diff options
Diffstat (limited to 'src/tsg_send_log.cpp')
| -rw-r--r-- | src/tsg_send_log.cpp | 4502 |
1 files changed, 2253 insertions, 2249 deletions
diff --git a/src/tsg_send_log.cpp b/src/tsg_send_log.cpp index 8141119..751f285 100644 --- a/src/tsg_send_log.cpp +++ b/src/tsg_send_log.cpp @@ -1,2249 +1,2253 @@ -#include <stdio.h> -#include <string.h> -#include <stdlib.h> -#include <assert.h> -#include <time.h> -#include <sys/socket.h> -#include <netinet/in.h> -#include <arpa/inet.h> -#include <net/if.h> -#include <sys/types.h> -#include <sys/ioctl.h> -#include <unistd.h> -#include <pthread.h> -#include <arpa/inet.h> - -#include <MESA/stream.h> -#include <MESA/MESA_prof_load.h> -#include <MESA/MESA_handle_logger.h> - -#include "app_label.h" -#include "tsg_entry.h" -#include "tsg_send_log.h" -#include "tsg_send_log_internal.h" - -#include "rapidjson/document.h" // rapidjson's DOM-style API -#include "rapidjson/prettywriter.h" // for stringify JSON -#include "rapidjson/stringbuffer.h" - - -using namespace rapidjson; -using namespace std; - - -char TSG_SEND_LOG_VERSION_20200729=0; -struct tsg_log_instance_t *g_tsg_log_instance; - -struct TLD_handle_t -{ - int thread_id; - MemoryPoolAllocator<> *valueAllocator; - Document *document; -}; - -id2field_t g_log_fs2_field[LOG_FS2_TYPE_MAX]={ - {0, LOG_FS2_ABORT_ALLOW, "abort_allow"}, - {0, LOG_FS2_ABORT_DENY, "abort_deny"}, - {0, LOG_FS2_ABORT_MONITOR, "abort_monitor"}, - {0, LOG_FS2_ABORT_INTERCEPT, "abort_intercept"}, - {0, LOG_FS2_ABORT_UNKNOWN, "abort_unknown"}, - {0, LOG_FS2_CREATE_LOG_HANDLE, "create_log_cnt"}, - {0, LOG_FS2_DUP_LOG_HANDLE, "dup_log_cnt"}, - {0, LOG_FS2_APPEND_LOG_HANDLE, "append_log_cnt"}, - {0, LOG_FS2_FREE_LOG_HANDLE, "free_log_cnt"}, - {0, LOG_FS2_FREE_RAPID_SIZE, "free_rapid_size"}, - {0, LOG_FS2_FREE_RAPID_CAPACITY, "free_rapid_capacity"} - }; - - -const id2field_t tld_type[TLD_TYPE_MAX]={{TLD_TYPE_UNKNOWN, TLD_TYPE_UNKNOWN, "UNKOWN"}, - {TLD_TYPE_LONG, TLD_TYPE_LONG, "LONG"}, - {TLD_TYPE_STRING, TLD_TYPE_STRING, "STRING"}, - {TLD_TYPE_FILE, TLD_TYPE_FILE, "FILE"}, - {TLD_TYPE_TOPIC, TLD_TYPE_TOPIC, "TOPIC"} - }; - -extern "C" int MESA_get_dev_ipv4(const char *device, int *ip_add); - -static int string_cat(char *dst, int dst_len, char *src) -{ - if(dst==NULL || dst_len<=0 || src==NULL) - { - return 0; - } - - return snprintf(dst, dst_len, "%s", src); -} - -#define add_number_member add_member -#define add_object_member add_member - -#define add_member(handle, object, key, val) \ - { \ - Value temp_key; \ - temp_key.SetString((key), (handle)->document->GetAllocator()); \ - (object)->AddMember(temp_key, (val), (handle)->document->GetAllocator()); \ - } - -static int copy_rapidjson(struct TLD_handle_t *_handle, char *field_name, const char *json_string) -{ - Document nest_document; - nest_document.Parse(json_string); - - Value p_object(kObjectType); - p_object.CopyFrom(nest_document, _handle->document->GetAllocator()); - - TLD_append(_handle, field_name, (void *)&p_object, TLD_TYPE_OBJECT); - - return 0; -} - -static void add_str_member(struct TLD_handle_t *_handle, Value *object, const char *key, const char *val) -{ - Value temp_key; - Value temp_val; - temp_key.SetString(key, _handle->document->GetAllocator()); - temp_val.SetString(val, _handle->document->GetAllocator()); - object->AddMember(temp_key, temp_val, _handle->document->GetAllocator()); -} - - -static int register_topic(struct tsg_log_instance_t *instance, struct topic_stat *topic) -{ - rd_kafka_topic_conf_t *topic_conf; - struct tsg_log_instance_t *_instance=(struct tsg_log_instance_t *)instance; - - topic_conf=rd_kafka_topic_conf_new(); - topic->status=1; - topic->topic_rkt=(rd_kafka_topic_t *)calloc(1, sizeof(rd_kafka_topic_t*)); - topic->topic_rkt=rd_kafka_topic_new(_instance->kafka_handle, topic->name, topic_conf); - - int thread_num=get_thread_count(); - topic->drop_start=(long long *)calloc(thread_num, sizeof(long long)); - topic->send_log_percent=(int *)calloc(thread_num, sizeof(int)); - - for(int i=0; i<thread_num; i++) - { - topic->send_log_percent[i]=100; - topic->drop_start[i]=get_current_time_ms(); - } - - topic->fs2_line_id=FS_register(_instance->fs2_handle, FS_STYLE_LINE, FS_CALC_SPEED, topic->name); - - return 1; -} - - -static int update_percent(struct tsg_log_instance_t *_instance, int service_id, enum LOG_COLUMN_STATUS column, int thread_id) -{ - long long current_time_ms=get_current_time_ms(); - struct topic_stat *topic=(struct topic_stat *)&(_instance->service2topic[service_id]); - - switch(column) - { - case LOG_COLUMN_STATUS_SUCCESS: - FS_operate(_instance->fs2_handle, topic->fs2_line_id, _instance->fs2_column_id[column], FS_OP_ADD, 1); - FS_operate(_instance->fs2_handle, topic->fs2_line_id, _instance->fs2_column_id[column+1], FS_OP_ADD, 1); - - FS_operate(_instance->fs2_handle, _instance->sum_line_id, _instance->fs2_column_id[column], FS_OP_ADD, 1); - FS_operate(_instance->fs2_handle, _instance->sum_line_id, _instance->fs2_column_id[column+1], FS_OP_ADD, 1); - break; - case LOG_COLUMN_STATUS_FAIL: - FS_operate(_instance->fs2_handle, topic->fs2_line_id, _instance->fs2_column_id[column], FS_OP_ADD, 1); - FS_operate(_instance->fs2_handle, topic->fs2_line_id, _instance->fs2_column_id[column+1], FS_OP_ADD, 1); - - FS_operate(_instance->fs2_handle, _instance->sum_line_id, _instance->fs2_column_id[column], FS_OP_ADD, 1); - FS_operate(_instance->fs2_handle, _instance->sum_line_id, _instance->fs2_column_id[column+1], FS_OP_ADD, 1); - if(current_time_ms - topic->drop_start[thread_id]>=1000) - { - topic->send_log_percent[thread_id]/=2; - topic->drop_start[thread_id]=current_time_ms; - } - break; - case LOG_COLUMN_STATUS_DROP: - if((current_time_ms%100) > topic->send_log_percent[thread_id]) - { - FS_operate(_instance->fs2_handle, topic->fs2_line_id, _instance->fs2_column_id[column], FS_OP_ADD, 1); - FS_operate(_instance->fs2_handle, topic->fs2_line_id, _instance->fs2_column_id[column+1], FS_OP_ADD, 1); - - FS_operate(_instance->fs2_handle, _instance->sum_line_id, _instance->fs2_column_id[column], FS_OP_ADD, 1); - FS_operate(_instance->fs2_handle, _instance->sum_line_id, _instance->fs2_column_id[column+1], FS_OP_ADD, 1); - return 1; - } - break; - case LOG_COLUMN_STATUS_MAX: - if(topic->send_log_percent[thread_id]>=100) - { - break; - } - - if((current_time_ms - topic->drop_start[thread_id]) >= _instance->recovery_interval*1000) - { - topic->send_log_percent[thread_id]++; - topic->drop_start[thread_id]=current_time_ms; - } - break; - default: - break; - } - - return 0; -} - -static struct tsg_log_instance_t *get_log_instance(void) -{ - if(g_tsg_log_instance!=NULL) - { - return g_tsg_log_instance; - } - - return NULL; -} - -static int is_tunnels(struct streaminfo *a_stream) -{ - const struct streaminfo *ptmp = a_stream; - const struct streaminfo *pfather=NULL; - int is_tunnel=0; - - while(ptmp) - { - pfather = ptmp->pfather; - switch(ptmp->addr.addrtype) - { - case ADDR_TYPE_GRE: - case ADDR_TYPE_VLAN: - case ADDR_TYPE_L2TP: - case ADDR_TYPE_PPTP: - case ADDR_TYPE_VXLAN: - case ADDR_TYPE_GPRS_TUNNEL: - case __ADDR_TYPE_IP_PAIR_V4: - case __ADDR_TYPE_IP_PAIR_V6: - is_tunnel=1; - break; - case ADDR_TYPE_MPLS: - if(ptmp->addr.mpls->s2c_layer_num==0 && ptmp->addr.mpls->c2s_layer_num==0) - { - break; - } - is_tunnel=1; - break; - default: - break; - } - - ptmp = pfather; - } - - return is_tunnel; -} - -static int set_isn(struct TLD_handle_t *_handle, struct streaminfo *a_stream, char *field_name, enum MESA_stream_opt type) -{ - int ret=0; - unsigned int isn=0; - int size=sizeof(unsigned long long); - - size=sizeof(unsigned int); - ret=MESA_get_stream_opt(a_stream, type, &isn, &size); - if(ret==0) - { - TLD_append(_handle, field_name, (void *)(long)isn, TLD_TYPE_LONG); - } - - return 1; -} - -static int set_tcp_isn(struct tsg_log_instance_t *_instance, struct TLD_handle_t *_handle, struct streaminfo *a_stream) -{ - if(a_stream->type==STREAM_TYPE_TCP) - { - switch(a_stream->dir) - { - case DIR_C2S: - set_isn(_handle, a_stream, _instance->id2field[LOG_COMMON_TCP_CLIENT_ISN].name, MSO_TCP_ISN_C2S); - break; - case DIR_S2C: - set_isn(_handle, a_stream, _instance->id2field[LOG_COMMON_TCP_SERVER_ISN].name, MSO_TCP_ISN_S2C); - break; - case DIR_DOUBLE: - set_isn(_handle, a_stream, _instance->id2field[LOG_COMMON_TCP_CLIENT_ISN].name, MSO_TCP_ISN_C2S); - set_isn(_handle, a_stream, _instance->id2field[LOG_COMMON_TCP_SERVER_ISN].name, MSO_TCP_ISN_S2C); - break; - default: - break; - } - } - - return 1; -} - -static int set_linkinfo(struct tsg_log_instance_t *_instance, struct TLD_handle_t *_handle, struct streaminfo *a_stream) -{ - const char *linkinfo=(const char *)stream_bridge_async_data_get(a_stream, _instance->bridge_id[LOG_BRIDGE_MAC_LINKINFO]); - if(linkinfo==NULL) - { - return 0; - } - - cJSON *item=NULL; - cJSON *object=cJSON_Parse(linkinfo); - if(object) - { - item=cJSON_GetObjectItem(object, "common_direction"); - if(item!=NULL) - { - TLD_append(_handle, (char *)"common_direction", (void *)(long)(item->valueint), TLD_TYPE_LONG); - } - - item=cJSON_GetObjectItem(object, "common_egress_link_id"); - if(item!=NULL) - { - TLD_append(_handle, (char *)"common_egress_link_id", (void *)(long)(item->valueint), TLD_TYPE_LONG); - } - - item=cJSON_GetObjectItem(object, "common_ingress_link_id"); - if(item!=NULL) - { - TLD_append(_handle, (char *)"common_ingress_link_id", (void *)(long)(item->valueint), TLD_TYPE_LONG); - } - - cJSON_Delete(object); - object=NULL; - - return 1; - } - - return 0; -} - -static int set_asn(struct TLD_handle_t *_handle, struct streaminfo *a_stream, char *field_name, struct asn_info *asn_info) -{ - int len=0; - char buff[1024]={0}; - int buff_len=sizeof(buff); - - if(asn_info!=NULL) - { - len+=string_cat(buff+len, buff_len-len, asn_info->asn_id); - buff[len++]='('; - len+=string_cat(buff+len, buff_len-len, asn_info->organization); - buff[len++]=')'; - TLD_append(_handle, field_name, (void *)buff, TLD_TYPE_STRING); - } - - return 1; -} - -static int set_location(struct TLD_handle_t *_handle, struct streaminfo *a_stream, char *field_name, struct location_info *location_info) -{ - int len=0; - char buff[1024]={0}; - int buff_len=sizeof(buff); - - if(location_info==NULL) - { - return 0; - } - - int location_type=tsg_get_location_type(); - switch(location_type) - { - case 18: - len+=string_cat(buff+len, buff_len-len, location_info->city_full); - buff[len++]=','; - len+=string_cat(buff+len, buff_len-len, location_info->province_full); - buff[len++]=','; - len+=string_cat(buff+len, buff_len-len, location_info->country_full); - break; - case 19: - len+=string_cat(buff+len, buff_len-len, location_info->country_full); - buff[len++]='.'; - len+=string_cat(buff+len, buff_len-len, location_info->province_full); - buff[len++]='.'; - len+=string_cat(buff+len, buff_len-len, location_info->city_full); - - if(location_info->subdivision_addr!=NULL) - { - buff[len++]='.'; - len+=string_cat(buff+len, buff_len-len, location_info->subdivision_addr); - } - break; - default: - return 0; - } - - TLD_append(_handle, field_name, (void *)buff, TLD_TYPE_STRING); - - return 1; -} - -static int set_direction(struct tsg_log_instance_t *_instance, struct TLD_handle_t *_handle, struct streaminfo *a_stream) -{ - int direction=0,i_or_e=0; - - i_or_e=MESA_dir_link_to_human(a_stream->routedir); - switch(a_stream->curdir) - { - case DIR_C2S: - if(i_or_e=='E' || i_or_e=='e') - { - direction='E'; - } - else - { - direction='I'; - } - break; - case DIR_S2C: - if(i_or_e=='E' || i_or_e=='e') - { - direction='I'; - } - else - { - direction='E'; - } - break; - default: - break; - } - - - TLD_append(_handle, _instance->id2field[LOG_COMMON_DIRECTION].name, (void *)(long)direction, TLD_TYPE_LONG); - - return 1; -} - -static int set_address_list(struct tsg_log_instance_t *_instance, struct TLD_handle_t *_handle, struct streaminfo *a_stream) -{ - unsigned short tunnel_type=0; - char nest_addr_buf[1024]; - int tunnel_type_size=sizeof(tunnel_type); - - MESA_get_stream_opt(a_stream, MSO_STREAM_TUNNEL_TYPE, &tunnel_type, &tunnel_type_size); - if(tunnel_type==STREAM_TUNNLE_NON) - { - layer_addr_ntop_r(a_stream,nest_addr_buf, sizeof(nest_addr_buf)); - } - else - { - stream_addr_list_ntop(a_stream,nest_addr_buf, sizeof(nest_addr_buf)); - } - - TLD_append(_handle, _instance->id2field[LOG_COMMON_ADDRESS_LIST].name, (void *)nest_addr_buf, TLD_TYPE_STRING); - - return 1; -} - -static int set_tuple4(struct tsg_log_instance_t *_instance, struct TLD_handle_t *_handle, struct streaminfo *a_stream) -{ - int addr_type=0; - unsigned short c_port=0, s_port=0; - struct layer_addr_ipv4 *ipv4=NULL; - struct layer_addr_ipv6 *ipv6=NULL; - char server_ip[MAX_IPV4_LEN*8]={0}; - char client_ip[MAX_IPV4_LEN*8]={0}; - - switch(a_stream->addr.addrtype) - { - case ADDR_TYPE_IPV4: - case __ADDR_TYPE_IP_PAIR_V4: - ipv4=a_stream->addr.ipv4; - addr_type=4; - c_port=ntohs(ipv4->source); - s_port=ntohs(ipv4->dest); - - inet_ntop(AF_INET, (void *)&ipv4->saddr, client_ip, sizeof(client_ip)); - inet_ntop(AF_INET, (void *)&ipv4->daddr, server_ip, sizeof(server_ip)); - break; - case ADDR_TYPE_IPV6: - case __ADDR_TYPE_IP_PAIR_V6: - ipv6=a_stream->addr.ipv6; - addr_type=6; - c_port=ntohs(ipv6->source); - s_port=ntohs(ipv6->dest); - - inet_ntop(AF_INET6, (void *)ipv6->saddr, client_ip, sizeof(client_ip)); - inet_ntop(AF_INET6, (void *)ipv6->daddr, server_ip, sizeof(server_ip)); - break; - default: - break; - } - - - TLD_append(_handle, _instance->id2field[LOG_COMMON_SERVER_IP].name, (void *)server_ip, TLD_TYPE_STRING); - TLD_append(_handle, _instance->id2field[LOG_COMMON_CLIENT_IP].name, (void *)client_ip, TLD_TYPE_STRING); - TLD_append(_handle, _instance->id2field[LOG_COMMON_SERVER_PORT].name, (void *)(long)s_port, TLD_TYPE_LONG); - TLD_append(_handle, _instance->id2field[LOG_COMMON_CLIENT_PORT].name, (void *)(long)c_port, TLD_TYPE_LONG); - - TLD_append(_handle, _instance->id2field[LOG_COMMON_STREAM_DIR].name, (void *)(long)a_stream->dir, TLD_TYPE_LONG); - TLD_append(_handle, _instance->id2field[LOG_COMMON_ADDRESS_TYPE].name, (void *)(long)addr_type, TLD_TYPE_LONG); - - return 1; -} - -static int set_duraction(struct tsg_log_instance_t *_instance, struct TLD_handle_t *_handle, struct streaminfo *a_stream) -{ - int ret=0; - long common_con_duration_ms=0; - unsigned long long create_time=0,last_time=0; - int size=sizeof(unsigned long long); - - if(a_stream->ptcpdetail!=NULL) - { - TLD_append(_handle, _instance->id2field[LOG_COMMON_START_TIME].name, (void *)(a_stream->ptcpdetail->createtime), TLD_TYPE_LONG); - TLD_append(_handle, _instance->id2field[LOG_COMMON_END_TIME].name, (void *)(a_stream->ptcpdetail->lastmtime), TLD_TYPE_LONG); - - ret=MESA_get_stream_opt(a_stream, MSO_STREAM_CREATE_TIMESTAMP_MS, (void *)&create_time, &size); - if(ret>=0) - { - ret=MESA_get_stream_opt(a_stream, MSO_STREAM_LASTUPDATE_TIMESTAMP_MS, (void *)&last_time, &size); - if(ret>=0 && last_time>create_time) - { - common_con_duration_ms=last_time-create_time; - TLD_append(_handle, _instance->id2field[LOG_COMMON_CON_DURATION_MS].name, (void *)(common_con_duration_ms), TLD_TYPE_LONG); - } - } - } - else - { - time_t cur_time=time(NULL); - TLD_append(_handle, _instance->id2field[LOG_COMMON_START_TIME].name, (void *)cur_time, TLD_TYPE_LONG); - TLD_append(_handle, _instance->id2field[LOG_COMMON_END_TIME].name, (void *)cur_time, TLD_TYPE_LONG); - TLD_append(_handle, _instance->id2field[LOG_COMMON_CON_DURATION_MS].name, (void *)(common_con_duration_ms), TLD_TYPE_LONG); - } - - return 1; -} - -static int set_subscriber_id(struct TLD_handle_t *_handle, char *field_name, struct subscribe_id_info *subscriber) -{ - if(subscriber!=NULL && subscriber->subscribe_id!=NULL) - { - TLD_append(_handle, field_name, (void *)subscriber->subscribe_id, TLD_TYPE_STRING); - return 1; - } - - return 0; -} - -static int set_fqdn_category(struct tsg_log_instance_t *_instance, struct TLD_handle_t *_handle, struct streaminfo *a_stream, unsigned int *category_id, int category_id_num) -{ - int i=0; - if(category_id_num<=0 || category_id==NULL) - { - return 0; - } - - Value array(kArrayType); - for(i=0; i<category_id_num; i++) - { - array.PushBack(category_id[i], _handle->document->GetAllocator()); - } - - TLD_append(_handle, _instance->id2field[LOG_COMMON_FQDN_CATEGORY].name, &array, TLD_TYPE_OBJECT); - - return 1; -} - -static int set_umts_user_info(struct tsg_log_instance_t *_instance, struct TLD_handle_t *_handle, struct streaminfo *a_stream, struct umts_user_info *user_info) -{ - if(user_info==NULL) - { - return 0; - } - - if(user_info->apn!=NULL) - { - TLD_append(_handle, _instance->id2field[LOG_COMMON_GTP_APN].name, (void *)user_info->apn, TLD_TYPE_STRING); - } - - if(user_info->imsi!=NULL) - { - TLD_append(_handle, _instance->id2field[LOG_COMMON_GTP_IMSI].name, (void *)user_info->imsi, TLD_TYPE_STRING); - } - - if(user_info->imei!=NULL) - { - TLD_append(_handle, _instance->id2field[LOG_COMMON_GTP_IMEI].name, (void *)user_info->imei, TLD_TYPE_STRING); - } - - if(user_info->msisdn!=NULL) - { - TLD_append(_handle, _instance->id2field[LOG_COMMON_GTP_MSISDN].name, (void *)user_info->msisdn, TLD_TYPE_STRING); //phone number - } - - return 1; -} - -static int set_packet_bytes(struct tsg_log_instance_t *_instance, struct TLD_handle_t *_handle, struct streaminfo *a_stream) -{ - struct tcp_flow_stat *tflow_project=NULL; - struct udp_flow_stat *uflow_project=NULL; - - switch(a_stream->type) - { - case STREAM_TYPE_TCP: - tflow_project=(struct tcp_flow_stat *)project_req_get_struct(a_stream, _instance->tcp_flow_project_id); - if(tflow_project!=NULL) - { - TLD_append(_handle, _instance->id2field[LOG_COMMON_S2C_PKT_NUM].name, (void *)(long)tflow_project->S2C_all_pkt, TLD_TYPE_LONG); - TLD_append(_handle, _instance->id2field[LOG_COMMON_S2C_BYTE_NUM].name, (void *)(long)tflow_project->S2C_all_byte_raw, TLD_TYPE_LONG); - TLD_append(_handle, _instance->id2field[LOG_COMMON_C2S_PKT_NUM].name, (void *)(long)tflow_project->C2S_all_pkt, TLD_TYPE_LONG); - TLD_append(_handle, _instance->id2field[LOG_COMMON_C2S_BYTE_NUM].name, (void *)(long)tflow_project->C2S_all_byte_raw, TLD_TYPE_LONG); - } - break; - case STREAM_TYPE_UDP: - uflow_project=(struct udp_flow_stat *)project_req_get_struct(a_stream, _instance->udp_flow_project_id); - if(uflow_project!=NULL) - { - TLD_append(_handle, _instance->id2field[LOG_COMMON_S2C_PKT_NUM].name, (void *)(long)uflow_project->S2C_pkt, TLD_TYPE_LONG); - TLD_append(_handle, _instance->id2field[LOG_COMMON_S2C_BYTE_NUM].name, (void *)(long)uflow_project->S2C_all_byte_raw, TLD_TYPE_LONG); - TLD_append(_handle, _instance->id2field[LOG_COMMON_C2S_PKT_NUM].name, (void *)(long)uflow_project->C2S_pkt, TLD_TYPE_LONG); - TLD_append(_handle, _instance->id2field[LOG_COMMON_C2S_BYTE_NUM].name, (void *)(long)uflow_project->C2S_all_byte_raw, TLD_TYPE_LONG); - } - break; - default: - break; - } - - return 1; -} - -static int set_app_identify_info(struct TLD_handle_t *_handle, char *field_name, struct gather_app_result *result) -{ - int i=0,j=0,ret=0; - char app_name[512]={0}; - Value array(kArrayType); - - for(i=ORIGIN_USER_DEFINE; i<ORIGIN_MAX; i++) - { - if(result[i].app_num<=0) - { - continue; - } - - Value object(kObjectType); - for(j=0; j<result[i].app_num; j++) - { - ret=tsg_app_id2name(result[i].attributes[j].app_id, app_name, sizeof(app_name), 0); - if(ret>0) - { - add_str_member(_handle, &object, "app_name", app_name); - } - else - { - object.AddMember("app_name", result[i].attributes[j].app_id, _handle->document->GetAllocator()); - } - object.AddMember("packet_sequence",result[i].attributes[j].packet_sequence, _handle->document->GetAllocator()); - } - - array.PushBack(object, _handle->document->GetAllocator()); - } - - TLD_append(_handle, field_name, &array, TLD_TYPE_OBJECT); - - return 1; -} - -static int get_app_id_list(Value *app_id_object, struct TLD_handle_t *_handle, const char *field_name, struct gather_app_result *result) -{ - int i=0,ret=0; - char app_name[512]={0}; - - if(result->app_num==0) - { - return 0; - } - - Value array(kArrayType); - for(i=0; i<result->app_num; i++) - { - Value object(kObjectType); - ret=tsg_app_id2name(result->attributes[i].app_id, app_name, sizeof(app_name), 1); - if(ret>0) - { - add_str_member(_handle, &object, "app_name", app_name); - } - object.AddMember("app_id", result->attributes[i].app_id, _handle->document->GetAllocator()); - object.AddMember("surrogate_id", result->attributes[i].surrogate_id, _handle->document->GetAllocator()); - object.AddMember("packet_sequence",result->attributes[i].packet_sequence, _handle->document->GetAllocator()); - array.PushBack(object, _handle->document->GetAllocator()); - } - add_object_member(_handle, app_id_object, field_name, array); - - return 1; -} - - -static int set_userdefine_app(struct TLD_handle_t *_handle, char *field_name, struct gather_app_result *result, TLD_TYPE type) -{ - if(result==NULL || result->app_num<=0) - { - return 0; - } - - int i=0; - char app_name[256]={0}; - - Value array(kArrayType); - for(i=0; i<result->app_num; i++) - { - memset(app_name, 0, sizeof(app_name)); - tsg_app_id2name(result->attributes[i].app_id, app_name, sizeof(app_name), 1); - if(strnlen(app_name, sizeof(app_name)) > 0) - { - Value app_name_str; - app_name_str.SetString(app_name, _handle->document->GetAllocator()); - array.PushBack(app_name_str, _handle->document->GetAllocator()); - } - } - - TLD_append(_handle, field_name, &array, TLD_TYPE_OBJECT); - - return 1; -} - -static int get_l7_protocol(struct gather_app_result *result, char *protocol_list, int protocol_list_len, int *flag) -{ - int i=0,offset=0; - char *name=NULL; - - if((*flag)==1) - { - return 0; - } - - for(i=0; i<result->app_num; i++) - { - (*flag)=1; - name=tsg_l7_protocol_id2name(result->attributes[i].app_id); - if(name!=NULL) - { - if(i>0 && offset>0 && (protocol_list_len-offset)>0) - { - protocol_list[offset]='.'; - offset++; - } - offset+=snprintf(protocol_list+offset, protocol_list_len-offset, "%s", name); - } - } - - return 1; -} - -static unsigned int get_userdefine_name(struct gather_app_result *result, char *app_name, int app_name_len, int *flag, int is_joint_parent) -{ - if((*flag)==1 || result->app_num<=0) - { - return 0; - } - - - int i=0; - unsigned int max_app_id=0; - - for(i=0; i< result->app_num; i++) - { - if(max_app_id < result->attributes[i].app_id) - { - max_app_id=result->attributes[i].app_id; - } - } - - (*flag)=1; - tsg_app_id2name(max_app_id, app_name, app_name_len, is_joint_parent); - - return max_app_id; -} - -static int get_app_id(struct gather_app_result *result, unsigned int *app_id, unsigned int *surrogate_id, int *flag) -{ - if(result->app_num>0 && (*flag)==0) - { - (*flag)=1; - (*app_id)=result->attributes[result->app_num-1].app_id; - (*surrogate_id)=result->attributes[result->app_num-1].surrogate_id; - - return 1; - } - - return 0; -} - -static int get_app_name_list(struct gather_app_result *result, char *app_name, int app_name_len, int *flag, int is_joint_parent) -{ - int i=0; - int offset=0; - - if((*flag)==1 || result->app_num<=0) - { - return 0; - } - - for(i=result->app_num-1; i<result->app_num; i++) - { - (*flag)=1; - - if(i>0 && offset>0 && (app_name_len-offset)>0) - { - app_name[offset]='.'; - offset++; - } - - offset+=tsg_app_id2name(result->attributes[i].app_id, app_name+offset, app_name_len-offset, is_joint_parent); - } - - return 1; -} - -static int set_app_id(struct tsg_log_instance_t *_instance, struct TLD_handle_t *_handle, struct streaminfo *a_stream) -{ - int app_id_flag=0; - int l7_protocol_flag=0; - char app_name[512]={0}; - char protocol_list[256]={0}; - - unsigned int one_app_id=0; - unsigned int one_surrogate_id=0; - struct gather_app_result *gather_result=NULL; - - gather_result=(struct gather_app_result *)project_req_get_struct(a_stream, g_tsg_para.gather_app_project_id); - if(gather_result==NULL) - { - TLD_append(_handle, _instance->id2field[LOG_COMMON_L7_PROTOCOL].name, (void *)_instance->l7_unknown_name, TLD_TYPE_STRING); - return 0; - } - - get_l7_protocol(&(gather_result[ORIGIN_BASIC_PROTOCOL]), protocol_list, sizeof(protocol_list), &l7_protocol_flag); - if(l7_protocol_flag==1) - { - TLD_append(_handle, _instance->id2field[LOG_COMMON_L7_PROTOCOL].name, (void *)protocol_list, TLD_TYPE_STRING); - } - else - { - TLD_append(_handle, _instance->id2field[LOG_COMMON_L7_PROTOCOL].name, (void *)_instance->l7_unknown_name, TLD_TYPE_STRING); - } - - if(_instance->app_id_type==0) // int - { - get_app_id(&(gather_result[ORIGIN_USER_DEFINE]), &one_app_id, &one_surrogate_id, &app_id_flag); - get_app_id(&(gather_result[ORIGIN_DKPT]), &one_app_id, &one_surrogate_id, &app_id_flag); - get_app_id(&(gather_result[ORIGIN_QM_ENGINE]), &one_app_id, &one_surrogate_id, &app_id_flag); - - if(app_id_flag==1) - { - TLD_append(_handle, _instance->id2field[LOG_COMMON_APP_ID].name, (void *)(long)one_app_id, TLD_TYPE_LONG); - TLD_append(_handle, _instance->id2field[LOG_COMMON_APP_SURROGATE_ID].name, (void *)(long)one_surrogate_id, TLD_TYPE_LONG); - } - } - else //string - { - set_userdefine_app(_handle, _instance->id2field[LOG_COMMON_USERDEFINE_APP].name, &(gather_result[ORIGIN_USER_DEFINE]), TLD_TYPE_LONG); - - get_userdefine_name(&(gather_result[ORIGIN_USER_DEFINE]), app_name, sizeof(app_name), &app_id_flag, 0); - - if(app_id_flag!=1) - { - get_app_name_list(&(gather_result[ORIGIN_BUILT_IN]), app_name, sizeof(app_name), &app_id_flag, 0); - } - - if(app_id_flag!=1) - { - get_app_name_list(&(gather_result[ORIGIN_DKPT]), app_name, sizeof(app_name), &app_id_flag, 0); - } - - if(app_id_flag!=1) - { - get_app_name_list(&(gather_result[ORIGIN_QM_ENGINE]), app_name, sizeof(app_name), &app_id_flag, 0); - } - - if(app_id_flag!=1) - { - get_app_name_list(&(gather_result[ORIGIN_UNKNOWN]), app_name, sizeof(app_name), &app_id_flag, 0); - } - - if(app_id_flag==1) - { - if(!(TLD_search(_handle, _instance->id2field[LOG_COMMON_APP_LABEL].name))) - { - TLD_append(_handle, _instance->id2field[LOG_COMMON_APP_LABEL].name, (void *)app_name, TLD_TYPE_STRING); - } - - Value app_id_object(kObjectType); - get_app_id_list(&app_id_object, _handle, "USER_DEFINE", &(gather_result[ORIGIN_USER_DEFINE])); - get_app_id_list(&app_id_object, _handle, "BUILT_IN", &(gather_result[ORIGIN_BUILT_IN])); - get_app_id_list(&app_id_object, _handle, "DKPT", &(gather_result[ORIGIN_DKPT])); - get_app_id_list(&app_id_object, _handle, "THIRD", &(gather_result[ORIGIN_QM_ENGINE])); - get_app_id_list(&app_id_object, _handle, "UNKNOWN", &(gather_result[ORIGIN_UNKNOWN])); - TLD_append(_handle, _instance->id2field[LOG_COMMON_APP_ID].name, &app_id_object, TLD_TYPE_OBJECT); - - set_app_identify_info(_handle, _instance->id2field[LOG_COMMON_APP_IDENTIFY_INFO].name, gather_result); - } - } - - return 1; -} - -static int set_vlan(struct tsg_log_instance_t *_instance, struct TLD_handle_t *_handle, struct single_layer_vlan_addr *vlan_addr, int layer_num, Value *tunnel_object, tsg_log_field_id_t id) -{ - if(layer_num==0) - { - return 0; - } - - int i=0; - Value vlan_array(kArrayType); - for(i=0; i<layer_num; i++) - { - vlan_array.PushBack(ntohs(vlan_addr[i].VID), _handle->document->GetAllocator()); - } - add_object_member(_handle, tunnel_object, _instance->id2field[id].name, vlan_array); - - return 1; -} - -static int set_mpls(struct tsg_log_instance_t *_instance, struct TLD_handle_t *_handle, struct single_layer_mpls_addr *mpls_addr, int layer_num, Value *tunnel_object, tsg_log_field_id_t id) -{ - if(layer_num==0) - { - return 0; - } - - int i=0; - Value mpls_array(kArrayType); - for(i=0; i<layer_num; i++) - { - mpls_array.PushBack(ntohl(mpls_addr[i].label), _handle->document->GetAllocator()); - } - add_object_member(_handle, tunnel_object, _instance->id2field[id].name, mpls_array); - - return 1; -} - -static int set_l2tp(struct tsg_log_instance_t *_instance, struct TLD_handle_t *_handle, struct layer_addr_l2tp *l2tp_addr, Value *object) -{ - if(l2tp_addr==NULL || object==NULL) - { - return 0; - } - - struct layer_addr_l2tp_v2_t *l2tp_v2=NULL; - - switch(l2tp_addr->version) - { - case 2: - l2tp_v2=&(l2tp_addr->l2tpun.l2tp_addr_v2); - add_str_member(_handle, object, _instance->id2field[LOG_COMMON_L2TP_VERSION].name, "v2"); - add_number_member(_handle, object, _instance->id2field[LOG_COMMON_L2TP_LAC2LNS_TUNNEL_ID].name, ntohs(l2tp_v2->tunnelid_C2S)); - add_number_member(_handle, object, _instance->id2field[LOG_COMMON_L2TP_LNS2LAC_TUNNEL_ID].name, ntohs(l2tp_v2->tunnelid_S2C)); - add_number_member(_handle, object, _instance->id2field[LOG_COMMON_L2TP_LAC2LNS_SESSION_ID].name, ntohs(l2tp_v2->sessionid_C2S)); - add_number_member(_handle, object, _instance->id2field[LOG_COMMON_L2TP_LNS2LAC_SESSION_ID].name, ntohs(l2tp_v2->sessionid_S2C)); - break; - case 3: - add_str_member(_handle, object, _instance->id2field[LOG_COMMON_L2TP_VERSION].name, "v3"); - break; - default: - return 0; - } - - return 1; -} - -static int mac_to_string(unsigned char *mac, char *buff) -{ - int i=0,len=0; - - for(i=0; i<6; i++) - { - len+=sprintf(buff+len, "%02x:", mac[i]); - } - - buff[len-1]='\0'; - - return 0; -} - -static int set_link_mac(struct tsg_log_instance_t *_instance, struct TLD_handle_t *_handle, struct layer_addr_mac *mac, Value *tunnel_object) -{ - int flag=0; - char default_mac[6]={0,0,0,0,0,0}; - char c2s_source_mac[128]={0}; - char c2s_dest_mac[128]={0}; - char s2c_source_mac[128]={0}; - char s2c_dest_mac[128]={0}; - - if((memcmp(mac->src_addr.h_source, default_mac, 6))) - { - flag|=1; - mac_to_string(mac->src_addr.h_source, c2s_source_mac); - mac_to_string(mac->src_addr.h_dest, c2s_dest_mac); - } - - if((memcmp(mac->dst_addr.h_source, default_mac, 6))) - { - flag|=2; - mac_to_string(mac->dst_addr.h_source, s2c_source_mac); - mac_to_string(mac->dst_addr.h_dest, s2c_dest_mac); - } - - switch(flag) - { - case 1: - add_str_member(_handle, tunnel_object, _instance->id2field[LOG_COMMON_TUNNELS_SCHEMA_TYPE].name, "ETHERNET"); - add_str_member(_handle, tunnel_object, _instance->id2field[LOG_COMMON_TUNNELS_MAC_SOURCE].name, c2s_source_mac); - add_str_member(_handle, tunnel_object, _instance->id2field[LOG_COMMON_TUNNELS_MAC_DEST].name, c2s_dest_mac); - break; - case 2: - add_str_member(_handle, tunnel_object, _instance->id2field[LOG_COMMON_TUNNELS_SCHEMA_TYPE].name, "ETHERNET"); - add_str_member(_handle, tunnel_object, _instance->id2field[LOG_COMMON_TUNNELS_MAC_SOURCE].name, s2c_source_mac); - add_str_member(_handle, tunnel_object, _instance->id2field[LOG_COMMON_TUNNELS_MAC_DEST].name, s2c_dest_mac); - break; - case 3: - add_str_member(_handle, tunnel_object, _instance->id2field[LOG_COMMON_TUNNELS_SCHEMA_TYPE].name, "MULTIPATH_ETHERNET"); - add_str_member(_handle, tunnel_object, _instance->id2field[LOG_COMMON_TUNNELS_C2S_MAC_SOURCE].name, c2s_source_mac); - add_str_member(_handle, tunnel_object, _instance->id2field[LOG_COMMON_TUNNELS_C2S_MAC_DEST].name, c2s_dest_mac); - add_str_member(_handle, tunnel_object, _instance->id2field[LOG_COMMON_TUNNELS_S2C_MAC_SOURCE].name, s2c_source_mac); - add_str_member(_handle, tunnel_object, _instance->id2field[LOG_COMMON_TUNNELS_S2C_MAC_DEST].name, s2c_dest_mac); - break; - default: - break; - } - - return 1; -} - -static int action2fs_id(int action) -{ - switch(action) - { - case TSG_ACTION_DENY: - return LOG_FS2_ABORT_DENY; - break; - case TSG_ACTION_BYPASS: - return LOG_FS2_ABORT_ALLOW; - break; - case TSG_ACTION_MONITOR: - return LOG_FS2_ABORT_MONITOR; - break; - case TSG_ACTION_INTERCEPT: - return LOG_FS2_ABORT_INTERCEPT; - break; - default: - return LOG_FS2_ABORT_UNKNOWN; - break; - } - - return LOG_FS2_ABORT_UNKNOWN; -} - -int TLD_cancel(struct TLD_handle_t *handle) -{ - if (handle != NULL) - { - if (handle->document != NULL) - { - long long length=0; - struct tsg_log_instance_t *_instance=get_log_instance(); - - length=handle->document->GetAllocator().Size(); - FS_operate(_instance->fs2_handle, _instance->fs2_field_id[LOG_FS2_FREE_RAPID_SIZE], 0, FS_OP_ADD, length); - - length=handle->document->GetAllocator().Capacity(); - FS_operate(_instance->fs2_handle, _instance->fs2_field_id[LOG_FS2_FREE_RAPID_CAPACITY], 0, FS_OP_ADD, length); - - delete handle->document; - handle->document = NULL; - - delete handle->valueAllocator; - handle->valueAllocator=NULL; - - FS_operate(_instance->fs2_handle, _instance->fs2_field_id[LOG_FS2_FREE_LOG_HANDLE], 0, FS_OP_ADD, 1); - } - - free(handle); - handle = NULL; - } - - return 0; -} - -int TLD_search(struct TLD_handle_t *handle, char *key) -{ - if (handle != NULL && handle->document != NULL && key != NULL) - { - Value::ConstMemberIterator itr = handle->document->FindMember(key); - if (itr!=handle->document->MemberEnd()) - { - return 1; - } - } - - return 0; -} - -static void TLD_delete(struct TLD_handle_t *handle, char *key) -{ - if (handle != NULL && handle->document != NULL && key != NULL) - { - handle->document->RemoveMember(key); - } -} - -int TLD_append(struct TLD_handle_t *handle, char *key, void *value, TLD_TYPE type) -{ - struct TLD_handle_t *_handle=handle; - - if(_handle==NULL || key==NULL || (value==NULL && type!=TLD_TYPE_LONG)) - { - return -1; - } - - switch(type) - { - case TLD_TYPE_LONG: - add_number_member(_handle, _handle->document, key, (long)value); - break; - case TLD_TYPE_FILE: - break; - case TLD_TYPE_STRING: - if(strlen((char *)value)==0) - { - break; - } - add_str_member(_handle, _handle->document, key, (const char *)value); - break; - case TLD_TYPE_OBJECT: - add_object_member(handle, handle->document, key, ((Value &)(*(Value *)value))); - break; - case TLD_TYPE_CJSON: - printf("TLD_TYPE_CJSON is obsolete, please use TLD_TYPE_OBJECT !!!\n"); - abort(); - default: - return -1; - break; - } - - struct tsg_log_instance_t *_instance=get_log_instance(); - - FS_operate(_instance->fs2_handle, _instance->fs2_field_id[LOG_FS2_APPEND_LOG_HANDLE], 0, FS_OP_ADD, 1); - - return 0; -} - -int TLD_array_append(struct TLD_handle_t *handle, char *key, void **array, int array_num, TLD_TYPE type) -{ - if(handle==NULL || key==NULL || array_num<=0 || array==NULL || type!=TLD_TYPE_LONG || type!=TLD_TYPE_STRING) - { - return -1; - } - - int i=0; - Value obj_array(kArrayType); - - switch(type) - { - case TLD_TYPE_LONG: - for(i=0; i<array_num; i++) - { - obj_array.PushBack((long)(array[i]), handle->document->GetAllocator()); - } - break; - case TLD_TYPE_STRING: - for(i=0; i<array_num; i++) - { - Value str_value(StringRef((char *)(array[i]), strlen((char *)array[i]))); - obj_array.PushBack(str_value, handle->document->GetAllocator()); - } - break; - default: - return -1; - } - - add_object_member(handle, handle->document, key, obj_array); - - return 1; -} - -struct TLD_handle_t *TLD_duplicate(struct TLD_handle_t *handle) -{ - if (handle == NULL) - { - return NULL; - } - struct TLD_handle_t *_handle=(struct TLD_handle_t *)calloc(1, sizeof(struct TLD_handle_t)); - _handle->thread_id = handle->thread_id; - _handle->document = new Document(); - //_handle->document->SetObject(); - - _handle->document->CopyFrom(*handle->document, _handle->document->GetAllocator()); - - struct tsg_log_instance_t *_instance=get_log_instance(); - FS_operate(_instance->fs2_handle, _instance->fs2_field_id[LOG_FS2_DUP_LOG_HANDLE], 0, FS_OP_ADD, 1); - - return _handle; -} - -struct TLD_handle_t *TLD_create(int thread_id) -{ - struct tsg_log_instance_t *_instance=get_log_instance(); - if(_instance->mode==CLOSE) - { - return NULL; - } - - struct TLD_handle_t *_handle=(struct TLD_handle_t *)calloc(1, sizeof(struct TLD_handle_t)); - _handle->thread_id = thread_id; - - _handle->valueAllocator =new MemoryPoolAllocator<>(g_tsg_log_instance->rapidjson_chunk_capacity); - _handle->document = new Document(_handle->valueAllocator); - _handle->document->SetObject(); - - FS_operate(_instance->fs2_handle, _instance->fs2_field_id[LOG_FS2_CREATE_LOG_HANDLE], 0, FS_OP_ADD, 1); - - return _handle; -} - -static int set_user_region(struct tsg_log_instance_t *_instance, struct TLD_handle_t *_handle, struct Maat_rule_t *p_result, int thread_seq) -{ - int ret=0; - char *user_region=NULL; - - if(p_result->action!=TSG_ACTION_NONE && p_result->serv_def_len>0) - { - user_region=(char *)dictator_malloc(thread_seq, p_result->serv_def_len+1); - ret=Maat_read_rule(g_tsg_maat_feather, p_result, MAAT_RULE_SERV_DEFINE, user_region, p_result->serv_def_len+1); - if(ret==p_result->serv_def_len) - { - user_region[p_result->serv_def_len]='\0'; - TLD_append(_handle, _instance->id2field[LOG_COMMON_USER_REGION].name, (void *)user_region, TLD_TYPE_STRING); - } - - dictator_free(thread_seq, user_region); - user_region=NULL; - } - - return 0; -} - -static int set_mail_eml(struct tsg_log_instance_t *_instance, struct TLD_handle_t *_handle, struct streaminfo *a_stream) -{ - struct tsg_conn_sketch_notify_data *notify_mail=(struct tsg_conn_sketch_notify_data *)stream_bridge_async_data_get(a_stream, g_tsg_para.bridge_id[BRIDGE_TYPE_RECV_CONN_SKETCH_DATA]); - if(notify_mail!=NULL && notify_mail->pdata.mail_eml_filename!=NULL && notify_mail->protocol==PROTO_MAIL) - { - TLD_delete(_handle, _instance->id2field[LOG_COMMON_MAIL_EML_FILE].name); - TLD_append(_handle, _instance->id2field[LOG_COMMON_MAIL_EML_FILE].name, (void *)notify_mail->pdata.mail_eml_filename, TLD_TYPE_STRING); - return 1; - } - - return 0; -} - - -static int set_s3_filename(struct tsg_log_instance_t *_instance, struct TLD_handle_t *_handle, struct streaminfo *a_stream) -{ - struct business_notify_data *bnd_label=(struct business_notify_data *)stream_bridge_async_data_get(a_stream, _instance->bridge_id[LOG_BRIDGE_BUSINESS_S3_FILENAME]); - if(bnd_label==NULL || bnd_label->pdata==NULL) - { - return 0; - } - - switch(bnd_label->proto) - { - case PROTO_HTTP: - TLD_delete(_handle, _instance->id2field[LOG_COMMON_HTTP_REQUEST_S3_FILE].name); - TLD_delete(_handle, _instance->id2field[LOG_COMMON_HTTP_RESPONSE_S3_FILE].name); - - if(bnd_label->s3_http==NULL) - { - break; - } - - TLD_append(_handle, _instance->id2field[LOG_COMMON_HTTP_REQUEST_S3_FILE].name, bnd_label->s3_http->request_filename, TLD_TYPE_STRING); - TLD_append(_handle, _instance->id2field[LOG_COMMON_HTTP_RESPONSE_S3_FILE].name, bnd_label->s3_http->response_filename, TLD_TYPE_STRING); - break; - default: - break; - } - - return 1; -} - -int set_nat_linkinfo(struct tsg_log_instance_t *_instance, struct TLD_handle_t *_handle, struct streaminfo *a_stream, char *field_name, int project_id) -{ - const char *nat_linkinfo=(const char *)stream_bridge_async_data_get(a_stream, project_id); - if(nat_linkinfo==NULL) - { - return 0; - } - - copy_rapidjson(_handle, field_name, nat_linkinfo); - - return 0; -} - -static int set_tunnel_ipv4v6_port(struct tsg_log_instance_t *_instance, struct TLD_handle_t *_handle, struct streaminfo *a_stream, Value *object, enum addr_type_t up_layer_type) -{ - char ip_buff[64]={0}; - if(a_stream==NULL) - { - return 0; - } - - tsg_log_field_id_t s_ip_idx, d_ip_idx, s_port_idx, d_port_idx; - - switch(up_layer_type) - { - case ADDR_TYPE_L2TP: - s_ip_idx=LOG_COMMON_L2TP_ACCESS_CONCENTRATOR_IP; - d_ip_idx=LOG_COMMON_L2TP_NETWORK_SERVER_IP; - s_port_idx=LOG_COMMON_L2TP_ACCESS_CONCENTRATOR_PORT; - d_port_idx=LOG_COMMON_L2TP_NETWORK_SERVER_PORT; - break; - case ADDR_TYPE_GPRS_TUNNEL: - s_ip_idx=LOG_COMMON_TUNNELS_GTP_SGW_IP; - d_ip_idx=LOG_COMMON_TUNNELS_GTP_PGW_IP; - s_port_idx=LOG_COMMON_TUNNELS_GTP_SGW_PORT; - d_port_idx=LOG_COMMON_TUNNELS_GTP_PGW_PORT; - break; - default: - return 0; - break; - } - - switch(a_stream->addr.addrtype) - { - case ADDR_TYPE_IPV4: - inet_ntop(AF_INET, (const void *)&(a_stream->addr.ipv4->saddr), ip_buff, sizeof(ip_buff)); - add_str_member(_handle, object, _instance->id2field[s_ip_idx].name, ip_buff); - - inet_ntop(AF_INET, (const void *)&(a_stream->addr.ipv4->daddr), ip_buff, sizeof(ip_buff)); - add_str_member(_handle, object, _instance->id2field[d_ip_idx].name, ip_buff); - - add_number_member(_handle, object, _instance->id2field[s_port_idx].name, ntohs(a_stream->addr.ipv4->source)); - add_number_member(_handle, object, _instance->id2field[d_port_idx].name, ntohs(a_stream->addr.ipv4->dest)); - return 1; - break; - case ADDR_TYPE_IPV6: - inet_ntop(AF_INET6, (const void *)(a_stream->addr.ipv6->saddr), ip_buff, sizeof(ip_buff)); - add_str_member(_handle, object, _instance->id2field[s_ip_idx].name, ip_buff); - - inet_ntop(AF_INET6, (const void *)(a_stream->addr.ipv6->daddr), ip_buff, sizeof(ip_buff)); - add_str_member(_handle, object, _instance->id2field[d_ip_idx].name, ip_buff); - - add_number_member(_handle, object, _instance->id2field[s_port_idx].name, ntohs(a_stream->addr.ipv6->source)); - add_number_member(_handle, object, _instance->id2field[d_port_idx].name, ntohs(a_stream->addr.ipv6->dest)); - return 1; - break; - default: - break; - - } - - return 0; -} - -static int set_common_tunnels(struct tsg_log_instance_t *_instance, struct TLD_handle_t *_handle, struct streaminfo *a_stream) -{ - int ret=0; - char ip_buff[64]={0}; - const struct streaminfo *ptmp = a_stream; - const struct streaminfo *pfather=NULL; - Value tunnel_array(kArrayType); - - while(ptmp) - { - Value tunnel_object(kObjectType); - pfather = ptmp->pfather; - switch(ptmp->addr.addrtype) - { - case ADDR_TYPE_MAC: - set_link_mac(_instance, _handle, (ptmp->addr.mac), &tunnel_object); - break; - case ADDR_TYPE_VLAN: - add_str_member(_handle, &tunnel_object, _instance->id2field[LOG_COMMON_TUNNELS_SCHEMA_TYPE].name, "VLAN"); - set_vlan(_instance, _handle, ptmp->addr.vlan->c2s_addr_array, ptmp->addr.vlan->c2s_layer_num, &tunnel_object, LOG_COMMON_TUNNELS_VLAN_SRC_ID); - set_vlan(_instance, _handle, ptmp->addr.vlan->s2c_addr_array, ptmp->addr.vlan->s2c_layer_num, &tunnel_object, LOG_COMMON_TUNNELS_VLAN_DST_ID); - break; - case ADDR_TYPE_GRE: - add_str_member(_handle, &tunnel_object, _instance->id2field[LOG_COMMON_TUNNELS_SCHEMA_TYPE].name, "GRE"); - break; - case ADDR_TYPE_MPLS: - if(ptmp->addr.mpls->s2c_layer_num==0 && ptmp->addr.mpls->c2s_layer_num==0) - { - ptmp = pfather; - continue; - } - add_str_member(_handle, &tunnel_object, _instance->id2field[LOG_COMMON_TUNNELS_SCHEMA_TYPE].name, "MPLS"); - set_mpls(_instance, _handle, ptmp->addr.mpls->c2s_addr_array, ptmp->addr.mpls->c2s_layer_num, &tunnel_object, LOG_COMMON_TUNNELS_MPLS_SRC_LABEL); - set_mpls(_instance, _handle, ptmp->addr.mpls->s2c_addr_array, ptmp->addr.mpls->s2c_layer_num, &tunnel_object, LOG_COMMON_TUNNELS_MPLS_DST_LABEL); - break; - case ADDR_TYPE_L2TP: - add_str_member(_handle, &tunnel_object, _instance->id2field[LOG_COMMON_TUNNELS_SCHEMA_TYPE].name, "L2TP"); - set_l2tp(_instance, _handle, ptmp->addr.l2tp, &tunnel_object); - - ret=set_tunnel_ipv4v6_port(_instance, _handle, ptmp->pfather, &tunnel_object, ADDR_TYPE_L2TP); - if(ret==1) - { - ptmp=pfather->pfather; - } - break; - case __ADDR_TYPE_IP_PAIR_V4: - add_str_member(_handle, &tunnel_object, _instance->id2field[LOG_COMMON_TUNNELS_SCHEMA_TYPE].name, "IPv4"); - - inet_ntop(AF_INET, (const void *)&(ptmp->addr.ipv4->saddr), ip_buff, sizeof(ip_buff)); - add_str_member(_handle, &tunnel_object, _instance->id2field[LOG_COMMON_TUNNELS_CLIENT_IP].name, ip_buff); - - inet_ntop(AF_INET, (const void *)&(ptmp->addr.ipv4->daddr), ip_buff, sizeof(ip_buff)); - add_str_member(_handle, &tunnel_object, _instance->id2field[LOG_COMMON_TUNNELS_SERVER_IP].name, ip_buff); - break; - case __ADDR_TYPE_IP_PAIR_V6: - add_str_member(_handle, &tunnel_object, _instance->id2field[LOG_COMMON_TUNNELS_SCHEMA_TYPE].name, "IPv6"); - - inet_ntop(AF_INET6, (const void *)(ptmp->addr.ipv6->saddr), ip_buff, sizeof(ip_buff)); - add_str_member(_handle, &tunnel_object, _instance->id2field[LOG_COMMON_TUNNELS_CLIENT_IP].name, ip_buff); - - inet_ntop(AF_INET6, (const void *)(ptmp->addr.ipv6->daddr), ip_buff, sizeof(ip_buff)); - add_str_member(_handle, &tunnel_object, _instance->id2field[LOG_COMMON_TUNNELS_SERVER_IP].name, ip_buff); - break; - case ADDR_TYPE_PPTP: - add_str_member(_handle, &tunnel_object, _instance->id2field[LOG_COMMON_TUNNELS_SCHEMA_TYPE].name, "PPTP"); - add_number_member(_handle, &tunnel_object, _instance->id2field[LOG_COMMON_TUNNELS_PPTP_C2S_ID].name, ntohs(ptmp->addr.pptp->C2S_call_id)); - add_number_member(_handle, &tunnel_object, _instance->id2field[LOG_COMMON_TUNNELS_PPTP_S2C_ID].name, ntohs(ptmp->addr.pptp->S2C_call_id)); - break; - case ADDR_TYPE_GPRS_TUNNEL: - add_str_member(_handle, &tunnel_object, _instance->id2field[LOG_COMMON_TUNNELS_SCHEMA_TYPE].name, "GTP"); - add_number_member(_handle, &tunnel_object, _instance->id2field[LOG_COMMON_TUNNELS_GTP_UPLINK_TEID].name, ntohl(ptmp->addr.gtp->teid_c2s)); - add_number_member(_handle, &tunnel_object, _instance->id2field[LOG_COMMON_TUNNELS_GTP_DOWNLINK_TEID].name, ntohl(ptmp->addr.gtp->teid_s2c)); - - ret=set_tunnel_ipv4v6_port(_instance, _handle, ptmp->pfather, &tunnel_object, ADDR_TYPE_GPRS_TUNNEL); - if(ret==1) - { - ptmp=pfather->pfather; - } - break; - case ADDR_TYPE_VXLAN: - add_str_member(_handle, &tunnel_object, _instance->id2field[LOG_COMMON_TUNNELS_SCHEMA_TYPE].name, "VXLAN"); - break; - default: - ptmp = pfather; - continue; - break; - } - - ptmp = pfather;; - tunnel_array.PushBack(tunnel_object, _handle->document->GetAllocator()); - } - - TLD_append(_handle, _instance->id2field[LOG_COMMON_TUNNELS].name, &tunnel_array, TLD_TYPE_OBJECT); - - return 0; -} - -char *log_field_id2name(struct tsg_log_instance_t *instance, tsg_log_field_id_t id) -{ - struct tsg_log_instance_t *_instance=instance; - if(_instance!=NULL) - { - return _instance->id2field[id].name; - } - - return NULL; -} - -unsigned long long tsg_get_stream_id(struct streaminfo * a_stream) -{ - int ret=0; - int device_id_size=sizeof(unsigned long long); - unsigned long long device_id=(unsigned long long)g_tsg_para.device_seq_in_dc; - - ret=MESA_get_stream_opt(a_stream, MSO_GLOBAL_STREAM_ID, (void *)&device_id, &device_id_size); - if(ret==0) - { - return device_id; - } - - return -1; -} - -int is_multi_hit_same_policy(struct Maat_rule_t *result, int *policy_id, int *policy_id_num) -{ - int j=0; - - for(j=0;j<*policy_id_num;j++) - { - if(policy_id[j]==result->config_id) - { - return 1; - } - } - - policy_id[(*policy_id_num)++]=result->config_id; - - return 0; -} - -static int set_common_sub_action(struct TLD_handle_t *handle, char *field_name, struct Maat_rule_t *p_result) -{ - cJSON *item=NULL; - cJSON *object=NULL; - char *tmp_buff=NULL; - - if(p_result->serv_def_len<128) - { - object=cJSON_Parse(p_result->service_defined); - } - else - { - tmp_buff=(char *)calloc(1, p_result->serv_def_len+1); - Maat_read_rule(g_tsg_maat_feather, p_result, MAAT_RULE_SERV_DEFINE, tmp_buff, p_result->serv_def_len); - object=cJSON_Parse(tmp_buff); - - free(tmp_buff); - tmp_buff=NULL; - } - - if(object!=NULL) - { - item=cJSON_GetObjectItem(object, "method"); - if(item!=NULL && item->valuestring!=NULL) - { - TLD_append(handle, field_name, (void *)item->valuestring, TLD_TYPE_STRING); - } - - cJSON_Delete(object); - object=NULL; - } - - return 0; -} - -int set_application_behavior(struct tsg_log_instance_t *_instance, struct TLD_handle_t *_handle, struct streaminfo *a_stream) -{ - if(a_stream==NULL) - { - return 0; - } - - struct application_behavior *behavior_result=NULL; - behavior_result=(struct application_behavior *)stream_bridge_async_data_get(a_stream, _instance->bridge_id[LOG_BRIDGE_APP_BEHAVIOR_RESULT]); - if(behavior_result==NULL) - { - return 0; - } - - TLD_append(_handle, _instance->id2field[LOG_COMMON_APPLICATION_BEHAVIOR].name, (void *)(behavior_result->stream_behavior), TLD_TYPE_STRING); - - return 1; -} - -int set_notify_execution_result(struct tsg_log_instance_t *_instance, struct TLD_handle_t *_handle, struct streaminfo *a_stream, struct Maat_rule_t *p_result) -{ - if(a_stream==NULL) - { - return 0; - } - - int i=0; - struct tsg_notify_execution_result *execution_result=NULL; - execution_result=(struct tsg_notify_execution_result *)stream_bridge_async_data_get(a_stream, _instance->bridge_id[LOG_BRIDGE_CONN_SKETCH_EXEC_RESULT]); - if(execution_result==NULL) - { - return 0; - } - - TLD_delete(_handle, _instance->id2field[LOG_COMMON_MIRRORED_PKTS].name); - TLD_delete(_handle, _instance->id2field[LOG_COMMON_MIRRORED_BYTES].name); - TLD_delete(_handle, _instance->id2field[LOG_COMMON_PACKET_CAPTURE_FILE].name); - - for(i=0; i<execution_result->stat_mirrored_cnt; i++) - { - if(execution_result->stat_mirrored[i].compile_id==p_result->config_id) - { - TLD_append(_handle, _instance->id2field[LOG_COMMON_MIRRORED_PKTS].name, (void *)(execution_result->stat_mirrored[i].packets), TLD_TYPE_LONG); - TLD_append(_handle, _instance->id2field[LOG_COMMON_MIRRORED_BYTES].name, (void *)(execution_result->stat_mirrored[i].bytes), TLD_TYPE_LONG); - break; - } - } - - for(i=0; i<execution_result->capture_result_cnt; i++) - { - if(execution_result->capture_result[i].compile_id==p_result->config_id) - { - TLD_append(_handle, _instance->id2field[LOG_COMMON_PACKET_CAPTURE_FILE].name, (void *)(execution_result->capture_result[i].packet_path), TLD_TYPE_STRING); - break; - } - } - - return 1; -} - -int set_session_attributes(struct tsg_log_instance_t *_instance, struct TLD_handle_t *_handle, struct streaminfo *a_stream) -{ - int ret=0; - struct session_attribute_label *attribute_label=NULL; - - attribute_label=(struct session_attribute_label *)project_req_get_struct(a_stream, _instance->session_attribute_project_id); - if(attribute_label==NULL) - { - return 0; - } - - if(attribute_label->establish_latency_ms>0) - { - TLD_append(_handle, _instance->id2field[LOG_COMMON_ESTABLISH_LATENCY_MS].name, (void *)attribute_label->establish_latency_ms, TLD_TYPE_LONG); - } - - if(attribute_label->http_action_file_size>0) - { - TLD_append(_handle, _instance->id2field[LOG_COMMON_HTTP_ACTION_FILESIZE].name, (void *)(long)attribute_label->http_action_file_size, TLD_TYPE_LONG); - } - - set_asn(_handle, a_stream, _instance->id2field[LOG_COMMON_CLINET_ASN].name, attribute_label->client_asn); - set_asn(_handle, a_stream, _instance->id2field[LOG_COMMON_SERVER_ASN].name, attribute_label->server_asn); - - set_location(_handle, a_stream, _instance->id2field[LOG_COMMON_CLINET_LOCATION].name, attribute_label->client_location); - set_location(_handle, a_stream, _instance->id2field[LOG_COMMON_SERVER_LOCATION].name, attribute_label->server_location); - - ret=set_subscriber_id(_handle, _instance->id2field[LOG_COMMON_SUBSCRIBER_ID].name, attribute_label->client_subscribe_id); - if(ret==0) - { - set_subscriber_id(_handle, _instance->id2field[LOG_COMMON_SUBSCRIBER_ID].name, attribute_label->server_subscribe_id); - } - - set_fqdn_category(_instance, _handle, a_stream, attribute_label->fqdn_category_id, attribute_label->fqdn_category_id_num); - - if(attribute_label->ja3_fingerprint!=NULL) - { - TLD_append(_handle, _instance->id2field[LOG_SSL_JA3_FINGERPRINT].name, (void *)attribute_label->ja3_fingerprint, TLD_TYPE_STRING); - } - - set_umts_user_info(_instance, _handle, a_stream, attribute_label->user_info); - - return 1; -} - -int set_lua_scripts_result(struct tsg_log_instance_t *_instance, struct TLD_handle_t *_handle, struct streaminfo *a_stream) -{ - int i=0; - struct user_defined_attribute_label *uda_label=(struct user_defined_attribute_label *)stream_bridge_async_data_get(a_stream, _instance->bridge_id[LOG_BRIDGE_APP_LUA_RESULT]); - if(uda_label!=NULL) - { - Value array(kArrayType); - - for(i=0; i<uda_label->attribute_num; i++) - { - Value object(kObjectType); - switch(uda_label->attribute[i].type) - { - case ATTRIBUTE_TYPE_BOOL: - case ATTRIBUTE_TYPE_NUMERIC: - add_number_member(_handle, &object, uda_label->attribute[i].name, uda_label->attribute[i].number); - break; - case ATTRIBUTE_TYPE_IP: - case ATTRIBUTE_TYPE_STRING: - add_str_member(_handle, &object, uda_label->attribute[i].name, uda_label->attribute[i].string); - break; - default: - continue; - } - - array.PushBack(object, _handle->document->GetAllocator()); - } - - TLD_append(_handle, _instance->id2field[LOG_COMMON_APP_EXTRACT_INFO].name, &array, TLD_TYPE_OBJECT); - } - - return 0; -} - -int TLD_append_streaminfo(struct tsg_log_instance_t *instance, struct TLD_handle_t *handle, struct streaminfo *a_stream) -{ - int ret=0; - char *addr_proto=NULL; - char stream_id_buff[128]={0}; - unsigned long long stream_id=0; - struct TLD_handle_t *_handle=handle; - struct tsg_log_instance_t *_instance=instance; - - if(_instance==NULL || _handle==NULL || a_stream==NULL) - { - MESA_handle_runtime_log(_instance->logger, RLOG_LV_DEBUG, "TLD_APPEND_STREAM", "instance==NULL || TLD_handle==NULL || addr==NULL"); - return -1; - } - - ret=set_linkinfo(_instance, _handle, a_stream); - if(ret==0) - { - set_direction(_instance, _handle, a_stream); - } - - set_app_id(_instance, _handle, a_stream); - set_tcp_isn(_instance, _handle, a_stream); - set_tuple4(_instance, _handle, a_stream); - set_address_list(_instance, _handle, a_stream); - set_duraction(_instance, _handle, a_stream); - set_packet_bytes(_instance, _handle, a_stream); - set_session_attributes(_instance, _handle, a_stream); - set_lua_scripts_result(_instance, _handle, a_stream); - - if(is_tunnels(a_stream)) - { - set_common_tunnels(_instance, _handle, a_stream); - } - - stream_id=tsg_get_stream_id(a_stream); - snprintf(stream_id_buff, sizeof(stream_id_buff), "%llu", stream_id); - TLD_append(_handle, _instance->id2field[LOG_COMMON_STREAM_TRACE_ID].name, (void *)stream_id_buff, TLD_TYPE_STRING); - - addr_proto=(char *)layer_addr_prefix_ntop(a_stream); - TLD_append(_handle, _instance->id2field[LOG_COMMON_L4_PROTOCOL].name, (void *)addr_proto, TLD_TYPE_STRING); - - return 0; -} - -int load_log_common_field(const char *filename, id2field_t *id2field, struct topic_stat **service2topic, int *max_service) -{ - int i=0,flag=0; - int ret=0,id=0; - FILE *fp=NULL; - char line[1024]={0}; - char field_name[64]={0}; - char type_name[32]={0}; - struct topic_stat *_service2topic=NULL; - - fp=fopen(filename, "r"); - if(fp==NULL) - { - printf("Open %s failed ...", filename); - return -1; - } - - memset(line, 0, sizeof(line)); - - while((fgets(line, sizeof(line), fp))!=NULL) - { - if(line[0]=='#' || line[0]=='\n' || line[0]=='\r' ||line[0]=='\0') - { - continue; - } - memset(type_name, 0, sizeof(type_name)); - ret=sscanf(line, "%s %s %d", type_name, field_name, &id); - assert(ret==3); - - for(i=0; i<TLD_TYPE_MAX; i++) - { - if((strncasecmp(tld_type[i].name, type_name, strlen(tld_type[i].name)))==0) - { - switch(tld_type[i].type) - { - case TLD_TYPE_FILE: - case TLD_TYPE_LONG: - case TLD_TYPE_STRING: - id2field[id].type = tld_type[i].type; - id2field[id].id = id; - memcpy(id2field[id].name, field_name, strlen(field_name)); - flag=1; - break; - case TLD_TYPE_TOPIC: - if(_service2topic==NULL) - { - _service2topic=(struct topic_stat *)calloc(1, sizeof(struct topic_stat)*(id+1)); - _service2topic[id].type = TLD_TYPE_MAX; - //_service2topic[id].id = id; - memcpy(_service2topic[id].name, field_name, strlen(field_name)); - - *max_service=id+1; - } - else - { - if(*max_service<=id) - { - _service2topic=(struct topic_stat *)realloc(_service2topic, sizeof(struct topic_stat)*(id+1)); - memset(&_service2topic[id], 0, sizeof(struct topic_stat)); - _service2topic[id].type = TLD_TYPE_MAX; - //_service2topic[id].id = id; - memcpy(_service2topic[id].name, field_name, strlen(field_name)); - - *max_service=id+1; - } - else - { - memset(&_service2topic[id], 0, sizeof(struct topic_stat)); - _service2topic[id].type = TLD_TYPE_MAX; - //_service2topic[id].id = id; - memcpy(_service2topic[id].name, field_name, strlen(field_name)); - } - } - flag=1; - break; - default: - break; - } - - if(flag==1) - { - flag=0; - break; - } - } - } - memset(line, 0, sizeof(line)); - } - - fclose(fp); - fp=NULL; - - if(service2topic!=NULL) - { - (*service2topic)=_service2topic; - } - - return 0; -} - -struct tsg_log_instance_t *tsg_sendlog_init(const char *conffile, screen_stat_handle_t fs2_handle) -{ - int i=0,ret=0; - char nic_name[32]={0}; - char kafka_errstr[1024]={0}; - unsigned int local_ip_nr=0; - char bridge_name[LOG_BRIDGE_MAX][128]={0}; - rd_kafka_conf_t *rdkafka_conf = NULL; - struct tsg_log_instance_t *_instance=NULL; - - _instance=(struct tsg_log_instance_t *)calloc(1, sizeof(struct tsg_log_instance_t)); - _instance->fs2_handle=fs2_handle; - - for(i=0; i<LOG_FS2_TYPE_MAX; i++) - { - _instance->fs2_field_id[i]=FS_register(_instance->fs2_handle, FS_STYLE_FIELD, FS_CALC_SPEED, g_log_fs2_field[i].name); - } - - _instance->fs2_column_id[LOG_COLUMN_STATUS_SUCCESS]=FS_register(_instance->fs2_handle, FS_STYLE_COLUMN, FS_CALC_CURRENT, "T_success_log"); - _instance->fs2_column_id[LOG_COLUMN_STATUS_FAIL]=FS_register(_instance->fs2_handle, FS_STYLE_COLUMN, FS_CALC_CURRENT, "T_fail_log"); - _instance->fs2_column_id[LOG_COLUMN_STATUS_DROP]=FS_register(_instance->fs2_handle, FS_STYLE_COLUMN, FS_CALC_CURRENT, "T_drop_log"); - - _instance->fs2_column_id[LOG_COLUMN_STATUS_SUCCESS_S]=FS_register(_instance->fs2_handle, FS_STYLE_COLUMN, FS_CALC_SPEED, "success_log/s"); - _instance->fs2_column_id[LOG_COLUMN_STATUS_FAIL_S]=FS_register(_instance->fs2_handle, FS_STYLE_COLUMN, FS_CALC_SPEED, "fail_log/s"); - _instance->fs2_column_id[LOG_COLUMN_STATUS_DROP_S]=FS_register(_instance->fs2_handle, FS_STYLE_COLUMN, FS_CALC_SPEED, "drop_log/s"); - - _instance->sum_line_id=FS_register(_instance->fs2_handle, FS_STYLE_LINE, FS_CALC_SPEED, "SUM"); - - MESA_load_profile_int_def(conffile, "TSG_LOG", "LOG_LEVEL",&(_instance->level), 30); - MESA_load_profile_string_def(conffile, "TSG_LOG", "LOG_PATH", _instance->log_path, sizeof(_instance->log_path), "./tsglog/tsglog"); - MESA_load_profile_int_def(conffile, "TSG_LOG", "SEND_USER_REGION", &(_instance->send_user_region), 0); - MESA_load_profile_int_def(conffile, "TSG_LOG", "SEND_DATA_CENTER_SWITCH", &(_instance->send_data_center), 0); - MESA_load_profile_int_def(conffile, "TSG_LOG", "RAPIDJSON_CHUNK_CAPACITY", &(_instance->rapidjson_chunk_capacity), 8096); - - MESA_load_profile_int_def(conffile, "TSG_LOG", "APP_ID_TYPE", &(_instance->app_id_type), 1); //0: int, 1: string - MESA_load_profile_string_def(conffile, "TSG_LOG", "L7_UNKNOWN_NAME", _instance->l7_unknown_name, sizeof(_instance->l7_unknown_name), "UNCATEGORIZED"); - - MESA_load_profile_string_def(conffile, "TSG_LOG", "LINKINFO_FROM_MAC", bridge_name[LOG_BRIDGE_MAC_LINKINFO], sizeof(bridge_name[LOG_BRIDGE_MAC_LINKINFO]), "mirror_linkinfo_from_mac"); - MESA_load_profile_string_def(conffile, "TSG_LOG", "NAT_C2S_LINKINFO", bridge_name[LOG_BRIDGE_NAT_C2S_LINKINFO], sizeof(bridge_name[LOG_BRIDGE_NAT_C2S_LINKINFO]), "common_link_info_c2s"); - MESA_load_profile_string_def(conffile, "TSG_LOG", "NAT_S2C_LINKINFO", bridge_name[LOG_BRIDGE_NAT_S2C_LINKINFO], sizeof(bridge_name[LOG_BRIDGE_NAT_S2C_LINKINFO]), "common_link_info_s2c"); - MESA_load_profile_string_def(conffile, "TSG_LOG", "APP_LUA_SCRIPTS_BRIDGE_NAME", bridge_name[LOG_BRIDGE_APP_LUA_RESULT], sizeof(bridge_name[LOG_BRIDGE_APP_LUA_RESULT]), "LUA_USER_DEFINED_ATTRIBUTE"); - MESA_load_profile_string_def(conffile, "TSG_LOG", "BUSINESS_S3_FILENAME", bridge_name[LOG_BRIDGE_BUSINESS_S3_FILENAME], sizeof(bridge_name[LOG_BRIDGE_BUSINESS_S3_FILENAME]), "TSG_BUSINESS_S3_FILENAME"); - MESA_load_profile_string_def(conffile, "SYSTEM", "APP_BEHAVIOR_BRIDGE_NAME", bridge_name[LOG_BRIDGE_APP_BEHAVIOR_RESULT], sizeof(bridge_name[LOG_BRIDGE_APP_BEHAVIOR_RESULT]), "TSG_APPLICATION_BEHAVIOR"); - MESA_load_profile_string_def(conffile, "SYSTEM", "NOTIFY_EXEC_RESULT_BRIDGE_NAME", bridge_name[LOG_BRIDGE_CONN_SKETCH_EXEC_RESULT], sizeof(bridge_name[LOG_BRIDGE_CONN_SKETCH_EXEC_RESULT]), "TSG_NOTIFICATION_EXECUTION_RESULT"); - - for(i=0; i<LOG_BRIDGE_MAX; i++) - { - _instance->bridge_id[i]=stream_bridge_build(bridge_name[i], "w"); - if(_instance->bridge_id[i]<0) - { - MESA_handle_runtime_log(g_tsg_para.logger, RLOG_LV_FATAL, "LINKINFO_FROM_MAC", "stream_bridge_build is error, bridge_name: %s", bridge_name[i]); - } - } - - _instance->logger=MESA_create_runtime_log_handle(_instance->log_path, _instance->level); - if(_instance->logger==NULL) - { - printf("MESA_create_runtime_log_handle failed ..., path: %s level: %d", _instance->log_path, _instance->level); - return NULL; - } - - MESA_load_profile_int_def(conffile, "TSG_LOG", "MODE",&(_instance->mode), 0); - if(_instance->mode==CLOSE) - { - MESA_handle_runtime_log(_instance->logger, RLOG_LV_FATAL, "TSG_LOG", "Disable tsg_send_log"); - return _instance; - } - - MESA_load_profile_int_def(conffile, "TSG_LOG", "RECOVERY_INTERVEL_S", &(_instance->recovery_interval), 30); - - MESA_load_profile_string_def(conffile, "TSG_LOG", "COMMON_FIELD_FILE", _instance->common_field_file, sizeof(_instance->common_field_file), NULL); - MESA_load_profile_string_def(conffile, "TSG_LOG", "BROKER_LIST", _instance->broker_list, sizeof(_instance->broker_list), NULL); - MESA_load_profile_string_def(conffile, "TSG_LOG", "SASL_USERNAME", _instance->sasl_username, sizeof(_instance->sasl_username), ""); //admin - MESA_load_profile_string_def(conffile, "TSG_LOG", "SASL_PASSWD", _instance->sasl_passwd, sizeof(_instance->sasl_passwd), ""); - - MESA_load_profile_string_def(conffile, "TSG_LOG", "SEND_QUEUE_MAX_MESSAGE", _instance->send_queue_max_msg, sizeof(_instance->send_queue_max_msg), "1000000"); - MESA_load_profile_string_def(conffile, "TSG_LOG", "REFRESH_INTERVAL_MS", _instance->refresh_interval_ms, sizeof(_instance->refresh_interval_ms), "600000"); - MESA_load_profile_string_def(conffile, "TSG_LOG", "REQUIRE_ACK", _instance->require_ack, sizeof(_instance->require_ack), "1"); - - MESA_load_profile_string_def(conffile, "SYSTEM", "TCP_LABEL", _instance->tcp_label, sizeof(_instance->tcp_label), "tcp_flow_stat"); - MESA_load_profile_string_def(conffile, "SYSTEM", "UDP_LABEL", _instance->udp_label, sizeof(_instance->udp_label), "udp_flow_stat"); - - _instance->tcp_flow_project_id=project_customer_register(_instance->tcp_label, "struct"); - _instance->udp_flow_project_id=project_customer_register(_instance->udp_label, "struct"); - if(_instance->tcp_flow_project_id<0 || _instance->udp_flow_project_id<0) - { - MESA_handle_runtime_log(_instance->logger, - RLOG_LV_FATAL, - "TCP_OR_UDP_LABEL", - "project_customer_register is error, tcp_label: %s udp_label: %s, please check etc/project.conf", - _instance->tcp_label, - _instance->udp_label - ); - } - - MESA_load_profile_string_def(conffile, "SYSTEM", "NIC_NAME", nic_name, sizeof(nic_name), "lo"); - ret=MESA_get_dev_ipv4(nic_name, (int *)&local_ip_nr); - if(ret<0) - { - MESA_handle_runtime_log(_instance->logger, - RLOG_LV_FATAL, - "GET_LOCAL_IP", - "MESA_get_dev_ipv4 is error, nic_name: %s, please check tsgconf/main.conf", - nic_name - ); - return NULL; - } - inet_ntop(AF_INET,&(local_ip_nr),_instance->local_ip_str,sizeof(_instance->local_ip_str)); - - rdkafka_conf = rd_kafka_conf_new(); - rd_kafka_conf_set(rdkafka_conf, "queue.buffering.max.messages", _instance->send_queue_max_msg, kafka_errstr, sizeof(kafka_errstr)); - rd_kafka_conf_set(rdkafka_conf, "topic.metadata.refresh.interval.ms", _instance->refresh_interval_ms, kafka_errstr, sizeof(kafka_errstr)); - rd_kafka_conf_set(rdkafka_conf, "request.required.acks", _instance->require_ack, kafka_errstr, sizeof(kafka_errstr)); - rd_kafka_conf_set(rdkafka_conf, "socket.keepalive.enable", "true", kafka_errstr, sizeof(kafka_errstr)); - rd_kafka_conf_set(rdkafka_conf, "bootstrap.servers", _instance->broker_list, kafka_errstr, sizeof(kafka_errstr)); - - if(strlen(_instance->sasl_username)> 0 && strlen(_instance->sasl_passwd)>0) - { - rd_kafka_conf_set(rdkafka_conf, "security.protocol", "sasl_plaintext", kafka_errstr, sizeof(kafka_errstr)); - rd_kafka_conf_set(rdkafka_conf, "sasl.mechanisms", "PLAIN", kafka_errstr, sizeof(kafka_errstr)); - rd_kafka_conf_set(rdkafka_conf, "sasl.username", _instance->sasl_username, kafka_errstr, sizeof(kafka_errstr)); - rd_kafka_conf_set(rdkafka_conf, "sasl.password", _instance->sasl_passwd, kafka_errstr, sizeof(kafka_errstr)); - } - - if(!(_instance->kafka_handle=rd_kafka_new(RD_KAFKA_PRODUCER, rdkafka_conf, kafka_errstr, sizeof(kafka_errstr)))) - { - MESA_handle_runtime_log(_instance->logger, RLOG_LV_FATAL, "KAFKA_INIT", "rd_kafka_new is error"); - return NULL; - } - - load_log_common_field(_instance->common_field_file, _instance->id2field, &(_instance->service2topic), &(_instance->max_service)); - - if(_instance->service2topic!=NULL) - { - for(i=0; i<_instance->max_service; i++) - { - if(_instance->service2topic[i].type==TLD_TYPE_MAX && strlen(_instance->service2topic[i].name)>0) - { - register_topic(_instance, &( _instance->service2topic[i])); - } - - if(i==1) - { - memcpy(&(_instance->service2topic[i]), &(_instance->service2topic[0]), sizeof(struct topic_stat)); // service id of security event is 0 and 1 - } - } - } - else - { - MESA_handle_runtime_log(_instance->logger, - RLOG_LV_FATAL, - "KAFKA_INIT", - "load_log_common_field is error, please check %s", - _instance->common_field_file - ); - } - - return _instance; -} -void tsg_sendlog_destroy(struct tsg_log_instance_t * instance) -{ - if(instance==NULL) - { - return ; - } - - if(instance->mode!=CLOSE) - { - for(int i=0; i<instance->max_service; i++) - { - if(instance->service2topic[i].type!=TLD_TYPE_MAX || i==1) //i=1 equal i=0, service id of security event is 0 and 1 - { - continue; - } - - if(instance->service2topic[i].topic_rkt!=NULL) - { - rd_kafka_topic_destroy(instance->service2topic[i].topic_rkt); - } - - if(instance->service2topic[i].drop_start!=NULL) - { - free(instance->service2topic[i].drop_start); - instance->service2topic[i].drop_start=NULL; - } - - if(instance->service2topic[i].send_log_percent!=NULL) - { - free(instance->service2topic[i].send_log_percent); - instance->service2topic[i].send_log_percent=NULL; - } - } - - //rd_kafka_destroy_flags(instance->kafka_handle, 4); - rd_kafka_destroy(instance->kafka_handle); - - free(instance->service2topic); - instance->service2topic=NULL; - } - - - MESA_destroy_runtime_log_handle(instance->logger); - instance->logger=NULL; - - free(instance); - instance=NULL; -/* - int ret=0,count=0; - - while(1) - { - ret=rd_kafka_wait_destroyed(1000); - if(ret==0) - { - break; - } - count++; - } -*/ - - return ; -} - -int tsg_send_log(struct tsg_log_instance_t *instance, struct TLD_handle_t *handle, tsg_log_t *log_msg, int thread_id) -{ - int fs_id=0,ret=0; - int i=0,repeat_cnt=0; - int policy_id[MAX_RESULT_NUM]={0}; - struct TLD_handle_t *_handle=handle; - struct tsg_log_instance_t *_instance=instance; - - if(_instance==NULL || _handle==NULL || log_msg==NULL) - { - TLD_cancel(handle); - MESA_handle_runtime_log(_instance->logger, RLOG_LV_DEBUG, "TSG_SEND_LOG", " instance==NULL || TLD_handle==NULL || log_msg==NULL "); - return -1; - } - - if(_instance->mode==CLOSE) - { - TLD_cancel(handle); - FS_operate(_instance->fs2_handle, _instance->sum_line_id, _instance->fs2_field_id[LOG_COLUMN_STATUS_DROP], FS_OP_ADD, 1); - MESA_handle_runtime_log(_instance->logger, RLOG_LV_INFO, "TSG_SEND_LOG", "Disable tsg_send_log."); - return 0; - } - - TLD_append_streaminfo(instance, handle, log_msg->a_stream); - TLD_append(_handle, _instance->id2field[LOG_COMMON_SLED_IP].name, (void *)(_instance->local_ip_str), TLD_TYPE_STRING); - if(strlen(g_tsg_para.device_sn)>0) - { - TLD_append(_handle, _instance->id2field[LOG_COMMON_DEVICE_ID].name, (void *)(g_tsg_para.device_sn), TLD_TYPE_STRING); - } - - if(strlen(g_tsg_para.data_center)>0 && _instance->send_data_center==1) - { - TLD_append(_handle, _instance->id2field[LOG_COMMON_DATA_CENTER].name, (void *)(g_tsg_para.data_center), TLD_TYPE_STRING); - } - - if(strlen(g_tsg_para.device_tag)>0) - { - TLD_append(_handle, _instance->id2field[LOG_COMMON_DEVICE_TAG].name, (void *)(g_tsg_para.device_tag), TLD_TYPE_STRING); - } - - set_application_behavior(_instance, _handle, log_msg->a_stream); - - for(i=0;i<log_msg->result_num; i++) - { - if(is_multi_hit_same_policy(&(log_msg->result[i]), policy_id, &repeat_cnt)) - { - MESA_handle_runtime_log(_instance->logger, RLOG_LV_DEBUG, - "TSG_SEND_LOG", - "tsg same log:cfg_id=%d service=%d addr=%s", - log_msg->result[i].config_id, - log_msg->result[i].service_id, - (log_msg->a_stream==NULL ? "" : PRINTADDR(log_msg->a_stream,_instance->level)) - ); - continue; - } - - switch(log_msg->result[i].do_log) - { - case LOG_ABORT: - MESA_handle_runtime_log(_instance->logger, RLOG_LV_DEBUG, - "TSG_SEND_LOG", - "tsg abort log:cfg_id=%d service=%d addr=%s", - log_msg->result[i].config_id, - log_msg->result[i].service_id, - (log_msg->a_stream==NULL ? "" : PRINTADDR(log_msg->a_stream,_instance->level)) - ); - - fs_id=action2fs_id((int)log_msg->result[i].action); - FS_operate(_instance->fs2_handle, _instance->fs2_field_id[fs_id], 0, FS_OP_ADD, 1); - continue; - break; - case LOG_ALL: - if(log_msg->result[i].action==TSG_ACTION_MONITOR) - { - set_s3_filename(_instance, _handle, log_msg->a_stream); - set_mail_eml(_instance, _handle, log_msg->a_stream); - } - break; - case LOG_NOFILE: - if(log_msg->result[i].action==TSG_ACTION_MONITOR) - { - TLD_delete(_handle, _instance->id2field[LOG_COMMON_MAIL_EML_FILE].name); - TLD_delete(_handle, _instance->id2field[LOG_COMMON_HTTP_REQUEST_S3_FILE].name); - TLD_delete(_handle, _instance->id2field[LOG_COMMON_HTTP_RESPONSE_S3_FILE].name); - } - break; - default: - break; - } - - ret=update_percent(_instance, log_msg->result[i].service_id, LOG_COLUMN_STATUS_DROP, thread_id); - if(ret==1) - { - MESA_handle_runtime_log(_instance->logger, RLOG_LV_DEBUG, - "TSG_SEND_LOG", - "tsg drop log:cfg_id=%d service=%d send_log_percent: %d addr=%s", - log_msg->result[i].config_id, - log_msg->result[i].service_id, - _instance->service2topic[log_msg->result[i].service_id].send_log_percent[thread_id], - (log_msg->a_stream==NULL ? "" : PRINTADDR(log_msg->a_stream,_instance->level)) - ); - continue; - } - - TLD_append(_handle, _instance->id2field[LOG_COMMON_POLICY_ID].name, (void *)(long)(log_msg->result[i].config_id), TLD_TYPE_LONG); - TLD_append(_handle, _instance->id2field[LOG_COMMON_SERVICE].name, (void *)(long)(log_msg->result[i].service_id), TLD_TYPE_LONG); - TLD_append(_handle, _instance->id2field[LOG_COMMON_ACTION].name, (void *)(long)((unsigned char)log_msg->result[i].action), TLD_TYPE_LONG); - - set_notify_execution_result(_instance, _handle, log_msg->a_stream, &(log_msg->result[i])); - - if(_instance->send_user_region==1) - { - set_user_region(_instance, _handle, &log_msg->result[i], thread_id); - } - - if(log_msg->result[i].config_id==0 && log_msg->a_stream!=NULL) - { - set_nat_linkinfo(_instance, _handle, log_msg->a_stream, _instance->id2field[LOG_COMMON_LINK_INFO_C2S].name, _instance->bridge_id[LOG_BRIDGE_NAT_C2S_LINKINFO]); - set_nat_linkinfo(_instance, _handle, log_msg->a_stream, _instance->id2field[LOG_COMMON_LINK_INFO_S2C].name, _instance->bridge_id[LOG_BRIDGE_NAT_S2C_LINKINFO]); - } - - if(log_msg->result[i].action==TSG_ACTION_DENY) - { - set_common_sub_action(_handle, _instance->id2field[LOG_COMMON_SUB_ACTION].name, &(log_msg->result[i])); - } - - StringBuffer sb(0, 2048); - Writer<StringBuffer> writer(sb); - _handle->document->Accept(writer); - - tsg_send_payload(_instance, log_msg->result[i].service_id, (char *)sb.GetString(), sb.GetSize(), thread_id); - - TLD_delete(_handle, _instance->id2field[LOG_COMMON_POLICY_ID].name); - TLD_delete(_handle, _instance->id2field[LOG_COMMON_SERVICE].name); - TLD_delete(_handle, _instance->id2field[LOG_COMMON_ACTION].name); - TLD_delete(_handle, _instance->id2field[LOG_COMMON_USER_REGION].name); - TLD_delete(_handle, _instance->id2field[LOG_COMMON_SUB_ACTION].name); - } - - TLD_cancel(handle); - - return 0; -} - -int tsg_register_topic(struct tsg_log_instance_t *instance, char *topic_name) -{ - struct tsg_log_instance_t *_instance=(struct tsg_log_instance_t *)instance; - if(_instance==NULL || _instance->mode==CLOSE || topic_name==NULL || _instance->kafka_handle==NULL) - { - return -1; - } - - _instance->service2topic=(struct topic_stat *)realloc(_instance->service2topic, (_instance->max_service+1)*sizeof(struct topic_stat)); - _instance->service2topic[_instance->max_service].type=TLD_TYPE_MAX; - memset(_instance->service2topic[_instance->max_service].name, 0, MAX_STRING_LEN); - memcpy(_instance->service2topic[_instance->max_service].name, topic_name, MIN(MAX_STRING_LEN-1, strlen(topic_name))); - - register_topic(_instance, &(_instance->service2topic[_instance->max_service])); - _instance->max_service++; - - return (_instance->max_service-1); -} - -int tsg_send_payload(struct tsg_log_instance_t *instance, int topic_id, char *payload, int payload_len, int thread_id) -{ - int status=0; - struct tsg_log_instance_t *_instance=instance; - - if(_instance==NULL || _instance->mode==CLOSE) - { - return 0; - } - - if(payload==NULL || payload_len<=0 || topic_id<0 || _instance->service2topic[topic_id].topic_rkt==NULL) - { - MESA_handle_runtime_log(_instance->logger, - RLOG_LV_INFO, - "TSG_SEND_LOG", - "tsg_send_log to kafka is error (payload==NULL || payload_len<=0 || topic_id<0 || _instance->service2topic[topic_id].topic_rkt==NULL), topic: %s", - _instance->service2topic[topic_id].name - ); - return -1; - } - - status=rd_kafka_produce(_instance->service2topic[topic_id].topic_rkt, RD_KAFKA_PARTITION_UA, RD_KAFKA_MSG_F_COPY, payload, payload_len, NULL, 0, NULL); - if(status<0) - { - update_percent(_instance, topic_id, LOG_COLUMN_STATUS_FAIL, thread_id); - - MESA_handle_runtime_log(_instance->logger, - RLOG_LV_INFO, - "TSG_SEND_LOG", - "tsg_send_log to kafka is error of code: %d %s(%s), status: %d, topic: %s %s", - rd_kafka_last_error(), - rd_kafka_err2name(rd_kafka_last_error()), - rd_kafka_err2str(rd_kafka_last_error()), - status, - _instance->service2topic[topic_id].name, - payload - ); - return -1; - } - else - { - update_percent(_instance, topic_id, LOG_COLUMN_STATUS_SUCCESS, thread_id); - MESA_handle_runtime_log(_instance->logger, - RLOG_LV_DEBUG, - "TSG_SEND_LOG", - "log send successfully %s: %s", - _instance->service2topic[topic_id].name, - payload - ); - } - - - - - update_percent(_instance, topic_id, LOG_COLUMN_STATUS_MAX, thread_id); - - return 0; -} +#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+#include <assert.h>
+#include <time.h>
+#include <sys/socket.h>
+#include <netinet/in.h>
+#include <arpa/inet.h>
+#include <net/if.h>
+#include <sys/types.h>
+#include <sys/ioctl.h>
+#include <unistd.h>
+#include <pthread.h>
+#include <arpa/inet.h>
+
+#include <MESA/stream.h>
+#include <MESA/MESA_prof_load.h>
+#include <MESA/MESA_handle_logger.h>
+
+#include "app_label.h"
+#include "tsg_entry.h"
+#include "tsg_send_log.h"
+#include "tsg_send_log_internal.h"
+
+#include "rapidjson/document.h" // rapidjson's DOM-style API
+#include "rapidjson/prettywriter.h" // for stringify JSON
+#include "rapidjson/stringbuffer.h"
+
+
+using namespace rapidjson;
+using namespace std;
+
+
+char TSG_SEND_LOG_VERSION_20200729=0;
+struct tsg_log_instance_t *g_tsg_log_instance;
+
+struct TLD_handle_t
+{
+ int thread_id;
+ MemoryPoolAllocator<> *valueAllocator;
+ Document *document;
+};
+
+id2field_t g_log_fs2_field[LOG_FS2_TYPE_MAX]={
+ {0, LOG_FS2_ABORT_ALLOW, "abort_allow"},
+ {0, LOG_FS2_ABORT_DENY, "abort_deny"},
+ {0, LOG_FS2_ABORT_MONITOR, "abort_monitor"},
+ {0, LOG_FS2_ABORT_INTERCEPT, "abort_intercept"},
+ {0, LOG_FS2_ABORT_UNKNOWN, "abort_unknown"},
+ {0, LOG_FS2_CREATE_LOG_HANDLE, "create_log_cnt"},
+ {0, LOG_FS2_DUP_LOG_HANDLE, "dup_log_cnt"},
+ {0, LOG_FS2_APPEND_LOG_HANDLE, "append_log_cnt"},
+ {0, LOG_FS2_FREE_LOG_HANDLE, "free_log_cnt"},
+ {0, LOG_FS2_FREE_RAPID_SIZE, "free_rapid_size"},
+ {0, LOG_FS2_FREE_RAPID_CAPACITY, "free_rapid_capacity"}
+ };
+
+
+const id2field_t tld_type[TLD_TYPE_MAX]={{TLD_TYPE_UNKNOWN, TLD_TYPE_UNKNOWN, "UNKOWN"},
+ {TLD_TYPE_LONG, TLD_TYPE_LONG, "LONG"},
+ {TLD_TYPE_STRING, TLD_TYPE_STRING, "STRING"},
+ {TLD_TYPE_FILE, TLD_TYPE_FILE, "FILE"},
+ {TLD_TYPE_TOPIC, TLD_TYPE_TOPIC, "TOPIC"}
+ };
+
+extern "C" int MESA_get_dev_ipv4(const char *device, int *ip_add);
+
+static int string_cat(char *dst, int dst_len, char *src)
+{
+ if(dst==NULL || dst_len<=0 || src==NULL)
+ {
+ return 0;
+ }
+
+ return snprintf(dst, dst_len, "%s", src);
+}
+
+#define add_number_member add_member
+#define add_object_member add_member
+
+#define add_member(handle, object, key, val) \
+ { \
+ Value temp_key; \
+ temp_key.SetString((key), (handle)->document->GetAllocator()); \
+ (object)->AddMember(temp_key, (val), (handle)->document->GetAllocator()); \
+ }
+
+static int copy_rapidjson(struct TLD_handle_t *_handle, char *field_name, const char *json_string)
+{
+ Document nest_document;
+ nest_document.Parse(json_string);
+
+ Value p_object(kObjectType);
+ p_object.CopyFrom(nest_document, _handle->document->GetAllocator());
+
+ TLD_append(_handle, field_name, (void *)&p_object, TLD_TYPE_OBJECT);
+
+ return 0;
+}
+
+static void add_str_member(struct TLD_handle_t *_handle, Value *object, const char *key, const char *val)
+{
+ Value temp_key;
+ Value temp_val;
+ temp_key.SetString(key, _handle->document->GetAllocator());
+ temp_val.SetString(val, _handle->document->GetAllocator());
+ object->AddMember(temp_key, temp_val, _handle->document->GetAllocator());
+}
+
+
+static int register_topic(struct tsg_log_instance_t *instance, struct topic_stat *topic)
+{
+ rd_kafka_topic_conf_t *topic_conf;
+ struct tsg_log_instance_t *_instance=(struct tsg_log_instance_t *)instance;
+
+ topic_conf=rd_kafka_topic_conf_new();
+ topic->status=1;
+ topic->topic_rkt=(rd_kafka_topic_t *)calloc(1, sizeof(rd_kafka_topic_t*));
+ topic->topic_rkt=rd_kafka_topic_new(_instance->kafka_handle, topic->name, topic_conf);
+
+ int thread_num=get_thread_count();
+ topic->drop_start=(long long *)calloc(thread_num, sizeof(long long));
+ topic->send_log_percent=(int *)calloc(thread_num, sizeof(int));
+
+ for(int i=0; i<thread_num; i++)
+ {
+ topic->send_log_percent[i]=100;
+ topic->drop_start[i]=get_current_time_ms();
+ }
+
+ topic->fs2_line_id=FS_register(_instance->fs2_handle, FS_STYLE_LINE, FS_CALC_SPEED, topic->name);
+
+ return 1;
+}
+
+
+static int update_percent(struct tsg_log_instance_t *_instance, int service_id, enum LOG_COLUMN_STATUS column, int thread_id)
+{
+ long long current_time_ms=get_current_time_ms();
+ struct topic_stat *topic=(struct topic_stat *)&(_instance->service2topic[service_id]);
+
+ switch(column)
+ {
+ case LOG_COLUMN_STATUS_SUCCESS:
+ FS_operate(_instance->fs2_handle, topic->fs2_line_id, _instance->fs2_column_id[column], FS_OP_ADD, 1);
+ FS_operate(_instance->fs2_handle, topic->fs2_line_id, _instance->fs2_column_id[column+1], FS_OP_ADD, 1);
+
+ FS_operate(_instance->fs2_handle, _instance->sum_line_id, _instance->fs2_column_id[column], FS_OP_ADD, 1);
+ FS_operate(_instance->fs2_handle, _instance->sum_line_id, _instance->fs2_column_id[column+1], FS_OP_ADD, 1);
+ break;
+ case LOG_COLUMN_STATUS_FAIL:
+ FS_operate(_instance->fs2_handle, topic->fs2_line_id, _instance->fs2_column_id[column], FS_OP_ADD, 1);
+ FS_operate(_instance->fs2_handle, topic->fs2_line_id, _instance->fs2_column_id[column+1], FS_OP_ADD, 1);
+
+ FS_operate(_instance->fs2_handle, _instance->sum_line_id, _instance->fs2_column_id[column], FS_OP_ADD, 1);
+ FS_operate(_instance->fs2_handle, _instance->sum_line_id, _instance->fs2_column_id[column+1], FS_OP_ADD, 1);
+ if(current_time_ms - topic->drop_start[thread_id]>=1000)
+ {
+ topic->send_log_percent[thread_id]/=2;
+ topic->drop_start[thread_id]=current_time_ms;
+ }
+ break;
+ case LOG_COLUMN_STATUS_DROP:
+ if((current_time_ms%100) > topic->send_log_percent[thread_id])
+ {
+ FS_operate(_instance->fs2_handle, topic->fs2_line_id, _instance->fs2_column_id[column], FS_OP_ADD, 1);
+ FS_operate(_instance->fs2_handle, topic->fs2_line_id, _instance->fs2_column_id[column+1], FS_OP_ADD, 1);
+
+ FS_operate(_instance->fs2_handle, _instance->sum_line_id, _instance->fs2_column_id[column], FS_OP_ADD, 1);
+ FS_operate(_instance->fs2_handle, _instance->sum_line_id, _instance->fs2_column_id[column+1], FS_OP_ADD, 1);
+ return 1;
+ }
+ break;
+ case LOG_COLUMN_STATUS_MAX:
+ if(topic->send_log_percent[thread_id]>=100)
+ {
+ break;
+ }
+
+ if((current_time_ms - topic->drop_start[thread_id]) >= _instance->recovery_interval*1000)
+ {
+ topic->send_log_percent[thread_id]++;
+ topic->drop_start[thread_id]=current_time_ms;
+ }
+ break;
+ default:
+ break;
+ }
+
+ return 0;
+}
+
+static struct tsg_log_instance_t *get_log_instance(void)
+{
+ if(g_tsg_log_instance!=NULL)
+ {
+ return g_tsg_log_instance;
+ }
+
+ return NULL;
+}
+
+static int is_tunnels(struct streaminfo *a_stream)
+{
+ const struct streaminfo *ptmp = a_stream;
+ const struct streaminfo *pfather=NULL;
+ int is_tunnel=0;
+
+ while(ptmp)
+ {
+ pfather = ptmp->pfather;
+ switch(ptmp->addr.addrtype)
+ {
+ case ADDR_TYPE_GRE:
+ case ADDR_TYPE_VLAN:
+ case ADDR_TYPE_L2TP:
+ case ADDR_TYPE_PPTP:
+ case ADDR_TYPE_VXLAN:
+ case ADDR_TYPE_GPRS_TUNNEL:
+ case __ADDR_TYPE_IP_PAIR_V4:
+ case __ADDR_TYPE_IP_PAIR_V6:
+ is_tunnel=1;
+ break;
+ case ADDR_TYPE_MPLS:
+ if(ptmp->addr.mpls->s2c_layer_num==0 && ptmp->addr.mpls->c2s_layer_num==0)
+ {
+ break;
+ }
+ is_tunnel=1;
+ break;
+ default:
+ break;
+ }
+
+ ptmp = pfather;
+ }
+
+ return is_tunnel;
+}
+
+static int set_isn(struct TLD_handle_t *_handle, struct streaminfo *a_stream, char *field_name, enum MESA_stream_opt type)
+{
+ int ret=0;
+ unsigned int isn=0;
+ int size=sizeof(unsigned long long);
+
+ size=sizeof(unsigned int);
+ ret=MESA_get_stream_opt(a_stream, type, &isn, &size);
+ if(ret==0)
+ {
+ TLD_append(_handle, field_name, (void *)(long)isn, TLD_TYPE_LONG);
+ }
+
+ return 1;
+}
+
+static int set_tcp_isn(struct tsg_log_instance_t *_instance, struct TLD_handle_t *_handle, struct streaminfo *a_stream)
+{
+ if(a_stream->type==STREAM_TYPE_TCP)
+ {
+ switch(a_stream->dir)
+ {
+ case DIR_C2S:
+ set_isn(_handle, a_stream, _instance->id2field[LOG_COMMON_TCP_CLIENT_ISN].name, MSO_TCP_ISN_C2S);
+ break;
+ case DIR_S2C:
+ set_isn(_handle, a_stream, _instance->id2field[LOG_COMMON_TCP_SERVER_ISN].name, MSO_TCP_ISN_S2C);
+ break;
+ case DIR_DOUBLE:
+ set_isn(_handle, a_stream, _instance->id2field[LOG_COMMON_TCP_CLIENT_ISN].name, MSO_TCP_ISN_C2S);
+ set_isn(_handle, a_stream, _instance->id2field[LOG_COMMON_TCP_SERVER_ISN].name, MSO_TCP_ISN_S2C);
+ break;
+ default:
+ break;
+ }
+ }
+
+ return 1;
+}
+
+static int set_linkinfo(struct tsg_log_instance_t *_instance, struct TLD_handle_t *_handle, struct streaminfo *a_stream)
+{
+ const char *linkinfo=(const char *)stream_bridge_async_data_get(a_stream, _instance->bridge_id[LOG_BRIDGE_MAC_LINKINFO]);
+ if(linkinfo==NULL)
+ {
+ return 0;
+ }
+
+ cJSON *item=NULL;
+ cJSON *object=cJSON_Parse(linkinfo);
+ if(object)
+ {
+ item=cJSON_GetObjectItem(object, "common_direction");
+ if(item!=NULL)
+ {
+ TLD_append(_handle, (char *)"common_direction", (void *)(long)(item->valueint), TLD_TYPE_LONG);
+ }
+
+ item=cJSON_GetObjectItem(object, "common_egress_link_id");
+ if(item!=NULL)
+ {
+ TLD_append(_handle, (char *)"common_egress_link_id", (void *)(long)(item->valueint), TLD_TYPE_LONG);
+ }
+
+ item=cJSON_GetObjectItem(object, "common_ingress_link_id");
+ if(item!=NULL)
+ {
+ TLD_append(_handle, (char *)"common_ingress_link_id", (void *)(long)(item->valueint), TLD_TYPE_LONG);
+ }
+
+ cJSON_Delete(object);
+ object=NULL;
+
+ return 1;
+ }
+
+ return 0;
+}
+
+static int set_asn(struct TLD_handle_t *_handle, struct streaminfo *a_stream, char *field_name, struct asn_info *asn_info)
+{
+ int len=0;
+ char buff[1024]={0};
+ int buff_len=sizeof(buff);
+
+ if(asn_info!=NULL)
+ {
+ len+=string_cat(buff+len, buff_len-len, asn_info->asn_id);
+ buff[len++]='(';
+ len+=string_cat(buff+len, buff_len-len, asn_info->organization);
+ buff[len++]=')';
+ TLD_append(_handle, field_name, (void *)buff, TLD_TYPE_STRING);
+ }
+
+ return 1;
+}
+
+static int set_location(struct TLD_handle_t *_handle, struct streaminfo *a_stream, char *field_name, struct location_info *location_info)
+{
+ int len=0;
+ char buff[1024]={0};
+ int buff_len=sizeof(buff);
+
+ if(location_info==NULL)
+ {
+ return 0;
+ }
+
+ int location_type=tsg_get_location_type();
+ switch(location_type)
+ {
+ case 18:
+ len+=string_cat(buff+len, buff_len-len, location_info->city_full);
+ buff[len++]=',';
+ len+=string_cat(buff+len, buff_len-len, location_info->province_full);
+ buff[len++]=',';
+ len+=string_cat(buff+len, buff_len-len, location_info->country_full);
+ break;
+ case 19:
+ len+=string_cat(buff+len, buff_len-len, location_info->country_full);
+ buff[len++]='.';
+ len+=string_cat(buff+len, buff_len-len, location_info->province_full);
+ buff[len++]='.';
+ len+=string_cat(buff+len, buff_len-len, location_info->city_full);
+
+ if(location_info->subdivision_addr!=NULL)
+ {
+ buff[len++]='.';
+ len+=string_cat(buff+len, buff_len-len, location_info->subdivision_addr);
+ }
+ break;
+ default:
+ return 0;
+ }
+
+ TLD_append(_handle, field_name, (void *)buff, TLD_TYPE_STRING);
+
+ return 1;
+}
+
+static int set_direction(struct tsg_log_instance_t *_instance, struct TLD_handle_t *_handle, struct streaminfo *a_stream)
+{
+ int direction=0,i_or_e=0;
+
+ i_or_e=MESA_dir_link_to_human(a_stream->routedir);
+ switch(a_stream->curdir)
+ {
+ case DIR_C2S:
+ if(i_or_e=='E' || i_or_e=='e')
+ {
+ direction='E';
+ }
+ else
+ {
+ direction='I';
+ }
+ break;
+ case DIR_S2C:
+ if(i_or_e=='E' || i_or_e=='e')
+ {
+ direction='I';
+ }
+ else
+ {
+ direction='E';
+ }
+ break;
+ default:
+ break;
+ }
+
+
+ TLD_append(_handle, _instance->id2field[LOG_COMMON_DIRECTION].name, (void *)(long)direction, TLD_TYPE_LONG);
+
+ return 1;
+}
+
+static int set_address_list(struct tsg_log_instance_t *_instance, struct TLD_handle_t *_handle, struct streaminfo *a_stream)
+{
+ unsigned short tunnel_type=0;
+ char nest_addr_buf[1024];
+ int tunnel_type_size=sizeof(tunnel_type);
+
+ MESA_get_stream_opt(a_stream, MSO_STREAM_TUNNEL_TYPE, &tunnel_type, &tunnel_type_size);
+ if(tunnel_type==STREAM_TUNNLE_NON)
+ {
+ layer_addr_ntop_r(a_stream,nest_addr_buf, sizeof(nest_addr_buf));
+ }
+ else
+ {
+ stream_addr_list_ntop(a_stream,nest_addr_buf, sizeof(nest_addr_buf));
+ }
+
+ TLD_append(_handle, _instance->id2field[LOG_COMMON_ADDRESS_LIST].name, (void *)nest_addr_buf, TLD_TYPE_STRING);
+
+ return 1;
+}
+
+static int set_tuple4(struct tsg_log_instance_t *_instance, struct TLD_handle_t *_handle, struct streaminfo *a_stream)
+{
+ int addr_type=0;
+ unsigned short c_port=0, s_port=0;
+ struct layer_addr_ipv4 *ipv4=NULL;
+ struct layer_addr_ipv6 *ipv6=NULL;
+ char server_ip[MAX_IPV4_LEN*8]={0};
+ char client_ip[MAX_IPV4_LEN*8]={0};
+
+ switch(a_stream->addr.addrtype)
+ {
+ case ADDR_TYPE_IPV4:
+ case __ADDR_TYPE_IP_PAIR_V4:
+ ipv4=a_stream->addr.ipv4;
+ addr_type=4;
+ c_port=ntohs(ipv4->source);
+ s_port=ntohs(ipv4->dest);
+
+ inet_ntop(AF_INET, (void *)&ipv4->saddr, client_ip, sizeof(client_ip));
+ inet_ntop(AF_INET, (void *)&ipv4->daddr, server_ip, sizeof(server_ip));
+ break;
+ case ADDR_TYPE_IPV6:
+ case __ADDR_TYPE_IP_PAIR_V6:
+ ipv6=a_stream->addr.ipv6;
+ addr_type=6;
+ c_port=ntohs(ipv6->source);
+ s_port=ntohs(ipv6->dest);
+
+ inet_ntop(AF_INET6, (void *)ipv6->saddr, client_ip, sizeof(client_ip));
+ inet_ntop(AF_INET6, (void *)ipv6->daddr, server_ip, sizeof(server_ip));
+ break;
+ default:
+ break;
+ }
+
+
+ TLD_append(_handle, _instance->id2field[LOG_COMMON_SERVER_IP].name, (void *)server_ip, TLD_TYPE_STRING);
+ TLD_append(_handle, _instance->id2field[LOG_COMMON_CLIENT_IP].name, (void *)client_ip, TLD_TYPE_STRING);
+ TLD_append(_handle, _instance->id2field[LOG_COMMON_SERVER_PORT].name, (void *)(long)s_port, TLD_TYPE_LONG);
+ TLD_append(_handle, _instance->id2field[LOG_COMMON_CLIENT_PORT].name, (void *)(long)c_port, TLD_TYPE_LONG);
+
+ TLD_append(_handle, _instance->id2field[LOG_COMMON_STREAM_DIR].name, (void *)(long)a_stream->dir, TLD_TYPE_LONG);
+ TLD_append(_handle, _instance->id2field[LOG_COMMON_ADDRESS_TYPE].name, (void *)(long)addr_type, TLD_TYPE_LONG);
+
+ return 1;
+}
+
+static int set_duraction(struct tsg_log_instance_t *_instance, struct TLD_handle_t *_handle, struct streaminfo *a_stream)
+{
+ int ret=0;
+ long common_con_duration_ms=0;
+ unsigned long long create_time=0,last_time=0;
+ int size=sizeof(unsigned long long);
+
+ if(a_stream->ptcpdetail!=NULL)
+ {
+ TLD_append(_handle, _instance->id2field[LOG_COMMON_START_TIME].name, (void *)(a_stream->ptcpdetail->createtime), TLD_TYPE_LONG);
+ TLD_append(_handle, _instance->id2field[LOG_COMMON_END_TIME].name, (void *)(a_stream->ptcpdetail->lastmtime), TLD_TYPE_LONG);
+
+ ret=MESA_get_stream_opt(a_stream, MSO_STREAM_CREATE_TIMESTAMP_MS, (void *)&create_time, &size);
+ if(ret>=0)
+ {
+ ret=MESA_get_stream_opt(a_stream, MSO_STREAM_LASTUPDATE_TIMESTAMP_MS, (void *)&last_time, &size);
+ if(ret>=0 && last_time>create_time)
+ {
+ common_con_duration_ms=last_time-create_time;
+ TLD_append(_handle, _instance->id2field[LOG_COMMON_CON_DURATION_MS].name, (void *)(common_con_duration_ms), TLD_TYPE_LONG);
+ }
+ }
+ }
+ else
+ {
+ time_t cur_time=time(NULL);
+ TLD_append(_handle, _instance->id2field[LOG_COMMON_START_TIME].name, (void *)cur_time, TLD_TYPE_LONG);
+ TLD_append(_handle, _instance->id2field[LOG_COMMON_END_TIME].name, (void *)cur_time, TLD_TYPE_LONG);
+ TLD_append(_handle, _instance->id2field[LOG_COMMON_CON_DURATION_MS].name, (void *)(common_con_duration_ms), TLD_TYPE_LONG);
+ }
+
+ return 1;
+}
+
+static int set_subscriber_id(struct TLD_handle_t *_handle, char *field_name, struct subscribe_id_info *subscriber)
+{
+ if(subscriber!=NULL && subscriber->subscribe_id!=NULL)
+ {
+ TLD_append(_handle, field_name, (void *)subscriber->subscribe_id, TLD_TYPE_STRING);
+ return 1;
+ }
+
+ return 0;
+}
+
+static int set_fqdn_category(struct tsg_log_instance_t *_instance, struct TLD_handle_t *_handle, struct streaminfo *a_stream, unsigned int *category_id, int category_id_num)
+{
+ int i=0;
+ if(category_id_num<=0 || category_id==NULL)
+ {
+ return 0;
+ }
+
+ Value array(kArrayType);
+ for(i=0; i<category_id_num; i++)
+ {
+ array.PushBack(category_id[i], _handle->document->GetAllocator());
+ }
+
+ TLD_append(_handle, _instance->id2field[LOG_COMMON_FQDN_CATEGORY].name, &array, TLD_TYPE_OBJECT);
+
+ return 1;
+}
+
+static int set_umts_user_info(struct tsg_log_instance_t *_instance, struct TLD_handle_t *_handle, struct streaminfo *a_stream, struct umts_user_info *user_info)
+{
+ if(user_info==NULL)
+ {
+ return 0;
+ }
+
+ if(user_info->apn!=NULL)
+ {
+ TLD_append(_handle, _instance->id2field[LOG_COMMON_GTP_APN].name, (void *)user_info->apn, TLD_TYPE_STRING);
+ }
+
+ if(user_info->imsi!=NULL)
+ {
+ TLD_append(_handle, _instance->id2field[LOG_COMMON_GTP_IMSI].name, (void *)user_info->imsi, TLD_TYPE_STRING);
+ }
+
+ if(user_info->imei!=NULL)
+ {
+ TLD_append(_handle, _instance->id2field[LOG_COMMON_GTP_IMEI].name, (void *)user_info->imei, TLD_TYPE_STRING);
+ }
+
+ if(user_info->msisdn!=NULL)
+ {
+ TLD_append(_handle, _instance->id2field[LOG_COMMON_GTP_MSISDN].name, (void *)user_info->msisdn, TLD_TYPE_STRING); //phone number
+ }
+
+ return 1;
+}
+
+static int set_packet_bytes(struct tsg_log_instance_t *_instance, struct TLD_handle_t *_handle, struct streaminfo *a_stream)
+{
+ struct tcp_flow_stat *tflow_project=NULL;
+ struct udp_flow_stat *uflow_project=NULL;
+
+ switch(a_stream->type)
+ {
+ case STREAM_TYPE_TCP:
+ tflow_project=(struct tcp_flow_stat *)project_req_get_struct(a_stream, _instance->tcp_flow_project_id);
+ if(tflow_project!=NULL)
+ {
+ TLD_append(_handle, _instance->id2field[LOG_COMMON_S2C_PKT_NUM].name, (void *)(long)tflow_project->S2C_all_pkt, TLD_TYPE_LONG);
+ TLD_append(_handle, _instance->id2field[LOG_COMMON_S2C_BYTE_NUM].name, (void *)(long)tflow_project->S2C_all_byte_raw, TLD_TYPE_LONG);
+ TLD_append(_handle, _instance->id2field[LOG_COMMON_C2S_PKT_NUM].name, (void *)(long)tflow_project->C2S_all_pkt, TLD_TYPE_LONG);
+ TLD_append(_handle, _instance->id2field[LOG_COMMON_C2S_BYTE_NUM].name, (void *)(long)tflow_project->C2S_all_byte_raw, TLD_TYPE_LONG);
+ }
+ break;
+ case STREAM_TYPE_UDP:
+ uflow_project=(struct udp_flow_stat *)project_req_get_struct(a_stream, _instance->udp_flow_project_id);
+ if(uflow_project!=NULL)
+ {
+ TLD_append(_handle, _instance->id2field[LOG_COMMON_S2C_PKT_NUM].name, (void *)(long)uflow_project->S2C_pkt, TLD_TYPE_LONG);
+ TLD_append(_handle, _instance->id2field[LOG_COMMON_S2C_BYTE_NUM].name, (void *)(long)uflow_project->S2C_all_byte_raw, TLD_TYPE_LONG);
+ TLD_append(_handle, _instance->id2field[LOG_COMMON_C2S_PKT_NUM].name, (void *)(long)uflow_project->C2S_pkt, TLD_TYPE_LONG);
+ TLD_append(_handle, _instance->id2field[LOG_COMMON_C2S_BYTE_NUM].name, (void *)(long)uflow_project->C2S_all_byte_raw, TLD_TYPE_LONG);
+ }
+ break;
+ default:
+ break;
+ }
+
+ return 1;
+}
+
+static int set_app_identify_info(struct TLD_handle_t *_handle, char *field_name, struct gather_app_result *result)
+{
+ int i=0,j=0,ret=0;
+ char app_name[512]={0};
+ Value array(kArrayType);
+
+ for(i=ORIGIN_USER_DEFINE; i<ORIGIN_MAX; i++)
+ {
+ if(result[i].app_num<=0)
+ {
+ continue;
+ }
+
+ Value object(kObjectType);
+ for(j=0; j<result[i].app_num; j++)
+ {
+ ret=tsg_app_id2name(result[i].attributes[j].app_id, app_name, sizeof(app_name), 0);
+ if(ret>0)
+ {
+ add_str_member(_handle, &object, "app_name", app_name);
+ }
+ else
+ {
+ object.AddMember("app_name", result[i].attributes[j].app_id, _handle->document->GetAllocator());
+ }
+ object.AddMember("packet_sequence",result[i].attributes[j].packet_sequence, _handle->document->GetAllocator());
+ }
+
+ array.PushBack(object, _handle->document->GetAllocator());
+ }
+
+ TLD_append(_handle, field_name, &array, TLD_TYPE_OBJECT);
+
+ return 1;
+}
+
+static int get_app_id_list(Value *app_id_object, struct TLD_handle_t *_handle, const char *field_name, struct gather_app_result *result)
+{
+ int i=0,ret=0;
+ char app_name[512]={0};
+
+ if(result->app_num==0)
+ {
+ return 0;
+ }
+
+ Value array(kArrayType);
+ for(i=0; i<result->app_num; i++)
+ {
+ Value object(kObjectType);
+ ret=tsg_app_id2name(result->attributes[i].app_id, app_name, sizeof(app_name), 1);
+ if(ret>0)
+ {
+ add_str_member(_handle, &object, "app_name", app_name);
+ }
+ object.AddMember("app_id", result->attributes[i].app_id, _handle->document->GetAllocator());
+ object.AddMember("surrogate_id", result->attributes[i].surrogate_id, _handle->document->GetAllocator());
+ object.AddMember("packet_sequence",result->attributes[i].packet_sequence, _handle->document->GetAllocator());
+ array.PushBack(object, _handle->document->GetAllocator());
+ }
+ add_object_member(_handle, app_id_object, field_name, array);
+
+ return 1;
+}
+
+
+static int set_userdefine_app(struct TLD_handle_t *_handle, char *field_name, struct gather_app_result *result, TLD_TYPE type)
+{
+ if(result==NULL || result->app_num<=0)
+ {
+ return 0;
+ }
+
+ int i=0;
+ char app_name[256]={0};
+
+ Value array(kArrayType);
+ for(i=0; i<result->app_num; i++)
+ {
+ memset(app_name, 0, sizeof(app_name));
+ tsg_app_id2name(result->attributes[i].app_id, app_name, sizeof(app_name), 1);
+ if(strnlen(app_name, sizeof(app_name)) > 0)
+ {
+ Value app_name_str;
+ app_name_str.SetString(app_name, _handle->document->GetAllocator());
+ array.PushBack(app_name_str, _handle->document->GetAllocator());
+ }
+ }
+
+ TLD_append(_handle, field_name, &array, TLD_TYPE_OBJECT);
+
+ return 1;
+}
+
+static int get_l7_protocol(struct gather_app_result *result, char *protocol_list, int protocol_list_len, int *flag)
+{
+ int i=0,offset=0;
+ char *name=NULL;
+
+ if((*flag)==1)
+ {
+ return 0;
+ }
+
+ for(i=0; i<result->app_num; i++)
+ {
+ (*flag)=1;
+ name=tsg_l7_protocol_id2name(result->attributes[i].app_id);
+ if(name!=NULL)
+ {
+ if(i>0 && offset>0 && (protocol_list_len-offset)>0)
+ {
+ protocol_list[offset]='.';
+ offset++;
+ }
+ offset+=snprintf(protocol_list+offset, protocol_list_len-offset, "%s", name);
+ }
+ }
+
+ return 1;
+}
+
+static unsigned int get_userdefine_name(struct gather_app_result *result, char *app_name, int app_name_len, int *flag, int is_joint_parent)
+{
+ if((*flag)==1 || result->app_num<=0)
+ {
+ return 0;
+ }
+
+
+ int i=0;
+ unsigned int max_app_id=0;
+
+ for(i=0; i< result->app_num; i++)
+ {
+ if(max_app_id < result->attributes[i].app_id)
+ {
+ max_app_id=result->attributes[i].app_id;
+ }
+ }
+
+ (*flag)=1;
+ tsg_app_id2name(max_app_id, app_name, app_name_len, is_joint_parent);
+
+ return max_app_id;
+}
+
+static int get_app_id(struct gather_app_result *result, unsigned int *app_id, unsigned int *surrogate_id, int *flag)
+{
+ if(result->app_num>0 && (*flag)==0)
+ {
+ (*flag)=1;
+ (*app_id)=result->attributes[result->app_num-1].app_id;
+ (*surrogate_id)=result->attributes[result->app_num-1].surrogate_id;
+
+ return 1;
+ }
+
+ return 0;
+}
+
+static int get_app_name_list(struct gather_app_result *result, char *app_name, int app_name_len, int *flag, int is_joint_parent)
+{
+ int i=0;
+ int offset=0;
+
+ if((*flag)==1 || result->app_num<=0)
+ {
+ return 0;
+ }
+
+ for(i=result->app_num-1; i<result->app_num; i++)
+ {
+ (*flag)=1;
+
+ if(i>0 && offset>0 && (app_name_len-offset)>0)
+ {
+ app_name[offset]='.';
+ offset++;
+ }
+
+ offset+=tsg_app_id2name(result->attributes[i].app_id, app_name+offset, app_name_len-offset, is_joint_parent);
+ }
+
+ return 1;
+}
+
+static int set_app_id(struct tsg_log_instance_t *_instance, struct TLD_handle_t *_handle, struct streaminfo *a_stream)
+{
+ int app_id_flag=0;
+ int l7_protocol_flag=0;
+ char app_name[512]={0};
+ char protocol_list[256]={0};
+
+ unsigned int one_app_id=0;
+ unsigned int one_surrogate_id=0;
+ struct gather_app_result *gather_result=NULL;
+
+ gather_result=(struct gather_app_result *)project_req_get_struct(a_stream, g_tsg_para.gather_app_project_id);
+ if(gather_result==NULL)
+ {
+ TLD_append(_handle, _instance->id2field[LOG_COMMON_L7_PROTOCOL].name, (void *)_instance->l7_unknown_name, TLD_TYPE_STRING);
+ return 0;
+ }
+
+ get_l7_protocol(&(gather_result[ORIGIN_BASIC_PROTOCOL]), protocol_list, sizeof(protocol_list), &l7_protocol_flag);
+ if(l7_protocol_flag==1)
+ {
+ TLD_append(_handle, _instance->id2field[LOG_COMMON_L7_PROTOCOL].name, (void *)protocol_list, TLD_TYPE_STRING);
+ }
+ else
+ {
+ TLD_append(_handle, _instance->id2field[LOG_COMMON_L7_PROTOCOL].name, (void *)_instance->l7_unknown_name, TLD_TYPE_STRING);
+ }
+
+ if(_instance->app_id_type==0) // int
+ {
+ get_app_id(&(gather_result[ORIGIN_USER_DEFINE]), &one_app_id, &one_surrogate_id, &app_id_flag);
+ get_app_id(&(gather_result[ORIGIN_DKPT]), &one_app_id, &one_surrogate_id, &app_id_flag);
+ get_app_id(&(gather_result[ORIGIN_QM_ENGINE]), &one_app_id, &one_surrogate_id, &app_id_flag);
+
+ if(app_id_flag==1)
+ {
+ TLD_append(_handle, _instance->id2field[LOG_COMMON_APP_ID].name, (void *)(long)one_app_id, TLD_TYPE_LONG);
+ TLD_append(_handle, _instance->id2field[LOG_COMMON_APP_SURROGATE_ID].name, (void *)(long)one_surrogate_id, TLD_TYPE_LONG);
+ }
+ }
+ else //string
+ {
+ set_userdefine_app(_handle, _instance->id2field[LOG_COMMON_USERDEFINE_APP].name, &(gather_result[ORIGIN_USER_DEFINE]), TLD_TYPE_LONG);
+
+ get_userdefine_name(&(gather_result[ORIGIN_USER_DEFINE]), app_name, sizeof(app_name), &app_id_flag, 0);
+
+ if(app_id_flag!=1)
+ {
+ get_app_name_list(&(gather_result[ORIGIN_BUILT_IN]), app_name, sizeof(app_name), &app_id_flag, 0);
+ }
+
+ if(app_id_flag!=1)
+ {
+ get_app_name_list(&(gather_result[ORIGIN_DKPT]), app_name, sizeof(app_name), &app_id_flag, 0);
+ }
+
+ if(app_id_flag!=1)
+ {
+ get_app_name_list(&(gather_result[ORIGIN_QM_ENGINE]), app_name, sizeof(app_name), &app_id_flag, 0);
+ }
+
+ if(app_id_flag!=1)
+ {
+ get_app_name_list(&(gather_result[ORIGIN_UNKNOWN]), app_name, sizeof(app_name), &app_id_flag, 0);
+ }
+
+ if(app_id_flag==1)
+ {
+ if(!(TLD_search(_handle, _instance->id2field[LOG_COMMON_APP_LABEL].name)))
+ {
+ TLD_append(_handle, _instance->id2field[LOG_COMMON_APP_LABEL].name, (void *)app_name, TLD_TYPE_STRING);
+ }
+
+ if(_instance->send_app_id)
+ {
+ Value app_id_object(kObjectType);
+ get_app_id_list(&app_id_object, _handle, "USER_DEFINE", &(gather_result[ORIGIN_USER_DEFINE]));
+ get_app_id_list(&app_id_object, _handle, "BUILT_IN", &(gather_result[ORIGIN_BUILT_IN]));
+ get_app_id_list(&app_id_object, _handle, "DKPT", &(gather_result[ORIGIN_DKPT]));
+ get_app_id_list(&app_id_object, _handle, "THIRD", &(gather_result[ORIGIN_QM_ENGINE]));
+ get_app_id_list(&app_id_object, _handle, "UNKNOWN", &(gather_result[ORIGIN_UNKNOWN]));
+ TLD_append(_handle, _instance->id2field[LOG_COMMON_APP_ID].name, &app_id_object, TLD_TYPE_OBJECT);
+ }
+ set_app_identify_info(_handle, _instance->id2field[LOG_COMMON_APP_IDENTIFY_INFO].name, gather_result);
+ }
+ }
+
+ return 1;
+}
+
+static int set_vlan(struct tsg_log_instance_t *_instance, struct TLD_handle_t *_handle, struct single_layer_vlan_addr *vlan_addr, int layer_num, Value *tunnel_object, tsg_log_field_id_t id)
+{
+ if(layer_num==0)
+ {
+ return 0;
+ }
+
+ int i=0;
+ Value vlan_array(kArrayType);
+ for(i=0; i<layer_num; i++)
+ {
+ vlan_array.PushBack(ntohs(vlan_addr[i].VID), _handle->document->GetAllocator());
+ }
+ add_object_member(_handle, tunnel_object, _instance->id2field[id].name, vlan_array);
+
+ return 1;
+}
+
+static int set_mpls(struct tsg_log_instance_t *_instance, struct TLD_handle_t *_handle, struct single_layer_mpls_addr *mpls_addr, int layer_num, Value *tunnel_object, tsg_log_field_id_t id)
+{
+ if(layer_num==0)
+ {
+ return 0;
+ }
+
+ int i=0;
+ Value mpls_array(kArrayType);
+ for(i=0; i<layer_num; i++)
+ {
+ mpls_array.PushBack(ntohl(mpls_addr[i].label), _handle->document->GetAllocator());
+ }
+ add_object_member(_handle, tunnel_object, _instance->id2field[id].name, mpls_array);
+
+ return 1;
+}
+
+static int set_l2tp(struct tsg_log_instance_t *_instance, struct TLD_handle_t *_handle, struct layer_addr_l2tp *l2tp_addr, Value *object)
+{
+ if(l2tp_addr==NULL || object==NULL)
+ {
+ return 0;
+ }
+
+ struct layer_addr_l2tp_v2_t *l2tp_v2=NULL;
+
+ switch(l2tp_addr->version)
+ {
+ case 2:
+ l2tp_v2=&(l2tp_addr->l2tpun.l2tp_addr_v2);
+ add_str_member(_handle, object, _instance->id2field[LOG_COMMON_L2TP_VERSION].name, "v2");
+ add_number_member(_handle, object, _instance->id2field[LOG_COMMON_L2TP_LAC2LNS_TUNNEL_ID].name, ntohs(l2tp_v2->tunnelid_C2S));
+ add_number_member(_handle, object, _instance->id2field[LOG_COMMON_L2TP_LNS2LAC_TUNNEL_ID].name, ntohs(l2tp_v2->tunnelid_S2C));
+ add_number_member(_handle, object, _instance->id2field[LOG_COMMON_L2TP_LAC2LNS_SESSION_ID].name, ntohs(l2tp_v2->sessionid_C2S));
+ add_number_member(_handle, object, _instance->id2field[LOG_COMMON_L2TP_LNS2LAC_SESSION_ID].name, ntohs(l2tp_v2->sessionid_S2C));
+ break;
+ case 3:
+ add_str_member(_handle, object, _instance->id2field[LOG_COMMON_L2TP_VERSION].name, "v3");
+ break;
+ default:
+ return 0;
+ }
+
+ return 1;
+}
+
+static int mac_to_string(unsigned char *mac, char *buff)
+{
+ int i=0,len=0;
+
+ for(i=0; i<6; i++)
+ {
+ len+=sprintf(buff+len, "%02x:", mac[i]);
+ }
+
+ buff[len-1]='\0';
+
+ return 0;
+}
+
+static int set_link_mac(struct tsg_log_instance_t *_instance, struct TLD_handle_t *_handle, struct layer_addr_mac *mac, Value *tunnel_object)
+{
+ int flag=0;
+ char default_mac[6]={0,0,0,0,0,0};
+ char c2s_source_mac[128]={0};
+ char c2s_dest_mac[128]={0};
+ char s2c_source_mac[128]={0};
+ char s2c_dest_mac[128]={0};
+
+ if((memcmp(mac->src_addr.h_source, default_mac, 6)))
+ {
+ flag|=1;
+ mac_to_string(mac->src_addr.h_source, c2s_source_mac);
+ mac_to_string(mac->src_addr.h_dest, c2s_dest_mac);
+ }
+
+ if((memcmp(mac->dst_addr.h_source, default_mac, 6)))
+ {
+ flag|=2;
+ mac_to_string(mac->dst_addr.h_source, s2c_source_mac);
+ mac_to_string(mac->dst_addr.h_dest, s2c_dest_mac);
+ }
+
+ switch(flag)
+ {
+ case 1:
+ add_str_member(_handle, tunnel_object, _instance->id2field[LOG_COMMON_TUNNELS_SCHEMA_TYPE].name, "ETHERNET");
+ add_str_member(_handle, tunnel_object, _instance->id2field[LOG_COMMON_TUNNELS_MAC_SOURCE].name, c2s_source_mac);
+ add_str_member(_handle, tunnel_object, _instance->id2field[LOG_COMMON_TUNNELS_MAC_DEST].name, c2s_dest_mac);
+ break;
+ case 2:
+ add_str_member(_handle, tunnel_object, _instance->id2field[LOG_COMMON_TUNNELS_SCHEMA_TYPE].name, "ETHERNET");
+ add_str_member(_handle, tunnel_object, _instance->id2field[LOG_COMMON_TUNNELS_MAC_SOURCE].name, s2c_source_mac);
+ add_str_member(_handle, tunnel_object, _instance->id2field[LOG_COMMON_TUNNELS_MAC_DEST].name, s2c_dest_mac);
+ break;
+ case 3:
+ add_str_member(_handle, tunnel_object, _instance->id2field[LOG_COMMON_TUNNELS_SCHEMA_TYPE].name, "MULTIPATH_ETHERNET");
+ add_str_member(_handle, tunnel_object, _instance->id2field[LOG_COMMON_TUNNELS_C2S_MAC_SOURCE].name, c2s_source_mac);
+ add_str_member(_handle, tunnel_object, _instance->id2field[LOG_COMMON_TUNNELS_C2S_MAC_DEST].name, c2s_dest_mac);
+ add_str_member(_handle, tunnel_object, _instance->id2field[LOG_COMMON_TUNNELS_S2C_MAC_SOURCE].name, s2c_source_mac);
+ add_str_member(_handle, tunnel_object, _instance->id2field[LOG_COMMON_TUNNELS_S2C_MAC_DEST].name, s2c_dest_mac);
+ break;
+ default:
+ break;
+ }
+
+ return 1;
+}
+
+static int action2fs_id(int action)
+{
+ switch(action)
+ {
+ case TSG_ACTION_DENY:
+ return LOG_FS2_ABORT_DENY;
+ break;
+ case TSG_ACTION_BYPASS:
+ return LOG_FS2_ABORT_ALLOW;
+ break;
+ case TSG_ACTION_MONITOR:
+ return LOG_FS2_ABORT_MONITOR;
+ break;
+ case TSG_ACTION_INTERCEPT:
+ return LOG_FS2_ABORT_INTERCEPT;
+ break;
+ default:
+ return LOG_FS2_ABORT_UNKNOWN;
+ break;
+ }
+
+ return LOG_FS2_ABORT_UNKNOWN;
+}
+
+int TLD_cancel(struct TLD_handle_t *handle)
+{
+ if (handle != NULL)
+ {
+ if (handle->document != NULL)
+ {
+ long long length=0;
+ struct tsg_log_instance_t *_instance=get_log_instance();
+
+ length=handle->document->GetAllocator().Size();
+ FS_operate(_instance->fs2_handle, _instance->fs2_field_id[LOG_FS2_FREE_RAPID_SIZE], 0, FS_OP_ADD, length);
+
+ length=handle->document->GetAllocator().Capacity();
+ FS_operate(_instance->fs2_handle, _instance->fs2_field_id[LOG_FS2_FREE_RAPID_CAPACITY], 0, FS_OP_ADD, length);
+
+ delete handle->document;
+ handle->document = NULL;
+
+ delete handle->valueAllocator;
+ handle->valueAllocator=NULL;
+
+ FS_operate(_instance->fs2_handle, _instance->fs2_field_id[LOG_FS2_FREE_LOG_HANDLE], 0, FS_OP_ADD, 1);
+ }
+
+ free(handle);
+ handle = NULL;
+ }
+
+ return 0;
+}
+
+int TLD_search(struct TLD_handle_t *handle, char *key)
+{
+ if (handle != NULL && handle->document != NULL && key != NULL)
+ {
+ Value::ConstMemberIterator itr = handle->document->FindMember(key);
+ if (itr!=handle->document->MemberEnd())
+ {
+ return 1;
+ }
+ }
+
+ return 0;
+}
+
+static void TLD_delete(struct TLD_handle_t *handle, char *key)
+{
+ if (handle != NULL && handle->document != NULL && key != NULL)
+ {
+ handle->document->RemoveMember(key);
+ }
+}
+
+int TLD_append(struct TLD_handle_t *handle, char *key, void *value, TLD_TYPE type)
+{
+ struct TLD_handle_t *_handle=handle;
+
+ if(_handle==NULL || key==NULL || (value==NULL && type!=TLD_TYPE_LONG))
+ {
+ return -1;
+ }
+
+ switch(type)
+ {
+ case TLD_TYPE_LONG:
+ add_number_member(_handle, _handle->document, key, (long)value);
+ break;
+ case TLD_TYPE_FILE:
+ break;
+ case TLD_TYPE_STRING:
+ if(strlen((char *)value)==0)
+ {
+ break;
+ }
+ add_str_member(_handle, _handle->document, key, (const char *)value);
+ break;
+ case TLD_TYPE_OBJECT:
+ add_object_member(handle, handle->document, key, ((Value &)(*(Value *)value)));
+ break;
+ case TLD_TYPE_CJSON:
+ printf("TLD_TYPE_CJSON is obsolete, please use TLD_TYPE_OBJECT !!!\n");
+ abort();
+ default:
+ return -1;
+ break;
+ }
+
+ struct tsg_log_instance_t *_instance=get_log_instance();
+
+ FS_operate(_instance->fs2_handle, _instance->fs2_field_id[LOG_FS2_APPEND_LOG_HANDLE], 0, FS_OP_ADD, 1);
+
+ return 0;
+}
+
+int TLD_array_append(struct TLD_handle_t *handle, char *key, void **array, int array_num, TLD_TYPE type)
+{
+ if(handle==NULL || key==NULL || array_num<=0 || array==NULL || type!=TLD_TYPE_LONG || type!=TLD_TYPE_STRING)
+ {
+ return -1;
+ }
+
+ int i=0;
+ Value obj_array(kArrayType);
+
+ switch(type)
+ {
+ case TLD_TYPE_LONG:
+ for(i=0; i<array_num; i++)
+ {
+ obj_array.PushBack((long)(array[i]), handle->document->GetAllocator());
+ }
+ break;
+ case TLD_TYPE_STRING:
+ for(i=0; i<array_num; i++)
+ {
+ Value str_value(StringRef((char *)(array[i]), strlen((char *)array[i])));
+ obj_array.PushBack(str_value, handle->document->GetAllocator());
+ }
+ break;
+ default:
+ return -1;
+ }
+
+ add_object_member(handle, handle->document, key, obj_array);
+
+ return 1;
+}
+
+struct TLD_handle_t *TLD_duplicate(struct TLD_handle_t *handle)
+{
+ if (handle == NULL)
+ {
+ return NULL;
+ }
+ struct TLD_handle_t *_handle=(struct TLD_handle_t *)calloc(1, sizeof(struct TLD_handle_t));
+ _handle->thread_id = handle->thread_id;
+ _handle->document = new Document();
+ //_handle->document->SetObject();
+
+ _handle->document->CopyFrom(*handle->document, _handle->document->GetAllocator());
+
+ struct tsg_log_instance_t *_instance=get_log_instance();
+ FS_operate(_instance->fs2_handle, _instance->fs2_field_id[LOG_FS2_DUP_LOG_HANDLE], 0, FS_OP_ADD, 1);
+
+ return _handle;
+}
+
+struct TLD_handle_t *TLD_create(int thread_id)
+{
+ struct tsg_log_instance_t *_instance=get_log_instance();
+ if(_instance->mode==CLOSE)
+ {
+ return NULL;
+ }
+
+ struct TLD_handle_t *_handle=(struct TLD_handle_t *)calloc(1, sizeof(struct TLD_handle_t));
+ _handle->thread_id = thread_id;
+
+ _handle->valueAllocator =new MemoryPoolAllocator<>(g_tsg_log_instance->rapidjson_chunk_capacity);
+ _handle->document = new Document(_handle->valueAllocator);
+ _handle->document->SetObject();
+
+ FS_operate(_instance->fs2_handle, _instance->fs2_field_id[LOG_FS2_CREATE_LOG_HANDLE], 0, FS_OP_ADD, 1);
+
+ return _handle;
+}
+
+static int set_user_region(struct tsg_log_instance_t *_instance, struct TLD_handle_t *_handle, struct Maat_rule_t *p_result, int thread_seq)
+{
+ int ret=0;
+ char *user_region=NULL;
+
+ if(p_result->action!=TSG_ACTION_NONE && p_result->serv_def_len>0)
+ {
+ user_region=(char *)dictator_malloc(thread_seq, p_result->serv_def_len+1);
+ ret=Maat_read_rule(g_tsg_maat_feather, p_result, MAAT_RULE_SERV_DEFINE, user_region, p_result->serv_def_len+1);
+ if(ret==p_result->serv_def_len)
+ {
+ user_region[p_result->serv_def_len]='\0';
+ TLD_append(_handle, _instance->id2field[LOG_COMMON_USER_REGION].name, (void *)user_region, TLD_TYPE_STRING);
+ }
+
+ dictator_free(thread_seq, user_region);
+ user_region=NULL;
+ }
+
+ return 0;
+}
+
+static int set_mail_eml(struct tsg_log_instance_t *_instance, struct TLD_handle_t *_handle, struct streaminfo *a_stream)
+{
+ struct tsg_conn_sketch_notify_data *notify_mail=(struct tsg_conn_sketch_notify_data *)stream_bridge_async_data_get(a_stream, g_tsg_para.bridge_id[BRIDGE_TYPE_RECV_CONN_SKETCH_DATA]);
+ if(notify_mail!=NULL && notify_mail->pdata.mail_eml_filename!=NULL && notify_mail->protocol==PROTO_MAIL)
+ {
+ TLD_delete(_handle, _instance->id2field[LOG_COMMON_MAIL_EML_FILE].name);
+ TLD_append(_handle, _instance->id2field[LOG_COMMON_MAIL_EML_FILE].name, (void *)notify_mail->pdata.mail_eml_filename, TLD_TYPE_STRING);
+ return 1;
+ }
+
+ return 0;
+}
+
+
+static int set_s3_filename(struct tsg_log_instance_t *_instance, struct TLD_handle_t *_handle, struct streaminfo *a_stream)
+{
+ struct business_notify_data *bnd_label=(struct business_notify_data *)stream_bridge_async_data_get(a_stream, _instance->bridge_id[LOG_BRIDGE_BUSINESS_S3_FILENAME]);
+ if(bnd_label==NULL || bnd_label->pdata==NULL)
+ {
+ return 0;
+ }
+
+ switch(bnd_label->proto)
+ {
+ case PROTO_HTTP:
+ TLD_delete(_handle, _instance->id2field[LOG_COMMON_HTTP_REQUEST_S3_FILE].name);
+ TLD_delete(_handle, _instance->id2field[LOG_COMMON_HTTP_RESPONSE_S3_FILE].name);
+
+ if(bnd_label->s3_http==NULL)
+ {
+ break;
+ }
+
+ TLD_append(_handle, _instance->id2field[LOG_COMMON_HTTP_REQUEST_S3_FILE].name, bnd_label->s3_http->request_filename, TLD_TYPE_STRING);
+ TLD_append(_handle, _instance->id2field[LOG_COMMON_HTTP_RESPONSE_S3_FILE].name, bnd_label->s3_http->response_filename, TLD_TYPE_STRING);
+ break;
+ default:
+ break;
+ }
+
+ return 1;
+}
+
+int set_nat_linkinfo(struct tsg_log_instance_t *_instance, struct TLD_handle_t *_handle, struct streaminfo *a_stream, char *field_name, int project_id)
+{
+ const char *nat_linkinfo=(const char *)stream_bridge_async_data_get(a_stream, project_id);
+ if(nat_linkinfo==NULL)
+ {
+ return 0;
+ }
+
+ copy_rapidjson(_handle, field_name, nat_linkinfo);
+
+ return 0;
+}
+
+static int set_tunnel_ipv4v6_port(struct tsg_log_instance_t *_instance, struct TLD_handle_t *_handle, struct streaminfo *a_stream, Value *object, enum addr_type_t up_layer_type)
+{
+ char ip_buff[64]={0};
+ if(a_stream==NULL)
+ {
+ return 0;
+ }
+
+ tsg_log_field_id_t s_ip_idx, d_ip_idx, s_port_idx, d_port_idx;
+
+ switch(up_layer_type)
+ {
+ case ADDR_TYPE_L2TP:
+ s_ip_idx=LOG_COMMON_L2TP_ACCESS_CONCENTRATOR_IP;
+ d_ip_idx=LOG_COMMON_L2TP_NETWORK_SERVER_IP;
+ s_port_idx=LOG_COMMON_L2TP_ACCESS_CONCENTRATOR_PORT;
+ d_port_idx=LOG_COMMON_L2TP_NETWORK_SERVER_PORT;
+ break;
+ case ADDR_TYPE_GPRS_TUNNEL:
+ s_ip_idx=LOG_COMMON_TUNNELS_GTP_SGW_IP;
+ d_ip_idx=LOG_COMMON_TUNNELS_GTP_PGW_IP;
+ s_port_idx=LOG_COMMON_TUNNELS_GTP_SGW_PORT;
+ d_port_idx=LOG_COMMON_TUNNELS_GTP_PGW_PORT;
+ break;
+ default:
+ return 0;
+ break;
+ }
+
+ switch(a_stream->addr.addrtype)
+ {
+ case ADDR_TYPE_IPV4:
+ inet_ntop(AF_INET, (const void *)&(a_stream->addr.ipv4->saddr), ip_buff, sizeof(ip_buff));
+ add_str_member(_handle, object, _instance->id2field[s_ip_idx].name, ip_buff);
+
+ inet_ntop(AF_INET, (const void *)&(a_stream->addr.ipv4->daddr), ip_buff, sizeof(ip_buff));
+ add_str_member(_handle, object, _instance->id2field[d_ip_idx].name, ip_buff);
+
+ add_number_member(_handle, object, _instance->id2field[s_port_idx].name, ntohs(a_stream->addr.ipv4->source));
+ add_number_member(_handle, object, _instance->id2field[d_port_idx].name, ntohs(a_stream->addr.ipv4->dest));
+ return 1;
+ break;
+ case ADDR_TYPE_IPV6:
+ inet_ntop(AF_INET6, (const void *)(a_stream->addr.ipv6->saddr), ip_buff, sizeof(ip_buff));
+ add_str_member(_handle, object, _instance->id2field[s_ip_idx].name, ip_buff);
+
+ inet_ntop(AF_INET6, (const void *)(a_stream->addr.ipv6->daddr), ip_buff, sizeof(ip_buff));
+ add_str_member(_handle, object, _instance->id2field[d_ip_idx].name, ip_buff);
+
+ add_number_member(_handle, object, _instance->id2field[s_port_idx].name, ntohs(a_stream->addr.ipv6->source));
+ add_number_member(_handle, object, _instance->id2field[d_port_idx].name, ntohs(a_stream->addr.ipv6->dest));
+ return 1;
+ break;
+ default:
+ break;
+
+ }
+
+ return 0;
+}
+
+static int set_common_tunnels(struct tsg_log_instance_t *_instance, struct TLD_handle_t *_handle, struct streaminfo *a_stream)
+{
+ int ret=0;
+ char ip_buff[64]={0};
+ const struct streaminfo *ptmp = a_stream;
+ const struct streaminfo *pfather=NULL;
+ Value tunnel_array(kArrayType);
+
+ while(ptmp)
+ {
+ Value tunnel_object(kObjectType);
+ pfather = ptmp->pfather;
+ switch(ptmp->addr.addrtype)
+ {
+ case ADDR_TYPE_MAC:
+ set_link_mac(_instance, _handle, (ptmp->addr.mac), &tunnel_object);
+ break;
+ case ADDR_TYPE_VLAN:
+ add_str_member(_handle, &tunnel_object, _instance->id2field[LOG_COMMON_TUNNELS_SCHEMA_TYPE].name, "VLAN");
+ set_vlan(_instance, _handle, ptmp->addr.vlan->c2s_addr_array, ptmp->addr.vlan->c2s_layer_num, &tunnel_object, LOG_COMMON_TUNNELS_VLAN_SRC_ID);
+ set_vlan(_instance, _handle, ptmp->addr.vlan->s2c_addr_array, ptmp->addr.vlan->s2c_layer_num, &tunnel_object, LOG_COMMON_TUNNELS_VLAN_DST_ID);
+ break;
+ case ADDR_TYPE_GRE:
+ add_str_member(_handle, &tunnel_object, _instance->id2field[LOG_COMMON_TUNNELS_SCHEMA_TYPE].name, "GRE");
+ break;
+ case ADDR_TYPE_MPLS:
+ if(ptmp->addr.mpls->s2c_layer_num==0 && ptmp->addr.mpls->c2s_layer_num==0)
+ {
+ ptmp = pfather;
+ continue;
+ }
+ add_str_member(_handle, &tunnel_object, _instance->id2field[LOG_COMMON_TUNNELS_SCHEMA_TYPE].name, "MPLS");
+ set_mpls(_instance, _handle, ptmp->addr.mpls->c2s_addr_array, ptmp->addr.mpls->c2s_layer_num, &tunnel_object, LOG_COMMON_TUNNELS_MPLS_SRC_LABEL);
+ set_mpls(_instance, _handle, ptmp->addr.mpls->s2c_addr_array, ptmp->addr.mpls->s2c_layer_num, &tunnel_object, LOG_COMMON_TUNNELS_MPLS_DST_LABEL);
+ break;
+ case ADDR_TYPE_L2TP:
+ add_str_member(_handle, &tunnel_object, _instance->id2field[LOG_COMMON_TUNNELS_SCHEMA_TYPE].name, "L2TP");
+ set_l2tp(_instance, _handle, ptmp->addr.l2tp, &tunnel_object);
+
+ ret=set_tunnel_ipv4v6_port(_instance, _handle, ptmp->pfather, &tunnel_object, ADDR_TYPE_L2TP);
+ if(ret==1)
+ {
+ ptmp=pfather->pfather;
+ }
+ break;
+ case __ADDR_TYPE_IP_PAIR_V4:
+ add_str_member(_handle, &tunnel_object, _instance->id2field[LOG_COMMON_TUNNELS_SCHEMA_TYPE].name, "IPv4");
+
+ inet_ntop(AF_INET, (const void *)&(ptmp->addr.ipv4->saddr), ip_buff, sizeof(ip_buff));
+ add_str_member(_handle, &tunnel_object, _instance->id2field[LOG_COMMON_TUNNELS_CLIENT_IP].name, ip_buff);
+
+ inet_ntop(AF_INET, (const void *)&(ptmp->addr.ipv4->daddr), ip_buff, sizeof(ip_buff));
+ add_str_member(_handle, &tunnel_object, _instance->id2field[LOG_COMMON_TUNNELS_SERVER_IP].name, ip_buff);
+ break;
+ case __ADDR_TYPE_IP_PAIR_V6:
+ add_str_member(_handle, &tunnel_object, _instance->id2field[LOG_COMMON_TUNNELS_SCHEMA_TYPE].name, "IPv6");
+
+ inet_ntop(AF_INET6, (const void *)(ptmp->addr.ipv6->saddr), ip_buff, sizeof(ip_buff));
+ add_str_member(_handle, &tunnel_object, _instance->id2field[LOG_COMMON_TUNNELS_CLIENT_IP].name, ip_buff);
+
+ inet_ntop(AF_INET6, (const void *)(ptmp->addr.ipv6->daddr), ip_buff, sizeof(ip_buff));
+ add_str_member(_handle, &tunnel_object, _instance->id2field[LOG_COMMON_TUNNELS_SERVER_IP].name, ip_buff);
+ break;
+ case ADDR_TYPE_PPTP:
+ add_str_member(_handle, &tunnel_object, _instance->id2field[LOG_COMMON_TUNNELS_SCHEMA_TYPE].name, "PPTP");
+ add_number_member(_handle, &tunnel_object, _instance->id2field[LOG_COMMON_TUNNELS_PPTP_C2S_ID].name, ntohs(ptmp->addr.pptp->C2S_call_id));
+ add_number_member(_handle, &tunnel_object, _instance->id2field[LOG_COMMON_TUNNELS_PPTP_S2C_ID].name, ntohs(ptmp->addr.pptp->S2C_call_id));
+ break;
+ case ADDR_TYPE_GPRS_TUNNEL:
+ add_str_member(_handle, &tunnel_object, _instance->id2field[LOG_COMMON_TUNNELS_SCHEMA_TYPE].name, "GTP");
+ add_number_member(_handle, &tunnel_object, _instance->id2field[LOG_COMMON_TUNNELS_GTP_UPLINK_TEID].name, ntohl(ptmp->addr.gtp->teid_c2s));
+ add_number_member(_handle, &tunnel_object, _instance->id2field[LOG_COMMON_TUNNELS_GTP_DOWNLINK_TEID].name, ntohl(ptmp->addr.gtp->teid_s2c));
+
+ ret=set_tunnel_ipv4v6_port(_instance, _handle, ptmp->pfather, &tunnel_object, ADDR_TYPE_GPRS_TUNNEL);
+ if(ret==1)
+ {
+ ptmp=pfather->pfather;
+ }
+ break;
+ case ADDR_TYPE_VXLAN:
+ add_str_member(_handle, &tunnel_object, _instance->id2field[LOG_COMMON_TUNNELS_SCHEMA_TYPE].name, "VXLAN");
+ break;
+ default:
+ ptmp = pfather;
+ continue;
+ break;
+ }
+
+ ptmp = pfather;;
+ tunnel_array.PushBack(tunnel_object, _handle->document->GetAllocator());
+ }
+
+ TLD_append(_handle, _instance->id2field[LOG_COMMON_TUNNELS].name, &tunnel_array, TLD_TYPE_OBJECT);
+
+ return 0;
+}
+
+char *log_field_id2name(struct tsg_log_instance_t *instance, tsg_log_field_id_t id)
+{
+ struct tsg_log_instance_t *_instance=instance;
+ if(_instance!=NULL)
+ {
+ return _instance->id2field[id].name;
+ }
+
+ return NULL;
+}
+
+unsigned long long tsg_get_stream_id(struct streaminfo * a_stream)
+{
+ int ret=0;
+ int device_id_size=sizeof(unsigned long long);
+ unsigned long long device_id=(unsigned long long)g_tsg_para.device_seq_in_dc;
+
+ ret=MESA_get_stream_opt(a_stream, MSO_GLOBAL_STREAM_ID, (void *)&device_id, &device_id_size);
+ if(ret==0)
+ {
+ return device_id;
+ }
+
+ return -1;
+}
+
+int is_multi_hit_same_policy(struct Maat_rule_t *result, int *policy_id, int *policy_id_num)
+{
+ int j=0;
+
+ for(j=0;j<*policy_id_num;j++)
+ {
+ if(policy_id[j]==result->config_id)
+ {
+ return 1;
+ }
+ }
+
+ policy_id[(*policy_id_num)++]=result->config_id;
+
+ return 0;
+}
+
+static int set_common_sub_action(struct TLD_handle_t *handle, char *field_name, struct Maat_rule_t *p_result)
+{
+ cJSON *item=NULL;
+ cJSON *object=NULL;
+ char *tmp_buff=NULL;
+
+ if(p_result->serv_def_len<128)
+ {
+ object=cJSON_Parse(p_result->service_defined);
+ }
+ else
+ {
+ tmp_buff=(char *)calloc(1, p_result->serv_def_len+1);
+ Maat_read_rule(g_tsg_maat_feather, p_result, MAAT_RULE_SERV_DEFINE, tmp_buff, p_result->serv_def_len);
+ object=cJSON_Parse(tmp_buff);
+
+ free(tmp_buff);
+ tmp_buff=NULL;
+ }
+
+ if(object!=NULL)
+ {
+ item=cJSON_GetObjectItem(object, "method");
+ if(item!=NULL && item->valuestring!=NULL)
+ {
+ TLD_append(handle, field_name, (void *)item->valuestring, TLD_TYPE_STRING);
+ }
+
+ cJSON_Delete(object);
+ object=NULL;
+ }
+
+ return 0;
+}
+
+int set_application_behavior(struct tsg_log_instance_t *_instance, struct TLD_handle_t *_handle, struct streaminfo *a_stream)
+{
+ if(a_stream==NULL)
+ {
+ return 0;
+ }
+
+ struct application_behavior *behavior_result=NULL;
+ behavior_result=(struct application_behavior *)stream_bridge_async_data_get(a_stream, _instance->bridge_id[LOG_BRIDGE_APP_BEHAVIOR_RESULT]);
+ if(behavior_result==NULL)
+ {
+ return 0;
+ }
+
+ TLD_append(_handle, _instance->id2field[LOG_COMMON_APPLICATION_BEHAVIOR].name, (void *)(behavior_result->stream_behavior), TLD_TYPE_STRING);
+
+ return 1;
+}
+
+int set_notify_execution_result(struct tsg_log_instance_t *_instance, struct TLD_handle_t *_handle, struct streaminfo *a_stream, struct Maat_rule_t *p_result)
+{
+ if(a_stream==NULL)
+ {
+ return 0;
+ }
+
+ int i=0;
+ struct tsg_notify_execution_result *execution_result=NULL;
+ execution_result=(struct tsg_notify_execution_result *)stream_bridge_async_data_get(a_stream, _instance->bridge_id[LOG_BRIDGE_CONN_SKETCH_EXEC_RESULT]);
+ if(execution_result==NULL)
+ {
+ return 0;
+ }
+
+ TLD_delete(_handle, _instance->id2field[LOG_COMMON_MIRRORED_PKTS].name);
+ TLD_delete(_handle, _instance->id2field[LOG_COMMON_MIRRORED_BYTES].name);
+ TLD_delete(_handle, _instance->id2field[LOG_COMMON_PACKET_CAPTURE_FILE].name);
+
+ for(i=0; i<execution_result->stat_mirrored_cnt; i++)
+ {
+ if(execution_result->stat_mirrored[i].compile_id==p_result->config_id)
+ {
+ TLD_append(_handle, _instance->id2field[LOG_COMMON_MIRRORED_PKTS].name, (void *)(execution_result->stat_mirrored[i].packets), TLD_TYPE_LONG);
+ TLD_append(_handle, _instance->id2field[LOG_COMMON_MIRRORED_BYTES].name, (void *)(execution_result->stat_mirrored[i].bytes), TLD_TYPE_LONG);
+ break;
+ }
+ }
+
+ for(i=0; i<execution_result->capture_result_cnt; i++)
+ {
+ if(execution_result->capture_result[i].compile_id==p_result->config_id)
+ {
+ TLD_append(_handle, _instance->id2field[LOG_COMMON_PACKET_CAPTURE_FILE].name, (void *)(execution_result->capture_result[i].packet_path), TLD_TYPE_STRING);
+ break;
+ }
+ }
+
+ return 1;
+}
+
+int set_session_attributes(struct tsg_log_instance_t *_instance, struct TLD_handle_t *_handle, struct streaminfo *a_stream)
+{
+ int ret=0;
+ struct session_attribute_label *attribute_label=NULL;
+
+ attribute_label=(struct session_attribute_label *)project_req_get_struct(a_stream, _instance->session_attribute_project_id);
+ if(attribute_label==NULL)
+ {
+ return 0;
+ }
+
+ if(attribute_label->establish_latency_ms>0)
+ {
+ TLD_append(_handle, _instance->id2field[LOG_COMMON_ESTABLISH_LATENCY_MS].name, (void *)attribute_label->establish_latency_ms, TLD_TYPE_LONG);
+ }
+
+ if(attribute_label->http_action_file_size>0)
+ {
+ TLD_append(_handle, _instance->id2field[LOG_COMMON_HTTP_ACTION_FILESIZE].name, (void *)(long)attribute_label->http_action_file_size, TLD_TYPE_LONG);
+ }
+
+ set_asn(_handle, a_stream, _instance->id2field[LOG_COMMON_CLINET_ASN].name, attribute_label->client_asn);
+ set_asn(_handle, a_stream, _instance->id2field[LOG_COMMON_SERVER_ASN].name, attribute_label->server_asn);
+
+ set_location(_handle, a_stream, _instance->id2field[LOG_COMMON_CLINET_LOCATION].name, attribute_label->client_location);
+ set_location(_handle, a_stream, _instance->id2field[LOG_COMMON_SERVER_LOCATION].name, attribute_label->server_location);
+
+ ret=set_subscriber_id(_handle, _instance->id2field[LOG_COMMON_SUBSCRIBER_ID].name, attribute_label->client_subscribe_id);
+ if(ret==0)
+ {
+ set_subscriber_id(_handle, _instance->id2field[LOG_COMMON_SUBSCRIBER_ID].name, attribute_label->server_subscribe_id);
+ }
+
+ set_fqdn_category(_instance, _handle, a_stream, attribute_label->fqdn_category_id, attribute_label->fqdn_category_id_num);
+
+ if(attribute_label->ja3_fingerprint!=NULL)
+ {
+ TLD_append(_handle, _instance->id2field[LOG_SSL_JA3_FINGERPRINT].name, (void *)attribute_label->ja3_fingerprint, TLD_TYPE_STRING);
+ }
+
+ set_umts_user_info(_instance, _handle, a_stream, attribute_label->user_info);
+
+ return 1;
+}
+
+int set_lua_scripts_result(struct tsg_log_instance_t *_instance, struct TLD_handle_t *_handle, struct streaminfo *a_stream)
+{
+ int i=0;
+ struct user_defined_attribute_label *uda_label=(struct user_defined_attribute_label *)stream_bridge_async_data_get(a_stream, _instance->bridge_id[LOG_BRIDGE_APP_LUA_RESULT]);
+ if(uda_label!=NULL)
+ {
+ Value array(kArrayType);
+
+ for(i=0; i<uda_label->attribute_num; i++)
+ {
+ Value object(kObjectType);
+ switch(uda_label->attribute[i].type)
+ {
+ case ATTRIBUTE_TYPE_BOOL:
+ case ATTRIBUTE_TYPE_NUMERIC:
+ add_number_member(_handle, &object, uda_label->attribute[i].name, uda_label->attribute[i].number);
+ break;
+ case ATTRIBUTE_TYPE_IP:
+ case ATTRIBUTE_TYPE_STRING:
+ add_str_member(_handle, &object, uda_label->attribute[i].name, uda_label->attribute[i].string);
+ break;
+ default:
+ continue;
+ }
+
+ array.PushBack(object, _handle->document->GetAllocator());
+ }
+
+ TLD_append(_handle, _instance->id2field[LOG_COMMON_APP_EXTRACT_INFO].name, &array, TLD_TYPE_OBJECT);
+ }
+
+ return 0;
+}
+
+int TLD_append_streaminfo(struct tsg_log_instance_t *instance, struct TLD_handle_t *handle, struct streaminfo *a_stream)
+{
+ int ret=0;
+ char *addr_proto=NULL;
+ char stream_id_buff[128]={0};
+ unsigned long long stream_id=0;
+ struct TLD_handle_t *_handle=handle;
+ struct tsg_log_instance_t *_instance=instance;
+
+ if(_instance==NULL || _handle==NULL || a_stream==NULL)
+ {
+ MESA_handle_runtime_log(_instance->logger, RLOG_LV_DEBUG, "TLD_APPEND_STREAM", "instance==NULL || TLD_handle==NULL || addr==NULL");
+ return -1;
+ }
+
+ ret=set_linkinfo(_instance, _handle, a_stream);
+ if(ret==0)
+ {
+ set_direction(_instance, _handle, a_stream);
+ }
+
+ set_app_id(_instance, _handle, a_stream);
+ set_tcp_isn(_instance, _handle, a_stream);
+ set_tuple4(_instance, _handle, a_stream);
+ set_address_list(_instance, _handle, a_stream);
+ set_duraction(_instance, _handle, a_stream);
+ set_packet_bytes(_instance, _handle, a_stream);
+ set_session_attributes(_instance, _handle, a_stream);
+ set_lua_scripts_result(_instance, _handle, a_stream);
+
+ if(is_tunnels(a_stream))
+ {
+ set_common_tunnels(_instance, _handle, a_stream);
+ }
+
+ stream_id=tsg_get_stream_id(a_stream);
+ snprintf(stream_id_buff, sizeof(stream_id_buff), "%llu", stream_id);
+ TLD_append(_handle, _instance->id2field[LOG_COMMON_STREAM_TRACE_ID].name, (void *)stream_id_buff, TLD_TYPE_STRING);
+
+ addr_proto=(char *)layer_addr_prefix_ntop(a_stream);
+ TLD_append(_handle, _instance->id2field[LOG_COMMON_L4_PROTOCOL].name, (void *)addr_proto, TLD_TYPE_STRING);
+
+ return 0;
+}
+
+int load_log_common_field(const char *filename, id2field_t *id2field, struct topic_stat **service2topic, int *max_service)
+{
+ int i=0,flag=0;
+ int ret=0,id=0;
+ FILE *fp=NULL;
+ char line[1024]={0};
+ char field_name[64]={0};
+ char type_name[32]={0};
+ struct topic_stat *_service2topic=NULL;
+
+ fp=fopen(filename, "r");
+ if(fp==NULL)
+ {
+ printf("Open %s failed ...", filename);
+ return -1;
+ }
+
+ memset(line, 0, sizeof(line));
+
+ while((fgets(line, sizeof(line), fp))!=NULL)
+ {
+ if(line[0]=='#' || line[0]=='\n' || line[0]=='\r' ||line[0]=='\0')
+ {
+ continue;
+ }
+ memset(type_name, 0, sizeof(type_name));
+ ret=sscanf(line, "%s %s %d", type_name, field_name, &id);
+ assert(ret==3);
+
+ for(i=0; i<TLD_TYPE_MAX; i++)
+ {
+ if((strncasecmp(tld_type[i].name, type_name, strlen(tld_type[i].name)))==0)
+ {
+ switch(tld_type[i].type)
+ {
+ case TLD_TYPE_FILE:
+ case TLD_TYPE_LONG:
+ case TLD_TYPE_STRING:
+ id2field[id].type = tld_type[i].type;
+ id2field[id].id = id;
+ memcpy(id2field[id].name, field_name, strlen(field_name));
+ flag=1;
+ break;
+ case TLD_TYPE_TOPIC:
+ if(_service2topic==NULL)
+ {
+ _service2topic=(struct topic_stat *)calloc(1, sizeof(struct topic_stat)*(id+1));
+ _service2topic[id].type = TLD_TYPE_MAX;
+ //_service2topic[id].id = id;
+ memcpy(_service2topic[id].name, field_name, strlen(field_name));
+
+ *max_service=id+1;
+ }
+ else
+ {
+ if(*max_service<=id)
+ {
+ _service2topic=(struct topic_stat *)realloc(_service2topic, sizeof(struct topic_stat)*(id+1));
+ memset(&_service2topic[id], 0, sizeof(struct topic_stat));
+ _service2topic[id].type = TLD_TYPE_MAX;
+ //_service2topic[id].id = id;
+ memcpy(_service2topic[id].name, field_name, strlen(field_name));
+
+ *max_service=id+1;
+ }
+ else
+ {
+ memset(&_service2topic[id], 0, sizeof(struct topic_stat));
+ _service2topic[id].type = TLD_TYPE_MAX;
+ //_service2topic[id].id = id;
+ memcpy(_service2topic[id].name, field_name, strlen(field_name));
+ }
+ }
+ flag=1;
+ break;
+ default:
+ break;
+ }
+
+ if(flag==1)
+ {
+ flag=0;
+ break;
+ }
+ }
+ }
+ memset(line, 0, sizeof(line));
+ }
+
+ fclose(fp);
+ fp=NULL;
+
+ if(service2topic!=NULL)
+ {
+ (*service2topic)=_service2topic;
+ }
+
+ return 0;
+}
+
+struct tsg_log_instance_t *tsg_sendlog_init(const char *conffile, screen_stat_handle_t fs2_handle)
+{
+ int i=0,ret=0;
+ char nic_name[32]={0};
+ char kafka_errstr[1024]={0};
+ unsigned int local_ip_nr=0;
+ char bridge_name[LOG_BRIDGE_MAX][128]={0};
+ rd_kafka_conf_t *rdkafka_conf = NULL;
+ struct tsg_log_instance_t *_instance=NULL;
+
+ _instance=(struct tsg_log_instance_t *)calloc(1, sizeof(struct tsg_log_instance_t));
+ _instance->fs2_handle=fs2_handle;
+
+ for(i=0; i<LOG_FS2_TYPE_MAX; i++)
+ {
+ _instance->fs2_field_id[i]=FS_register(_instance->fs2_handle, FS_STYLE_FIELD, FS_CALC_SPEED, g_log_fs2_field[i].name);
+ }
+
+ _instance->fs2_column_id[LOG_COLUMN_STATUS_SUCCESS]=FS_register(_instance->fs2_handle, FS_STYLE_COLUMN, FS_CALC_CURRENT, "T_success_log");
+ _instance->fs2_column_id[LOG_COLUMN_STATUS_FAIL]=FS_register(_instance->fs2_handle, FS_STYLE_COLUMN, FS_CALC_CURRENT, "T_fail_log");
+ _instance->fs2_column_id[LOG_COLUMN_STATUS_DROP]=FS_register(_instance->fs2_handle, FS_STYLE_COLUMN, FS_CALC_CURRENT, "T_drop_log");
+
+ _instance->fs2_column_id[LOG_COLUMN_STATUS_SUCCESS_S]=FS_register(_instance->fs2_handle, FS_STYLE_COLUMN, FS_CALC_SPEED, "success_log/s");
+ _instance->fs2_column_id[LOG_COLUMN_STATUS_FAIL_S]=FS_register(_instance->fs2_handle, FS_STYLE_COLUMN, FS_CALC_SPEED, "fail_log/s");
+ _instance->fs2_column_id[LOG_COLUMN_STATUS_DROP_S]=FS_register(_instance->fs2_handle, FS_STYLE_COLUMN, FS_CALC_SPEED, "drop_log/s");
+
+ _instance->sum_line_id=FS_register(_instance->fs2_handle, FS_STYLE_LINE, FS_CALC_SPEED, "SUM");
+
+ MESA_load_profile_int_def(conffile, "TSG_LOG", "LOG_LEVEL",&(_instance->level), 30);
+ MESA_load_profile_string_def(conffile, "TSG_LOG", "LOG_PATH", _instance->log_path, sizeof(_instance->log_path), "./tsglog/tsglog");
+ MESA_load_profile_int_def(conffile, "TSG_LOG", "SEND_USER_REGION", &(_instance->send_user_region), 0);
+ MESA_load_profile_int_def(conffile, "TSG_LOG", "SEND_DATA_CENTER_SWITCH", &(_instance->send_data_center), 0);
+ MESA_load_profile_int_def(conffile, "TSG_LOG", "SEND_APP_ID_SWITCH", &(_instance->send_app_id), 0);
+ MESA_load_profile_int_def(conffile, "TSG_LOG", "SEND_NAT_LINKINFO_SWITCH", &(_instance->send_nat_linkinfo), 0);
+ MESA_load_profile_int_def(conffile, "TSG_LOG", "RAPIDJSON_CHUNK_CAPACITY", &(_instance->rapidjson_chunk_capacity), 8192);
+
+ MESA_load_profile_int_def(conffile, "TSG_LOG", "APP_ID_TYPE", &(_instance->app_id_type), 1); //0: int, 1: string
+ MESA_load_profile_string_def(conffile, "TSG_LOG", "L7_UNKNOWN_NAME", _instance->l7_unknown_name, sizeof(_instance->l7_unknown_name), "UNCATEGORIZED");
+
+ MESA_load_profile_string_def(conffile, "TSG_LOG", "LINKINFO_FROM_MAC", bridge_name[LOG_BRIDGE_MAC_LINKINFO], sizeof(bridge_name[LOG_BRIDGE_MAC_LINKINFO]), "mirror_linkinfo_from_mac");
+ MESA_load_profile_string_def(conffile, "TSG_LOG", "NAT_C2S_LINKINFO", bridge_name[LOG_BRIDGE_NAT_C2S_LINKINFO], sizeof(bridge_name[LOG_BRIDGE_NAT_C2S_LINKINFO]), "common_link_info_c2s");
+ MESA_load_profile_string_def(conffile, "TSG_LOG", "NAT_S2C_LINKINFO", bridge_name[LOG_BRIDGE_NAT_S2C_LINKINFO], sizeof(bridge_name[LOG_BRIDGE_NAT_S2C_LINKINFO]), "common_link_info_s2c");
+ MESA_load_profile_string_def(conffile, "TSG_LOG", "APP_LUA_SCRIPTS_BRIDGE_NAME", bridge_name[LOG_BRIDGE_APP_LUA_RESULT], sizeof(bridge_name[LOG_BRIDGE_APP_LUA_RESULT]), "LUA_USER_DEFINED_ATTRIBUTE");
+ MESA_load_profile_string_def(conffile, "TSG_LOG", "BUSINESS_S3_FILENAME", bridge_name[LOG_BRIDGE_BUSINESS_S3_FILENAME], sizeof(bridge_name[LOG_BRIDGE_BUSINESS_S3_FILENAME]), "TSG_BUSINESS_S3_FILENAME");
+ MESA_load_profile_string_def(conffile, "SYSTEM", "APP_BEHAVIOR_BRIDGE_NAME", bridge_name[LOG_BRIDGE_APP_BEHAVIOR_RESULT], sizeof(bridge_name[LOG_BRIDGE_APP_BEHAVIOR_RESULT]), "TSG_APPLICATION_BEHAVIOR");
+ MESA_load_profile_string_def(conffile, "SYSTEM", "NOTIFY_EXEC_RESULT_BRIDGE_NAME", bridge_name[LOG_BRIDGE_CONN_SKETCH_EXEC_RESULT], sizeof(bridge_name[LOG_BRIDGE_CONN_SKETCH_EXEC_RESULT]), "TSG_NOTIFICATION_EXECUTION_RESULT");
+
+ for(i=0; i<LOG_BRIDGE_MAX; i++)
+ {
+ _instance->bridge_id[i]=stream_bridge_build(bridge_name[i], "w");
+ if(_instance->bridge_id[i]<0)
+ {
+ MESA_handle_runtime_log(g_tsg_para.logger, RLOG_LV_FATAL, "LINKINFO_FROM_MAC", "stream_bridge_build is error, bridge_name: %s", bridge_name[i]);
+ }
+ }
+
+ _instance->logger=MESA_create_runtime_log_handle(_instance->log_path, _instance->level);
+ if(_instance->logger==NULL)
+ {
+ printf("MESA_create_runtime_log_handle failed ..., path: %s level: %d", _instance->log_path, _instance->level);
+ return NULL;
+ }
+
+ MESA_load_profile_int_def(conffile, "TSG_LOG", "MODE",&(_instance->mode), 0);
+ if(_instance->mode==CLOSE)
+ {
+ MESA_handle_runtime_log(_instance->logger, RLOG_LV_FATAL, "TSG_LOG", "Disable tsg_send_log");
+ return _instance;
+ }
+
+ MESA_load_profile_int_def(conffile, "TSG_LOG", "RECOVERY_INTERVEL_S", &(_instance->recovery_interval), 30);
+
+ MESA_load_profile_string_def(conffile, "TSG_LOG", "COMMON_FIELD_FILE", _instance->common_field_file, sizeof(_instance->common_field_file), NULL);
+ MESA_load_profile_string_def(conffile, "TSG_LOG", "BROKER_LIST", _instance->broker_list, sizeof(_instance->broker_list), NULL);
+ MESA_load_profile_string_def(conffile, "TSG_LOG", "SASL_USERNAME", _instance->sasl_username, sizeof(_instance->sasl_username), ""); //admin
+ MESA_load_profile_string_def(conffile, "TSG_LOG", "SASL_PASSWD", _instance->sasl_passwd, sizeof(_instance->sasl_passwd), "");
+
+ MESA_load_profile_string_def(conffile, "TSG_LOG", "SEND_QUEUE_MAX_MESSAGE", _instance->send_queue_max_msg, sizeof(_instance->send_queue_max_msg), "1000000");
+ MESA_load_profile_string_def(conffile, "TSG_LOG", "REFRESH_INTERVAL_MS", _instance->refresh_interval_ms, sizeof(_instance->refresh_interval_ms), "600000");
+ MESA_load_profile_string_def(conffile, "TSG_LOG", "REQUIRE_ACK", _instance->require_ack, sizeof(_instance->require_ack), "1");
+
+ MESA_load_profile_string_def(conffile, "SYSTEM", "TCP_LABEL", _instance->tcp_label, sizeof(_instance->tcp_label), "tcp_flow_stat");
+ MESA_load_profile_string_def(conffile, "SYSTEM", "UDP_LABEL", _instance->udp_label, sizeof(_instance->udp_label), "udp_flow_stat");
+
+ _instance->tcp_flow_project_id=project_customer_register(_instance->tcp_label, "struct");
+ _instance->udp_flow_project_id=project_customer_register(_instance->udp_label, "struct");
+ if(_instance->tcp_flow_project_id<0 || _instance->udp_flow_project_id<0)
+ {
+ MESA_handle_runtime_log(_instance->logger,
+ RLOG_LV_FATAL,
+ "TCP_OR_UDP_LABEL",
+ "project_customer_register is error, tcp_label: %s udp_label: %s, please check etc/project.conf",
+ _instance->tcp_label,
+ _instance->udp_label
+ );
+ }
+
+ MESA_load_profile_string_def(conffile, "SYSTEM", "NIC_NAME", nic_name, sizeof(nic_name), "lo");
+ ret=MESA_get_dev_ipv4(nic_name, (int *)&local_ip_nr);
+ if(ret<0)
+ {
+ MESA_handle_runtime_log(_instance->logger,
+ RLOG_LV_FATAL,
+ "GET_LOCAL_IP",
+ "MESA_get_dev_ipv4 is error, nic_name: %s, please check tsgconf/main.conf",
+ nic_name
+ );
+ return NULL;
+ }
+ inet_ntop(AF_INET,&(local_ip_nr),_instance->local_ip_str,sizeof(_instance->local_ip_str));
+
+ rdkafka_conf = rd_kafka_conf_new();
+ rd_kafka_conf_set(rdkafka_conf, "queue.buffering.max.messages", _instance->send_queue_max_msg, kafka_errstr, sizeof(kafka_errstr));
+ rd_kafka_conf_set(rdkafka_conf, "topic.metadata.refresh.interval.ms", _instance->refresh_interval_ms, kafka_errstr, sizeof(kafka_errstr));
+ rd_kafka_conf_set(rdkafka_conf, "request.required.acks", _instance->require_ack, kafka_errstr, sizeof(kafka_errstr));
+ rd_kafka_conf_set(rdkafka_conf, "socket.keepalive.enable", "true", kafka_errstr, sizeof(kafka_errstr));
+ rd_kafka_conf_set(rdkafka_conf, "bootstrap.servers", _instance->broker_list, kafka_errstr, sizeof(kafka_errstr));
+
+ if(strlen(_instance->sasl_username)> 0 && strlen(_instance->sasl_passwd)>0)
+ {
+ rd_kafka_conf_set(rdkafka_conf, "security.protocol", "sasl_plaintext", kafka_errstr, sizeof(kafka_errstr));
+ rd_kafka_conf_set(rdkafka_conf, "sasl.mechanisms", "PLAIN", kafka_errstr, sizeof(kafka_errstr));
+ rd_kafka_conf_set(rdkafka_conf, "sasl.username", _instance->sasl_username, kafka_errstr, sizeof(kafka_errstr));
+ rd_kafka_conf_set(rdkafka_conf, "sasl.password", _instance->sasl_passwd, kafka_errstr, sizeof(kafka_errstr));
+ }
+
+ if(!(_instance->kafka_handle=rd_kafka_new(RD_KAFKA_PRODUCER, rdkafka_conf, kafka_errstr, sizeof(kafka_errstr))))
+ {
+ MESA_handle_runtime_log(_instance->logger, RLOG_LV_FATAL, "KAFKA_INIT", "rd_kafka_new is error");
+ return NULL;
+ }
+
+ load_log_common_field(_instance->common_field_file, _instance->id2field, &(_instance->service2topic), &(_instance->max_service));
+
+ if(_instance->service2topic!=NULL)
+ {
+ for(i=0; i<_instance->max_service; i++)
+ {
+ if(_instance->service2topic[i].type==TLD_TYPE_MAX && strlen(_instance->service2topic[i].name)>0)
+ {
+ register_topic(_instance, &( _instance->service2topic[i]));
+ }
+
+ if(i==1)
+ {
+ memcpy(&(_instance->service2topic[i]), &(_instance->service2topic[0]), sizeof(struct topic_stat)); // service id of security event is 0 and 1
+ }
+ }
+ }
+ else
+ {
+ MESA_handle_runtime_log(_instance->logger,
+ RLOG_LV_FATAL,
+ "KAFKA_INIT",
+ "load_log_common_field is error, please check %s",
+ _instance->common_field_file
+ );
+ }
+
+ return _instance;
+}
+void tsg_sendlog_destroy(struct tsg_log_instance_t * instance)
+{
+ if(instance==NULL)
+ {
+ return ;
+ }
+
+ if(instance->mode!=CLOSE)
+ {
+ for(int i=0; i<instance->max_service; i++)
+ {
+ if(instance->service2topic[i].type!=TLD_TYPE_MAX || i==1) //i=1 equal i=0, service id of security event is 0 and 1
+ {
+ continue;
+ }
+
+ if(instance->service2topic[i].topic_rkt!=NULL)
+ {
+ rd_kafka_topic_destroy(instance->service2topic[i].topic_rkt);
+ }
+
+ if(instance->service2topic[i].drop_start!=NULL)
+ {
+ free(instance->service2topic[i].drop_start);
+ instance->service2topic[i].drop_start=NULL;
+ }
+
+ if(instance->service2topic[i].send_log_percent!=NULL)
+ {
+ free(instance->service2topic[i].send_log_percent);
+ instance->service2topic[i].send_log_percent=NULL;
+ }
+ }
+
+ //rd_kafka_destroy_flags(instance->kafka_handle, 4);
+ rd_kafka_destroy(instance->kafka_handle);
+
+ free(instance->service2topic);
+ instance->service2topic=NULL;
+ }
+
+
+ MESA_destroy_runtime_log_handle(instance->logger);
+ instance->logger=NULL;
+
+ free(instance);
+ instance=NULL;
+/*
+ int ret=0,count=0;
+
+ while(1)
+ {
+ ret=rd_kafka_wait_destroyed(1000);
+ if(ret==0)
+ {
+ break;
+ }
+ count++;
+ }
+*/
+
+ return ;
+}
+
+int tsg_send_log(struct tsg_log_instance_t *instance, struct TLD_handle_t *handle, tsg_log_t *log_msg, int thread_id)
+{
+ int fs_id=0,ret=0;
+ int i=0,repeat_cnt=0;
+ int policy_id[MAX_RESULT_NUM]={0};
+ struct TLD_handle_t *_handle=handle;
+ struct tsg_log_instance_t *_instance=instance;
+
+ if(_instance==NULL || _handle==NULL || log_msg==NULL)
+ {
+ TLD_cancel(handle);
+ MESA_handle_runtime_log(_instance->logger, RLOG_LV_DEBUG, "TSG_SEND_LOG", " instance==NULL || TLD_handle==NULL || log_msg==NULL ");
+ return -1;
+ }
+
+ if(_instance->mode==CLOSE)
+ {
+ TLD_cancel(handle);
+ FS_operate(_instance->fs2_handle, _instance->sum_line_id, _instance->fs2_field_id[LOG_COLUMN_STATUS_DROP], FS_OP_ADD, 1);
+ MESA_handle_runtime_log(_instance->logger, RLOG_LV_INFO, "TSG_SEND_LOG", "Disable tsg_send_log.");
+ return 0;
+ }
+
+ TLD_append_streaminfo(instance, handle, log_msg->a_stream);
+ TLD_append(_handle, _instance->id2field[LOG_COMMON_SLED_IP].name, (void *)(_instance->local_ip_str), TLD_TYPE_STRING);
+ if(strlen(g_tsg_para.device_sn)>0)
+ {
+ TLD_append(_handle, _instance->id2field[LOG_COMMON_DEVICE_ID].name, (void *)(g_tsg_para.device_sn), TLD_TYPE_STRING);
+ }
+
+ if(strlen(g_tsg_para.data_center)>0 && _instance->send_data_center==1)
+ {
+ TLD_append(_handle, _instance->id2field[LOG_COMMON_DATA_CENTER].name, (void *)(g_tsg_para.data_center), TLD_TYPE_STRING);
+ }
+
+ if(strlen(g_tsg_para.device_tag)>0)
+ {
+ TLD_append(_handle, _instance->id2field[LOG_COMMON_DEVICE_TAG].name, (void *)(g_tsg_para.device_tag), TLD_TYPE_STRING);
+ }
+
+ set_application_behavior(_instance, _handle, log_msg->a_stream);
+
+ for(i=0;i<log_msg->result_num; i++)
+ {
+ if(is_multi_hit_same_policy(&(log_msg->result[i]), policy_id, &repeat_cnt))
+ {
+ MESA_handle_runtime_log(_instance->logger, RLOG_LV_DEBUG,
+ "TSG_SEND_LOG",
+ "tsg same log:cfg_id=%d service=%d addr=%s",
+ log_msg->result[i].config_id,
+ log_msg->result[i].service_id,
+ (log_msg->a_stream==NULL ? "" : PRINTADDR(log_msg->a_stream,_instance->level))
+ );
+ continue;
+ }
+
+ switch(log_msg->result[i].do_log)
+ {
+ case LOG_ABORT:
+ MESA_handle_runtime_log(_instance->logger, RLOG_LV_DEBUG,
+ "TSG_SEND_LOG",
+ "tsg abort log:cfg_id=%d service=%d addr=%s",
+ log_msg->result[i].config_id,
+ log_msg->result[i].service_id,
+ (log_msg->a_stream==NULL ? "" : PRINTADDR(log_msg->a_stream,_instance->level))
+ );
+
+ fs_id=action2fs_id((int)log_msg->result[i].action);
+ FS_operate(_instance->fs2_handle, _instance->fs2_field_id[fs_id], 0, FS_OP_ADD, 1);
+ continue;
+ break;
+ case LOG_ALL:
+ if(log_msg->result[i].action==TSG_ACTION_MONITOR)
+ {
+ set_s3_filename(_instance, _handle, log_msg->a_stream);
+ set_mail_eml(_instance, _handle, log_msg->a_stream);
+ }
+ break;
+ case LOG_NOFILE:
+ if(log_msg->result[i].action==TSG_ACTION_MONITOR)
+ {
+ TLD_delete(_handle, _instance->id2field[LOG_COMMON_MAIL_EML_FILE].name);
+ TLD_delete(_handle, _instance->id2field[LOG_COMMON_HTTP_REQUEST_S3_FILE].name);
+ TLD_delete(_handle, _instance->id2field[LOG_COMMON_HTTP_RESPONSE_S3_FILE].name);
+ }
+ break;
+ default:
+ break;
+ }
+
+ ret=update_percent(_instance, log_msg->result[i].service_id, LOG_COLUMN_STATUS_DROP, thread_id);
+ if(ret==1)
+ {
+ MESA_handle_runtime_log(_instance->logger, RLOG_LV_DEBUG,
+ "TSG_SEND_LOG",
+ "tsg drop log:cfg_id=%d service=%d send_log_percent: %d addr=%s",
+ log_msg->result[i].config_id,
+ log_msg->result[i].service_id,
+ _instance->service2topic[log_msg->result[i].service_id].send_log_percent[thread_id],
+ (log_msg->a_stream==NULL ? "" : PRINTADDR(log_msg->a_stream,_instance->level))
+ );
+ continue;
+ }
+
+ TLD_append(_handle, _instance->id2field[LOG_COMMON_POLICY_ID].name, (void *)(long)(log_msg->result[i].config_id), TLD_TYPE_LONG);
+ TLD_append(_handle, _instance->id2field[LOG_COMMON_SERVICE].name, (void *)(long)(log_msg->result[i].service_id), TLD_TYPE_LONG);
+ TLD_append(_handle, _instance->id2field[LOG_COMMON_ACTION].name, (void *)(long)((unsigned char)log_msg->result[i].action), TLD_TYPE_LONG);
+
+ set_notify_execution_result(_instance, _handle, log_msg->a_stream, &(log_msg->result[i]));
+
+ if(_instance->send_user_region==1)
+ {
+ set_user_region(_instance, _handle, &log_msg->result[i], thread_id);
+ }
+
+ if(_instance->send_nat_linkinfo && log_msg->result[i].config_id==0 && log_msg->a_stream!=NULL)
+ {
+ set_nat_linkinfo(_instance, _handle, log_msg->a_stream, _instance->id2field[LOG_COMMON_LINK_INFO_C2S].name, _instance->bridge_id[LOG_BRIDGE_NAT_C2S_LINKINFO]);
+ set_nat_linkinfo(_instance, _handle, log_msg->a_stream, _instance->id2field[LOG_COMMON_LINK_INFO_S2C].name, _instance->bridge_id[LOG_BRIDGE_NAT_S2C_LINKINFO]);
+ }
+
+ if(log_msg->result[i].action==TSG_ACTION_DENY)
+ {
+ set_common_sub_action(_handle, _instance->id2field[LOG_COMMON_SUB_ACTION].name, &(log_msg->result[i]));
+ }
+
+ StringBuffer sb(0, 2048);
+ Writer<StringBuffer> writer(sb);
+ _handle->document->Accept(writer);
+
+ tsg_send_payload(_instance, log_msg->result[i].service_id, (char *)sb.GetString(), sb.GetSize(), thread_id);
+
+ TLD_delete(_handle, _instance->id2field[LOG_COMMON_POLICY_ID].name);
+ TLD_delete(_handle, _instance->id2field[LOG_COMMON_SERVICE].name);
+ TLD_delete(_handle, _instance->id2field[LOG_COMMON_ACTION].name);
+ TLD_delete(_handle, _instance->id2field[LOG_COMMON_USER_REGION].name);
+ TLD_delete(_handle, _instance->id2field[LOG_COMMON_SUB_ACTION].name);
+ }
+
+ TLD_cancel(handle);
+
+ return 0;
+}
+
+int tsg_register_topic(struct tsg_log_instance_t *instance, char *topic_name)
+{
+ struct tsg_log_instance_t *_instance=(struct tsg_log_instance_t *)instance;
+ if(_instance==NULL || _instance->mode==CLOSE || topic_name==NULL || _instance->kafka_handle==NULL)
+ {
+ return -1;
+ }
+
+ _instance->service2topic=(struct topic_stat *)realloc(_instance->service2topic, (_instance->max_service+1)*sizeof(struct topic_stat));
+ _instance->service2topic[_instance->max_service].type=TLD_TYPE_MAX;
+ memset(_instance->service2topic[_instance->max_service].name, 0, MAX_STRING_LEN);
+ memcpy(_instance->service2topic[_instance->max_service].name, topic_name, MIN(MAX_STRING_LEN-1, strlen(topic_name)));
+
+ register_topic(_instance, &(_instance->service2topic[_instance->max_service]));
+ _instance->max_service++;
+
+ return (_instance->max_service-1);
+}
+
+int tsg_send_payload(struct tsg_log_instance_t *instance, int topic_id, char *payload, int payload_len, int thread_id)
+{
+ int status=0;
+ struct tsg_log_instance_t *_instance=instance;
+
+ if(_instance==NULL || _instance->mode==CLOSE)
+ {
+ return 0;
+ }
+
+ if(payload==NULL || payload_len<=0 || topic_id<0 || _instance->service2topic[topic_id].topic_rkt==NULL)
+ {
+ MESA_handle_runtime_log(_instance->logger,
+ RLOG_LV_INFO,
+ "TSG_SEND_LOG",
+ "tsg_send_log to kafka is error (payload==NULL || payload_len<=0 || topic_id<0 || _instance->service2topic[topic_id].topic_rkt==NULL), topic: %s",
+ _instance->service2topic[topic_id].name
+ );
+ return -1;
+ }
+
+ status=rd_kafka_produce(_instance->service2topic[topic_id].topic_rkt, RD_KAFKA_PARTITION_UA, RD_KAFKA_MSG_F_COPY, payload, payload_len, NULL, 0, NULL);
+ if(status<0)
+ {
+ update_percent(_instance, topic_id, LOG_COLUMN_STATUS_FAIL, thread_id);
+
+ MESA_handle_runtime_log(_instance->logger,
+ RLOG_LV_INFO,
+ "TSG_SEND_LOG",
+ "tsg_send_log to kafka is error of code: %d %s(%s), status: %d, topic: %s %s",
+ rd_kafka_last_error(),
+ rd_kafka_err2name(rd_kafka_last_error()),
+ rd_kafka_err2str(rd_kafka_last_error()),
+ status,
+ _instance->service2topic[topic_id].name,
+ payload
+ );
+ return -1;
+ }
+ else
+ {
+ update_percent(_instance, topic_id, LOG_COLUMN_STATUS_SUCCESS, thread_id);
+ MESA_handle_runtime_log(_instance->logger,
+ RLOG_LV_DEBUG,
+ "TSG_SEND_LOG",
+ "log send successfully %s: %s",
+ _instance->service2topic[topic_id].name,
+ payload
+ );
+ }
+
+
+
+
+ update_percent(_instance, topic_id, LOG_COLUMN_STATUS_MAX, thread_id);
+
+ return 0;
+}
|