); - } - } - else // hit monitor - { - context->hit_cnt=1; - memcpy(context->result, p_result, sizeof(struct Maat_rule_t)); - } - } - - MESA_handle_runtime_log(g_tsg_para.logger, - RLOG_LV_DEBUG, - "ALLOW", - "Hit allow policy, policy_id: %d service: %d action: %d addr: %s", - p_result[0].config_id, - p_result[0].service_id, - (unsigned char)p_result[0].action, - PRINTADDR(a_stream, g_tsg_para.level) - ); - - return ; -} - -static void copy_deny_result(const struct streaminfo *a_stream, struct master_context *context, struct Maat_rule_t *p_result, int thread_seq) -{ - if(context->result==NULL) - { - context->hit_cnt=1; - context->result=(struct Maat_rule_t *)dictator_malloc(thread_seq, sizeof(struct Maat_rule_t)); - - memcpy(context->result, p_result, sizeof(struct Maat_rule_t)); - } - else - { - if(context->result[0].action==TSG_ACTION_BYPASS) - { - return ; - } - - if(context->result[0].action==TSG_ACTION_DENY) - { - if(p_result->config_id>context->result[0].config_id) - { - context->hit_cnt=1; - memcpy(&(context->result[0]), p_result, sizeof(struct Maat_rule_t)); - } - } - else // hit monitor - { - context->hit_cnt=1; - memcpy(context->result, p_result, sizeof(struct Maat_rule_t)); - } - } - - MESA_handle_runtime_log(g_tsg_para.logger, - RLOG_LV_DEBUG, - "DENY", - "Hit deny policy, policy_id: %d service: %d action: %d addr: %s", - p_result[0].config_id, - p_result[0].service_id, - (unsigned char)p_result[0].action, - PRINTADDR(a_stream, g_tsg_para.level) - ); - - return ; -} - int copy_app_result(struct gather_app_result *gather_result, struct app_identify_result *identify_result, int packet_sequence) { if(identify_result->app_id_num<=gather_result->app_num) @@ -1069,14 +822,17 @@ int copy_app_result(struct gather_app_result *gather_result, struct app_identify return 0; } -static int l7_protocol_mapper(const char *filename) +static int l7_protocol_mapper(const char *conffile) { int ret=0; FILE *fp=NULL; char line[1024]={0}; char type_name[32]={0}; + char filename[128]={0}; struct l7_protocol *protocol=NULL; + MESA_load_profile_string_def(conffile, "SYSTEM", "L7_PROTOCOL_FILE", filename, sizeof(filename), "./tsgconf/tsg_l7_protocol.conf"); + fp=fopen(filename, "r"); if(fp==NULL) { @@ -1094,7 +850,7 @@ static int l7_protocol_mapper(const char *filename) } protocol=(struct l7_protocol *)calloc(1, sizeof(struct l7_protocol)); - ret=sscanf(line, "%s %s %d", type_name, protocol->name, &protocol->id); + ret=sscanf(line, "%31s %31s %d", type_name, protocol->name, &protocol->id); assert(ret==3); HASH_ADD(hh1, g_tsg_para.name_by_id, id, sizeof(int), protocol); @@ -1136,12 +892,10 @@ unsigned int tsg_l7_protocol_name2id(const char *l7_protocol_name) static int set_l7_protocol_to_pme(struct master_context *context, unsigned int app_id) { - int i=0; - char *l7_protocol_name=NULL; - l7_protocol_name=tsg_l7_protocol_id2name(app_id); + char *l7_protocol_name=tsg_l7_protocol_id2name(app_id); if(l7_protocol_name!=NULL) { - for(i=PROTO_HTTP; i<PROTO_MAX; i++) + for(int i=PROTO_HTTP; i<PROTO_MAX; i++) { if((strcasecmp(g_tsg_proto_name2id[i].name, l7_protocol_name))==0) { @@ -1158,13 +912,11 @@ static int set_l7_protocol_to_pme(struct master_context *context, unsigned int a int is_intercept_exclusion(const struct streaminfo *a_stream, Maat_rule_t *p_result, char *domain, int thread_seq) { - int ret=0; - scan_status_t mid=NULL; - Maat_rule_t tmp_result; - if(domain!=NULL) { - ret=Maat_full_scan_string(g_tsg_maat_feather, g_tsg_para.table_id[TABLE_EXCLUSION_SSL_SNI], CHARSET_UTF8, domain, strlen(domain), &tmp_result, NULL, 1, &mid,thread_seq); + scan_status_t mid=NULL; + struct Maat_rule_t tmp_result; + int ret=Maat_full_scan_string(g_tsg_maat_feather, g_tsg_para.table_id[TABLE_EXCLUSION_SSL_SNI], CHARSET_UTF8, domain, strlen(domain), &tmp_result, NULL, 1, &mid,thread_seq); if(mid!=NULL) { Maat_clean_status(&mid); @@ -1223,7 +975,7 @@ static int set_l7_protocol_label(const struct streaminfo *a_stream, tsg_protocol { struct gather_app_result *gather_result=NULL; - gather_result=(struct gather_app_result *)get_struct_project(a_stream, g_tsg_para.gather_app_project_id); + gather_result=(struct gather_app_result *)tsg_get_xxx_from_bridge(a_stream, g_tsg_para.bridge[BRIDGE_TYPE_GATHER_APP_RESULT].id); if(gather_result!=NULL) { return 0; @@ -1231,7 +983,7 @@ static int set_l7_protocol_label(const struct streaminfo *a_stream, tsg_protocol gather_result=(struct gather_app_result *)dictator_malloc(a_stream->threadnum, sizeof(struct gather_app_result)*ORIGIN_MAX); memset(gather_result, 0, sizeof(struct gather_app_result)*ORIGIN_MAX); - set_struct_project(a_stream, g_tsg_para.gather_app_project_id, (void *)gather_result); + tsg_set_xxx_to_bridge(a_stream, g_tsg_para.bridge[BRIDGE_TYPE_GATHER_APP_RESULT].id, (void *)gather_result); int app_id=tsg_l7_protocol_name2id(g_tsg_proto_name2id[protocol].name); if(app_id>0) @@ -1248,12 +1000,12 @@ static int set_l7_protocol_label(const struct streaminfo *a_stream, tsg_protocol int set_after_n_packet_to_tcpall(const struct streaminfo *a_stream, int after_n_packets, int thread_seq) { - struct tcpall_context *_context=(struct tcpall_context *)get_struct_project(a_stream, g_tsg_para.tcpall_project_id); + struct tcpall_context *_context=(struct tcpall_context *)tsg_get_xxx_from_bridge(a_stream, g_tsg_para.bridge[BRIDGE_TYPE_ALL_CONTEXT].id); if(_context==NULL) { _context=(struct tcpall_context *)dictator_malloc(thread_seq, sizeof(struct tcpall_context)); memset(_context, 0, sizeof(struct tcpall_context)); - set_struct_project(a_stream, g_tsg_para.tcpall_project_id, (void *)_context); + tsg_set_xxx_to_bridge(a_stream, g_tsg_para.bridge[BRIDGE_TYPE_ALL_CONTEXT].id, (void *)_context); } _context->hited_para.after_n_packets=after_n_packets; @@ -1263,12 +1015,12 @@ int set_after_n_packet_to_tcpall(const struct streaminfo *a_stream, int after_n_ int set_hited_app_id_to_tcpall(const struct streaminfo *a_stream, int hited_app_id, int thread_seq) { - struct tcpall_context *_context=(struct tcpall_context *)get_struct_project(a_stream, g_tsg_para.tcpall_project_id); + struct tcpall_context *_context=(struct tcpall_context *)tsg_get_xxx_from_bridge(a_stream, g_tsg_para.bridge[BRIDGE_TYPE_ALL_CONTEXT].id); if(_context==NULL) { _context=(struct tcpall_context *)dictator_malloc(thread_seq, sizeof(struct tcpall_context)); memset(_context, 0, sizeof(struct tcpall_context)); - set_struct_project(a_stream, g_tsg_para.tcpall_project_id, (void *)_context); + tsg_set_xxx_to_bridge(a_stream, g_tsg_para.bridge[BRIDGE_TYPE_ALL_CONTEXT].id, (void *)_context); } _context->hited_para.hited_app_id=hited_app_id; @@ -1278,12 +1030,12 @@ int set_hited_app_id_to_tcpall(const struct streaminfo *a_stream, int hited_app_ int set_protocol_to_tcpall(const struct streaminfo *a_stream, tsg_protocol_t protocol, int thread_seq) { - struct tcpall_context *_context=(struct tcpall_context *)get_struct_project(a_stream, g_tsg_para.tcpall_project_id); + struct tcpall_context *_context=(struct tcpall_context *)tsg_get_xxx_from_bridge(a_stream, g_tsg_para.bridge[BRIDGE_TYPE_ALL_CONTEXT].id); if(_context==NULL) { _context=(struct tcpall_context *)dictator_malloc(thread_seq, sizeof(struct tcpall_context)); memset(_context, 0, sizeof(struct tcpall_context)); - set_struct_project(a_stream, g_tsg_para.tcpall_project_id, (void *)_context); + tsg_set_xxx_to_bridge(a_stream, g_tsg_para.bridge[BRIDGE_TYPE_ALL_CONTEXT].id, (void *)_context); } _context->protocol=protocol; @@ -1293,12 +1045,12 @@ int set_protocol_to_tcpall(const struct streaminfo *a_stream, tsg_protocol_t pro int set_method_to_tcpall(const struct streaminfo *a_stream, enum TSG_METHOD_TYPE method_type, int thread_seq) { - struct tcpall_context *_context=(struct tcpall_context *)get_struct_project(a_stream, g_tsg_para.tcpall_project_id); + struct tcpall_context *_context=(struct tcpall_context *)tsg_get_xxx_from_bridge(a_stream, g_tsg_para.bridge[BRIDGE_TYPE_ALL_CONTEXT].id); if(_context==NULL) { _context=(struct tcpall_context *)dictator_malloc(thread_seq, sizeof(struct tcpall_context)); memset(_context, 0, sizeof(struct tcpall_context)); - set_struct_project(a_stream, g_tsg_para.tcpall_project_id, (void *)_context); + tsg_set_xxx_to_bridge(a_stream, g_tsg_para.bridge[BRIDGE_TYPE_ALL_CONTEXT].id, (void *)_context); } switch(_context->method_type) @@ -1318,18 +1070,18 @@ int set_method_to_tcpall(const struct streaminfo *a_stream, enum TSG_METHOD_TYPE int set_bucket_to_tcpall(const struct streaminfo *a_stream, struct leaky_bucket *bucket, int thread_seq) { - struct tcpall_context *_context=(struct tcpall_context *)get_struct_project(a_stream, g_tsg_para.tcpall_project_id); + struct tcpall_context *_context=(struct tcpall_context *)tsg_get_xxx_from_bridge(a_stream, g_tsg_para.bridge[BRIDGE_TYPE_ALL_CONTEXT].id); if(_context==NULL) { _context=(struct tcpall_context *)dictator_malloc(thread_seq, sizeof(struct tcpall_context)); memset(_context, 0, sizeof(struct tcpall_context)); - set_struct_project(a_stream, g_tsg_para.tcpall_project_id, (void *)_context); + tsg_set_xxx_to_bridge(a_stream, g_tsg_para.bridge[BRIDGE_TYPE_ALL_CONTEXT].id, (void *)_context); } switch(_context->method_type) { case TSG_METHOD_TYPE_RATE_LIMIT: - return 1; + return 1; break; case TSG_METHOD_TYPE_DEFAULT: case TSG_METHOD_TYPE_UNKNOWN: @@ -1347,7 +1099,7 @@ int set_bucket_to_tcpall(const struct streaminfo *a_stream, struct leaky_bucket char get_direction_from_tcpall(const struct streaminfo *a_stream) { - struct tcpall_context *context=(struct tcpall_context *)get_struct_project(a_stream, g_tsg_para.tcpall_project_id); + struct tcpall_context *context=(struct tcpall_context *)tsg_get_xxx_from_bridge(a_stream, g_tsg_para.bridge[BRIDGE_TYPE_ALL_CONTEXT].id); if(context!=NULL) { return context->direction; @@ -1356,20 +1108,6 @@ char get_direction_from_tcpall(const struct streaminfo *a_stream) return -1; } -int get_shaping_result(struct Maat_rule_t *hit_result, int hit_num, struct Maat_rule_t *shaping_result, int shaping_result_num) -{ - int shaping_cnt=0; - for(int i=0; i<hit_num; i++) - { - if(hit_result[i].action==TSG_ACTION_SHAPING && shaping_cnt<shaping_result_num) - { - memcpy(&shaping_result[shaping_cnt++], &hit_result[i], sizeof(struct Maat_rule_t)); - } - } - - return shaping_cnt; -} - static void set_shaping_result_to_project(const struct streaminfo *a_stream, struct Maat_rule_t *p_result, int p_result_num, int thread_seq) { if(p_result==NULL || p_result_num==0) @@ -1377,10 +1115,10 @@ static void set_shaping_result_to_project(const struct streaminfo *a_stream, str return ; } - struct notify_shaping_policy *shaping_label=(struct notify_shaping_policy *)stream_bridge_async_data_get((struct streaminfo *)a_stream, g_tsg_para.bridge_id[BRIDGE_TYPE_NOTIFY_SHAPING_RESULT]); + struct notify_shaping_policy *shaping_label=(struct notify_shaping_policy *)tsg_get_xxx_from_bridge((struct streaminfo *)a_stream, g_tsg_para.bridge[BRIDGE_TYPE_NOTIFY_SHAPING_RESULT].id); if(shaping_label==NULL) { - shaping_label=(struct notify_shaping_policy *)dictator_malloc(thread_seq, sizeof(struct notify_shaping_policy)); + shaping_label=(struct notify_shaping_policy *)dictator_malloc(thread_seq, sizeof(struct notify_shaping_policy)); memset(shaping_label, 0, sizeof(struct notify_shaping_policy)); } @@ -1408,13 +1146,13 @@ static void set_shaping_result_to_project(const struct streaminfo *a_stream, str struct notify_shaping_policy sync_result={0, {0}}; sync_result.shaping_result_num=inc_result_num; memcpy(sync_result.shaping_result, inc_result, inc_result_num*sizeof(struct Maat_rule_t)); - stream_bridge_sync_data_put(a_stream, g_tsg_para.bridge_id[BRIDGE_TYPE_NOTIFY_SHAPING_RESULT], (void *)&sync_result); + stream_bridge_sync_data_put(a_stream, g_tsg_para.bridge[BRIDGE_TYPE_NOTIFY_SHAPING_RESULT].id, (void *)&sync_result); shaping_label->shaping_result_num+=inc_result_num; - int ret=stream_bridge_async_data_put((struct streaminfo *)a_stream, g_tsg_para.bridge_id[BRIDGE_TYPE_NOTIFY_SHAPING_RESULT], (void *)shaping_label); + int ret=tsg_set_xxx_to_bridge((struct streaminfo *)a_stream, g_tsg_para.bridge[BRIDGE_TYPE_NOTIFY_SHAPING_RESULT].id, (void *)shaping_label); if(ret<0) { - free_shaping_result(a_stream, g_tsg_para.bridge_id[BRIDGE_TYPE_NOTIFY_SHAPING_RESULT], (void *)shaping_label); + free_shaping_result(a_stream, g_tsg_para.bridge[BRIDGE_TYPE_NOTIFY_SHAPING_RESULT].id, (void *)shaping_label); return ; } } @@ -1425,86 +1163,91 @@ int tsg_notify_hited_shaping_result(const struct streaminfo *a_stream, struct Ma return 0; } - -static void set_security_result_to_project(const struct streaminfo *a_stream, struct master_context *context, struct Maat_rule_t *p_result, int p_result_num, PULL_RESULT_TYPE result_type, int thread_seq) +int set_log_field_to_project(const struct streaminfo * a_stream, char *domain, void *para, tsg_protocol_t proto, int thread_seq) { - if(p_result==NULL || p_result_num==0) + struct policy_priority_label *priority_label=(struct policy_priority_label *)tsg_get_xxx_from_bridge((struct streaminfo *)a_stream, g_tsg_para.bridge[BRIDGE_TYPE_POLICY_PRIORITY].id); + if(priority_label==NULL) { - return ; + priority_label=(struct policy_priority_label *)dictator_malloc(thread_seq, sizeof(struct policy_priority_label)); + memset(priority_label, 0, sizeof(struct policy_priority_label)); + + int ret=tsg_set_xxx_to_bridge((struct streaminfo *)a_stream, g_tsg_para.bridge[BRIDGE_TYPE_POLICY_PRIORITY].id, (void *)priority_label); + if(ret<0) + { + free_policy_label(a_stream, g_tsg_para.bridge[BRIDGE_TYPE_POLICY_PRIORITY].id, (void *)priority_label); + } } - struct policy_priority_label *priority_label=(struct policy_priority_label *)project_req_get_struct((struct streaminfo *)a_stream, g_tsg_para.priority_project_id); - if(priority_label==NULL) + priority_label->proto=proto; + if(domain!=NULL) { - priority_label=(struct policy_priority_label *)dictator_malloc(thread_seq, sizeof(struct policy_priority_label)); - memset(priority_label, 0, sizeof(struct policy_priority_label)); + priority_label->domain_len=MIN(sizeof(priority_label->domain)-1 ,strlen(domain)); + memcpy(priority_label->domain, domain, priority_label->domain_len); } - else + + if(para!=NULL) { - MESA_handle_runtime_log(g_tsg_para.logger, - RLOG_LV_DEBUG, - "DUP_HIT_POLICY", - "Hit policy, domain: %s policy_id: %d action: %d addr: %s", - (context->domain!=NULL ? context->domain : ""), - p_result->config_id, - (unsigned char)p_result->action, - PRINTADDR(a_stream, g_tsg_para.level) - ); + int length=strlen((const char*)para); + priority_label->para=dictator_malloc(thread_seq,length+1); + memcpy(priority_label->para, para, length); + ((char *)priority_label->para)[length]='\0'; } - priority_label->proto=context->proto; - if(context->domain!=NULL) + return 0; +} + +static void set_security_result_to_project(const struct streaminfo *a_stream, struct Maat_rule_t *p_result, int p_result_num, PULL_RESULT_TYPE result_type, int thread_seq) +{ + if(p_result==NULL || p_result_num==0) { - priority_label->domain_len=MIN(sizeof(priority_label->domain)-1 ,strlen(context->domain)); - memcpy(priority_label->domain, context->domain, priority_label->domain_len); + return ; } - if(context->para!=NULL) + struct policy_priority_label *priority_label=(struct policy_priority_label *)tsg_get_xxx_from_bridge((struct streaminfo *)a_stream, g_tsg_para.bridge[BRIDGE_TYPE_POLICY_PRIORITY].id); + if(priority_label==NULL) { - int length=strlen(context->http_url); - priority_label->para=dictator_malloc(thread_seq,length+1); - memcpy(priority_label->para, context->para, length); - ((char *)priority_label->para)[length]='\0'; + priority_label=(struct policy_priority_label *)dictator_malloc(thread_seq, sizeof(struct policy_priority_label)); + memset(priority_label, 0, sizeof(struct policy_priority_label)); + + int ret=tsg_set_xxx_to_bridge((struct streaminfo *)a_stream, g_tsg_para.bridge[BRIDGE_TYPE_POLICY_PRIORITY].id, (void *)priority_label); + if(ret<0) + { + free_policy_label(a_stream, g_tsg_para.bridge[BRIDGE_TYPE_POLICY_PRIORITY].id, (void *)priority_label); + } } - if(priority_label->security_result_num<=0 || (priority_label->security_result[0].action < p_result->action)) + if(priority_label->security_result_num>0 && priority_label->security_result[0].action!=p_result[0].action) { - priority_label->security_result_num=1; - priority_label->result_type=result_type; - memcpy(priority_label->security_result, p_result, sizeof(struct Maat_rule_t)); } - int ret=project_req_add_struct((struct streaminfo *)a_stream, g_tsg_para.priority_project_id, (void *)priority_label); - if(ret<0) + int num=MIN(MAX_RESULT_NUM-priority_label->security_result_num, p_result_num); + for(int i=0; i<num; i++) { - free_policy_label(thread_seq, (void *)priority_label); - MESA_handle_runtime_log(g_tsg_para.logger, - RLOG_LV_FATAL, - "PROJECT_ADD", - "Add policy_priority_label failed, policy, domain: %s para(url/ua): %s policy_id: %d action: %d addr: %s", - (context->domain!=NULL ? context->domain : ""), - (context->para!=NULL ? context->http_url : ""), - priority_label->security_result[0].config_id, - (unsigned char)priority_label->security_result[0].action, - PRINTADDR(a_stream, g_tsg_para.level) - ); - return ; + int repeat_result=0; + for(int j=0; j<priority_label->security_result_num; j++) + { + if(p_result[i].config_id==priority_label->security_result[j].config_id) + { + repeat_result=1; + break; + } + } + + if(repeat_result==0) + { + memcpy(&(priority_label->security_result[priority_label->security_result_num++]), &(p_result[i]), sizeof(struct Maat_rule_t)); + } } - MESA_handle_runtime_log(g_tsg_para.logger, - RLOG_LV_DEBUG, - "COPY_RESULT", - "Hit policy, domain: %s para(url/ua): %s policy_id: %d action: %d addr: %s", - (context->domain!=NULL ? context->domain : ""), - (context->para!=NULL ? context->http_url : ""), - priority_label->security_result[0].config_id, - (unsigned char)priority_label->security_result[0].action, - PRINTADDR(a_stream, g_tsg_para.level) - ); - return ; } +int tsg_notify_hited_security_result(const struct streaminfo * a_stream, struct Maat_rule_t * p_result, int p_result_num, int thread_seq) +{ + set_security_result_to_project(a_stream, p_result, p_result_num, PULL_FW_RESULT, thread_seq); + return 0; +} + void set_session_attribute_label(const struct streaminfo *a_stream, enum TSG_ATTRIBUTE_TYPE type, void *value, int value_len, int thread_seq) { @@ -1525,15 +1268,6 @@ void set_session_attribute_label(const struct streaminfo *a_stream, enum TSG_ATT { dictator_free(thread_seq, (void *)attribute_label); attribute_label=NULL; - - MESA_handle_runtime_log(g_tsg_para.logger, - RLOG_LV_FATAL, - "PROJECT_ADD", - "Add internal_label failed, establish latency ms: %llu proto: %d addr: %s", - attribute_label->establish_latency_ms, - attribute_label->proto, - PRINTADDR(a_stream, g_tsg_para.level) - ); return ; } } @@ -1639,14 +1373,12 @@ static char set_tcp_establish_latency_ms(const struct streaminfo *a_tcp, int thr int tsg_set_device_id_to_telegraf(char *device_sn) { - char buff[128]={0}; - FILE *fp=NULL; - if(device_sn) { - fp=fopen("/etc/default/telegraf", "wb"); + FILE *fp=fopen("/etc/default/telegraf", "wb"); if(fp) { + char buff[128]={0}; snprintf(buff, sizeof(buff), "device_id=\"%s\"\n", device_sn); fwrite(buff, strlen(buff), 1, fp); fclose(fp); @@ -1735,11 +1467,6 @@ struct Maat_rule_t *tsg_policy_decision_criteria(Maat_rule_t *result, int result for(i=0; i<result_num; i++) { - if((unsigned char)result[i].action==TSG_ACTION_SHAPING) - { - continue; - } - if(p_result==NULL) { p_result=&result[i]; @@ -1766,7 +1493,7 @@ struct Maat_rule_t *tsg_policy_decision_criteria(Maat_rule_t *result, int result static int identify_application_protocol(const struct streaminfo *a_stream, struct master_context *context, void *a_packet) { - int ret=0, length=0; + int ret=0; switch(a_stream->type) { @@ -1779,7 +1506,7 @@ static int identify_application_protocol(const struct streaminfo *a_stream, stru { context->proto=PROTO_HTTP; - length=http_get_filed_result(parser_result, HTTP_HOST, &host); + int length=http_get_filed_result(parser_result, HTTP_HOST, &host); context->domain=malloc_copy_string(host, length, a_stream->threadnum); length=http_get_filed_result(parser_result, HTTP_MESSAGE_URL, &url); context->http_url=malloc_copy_string(url, length, a_stream->threadnum); @@ -1935,11 +1662,11 @@ static int identify_application_protocol(const struct streaminfo *a_stream, stru if (g_tsg_para.proto_flag&(1<<PROTO_DTLS)) //DTLS { - char sni_buff[512] = {0}; - int sni_len = 512; bool is_dtls = dtls_identifyStream((streaminfo *)a_stream); if (is_dtls) { + char sni_buff[512]={0}; + int sni_len=sizeof(sni_buff); context->proto = PROTO_DTLS; ret = dtls_parse_sni((const char *)a_stream->pudpdetail->pdata, a_stream->pudpdetail->datalen, sni_buff, sni_len); if (ret == 0 && strlen(sni_buff) > 0) @@ -1949,7 +1676,6 @@ static int identify_application_protocol(const struct streaminfo *a_stream, stru } } } - break; default: break; @@ -1975,7 +1701,7 @@ int scan_application_id_and_properties(const struct streaminfo *a_stream, struct for(i=0; i< identify_result->app_num; i++) { - snprintf(app_id_buff, sizeof(app_id_buff), "%d", identify_result->attributes[i].app_id); + snprintf(app_id_buff, sizeof(app_id_buff), "%u", identify_result->attributes[i].app_id); dict=(struct app_id_dict *)Maat_plugin_get_EX_data(g_tsg_maat_feather, g_tsg_para.table_id[TABLE_APP_ID_DICT], (const char *)app_id_buff); if(dict!=NULL) { @@ -2033,11 +1759,9 @@ int scan_application_id_and_properties(const struct streaminfo *a_stream, struct return hit_num; } -static int master_deal_shaping_result(const struct streaminfo *a_stream, struct Maat_rule_t *result, int hit_num) +static int master_deal_shaping_result(const struct streaminfo *a_stream, struct Maat_rule_t *shaping_result, int shaping_result_num) { //get shaping rule - struct Maat_rule_t shaping_result[hit_num]; - int shaping_result_num=get_shaping_result(result, hit_num, shaping_result, hit_num); set_shaping_result_to_project(a_stream, shaping_result, shaping_result_num, a_stream->threadnum); FS_operate(g_tsg_para.fs2_handle, g_tsg_para.fs2_field_id[TSG_FS2_SHAPING], 0, FS_OP_ADD, 1); @@ -2048,10 +1772,13 @@ static int master_deal_shaping_result(const struct streaminfo *a_stream, struct static unsigned char master_deal_scan_result(const struct streaminfo *a_stream, struct master_context *context, struct Maat_rule_t *result, int hit_num, const void *a_packet) { - Maat_rule_t *p_result=NULL; + struct Maat_rule_t *p_result=NULL; unsigned char state=APP_STATE_GIVEME; + struct Maat_rule_t shaping_result[MAX_RESULT_NUM]={0}; + struct Maat_rule_t security_result[MAX_RESULT_NUM]={0}; - p_result=tsg_policy_decision_criteria(result, hit_num); + int security_result_num=tsg_fetch_hited_security_result(result, hit_num, security_result, MAX_RESULT_NUM); + p_result=tsg_policy_decision_criteria(security_result, hit_num); if(p_result!=NULL) { print_hit_path(a_stream, context); @@ -2075,8 +1802,7 @@ static unsigned char master_deal_scan_result(const struct streaminfo *a_stream, if((state&APP_STATE_DROPPKT)==APP_STATE_DROPPKT || (state&APP_STATE_KILL_OTHER)) { - copy_deny_result(a_stream, context, p_result, a_stream->threadnum); - set_security_result_to_project(a_stream, context, p_result, 1, PULL_FW_RESULT, a_stream->threadnum); + set_security_result_to_project(a_stream, p_result, 1, PULL_FW_RESULT, a_stream->threadnum); MESA_handle_runtime_log(g_tsg_para.logger, RLOG_LV_DEBUG, "DENY", @@ -2086,19 +1812,20 @@ static unsigned char master_deal_scan_result(const struct streaminfo *a_stream, (unsigned char)p_result->action, PRINTADDR(a_stream, g_tsg_para.level) ); - } + } + set_security_result_to_project(a_stream, p_result, 1, PULL_FW_RESULT, a_stream->threadnum); break; case TSG_ACTION_MONITOR: if(context->proto==PROTO_RTP) { break; } - copy_monitor_result(a_stream, context, result, hit_num, a_stream->threadnum); tsg_notify_hited_monitor_result(a_stream, result, hit_num, a_stream->threadnum); + set_security_result_to_project(a_stream, security_result, security_result_num, PULL_FW_RESULT, a_stream->threadnum); break; case TSG_ACTION_BYPASS: - copy_bypass_result(a_stream, context, p_result, a_stream->threadnum); - set_security_result_to_project(a_stream, context, p_result, 1, PULL_FW_RESULT, a_stream->threadnum); + context->is_hited_allow=1; + set_security_result_to_project(a_stream, p_result, 1, PULL_FW_RESULT, a_stream->threadnum); FS_operate(g_tsg_para.fs2_handle, g_tsg_para.fs2_field_id[TSG_FS2_BYPASS], 0, FS_OP_ADD, 1); state=APP_STATE_GIVEME|APP_STATE_KILL_OTHER; @@ -2111,7 +1838,7 @@ static unsigned char master_deal_scan_result(const struct streaminfo *a_stream, break; } - set_security_result_to_project(a_stream, context, p_result, 1, PULL_KNI_RESULT, a_stream->threadnum); + set_security_result_to_project(a_stream, p_result, 1, PULL_KNI_RESULT, a_stream->threadnum); FS_operate(g_tsg_para.fs2_handle, g_tsg_para.fs2_field_id[TSG_FS2_INTERCEPT], 0, FS_OP_ADD, 1); state=APP_STATE_DROPME|APP_STATE_KILL_OTHER; @@ -2120,23 +1847,24 @@ static unsigned char master_deal_scan_result(const struct streaminfo *a_stream, default: break; } + + set_log_field_to_project(a_stream, context->domain, context->para, context->proto, a_stream->threadnum); } - if(state==APP_STATE_GIVEME) - { - master_deal_shaping_result(a_stream, result, hit_num); + int shaping_result_num=tsg_fetch_hited_shaping_result(result, hit_num, shaping_result, MAX_RESULT_NUM); + if(state==APP_STATE_GIVEME && shaping_result_num>0) + { + master_deal_shaping_result(a_stream, shaping_result, shaping_result_num); } return state; } -static int app_identify_result_cb(const struct streaminfo *a_stream, int bridge_id, void *data) +int app_identify_result_cb(const struct streaminfo *a_stream, int bridge_id, void *data) { - int hit_num=0,app_id=-1; - int is_parent_ssl=0; struct master_context *context=NULL; struct gather_app_result *gather_result=NULL; - struct Maat_rule_t scan_result[MAX_RESULT_NUM]={0}, *p_result=NULL; + struct Maat_rule_t scan_result[MAX_RESULT_NUM]={0}; struct app_identify_result *identify_result=(struct app_identify_result *)data; if(data==NULL) @@ -2144,19 +1872,19 @@ static int app_identify_result_cb(const struct streaminfo *a_stream, int bridge_ return 0; } - context=(struct master_context *)get_struct_project(a_stream, g_tsg_para.context_project_id); + context=(struct master_context *)tsg_get_xxx_from_bridge(a_stream, g_tsg_para.bridge[BRIDGE_TYPE_DATA_CONTEXT].id); if(context==NULL) { init_context((void **)(&context), a_stream->threadnum); - set_struct_project(a_stream, g_tsg_para.context_project_id, (void *)context); + tsg_set_xxx_to_bridge(a_stream, g_tsg_para.bridge[BRIDGE_TYPE_DATA_CONTEXT].id, (void *)context); } - gather_result=(struct gather_app_result *)get_struct_project(a_stream, g_tsg_para.gather_app_project_id); + gather_result=(struct gather_app_result *)tsg_get_xxx_from_bridge(a_stream, g_tsg_para.bridge[BRIDGE_TYPE_GATHER_APP_RESULT].id); if(gather_result==NULL) { gather_result=(struct gather_app_result *)dictator_malloc(a_stream->threadnum, sizeof(struct gather_app_result)*ORIGIN_MAX); memset(gather_result, 0, sizeof(struct gather_app_result)*ORIGIN_MAX); - set_struct_project(a_stream, g_tsg_para.gather_app_project_id, (void *)gather_result); + tsg_set_xxx_to_bridge(a_stream, g_tsg_para.bridge[BRIDGE_TYPE_GATHER_APP_RESULT].id, (void *)gather_result); } switch(identify_result->origin) @@ -2180,17 +1908,6 @@ static int app_identify_result_cb(const struct streaminfo *a_stream, int bridge_ { set_l7_protocol_to_pme(context, identify_result->app_id[identify_result->app_id_num-1]); } - - app_id=identify_result->app_id[identify_result->app_id_num-1]; - if(app_id==(int)tsg_l7_protocol_name2id("SMTPS") || - app_id==(int)tsg_l7_protocol_name2id("IMAPS") || - app_id==(int)tsg_l7_protocol_name2id("POP3S") || - app_id==(int)tsg_l7_protocol_name2id("FTPS") || - app_id==(int)tsg_l7_protocol_name2id("HTTPS") - ) - { - is_parent_ssl=1; - } break; case ORIGIN_UNKNOWN: context->is_app_link=FLAG_TRUE; @@ -2208,18 +1925,13 @@ static int app_identify_result_cb(const struct streaminfo *a_stream, int bridge_ } context->last_scan_time=get_current_time_ms(); - hit_num=scan_application_id_and_properties((struct streaminfo *)a_stream, scan_result, MAX_RESULT_NUM, context, &(gather_result[identify_result->origin]), a_stream->threadnum); - p_result=tsg_policy_decision_criteria(scan_result, hit_num); - if(p_result==NULL || (p_result->action==TSG_ACTION_MONITOR && is_parent_ssl==1) || is_alone_business(context->proto, context->hited_para.hited_app_id)) - { - return 0; - } + int hit_num=scan_application_id_and_properties((struct streaminfo *)a_stream, scan_result, MAX_RESULT_NUM, context, &(gather_result[identify_result->origin]), a_stream->threadnum); context->sync_cb_state=master_deal_scan_result(a_stream, context, scan_result, hit_num, NULL); return 0; } -static int session_flags_identify_result_cb(const struct streaminfo *a_stream, int bridge_id, void *data) +int session_flags_identify_result_cb(const struct streaminfo *a_stream, int bridge_id, void *data) { if(data==NULL) { @@ -2229,11 +1941,11 @@ static int session_flags_identify_result_cb(const struct streaminfo *a_stream, i struct master_context *context=NULL; struct Maat_rule_t scan_result[MAX_RESULT_NUM]={0}; - context=(struct master_context *)get_struct_project(a_stream, g_tsg_para.context_project_id); + context=(struct master_context *)tsg_get_xxx_from_bridge(a_stream, g_tsg_para.bridge[BRIDGE_TYPE_DATA_CONTEXT].id); if(context==NULL) { init_context((void **)(&context), a_stream->threadnum); - set_struct_project(a_stream, g_tsg_para.context_project_id, (void *)context); + tsg_set_xxx_to_bridge(a_stream, g_tsg_para.bridge[BRIDGE_TYPE_DATA_CONTEXT].id, (void *)context); } context->session_flag=*(unsigned long *)(data); @@ -2249,12 +1961,9 @@ static int session_flags_identify_result_cb(const struct streaminfo *a_stream, i static int deal_pending_state(const struct streaminfo *a_stream, struct master_context *context, struct Maat_rule_t *result, int result_num, void *a_packet) { - int i=0,table_id=0; - int ret=0,hit_num=0; - unsigned int protocol_id=0; - struct gather_app_result *gather_result=NULL; + int hit_num=0; - ret=identify_application_protocol(a_stream, context, a_packet); + int ret=identify_application_protocol(a_stream, context, a_packet); if(ret==1) { set_l7_protocol_label(a_stream, context->proto); @@ -2265,12 +1974,12 @@ static int deal_pending_state(const struct streaminfo *a_stream, struct master_c set_session_attribute_label(a_stream, TSG_ATTRIBUTE_TYPE_JA3_HASH, NULL, 0, a_stream->threadnum); } - table_id=get_table_id(context->proto); + int table_id=get_table_id(context->proto); hit_num+=tsg_scan_shared_policy(g_tsg_maat_feather, a_stream, context->domain, result+hit_num, MAX_RESULT_NUM-hit_num, &context->mid, table_id, a_stream->threadnum); hit_num+=scan_fqdn_category_id(g_tsg_maat_feather, a_stream, context->domain, result+hit_num, MAX_RESULT_NUM-hit_num, &context->mid, table_id, a_stream->threadnum); if(context->is_esni) { - protocol_id=tsg_l7_protocol_name2id("ESNI"); + unsigned int protocol_id=tsg_l7_protocol_name2id("ESNI"); hit_num+=tsg_scan_app_id_policy(g_tsg_maat_feather, a_stream, result+hit_num, MAX_RESULT_NUM-hit_num, &context->mid, (char *)"ESNI", protocol_id, a_stream->threadnum); } @@ -2287,8 +1996,8 @@ static int deal_pending_state(const struct streaminfo *a_stream, struct master_c FS_operate(g_tsg_para.fs2_handle, g_tsg_para.fs2_field_id[TSG_FS2_HIT_ADDR], 0, FS_OP_ADD, 1); } - gather_result=(struct gather_app_result *)get_struct_project(a_stream, g_tsg_para.gather_app_project_id); - for(i=0; i<ORIGIN_MAX && gather_result!=NULL; i++) + struct gather_app_result *gather_result=(struct gather_app_result *)tsg_get_xxx_from_bridge(a_stream, g_tsg_para.bridge[BRIDGE_TYPE_GATHER_APP_RESULT].id); + for(int i=0; i<ORIGIN_MAX && gather_result!=NULL; i++) { if(i==ORIGIN_HITED_APP || i==ORIGIN_QM_ENGINE_L7) { @@ -2296,40 +2005,27 @@ static int deal_pending_state(const struct streaminfo *a_stream, struct master_c } hit_num+=scan_application_id_and_properties(a_stream, result+hit_num, MAX_RESULT_NUM-hit_num, context, &(gather_result[i]), a_stream->threadnum); } - - - if((is_only_monitor(result, hit_num)) && - context->proto!=PROTO_UNKONWN && - context->proto!=PROTO_APP && - context->proto!=PROTO_SSH && - context->proto!=PROTO_STRATUM && - context->proto!=PROTO_RDP) // business deal action of monitor - { - hit_num=0; - } return hit_num; } - static unsigned char tsg_master_data_entry(const struct streaminfo *a_stream, void **pme, int thread_seq,void *a_packet) { - int i=0, ret=0, hit_num=0; + int i=0,ret=0,hit_num=0; unsigned char state=APP_STATE_GIVEME; - Maat_rule_t scan_result[MAX_RESULT_NUM]; - Maat_rule_t *p_result=NULL; + Maat_rule_t hited_result[MAX_RESULT_NUM]; struct gather_app_result *gather_result=NULL; struct master_context *context=(struct master_context *)*pme; struct app_identify_result unknown_result; if(*pme==NULL) { - context=(struct master_context *)get_struct_project(a_stream, g_tsg_para.context_project_id); + context=(struct master_context *)tsg_get_xxx_from_bridge(a_stream, g_tsg_para.bridge[BRIDGE_TYPE_DATA_CONTEXT].id); if(context==NULL) { init_context(pme, thread_seq); context=(struct master_context *)*pme; - set_struct_project(a_stream, g_tsg_para.context_project_id, *pme); + tsg_set_xxx_to_bridge(a_stream, g_tsg_para.bridge[BRIDGE_TYPE_DATA_CONTEXT].id, *pme); } else { @@ -2350,8 +2046,8 @@ static unsigned char tsg_master_data_entry(const struct streaminfo *a_stream, vo FS_operate(g_tsg_para.fs2_handle, g_tsg_para.fs2_field_id[TSG_FS2_UDP_LINKS], 0, FS_OP_ADD, 1); } - hit_num+=deal_pending_state(a_stream, context, scan_result+hit_num, MAX_RESULT_NUM-hit_num, a_packet); - state=master_deal_scan_result(a_stream, context, scan_result, hit_num, a_packet); + hit_num+=deal_pending_state(a_stream, context, hited_result+hit_num, MAX_RESULT_NUM-hit_num, a_packet); + state=master_deal_scan_result(a_stream, context, hited_result, hit_num, a_packet); context->deal_pkt_num++; break; case OP_STATE_DATA: @@ -2362,10 +2058,10 @@ static unsigned char tsg_master_data_entry(const struct streaminfo *a_stream, vo unknown_result.origin=ORIGIN_UNKNOWN; unknown_result.app_id[0]=g_tsg_para.unknown_app_id; - app_identify_result_cb(a_stream, g_tsg_para.bridge_id[BRIDGE_TYPE_APP_IDENTIFY_RESULT], (void *)&unknown_result); + app_identify_result_cb(a_stream, g_tsg_para.bridge[BRIDGE_TYPE_APP_IDENTIFY_RESULT].id, (void *)&unknown_result); } - if(is_hited_allow(context->result, context->hit_cnt)) + if(context->is_hited_allow) { state=APP_STATE_KILL_OTHER|APP_STATE_GIVEME; break; @@ -2390,27 +2086,27 @@ static unsigned char tsg_master_data_entry(const struct streaminfo *a_stream, vo } context->last_scan_time=get_current_time_ms(); - ret=tsg_scan_nesting_addr(g_tsg_maat_feather, a_stream, context->proto, &context->mid, scan_result+hit_num, MAX_RESULT_NUM-hit_num); + ret=tsg_scan_nesting_addr(g_tsg_maat_feather, a_stream, context->proto, &context->mid, hited_result+hit_num, MAX_RESULT_NUM-hit_num); if(ret>0) { hit_num+=ret; } - gather_result=(struct gather_app_result *)get_struct_project(a_stream, g_tsg_para.gather_app_project_id); + gather_result=(struct gather_app_result *)tsg_get_xxx_from_bridge(a_stream, g_tsg_para.bridge[BRIDGE_TYPE_GATHER_APP_RESULT].id); for(i=0; i<ORIGIN_MAX && gather_result!=NULL; i++) { if(i==ORIGIN_HITED_APP || i==ORIGIN_QM_ENGINE_L7) { continue; } - hit_num+=scan_application_id_and_properties(a_stream, scan_result+hit_num, MAX_RESULT_NUM-hit_num, context, &(gather_result[i]), thread_seq); + hit_num+=scan_application_id_and_properties(a_stream, hited_result+hit_num, MAX_RESULT_NUM-hit_num, context, &(gather_result[i]), thread_seq); } if(context->session_flag>0) { hit_num+=tsg_scan_session_flags(g_tsg_maat_feather, a_stream, - scan_result+hit_num, + hited_result+hit_num, MAX_RESULT_NUM-hit_num, &context->mid, g_tsg_para.table_id[TABLE_SESSION_FLAGS], @@ -2419,11 +2115,7 @@ static unsigned char tsg_master_data_entry(const struct streaminfo *a_stream, vo ); } - p_result=tsg_policy_decision_criteria(scan_result, hit_num); - if(p_result!=NULL && p_result->action!=TSG_ACTION_MONITOR) - { - state=master_deal_scan_result(a_stream, context, scan_result, hit_num, a_packet); - } + state=master_deal_scan_result(a_stream, context, hited_result, hit_num, a_packet); break; default: break; @@ -2431,11 +2123,6 @@ static unsigned char tsg_master_data_entry(const struct streaminfo *a_stream, vo if((a_stream->opstate==OP_STATE_CLOSE) || (state&APP_STATE_DROPME)==APP_STATE_DROPME) { - if(context!=NULL && context->is_log==0 && context->hit_cnt>0 && context->result!=NULL) - { - context->is_log = 1; - master_send_log(a_stream, context->result, context->hit_cnt, context, thread_seq); - } *pme = NULL; } @@ -2444,13 +2131,15 @@ static unsigned char tsg_master_data_entry(const struct streaminfo *a_stream, vo static unsigned char tsg_master_all_entry(const struct streaminfo *a_stream, unsigned char stream_state, void **pme, int thread_seq, const void *a_packet) { - int ret=0,hit_num=0; + int ret=0; int eth_rawpkt_len=0; scan_status_t scan_mid=NULL; - struct Maat_rule_t *p_result=NULL; - unsigned char state=APP_STATE_GIVEME; - struct identify_info tmp_identify_info; + struct Maat_rule_t *p_result=NULL; + unsigned char state=APP_STATE_GIVEME; + struct identify_info tmp_identify_info; + struct Maat_rule_t hited_result[MAX_TSG_ALL_RESULT_NUM]={0}; struct Maat_rule_t security_result[MAX_RESULT_NUM]={0}; + struct Maat_rule_t shaping_result[MAX_RESULT_NUM]={0}; struct tcpall_context *all_context=(struct tcpall_context *)(*pme); if(stream_state==OP_STATE_PENDING && all_context->method_type!=TSG_METHOD_TYPE_ALLOW && !(all_context->udp_data_dropme)) @@ -2461,29 +2150,32 @@ static unsigned char tsg_master_all_entry(const struct streaminfo *a_stream, uns all_context->default_policy_after_n_packets=get_default_para(a_stream, g_tsg_para.default_compile_id); } - hit_num=tsg_scan_nesting_addr(g_tsg_maat_feather, a_stream, PROTO_UNKONWN, &scan_mid, security_result, MAX_RESULT_NUM); + int hit_num=tsg_scan_nesting_addr(g_tsg_maat_feather, a_stream, PROTO_UNKONWN, &scan_mid, hited_result, MAX_TSG_ALL_RESULT_NUM); if(hit_num>0) { - p_result=tsg_policy_decision_criteria(security_result, hit_num); + int security_result_num=tsg_fetch_hited_security_result(hited_result, hit_num, security_result, MAX_RESULT_NUM); + p_result=tsg_policy_decision_criteria(security_result, security_result_num); if(p_result!=NULL) { switch(p_result->action) { case TSG_ACTION_DENY: state=tsg_deal_deny_action(a_stream, p_result, PROTO_UNKONWN, ACTION_RETURN_TYPE_TCPALL, a_packet); - master_send_log(a_stream, p_result, 1, NULL, thread_seq); + set_security_result_to_project(a_stream, p_result, 1, PULL_FW_RESULT,thread_seq); break; case TSG_ACTION_MONITOR: tsg_notify_hited_monitor_result(a_stream, security_result, hit_num, thread_seq); + set_security_result_to_project(a_stream, security_result, security_result_num, PULL_FW_RESULT,thread_seq); break; default: break; } } - if(state==APP_STATE_GIVEME) + int shaping_result_num=tsg_fetch_hited_security_result(hited_result, hit_num, shaping_result, MAX_RESULT_NUM); + if(state==APP_STATE_GIVEME && shaping_result_num>0) { - master_deal_shaping_result(a_stream, security_result, hit_num); + master_deal_shaping_result(a_stream, shaping_result, shaping_result_num); } } @@ -2521,7 +2213,6 @@ static unsigned char tsg_master_all_entry(const struct streaminfo *a_stream, uns if(get_default_policy(g_tsg_para.default_compile_id, &security_result[0])) { state=tsg_deal_deny_action(a_stream, &security_result[0], PROTO_UNKONWN, ACTION_RETURN_TYPE_TCPALL, a_packet); - master_send_log(a_stream, &security_result[0], 1, NULL, thread_seq); } break; case TSG_METHOD_TYPE_DROP: @@ -2584,7 +2275,7 @@ extern "C" unsigned char TSG_MASTER_UDP_ENTRY(const struct streaminfo *a_udp, vo context->all_entry=(struct tcpall_context *)dictator_malloc(thread_seq, sizeof(struct tcpall_context)); memset(context->all_entry, 0, sizeof(struct tcpall_context)); - set_struct_project(a_udp, g_tsg_para.tcpall_project_id, (void *)(context->all_entry)); + tsg_set_xxx_to_bridge(a_udp, g_tsg_para.bridge[BRIDGE_TYPE_ALL_CONTEXT].id, (void *)(context->all_entry)); context->all_entry->direction=get_direction(a_udp); } @@ -2620,12 +2311,12 @@ extern "C" unsigned char TSG_MASTER_TCPALL_ENTRY(const struct streaminfo *a_tcp, if(*pme==NULL) { - *pme=(void *)get_struct_project(a_tcp, g_tsg_para.tcpall_project_id); + *pme=(void *)tsg_get_xxx_from_bridge(a_tcp, g_tsg_para.bridge[BRIDGE_TYPE_ALL_CONTEXT].id); if(*pme==NULL) { *pme=(struct tcpall_context *)dictator_malloc(thread_seq, sizeof(struct tcpall_context)); memset(*pme, 0, sizeof(struct tcpall_context)); - set_struct_project(a_tcp, g_tsg_para.tcpall_project_id, (void *)(*pme)); + tsg_set_xxx_to_bridge(a_tcp, g_tsg_para.bridge[BRIDGE_TYPE_ALL_CONTEXT].id, (void *)(*pme)); } _context=(struct tcpall_context *)(*pme); @@ -2642,22 +2333,15 @@ extern "C" unsigned char TSG_MASTER_TCPALL_ENTRY(const struct streaminfo *a_tcp, extern "C" int TSG_MASTER_INIT() { - int i=0,ret=0; - char buff[128]={0}; - int value=0,cycle=0; - int output_prometheus=0; - unsigned short fs_server_port=0; - char app_name[MAX_STRING_LEN]={0}; - char label_buff[MAX_STRING_LEN*4]={0}; - char fs_server_ip[MAX_IPV4_LEN]={0}; - char fs_output_path[MAX_STRING_LEN*4]={0}; - char device_sn_filename[MAX_STRING_LEN]={0}; - char identify_proto_name[MAX_STRING_LEN*4]={0}; + int ret=0; + char label_buff[128]={0}; + char device_sn_filename[128]={0}; + char identify_proto_name[256]={0}; memset(&g_tsg_para, 0, sizeof(g_tsg_para)); MESA_load_profile_int_def(tsg_conffile, "SYSTEM","LOG_LEVEL", &g_tsg_para.level, RLOG_LV_FATAL); - MESA_load_profile_string_def(tsg_conffile, "SYSTEM","LOG_PATH", g_tsg_para.log_path, sizeof(g_tsg_para.log_path), "tsglog/tsg_master"); + MESA_load_profile_string_def(tsg_conffile, "SYSTEM","LOG_PATH", g_tsg_para.log_path, sizeof(g_tsg_para.log_path), "log/tsg_master"); g_tsg_para.logger=MESA_create_runtime_log_handle(g_tsg_para.log_path, g_tsg_para.level); if(g_tsg_para.logger==NULL) @@ -2673,7 +2357,7 @@ extern "C" int TSG_MASTER_INIT() MESA_load_profile_int_def(tsg_conffile, "RESET", "SEED1", &g_tsg_para.reset.seed1, 65535); MESA_load_profile_int_def(tsg_conffile, "RESET", "SEED2", &g_tsg_para.reset.seed2, 13); MESA_load_profile_int_def(tsg_conffile, "RESET", "FLAGS", &g_tsg_para.reset.th_flags, 0x14); - MESA_load_profile_int_def(tsg_conffile, "RESET", "DIR", &g_tsg_para.reset.dir, DIR_DOUBLE); + MESA_load_profile_int_def(tsg_conffile, "RESET", "DIR", &g_tsg_para.reset.dir, DIR_DOUBLE); MESA_load_profile_int_def(tsg_conffile, "RESET", "REMEDY", &g_tsg_para.reset.remedy, 1); MESA_load_profile_int_def(tsg_conffile, "SYSTEM","DEFAULT_POLICY_ID", &g_tsg_para.default_compile_id, 0); @@ -2716,14 +2400,6 @@ extern "C" int TSG_MASTER_INIT() { MESA_handle_runtime_log(g_tsg_para.logger, RLOG_LV_FATAL, "SET_DEVICE_SN_TO_TELEGRAF", "Set device SN(%s) failed; please check :%s", g_tsg_para.device_sn, "/etc/default/telegraf"); } - - MESA_load_profile_string_def(tsg_conffile, "SYSTEM", "POLICY_PRIORITY_LABEL", label_buff, sizeof(label_buff), "POLICY_PRIORITY"); - g_tsg_para.priority_project_id=project_producer_register(label_buff, PROJECT_VAL_TYPE_STRUCT, free_policy_label); - if(g_tsg_para.priority_project_id<0) - { - MESA_handle_runtime_log(g_tsg_para.logger, RLOG_LV_FATAL, "PROJECT_REGISTER", "Register %s failed.", label_buff); - return -1; - } MESA_load_profile_string_def(tsg_conffile, "SYSTEM", "TSG_MASTER_INTERNAL_LABEL", label_buff, sizeof(label_buff), "TSG_MASTER_INTERNAL_LABEL"); g_tsg_para.session_attribute_project_id=project_producer_register(label_buff, PROJECT_VAL_TYPE_STRUCT, free_session_attribute_label); @@ -2732,129 +2408,14 @@ extern "C" int TSG_MASTER_INIT() MESA_handle_runtime_log(g_tsg_para.logger, RLOG_LV_FATAL, "PROJECT_REGISTER", "Register %s failed.", label_buff); } - MESA_load_profile_string_def(tsg_conffile, "SYSTEM", "APP_IDENTIFY_RESULT_BRIDGE", g_tsg_para.bridge_name[BRIDGE_TYPE_APP_IDENTIFY_RESULT],_MAX_TABLE_NAME_LEN, "APP_IDENTIFY_RESULT_BRIDGE"); - MESA_load_profile_string_def(tsg_conffile, "SYSTEM", "SKETCH_NOTIFY_BRIDGE_NAME", g_tsg_para.bridge_name[BRIDGE_TYPE_RECV_CONN_SKETCH_DATA],_MAX_TABLE_NAME_LEN, "TSG_CONN_SKETCH_NOTIFY_DATA"); - MESA_load_profile_string_def(tsg_conffile, "SYSTEM", "MASTER_NOTIFY_BRIDGE_NAME", g_tsg_para.bridge_name[BRIDGE_TYPE_SEND_CONN_SKETCH_DATA],_MAX_TABLE_NAME_LEN, "TSG_MASTER_NOTIFY_DATA"); - MESA_load_profile_string_def(tsg_conffile, "SESSION_FLAGS", "FLAGS_NOTIFY_BRIDGE_NAME", g_tsg_para.bridge_name[BRIDGE_TYPE_NOTIFY_FLAGS],_MAX_TABLE_NAME_LEN, "SESSION_FLAGS_SYNC_NOTIFY_DATA"); - MESA_load_profile_string_def(tsg_conffile, "SYSTEM", "SHAPING_RESULT_BRIDGE_NAME", g_tsg_para.bridge_name[BRIDGE_TYPE_NOTIFY_SHAPING_RESULT],_MAX_TABLE_NAME_LEN, "NOTIFY_SHAPING_RESULT"); - - for(i=0; i<BRIDGE_TYPE_MAX; i++) - { - g_tsg_para.bridge_id[i]=stream_bridge_build(g_tsg_para.bridge_name[i], "w"); - if(g_tsg_para.bridge_id[i]<0) - { - MESA_handle_runtime_log(g_tsg_para.logger, RLOG_LV_FATAL, "INIT_BRIDGE", "stream_bridge_build is error, bridge_name: %s", g_tsg_para.bridge_name[i]); - } - } - - ret=stream_bridge_register_data_sync_cb(g_tsg_para.bridge_id[BRIDGE_TYPE_APP_IDENTIFY_RESULT], app_identify_result_cb); + ret=tsg_init_bridge(tsg_conffile); if(ret<0) - { - MESA_handle_runtime_log(g_tsg_para.logger, - RLOG_LV_FATAL, - "APP_BRIDGE", - "Register callback failed, bridge_name: %d", - g_tsg_para.bridge_name[BRIDGE_TYPE_APP_IDENTIFY_RESULT] - ); - return -1; - } - - ret=stream_bridge_register_data_sync_cb(g_tsg_para.bridge_id[BRIDGE_TYPE_NOTIFY_FLAGS], session_flags_identify_result_cb); - if(ret<0) - { - MESA_handle_runtime_log(g_tsg_para.logger, - RLOG_LV_FATAL, - "APP_BRIDGE", - "Register callback failed, bridge_name: %d", - g_tsg_para.bridge_name[BRIDGE_TYPE_NOTIFY_FLAGS] - ); - return -1; - } - - ret=stream_bridge_register_data_free_cb(g_tsg_para.bridge_id[BRIDGE_TYPE_NOTIFY_SHAPING_RESULT], free_shaping_result); - if(ret<0) - { - MESA_handle_runtime_log(g_tsg_para.logger, - RLOG_LV_FATAL, - "APP_BRIDGE", - "Register async free callback failed, bridge_name: %d", - g_tsg_para.bridge_name[BRIDGE_TYPE_NOTIFY_SHAPING_RESULT] - ); - return -1; - } - - g_tsg_para.context_project_id=project_producer_register("TSG_MASTER_CONTEXT", PROJECT_VAL_TYPE_STRUCT, free_context_label); - if(g_tsg_para.context_project_id<0) - { - MESA_handle_runtime_log(g_tsg_para.logger, RLOG_LV_FATAL, "CONTEXT_LABEL", "project_producer_register is error, context label: %s","TSG_MASTER_CONTEXT"); - return -1; - } - - g_tsg_para.tcpall_project_id=project_producer_register("TSG_TCPALL_CONTEXT", PROJECT_VAL_TYPE_STRUCT, free_tcpall_label); - if(g_tsg_para.tcpall_project_id<0) - { - MESA_handle_runtime_log(g_tsg_para.logger, RLOG_LV_FATAL, "CONTEXT_LABEL", "project_producer_register is error, context label: %s","TSG_TCPALL_CONTEXT"); - return -1; - } - - g_tsg_para.gather_app_project_id=project_producer_register("APP_IDENTIFY_RESULT", PROJECT_VAL_TYPE_STRUCT, free_gather_app_result); - if(g_tsg_para.gather_app_project_id<0) { - MESA_handle_runtime_log(g_tsg_para.logger, RLOG_LV_FATAL, "APP_IDENTIFY_RESULT", "project_producer_register is error, context label: %s","APP_IDENTIFY_RESULT"); return -1; } - char page_path[256]; - memset(page_path, 0, sizeof(page_path)); - MESA_load_profile_string_def(tsg_conffile, "HTTP_PLUG", "PAGE403", page_path, sizeof(page_path), "./tsgconf/HTTP403.html"); - g_tsg_para.tpl_403 = ctemplate::Template::GetTemplate(page_path, ctemplate::DO_NOT_STRIP); - - memset(page_path, 0, sizeof(page_path)); - MESA_load_profile_string_def(tsg_conffile, "HTTP_PLUG", "PAGE404", page_path, sizeof(page_path), "./tsgconf/HTTP404.html"); - g_tsg_para.tpl_404 = ctemplate::Template::GetTemplate(page_path, ctemplate::DO_NOT_STRIP); - - memset(page_path, 0, sizeof(page_path)); - MESA_load_profile_string_def(tsg_conffile, "HTTP_PLUG", "PAGE200", page_path, sizeof(page_path), "./tsgconf/HTTP200.html"); - g_tsg_para.tpl_200 = ctemplate::Template::GetTemplate(page_path, ctemplate::DO_NOT_STRIP); - - memset(page_path, 0, sizeof(page_path)); - MESA_load_profile_string_def(tsg_conffile, "HTTP_PLUG", "PAGE204", page_path, sizeof(page_path), "./tsgconf/HTTP204.html"); - g_tsg_para.tpl_204 = ctemplate::Template::GetTemplate(page_path, ctemplate::DO_NOT_STRIP); - - MESA_load_profile_int_def(tsg_conffile, "FIELD_STAT", "CYCLE", &cycle, 30); - MESA_load_profile_short_nodef(tsg_conffile, "FIELD_STAT","TELEGRAF_PORT", (short *)&(fs_server_port)); - MESA_load_profile_string_nodef(tsg_conffile,"FIELD_STAT","TELEGRAF_IP",fs_server_ip, sizeof(fs_server_ip)); - MESA_load_profile_string_def(tsg_conffile,"FIELD_STAT","OUTPUT_PATH",fs_output_path, sizeof(fs_output_path), "tsg_stat.log"); - MESA_load_profile_string_def(tsg_conffile,"FIELD_STAT","APP_NAME", app_name, sizeof(app_name), "tsg_master"); - MESA_load_profile_int_def(tsg_conffile, "FIELD_STAT", "PROMETHEUS", &output_prometheus, 1); - - g_tsg_para.fs2_handle=FS_create_handle(); - - value=1;//Rewrite - FS_set_para(g_tsg_para.fs2_handle, PRINT_MODE, &value, sizeof(value)); - value=1;//Do not create stat thread - FS_set_para(g_tsg_para.fs2_handle, CREATE_THREAD, &value, sizeof(value)); - - FS_set_para(g_tsg_para.fs2_handle, STAT_CYCLE, &cycle, sizeof(cycle)); - FS_set_para(g_tsg_para.fs2_handle, APP_NAME, app_name, strlen(app_name)+1); - FS_set_para(g_tsg_para.fs2_handle, OUTPUT_DEVICE, fs_output_path, strlen(fs_output_path)+1); - - value=1; - FS_set_para(g_tsg_para.fs2_handle, OUTPUT_PROMETHEUS, &output_prometheus, sizeof(output_prometheus)); - - if(fs_server_port > 0 && strlen(fs_server_ip) > 0) - { - FS_set_para(g_tsg_para.fs2_handle, STATS_SERVER_IP,fs_server_ip, strlen(fs_server_ip)+1); - FS_set_para(g_tsg_para.fs2_handle, STATS_SERVER_PORT,&(fs_server_port), sizeof(fs_server_port)); - } - - value=FS_OUTPUT_INFLUX_LINE; - FS_set_para(g_tsg_para.fs2_handle, STATS_FORMAT, &value, sizeof(value)); - - for(i=0; i<TSG_FS2_MAX; i++) - { - g_tsg_para.fs2_field_id[i]=FS_register(g_tsg_para.fs2_handle, FS_STYLE_FIELD, FS_CALC_SPEED, g_tsg_fs2_field[i].name); - } + init_page_template(tsg_conffile); + init_fs2_handle(tsg_conffile); ret=tsg_rule_init(tsg_conffile, g_tsg_para.logger); if(ret<0) @@ -2870,9 +2431,9 @@ extern "C" int TSG_MASTER_INIT() return -1; } g_tsg_log_instance->session_attribute_project_id=g_tsg_para.session_attribute_project_id; - - FS_start(g_tsg_para.fs2_handle); + FS_start(g_tsg_para.fs2_handle); + ret=tsg_statistic_init(tsg_conffile, g_tsg_para.logger); if(ret<0) { @@ -2880,8 +2441,7 @@ extern "C" int TSG_MASTER_INIT() return -1; } - MESA_load_profile_string_def(tsg_conffile, "SYSTEM", "L7_PROTOCOL_FILE", buff, sizeof(buff), "./tsgconf/tsg_l7_protocol.conf"); - l7_protocol_mapper(buff); + l7_protocol_mapper(tsg_conffile); ret=tsg_gtp_signaling_hash_init(tsg_conffile, g_tsg_para.logger); if(ret<0) diff --git a/src/tsg_entry.h b/src/tsg_entry.h index c1fd5a2..0418031 100644 --- a/src/tsg_entry.h +++ b/src/tsg_entry.h @@ -9,12 +9,13 @@ #include <MESA/Maat_rule.h>
#include <MESA/field_stat2.h>
-#include <ctemplate/template.h>
#include "uthash.h"
#include "tsg_rule.h"
#include "app_label.h"
#include "tsg_label.h"
+#include "tsg_bridge.h"
+#include "tsg_variable.h"
#include "tsg_statistic.h"
#include "tsg_leaky_bucket.h"
#include "tsg_protocol_common.h"
@@ -33,14 +34,6 @@ typedef int atomic_t; #include <alsa/iatomic.h>
#endif
-#ifndef MIN
-#define MIN(a, b) (((a) < (b)) ? (a) : (b))
-#endif
-
-#ifndef PRINTADDR
-#define PRINTADDR(a, b) ((b)<RLOG_LV_FATAL ? printaddr(&(a->addr), a->threadnum) : "")
-#endif
-
#ifndef FLAG_FALSE
#define FLAG_FALSE 0
#endif
@@ -52,112 +45,6 @@ typedef int atomic_t; #define APP_SCAN_FLAG_STOP 0
#define APP_SCAN_FLAG_CONTINUE 1
-enum DEPLOY_MODE
-{
- DEPLOY_MODE_MIRROR,
- DEPLOY_MODE_INLINE,
- DEPLOY_MODE_TRANSPARENT,
- DEPLOY_MODE_MAX
-};
-
-enum MASTER_STATIC_TABLE{
- TABLE_SECURITY_COMPILE=0,
- TABLE_IP_ADDR,
- TABLE_SUBSCRIBER_ID,
- TABLE_APP_ID,
- TABLE_HTTP_HOST,
- TABLE_SSL_SNI,
- TABLE_EXCLUSION_SSL_SNI,
- TABLE_SRC_ASN,
- TABLE_DST_ASN,
- TABLE_SRC_LOCATION,
- TABLE_DST_LOCATION,
- TABLE_ASN_USER_DEFINED,
- TABLE_ASN_BUILT_IN,
- TABLE_LOCATION_USER_DEFINED,
- TABLE_LOCATION_BUILT_IN,
- TABLE_QUIC_SNI,
- TABLE_FQDN_CAT_ID,
- TABLE_FQDN_CAT_USER_DEFINED,
- TABLE_FQDN_CAT_BUILT_IN,
- TABLE_APP_ID_DICT,
- TABLE_SELECTOR_ID,
- TABLE_SELECTOR_PROPERTIES,
- TABLE_GTP_APN,
- TABLE_GTP_IMSI,
- TABLE_GTP_PHONE_NUMBER,
- TABLE_RESPONSE_PAGES,
- TABLE_DNS_PROFILE_RECORD,
- TABLE_PROFILE_MIRROR,
- TABLE_HTTP_URL,
- TABLE_DTLS_SNI,
- TABLE_TUNNEL_ID,
- TABLE_TUNNEL_CATALOG,
- TABLE_TUNNEL_ENDPOINT,
- TABLE_TUNNEL_LABEL,
- TABLE_SESSION_FLAGS,
- TABLE_MAX
-};
-
-enum MASTER_DYNAMIC_TABLE{
- DYN_TABLE_SUBSCRIBER_IP=0,
- DYN_TABLE_GTP_SIGNALING,
- DYN_TABLE_MAX
-};
-
-enum TSG_FS2_TYPE{
- TSG_FS2_TCP_LINKS=0,
- TSG_FS2_UDP_LINKS,
- TSG_FS2_BYPASS,
- TSG_FS2_HIT_ADDR,
- TSG_FS2_HIT_SHARE,
- TSG_FS2_INTERCEPT,
- TSG_FS2_SHAPING,
- TSG_FS2_EXCLUSION,
- TSG_FS2_APP_DPKT_RESULT,
- TSG_FS2_APP_Q_RESULT,
- TSG_FS2_APP_USER_RESULT,
- TSG_FS2_APP_BUILT_IN_RESULT,
- TSG_FS2_INJECT_PKT_SUCCESS,
- TSG_FS2_INJECT_PKT_FAILED,
- TSG_FS2_MIRRORED_PKT_SUCCESS,
- TSG_FS2_MIRRORED_BYTE_SUCCESS,
- TSG_FS2_MIRRORED_PKT_FAILED,
- TSG_FS2_MIRRORED_BYTE_FAILED,
- TSG_FS2_SET_TIMOUT_SUCCESS,
- TSG_FS2_SET_TIMOUT_FAILED,
- TSG_FS2_SUCESS_TAMPER,
- TSG_FS2_TAMPER_FAILED_PLOAD_LESS_4,
- TSG_FS2_TAMPER_FAILED_NOSWAP,
- TSG_FS2_ASN_ADD,
- TSG_FS2_ASN_DEL,
- TSG_FS2_GTPC_ADD,
- TSG_FS2_GTPC_DEL,
- TSG_FS2_LOCATION_ADD,
- TSG_FS2_LOCATION_DEL,
- TSG_FS2_FQDN_ADD,
- TSG_FS2_FQDN_DEL,
- TSG_FS2_SUBSCRIBER_ADD,
- TSG_FS2_SUBSCRIBER_DEL,
- TSG_FS2_SECURIRY_ADD,
- TSG_FS2_SECURIRY_DEL,
- TSG_FS2_MIRRORED_ADD,
- TSG_FS2_MIRRORED_DEL,
- TSG_FS2_HTTP_RES_ADD,
- TSG_FS2_HTTP_RES_DEL,
- TSG_FS2_DNS_RES_ADD,
- TSG_FS2_DNS_RES_DEL,
- TSG_FS2_APP_ID_ADD,
- TSG_FS2_APP_ID_DEL,
- TSG_FS2_TUNNEL_CATALOG_ADD,
- TSG_FS2_TUNNEL_CATALOG_DEL,
- TSG_FS2_TUNNEL_ENDPOINT_ADD,
- TSG_FS2_TUNNEL_ENDPOINT_DEL,
- TSG_FS2_TUNNEL_LABEL_ADD,
- TSG_FS2_TUNNEL_LABEL_DEL,
- TSG_FS2_MAX
-};
-
enum TSG_ATTRIBUTE_TYPE
{
TSG_ATTRIBUTE_TYPE_ESTABLISH_LATECY=0,
@@ -179,37 +66,6 @@ enum HTTP_RESPONSE_FORMAT HTTP_RESPONSE_FORMAT_HTML
};
-enum BRIDGE_TYPE
-{
- BRIDGE_TYPE_SEND_CONN_SKETCH_DATA=0,
- BRIDGE_TYPE_RECV_CONN_SKETCH_DATA,
- BRIDGE_TYPE_APP_IDENTIFY_RESULT,
- BRIDGE_TYPE_NOTIFY_FLAGS,
- BRIDGE_TYPE_NOTIFY_SHAPING_RESULT,
- BRIDGE_TYPE_MAX
-};
-
-struct _str2index
-{
- int index;
- int len;
- char *type;
-};
-
-struct app_attributes
-{
- unsigned int app_id;
- unsigned int surrogate_id;
- unsigned int packet_sequence;
-};
-
-struct gather_app_result
-{
- int app_num;
- enum APP_IDENTIFY_ORIGIN origin;
- struct app_attributes attributes[MAX_APP_ID_NUM];
-};
-
struct l7_protocol
{
int id; /* first key */
@@ -218,22 +74,6 @@ struct l7_protocol UT_hash_handle hh2; /* handle for second hash table */
};
-struct policy_priority_label
-{
- tsg_protocol_t proto; //enum _tsg_protocol (tsg_types.h)
- int domain_len;
- int result_type; //enum _PULL_RESULT_TYPE (tsg_rule.h)
- int security_result_num;
- union
- {
- char *http_url;
- char *quic_ua;
- void *para;
- };
- char domain[MAX_DOMAIN_LEN];
- Maat_rule_t security_result[MAX_RESULT_NUM];
-};
-
struct fqdn_category
{
int ref_cnt;
@@ -269,130 +109,6 @@ struct app_id_dict struct deny_user_region deny_app_para;
};
-struct hited_app_para
-{
- int hited_app_id;
- int after_n_packets;
-};
-
-struct master_context
-{
- unsigned char is_esni;
- unsigned char is_log;
- unsigned char deal_pkt_num;
- unsigned char is_app_link;
- unsigned char sync_cb_state;
- unsigned short timeout;
- tsg_protocol_t proto;
- int hit_cnt;
- int hited_app_id; // only app
- unsigned int quic_version;
- unsigned long session_flag;
- char *domain;
- union
- {
- char *http_url;
- char *quic_ua;
- void *para;
- };
- scan_status_t mid;
- struct Maat_rule_t *result;
- struct hited_app_para hited_para; // l7 protocol and app
- long long last_scan_time;
-};
-
-struct tcpall_context
-{
- char udp_data_dropme;
- char set_latency_flag;
- char direction;
- char padding[5];
- enum TSG_METHOD_TYPE method_type;
- tsg_protocol_t protocol;
- union
- {
- struct leaky_bucket *bucket;
- long tamper_count;
- int default_policy_after_n_packets;
- struct hited_app_para hited_para;
- void *para;
- };
-};
-
-struct udp_context
-{
- struct master_context *data_entry;
- struct tcpall_context *all_entry;
-};
-
-struct reset_argv
-{
- int pkt_num;
- int seed1;
- int seed2;
- int th_flags;
- int dir;
- int remedy;
-};
-
-#define _MAX_TABLE_NAME_LEN 64
-typedef struct tsg_para
-{
- int level;
- short mirror_switch;
- unsigned short timeout;
- int dynamic_maat_switch;
- int location_field_num;
- int app_dict_field_num;
- int device_seq_in_dc;
- int datacenter_id;
- int scan_signaling_switch;
- int hash_timeout;
- int hash_slot_size;
- int hash_thread_safe;
- int feature_tamper;
- enum DEPLOY_MODE deploy_mode;
- int scan_time_interval;
- int identify_app_max_pkt_num;
- int unknown_app_id;
- int hit_path_switch;
- int default_compile_id;
- int table_id[TABLE_MAX];
- int dyn_table_id[DYN_TABLE_MAX];
- int priority_project_id;
- int shaping_project_id;
- int session_attribute_project_id;
- int context_project_id;
- int tcpall_project_id;
- int gather_app_project_id;
- int bridge_id[BRIDGE_TYPE_MAX];
- int proto_flag; //tsg_protocol_t
- int fs2_field_id[TSG_FS2_MAX];
- char device_sn[MAX_DOMAIN_LEN/8];
- char log_path[MAX_DOMAIN_LEN/8];
- char device_id_command[MAX_DOMAIN_LEN/8];
- char data_center[_MAX_TABLE_NAME_LEN];
- char device_tag[MAX_DOMAIN_LEN/2];
- char table_name[TABLE_MAX][_MAX_TABLE_NAME_LEN];
- char dyn_table_name[DYN_TABLE_MAX][_MAX_TABLE_NAME_LEN];
- char bridge_name[BRIDGE_TYPE_MAX][_MAX_TABLE_NAME_LEN];
- void *logger;
- void *maat_logger;
- struct reset_argv reset;
- struct mirrored_vlan default_vlan;
- screen_stat_handle_t fs2_handle;
- struct l7_protocol *name_by_id;
- struct l7_protocol *id_by_name;
- struct traffic_mirror *mirror_handle;
- ctemplate::Template *tpl_403,*tpl_404;
- ctemplate::Template *tpl_200,*tpl_204;
- ctemplate::Template *tpl_303;
-}g_tsg_para_t;
-
-extern g_tsg_para_t g_tsg_para;
-extern Maat_feather_t g_tsg_dynamic_maat_feather;
-extern id2field_t g_tsg_proto_name2id[PROTO_MAX];
-
typedef enum tsg_statis_field_id
{
STATIS_UNKNOWN=0,
@@ -483,9 +199,6 @@ void tsg_statistic_destroy(void); int tsg_gtp_signaling_hash_init(const char* conffile, void *logger);
-int set_struct_project(const struct streaminfo *a_stream, int project_id, void *data);
-const void *get_struct_project(const struct streaminfo *a_stream, int project_id);
-
long long get_current_time_ms(void);
//parent_app_name.app_name
@@ -521,7 +234,6 @@ int tsg_scan_subscribe_id_policy(Maat_feather_t maat_feather, const struct strea int tsg_get_umts_user_info(const struct streaminfo *a_stream, struct umts_user_info **user_info);
struct umts_user_info *tsg_get_umts_user_info_form_redis(unsigned int teid);
-void free_policy_label(int thread_seq, void *project_req_value);
int tsg_set_policy_result(const struct streaminfo *a_stream, PULL_RESULT_TYPE result_type, struct Maat_rule_t *p_result, tsg_protocol_t proto, int thread_seq);
int tsg_scan_gtp_apn_policy(Maat_feather_t maat_feather, const struct streaminfo *a_stream, struct Maat_rule_t *result, int result_num, scan_status_t *mid, char *apn, int thread_seq);
int tsg_scan_gtp_imsi_policy(Maat_feather_t maat_feather, const struct streaminfo *a_stream, struct Maat_rule_t *result, int result_num, scan_status_t *mid, char *imsi, int thread_seq);
@@ -532,4 +244,8 @@ int tsg_get_subscribe_id(const struct streaminfo *a_stream, struct subscribe_id_ int tsg_send_raw_packet(const struct streaminfo *a_stream, struct mirrored_vlan *vlan, int vlan_num, int thread_seq);
int tsg_scan_session_flags(Maat_feather_t maat_feather, const struct streaminfo *a_stream, Maat_rule_t *result, int result_num, scan_status_t *mid, int table_id, unsigned long flag, int thread_seq);
+int tsg_fetch_hited_security_result(struct Maat_rule_t *hited_result, int hited_result_num, struct Maat_rule_t *security_result, int security_result_num);
+int tsg_fetch_hited_shaping_result(struct Maat_rule_t *hited_result, int hited_result_num, struct Maat_rule_t *security_result, int security_result_num);
+
+
#endif
diff --git a/src/tsg_gtp_signaling.cpp b/src/tsg_gtp_signaling.cpp index a6f9d79..40a6482 100644 --- a/src/tsg_gtp_signaling.cpp +++ b/src/tsg_gtp_signaling.cpp @@ -35,7 +35,7 @@ static int is_gtp_tunnel(const struct streaminfo *a_stream) static int get_gtp_teid(const struct streaminfo *a_stream, unsigned int *uplink, unsigned int *downlink) { - const struct streaminfo *p=a_stream, *q=a_stream->pfather; + const struct streaminfo *p=a_stream; while(p) { @@ -47,8 +47,7 @@ static int get_gtp_teid(const struct streaminfo *a_stream, unsigned int *uplink, return 1; } - p=q; - q=q->pfather; + p=p->pfather; } return 0; diff --git a/src/tsg_rule.cpp b/src/tsg_rule.cpp index e9b336d..a56e13d 100644 --- a/src/tsg_rule.cpp +++ b/src/tsg_rule.cpp @@ -30,10 +30,17 @@ enum kni_scan_table{ SCAN_TABLE_MAX }; +struct str2index +{ + int index; + int len; + char *type; +}; + const char *g_kni_scan_table_name[SCAN_TABLE_MAX]; int g_kni_scan_tableid[SCAN_TABLE_MAX] = {0}; -extern id2field_t g_tsg_proto_name2id[PROTO_MAX]; -const struct _str2index method2index[TSG_METHOD_TYPE_MAX]={ {TSG_METHOD_TYPE_UNKNOWN, 7, (char *)"unknown"}, +extern struct id2field g_tsg_proto_name2id[PROTO_MAX]; +const struct str2index method2index[TSG_METHOD_TYPE_MAX]={ {TSG_METHOD_TYPE_UNKNOWN, 7, (char *)"unknown"}, {TSG_METHOD_TYPE_DROP, 4, (char *)"drop"}, {TSG_METHOD_TYPE_REDIRECTION, 8, (char *)"redirect"}, {TSG_METHOD_TYPE_BLOCK, 5, (char *)"block"}, @@ -63,8 +70,7 @@ static char* tsg_strdup(const char* s) unsigned short get_redis_port(char *redis_port_range) { - int i=0,ret=0; - int idx=0,port_num=0; + int port_num=0; int range_len=0,used_len=0; char buf[256]={0}; unsigned short s_port=0,e_port=0; @@ -109,11 +115,11 @@ unsigned short get_redis_port(char *redis_port_range) } else { - ret=sscanf(buf, "%hu-%hu", &s_port, &e_port); + int ret=sscanf(buf, "%hu-%hu", &s_port, &e_port); assert(ret==2); } - for(i=s_port; i<=e_port && port_num<32; i++) + for(int i=s_port; i<=e_port && port_num<32; i++) { redis_port[port_num++]=i; } @@ -125,7 +131,7 @@ unsigned short get_redis_port(char *redis_port_range) } srand((unsigned int)time(NULL)); - idx=rand()%port_num; + int idx=rand()%port_num; return redis_port[idx]; } @@ -253,14 +259,13 @@ static int sort_category_id(const void * a, const void * b) static int get_data_center(char *accept_tag, char *effective_tag_key, char *data_center, int data_center_len) { - int i=0,len; cJSON *object=cJSON_Parse(accept_tag); if(object!=NULL) { cJSON *array=cJSON_GetObjectItem(object, "tags"); if(array!=NULL) { - for(i=0; i<cJSON_GetArraySize(array); i++) + for(int i=0; i<cJSON_GetArraySize(array); i++) { cJSON *item=cJSON_GetArrayItem(array, i); if(item!=NULL) @@ -271,7 +276,7 @@ static int get_data_center(char *accept_tag, char *effective_tag_key, char *data cJSON *v_item=cJSON_GetObjectItem(item, "value"); if(v_item!=NULL && v_item->valuestring!=NULL) { - len=strlen(v_item->valuestring); + int len=strlen(v_item->valuestring); memcpy(data_center, v_item->valuestring, (len>data_center_len-1 ? data_center_len-1 : len)); } @@ -301,7 +306,7 @@ static void _free_field(char *field) static char *_malloc_field(const char *field_start, size_t field_len) { - if(field_start==NULL || field_len<=0) + if(field_start==NULL || field_len==0) { return NULL; } @@ -324,11 +329,10 @@ static int get_string_from_json(cJSON *object, const char *key, char **value) { return 0; } - int len=0; cJSON *item=cJSON_GetObjectItem(object, key); if(item!=NULL) { - len=strlen(item->valuestring); + int len=strlen(item->valuestring); (*value)=(char *)malloc(len+1); memcpy((*value), item->valuestring, len); (*value)[len]='\0'; @@ -485,19 +489,18 @@ void location_dup_data(int table_id, MAAT_PLUGIN_EX_DATA *to, MAAT_PLUGIN_EX_DAT void location_new_data(int table_id, const char* key, const char* table_line, MAAT_PLUGIN_EX_DATA* ad, long argl, void* argp) { - int country_full=13,province_full=15,city_full=16,subdivision_addr=17; struct location_info *location=(struct location_info *)calloc(1, sizeof(struct location_info)); - location->country_full=tsg_get_column_string_value(table_line, country_full); - location->province_full=tsg_get_column_string_value(table_line, province_full); - location->city_full=tsg_get_column_string_value(table_line, city_full); + location->country_full=tsg_get_column_string_value(table_line, 13); // country_full + location->province_full=tsg_get_column_string_value(table_line, 15); // province_full + location->city_full=tsg_get_column_string_value(table_line, 16); // city_full str_unescape(location->country_full); str_unescape(location->province_full); str_unescape(location->city_full); if(g_tsg_para.location_field_num==19) { - location->subdivision_addr=tsg_get_column_string_value(table_line, subdivision_addr); + location->subdivision_addr=tsg_get_column_string_value(table_line, 17); // subdivision_addr str_unescape(location->subdivision_addr); } @@ -1423,29 +1426,27 @@ void http_response_pages_free(int table_id, MAAT_PLUGIN_EX_DATA* ad, long argl, void dns_profile_records_new(int table_id, const char* key, const char* table_line, MAAT_PLUGIN_EX_DATA* ad, long argl, void *argp) { - int i=0; - cJSON *one_record=NULL,*pSub=NULL; struct dns_profile_records *profile_records=(struct dns_profile_records *)calloc(1, sizeof(struct dns_profile_records)); profile_records->record_id=tsg_get_column_integer_value(table_line, 1); char *answer_type=tsg_get_column_string_value(table_line, 3); char *json_record=tsg_get_column_string_value(table_line, 4); - cJSON *records_array=cJSON_Parse(json_record); + cJSON *records_array=cJSON_Parse(json_record); if(records_array!=NULL) { profile_records->record_num=cJSON_GetArraySize(records_array); profile_records->record_val=(struct dns_record_val *)calloc(1, profile_records->record_num*sizeof(struct dns_record_val)); profile_records->answer_type=get_dns_qtype(answer_type, strlen(answer_type)); - for(i=0; i<profile_records->record_num; i++) + for(int i=0; i<profile_records->record_num; i++) { - one_record=cJSON_GetArrayItem(records_array, i); + cJSON *one_record=cJSON_GetArrayItem(records_array, i); if(one_record==NULL) { continue; } - pSub=cJSON_GetObjectItem(one_record, "value"); + cJSON *pSub=cJSON_GetObjectItem(one_record, "value"); if(NULL==pSub ) { continue; @@ -1534,8 +1535,6 @@ void dns_profile_records_free(int table_id, MAAT_PLUGIN_EX_DATA* ad, long argl, void mirrored_profile_new(int table_id, const char* key, const char* table_line, MAAT_PLUGIN_EX_DATA* ad, long argl, void *argp) { - int i=0,vlan_id_num=0; - cJSON *one_vlan=NULL; struct traffic_mirror_profile *mirror_profile=(struct traffic_mirror_profile *)calloc(1, sizeof(struct traffic_mirror_profile)); mirror_profile->profile_id=tsg_get_column_integer_value(table_line, 1); @@ -1544,10 +1543,10 @@ void mirrored_profile_new(int table_id, const char* key, const char* table_line, cJSON *vlan_ids_object=cJSON_Parse(vlan_ids_str); if(vlan_ids_object!=NULL) { - vlan_id_num=cJSON_GetArraySize(vlan_ids_object); - for(i=0; i<vlan_id_num; i++) + int vlan_id_num=cJSON_GetArraySize(vlan_ids_object); + for(int i=0; i<vlan_id_num; i++) { - one_vlan=cJSON_GetArrayItem(vlan_ids_object, i); + cJSON *one_vlan=cJSON_GetArrayItem(vlan_ids_object, i); if(one_vlan==NULL) { continue; @@ -1677,7 +1676,7 @@ void tunnel_endpoint_free(int table_id, MAAT_PLUGIN_EX_DATA* ad, long argl, void { _free_field(t_endpoint->description); _free_field((char *)(*ad)); - *ad=NULL; + *ad=NULL; FS_operate(g_tsg_para.fs2_handle, g_tsg_para.fs2_field_id[TSG_FS2_TUNNEL_ENDPOINT_DEL], 0, FS_OP_ADD, 1); } } @@ -1694,11 +1693,7 @@ void tunnel_label_new(int table_id, const char* key, const char* table_line, MAA void tunnel_label_dup(int table_id, MAAT_PLUGIN_EX_DATA *to, MAAT_PLUGIN_EX_DATA *from, long argl, void *argp) { - if((*from)!=NULL) - { - (*to)=(*from); - } - + (*to)=(*from); return ; } @@ -1709,18 +1704,15 @@ void tunnel_label_free(int table_id, MAAT_PLUGIN_EX_DATA* ad, long argl, void *a static Maat_feather_t init_maat_feather(const char* conffile, char* instance_name, char *module, void *maat_logger) { - int redis_index=0,deferred_load=0; - unsigned short redis_port=0; - int ret=0,scan_detail=0,effect_interval=60; + int deferred_load=0; + int scan_detail=0,effect_interval=60; Maat_feather_t _maat_feather=NULL; - char redis_port_range[256]={0}; - char effective_tag_key[128]={0}; char effective_range_filename[1024]={0}; - char redis_ip[16]={0}, effective_flag[1024]={0}; + char effective_flag[1024]={0}; int output_prometheus=0; int maat_mode=0,maat_stat_on=0,maat_perf_on=0,thread_max=0; - char json_cfg_file[MAX_PATH_LEN]={0},maat_stat_file[MAX_PATH_LEN]={0}; - char table_info[MAX_PATH_LEN]={0},inc_cfg_dir[MAX_PATH_LEN]={0},ful_cfg_dir[MAX_PATH_LEN]={0}; + char maat_stat_file[MAX_PATH_LEN]={0}; + char table_info[MAX_PATH_LEN]={0}; memset(effective_flag, 0, sizeof(effective_flag)); MESA_load_profile_string_def(conffile, module, "EFFECTIVE_RANGE_FILE", effective_range_filename, sizeof(effective_range_filename),"./tsgconf/maat.conf"); @@ -1737,11 +1729,13 @@ static Maat_feather_t init_maat_feather(const char* conffile, char* instance_nam if(strlen(g_tsg_para.device_tag)==0 && strlen(effective_flag)>0) { + memcpy(g_tsg_para.device_tag, effective_flag, MIN(strlen(effective_flag), sizeof(g_tsg_para.device_tag)-1)); } if(strlen(g_tsg_para.data_center)==0 && strlen(effective_flag)>0) { + char effective_tag_key[128]={0}; MESA_load_profile_string_def(conffile, module, "EFFECTIVE_TAG_KEY", effective_tag_key, sizeof(effective_tag_key),"data_center"); get_data_center(effective_flag, effective_tag_key, g_tsg_para.data_center, sizeof(g_tsg_para.data_center)); } @@ -1762,10 +1756,13 @@ static Maat_feather_t init_maat_feather(const char* conffile, char* instance_nam if(maat_mode==2) { + int redis_index=0; + char redis_ip[16]={0}; + char redis_port_range[256]={0}; MESA_load_profile_string_def(conffile,module,"REDIS_IP", redis_ip, sizeof(redis_ip),""); MESA_load_profile_int_def(conffile, module,"REDIS_INDEX", &redis_index, 0); MESA_load_profile_string_def(conffile,module,"REDIS_PORT", redis_port_range, sizeof(redis_port_range), "6379;"); - redis_port=get_redis_port(redis_port_range); + unsigned short redis_port=get_redis_port(redis_port_range); if(strlen(effective_flag)!=0) { @@ -1791,7 +1788,7 @@ static Maat_feather_t init_maat_feather(const char* conffile, char* instance_nam { if(strlen(effective_flag)!=0) { - ret=Maat_set_feather_opt(_maat_feather,MAAT_OPT_ACCEPT_TAGS,effective_flag, strlen(effective_flag)+1); + int ret=Maat_set_feather_opt(_maat_feather,MAAT_OPT_ACCEPT_TAGS,effective_flag, strlen(effective_flag)+1); assert(ret>=0); } else @@ -1802,11 +1799,13 @@ static Maat_feather_t init_maat_feather(const char* conffile, char* instance_nam Maat_set_feather_opt(_maat_feather, MAAT_OPT_STATUS_OUTPUT_PROMETHEUS, &output_prometheus, sizeof(output_prometheus)); if(maat_mode==1) { + char json_cfg_file[MAX_PATH_LEN]={0}; MESA_load_profile_string_def(conffile,module,"JSON_CFG_FILE",json_cfg_file, sizeof(json_cfg_file),""); Maat_set_feather_opt(_maat_feather, MAAT_OPT_JSON_FILE_PATH, json_cfg_file, strlen(json_cfg_file)+1); } else { + char inc_cfg_dir[MAX_PATH_LEN]={0},ful_cfg_dir[MAX_PATH_LEN]={0}; MESA_load_profile_string_def(conffile,module,"INC_CFG_DIR",inc_cfg_dir, sizeof(inc_cfg_dir),""); MESA_load_profile_string_def(conffile,module,"FULL_CFG_DIR",ful_cfg_dir, sizeof(ful_cfg_dir),""); assert(strlen(inc_cfg_dir)!=0&&strlen(ful_cfg_dir)!=0); @@ -1833,7 +1832,7 @@ static Maat_feather_t init_maat_feather(const char* conffile, char* instance_nam } } - ret=Maat_initiate_feather(_maat_feather); + int ret=Maat_initiate_feather(_maat_feather); if(ret<0) { return NULL; @@ -1853,52 +1852,52 @@ int tsg_rule_init(const char* conffile, void *logger) MESA_load_profile_int_def(conffile, "MAAT","LOCATION_TABLE_TYPE", &g_tsg_para.location_field_num, 18); MESA_load_profile_string_def(conffile, "MAAT", "PROFILE", maat_conffile, sizeof(maat_conffile), "./tsgconf/maat.conf"); - MESA_load_profile_string_def(conffile, "MAAT", "SECURITY_COMPILE", g_tsg_para.table_name[TABLE_SECURITY_COMPILE], _MAX_TABLE_NAME_LEN, "TSG_SECURITY_COMPILE"); - MESA_load_profile_string_def(conffile, "MAAT", "IP_ADDR_TABLE", g_tsg_para.table_name[TABLE_IP_ADDR], _MAX_TABLE_NAME_LEN, "TSG_SECURITY_ADDR"); - MESA_load_profile_string_def(conffile, "MAAT", "SUBSCRIBER_ID_TABLE", g_tsg_para.table_name[TABLE_SUBSCRIBER_ID], _MAX_TABLE_NAME_LEN, "TSG_OBJ_SUBSCRIBER_ID"); - MESA_load_profile_string_def(conffile, "MAAT", "APP_ID_TABLE", g_tsg_para.table_name[TABLE_APP_ID], _MAX_TABLE_NAME_LEN, "TSG_OBJ_APP_ID"); - MESA_load_profile_string_def(conffile, "MAAT", "HTTP_HOST_TABLE", g_tsg_para.table_name[TABLE_HTTP_HOST], _MAX_TABLE_NAME_LEN, "TSG_FIELD_HTTP_HOST"); - MESA_load_profile_string_def(conffile, "MAAT", "HTTP_URL_TABLE", g_tsg_para.table_name[TABLE_HTTP_URL], _MAX_TABLE_NAME_LEN, "TSG_FIELD_HTTP_URL"); - MESA_load_profile_string_def(conffile, "MAAT", "SSL_SNI_TABLE", g_tsg_para.table_name[TABLE_SSL_SNI], _MAX_TABLE_NAME_LEN, "TSG_FIELD_SSL_SNI"); - MESA_load_profile_string_def(conffile, "MAAT", "DECYPTION_EXCLUSION_SSL_SNI", g_tsg_para.table_name[TABLE_EXCLUSION_SSL_SNI], _MAX_TABLE_NAME_LEN, "TSG_DECYPTION_EXCLUSION_SSL_SNI"); + MESA_load_profile_string_def(conffile, "MAAT", "SECURITY_COMPILE", g_tsg_para.table_name[TABLE_SECURITY_COMPILE], MAX_TABLE_NAME_LEN, "TSG_SECURITY_COMPILE"); + MESA_load_profile_string_def(conffile, "MAAT", "IP_ADDR_TABLE", g_tsg_para.table_name[TABLE_IP_ADDR], MAX_TABLE_NAME_LEN, "TSG_SECURITY_ADDR"); + MESA_load_profile_string_def(conffile, "MAAT", "SUBSCRIBER_ID_TABLE", g_tsg_para.table_name[TABLE_SUBSCRIBER_ID], MAX_TABLE_NAME_LEN, "TSG_OBJ_SUBSCRIBER_ID"); + MESA_load_profile_string_def(conffile, "MAAT", "APP_ID_TABLE", g_tsg_para.table_name[TABLE_APP_ID], MAX_TABLE_NAME_LEN, "TSG_OBJ_APP_ID"); + MESA_load_profile_string_def(conffile, "MAAT", "HTTP_HOST_TABLE", g_tsg_para.table_name[TABLE_HTTP_HOST], MAX_TABLE_NAME_LEN, "TSG_FIELD_HTTP_HOST"); + MESA_load_profile_string_def(conffile, "MAAT", "HTTP_URL_TABLE", g_tsg_para.table_name[TABLE_HTTP_URL], MAX_TABLE_NAME_LEN, "TSG_FIELD_HTTP_URL"); + MESA_load_profile_string_def(conffile, "MAAT", "SSL_SNI_TABLE", g_tsg_para.table_name[TABLE_SSL_SNI], MAX_TABLE_NAME_LEN, "TSG_FIELD_SSL_SNI"); + MESA_load_profile_string_def(conffile, "MAAT", "DECYPTION_EXCLUSION_SSL_SNI", g_tsg_para.table_name[TABLE_EXCLUSION_SSL_SNI], MAX_TABLE_NAME_LEN, "TSG_DECYPTION_EXCLUSION_SSL_SNI"); - MESA_load_profile_string_def(conffile, "MAAT", "SRC_ASN_TABLE", g_tsg_para.table_name[TABLE_SRC_ASN], _MAX_TABLE_NAME_LEN, "TSG_SECURITY_SOURCE_ASN"); - MESA_load_profile_string_def(conffile, "MAAT", "DST_ASN_TABLE", g_tsg_para.table_name[TABLE_DST_ASN], _MAX_TABLE_NAME_LEN, "TSG_SECURITY_DESTINATION_ASN"); - MESA_load_profile_string_def(conffile, "MAAT", "SRC_LOCATION_TABLE", g_tsg_para.table_name[TABLE_SRC_LOCATION], _MAX_TABLE_NAME_LEN, "TSG_SECURITY_SOURCE_LOCATION"); - MESA_load_profile_string_def(conffile, "MAAT", "DST_LOCATION_TABLE", g_tsg_para.table_name[TABLE_DST_LOCATION], _MAX_TABLE_NAME_LEN, "TSG_SECURITY_DESTINATION_LOCATION"); + MESA_load_profile_string_def(conffile, "MAAT", "SRC_ASN_TABLE", g_tsg_para.table_name[TABLE_SRC_ASN], MAX_TABLE_NAME_LEN, "TSG_SECURITY_SOURCE_ASN"); + MESA_load_profile_string_def(conffile, "MAAT", "DST_ASN_TABLE", g_tsg_para.table_name[TABLE_DST_ASN], MAX_TABLE_NAME_LEN, "TSG_SECURITY_DESTINATION_ASN"); + MESA_load_profile_string_def(conffile, "MAAT", "SRC_LOCATION_TABLE", g_tsg_para.table_name[TABLE_SRC_LOCATION], MAX_TABLE_NAME_LEN, "TSG_SECURITY_SOURCE_LOCATION"); + MESA_load_profile_string_def(conffile, "MAAT", "DST_LOCATION_TABLE", g_tsg_para.table_name[TABLE_DST_LOCATION], MAX_TABLE_NAME_LEN, "TSG_SECURITY_DESTINATION_LOCATION"); - MESA_load_profile_string_def(conffile, "MAAT", "ASN_BUILT_IN_TABLE", g_tsg_para.table_name[TABLE_ASN_BUILT_IN], _MAX_TABLE_NAME_LEN, "TSG_IP_ASN_BUILT_IN"); - MESA_load_profile_string_def(conffile, "MAAT", "ASN_USER_DEFINED_TABLE", g_tsg_para.table_name[TABLE_ASN_USER_DEFINED], _MAX_TABLE_NAME_LEN, "TSG_IP_ASN_USER_DEFINED"); - MESA_load_profile_string_def(conffile, "MAAT", "LOCATION_BUILT_IN_TABLE", g_tsg_para.table_name[TABLE_LOCATION_BUILT_IN], _MAX_TABLE_NAME_LEN, "TSG_IP_LOCATION_BUILT_IN"); - MESA_load_profile_string_def(conffile, "MAAT", "LOCATION_USER_DEFINED_TABLE", g_tsg_para.table_name[TABLE_LOCATION_USER_DEFINED], _MAX_TABLE_NAME_LEN, "TSG_IP_LOCATION_USER_DEFINED"); + MESA_load_profile_string_def(conffile, "MAAT", "ASN_BUILT_IN_TABLE", g_tsg_para.table_name[TABLE_ASN_BUILT_IN], MAX_TABLE_NAME_LEN, "TSG_IP_ASN_BUILT_IN"); + MESA_load_profile_string_def(conffile, "MAAT", "ASN_USER_DEFINED_TABLE", g_tsg_para.table_name[TABLE_ASN_USER_DEFINED], MAX_TABLE_NAME_LEN, "TSG_IP_ASN_USER_DEFINED"); + MESA_load_profile_string_def(conffile, "MAAT", "LOCATION_BUILT_IN_TABLE", g_tsg_para.table_name[TABLE_LOCATION_BUILT_IN], MAX_TABLE_NAME_LEN, "TSG_IP_LOCATION_BUILT_IN"); + MESA_load_profile_string_def(conffile, "MAAT", "LOCATION_USER_DEFINED_TABLE", g_tsg_para.table_name[TABLE_LOCATION_USER_DEFINED], MAX_TABLE_NAME_LEN, "TSG_IP_LOCATION_USER_DEFINED"); - MESA_load_profile_string_def(conffile, "MAAT", "QUIC_SNI_TABLE", g_tsg_para.table_name[TABLE_QUIC_SNI], _MAX_TABLE_NAME_LEN, "TSG_FIELD_QUIC_SNI"); + MESA_load_profile_string_def(conffile, "MAAT", "QUIC_SNI_TABLE", g_tsg_para.table_name[TABLE_QUIC_SNI], MAX_TABLE_NAME_LEN, "TSG_FIELD_QUIC_SNI"); - MESA_load_profile_string_def(conffile, "MAAT", "FQDN_CAT_ID_TABLE", g_tsg_para.table_name[TABLE_FQDN_CAT_ID], _MAX_TABLE_NAME_LEN, "TSG_OBJ_FQDN_CAT"); - MESA_load_profile_string_def(conffile, "MAAT", "FQDN_CAT_BUILT_IN_TABLE", g_tsg_para.table_name[TABLE_FQDN_CAT_BUILT_IN], _MAX_TABLE_NAME_LEN, "TSG_FQDN_CATEGORY_BUILT_IN"); - MESA_load_profile_string_def(conffile, "MAAT", "FQDN_CAT_USER_DEFINED_TABLE", g_tsg_para.table_name[TABLE_FQDN_CAT_USER_DEFINED], _MAX_TABLE_NAME_LEN, "TSG_FQDN_CATEGORY_USER_DEFINED"); + MESA_load_profile_string_def(conffile, "MAAT", "FQDN_CAT_ID_TABLE", g_tsg_para.table_name[TABLE_FQDN_CAT_ID], MAX_TABLE_NAME_LEN, "TSG_OBJ_FQDN_CAT"); + MESA_load_profile_string_def(conffile, "MAAT", "FQDN_CAT_BUILT_IN_TABLE", g_tsg_para.table_name[TABLE_FQDN_CAT_BUILT_IN], MAX_TABLE_NAME_LEN, "TSG_FQDN_CATEGORY_BUILT_IN"); + MESA_load_profile_string_def(conffile, "MAAT", "FQDN_CAT_USER_DEFINED_TABLE", g_tsg_para.table_name[TABLE_FQDN_CAT_USER_DEFINED], MAX_TABLE_NAME_LEN, "TSG_FQDN_CATEGORY_USER_DEFINED"); - MESA_load_profile_string_def(conffile, "MAAT", "APP_ID_DICT_TABLE", g_tsg_para.table_name[TABLE_APP_ID_DICT], _MAX_TABLE_NAME_LEN, "APP_ID_DICT"); - MESA_load_profile_string_def(conffile, "MAAT", "APP_ID_TABLE", g_tsg_para.table_name[TABLE_APP_ID], _MAX_TABLE_NAME_LEN, "TSG_OBJ_APP_ID"); - MESA_load_profile_string_def(conffile, "MAAT", "SELECTOR_ID_TABLE", g_tsg_para.table_name[TABLE_SELECTOR_ID], _MAX_TABLE_NAME_LEN, "APP_SELECTOR_ID"); - MESA_load_profile_string_def(conffile, "MAAT", "SELECTOR_PROPERTIES_TABLE", g_tsg_para.table_name[TABLE_SELECTOR_PROPERTIES], _MAX_TABLE_NAME_LEN, "APP_SELECTOR_PROPERTIES"); + MESA_load_profile_string_def(conffile, "MAAT", "APP_ID_DICT_TABLE", g_tsg_para.table_name[TABLE_APP_ID_DICT], MAX_TABLE_NAME_LEN, "APP_ID_DICT"); + MESA_load_profile_string_def(conffile, "MAAT", "APP_ID_TABLE", g_tsg_para.table_name[TABLE_APP_ID], MAX_TABLE_NAME_LEN, "TSG_OBJ_APP_ID"); + MESA_load_profile_string_def(conffile, "MAAT", "SELECTOR_ID_TABLE", g_tsg_para.table_name[TABLE_SELECTOR_ID], MAX_TABLE_NAME_LEN, "APP_SELECTOR_ID"); + MESA_load_profile_string_def(conffile, "MAAT", "SELECTOR_PROPERTIES_TABLE", g_tsg_para.table_name[TABLE_SELECTOR_PROPERTIES], MAX_TABLE_NAME_LEN, "APP_SELECTOR_PROPERTIES"); - MESA_load_profile_string_def(conffile, "MAAT", "GTP_APN", g_tsg_para.table_name[TABLE_GTP_APN], _MAX_TABLE_NAME_LEN, "TSG_FILED_GTP_APN"); - MESA_load_profile_string_def(conffile, "MAAT", "GTP_IMSI", g_tsg_para.table_name[TABLE_GTP_IMSI], _MAX_TABLE_NAME_LEN, "TSG_FILED_GTP_IMSI"); - MESA_load_profile_string_def(conffile, "MAAT", "GTP_PHONE_NUMBER", g_tsg_para.table_name[TABLE_GTP_PHONE_NUMBER], _MAX_TABLE_NAME_LEN, "TSG_FILED_GTP_PHONE_NUMBER"); + MESA_load_profile_string_def(conffile, "MAAT", "GTP_APN", g_tsg_para.table_name[TABLE_GTP_APN], MAX_TABLE_NAME_LEN, "TSG_FILED_GTP_APN"); + MESA_load_profile_string_def(conffile, "MAAT", "GTP_IMSI", g_tsg_para.table_name[TABLE_GTP_IMSI], MAX_TABLE_NAME_LEN, "TSG_FILED_GTP_IMSI"); + MESA_load_profile_string_def(conffile, "MAAT", "GTP_PHONE_NUMBER", g_tsg_para.table_name[TABLE_GTP_PHONE_NUMBER], MAX_TABLE_NAME_LEN, "TSG_FILED_GTP_PHONE_NUMBER"); - MESA_load_profile_string_def(conffile, "MAAT", "RESPONSE_PAGES_TABLE", g_tsg_para.table_name[TABLE_RESPONSE_PAGES], _MAX_TABLE_NAME_LEN, "TSG_PROFILE_RESPONSE_PAGES"); - MESA_load_profile_string_def(conffile, "MAAT", "DNS_PROFILE_RECORDS", g_tsg_para.table_name[TABLE_DNS_PROFILE_RECORD], _MAX_TABLE_NAME_LEN, (char *)"TSG_PROFILE_DNS_RECORDS"); - MESA_load_profile_string_def(conffile, "MAAT", "TRAFFIC_MIRROR_PROFILE", g_tsg_para.table_name[TABLE_PROFILE_MIRROR], _MAX_TABLE_NAME_LEN, (char *)"TSG_PROFILE_TRAFFIC_MIRROR"); + MESA_load_profile_string_def(conffile, "MAAT", "RESPONSE_PAGES_TABLE", g_tsg_para.table_name[TABLE_RESPONSE_PAGES], MAX_TABLE_NAME_LEN, "TSG_PROFILE_RESPONSE_PAGES"); + MESA_load_profile_string_def(conffile, "MAAT", "DNS_PROFILE_RECORDS", g_tsg_para.table_name[TABLE_DNS_PROFILE_RECORD], MAX_TABLE_NAME_LEN, (char *)"TSG_PROFILE_DNS_RECORDS"); + MESA_load_profile_string_def(conffile, "MAAT", "TRAFFIC_MIRROR_PROFILE", g_tsg_para.table_name[TABLE_PROFILE_MIRROR], MAX_TABLE_NAME_LEN, (char *)"TSG_PROFILE_TRAFFIC_MIRROR"); - MESA_load_profile_string_def(conffile, "MAAT", "DTLS_SNI_TABLE", g_tsg_para.table_name[TABLE_DTLS_SNI], _MAX_TABLE_NAME_LEN, "TSG_FIELD_DTLS_SNI"); + MESA_load_profile_string_def(conffile, "MAAT", "DTLS_SNI_TABLE", g_tsg_para.table_name[TABLE_DTLS_SNI], MAX_TABLE_NAME_LEN, "TSG_FIELD_DTLS_SNI"); - MESA_load_profile_string_def(conffile, "MAAT", "TUNNEL_ID_TABLE", g_tsg_para.table_name[TABLE_TUNNEL_ID], _MAX_TABLE_NAME_LEN, "TSG_SECURITY_TUNNEL"); - MESA_load_profile_string_def(conffile, "MAAT", "TUNNEL_CATALOG_TABLE", g_tsg_para.table_name[TABLE_TUNNEL_CATALOG], _MAX_TABLE_NAME_LEN, "TSG_TUNNEL_CATALOG"); - MESA_load_profile_string_def(conffile, "MAAT", "TUNNEL_ENDPOINT_TABLE", g_tsg_para.table_name[TABLE_TUNNEL_ENDPOINT], _MAX_TABLE_NAME_LEN, "TSG_TUNNEL_ENDPOINT"); - MESA_load_profile_string_def(conffile, "MAAT", "TUNNEL_LABEL_TABLE", g_tsg_para.table_name[TABLE_TUNNEL_LABEL], _MAX_TABLE_NAME_LEN, "TSG_TUNNEL_LABEL"); + MESA_load_profile_string_def(conffile, "MAAT", "TUNNEL_ID_TABLE", g_tsg_para.table_name[TABLE_TUNNEL_ID], MAX_TABLE_NAME_LEN, "TSG_SECURITY_TUNNEL"); + MESA_load_profile_string_def(conffile, "MAAT", "TUNNEL_CATALOG_TABLE", g_tsg_para.table_name[TABLE_TUNNEL_CATALOG], MAX_TABLE_NAME_LEN, "TSG_TUNNEL_CATALOG"); + MESA_load_profile_string_def(conffile, "MAAT", "TUNNEL_ENDPOINT_TABLE", g_tsg_para.table_name[TABLE_TUNNEL_ENDPOINT], MAX_TABLE_NAME_LEN, "TSG_TUNNEL_ENDPOINT"); + MESA_load_profile_string_def(conffile, "MAAT", "TUNNEL_LABEL_TABLE", g_tsg_para.table_name[TABLE_TUNNEL_LABEL], MAX_TABLE_NAME_LEN, "TSG_TUNNEL_LABEL"); - MESA_load_profile_string_def(conffile, "MAAT", "SESSION_FLAG_TABLE", g_tsg_para.table_name[TABLE_SESSION_FLAGS], _MAX_TABLE_NAME_LEN, "TSG_SECURITY_FLAG"); + MESA_load_profile_string_def(conffile, "MAAT", "SESSION_FLAG_TABLE", g_tsg_para.table_name[TABLE_SESSION_FLAGS], MAX_TABLE_NAME_LEN, "TSG_SECURITY_FLAG"); MESA_load_profile_int_def(conffile, "MAAT","LOG_LEVEL", &log_level, 30); MESA_load_profile_string_def(conffile, "MAAT", "LOG_PATH", log_path, sizeof(log_path), "./tsglog/maat/tsg_maat.log"); @@ -2203,32 +2202,31 @@ int tsg_rule_init(const char* conffile, void *logger) static int get_fqdn_category_id(Maat_feather_t maat_feather, int table_id, char *fqdn, unsigned int *category_id, int category_id_num, void *logger, int thread_seq) { - int i=0,j=0,ret=0; struct fqdn_category *ex_data_array[8]={0}; - - ret=Maat_fqdn_plugin_get_EX_data(maat_feather, table_id, fqdn, (MAAT_PLUGIN_EX_DATA *)ex_data_array, 8); + int ret=Maat_fqdn_plugin_get_EX_data(maat_feather, table_id, fqdn, (MAAT_PLUGIN_EX_DATA *)ex_data_array, 8); if(ret>0) - { + { + int cnt=0; qsort(ex_data_array, ret, sizeof(struct fqdn_category *), sort_category_id); - for(i=0; i<ret; i++) + for(int i=0; i<ret; i++) { - if(j==0) + if(cnt==0) { - category_id[j++]=ex_data_array[i]->category_id; + category_id[cnt++]=ex_data_array[i]->category_id; } else { - if(j<category_id_num && ex_data_array[i]->category_id!=category_id[j-1]) + if(cnt<category_id_num && ex_data_array[i]->category_id!=category_id[cnt-1]) { - category_id[j++]=ex_data_array[i]->category_id; + category_id[cnt++]=ex_data_array[i]->category_id; } } fqdn_category_free(table_id, (MAAT_PLUGIN_EX_DATA *)&(ex_data_array[i]), 0, logger); } - return j; + return cnt; } return 0; @@ -2238,7 +2236,7 @@ int tsg_set_policy_result(const struct streaminfo *a_stream, PULL_RESULT_TYPE re { struct policy_priority_label *priority_label=NULL; - priority_label=(struct policy_priority_label *)project_req_get_struct((struct streaminfo *)a_stream, g_tsg_para.priority_project_id); + priority_label=(struct policy_priority_label *)stream_bridge_async_data_get((struct streaminfo *)a_stream, g_tsg_para.bridge[BRIDGE_TYPE_POLICY_PRIORITY].id); if(priority_label==NULL) { priority_label=(struct policy_priority_label *)dictator_malloc(thread_seq, sizeof(struct policy_priority_label)); @@ -2251,10 +2249,10 @@ int tsg_set_policy_result(const struct streaminfo *a_stream, PULL_RESULT_TYPE re priority_label->result_type=result_type; memcpy(priority_label->security_result, p_result, sizeof(struct Maat_rule_t)); - int ret=project_req_add_struct((struct streaminfo *)a_stream, g_tsg_para.priority_project_id, (void *)priority_label); + int ret=stream_bridge_async_data_put((struct streaminfo *)a_stream, g_tsg_para.bridge[BRIDGE_TYPE_POLICY_PRIORITY].id, (void *)priority_label); if(ret<0) { - free_policy_label(thread_seq, (void *)priority_label); + free_policy_label(a_stream, g_tsg_para.bridge[BRIDGE_TYPE_POLICY_PRIORITY].id, (void *)priority_label); MESA_handle_runtime_log(g_tsg_para.logger, RLOG_LV_FATAL, "PROJECT_ADD", @@ -2280,7 +2278,7 @@ int tsg_set_policy_result(const struct streaminfo *a_stream, PULL_RESULT_TYPE re int tsg_pull_shaping_result(struct streaminfo *a_stream, Maat_rule_t*result, int result_num) { - struct notify_shaping_policy *shaping_label=(struct notify_shaping_policy *)stream_bridge_async_data_get(a_stream, g_tsg_para.bridge_id[BRIDGE_TYPE_NOTIFY_SHAPING_RESULT]); + struct notify_shaping_policy *shaping_label=(struct notify_shaping_policy *)tsg_get_xxx_from_bridge(a_stream, g_tsg_para.bridge[BRIDGE_TYPE_NOTIFY_SHAPING_RESULT].id); if(shaping_label!=NULL && result!=NULL && result_num>0) { int num=MIN(shaping_label->shaping_result_num, result_num); @@ -2293,15 +2291,12 @@ int tsg_pull_shaping_result(struct streaminfo *a_stream, Maat_rule_t*result, int int tsg_pull_policy_result(struct streaminfo *a_stream, PULL_RESULT_TYPE pull_result_type, Maat_rule_t*result, int result_num, struct identify_info *identify_info) { - int num=0; - struct policy_priority_label *label=NULL; - - label=(struct policy_priority_label *)project_req_get_struct(a_stream, g_tsg_para.priority_project_id); + struct policy_priority_label *label=(struct policy_priority_label *)tsg_get_xxx_from_bridge((struct streaminfo *)a_stream, g_tsg_para.bridge[BRIDGE_TYPE_POLICY_PRIORITY].id); if(label!=NULL && result!=NULL && result_num>0 && identify_info!=NULL) { if((label->result_type==pull_result_type) || (pull_result_type==PULL_ALL_RESULT)) { - num=MIN(label->security_result_num, result_num); + int num=MIN(label->security_result_num, result_num); memcpy(result, label->security_result, num*sizeof(Maat_rule_t)); if(label->domain_len>0) @@ -2321,7 +2316,7 @@ int tsg_pull_policy_result(struct streaminfo *a_stream, PULL_RESULT_TYPE pull_re char *tsg_pull_quic_ua(struct streaminfo *a_stream) { - struct policy_priority_label *label=(struct policy_priority_label *)project_req_get_struct(a_stream, g_tsg_para.priority_project_id); + struct policy_priority_label *label=(struct policy_priority_label *)tsg_get_xxx_from_bridge((struct streaminfo *)a_stream, g_tsg_para.bridge[BRIDGE_TYPE_POLICY_PRIORITY].id); if(label!=NULL) { return label->quic_ua; @@ -2332,7 +2327,7 @@ char *tsg_pull_quic_ua(struct streaminfo *a_stream) char *tsg_pull_http_url(struct streaminfo *a_stream) { - struct policy_priority_label *label=(struct policy_priority_label *)project_req_get_struct(a_stream, g_tsg_para.priority_project_id); + struct policy_priority_label *label=(struct policy_priority_label *)tsg_get_xxx_from_bridge((struct streaminfo *)a_stream, g_tsg_para.bridge[BRIDGE_TYPE_POLICY_PRIORITY].id); if(label!=NULL) { return label->http_url; @@ -2687,13 +2682,12 @@ int tsg_get_vlan_label_id(struct single_layer_vlan_addr *vlan_array, int vlan_ar int tsg_scan_tunnel_id(Maat_feather_t maat_feather, struct Maat_rule_t *result, int result_num, scan_status_t *mid, unsigned long long *bool_id_array, int bool_id_array_idx, int thread_seq) { - int i=0,ret=0; - int maat_ret=0, hit_num=0; + int hit_num=0; struct tunnel_catalog *t_catalog[TUNNEL_CATALOG_MAX]; - ret=Maat_bool_plugin_get_EX_data(g_tsg_maat_feather, g_tsg_para.table_id[TABLE_TUNNEL_CATALOG], bool_id_array, bool_id_array_idx, (void**)(&t_catalog), TUNNEL_CATALOG_MAX); - for(i=0; i<ret; i++) + int ret=Maat_bool_plugin_get_EX_data(g_tsg_maat_feather, g_tsg_para.table_id[TABLE_TUNNEL_CATALOG], bool_id_array, bool_id_array_idx, (void**)(&t_catalog), TUNNEL_CATALOG_MAX); + for(int i=0; i<ret; i++) { - maat_ret=Maat_scan_intval(maat_feather, g_tsg_para.table_id[TABLE_TUNNEL_ID], t_catalog[i]->id, result+hit_num, result_num-hit_num, mid, thread_seq); + int maat_ret=Maat_scan_intval(maat_feather, g_tsg_para.table_id[TABLE_TUNNEL_ID], t_catalog[i]->id, result+hit_num, result_num-hit_num, mid, thread_seq); if(maat_ret>0) { hit_num+=maat_ret; @@ -2880,15 +2874,13 @@ int tsg_scan_nesting_addr(Maat_feather_t maat_feather, const struct streaminfo * //return value: -1: failed, 0: not hit, >0: hit count int tsg_scan_shared_policy(Maat_feather_t maat_feather, const struct streaminfo *a_stream, char *domain, Maat_rule_t *result, int result_num, scan_status_t *mid, int table_id, int thread_seq) { - int ret=0,fqdn_len=0; - if(table_id<0 || domain==NULL) { return 0; } - fqdn_len=get_fqdn_len(domain); - ret=Maat_full_scan_string(g_tsg_maat_feather, table_id, CHARSET_UTF8, domain, fqdn_len, result, NULL, result_num, mid, thread_seq); + int fqdn_len=get_fqdn_len(domain); + int ret=Maat_full_scan_string(g_tsg_maat_feather, table_id, CHARSET_UTF8, domain, fqdn_len, result, NULL, result_num, mid, thread_seq); if(ret>0) { FS_operate(g_tsg_para.fs2_handle, g_tsg_para.fs2_field_id[TSG_FS2_HIT_SHARE], 0, FS_OP_ADD, 1); @@ -2968,9 +2960,7 @@ struct Maat_rule_t *tsg_fetch_deny_rule(Maat_rule_t *result, int result_num) int tsg_get_method_id(char *method) { - int i=0; - - for(i=0; i<TSG_METHOD_TYPE_MAX; i++) + for(int i=0; i<TSG_METHOD_TYPE_MAX; i++) { if(method2index[i].len==(int)strlen(method) && (strncasecmp(method2index[i].type, method, method2index[i].len))==0) { @@ -2983,11 +2973,9 @@ int tsg_get_method_id(char *method) int tsg_get_fqdn_category_id(Maat_feather_t maat_feather, char *fqdn, unsigned int *category_id, int category_id_num, void *logger, int thread_seq) { - int ret=0; - if(category_id!=NULL && category_id_num>0) { - ret=get_fqdn_category_id(maat_feather, g_tsg_para.table_id[TABLE_FQDN_CAT_USER_DEFINED], fqdn, category_id, category_id_num, logger, thread_seq); + int ret=get_fqdn_category_id(maat_feather, g_tsg_para.table_id[TABLE_FQDN_CAT_USER_DEFINED], fqdn, category_id, category_id_num, logger, thread_seq); if(ret>0) { return ret; @@ -3005,16 +2993,16 @@ int tsg_get_fqdn_category_id(Maat_feather_t maat_feather, char *fqdn, unsigned i int tsg_scan_fqdn_category_id(Maat_feather_t maat_feather, const struct streaminfo *a_stream, struct Maat_rule_t *result, int result_num, scan_status_t *mid, int table_id, unsigned int *category_id, int category_id_num, int thread_seq) { - int i=0,ret=0,hit_num=0; - if(table_id<0 || result_num<=0 || category_id==NULL || category_id_num <=0) { return 0; } + + int hit_num=0; - for(i=0; i<category_id_num; i++) + for(int i=0; i<category_id_num; i++) { - ret=Maat_scan_intval(g_tsg_maat_feather, table_id, (unsigned int)category_id[i], result+hit_num, result_num-hit_num, mid, thread_seq); + int ret=Maat_scan_intval(g_tsg_maat_feather, table_id, (unsigned int)category_id[i], result+hit_num, result_num-hit_num, mid, thread_seq); if(ret>0) { MESA_handle_runtime_log(g_tsg_para.logger, @@ -3069,14 +3057,13 @@ int tsg_scan_app_id_policy(Maat_feather_t maat_feather, const struct streaminfo int tsg_scan_app_properties_policy(Maat_feather_t maat_feather, const struct streaminfo *a_stream, struct Maat_rule_t *result, int result_num, scan_status_t *mid, char *property, char *district, int thread_seq) { - int i=0,ret=0; - int ret2=0, hit_num=0; + int hit_num=0; struct Maat_rule_t property_result[MAX_RESULT_NUM]={0}; if(property!=NULL && district!=NULL) { Maat_set_scan_status(g_tsg_maat_feather, mid, MAAT_SET_SCAN_DISTRICT, (void *)district, strlen(district)); - ret=Maat_full_scan_string(g_tsg_maat_feather, + int ret=Maat_full_scan_string(g_tsg_maat_feather, g_tsg_para.table_id[TABLE_SELECTOR_PROPERTIES], CHARSET_UTF8, property, @@ -3087,9 +3074,9 @@ int tsg_scan_app_properties_policy(Maat_feather_t maat_feather, const struct str mid, thread_seq ); - for(i=0; i<ret; i++) + for(int i=0; i<ret; i++) { - ret2=Maat_scan_intval(g_tsg_maat_feather, g_tsg_para.table_id[TABLE_SELECTOR_ID], property_result[i].config_id, result+hit_num, result_num-hit_num, mid, thread_seq); + int ret2=Maat_scan_intval(g_tsg_maat_feather, g_tsg_para.table_id[TABLE_SELECTOR_ID], property_result[i].config_id, result+hit_num, result_num-hit_num, mid, thread_seq); if(ret2>0) { MESA_handle_runtime_log(g_tsg_para.logger, @@ -3327,15 +3314,15 @@ int tsg_notify_hited_monitor_result(const struct streaminfo *a_stream, struct Ma notify_data.type=NOTIFY_TYPE_MIRRORED; notify_data.vlan=&(mirror_profile->vlan); - stream_bridge_sync_data_put(a_stream, g_tsg_para.bridge_id[BRIDGE_TYPE_SEND_CONN_SKETCH_DATA], (void *)&(notify_data)); + stream_bridge_sync_data_put(a_stream, g_tsg_para.bridge[BRIDGE_TYPE_SEND_CONN_SKETCH_DATA].id, (void *)&(notify_data)); mirrored_profile_free(0, (MAAT_PLUGIN_EX_DATA *)&mirror_profile, 0, NULL); } else { notify_data.compile_id=result[i].config_id; notify_data.type=NOTIFY_TYPE_MIRRORED; - notify_data.vlan=&(g_tsg_para.default_vlan); - stream_bridge_sync_data_put(a_stream, g_tsg_para.bridge_id[BRIDGE_TYPE_SEND_CONN_SKETCH_DATA], (void *)&(notify_data)); + notify_data.vlan=&(g_tsg_para.default_vlan); + stream_bridge_sync_data_put(a_stream, g_tsg_para.bridge[BRIDGE_TYPE_SEND_CONN_SKETCH_DATA].id, (void *)&(notify_data)); } } @@ -3344,7 +3331,7 @@ int tsg_notify_hited_monitor_result(const struct streaminfo *a_stream, struct Ma notify_data.compile_id=result[i].config_id; notify_data.type=NOTIFY_TYPE_CAPTURE; notify_data.capture_depth=user_region->capture.depth; - stream_bridge_sync_data_put(a_stream, g_tsg_para.bridge_id[BRIDGE_TYPE_SEND_CONN_SKETCH_DATA], (void *)&(notify_data)); + stream_bridge_sync_data_put(a_stream, g_tsg_para.bridge[BRIDGE_TYPE_SEND_CONN_SKETCH_DATA].id, (void *)&(notify_data)); } tsg_free_compile_user_region(&(result[i]), user_region); @@ -3402,7 +3389,60 @@ int tsg_get_location_type(void) struct umts_user_info *tsg_get_umts_user_info_form_redis(unsigned int teid) { char teid_str[32]={0}; - snprintf(teid_str, sizeof(teid_str), "%d", teid); + snprintf(teid_str, sizeof(teid_str), "%u", teid); return (struct umts_user_info *)Maat_plugin_get_EX_data(g_tsg_dynamic_maat_feather, g_tsg_para.dyn_table_id[DYN_TABLE_GTP_SIGNALING], (const char *)teid_str); } +int tsg_fetch_hited_shaping_result(struct Maat_rule_t *hited_result, int hited_result_num, struct Maat_rule_t *shaping_result, int shaping_result_num) +{ + if(hited_result==NULL || hited_result_num<=0 || shaping_result==NULL || shaping_result_num<=0) + { + return 0; + } + + int result_cnt=0; + for(int i=0; i<hited_result_num; i++) + { + if(hited_result[i].action!=TSG_ACTION_SHAPING) + { + continue; + } + + if(result_cnt>=shaping_result_num) + { + break; + } + + memcpy(&(shaping_result[result_cnt++]), &(hited_result[i]), sizeof(struct Maat_rule_t)); + } + + return result_cnt; + +} + +int tsg_fetch_hited_security_result(struct Maat_rule_t *hited_result, int hited_result_num, struct Maat_rule_t *security_result, int security_result_num) +{ + if(hited_result==NULL || hited_result_num<=0 || security_result==NULL || security_result_num<=0) + { + return 0; + } + + int result_cnt=0; + for(int i=0; i<hited_result_num; i++) + { + if(hited_result[i].action==TSG_ACTION_SHAPING) + { + continue; + } + + if(result_cnt>=security_result_num) + { + break; + } + + memcpy(&(security_result[result_cnt++]), &(hited_result[i]), sizeof(struct Maat_rule_t)); + } + + return result_cnt; +} + diff --git a/src/tsg_send_log.cpp b/src/tsg_send_log.cpp index bd654a7..4ef17b3 100644 --- a/src/tsg_send_log.cpp +++ b/src/tsg_send_log.cpp @@ -117,7 +117,7 @@ static int register_topic(struct tsg_log_instance_t *instance, struct topic_stat topic_conf=rd_kafka_topic_conf_new(); topic->status=1; - topic->topic_rkt=(rd_kafka_topic_t *)calloc(1, sizeof(rd_kafka_topic_t*)); + //topic->topic_rkt=(rd_kafka_topic_t *)calloc(1, sizeof(rd_kafka_topic_t*)); topic->topic_rkt=rd_kafka_topic_new(_instance->kafka_handle, topic->name, topic_conf); int thread_num=get_thread_count(); @@ -242,12 +242,9 @@ static int is_tunnels(struct streaminfo *a_stream) static int set_isn(struct TLD_handle_t *_handle, struct streaminfo *a_stream, char *field_name, enum MESA_stream_opt type) { - int ret=0; unsigned int isn=0; - int size=sizeof(unsigned long long); - - size=sizeof(unsigned int); - ret=MESA_get_stream_opt(a_stream, type, &isn, &size); + int size=sizeof(isn); + int ret=MESA_get_stream_opt(a_stream, type, &isn, &size); if(ret==0) { TLD_append(_handle, field_name, (void *)(long)isn, TLD_TYPE_LONG); @@ -282,7 +279,7 @@ static int set_tcp_isn(struct tsg_log_instance_t *_instance, struct TLD_handle_t static int set_linkinfo(struct tsg_log_instance_t *_instance, struct TLD_handle_t *_handle, struct streaminfo *a_stream) { - const char *linkinfo=(const char *)stream_bridge_async_data_get(a_stream, _instance->bridge_id[LOG_BRIDGE_MAC_LINKINFO]); + const char *linkinfo=(const char *)tsg_get_xxx_from_bridge(a_stream, _instance->bridge_id[LOG_BRIDGE_MAC_LINKINFO]); if(linkinfo==NULL) { return 0; @@ -320,13 +317,13 @@ static int set_linkinfo(struct tsg_log_instance_t *_instance, struct TLD_handle_ } static int set_asn(struct TLD_handle_t *_handle, struct streaminfo *a_stream, char *field_name, struct asn_info *asn_info) -{ - int len=0; - char buff[1024]={0}; - int buff_len=sizeof(buff); - +{ if(asn_info!=NULL) { + int len=0; + char buff[1024]={0}; + int buff_len=sizeof(buff); + len+=string_cat(buff+len, buff_len-len, asn_info->asn_id); buff[len++]='('; len+=string_cat(buff+len, buff_len-len, asn_info->organization); @@ -339,24 +336,23 @@ static int set_asn(struct TLD_handle_t *_handle, struct streaminfo *a_stream, ch static int set_location(struct TLD_handle_t *_handle, struct streaminfo *a_stream, char *field_name, struct location_info *location_info) { - int len=0; - char buff[1024]={0}; - int buff_len=sizeof(buff); - if(location_info==NULL) { return 0; } - + + int len=0; + char buff[1024]={0}; + int buff_len=sizeof(buff); int location_type=tsg_get_location_type(); switch(location_type) { - case 18: + case 18: len+=string_cat(buff+len, buff_len-len, location_info->city_full); buff[len++]=','; len+=string_cat(buff+len, buff_len-len, location_info->province_full); buff[len++]=','; - len+=string_cat(buff+len, buff_len-len, location_info->country_full); + string_cat(buff+len, buff_len-len, location_info->country_full); break; case 19: len+=string_cat(buff+len, buff_len-len, location_info->country_full); @@ -368,7 +364,7 @@ static int set_location(struct TLD_handle_t *_handle, struct streaminfo *a_strea if(location_info->subdivision_addr!=NULL) { buff[len++]='.'; - len+=string_cat(buff+len, buff_len-len, location_info->subdivision_addr); + string_cat(buff+len, buff_len-len, location_info->subdivision_addr); } break; default: @@ -462,17 +458,16 @@ static int set_tuple4(struct tsg_log_instance_t *_instance, struct TLD_handle_t static int set_duraction(struct tsg_log_instance_t *_instance, struct TLD_handle_t *_handle, struct streaminfo *a_stream) { - int ret=0; long common_con_duration_ms=0; - unsigned long long create_time=0,last_time=0; int size=sizeof(unsigned long long); + unsigned long long create_time=0,last_time=0; if(a_stream->ptcpdetail!=NULL) { TLD_append(_handle, _instance->id2field[LOG_COMMON_START_TIME].name, (void *)(a_stream->ptcpdetail->createtime), TLD_TYPE_LONG); TLD_append(_handle, _instance->id2field[LOG_COMMON_END_TIME].name, (void *)(a_stream->ptcpdetail->lastmtime), TLD_TYPE_LONG); - ret=MESA_get_stream_opt(a_stream, MSO_STREAM_CREATE_TIMESTAMP_MS, (void *)&create_time, &size); + int ret=MESA_get_stream_opt(a_stream, MSO_STREAM_CREATE_TIMESTAMP_MS, (void *)&create_time, &size); if(ret>=0) { ret=MESA_get_stream_opt(a_stream, MSO_STREAM_LASTUPDATE_TIMESTAMP_MS, (void *)&last_time, &size); @@ -631,19 +626,17 @@ static int set_app_identify_info(struct TLD_handle_t *_handle, char *field_name, static int get_app_id_list(Value *app_id_object, struct TLD_handle_t *_handle, const char *field_name, struct gather_app_result *result) { - int i=0,ret=0; - char app_name[512]={0}; - if(result->app_num==0) { return 0; } Value array(kArrayType); - for(i=0; i<result->app_num; i++) - { - Value object(kObjectType); - ret=tsg_app_id2name(result->attributes[i].app_id, app_name, sizeof(app_name), 1); + for(int i=0; i<result->app_num; i++) + { + char app_name[512]={0}; + Value object(kObjectType); + int ret=tsg_app_id2name(result->attributes[i].app_id, app_name, sizeof(app_name), 1); if(ret>0) { add_str_member(_handle, &object, "app_name", app_name); @@ -849,13 +842,10 @@ int set_app_info(struct tsg_log_instance_t *_instance, struct TLD_handle_t *_han int set_app_id(struct tsg_log_instance_t *_instance, struct TLD_handle_t *_handle, struct streaminfo *a_stream) { - char app_name[512]={0}; - - struct gather_app_result *gather_result=NULL; - - gather_result=(struct gather_app_result *)project_req_get_struct(a_stream, g_tsg_para.gather_app_project_id); + struct gather_app_result *gather_result=(struct gather_app_result *)tsg_get_xxx_from_bridge(a_stream, g_tsg_para.bridge[BRIDGE_TYPE_GATHER_APP_RESULT].id); if(gather_result==NULL) - { + { + char app_name[512]={0}; if(tsg_app_id2name(_instance->unknown_app_id, app_name, sizeof(app_name), 0)) { TLD_append(_handle, _instance->id2field[LOG_COMMON_APP_FULL_PATH].name, (void *)app_name, TLD_TYPE_STRING); @@ -1137,36 +1127,36 @@ int TLD_append(struct TLD_handle_t *handle, char *key, void *value, TLD_TYPE typ int TLD_array_append(struct TLD_handle_t *handle, char *key, void **array, int array_num, TLD_TYPE type) { - if(handle==NULL || key==NULL || array_num<=0 || array==NULL || type!=TLD_TYPE_LONG || type!=TLD_TYPE_STRING) - { - return -1; - } + if(handle==NULL || key==NULL || array_num<=0 || array==NULL || (type!=TLD_TYPE_LONG && type!=TLD_TYPE_STRING)) + { + return -1; + } - int i=0; - Value obj_array(kArrayType); - - switch(type) - { - case TLD_TYPE_LONG: - for(i=0; i<array_num; i++) - { - obj_array.PushBack((long)(array[i]), handle->document->GetAllocator()); - } - break; - case TLD_TYPE_STRING: - for(i=0; i<array_num; i++) - { - Value str_value(StringRef((char *)(array[i]), strlen((char *)array[i]))); - obj_array.PushBack(str_value, handle->document->GetAllocator()); - } - break; - default: - return -1; - } + int i=0; + Value obj_array(kArrayType); + + switch(type) + { + case TLD_TYPE_LONG: + for(i=0; i<array_num; i++) + { + obj_array.PushBack((long)(array[i]), handle->document->GetAllocator()); + } + break; + case TLD_TYPE_STRING: + for(i=0; i<array_num; i++) + { + Value str_value(StringRef((char *)(array[i]), strlen((char *)array[i]))); + obj_array.PushBack(str_value, handle->document->GetAllocator()); + } + break; + default: + return -1; + } - add_object_member(handle, handle->document, key, obj_array); + add_object_member(handle, handle->document, key, obj_array); - return 1; + return 1; } struct TLD_handle_t *TLD_duplicate(struct TLD_handle_t *handle) @@ -1221,7 +1211,7 @@ int TLD_convert_json(struct TLD_handle_t *_handle, char *buff, unsigned int buff static int set_mail_eml(struct tsg_log_instance_t *_instance, struct TLD_handle_t *_handle, struct streaminfo *a_stream) { - struct tsg_conn_sketch_notify_data *notify_mail=(struct tsg_conn_sketch_notify_data *)stream_bridge_async_data_get(a_stream, g_tsg_para.bridge_id[BRIDGE_TYPE_RECV_CONN_SKETCH_DATA]); + struct tsg_conn_sketch_notify_data *notify_mail=(struct tsg_conn_sketch_notify_data *)tsg_get_xxx_from_bridge(a_stream, g_tsg_para.bridge[BRIDGE_TYPE_RECV_CONN_SKETCH_DATA].id); if(notify_mail!=NULL && notify_mail->pdata.mail_eml_filename!=NULL && notify_mail->protocol==PROTO_MAIL) { TLD_delete(_handle, _instance->id2field[LOG_COMMON_MAIL_EML_FILE].name); @@ -1235,7 +1225,7 @@ static int set_mail_eml(struct tsg_log_instance_t *_instance, struct TLD_handle_ static int set_s3_filename(struct tsg_log_instance_t *_instance, struct TLD_handle_t *_handle, struct streaminfo *a_stream) { - struct business_notify_data *bnd_label=(struct business_notify_data *)stream_bridge_async_data_get(a_stream, _instance->bridge_id[LOG_BRIDGE_BUSINESS_S3_FILENAME]); + struct business_notify_data *bnd_label=(struct business_notify_data *)tsg_get_xxx_from_bridge(a_stream, _instance->bridge_id[LOG_BRIDGE_BUSINESS_S3_FILENAME]); if(bnd_label==NULL || bnd_label->pdata==NULL) { return 0; @@ -1338,7 +1328,7 @@ static int set_tunnel_ipv4v6_port(struct tsg_log_instance_t *_instance, struct T int set_shaping_rule_ids(struct tsg_log_instance_t *_instance, struct TLD_handle_t *_handle, struct streaminfo *a_stream) { - struct notify_shaping_policy *shaping_label=(struct notify_shaping_policy *)stream_bridge_async_data_get(a_stream, g_tsg_para.bridge_id[BRIDGE_TYPE_NOTIFY_SHAPING_RESULT]); + struct notify_shaping_policy *shaping_label=(struct notify_shaping_policy *)tsg_get_xxx_from_bridge(a_stream, g_tsg_para.bridge[BRIDGE_TYPE_NOTIFY_SHAPING_RESULT].id); if(shaping_label==NULL) { return 0; @@ -1351,10 +1341,14 @@ int set_shaping_rule_ids(struct tsg_log_instance_t *_instance, struct TLD_handle offset+=snprintf(shaping_rule_ids+offset, sizeof(shaping_rule_ids)-offset, "%d,", shaping_label->shaping_result[i].config_id); } - shaping_rule_ids[offset-1]='\0'; - TLD_append(_handle, _instance->id2field[LOG_COMMON_SHAPING_RULE_IDS].name, (void *)shaping_rule_ids, TLD_TYPE_STRING); - - return 1; + if(offset>0) + { + shaping_rule_ids[offset-1]='\0'; + TLD_append(_handle, _instance->id2field[LOG_COMMON_SHAPING_RULE_IDS].name, (void *)shaping_rule_ids, TLD_TYPE_STRING); + return 1; + } + + return 0; } static int set_common_tunnels(struct tsg_log_instance_t *_instance, struct TLD_handle_t *_handle, struct streaminfo *a_stream) @@ -1445,7 +1439,7 @@ static int set_common_tunnels(struct tsg_log_instance_t *_instance, struct TLD_h break; } - ptmp = pfather;; + ptmp=pfather; tunnel_array.PushBack(tunnel_object, _handle->document->GetAllocator()); } @@ -1499,7 +1493,6 @@ int is_multi_hit_same_policy(struct Maat_rule_t *result, int *policy_id, int *po static int set_xxxx_from_user_region(struct TLD_handle_t *_handle, struct tsg_log_instance_t *_instance, struct Maat_rule_t *p_result, int thread_seq) { - int ret=0; cJSON *item=NULL; cJSON *object=NULL; char *user_region=NULL; @@ -1511,7 +1504,7 @@ static int set_xxxx_from_user_region(struct TLD_handle_t *_handle, struct tsg_lo if(p_result->action!=TSG_ACTION_NONE && p_result->serv_def_len>0) { user_region=(char *)dictator_malloc(thread_seq, p_result->serv_def_len+1); - ret=Maat_read_rule(g_tsg_maat_feather, p_result, MAAT_RULE_SERV_DEFINE, user_region, p_result->serv_def_len+1); + int ret=Maat_read_rule(g_tsg_maat_feather, p_result, MAAT_RULE_SERV_DEFINE, user_region, p_result->serv_def_len+1); if(ret==p_result->serv_def_len) { user_region[p_result->serv_def_len]='\0'; @@ -1567,7 +1560,7 @@ int set_application_behavior(struct tsg_log_instance_t *_instance, struct TLD_ha } struct application_behavior *behavior_result=NULL; - behavior_result=(struct application_behavior *)stream_bridge_async_data_get(a_stream, _instance->bridge_id[LOG_BRIDGE_APP_BEHAVIOR_RESULT]); + behavior_result=(struct application_behavior *)tsg_get_xxx_from_bridge(a_stream, _instance->bridge_id[LOG_BRIDGE_APP_BEHAVIOR_RESULT]); if(behavior_result==NULL) { return 0; @@ -1587,7 +1580,7 @@ int set_notify_execution_result(struct tsg_log_instance_t *_instance, struct TLD int i=0; struct tsg_notify_execution_result *execution_result=NULL; - execution_result=(struct tsg_notify_execution_result *)stream_bridge_async_data_get(a_stream, _instance->bridge_id[LOG_BRIDGE_CONN_SKETCH_EXEC_RESULT]); + execution_result=(struct tsg_notify_execution_result *)tsg_get_xxx_from_bridge(a_stream, _instance->bridge_id[LOG_BRIDGE_CONN_SKETCH_EXEC_RESULT]); if(execution_result==NULL) { return 0; @@ -1681,13 +1674,12 @@ int set_session_attributes(struct tsg_log_instance_t *_instance, struct TLD_hand int set_lua_scripts_result(struct tsg_log_instance_t *_instance, struct TLD_handle_t *_handle, struct streaminfo *a_stream) { - int i=0; - struct user_defined_attribute_label *uda_label=(struct user_defined_attribute_label *)stream_bridge_async_data_get(a_stream, _instance->bridge_id[LOG_BRIDGE_APP_LUA_RESULT]); + struct user_defined_attribute_label *uda_label=(struct user_defined_attribute_label *)tsg_get_xxx_from_bridge(a_stream, _instance->bridge_id[LOG_BRIDGE_APP_LUA_RESULT]); if(uda_label!=NULL) { Value array(kArrayType); - for(i=0; i<uda_label->attribute_num; i++) + for(int i=0; i<uda_label->attribute_num; i++) { Value object(kObjectType); switch(uda_label->attribute[i].type) @@ -1715,20 +1707,19 @@ int set_lua_scripts_result(struct tsg_log_instance_t *_instance, struct TLD_hand int TLD_append_streaminfo(struct tsg_log_instance_t *instance, struct TLD_handle_t *handle, struct streaminfo *a_stream) { - int ret=0; - char *addr_proto=NULL; - char stream_id_buff[128]={0}; - unsigned long long stream_id=0; - struct TLD_handle_t *_handle=handle; - struct tsg_log_instance_t *_instance=instance; - - if(_instance==NULL || _handle==NULL || a_stream==NULL) - { - MESA_handle_runtime_log(_instance->logger, RLOG_LV_DEBUG, "TLD_APPEND_STREAM", "instance==NULL || TLD_handle==NULL || addr==NULL"); + if(instance==NULL || handle==NULL || a_stream==NULL) + { + if(instance) + { + MESA_handle_runtime_log(instance->logger, RLOG_LV_DEBUG, "TLD_APPEND_STREAM", "TLD_handle==NULL || addr==NULL"); + } return -1; } + + struct TLD_handle_t *_handle=handle; + struct tsg_log_instance_t *_instance=instance; - ret=set_linkinfo(_instance, _handle, a_stream); + int ret=set_linkinfo(_instance, _handle, a_stream); if(ret==0) { set_direction(_instance, _handle, a_stream); @@ -1748,11 +1739,12 @@ int TLD_append_streaminfo(struct tsg_log_instance_t *instance, struct TLD_handle set_common_tunnels(_instance, _handle, a_stream); } - stream_id=tsg_get_stream_id(a_stream); + unsigned long long stream_id=tsg_get_stream_id(a_stream); + char stream_id_buff[128]={0}; snprintf(stream_id_buff, sizeof(stream_id_buff), "%llu", stream_id); TLD_append(_handle, _instance->id2field[LOG_COMMON_STREAM_TRACE_ID].name, (void *)stream_id_buff, TLD_TYPE_STRING); - addr_proto=(char *)layer_addr_prefix_ntop(a_stream); + char *addr_proto=(char *)layer_addr_prefix_ntop(a_stream); TLD_append(_handle, _instance->id2field[LOG_COMMON_L4_PROTOCOL].name, (void *)addr_proto, TLD_TYPE_STRING); return 0; @@ -1784,7 +1776,7 @@ int load_log_common_field(const char *filename, id2field_t *id2field, struct top continue; } memset(type_name, 0, sizeof(type_name)); - ret=sscanf(line, "%s %s %d", type_name, field_name, &id); + ret=sscanf(line, "%31s %63s %d", type_name, field_name, &id); assert(ret==3); for(i=0; i<TLD_TYPE_MAX; i++) @@ -1863,19 +1855,19 @@ int load_log_common_field(const char *filename, id2field_t *id2field, struct top struct tsg_log_instance_t *tsg_sendlog_init(const char *conffile, screen_stat_handle_t fs2_handle) { - int i=0,ret=0; - char nic_name[32]={0}; char override_sled_ip[32]={0}; char kafka_errstr[1024]={0}; unsigned int local_ip_nr=0; char bridge_name[LOG_BRIDGE_MAX][128]={0}; - rd_kafka_conf_t *rdkafka_conf = NULL; + rd_kafka_conf_t *rdkafka_conf = NULL; + char broker_list[1024]={0}; struct tsg_log_instance_t *_instance=NULL; - + char common_field_file[128]={0}; + char log_path[128]={0}; _instance=(struct tsg_log_instance_t *)calloc(1, sizeof(struct tsg_log_instance_t)); _instance->fs2_handle=fs2_handle; - for(i=0; i<LOG_FS2_TYPE_MAX; i++) + for(int i=0; i<LOG_FS2_TYPE_MAX; i++) { _instance->fs2_field_id[i]=FS_register(_instance->fs2_handle, FS_STYLE_FIELD, FS_CALC_SPEED, g_log_fs2_field[i].name); } @@ -1891,7 +1883,7 @@ struct tsg_log_instance_t *tsg_sendlog_init(const char *conffile, screen_stat_ha _instance->sum_line_id=FS_register(_instance->fs2_handle, FS_STYLE_LINE, FS_CALC_SPEED, "SUM"); MESA_load_profile_int_def(conffile, "TSG_LOG", "LOG_LEVEL",&(_instance->level), 30); - MESA_load_profile_string_def(conffile, "TSG_LOG", "LOG_PATH", _instance->log_path, sizeof(_instance->log_path), "./tsglog/tsglog"); + MESA_load_profile_string_def(conffile, "TSG_LOG", "LOG_PATH", log_path, sizeof(log_path), "./log/tsglog"); MESA_load_profile_int_def(conffile, "TSG_LOG", "SEND_USER_REGION", &(_instance->send_user_region), 0); MESA_load_profile_int_def(conffile, "TSG_LOG", "SEND_DATA_CENTER_SWITCH", &(_instance->send_data_center), 0); MESA_load_profile_int_def(conffile, "TSG_LOG", "SEND_APP_ID_SWITCH", &(_instance->send_app_id), 0); @@ -1909,7 +1901,7 @@ struct tsg_log_instance_t *tsg_sendlog_init(const char *conffile, screen_stat_ha MESA_load_profile_string_def(conffile, "SYSTEM", "APP_BEHAVIOR_BRIDGE_NAME", bridge_name[LOG_BRIDGE_APP_BEHAVIOR_RESULT], sizeof(bridge_name[LOG_BRIDGE_APP_BEHAVIOR_RESULT]), "TSG_APPLICATION_BEHAVIOR"); MESA_load_profile_string_def(conffile, "SYSTEM", "NOTIFY_EXEC_RESULT_BRIDGE_NAME", bridge_name[LOG_BRIDGE_CONN_SKETCH_EXEC_RESULT], sizeof(bridge_name[LOG_BRIDGE_CONN_SKETCH_EXEC_RESULT]), "TSG_NOTIFICATION_EXECUTION_RESULT"); - for(i=0; i<LOG_BRIDGE_MAX; i++) + for(int i=0; i<LOG_BRIDGE_MAX; i++) { _instance->bridge_id[i]=stream_bridge_build(bridge_name[i], "w"); if(_instance->bridge_id[i]<0) @@ -1918,10 +1910,10 @@ struct tsg_log_instance_t *tsg_sendlog_init(const char *conffile, screen_stat_ha } } - _instance->logger=MESA_create_runtime_log_handle(_instance->log_path, _instance->level); + _instance->logger=MESA_create_runtime_log_handle(log_path, _instance->level); if(_instance->logger==NULL) { - printf("MESA_create_runtime_log_handle failed ..., path: %s level: %d", _instance->log_path, _instance->level); + printf("MESA_create_runtime_log_handle failed ..., path: %s level: %d", log_path, _instance->level); return NULL; } @@ -1934,8 +1926,8 @@ struct tsg_log_instance_t *tsg_sendlog_init(const char *conffile, screen_stat_ha MESA_load_profile_int_def(conffile, "TSG_LOG", "RECOVERY_INTERVEL_S", &(_instance->recovery_interval), 30); - MESA_load_profile_string_def(conffile, "TSG_LOG", "COMMON_FIELD_FILE", _instance->common_field_file, sizeof(_instance->common_field_file), NULL); - MESA_load_profile_string_def(conffile, "TSG_LOG", "BROKER_LIST", _instance->broker_list, sizeof(_instance->broker_list), NULL); + MESA_load_profile_string_def(conffile, "TSG_LOG", "COMMON_FIELD_FILE", common_field_file, sizeof(common_field_file), NULL); + MESA_load_profile_string_def(conffile, "TSG_LOG", "BROKER_LIST", broker_list, sizeof(broker_list), NULL); MESA_load_profile_string_def(conffile, "TSG_LOG", "SASL_USERNAME", _instance->sasl_username, sizeof(_instance->sasl_username), ""); //admin MESA_load_profile_string_def(conffile, "TSG_LOG", "SASL_PASSWD", _instance->sasl_passwd, sizeof(_instance->sasl_passwd), ""); @@ -1963,8 +1955,9 @@ struct tsg_log_instance_t *tsg_sendlog_init(const char *conffile, screen_stat_ha char *sled_ip=getenv(override_sled_ip); if(sled_ip==NULL) { + char nic_name[32]={0}; MESA_load_profile_string_def(conffile, "SYSTEM", "NIC_NAME", nic_name, sizeof(nic_name), "lo"); - ret=MESA_get_dev_ipv4(nic_name, (int *)&local_ip_nr); + int ret=MESA_get_dev_ipv4(nic_name, (int *)&local_ip_nr); if(ret<0) { MESA_handle_runtime_log(_instance->logger, @@ -1987,7 +1980,7 @@ struct tsg_log_instance_t *tsg_sendlog_init(const char *conffile, screen_stat_ha rd_kafka_conf_set(rdkafka_conf, "topic.metadata.refresh.interval.ms", _instance->refresh_interval_ms, kafka_errstr, sizeof(kafka_errstr)); rd_kafka_conf_set(rdkafka_conf, "request.required.acks", _instance->require_ack, kafka_errstr, sizeof(kafka_errstr)); rd_kafka_conf_set(rdkafka_conf, "socket.keepalive.enable", "true", kafka_errstr, sizeof(kafka_errstr)); - rd_kafka_conf_set(rdkafka_conf, "bootstrap.servers", _instance->broker_list, kafka_errstr, sizeof(kafka_errstr)); + rd_kafka_conf_set(rdkafka_conf, "bootstrap.servers", broker_list, kafka_errstr, sizeof(kafka_errstr)); if(strlen(_instance->sasl_username)> 0 && strlen(_instance->sasl_passwd)>0) { @@ -2003,11 +1996,11 @@ struct tsg_log_instance_t *tsg_sendlog_init(const char *conffile, screen_stat_ha return NULL; } - load_log_common_field(_instance->common_field_file, _instance->id2field, &(_instance->service2topic), &(_instance->max_service)); + load_log_common_field(common_field_file, _instance->id2field, &(_instance->service2topic), &(_instance->max_service)); if(_instance->service2topic!=NULL) { - for(i=0; i<_instance->max_service; i++) + for(int i=0; i<_instance->max_service; i++) { if(_instance->service2topic[i].type==TLD_TYPE_MAX && strlen(_instance->service2topic[i].name)>0) { @@ -2022,12 +2015,7 @@ struct tsg_log_instance_t *tsg_sendlog_init(const char *conffile, screen_stat_ha } else { - MESA_handle_runtime_log(_instance->logger, - RLOG_LV_FATAL, - "KAFKA_INIT", - "load_log_common_field is error, please check %s", - _instance->common_field_file - ); + MESA_handle_runtime_log(_instance->logger, RLOG_LV_FATAL, "KAFKA_INIT", "load_log_common_field is error, please check %s", common_field_file); } return _instance; @@ -2096,96 +2084,52 @@ void tsg_sendlog_destroy(struct tsg_log_instance_t * instance) return ; } -int tsg_send_log(struct tsg_log_instance_t *instance, struct TLD_handle_t *handle, tsg_log_t *log_msg, int thread_id) +int send_log(struct tsg_log_instance_t *_instance, struct TLD_handle_t *_handle, struct streaminfo *a_stream, struct Maat_rule_t *p_result, int p_result_num, int thread_id) { - int fs_id=0,ret=0; - int i=0,repeat_cnt=0; + int fs_id=0,ret=0,repeat_cnt=0; int policy_id[MAX_RESULT_NUM]={0}; - struct TLD_handle_t *_handle=handle; - struct tsg_log_instance_t *_instance=instance; - - if(_instance==NULL || _handle==NULL || log_msg==NULL) - { - TLD_cancel(handle); - MESA_handle_runtime_log(_instance->logger, RLOG_LV_DEBUG, "TSG_SEND_LOG", " instance==NULL || TLD_handle==NULL || log_msg==NULL "); - return -1; - } - if(_instance->mode==CLOSE) + for(int i=0;i<p_result_num; i++) { - TLD_cancel(handle); - FS_operate(_instance->fs2_handle, _instance->sum_line_id, _instance->fs2_field_id[LOG_COLUMN_STATUS_DROP], FS_OP_ADD, 1); - MESA_handle_runtime_log(_instance->logger, RLOG_LV_INFO, "TSG_SEND_LOG", "Disable tsg_send_log."); - return 0; - } - - TLD_append_streaminfo(instance, handle, log_msg->a_stream); - TLD_append(_handle, _instance->id2field[LOG_COMMON_SLED_IP].name, (void *)(_instance->local_ip_str), TLD_TYPE_STRING); - if(strlen(g_tsg_para.device_sn)>0) - { - TLD_append(_handle, _instance->id2field[LOG_COMMON_DEVICE_ID].name, (void *)(g_tsg_para.device_sn), TLD_TYPE_STRING); - } - - if(strlen(g_tsg_para.data_center)>0 && _instance->send_data_center==1) - { - TLD_append(_handle, _instance->id2field[LOG_COMMON_DATA_CENTER].name, (void *)(g_tsg_para.data_center), TLD_TYPE_STRING); - } - - if(strlen(g_tsg_para.device_tag)>0) - { - TLD_append(_handle, _instance->id2field[LOG_COMMON_DEVICE_TAG].name, (void *)(g_tsg_para.device_tag), TLD_TYPE_STRING); - } - - TLD_append(_handle, _instance->id2field[LOG_COMMON_TRAFFIC_VSYSTEM_ID].name, (void *)(long)_instance->vsystem_id, TLD_TYPE_LONG); - - set_application_behavior(_instance, _handle, log_msg->a_stream); - - if(log_msg->result[i].service_id==2 && log_msg->a_stream!=NULL) // stream of intercept is NULL - { - set_shaping_rule_ids(_instance, _handle, log_msg->a_stream); - } - - for(i=0;i<log_msg->result_num; i++) - { - if(is_multi_hit_same_policy(&(log_msg->result[i]), policy_id, &repeat_cnt)) + if(is_multi_hit_same_policy(&(p_result[i]), policy_id, &repeat_cnt)) { MESA_handle_runtime_log(_instance->logger, RLOG_LV_DEBUG, "TSG_SEND_LOG", "tsg same log:cfg_id=%d service=%d addr=%s", - log_msg->result[i].config_id, - log_msg->result[i].service_id, - (log_msg->a_stream==NULL ? "" : PRINTADDR(log_msg->a_stream,_instance->level)) + p_result[i].config_id, + p_result[i].service_id, + (a_stream==NULL ? "" : PRINTADDR(a_stream,_instance->level)) ); continue; } - switch(log_msg->result[i].do_log) + switch(p_result[i].do_log) { case LOG_ABORT: MESA_handle_runtime_log(_instance->logger, RLOG_LV_DEBUG, "TSG_SEND_LOG", "tsg abort log:cfg_id=%d service=%d addr=%s", - log_msg->result[i].config_id, - log_msg->result[i].service_id, - (log_msg->a_stream==NULL ? "" : PRINTADDR(log_msg->a_stream,_instance->level)) + p_result[i].config_id, + p_result[i].service_id, + (a_stream==NULL ? "" : PRINTADDR(a_stream,_instance->level)) ); - fs_id=action2fs_id((int)log_msg->result[i].action); + fs_id=action2fs_id((int)p_result[i].action); FS_operate(_instance->fs2_handle, _instance->fs2_field_id[fs_id], 0, FS_OP_ADD, 1); continue; break; case LOG_ALL: - if(log_msg->result[i].action==TSG_ACTION_MONITOR) + if(p_result[i].action==TSG_ACTION_MONITOR) { - set_s3_filename(_instance, _handle, log_msg->a_stream); - set_mail_eml(_instance, _handle, log_msg->a_stream); + set_s3_filename(_instance, _handle, a_stream); + set_mail_eml(_instance, _handle, a_stream); } break; case LOG_NOFILE: - if(log_msg->result[i].action==TSG_ACTION_MONITOR) + if(p_result[i].action==TSG_ACTION_MONITOR) { TLD_delete(_handle, _instance->id2field[LOG_COMMON_MAIL_EML_FILE].name); - TLD_delete(_handle, _instance->id2field[LOG_COMMON_HTTP_REQUEST_S3_FILE].name); + TLD_delete(_handle, _instance->id2field[LOG_COMMON_HTTP_REQUEST_S3_FILE].name); TLD_delete(_handle, _instance->id2field[LOG_COMMON_HTTP_RESPONSE_S3_FILE].name); } break; @@ -2193,39 +2137,39 @@ int tsg_send_log(struct tsg_log_instance_t *instance, struct TLD_handle_t *handl break; } - ret=update_percent(_instance, log_msg->result[i].service_id, LOG_COLUMN_STATUS_DROP, thread_id); + ret=update_percent(_instance, p_result[i].service_id, LOG_COLUMN_STATUS_DROP, thread_id); if(ret==1) { MESA_handle_runtime_log(_instance->logger, RLOG_LV_DEBUG, "TSG_SEND_LOG", "tsg drop log:cfg_id=%d service=%d send_log_percent: %d addr=%s", - log_msg->result[i].config_id, - log_msg->result[i].service_id, - _instance->service2topic[log_msg->result[i].service_id].send_log_percent[thread_id], - (log_msg->a_stream==NULL ? "" : PRINTADDR(log_msg->a_stream,_instance->level)) + p_result[i].config_id, + p_result[i].service_id, + _instance->service2topic[p_result[i].service_id].send_log_percent[thread_id], + (a_stream==NULL ? "" : PRINTADDR(a_stream,_instance->level)) ); continue; } - TLD_append(_handle, _instance->id2field[LOG_COMMON_POLICY_ID].name, (void *)(long)(log_msg->result[i].config_id), TLD_TYPE_LONG); - TLD_append(_handle, _instance->id2field[LOG_COMMON_SERVICE].name, (void *)(long)(log_msg->result[i].service_id), TLD_TYPE_LONG); - TLD_append(_handle, _instance->id2field[LOG_COMMON_ACTION].name, (void *)(long)((unsigned char)log_msg->result[i].action), TLD_TYPE_LONG); + TLD_append(_handle, _instance->id2field[LOG_COMMON_POLICY_ID].name, (void *)(long)(p_result[i].config_id), TLD_TYPE_LONG); + TLD_append(_handle, _instance->id2field[LOG_COMMON_SERVICE].name, (void *)(long)(p_result[i].service_id), TLD_TYPE_LONG); + TLD_append(_handle, _instance->id2field[LOG_COMMON_ACTION].name, (void *)(long)((unsigned char)p_result[i].action), TLD_TYPE_LONG); - set_notify_execution_result(_instance, _handle, log_msg->a_stream, &(log_msg->result[i])); + set_notify_execution_result(_instance, _handle, a_stream, &(p_result[i])); - if(_instance->send_nat_linkinfo && log_msg->result[i].config_id==0 && log_msg->a_stream!=NULL) + if(_instance->send_nat_linkinfo &&p_result[i].config_id==0 && a_stream!=NULL) { - set_nat_linkinfo(_instance, _handle, log_msg->a_stream, _instance->id2field[LOG_COMMON_LINK_INFO_C2S].name, _instance->bridge_id[LOG_BRIDGE_NAT_C2S_LINKINFO]); - set_nat_linkinfo(_instance, _handle, log_msg->a_stream, _instance->id2field[LOG_COMMON_LINK_INFO_S2C].name, _instance->bridge_id[LOG_BRIDGE_NAT_S2C_LINKINFO]); + set_nat_linkinfo(_instance, _handle, a_stream, _instance->id2field[LOG_COMMON_LINK_INFO_C2S].name, _instance->bridge_id[LOG_BRIDGE_NAT_C2S_LINKINFO]); + set_nat_linkinfo(_instance, _handle, a_stream, _instance->id2field[LOG_COMMON_LINK_INFO_S2C].name, _instance->bridge_id[LOG_BRIDGE_NAT_S2C_LINKINFO]); } - set_xxxx_from_user_region(_handle, _instance, &(log_msg->result[i]), thread_id); + set_xxxx_from_user_region(_handle, _instance, &(p_result[i]), thread_id); StringBuffer sb(0, 2048); Writer<StringBuffer> writer(sb); _handle->document->Accept(writer); - tsg_send_payload(_instance, log_msg->result[i].service_id, (char *)sb.GetString(), sb.GetSize(), thread_id); + tsg_send_payload(_instance, p_result[i].service_id, (char *)sb.GetString(), sb.GetSize(), thread_id); TLD_delete(_handle, _instance->id2field[LOG_COMMON_POLICY_ID].name); TLD_delete(_handle, _instance->id2field[LOG_COMMON_SERVICE].name); @@ -2233,6 +2177,69 @@ int tsg_send_log(struct tsg_log_instance_t *instance, struct TLD_handle_t *handl TLD_delete(_handle, _instance->id2field[LOG_COMMON_USER_REGION].name); } + return 0; +} + +int tsg_send_log(struct tsg_log_instance_t *instance, struct TLD_handle_t *handle, tsg_log_t *log_msg, int thread_id) +{ + if(instance==NULL || handle==NULL || log_msg==NULL) + { + TLD_cancel(handle); + if(instance!=NULL) + { + MESA_handle_runtime_log(instance->logger, RLOG_LV_DEBUG, "TSG_SEND_LOG", " instance==NULL || TLD_handle==NULL || log_msg==NULL "); + } + return -1; + } + + struct TLD_handle_t *_handle=handle; + struct tsg_log_instance_t *_instance=instance; + + if(_instance->mode==CLOSE) + { + TLD_cancel(handle); + FS_operate(_instance->fs2_handle, _instance->sum_line_id, _instance->fs2_field_id[LOG_COLUMN_STATUS_DROP], FS_OP_ADD, 1); + MESA_handle_runtime_log(_instance->logger, RLOG_LV_INFO, "TSG_SEND_LOG", "Disable tsg_send_log."); + return 0; + } + + TLD_append_streaminfo(instance, handle, log_msg->a_stream); + TLD_append(_handle, _instance->id2field[LOG_COMMON_SLED_IP].name, (void *)(_instance->local_ip_str), TLD_TYPE_STRING); + if(strlen(g_tsg_para.device_sn)>0) + { + TLD_append(_handle, _instance->id2field[LOG_COMMON_DEVICE_ID].name, (void *)(g_tsg_para.device_sn), TLD_TYPE_STRING); + } + + if(strlen(g_tsg_para.data_center)>0 && _instance->send_data_center==1) + { + TLD_append(_handle, _instance->id2field[LOG_COMMON_DATA_CENTER].name, (void *)(g_tsg_para.data_center), TLD_TYPE_STRING); + } + + if(strlen(g_tsg_para.device_tag)>0) + { + TLD_append(_handle, _instance->id2field[LOG_COMMON_DEVICE_TAG].name, (void *)(g_tsg_para.device_tag), TLD_TYPE_STRING); + } + + TLD_append(_handle, _instance->id2field[LOG_COMMON_TRAFFIC_VSYSTEM_ID].name, (void *)(long)_instance->vsystem_id, TLD_TYPE_LONG); + + set_application_behavior(_instance, _handle, log_msg->a_stream); + + if(log_msg->result[0].service_id==2 && log_msg->a_stream!=NULL) // stream of intercept is NULL + { + set_shaping_rule_ids(_instance, _handle, log_msg->a_stream); + } + + send_log(_instance, _handle, log_msg->a_stream, log_msg->result, log_msg->result_num, thread_id); + + //fetch firewall result + struct policy_priority_label *priority_label=(struct policy_priority_label *)tsg_get_xxx_from_bridge(log_msg->a_stream, g_tsg_para.bridge[BRIDGE_TYPE_POLICY_PRIORITY].id); + if(priority_label!=NULL && priority_label->security_result_num>0) + { + send_log(_instance, _handle, log_msg->a_stream, priority_label->security_result, priority_label->security_result_num, thread_id); + free_policy_label(log_msg->a_stream, g_tsg_para.bridge[BRIDGE_TYPE_POLICY_PRIORITY].id, (void *)priority_label); + tsg_set_xxx_to_bridge(log_msg->a_stream, g_tsg_para.bridge[BRIDGE_TYPE_POLICY_PRIORITY].id, NULL); + } + TLD_cancel(handle); return 0; @@ -2248,8 +2255,8 @@ int tsg_register_topic(struct tsg_log_instance_t *instance, char *topic_name) _instance->service2topic=(struct topic_stat *)realloc(_instance->service2topic, (_instance->max_service+1)*sizeof(struct topic_stat)); _instance->service2topic[_instance->max_service].type=TLD_TYPE_MAX; - memset(_instance->service2topic[_instance->max_service].name, 0, MAX_STRING_LEN); - memcpy(_instance->service2topic[_instance->max_service].name, topic_name, MIN(MAX_STRING_LEN-1, strlen(topic_name))); + memset(_instance->service2topic[_instance->max_service].name, 0, MAX_STRING_LEN32); + memcpy(_instance->service2topic[_instance->max_service].name, topic_name, MIN(MAX_STRING_LEN32-1, strlen(topic_name))); register_topic(_instance, &(_instance->service2topic[_instance->max_service])); _instance->max_service++; @@ -2308,9 +2315,6 @@ int tsg_send_payload(struct tsg_log_instance_t *instance, int topic_id, char *pa ); } - - - update_percent(_instance, topic_id, LOG_COLUMN_STATUS_MAX, thread_id); return 0; diff --git a/src/tsg_send_log_internal.h b/src/tsg_send_log_internal.h index aeef081..f881845 100644 --- a/src/tsg_send_log_internal.h +++ b/src/tsg_send_log_internal.h @@ -11,7 +11,10 @@ #define MAX_L7_PROTO_ID 150 #define MAX_IPV4_LEN 16 -#define MAX_STRING_LEN 32 + +#ifndef MAX_STRING_LEN32 +#define MAX_STRING_LEN32 32 +#endif enum _SEND_MODE { @@ -181,7 +184,7 @@ typedef struct _id2field { int type; int id; - char name[MAX_STRING_LEN]; + char name[MAX_STRING_LEN32]; }id2field_t; struct topic_stat @@ -190,7 +193,7 @@ struct topic_stat int type; int fs2_line_id; int *send_log_percent; - char name[MAX_STRING_LEN]; + char name[MAX_STRING_LEN32]; long long *drop_start; rd_kafka_topic_t *topic_rkt; }; @@ -215,18 +218,14 @@ struct tsg_log_instance_t int bridge_id[LOG_BRIDGE_MAX]; int fs2_column_id[LOG_COLUMN_STATUS_MAX]; int fs2_field_id[LOG_FS2_TYPE_MAX]; - char log_path[MAX_STRING_LEN*2]; - char tcp_label[MAX_STRING_LEN]; - char udp_label[MAX_STRING_LEN]; - char common_field_file[MAX_STRING_LEN*4]; - char broker_list[MAX_STRING_LEN*8]; - char sasl_username[MAX_STRING_LEN]; - char sasl_passwd[MAX_STRING_LEN]; - char send_queue_max_msg[MAX_STRING_LEN]; - char require_ack[MAX_STRING_LEN]; - char refresh_interval_ms[MAX_STRING_LEN]; + char tcp_label[MAX_STRING_LEN32]; + char udp_label[MAX_STRING_LEN32]; + char sasl_username[MAX_STRING_LEN32]; + char sasl_passwd[MAX_STRING_LEN32]; + char send_queue_max_msg[MAX_STRING_LEN32]; + char require_ack[MAX_STRING_LEN32]; + char refresh_interval_ms[MAX_STRING_LEN32]; char local_ip_str[MAX_IPV4_LEN]; - char l7_proto_id_file[MAX_STRING_LEN*4]; id2field_t id2field[LOG_COMMON_MAX]; rd_kafka_t *kafka_handle; struct topic_stat *service2topic; diff --git a/src/tsg_ssl_utils.cpp b/src/tsg_ssl_utils.cpp index 66cabc2..ca1b3e2 100644 --- a/src/tsg_ssl_utils.cpp +++ b/src/tsg_ssl_utils.cpp @@ -174,13 +174,12 @@ static char* parse_alpn_extension(const unsigned char* buff, size_t buff_len, en static char* parse_server_name_extension(const unsigned char* buff, size_t buff_len, enum chello_parse_result* result) { - size_t pos = 2; /* skip server name list length */ - size_t len; + size_t pos = 2; /* skip server name list length */ char* sni = NULL; - while (pos + 3 < buff_len) + while (pos + 3 < buff_len) { - len = ((size_t)buff[pos + 1] << 8) + (size_t)buff[pos + 2]; - if (pos + 3 + len > buff_len) + size_t len = ((size_t)buff[pos + 1] << 8) + (size_t)buff[pos + 2]; + if (pos + 3 + len > buff_len) { *result = CHELLO_PARSE_INVALID_FORMAT; return NULL; @@ -366,7 +365,7 @@ struct ssl_chello* ssl_chello_parse(const unsigned char* buff, size_t buff_len, *result = CHELLO_PARSE_NOT_ENOUGH_BUFF; return NULL; } - if(buff[1] != 3 || buff[2] > 4 || buff[2] < 0) + if(buff[1] != 3 || buff[2] > 4) { *result = CHELLO_PARSE_INVALID_FORMAT; return NULL; diff --git a/src/tsg_statistic.cpp b/src/tsg_statistic.cpp index 6abfc6b..3372faa 100644 --- a/src/tsg_statistic.cpp +++ b/src/tsg_statistic.cpp @@ -203,9 +203,6 @@ static int _set_traffic_info(struct _traffic_info *from, struct _traffic_info *t } static void *tsg_statistic_thread(void *arg) { - long long value=0; - long long total_value=0; - int value_len=sizeof(long long); int thread_num=get_thread_count(); struct _traffic_info policy_traffic_info; struct _traffic_info total_traffic_info; @@ -215,6 +212,10 @@ static void *tsg_statistic_thread(void *arg) while(g_tsg_statis_para.thread_alive) { + long long value=0; + long long total_value=0; + int value_len=sizeof(long long); + memset(&policy_traffic_info, 0, sizeof(policy_traffic_info)); memset(&total_traffic_info, 0, sizeof(total_traffic_info)); memset(&default_traffic_info, 0, sizeof(default_traffic_info)); @@ -344,9 +345,9 @@ int tsg_statistic_init(const char *conffile, void *logger) int output_prometheus=0; int i=0,value=0,thread_num=0; unsigned short fs_server_port=0; - char app_name[MAX_STRING_LEN]={0}; + char app_name[128]={0}; char fs_server_ip[MAX_IPV4_LEN]={0}; - char fs_output_path[MAX_STRING_LEN*4]={0}; + char fs_output_path[128]={0}; memset(&g_tsg_statis_para, 0, sizeof(g_tsg_statis_para)); @@ -381,7 +382,6 @@ int tsg_statistic_init(const char *conffile, void *logger) FS_set_para(g_tsg_statis_para.fs2_handle, APP_NAME, app_name, strlen(app_name)+1); FS_set_para(g_tsg_statis_para.fs2_handle, OUTPUT_DEVICE, fs_output_path, strlen(fs_output_path)+1); - value=1; FS_set_para(g_tsg_statis_para.fs2_handle, OUTPUT_PROMETHEUS, &output_prometheus, sizeof(output_prometheus)); if(fs_server_port > 0 && strlen(fs_server_ip) > 0) @@ -390,8 +390,8 @@ int tsg_statistic_init(const char *conffile, void *logger) FS_set_para(g_tsg_statis_para.fs2_handle, STATS_SERVER_PORT,&(fs_server_port), sizeof(fs_server_port)); } - value=FS_OUTPUT_INFLUX_LINE; - FS_set_para(g_tsg_statis_para.fs2_handle, STATS_FORMAT, &value, sizeof(value)); + int output_influx_line=FS_OUTPUT_INFLUX_LINE; + FS_set_para(g_tsg_statis_para.fs2_handle, STATS_FORMAT, &output_influx_line, sizeof(output_influx_line)); g_tsg_statis_para.fs_field_id[STATIS_NEW_CON_NUM]=FS_register(g_tsg_statis_para.fs2_handle, FS_STYLE_COLUMN, FS_CALC_SPEED, (char *)"new_conn_num"); g_tsg_statis_para.fs_field_id[STATIS_ESTABLISHED_CON_NUM]=FS_register(g_tsg_statis_para.fs2_handle, FS_STYLE_COLUMN, FS_CALC_CURRENT, (char *)"established_conn_num"); diff --git a/src/tsg_tamper.cpp b/src/tsg_tamper.cpp index 9ddd027..f5f169e 100644 --- a/src/tsg_tamper.cpp +++ b/src/tsg_tamper.cpp @@ -34,8 +34,6 @@ int swap_payload2byte(char *str, int endlen) { - int i = 0; - int j = 0; char temp; if(endlen<4){ //最少满足2个16bit的长度，即最小4字节。 @@ -43,8 +41,8 @@ int swap_payload2byte(char *str, int endlen) } //这样交换是别面校验和不对的问题 - for(i=1; i<endlen; i=i+2){ - for (j=i+2; j<endlen; j=j+2){ + for(int i=1; i<endlen; i=i+2){ + for (int j=i+2; j<endlen; j=j+2){ if(str[i] != str[j]){ temp = str[i]; str[i] = str[j]; diff --git a/src/tsg_variable.cpp b/src/tsg_variable.cpp deleted file mode 100644 index 8a6d55b..0000000 --- a/src/tsg_variable.cpp +++ /dev/null @@ -1,89 +0,0 @@ -#include <stdio.h> -#include <string.h> -#include <stdlib.h> -#include <assert.h> -#include <sys/time.h> -#include <unistd.h> - -#include "tsg_variable.h" - -g_tsg_para_t g_tsg_para; - -id2field_t g_tsg_fs2_field[TSG_FS2_MAX]={{0, TSG_FS2_TCP_LINKS, "tcp_links"}, - {0, TSG_FS2_UDP_LINKS, "udp_links"}, - {0, TSG_FS2_BYPASS, "bypass"}, - {0, TSG_FS2_HIT_ADDR, "hit_addr"}, - {0, TSG_FS2_HIT_SHARE, "hit_share"}, - {0, TSG_FS2_INTERCEPT, "intercept"}, - {0, TSG_FS2_SHAPING, "shaping"}, - {0, TSG_FS2_EXCLUSION, "exclusion"}, - {0, TSG_FS2_APP_DPKT_RESULT, "D_result"}, - {0, TSG_FS2_APP_Q_RESULT, "Q_result"}, - {0, TSG_FS2_APP_USER_RESULT, "U_result"}, - {0, TSG_FS2_APP_BUILT_IN_RESULT, "B_result"}, - {0, TSG_FS2_INJECT_PKT_SUCCESS, "inject_succuess"}, - {0, TSG_FS2_INJECT_PKT_FAILED, "inject_failed"}, - {0, TSG_FS2_MIRRORED_PKT_SUCCESS, "mirror_pkt_suc"}, - {0, TSG_FS2_MIRRORED_BYTE_SUCCESS, "mirror_byte_suc"}, - {0, TSG_FS2_MIRRORED_PKT_FAILED, "mirror_pkt_fai"}, - {0, TSG_FS2_MIRRORED_BYTE_FAILED, "mirror_byte_fai"}, - {0, TSG_FS2_SET_TIMOUT_SUCCESS, "set_timeout_suc"}, - {0, TSG_FS2_SET_TIMOUT_FAILED, "set_timeout_fai"}, - {0, TSG_FS2_SUCESS_TAMPER, "tamper_sucess"}, - {0, TSG_FS2_TAMPER_FAILED_PLOAD_LESS_4, "tamper_nopload"}, - {0, TSG_FS2_TAMPER_FAILED_NOSWAP, "tamper_noswap"}, - {0, TSG_FS2_ASN_ADD, "asn_add"}, - {0, TSG_FS2_ASN_DEL, "asn_del"}, - {0, TSG_FS2_GTPC_ADD, "gtpc_add"}, - {0, TSG_FS2_GTPC_DEL, "gtpc_del"}, - {0, TSG_FS2_LOCATION_ADD, "location_add"}, - {0, TSG_FS2_LOCATION_DEL, "location_del"}, - {0, TSG_FS2_FQDN_ADD, "fqdn_add"}, - {0, TSG_FS2_FQDN_DEL, "fqdn_del"}, - {0, TSG_FS2_SUBSCRIBER_ADD, "subscriber_add"}, - {0, TSG_FS2_SUBSCRIBER_DEL, "subscriber_del"}, - {0, TSG_FS2_SECURIRY_ADD, "security_add"}, - {0, TSG_FS2_SECURIRY_DEL, "security_del"}, - {0, TSG_FS2_MIRRORED_ADD, "mirrored_add"}, - {0, TSG_FS2_MIRRORED_DEL, "mirrored_del"}, - {0, TSG_FS2_HTTP_RES_ADD, "http_res_add"}, - {0, TSG_FS2_HTTP_RES_DEL, "http_res_del"}, - {0, TSG_FS2_DNS_RES_ADD, "dns_profile_add"}, - {0, TSG_FS2_DNS_RES_DEL, "dns_profile_del"}, - {0, TSG_FS2_APP_ID_ADD, "app_id_add"}, - {0, TSG_FS2_APP_ID_DEL, "app_id_del"}, - {0, TSG_FS2_TUNNEL_CATALOG_ADD, "t_catalog_add"}, - {0, TSG_FS2_TUNNEL_CATALOG_DEL, "t_catalog_del"}, - {0, TSG_FS2_TUNNEL_ENDPOINT_ADD, "t_endpoint_add"}, - {0, TSG_FS2_TUNNEL_ENDPOINT_DEL, "t_endpoint_del"}, - {0, TSG_FS2_TUNNEL_LABEL_ADD, "t_label_add"}, - {0, TSG_FS2_TUNNEL_LABEL_DEL, "t_label_del"} - }; - -id2field_t g_tsg_proto_name2id[PROTO_MAX]={{PROTO_UNKONWN, 0, "unknown"}, - {PROTO_IPv4, 0, "IPV4"}, - {PROTO_IPv6, 0, "IPV6"}, - {PROTO_TCP, 0, "TCP"}, - {PROTO_UDP, 0, "UDP"}, - {PROTO_HTTP, 0, "HTTP"}, - {PROTO_MAIL, 0, "MAIL"}, - {PROTO_DNS, 0, "DNS"}, - {PROTO_FTP, 0, "FTP"}, - {PROTO_SSL, 0, "SSL"}, - {PROTO_SIP, 0, "SIP"}, - {PROTO_BGP, 0, "BGP"}, - {PROTO_STREAMING_MEDIA, 0, "STREAMING_MEDIA"}, - {PROTO_QUIC, 0, "QUIC"}, - {PROTO_SSH, 0, "SSH"}, - {PROTO_SMTP, 0, "SMTP"}, - {PROTO_IMAP, 0, "IMAP"}, - {PROTO_POP3, 0, "POP3"}, - {PROTO_RTP, 0, "RTP"}, - {PROTO_APP, 0, "BASE"}, - {PROTO_L2TP, 0, "L2TP"}, - {PROTO_PPTP, 0, "PPTP"}, - {PROTO_STRATUM, 0, "Stratum"}, - {PROTO_RDP, 0, "RDP"}, - {PROTO_DTLS, 0, "DTLS"} - }; - diff --git a/src/tsg_variable.h b/src/tsg_variable.h index 0e4a433..7cff894 100644 --- a/src/tsg_variable.h +++ b/src/tsg_variable.h @@ -1,5 +1,142 @@ #pragma once +#include <MESA/stream.h> +#include <MESA/field_stat2.h> +#include <ctemplate/template.h> + +enum TSG_FS2_TYPE +{ + TSG_FS2_TCP_LINKS=0, + TSG_FS2_UDP_LINKS, + TSG_FS2_BYPASS, + TSG_FS2_HIT_ADDR, + TSG_FS2_HIT_SHARE, + TSG_FS2_INTERCEPT, + TSG_FS2_SHAPING, + TSG_FS2_EXCLUSION, + TSG_FS2_APP_DPKT_RESULT, + TSG_FS2_APP_Q_RESULT, + TSG_FS2_APP_USER_RESULT, + TSG_FS2_APP_BUILT_IN_RESULT, + TSG_FS2_INJECT_PKT_SUCCESS, + TSG_FS2_INJECT_PKT_FAILED, + TSG_FS2_MIRRORED_PKT_SUCCESS, + TSG_FS2_MIRRORED_BYTE_SUCCESS, + TSG_FS2_MIRRORED_PKT_FAILED, + TSG_FS2_MIRRORED_BYTE_FAILED, + TSG_FS2_SET_TIMOUT_SUCCESS, + TSG_FS2_SET_TIMOUT_FAILED, + TSG_FS2_SUCESS_TAMPER, + TSG_FS2_TAMPER_FAILED_PLOAD_LESS_4, + TSG_FS2_TAMPER_FAILED_NOSWAP, + TSG_FS2_ASN_ADD, + TSG_FS2_ASN_DEL, + TSG_FS2_GTPC_ADD, + TSG_FS2_GTPC_DEL, + TSG_FS2_LOCATION_ADD, + TSG_FS2_LOCATION_DEL, + TSG_FS2_FQDN_ADD, + TSG_FS2_FQDN_DEL, + TSG_FS2_SUBSCRIBER_ADD, + TSG_FS2_SUBSCRIBER_DEL, + TSG_FS2_SECURIRY_ADD, + TSG_FS2_SECURIRY_DEL, + TSG_FS2_MIRRORED_ADD, + TSG_FS2_MIRRORED_DEL, + TSG_FS2_HTTP_RES_ADD, + TSG_FS2_HTTP_RES_DEL, + TSG_FS2_DNS_RES_ADD, + TSG_FS2_DNS_RES_DEL, + TSG_FS2_APP_ID_ADD, + TSG_FS2_APP_ID_DEL, + TSG_FS2_TUNNEL_CATALOG_ADD, + TSG_FS2_TUNNEL_CATALOG_DEL, + TSG_FS2_TUNNEL_ENDPOINT_ADD, + TSG_FS2_TUNNEL_ENDPOINT_DEL, + TSG_FS2_TUNNEL_LABEL_ADD, + TSG_FS2_TUNNEL_LABEL_DEL, + TSG_FS2_MAX +}; + + +enum DEPLOY_MODE +{ + DEPLOY_MODE_MIRROR, + DEPLOY_MODE_INLINE, + DEPLOY_MODE_TRANSPARENT, + DEPLOY_MODE_MAX +}; + +enum MASTER_STATIC_TABLE +{ + TABLE_SECURITY_COMPILE=0, + TABLE_IP_ADDR, + TABLE_SUBSCRIBER_ID, + TABLE_APP_ID, + TABLE_HTTP_HOST, + TABLE_SSL_SNI, + TABLE_EXCLUSION_SSL_SNI, + TABLE_SRC_ASN, + TABLE_DST_ASN, + TABLE_SRC_LOCATION, + TABLE_DST_LOCATION, + TABLE_ASN_USER_DEFINED, + TABLE_ASN_BUILT_IN, + TABLE_LOCATION_USER_DEFINED, + TABLE_LOCATION_BUILT_IN, + TABLE_QUIC_SNI, + TABLE_FQDN_CAT_ID, + TABLE_FQDN_CAT_USER_DEFINED, + TABLE_FQDN_CAT_BUILT_IN, + TABLE_APP_ID_DICT, + TABLE_SELECTOR_ID, + TABLE_SELECTOR_PROPERTIES, + TABLE_GTP_APN, + TABLE_GTP_IMSI, + TABLE_GTP_PHONE_NUMBER, + TABLE_RESPONSE_PAGES, + TABLE_DNS_PROFILE_RECORD, + TABLE_PROFILE_MIRROR, + TABLE_HTTP_URL, + TABLE_DTLS_SNI, + TABLE_TUNNEL_ID, + TABLE_TUNNEL_CATALOG, + TABLE_TUNNEL_ENDPOINT, + TABLE_TUNNEL_LABEL, + TABLE_SESSION_FLAGS, + TABLE_MAX +}; + +enum MASTER_DYNAMIC_TABLE +{ + DYN_TABLE_SUBSCRIBER_IP=0, + DYN_TABLE_GTP_SIGNALING, + DYN_TABLE_MAX +}; + +#ifndef MIN +#define MIN(a, b) (((a) < (b)) ? (a) : (b)) +#endif + +#ifndef PRINTADDR +#define PRINTADDR(a, b) ((b)<RLOG_LV_FATAL ? printaddr(&(a->addr), a->threadnum) : "") +#endif + +#ifndef MAX_TSG_ALL_RESULT_NUM +#define MAX_TSG_ALL_RESULT_NUM MAX_RESULT_NUM*2 +#endif + +#ifndef MAX_STRING_LEN32 +#define MAX_STRING_LEN32 32 +#endif + +struct id2field +{ + int type; + int id; + char name[MAX_STRING_LEN32]; +}; + struct reset_argv { int pkt_num; @@ -10,7 +147,14 @@ struct reset_argv int remedy; }; -#define _MAX_TABLE_NAME_LEN 64 +#ifndef MAX_TABLE_NAME_LEN +#define MAX_TABLE_NAME_LEN 64 +#endif + +#ifndef MAX_STRING_LEN128 +#define MAX_STRING_LEN128 128 +#endif + typedef struct tsg_para { int level; @@ -32,25 +176,19 @@ typedef struct tsg_para int unknown_app_id; int hit_path_switch; int default_compile_id; - int table_id[TABLE_MAX]; + int table_id[TABLE_MAX]; int dyn_table_id[DYN_TABLE_MAX]; - int priority_project_id; - int shaping_project_id; int session_attribute_project_id; - int context_project_id; - int tcpall_project_id; - int gather_app_project_id; - int bridge_id[BRIDGE_TYPE_MAX]; int proto_flag; //tsg_protocol_t int fs2_field_id[TSG_FS2_MAX]; - char device_sn[MAX_DOMAIN_LEN/8]; - char log_path[MAX_DOMAIN_LEN/8]; - char device_id_command[MAX_DOMAIN_LEN/8]; - char data_center[_MAX_TABLE_NAME_LEN]; - char device_tag[MAX_DOMAIN_LEN/2]; - char table_name[TABLE_MAX][_MAX_TABLE_NAME_LEN]; - char dyn_table_name[DYN_TABLE_MAX][_MAX_TABLE_NAME_LEN]; - char bridge_name[BRIDGE_TYPE_MAX][_MAX_TABLE_NAME_LEN]; + char device_sn[MAX_STRING_LEN128]; + char log_path[MAX_STRING_LEN128]; + char device_id_command[MAX_STRING_LEN128]; + char data_center[MAX_STRING_LEN128]; + char device_tag[MAX_STRING_LEN128]; + char table_name[TABLE_MAX][MAX_TABLE_NAME_LEN]; + char dyn_table_name[DYN_TABLE_MAX][MAX_TABLE_NAME_LEN]; + struct bridge_info bridge[BRIDGE_TYPE_MAX]; void *logger; void *maat_logger; struct reset_argv reset; @@ -66,4 +204,5 @@ typedef struct tsg_para extern g_tsg_para_t g_tsg_para; extern Maat_feather_t g_tsg_dynamic_maat_feather; -extern id2field_t g_tsg_proto_name2id[PROTO_MAX];
\ No newline at end of file +extern struct id2field g_tsg_proto_name2id[PROTO_MAX]; + diff --git a/test/CMakeLists.txt b/test/CMakeLists.txt deleted file mode 100644 index 7554d2f..0000000 --- a/test/CMakeLists.txt +++ /dev/null @@ -1,25 +0,0 @@ -cmake_minimum_required(VERSION 2.8) - - -include_directories(${CMAKE_SOURCE_DIR}/inc) -include_directories(/opt/MESA/include/MESA/) -include_directories(/opt/MESA/include) -include_directories(/usr/include/) - -set(CMAKE_INSTALL_PREFIX /home/mesasoft/sapp_run) - -add_library(tsg_master_gtest SHARED src/tsg_master_gtest_protocol.cpp src/tsg_master_gtest_entry.cpp) -set_target_properties(tsg_master_gtest PROPERTIES PREFIX "") - -add_definitions(-std=c++11) -LINK_DIRECTORIES(/opt/MESA/lib) - -add_executable(master_gtest "src/tsg_master_gtest_main.cpp") -target_compile_options(master_gtest PUBLIC ${MEM_POOL_DEFINITIONS}) -target_link_libraries(master_gtest pthread dl m pcap systemd cjson MESA_prof_load MESA_htable MESA_handle_logger MESA_jump_layer breakpad_mini MESA_field_stat2) -target_link_libraries(master_gtest /home/mesasoft/sapp_run/lib/libsapp_devel.so) -target_link_libraries(master_gtest gtest-static ctemplate-static) - -install(TARGETS master_gtest DESTINATION ${CMAKE_INSTALL_PREFIX}/ COMPONENT EXECUTABLE) - - diff --git a/test/bin/conflist.inf b/test/bin/conflist.inf deleted file mode 100644 index a776f9f..0000000 --- a/test/bin/conflist.inf +++ /dev/null @@ -1,4 +0,0 @@ -[platform] -./plug/platform/tsg_master/tsg_master.inf -[protocol] -[business] diff --git a/test/bin/etc/asymmetric_addr_layer.conf b/test/bin/etc/asymmetric_addr_layer.conf deleted file mode 100644 index 1799588..0000000 --- a/test/bin/etc/asymmetric_addr_layer.conf +++ /dev/null @@ -1,6 +0,0 @@ -vlan[*] -mpls[*] -gre[*] -gtp[*] - - diff --git a/test/bin/etc/asymmetric_presence_layer.conf b/test/bin/etc/asymmetric_presence_layer.conf deleted file mode 100644 index 8fa2136..0000000 --- a/test/bin/etc/asymmetric_presence_layer.conf +++ /dev/null @@ -1,2 +0,0 @@ -# - diff --git a/test/bin/etc/entrylist.conf b/test/bin/etc/entrylist.conf deleted file mode 100644 index 6ec4088..0000000 --- a/test/bin/etc/entrylist.conf +++ /dev/null @@ -1,27 +0,0 @@ -IP -IPV6 -IPV6_RAW -TCP_ALL -TCP -UDP -HTTP -SSL -MAIL -FTP -PHONY -POLLING -IPSEC -L2TP -PPTP -RTP -DNS -GTP -STRATUM -RADIUS -QUIC -RDP -SSH -SOCKS -BGP -DTLS -SIP diff --git a/test/bin/etc/gdev.conf b/test/bin/etc/gdev.conf deleted file mode 100644 index 2441e11..0000000 --- a/test/bin/etc/gdev.conf +++ /dev/null @@ -1,5 +0,0 @@ -[Module] -pcapdevice=ens1f0 -sendto_gdev_card=ens1f0 -sendto_gdev_ip=10.252.20.1 -gdev_status_switch=1 diff --git a/test/bin/etc/gdev_block.conf b/test/bin/etc/gdev_block.conf deleted file mode 100644 index dc5c9e2..0000000 --- a/test/bin/etc/gdev_block.conf +++ /dev/null @@ -1,14 +0,0 @@ -[main] -nfs_proto_stat_path=./log -nfs_ddos_flow_detail_path=./log - -[gdev] -service_type=1 -rule_scope=1 -durable=0 -auth_data=B9840E2442951834 -#phony server -c3_list=10.0.6.201:22; - -c3_server_ip=10.0.6.201 -c3_server_port=22 diff --git a/test/bin/etc/necessary_plug_list.conf b/test/bin/etc/necessary_plug_list.conf deleted file mode 100644 index 5546eee..0000000 --- a/test/bin/etc/necessary_plug_list.conf +++ /dev/null @@ -1,4 +0,0 @@ -#以下插件如果加载,初始化失败, sapp平台会退出; -#插件的路径来自配置文件 ./plug/conflist.inf, 不需要加段落标识[platform],[protocol],[business]等. -#If the following plugins fail to initialize, the sapp platform will exit. -#The name of the plugin comes from the configuration ./plug/conflist.inf, section identification is not required.
\ No newline at end of file diff --git a/test/bin/etc/plugin.conf b/test/bin/etc/plugin.conf deleted file mode 100644 index 10ae034..0000000 --- a/test/bin/etc/plugin.conf +++ /dev/null @@ -1,5 +0,0 @@ -[PLUGIN] -platform_config = ./plug/platform/conflist_platform.inf -protocol_config = ./plug/protocol/conflist_protocol.inf -business_config = ./plug/business/conflist_business.inf -entrylist_config = ./etc/entrylist.conf diff --git a/test/bin/etc/project_list.conf b/test/bin/etc/project_list.conf deleted file mode 100644 index 22bfafb..0000000 --- a/test/bin/etc/project_list.conf +++ /dev/null @@ -1,18 +0,0 @@ -tcp_flow_stat struct -udp_flow_stat struct -tcp_deduce_flow_stat struct -POLICY_PRIORITY struct -ESTABLISH_LATENCY long -MAIL_IDENTIFY int -TSG_MASTER_INTERNAL_LABEL struct -BASIC_PROTO_LABEL struct -SKETCH_TRANS_LAYER_CTX_LABEL struct -SKETCH_PROTO_CTX_LABEL struct -common_link_info_c2s struct -common_link_info_s2c struct -common_link_info struct -JA3_FINGERPRINT_LABEL struct -DKPT_PRO_V2 struct -DPKT_PROJECT_V2 struct -PPROJECT_PRO_V2 struct -DPKT_BHSTAT_PROJECT struct diff --git a/test/bin/etc/sapp.toml b/test/bin/etc/sapp.toml deleted file mode 100644 index 0dafbf6..0000000 --- a/test/bin/etc/sapp.toml +++ /dev/null @@ -1,266 +0,0 @@ -################################################################################################### -# NOTE: # -# The format of this file is toml (https://github.com/cktan/tomlc99) # -# to make vim editor display colorful and human readable, # -# you can create a symbolic links named sapp.ini to sapp.toml, ln -sf sapp.toml sapp.ini # -################################################################################################### - -[SYSTEM] - instance_name = "sapp_v4.2" - -[CPU] -worker_threads=1 - send_only_threads_max=0 -### note, bind_mask, if you do not want to bind thread to special CPU core, keep it empty as [] -### there are two different grammars: -### toml array format: bind_mask=[1,2,3,4,5,11,12,13,14,15] -### MESA_load_profile range format: bind_mask="1-5,11-15" - bind_mask=[] - -[MEM] - dictator_enable=1 - -[PACKET_IO] - [overlay_tunnel_definition] -### note, since 2020-10-01, L2-L3 tunnel(VLAN,MPLS,PPPOE,etc.) is process and offload by mrtunnat, -### after 2020-10-01, sapp support L2-L3 tunnel(VLAN,MPLS,PPPOE,etc.) without mrtunnat. -l2_l3_tunnel_support=0 - -### note, optional value is [none, vxlan] -overlay_mode=none - - [packet_io.feature] - destroy_all_plug_enabled=0 -### note, used to represent inbound or outbound direction value, -### because it comes from Third party device, so it needs to be specified manually, -### if inbound_route_dir=1, then outbound_route_dir=0, vice versa, -### in other words, outbound_route_dir = 1 ^ inbound_route_dir; - inbound_route_dir=1 - -### note, BSD_packet_filter, if you do not want to set any filter rule, keep it empty as "" - BSD_packet_filter="" - -### note, same as tcpdump -Q/-P arg, possible values are `in', `out' and `inout', default is "in" - pcap_capture_direction="in" - -### note, support two mode: "inner_tuple2", "outer_tuple2" - pcap_distmode="inner_tuple2" - -### note, depolyment.mode options: [sys_route, vxlan_by_inline_device, raw_ethernet_single_gateway, raw_ethernet_multi_gateway] -### sys_route: send ip(ipv6) packet by system route table, this is default mode in mirror mode; -### vxlan_by_inline_device: encapsulation inject packet with vxlan, and then send to inline device by udp socket. -### raw_ethernet_single_gateway: send layer2 ethernet packet to specific gateway in same broadcast domain. -### raw_ethernet_multi_gateway: send layer2 ethernet packet to multiple gateway in same broadcast domain. - inject_pkt_mode=sys_route - -### note, this config is valid if inject_pkt_mode==vxlan_by_inline_device, means udp socket src port. - inject_mode_inline_device_sport=54789 - -### note, this config is valid if inject_pkt_mode==raw_ethernet_single_gateway. - inject_mode_single_gateway_device="eth1" -### inject_mode_single_gateway_src_mac has lower priority than get smac from inject_mode_single_gateway_device - inject_mode_single_gateway_src_mac="00:11:22:77:88:99" - inject_mode_single_gateway_dst_mac="00:11:22:33:44:55" - -dumpfile_sleep_time_before_exit=0 - -### note, for example, dst mac is 01:12:34:56:78:90, src src is 02:AA:BB:CC:DD:EE:FF, -### ether[0] is 0x01, dst mac first octet, ether[1] is 0x12, dst mac second octet, -### ether[6] is 0x02, src mac first octet, ether[11] is 0xFF, src mac sixth octet. -### the bit field is from 0 to 7, the 0 is least significant bit, the 7 is most significant bit. - ##extract_linkdir_from_mac_in_mirror_mode="ether[4]:0" ## for Xj example - extract_linkdir_from_mac_in_mirror_mode="" - -### note, depolyment.mode options: [mirror, inline, transparent] - [packet_io.depolyment] - mode=mirror - -### note, interface.type options: [pag, pcap, marsio, tun] -### receive from internal interface, route dir is 0, -### receive from external interface, route dir is 1. - [packet_io.internal.interface] - type=pcap - name="lo" - - [packet_io.external.interface] - type=pcap - name=lo - - [packet_io.polling] - enabled=1 -### note, polling_priority = call sapp_recv_pkt every call polling_entry times, - polling_priority=1 - - [packet_io.under_ddos] -### note, to reduce impact of ddos attack,set some stream bypass, all plugins will not process these streams - stream_bypass_enabled=0 -### note, cpu usage value is percent, for example, config value is 85, means 85%, valid range: [1,100] -### sapp change to bypass state immediately when realtime cpu usage > bypass_trigger_cpu_usage - bypass_trigger_cpu_usage=85 -### note, unit of get_cpu_usage_interval is milliseconds(ms) - get_cpu_usage_interval=500 -### note, use the average of the last $smooth_avg_window times as current realtime value - smooth_avg_window=2 - - decrease_ratio="0.95" - increase_ratio="1.005" -### note, unit of bypass_observe_time is second(s) - recovery_observe_time=30 - - -[PROTOCOL_FEATURE] - ipv6_decapsulation_enabled=1 - ipv6_send_packet_enabled=1 - tcp_drop_pure_ack_pkt=0 - tcp_syn_option_parse_enabled=1 -skip_not_ip_layer_over_eth=0 - skip_gtp_S_PN_E_field_for_inject=0 - -[DUPLICATE_PKT] -[dup_pkt.traffic.original] - original_ipv4_tcp_enabled=1 - original_ipv4_udp_enabled=0 -### note, can't distinguish between duplicate traffic and application retransmit traffic for IPv6 packets, -### so not support IPv6 original duplicate traffic check. - -[dup_pkt.traffic.inject] - inject_all_enabled=1 - -[dup_pkt.parameters] - bloom_capacity=1000000 - bloom_error_rate=0.00001 - bloom_timeout=10 - - -[STREAM] -### note, stream_id_base_time format is "%Y-%m-%d %H:%M:%S" - stream_id_base_time="2021-01-01 00:00:00" - [stream.tcp] -max=1000 -timeout=0 - syn_mandatory=1 -reorder_pkt_max=5 - analyse_option_enabled=1 - tuple4_reuse_time_interval=30 - - meaningful_statistics_minimum_pkt=3 - meaningful_statistics_minimum_byte=5 - special_timeout_ratio=10 - - [stream.tcp.inject] - link_mss=1460 - - [stream.tcp.inject.rst] - auto_remedy=1 - number=1 - signature_enabled=1 - signature_seed1=65535 - signature_seed2=13 - remedy_kill_tcp_by_inline_device=0 - - [stream.udp] -max=1000 -timeout=0 - meaningful_statistics_minimum_pkt=3 - meaningful_statistics_minimum_byte=5 - special_timeout_ratio=20 - -[PROFILING] -[profiling.pkt_latency] - enabled=0 - accurate_enable=0 -### note, threshold unit is microseconds (us) - threshold=100000 - - [profiling.sanity_check] - raw_pkt_broken_enabled=0 - symbol_conflict_enabled=0 - - [profiling.log] - level=20 - interval=1 - - [profiling.log.local] - enabled=1 -### note, if "file_truncate_open_enabled=1", file will be truncated, otherwise open the file for appending. - file_truncate_enabled = 1 - - [profiling.log.remote] - enabled=0 - server_ip="127.0.0.1" - server_port=8126 - - [profiling.log.remote.field_stat2] -### note, is valid when "remote_send_out_type=field_stat2" -### note, metric_type option value: [default, json] - metric_type = default - app_name=sapp - - [profiling.log.prometheus] - prometheus_enabled=0 - prometheus_port=9273 - prometheus_url_path="/metrics" - -[TOOLS] - [tools.pkt_dump] - enabled=0 -### note, mode options value:[storage, udp_socket] - mode=udp_socket - BSD_packet_filter="" - - [tools.pkt_dump.threads] -### note, if you want enable pkt dump in all thread, set dump_thread_all_enabled=0 -### if dump_thread_all_enabled=0, then use dump_thread_id to specify separate specified thread index. - all_threads_enabled=1 - -### note, dump_thread_id start from 0, max is CPU.worker_threads-1 - dump_thread_id=[0,1,2,3,4] - - [tools.pkt_dump.udp] - command_port=12345 - pkt_dump_ratio=30 - - [tools.pkt_dump.storage] -### note, file path must be double quotation mark extension, for example, path="/dev/shm/pkt_dump" - path="/dev/shm/pkt_dump" -### note, file size unit: MB - file_size_max_per_thread=10000 - -[breakpad] - disable_coredump=0 - enable_breakpad=0 - breakpad_minidump_dir="/tmp/crashreport" - enable_breakpad_upload=0 - breakpad_upload_url="http://127.0.0.1/" - breakpad_upload_tools="/opt/MESA/bin/minidump_upload" - - -### note: -### These configurations format is complex and difficult to describe with toml grammar, -### so, create a independent secondary config file to description specific information. - -[SECONDARY_CONFIG_LINK] -cfg_file_sapp_log="etc/sapp_log.conf" -cfg_file_plug_list="plug/conflist.inf" - cfg_file_project_list="etc/project_list.conf" - cfg_file_entrylist="etc/entrylist.conf" - cfg_file_send_raw_pkt="etc/send_raw_pkt.conf" - cfg_file_vxlan_sport_map="etc/vxlan_sport_service_map.conf" - cfg_file_inline_device="etc/gdev.conf" - cfg_file_necessary_plug_list="etc/necessary_plug_list.conf" - cfg_file_stream_compare_layer="etc/stream_compare_layer.conf" - cfg_file_vlan_flipping="etc/vlan_flipping_map.conf" - cfg_file_asymmetric_addr_layer="etc/asymmetric_addr_layer.conf" - cfg_file_well_known_port="etc/well_known_port.conf" - -[SECONDARY_DATA_LINK] -data_file_sysinfo_log="sysinfo.log" - data_file_field_stat_log="fs2_sysinfo.log" - data_file_inline_keepalive_log="gdev_keeplive_status.log" - data_file_load_plugin_stat_log="load_plugin_stat.log" - data_file_under_ddos_stat_log="under_ddos_stat.log" - data_file_memory_stat_log="memory_used_stat.log" - -[LIBRARY_LINK] - marsio_library_path="/opt/mrzcpd/lib/libmarsio.so" - diff --git a/test/bin/etc/sapp_log.conf b/test/bin/etc/sapp_log.conf deleted file mode 100644 index a0be07f..0000000 --- a/test/bin/etc/sapp_log.conf +++ /dev/null @@ -1,16 +0,0 @@ -[global] -default format = "%d(%c), %V, %U, %m%n" -[levels] -DEBUG=10 -INFO=20 -FATAL=30 -STOP=40 -[formats] -other = "%d(%c), %V, %F, %U, %m%n" -plugin = "%d(%c), %m%n" -[rules] -__log_runtimelog.info "./log/runtimelog.%d(%F)" -__log_runtimelog_plugin.fatal >stdout; plugin -__log_runtimelog_plugin.fatal "./log/plugin.log"; plugin -__log_http_runtime.stop "./log/%c.%d(%F)"; other -!.* "./log/%c.%d(%F)"; other diff --git a/test/bin/etc/send_gdev.conf b/test/bin/etc/send_gdev.conf deleted file mode 100644 index 54b7a0f..0000000 --- a/test/bin/etc/send_gdev.conf +++ /dev/null @@ -1,2 +0,0 @@ -3 10.3.127.1 - diff --git a/test/bin/etc/send_raw_pkt.conf b/test/bin/etc/send_raw_pkt.conf deleted file mode 100644 index a2845b2..0000000 --- a/test/bin/etc/send_raw_pkt.conf +++ /dev/null @@ -1,16 +0,0 @@ -#����ԭʼ��������, -#��ƽ̨���������ڲ�ͬ������, �ײ��������Ҳ��ͬ, -#����ͨģʽ��ʹ����������, DPDKģʽ��ʹ�ö˿ں�, PFRINGģʽ��ʹ��index��, ��������������ģʽ. -#target_id���ڱ�ʾ���ĸ����ն˷���, -#���ڷ��͵����ݰ��ײ�MAC��Ŀ��IP��, ���ϲ����������, ƽֻ̨����������ԭʼ��. -#target_id�൱�����ݿ������� - -#(0:pag,1:pcap,2:dumpfile,3:pfring,4:DPDK,5:ppf,6:NPacket,7:qnf,8:N95,9:pcap-dumpfile-list,10:topsec, -##(11:ipfile, 12:marsio4, 13:agent_smith, 14:dpdk_vxlan, 15:marsio_vxlan, 16:pag_marsio - -#target_id -#0 pag p7p2 eth1 dna0 dpdk ppf npacket qnf n95 eth1 topsec eth1 vxlan_user smith dpdk dpdk pag -#1 pag eth1 eth1 dna0 dpdk ppf npacket qnf n95 eth1 topsec eth1 p7p1 smith dpdk dpdk pag -#2 pag eth1 eth1 dna0 dpdk ppf npacket qnf n95 eth1 topsec eth1 p7p1 smith dpdk dpdk pag -#3 pag eth1 eth1 dna0 dpdk ppf npacket qnf n95 eth1 topsec eth1 p7p2 smith dpdk dpdk pag -#4 pag eth1 eth1 dna0 dpdk ppf npacket qnf n95 eth1 topsec eth1 p7p2 smith dpdk dpdk pag diff --git a/test/bin/etc/send_route.conf b/test/bin/etc/send_route.conf deleted file mode 100644 index f1186c7..0000000 --- a/test/bin/etc/send_route.conf +++ /dev/null @@ -1,3 +0,0 @@ -#dev_id link_id mac_addr -3 2 00:50:56:f3:59:5c - diff --git a/test/bin/etc/stream_compare_layer.conf b/test/bin/etc/stream_compare_layer.conf deleted file mode 100644 index 8fa2136..0000000 --- a/test/bin/etc/stream_compare_layer.conf +++ /dev/null @@ -1,2 +0,0 @@ -# - diff --git a/test/bin/etc/vlan_flipping_map.conf b/test/bin/etc/vlan_flipping_map.conf deleted file mode 100644 index dc637a3..0000000 --- a/test/bin/etc/vlan_flipping_map.conf +++ /dev/null @@ -1,12 +0,0 @@ -#for inline a device vlan flipping -#数据包来自C路由器端, 即C2I(I2E)方向, -#数据包来自I路由器端, 即I2C(E2I)方向, -#平台会根据vlan_id,设置当前包route_dir的值, 以便上层业务插件做两个方向的流量统计, -#如果一对vlan_id写反了, 网络是通的, 但是I2E,E2I的流量统计就颠倒了. -#配置文件格式, pattern: -#来自C路由器vlan_id 来自I路由器vlan_id 是否开启mac地址翻转 -#C_router_vlan_id I_router_vlan_id mac_flipping_enable - -#1001 1002 1 -#1003 1004 1 -#4000 4001 0 diff --git a/test/bin/etc/vxlan_sport_service_map.conf b/test/bin/etc/vxlan_sport_service_map.conf deleted file mode 100644 index 8a48052..0000000 --- a/test/bin/etc/vxlan_sport_service_map.conf +++ /dev/null @@ -1,86 +0,0 @@ -#service-id vpn-id sport-dport -1 101 50000-50016 -2 102 50064-50080 -3 103 50128-50144 -4 104 50192-50208 -5 105 50256-50272 -6 106 50320-50336 -7 107 50384-50384 -8 108 50448-50464 -9 109 50512-50512 -10 110 50576-50592 -11 111 50640-50656 -12 112 50704-50720 -13 113 50768-50784 -14 114 50832-50848 -15 115 50896-50912 -16 116 50960-50960 -17 117 51024-51024 -18 118 51088-51088 -19 119 51152-51168 -20 120 51216-51232 -21 121 51280-51296 -22 122 51344-51360 -23 123 51408-51408 -24 124 51472-51472 -25 125 51536-51536 -26 126 51600-51600 -27 127 51664-51664 -28 128 51728-51728 -29 129 51792-51792 -30 130 51856-51856 -31 131 51920-51920 -32 132 51984-51984 -33 133 52048-52064 -34 134 52112-52128 -35 135 52176-52192 -36 136 52240-52256 -37 137 52304-52320 -38 138 52368-52384 -39 139 52432-52448 -40 140 52496-52512 -41 141 52560-52576 -42 142 52624-52640 -43 143 52688-52704 -44 144 52752-52768 -45 145 52816-52832 -46 146 52880-52896 -47 147 52944-52960 -48 148 53008-53024 -49 149 53072-53088 -50 150 53136-53152 -51 151 53200-53216 -52 152 53264-53280 -53 153 53328-53344 -54 154 53392-53408 -55 155 53456-53472 -56 156 53520-53536 -57 157 53584-53600 -58 158 53648-53664 -59 159 53712-53712 -60 160 53776-53776 -61 161 53840-53840 -62 162 53904-53904 -63 163 53968-53968 -64 164 54032-54032 -65 165 54096-54096 -66 166 54160-54176 -67 167 54224-54240 -68 168 54288-54304 -69 169 54352-54368 -70 170 54416-54432 -71 171 54480-54496 -72 172 54544-54560 -73 173 54608-54624 -74 174 54672-54688 -75 175 54736-54736 -76 176 54800-54800 -77 177 54864-54864 -78 178 54928-54928 -79 179 54992-54992 -80 180 55056-55056 -81 181 55120-55120 -82 182 55184-55184 -83 183 55248-55248 -84 184 55312-55312 -85 185 55376-55376 diff --git a/test/bin/etc/well_known_port.conf b/test/bin/etc/well_known_port.conf deleted file mode 100644 index 5021aef..0000000 --- a/test/bin/etc/well_known_port.conf +++ /dev/null @@ -1,2 +0,0 @@ -[TCP] -[UDP] diff --git a/test/bin/tsg_master_gtest.inf b/test/bin/tsg_master_gtest.inf deleted file mode 100644 index 4337ca6..0000000 --- a/test/bin/tsg_master_gtest.inf +++ /dev/null @@ -1,9 +0,0 @@ -[PLUGINFO] -PLUGNAME=GTEST_MASTER -SO_PATH=./plug/platform/tsg_master_gtest/tsg_master_gtest.so -INIT_FUNC=GTEST_INIT -DESTROY_FUNC=GTEST_UNLOAD - -[TCP_ALL] -FUNC_FLAG=ALL -FUNC_NAME=GTEST_APP_FULL_PATH_1_ENTRY diff --git a/test/src/CMakeLists.txt b/test/src/CMakeLists.txt index 40e398d..b7cba97 100644 --- a/test/src/CMakeLists.txt +++ b/test/src/CMakeLists.txt @@ -9,7 +9,7 @@ include_directories(${PROJECT_SOURCE_DIR}/src/) add_definitions(-std=c++11) LINK_DIRECTORIES(/opt/MESA/lib) -add_executable(gtest_rule ${PROJECT_SOURCE_DIR}/src/tsg_rule.cpp gtest_common.cpp gtest_rule.cpp) +add_executable(gtest_rule ${PROJECT_SOURCE_DIR}/src/tsg_rule.cpp ${PROJECT_SOURCE_DIR}/src/tsg_bridge.cpp ${PROJECT_SOURCE_DIR}/src/tsg_leaky_bucket.cpp gtest_common.cpp gtest_rule.cpp) target_link_libraries(gtest_rule gtest-static ctemplate-static cjson MESA_prof_load MESA_handle_logger MESA_jump_layer MESA_field_stat2 maatframe) set(TSG_MASTER_SRC ${PROJECT_SOURCE_DIR}/src/tsg_entry.cpp @@ -24,7 +24,8 @@ set(TSG_MASTER_SRC ${PROJECT_SOURCE_DIR}/src/tsg_entry.cpp ${PROJECT_SOURCE_DIR}/src/tsg_dns.cpp ${PROJECT_SOURCE_DIR}/src/tsg_icmp.cpp ${PROJECT_SOURCE_DIR}/src/tsg_tamper.cpp + ${PROJECT_SOURCE_DIR}/src/tsg_bridge.cpp ) -add_executable(gtest_master ${TSG_MASTER_SRC} gtest_common.cpp gtest_master.cpp) -target_link_libraries(gtest_master gtest-static ctemplate-static cjson MESA_prof_load MESA_handle_logger MESA_jump_layer MESA_field_stat2 maatframe rdkafka MESA_htable) +add_executable(gtest_master ${TSG_MASTER_SRC} gtest_kafka.cpp gtest_common.cpp gtest_master.cpp) +target_link_libraries(gtest_master gtest-static ctemplate-static cjson MESA_prof_load MESA_handle_logger MESA_jump_layer MESA_field_stat2 maatframe MESA_htable) diff --git a/test/src/gtest_kafka.cpp b/test/src/gtest_kafka.cpp new file mode 100644 index 0000000..641e2b3 --- /dev/null +++ b/test/src/gtest_kafka.cpp @@ -0,0 +1,76 @@ +#include <string.h> +#include <librdkafka/rdkafka.h> + +#ifndef MIN +#define MIN(a,b) ((a)>(b) ? (b) : (a)) +#endif + +int g_kafka_sendlog_cnt=0; +char g_kafka_sendlog[16][1024]={0,0}; + +rd_kafka_conf_t *rd_kafka_conf_new(void) +{ + return (rd_kafka_conf_t *)0x1; +} + +rd_kafka_conf_res_t rd_kafka_conf_set(rd_kafka_conf_t *conf, const char *name, const char *value, char *errstr, size_t errstr_size) +{ + return (rd_kafka_conf_res_t)0x1; +} + +rd_kafka_t *rd_kafka_new(rd_kafka_type_t type, rd_kafka_conf_t *conf, char *errstr, size_t errstr_size) +{ + return (rd_kafka_t *)0x2; +} + +rd_kafka_topic_conf_t* rd_kafka_topic_conf_new(void) +{ + return (rd_kafka_topic_conf_t*)0x3; +} + +rd_kafka_topic_t* rd_kafka_topic_new(rd_kafka_t *rk, const char *topic, rd_kafka_topic_conf_t * conf) +{ + return (rd_kafka_topic_t*)0x4; +} + +void rd_kafka_topic_destroy (rd_kafka_topic_t *rkt) +{ +} + +void rd_kafka_destroy (rd_kafka_t *rk) +{ +} + +rd_kafka_resp_err_t rd_kafka_last_error(void) +{ + return (rd_kafka_resp_err_t)0x5; +} +const char *rd_kafka_err2name(rd_kafka_resp_err_t err) +{ + return "err2name"; +} +const char *rd_kafka_err2str(rd_kafka_resp_err_t err) +{ + return "err2str"; +} + +int rd_kafka_produce(rd_kafka_topic_t *rkt, int32_t partitition, int msgflags, void *payload, size_t len, const void *key, size_t keylen, void *msg_opaque) +{ + int length=MIN(len, sizeof(g_kafka_sendlog[g_kafka_sendlog_cnt])); + memcpy((void *)(g_kafka_sendlog[g_kafka_sendlog_cnt++]), payload, length); + return 0; +} + +int rd_kafka_get_sendlog_cnt(void) +{ + return g_kafka_sendlog_cnt; +} + +const char *rd_kafka_get_sendlog_payload(int idx) +{ + if(idx>g_kafka_sendlog_cnt || idx <0) + { + return NULL; + } + return (const char *)g_kafka_sendlog[idx]; +} diff --git a/test/src/gtest_kafka.h b/test/src/gtest_kafka.h new file mode 100644 index 0000000..45dcbb0 --- /dev/null +++ b/test/src/gtest_kafka.h @@ -0,0 +1,3 @@ +#pragma once + + diff --git a/test/src/gtest_master.cpp b/test/src/gtest_master.cpp index b281b0c..af24f7b 100644 --- a/test/src/gtest_master.cpp +++ b/test/src/gtest_master.cpp @@ -7,6 +7,9 @@ #include "tsg_entry.h" #include <gtest/gtest.h> +extern int rd_kafka_get_sendlog_cnt(void); +extern const char *rd_kafka_get_sendlog_payload(int idx); + TEST(TSGMaster, SetAPPIDHttp) { struct streaminfo a_stream={0}; @@ -16,8 +19,8 @@ TEST(TSGMaster, SetAPPIDHttp) gather_result[ORIGIN_BASIC_PROTOCOL].origin=ORIGIN_BASIC_PROTOCOL; gather_result[ORIGIN_BASIC_PROTOCOL].attributes[0].app_id=67; //HTTP - project_req_add_struct(&a_stream, g_tsg_para.gather_app_project_id, (const void *)gather_result); - struct gather_app_result *get_result=(struct gather_app_result *)project_req_get_struct(&a_stream, g_tsg_para.gather_app_project_id); + tsg_set_xxx_to_bridge(&a_stream, g_tsg_para.bridge[BRIDGE_TYPE_GATHER_APP_RESULT].id, (void *)gather_result); + struct gather_app_result *get_result=(struct gather_app_result *)tsg_get_xxx_from_bridge(&a_stream, g_tsg_para.bridge[BRIDGE_TYPE_GATHER_APP_RESULT].id); EXPECT_NE(nullptr, get_result); EXPECT_EQ(1, get_result[ORIGIN_BASIC_PROTOCOL].app_num); EXPECT_EQ(67, get_result[ORIGIN_BASIC_PROTOCOL].attributes[0].app_id); @@ -32,8 +35,8 @@ TEST(TSGMaster, SetAPPIDHttp) EXPECT_STREQ("{\"common_app_full_path\":\"http\",\"common_app_label\":\"http\"}", app_ids); - project_req_add_struct(&a_stream, g_tsg_para.gather_app_project_id, NULL); - get_result=(struct gather_app_result *)project_req_get_struct(&a_stream, g_tsg_para.gather_app_project_id); + tsg_set_xxx_to_bridge(&a_stream, g_tsg_para.bridge[BRIDGE_TYPE_GATHER_APP_RESULT].id, NULL); + get_result=(struct gather_app_result *)tsg_get_xxx_from_bridge(&a_stream, g_tsg_para.bridge[BRIDGE_TYPE_GATHER_APP_RESULT].id); EXPECT_EQ(nullptr, get_result); } @@ -68,7 +71,7 @@ TEST(TSGMaster, ShapingSetRuleIds) TLD_convert_json(handle, shaping_rule_ids, sizeof(shaping_rule_ids)); EXPECT_STREQ("{\"common_shaping_rule_ids\":\"32,33,34,35,36,37,38,39\"}", shaping_rule_ids); - struct notify_shaping_policy *shaping_label=(struct notify_shaping_policy *)stream_bridge_async_data_get(&a_stream, g_tsg_para.bridge_id[BRIDGE_TYPE_NOTIFY_SHAPING_RESULT]); + struct notify_shaping_policy *shaping_label=(struct notify_shaping_policy *)stream_bridge_async_data_get(&a_stream, g_tsg_para.bridge[BRIDGE_TYPE_NOTIFY_SHAPING_RESULT].id); EXPECT_NE(nullptr, shaping_label); EXPECT_EQ(MAX_RESULT_NUM, shaping_label->shaping_result_num); for(int i=0; i<shaping_label->shaping_result_num; i++) @@ -77,9 +80,9 @@ TEST(TSGMaster, ShapingSetRuleIds) EXPECT_EQ(TSG_ACTION_SHAPING+i, shaping_label->shaping_result[i].config_id); } - free_shaping_result(&a_stream, g_tsg_para.bridge_id[BRIDGE_TYPE_NOTIFY_SHAPING_RESULT], (void *)shaping_label); - stream_bridge_async_data_put(&a_stream, g_tsg_para.bridge_id[BRIDGE_TYPE_NOTIFY_SHAPING_RESULT], NULL); - EXPECT_EQ(nullptr, stream_bridge_async_data_get(&a_stream, g_tsg_para.bridge_id[BRIDGE_TYPE_NOTIFY_SHAPING_RESULT])); + free_shaping_result(&a_stream, g_tsg_para.bridge[BRIDGE_TYPE_NOTIFY_SHAPING_RESULT].id, (void *)shaping_label); + stream_bridge_async_data_put(&a_stream, g_tsg_para.bridge[BRIDGE_TYPE_NOTIFY_SHAPING_RESULT].id, NULL); + EXPECT_EQ(nullptr, stream_bridge_async_data_get(&a_stream, g_tsg_para.bridge[BRIDGE_TYPE_NOTIFY_SHAPING_RESULT].id)); } int shaping_policy_notify_cb(const struct streaminfo *stream, int bridge_id, void *data) @@ -107,7 +110,7 @@ TEST(TSGMaster, ShapingPolicyNotify) shaping_result[i].config_id=TSG_ACTION_SHAPING+i; } - stream_bridge_register_data_sync_cb(g_tsg_para.bridge_id[BRIDGE_TYPE_NOTIFY_SHAPING_RESULT], shaping_policy_notify_cb); + stream_bridge_register_data_sync_cb(g_tsg_para.bridge[BRIDGE_TYPE_NOTIFY_SHAPING_RESULT].id, shaping_policy_notify_cb); tsg_notify_hited_shaping_result(&a_stream, shaping_result, MAX_RESULT_NUM, 0); int shaping_result_num=tsg_pull_shaping_result((struct streaminfo *)&a_stream, shaping_result, MAX_RESULT_NUM); @@ -118,7 +121,7 @@ TEST(TSGMaster, ShapingPolicyNotify) EXPECT_EQ(TSG_ACTION_SHAPING+i, shaping_result[i].config_id); } - struct notify_shaping_policy *shaping_label=(struct notify_shaping_policy *)stream_bridge_async_data_get(&a_stream, g_tsg_para.bridge_id[BRIDGE_TYPE_NOTIFY_SHAPING_RESULT]); + struct notify_shaping_policy *shaping_label=(struct notify_shaping_policy *)stream_bridge_async_data_get(&a_stream, g_tsg_para.bridge[BRIDGE_TYPE_NOTIFY_SHAPING_RESULT].id); EXPECT_NE(nullptr, shaping_label); EXPECT_EQ(MAX_RESULT_NUM, shaping_label->shaping_result_num); for(int i=0; i<shaping_label->shaping_result_num; i++) @@ -127,9 +130,9 @@ TEST(TSGMaster, ShapingPolicyNotify) EXPECT_EQ(TSG_ACTION_SHAPING+i, shaping_label->shaping_result[i].config_id); } - free_shaping_result(&a_stream, g_tsg_para.bridge_id[BRIDGE_TYPE_NOTIFY_SHAPING_RESULT], (void *)shaping_label); - stream_bridge_async_data_put(&a_stream, g_tsg_para.bridge_id[BRIDGE_TYPE_NOTIFY_SHAPING_RESULT], NULL); - EXPECT_EQ(nullptr, stream_bridge_async_data_get(&a_stream, g_tsg_para.bridge_id[BRIDGE_TYPE_NOTIFY_SHAPING_RESULT])); + free_shaping_result(&a_stream, g_tsg_para.bridge[BRIDGE_TYPE_NOTIFY_SHAPING_RESULT].id, (void *)shaping_label); + stream_bridge_async_data_put(&a_stream, g_tsg_para.bridge[BRIDGE_TYPE_NOTIFY_SHAPING_RESULT].id, NULL); + EXPECT_EQ(nullptr, stream_bridge_async_data_get(&a_stream, g_tsg_para.bridge[BRIDGE_TYPE_NOTIFY_SHAPING_RESULT].id)); } int shaping_policy_notify_null_cb(const struct streaminfo *stream, int bridge_id, void *data) @@ -143,10 +146,10 @@ TEST(TSGMaster, ShapingPolicyNotifyNULL) const struct streaminfo a_stream={0}; struct Maat_rule_t shaping_result[MAX_RESULT_NUM]={0}; - stream_bridge_register_data_sync_cb(g_tsg_para.bridge_id[BRIDGE_TYPE_NOTIFY_SHAPING_RESULT], shaping_policy_notify_null_cb); + stream_bridge_register_data_sync_cb(g_tsg_para.bridge[BRIDGE_TYPE_NOTIFY_SHAPING_RESULT].id, shaping_policy_notify_null_cb); tsg_notify_hited_shaping_result(&a_stream, shaping_result, 0, 0); - struct notify_shaping_policy *shaping_label=(struct notify_shaping_policy *)stream_bridge_async_data_get(&a_stream, g_tsg_para.bridge_id[BRIDGE_TYPE_NOTIFY_SHAPING_RESULT]); + struct notify_shaping_policy *shaping_label=(struct notify_shaping_policy *)stream_bridge_async_data_get(&a_stream, g_tsg_para.bridge[BRIDGE_TYPE_NOTIFY_SHAPING_RESULT].id); EXPECT_EQ(nullptr, shaping_label); } @@ -175,7 +178,7 @@ TEST(TSGMaster, ShapingDuplicatePolicyNotify) shaping_result[i].config_id=TSG_ACTION_SHAPING+(i%4); } - stream_bridge_register_data_sync_cb(g_tsg_para.bridge_id[BRIDGE_TYPE_NOTIFY_SHAPING_RESULT], shaping_duplicate_policy_notify_cb); + stream_bridge_register_data_sync_cb(g_tsg_para.bridge[BRIDGE_TYPE_NOTIFY_SHAPING_RESULT].id, shaping_duplicate_policy_notify_cb); tsg_notify_hited_shaping_result(&a_stream, shaping_result, MAX_RESULT_NUM, 0); int shaping_result_num=tsg_pull_shaping_result((struct streaminfo *)&a_stream, shaping_result, MAX_RESULT_NUM); @@ -186,7 +189,7 @@ TEST(TSGMaster, ShapingDuplicatePolicyNotify) EXPECT_EQ(TSG_ACTION_SHAPING+i, shaping_result[i].config_id); } - struct notify_shaping_policy *shaping_label=(struct notify_shaping_policy *)stream_bridge_async_data_get(&a_stream, g_tsg_para.bridge_id[BRIDGE_TYPE_NOTIFY_SHAPING_RESULT]); + struct notify_shaping_policy *shaping_label=(struct notify_shaping_policy *)stream_bridge_async_data_get(&a_stream, g_tsg_para.bridge[BRIDGE_TYPE_NOTIFY_SHAPING_RESULT].id); EXPECT_NE(nullptr, shaping_label); EXPECT_EQ(MAX_RESULT_NUM/2, shaping_label->shaping_result_num); for(int i=0; i<shaping_label->shaping_result_num; i++) @@ -195,9 +198,9 @@ TEST(TSGMaster, ShapingDuplicatePolicyNotify) EXPECT_EQ(TSG_ACTION_SHAPING+i, shaping_label->shaping_result[i].config_id); } - free_shaping_result(&a_stream, g_tsg_para.bridge_id[BRIDGE_TYPE_NOTIFY_SHAPING_RESULT], (void *)shaping_label); - stream_bridge_async_data_put(&a_stream, g_tsg_para.bridge_id[BRIDGE_TYPE_NOTIFY_SHAPING_RESULT], NULL); - EXPECT_EQ(nullptr, stream_bridge_async_data_get(&a_stream, g_tsg_para.bridge_id[BRIDGE_TYPE_NOTIFY_SHAPING_RESULT])); + free_shaping_result(&a_stream, g_tsg_para.bridge[BRIDGE_TYPE_NOTIFY_SHAPING_RESULT].id, (void *)shaping_label); + stream_bridge_async_data_put(&a_stream, g_tsg_para.bridge[BRIDGE_TYPE_NOTIFY_SHAPING_RESULT].id, NULL); + EXPECT_EQ(nullptr, stream_bridge_async_data_get(&a_stream, g_tsg_para.bridge[BRIDGE_TYPE_NOTIFY_SHAPING_RESULT].id)); } TEST(TSGMaster, ShapingDuplicatePolicyMultipleNotify) @@ -211,7 +214,7 @@ TEST(TSGMaster, ShapingDuplicatePolicyMultipleNotify) shaping_result[i].config_id=TSG_ACTION_SHAPING+i; } - stream_bridge_register_data_sync_cb(g_tsg_para.bridge_id[BRIDGE_TYPE_NOTIFY_SHAPING_RESULT], shaping_duplicate_policy_notify_cb); + stream_bridge_register_data_sync_cb(g_tsg_para.bridge[BRIDGE_TYPE_NOTIFY_SHAPING_RESULT].id, shaping_duplicate_policy_notify_cb); // First notify tsg_notify_hited_shaping_result(&a_stream, shaping_result, MAX_RESULT_NUM/2, 0); @@ -223,7 +226,7 @@ TEST(TSGMaster, ShapingDuplicatePolicyMultipleNotify) EXPECT_EQ(TSG_ACTION_SHAPING+i, shaping_result[i].config_id); } - struct notify_shaping_policy *shaping_label=(struct notify_shaping_policy *)stream_bridge_async_data_get(&a_stream, g_tsg_para.bridge_id[BRIDGE_TYPE_NOTIFY_SHAPING_RESULT]); + struct notify_shaping_policy *shaping_label=(struct notify_shaping_policy *)stream_bridge_async_data_get(&a_stream, g_tsg_para.bridge[BRIDGE_TYPE_NOTIFY_SHAPING_RESULT].id); EXPECT_NE(nullptr, shaping_label); EXPECT_EQ(MAX_RESULT_NUM/2, shaping_label->shaping_result_num); for(int i=0; i<shaping_label->shaping_result_num; i++) @@ -242,7 +245,7 @@ TEST(TSGMaster, ShapingDuplicatePolicyMultipleNotify) EXPECT_EQ(TSG_ACTION_SHAPING+i, shaping_result[i].config_id); } - shaping_label=(struct notify_shaping_policy *)stream_bridge_async_data_get(&a_stream, g_tsg_para.bridge_id[BRIDGE_TYPE_NOTIFY_SHAPING_RESULT]); + shaping_label=(struct notify_shaping_policy *)stream_bridge_async_data_get(&a_stream, g_tsg_para.bridge[BRIDGE_TYPE_NOTIFY_SHAPING_RESULT].id); EXPECT_NE(nullptr, shaping_label); EXPECT_EQ(MAX_RESULT_NUM/2, shaping_label->shaping_result_num); for(int i=0; i<shaping_label->shaping_result_num; i++) @@ -251,9 +254,94 @@ TEST(TSGMaster, ShapingDuplicatePolicyMultipleNotify) EXPECT_EQ(TSG_ACTION_SHAPING+i, shaping_label->shaping_result[i].config_id); } - free_shaping_result(&a_stream, g_tsg_para.bridge_id[BRIDGE_TYPE_NOTIFY_SHAPING_RESULT], (void *)shaping_label); - stream_bridge_async_data_put(&a_stream, g_tsg_para.bridge_id[BRIDGE_TYPE_NOTIFY_SHAPING_RESULT], NULL); - EXPECT_EQ(nullptr, stream_bridge_async_data_get(&a_stream, g_tsg_para.bridge_id[BRIDGE_TYPE_NOTIFY_SHAPING_RESULT])); + free_shaping_result(&a_stream, g_tsg_para.bridge[BRIDGE_TYPE_NOTIFY_SHAPING_RESULT].id, (void *)shaping_label); + stream_bridge_async_data_put(&a_stream, g_tsg_para.bridge[BRIDGE_TYPE_NOTIFY_SHAPING_RESULT].id, NULL); + EXPECT_EQ(nullptr, stream_bridge_async_data_get(&a_stream, g_tsg_para.bridge[BRIDGE_TYPE_NOTIFY_SHAPING_RESULT].id)); +} + +TEST(TSGMaster, SecurityPolicySendlog) +{ + const struct streaminfo a_stream={0}; + struct Maat_rule_t security_result[MAX_RESULT_NUM]={0}; + + for(int i=0; i<MAX_RESULT_NUM; i++) + { + security_result[i].do_log=1; + security_result[i].action=TSG_ACTION_MONITOR; + security_result[i].config_id=TSG_ACTION_MONITOR+i; + } + + // First notify + tsg_notify_hited_security_result(&a_stream, security_result, MAX_RESULT_NUM, 0); + + struct policy_priority_label *priority_label=(struct policy_priority_label *)tsg_get_xxx_from_bridge(&a_stream, g_tsg_para.bridge[BRIDGE_TYPE_POLICY_PRIORITY].id); + EXPECT_NE(nullptr, priority_label); + EXPECT_EQ(MAX_RESULT_NUM, priority_label->security_result_num); + for(int i=0; i<priority_label->security_result_num; i++) + { + EXPECT_EQ(TSG_ACTION_MONITOR, priority_label->security_result[i].action); + EXPECT_EQ(TSG_ACTION_MONITOR+i, priority_label->security_result[i].config_id); + } + + struct TLD_handle_t * handle=TLD_create(0); + struct Maat_rule_t session_record={0, 2, 1, 0, 0, 0, 0, {0}}; + tsg_log_t log_msg={1, &session_record, (struct streaminfo*)&a_stream}; + tsg_send_log(g_tsg_log_instance, handle, &log_msg, 0); + + int sendlog_cnt=rd_kafka_get_sendlog_cnt(); + EXPECT_EQ(9, sendlog_cnt); + //EXPECT_STREQ("{}", rd_kafka_get_sendlog_payload(0)); + //EXPECT_STREQ("{}", rd_kafka_get_sendlog_payload(1)); + //EXPECT_STREQ("{}", rd_kafka_get_sendlog_payload(2)); + //EXPECT_STREQ("{}", rd_kafka_get_sendlog_payload(3)); + //EXPECT_STREQ("{}", rd_kafka_get_sendlog_payload(4)); + //EXPECT_STREQ("{}", rd_kafka_get_sendlog_payload(5)); + //EXPECT_STREQ("{}", rd_kafka_get_sendlog_payload(6)); + //EXPECT_STREQ("{}", rd_kafka_get_sendlog_payload(7)); + //EXPECT_STREQ("{}", rd_kafka_get_sendlog_payload(8)); + + priority_label=(struct policy_priority_label *)tsg_get_xxx_from_bridge(&a_stream, g_tsg_para.bridge[BRIDGE_TYPE_POLICY_PRIORITY].id); + EXPECT_EQ(nullptr, priority_label); +} + +TEST(TSGMaster, SecurityDuplicatePolicyMultipleNotify) +{ + const struct streaminfo a_stream={0}; + struct Maat_rule_t security_result[MAX_RESULT_NUM]={0}; + + for(int i=0; i<MAX_RESULT_NUM/2; i++) + { + security_result[i].action=TSG_ACTION_MONITOR; + security_result[i].config_id=TSG_ACTION_MONITOR+i; + } + + // First notify + tsg_notify_hited_security_result(&a_stream, security_result, MAX_RESULT_NUM/2, 0); + + struct policy_priority_label *priority_label=(struct policy_priority_label *)tsg_get_xxx_from_bridge(&a_stream, g_tsg_para.bridge[BRIDGE_TYPE_POLICY_PRIORITY].id); + EXPECT_NE(nullptr, priority_label); + EXPECT_EQ(MAX_RESULT_NUM/2, priority_label->security_result_num); + for(int i=0; i<priority_label->security_result_num; i++) + { + EXPECT_EQ(TSG_ACTION_MONITOR, priority_label->security_result[i].action); + EXPECT_EQ(TSG_ACTION_MONITOR+i, priority_label->security_result[i].config_id); + } + + // Second notify + tsg_notify_hited_security_result(&a_stream, security_result, MAX_RESULT_NUM/2, 0); + + priority_label=(struct policy_priority_label *)tsg_get_xxx_from_bridge(&a_stream, g_tsg_para.bridge[BRIDGE_TYPE_POLICY_PRIORITY].id); + EXPECT_NE(nullptr, priority_label); + EXPECT_EQ(MAX_RESULT_NUM/2, priority_label->security_result_num); + for(int i=0; i<priority_label->security_result_num; i++) + { + EXPECT_EQ(TSG_ACTION_MONITOR, priority_label->security_result[i].action); + EXPECT_EQ(TSG_ACTION_MONITOR+i, priority_label->security_result[i].config_id); + } + + free_shaping_result(&a_stream, g_tsg_para.bridge[BRIDGE_TYPE_POLICY_PRIORITY].id, (void *)priority_label); + stream_bridge_async_data_put(&a_stream, g_tsg_para.bridge[BRIDGE_TYPE_POLICY_PRIORITY].id, NULL); + EXPECT_EQ(nullptr, stream_bridge_async_data_get(&a_stream, g_tsg_para.bridge[BRIDGE_TYPE_POLICY_PRIORITY].id)); } int main(int argc, char *argv[]) diff --git a/test/src/gtest_rule.cpp b/test/src/gtest_rule.cpp index 9b346ab..3394a62 100644 --- a/test/src/gtest_rule.cpp +++ b/test/src/gtest_rule.cpp @@ -8,7 +8,7 @@ #include <gtest/gtest.h> g_tsg_para_t g_tsg_para; -id2field_t g_tsg_proto_name2id[PROTO_MAX]={{PROTO_UNKONWN, 0, "unknown"}, +struct id2field g_tsg_proto_name2id[PROTO_MAX]={{PROTO_UNKONWN, 0, "unknown"}, {PROTO_IPv4, 0, "IPV4"}, {PROTO_IPv6, 0, "IPV6"}, {PROTO_TCP, 0, "TCP"}, @@ -35,13 +35,19 @@ id2field_t g_tsg_proto_name2id[PROTO_MAX]={{PROTO_UNKONWN, 0, "unknown"}, {PROTO_DTLS, 0, "DTLS"} }; -unsigned int tsg_l7_protocol_name2id(const char *l7_protocol_name) +int app_identify_result_cb(const struct streaminfo *a_stream, int bridge_id, void *data) { return 0; } -void free_policy_label(int thread_seq, void *project_req_value) +int session_flags_identify_result_cb(const struct streaminfo *a_stream, int bridge_id, void *data) { + return 0; +} + +unsigned int tsg_l7_protocol_name2id(const char *l7_protocol_name) +{ + return 0; } void set_session_attribute_label(const struct streaminfo *a_stream, enum TSG_ATTRIBUTE_TYPE type, void *value, int value_len, int thread_seq) |