path: root/src/nat_format.cpp

#include <assert.h>
#include <errno.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>

#include <arpa/inet.h>
#include <netinet/in.h>
#include <sys/socket.h>
#include <time.h>
#include <unistd.h> 

#include "nat_format.h"

#define NAT_FORMAT_CONFIG_FILE "./conf/nat_format.conf"
#define PAYLOAD_LEN 46

#define FORMAT_LOG_ACTION_ADD 0x00
#define FORMAT_LOG_ACTION_DEL 0x01

#define HW_EVENT_ADD "SESSION_BUILT"
#define HW_EVENT_DEL "SESSION_TEARDOWN"

#define HW_EVENT_NEW 0x00
#define HW_EVENT_AGED 0x02
#define HW_EVENT_PERIOD 0x03

#define HS_EVENT_ADD "Session created"
#define HS_EVENT_DEL_1 "Normal over"
#define HS_EVENT_DEL_2 "Aged for timeout"
#define HS_EVENT_DEL_3 "Active data flow timeout"
#define HS_EVENT_DEL_4 "Aged for reset or config-change"
#define HS_EVENT_DEL_5 "Other"

#define FORMAT_LOG_PROTOCOL_ICMP 0x01
#define FORMAT_LOG_PROTOCOL_TCP 0x06
#define FORMAT_LOG_PROTOCOL_UDP 0x17

#define HW_BINARY_PROT_ICMP 1
#define HW_BINARY_PROT_TCP 6
#define HW_BINARY_PROT_UDP 17

struct nat_format_global_info g_nat_format_info;

// 组播报文缓冲区和socket都是每个线程一个
int platform_thread_num = get_thread_count();

char **multicast_payloads;
int *cur_pkts;

int *udp_sockets;
struct sockaddr_in dst_addr = {0};

// 函数：子串匹配，返回子串结尾+1的位置，即值的起始位置
int get_value_offset(char *str, int str_len, const char *key) {
    int i, j;
    int key_len = strlen(key);

    for (i = 0; i <= str_len - key_len - 1; i++) {
        for (j = 0; j < key_len; j++) {
            if (str[i + j]!= key[j])
                break;
        }
        if (j == key_len)
            return (i + key_len + 1);
    }
    return -1;
}

// 函数：从字符串中提取点分十进制ip并转换为二进制数
int extract_ip(char *data, int data_len, const char *key, unsigned int *dst) {
    int offset;
    char tmp_ip[20];
    if ((offset = get_value_offset(data, data_len, key)) == -1) { return -1; }
    if (sscanf(data+offset, "%19[^,]", tmp_ip) != 1) { return -1; }
    if (inet_pton(AF_INET, tmp_ip, dst) <= 0) {return -1; }
    return 0;
}
// 函数：从字符串中提取字符串并转为16位数
int extract_port(char *data, int data_len, const char *key, unsigned short *dst) {
    int offset;
    if ((offset = get_value_offset(data, data_len, key)) == -1) { return -1; }
    if (sscanf(data+offset, "%hu", dst) != 1) { return -1; }
    *dst = htons(*dst);
    return 0;
}
// 函数：从字符串中提取字符串并转为32位数
int extract_time(char *data, int data_len, const char *key, unsigned int *dst) {
    int offset;
    if ((offset = get_value_offset(data, data_len, key)) == -1) { return -1; }
    if (sscanf(data+offset, "%u", dst) != 1) { return -1; }
    return 0;
}
// 函数：从字符串中提取字符串并转为标识
int extract_protocol_hw(char *data, int data_len, const char *key, char *dst) {
    int offset;
    char protocol_str[20];
    if ((offset = get_value_offset(data, data_len, key)) == -1) { return -1; }
    if (sscanf(data+offset, "%[^,]", protocol_str) != 1) { return -1; }
    if (strcmp(protocol_str, "tcp") == 0) {
        *dst = FORMAT_LOG_PROTOCOL_TCP;
    } else if (strcmp(protocol_str, "udp") == 0) {
        *dst = FORMAT_LOG_PROTOCOL_UDP;
    } else if (strcmp(protocol_str, "icmp") == 0) {
        *dst = FORMAT_LOG_PROTOCOL_ICMP;
    } else {
        return -1;
    }
    return 0;
}
int extract_protocol_hs(char *data, int data_len, const char *key, char *dst) {
    int offset;
    char protocol_str[20];
    if ((offset = get_value_offset(data, data_len, key)) == -1) { return -1; }
    if (sscanf(data+offset, "%[^,]", protocol_str) != 1) { return -1; }
    if (strcmp(protocol_str, "TCP") == 0) {
        *dst = FORMAT_LOG_PROTOCOL_TCP;
    } else if (strcmp(protocol_str, "UDP") == 0) {
        *dst = FORMAT_LOG_PROTOCOL_UDP;
    } else if (strcmp(protocol_str, "ICMP") == 0) {
        *dst = FORMAT_LOG_PROTOCOL_ICMP;
    } else {
        return -1;
    }
    return 0;
}
// 函数：从字符串中提取字符串并转为标识
int extract_action_hs(char *data, int data_len, const char *key, char *dst) {
    int offset;
    char action_str[50];
    if ((offset = get_value_offset(data, data_len, key)) == -1) { return -1; }
    if (sscanf(data+offset, "(%*d)%[^,]", action_str) != 1) { return -1; }
    if (strcmp(action_str, HS_EVENT_ADD) == 0) {
        *dst = FORMAT_LOG_ACTION_ADD;
    } else if (strcmp(action_str, HS_EVENT_DEL_1) == 0 || strcmp(action_str, HS_EVENT_DEL_2) == 0 || strcmp(action_str, HS_EVENT_DEL_3) == 0 || strcmp(action_str, HS_EVENT_DEL_4) == 0 || strcmp(action_str, HS_EVENT_DEL_5) == 0) {
        *dst = FORMAT_LOG_ACTION_DEL;
    } else {
        return -1;
    }
    return 0;
}

// 组播报文发送
int send_multicast(int thread_seq) {
    // 发之前统一填充发送时间
    time_t now;
    time(&now);
    unsigned int now_timestamp = (int)now;
    for (int i = 0; i < g_nat_format_info.batch_size; i++) {
        memcpy(multicast_payloads[thread_seq] + i*PAYLOAD_LEN+SEND_TIME_OFFSET, &now_timestamp, 4);
    }
    // 进行发送
    if (sendto(udp_sockets[thread_seq], multicast_payloads[thread_seq], PAYLOAD_LEN*g_nat_format_info.batch_size, 0, (struct sockaddr *)&dst_addr, sizeof(dst_addr)) < 0) {
        MESA_handle_runtime_log(g_nat_format_info.log, RLOG_LV_INFO, "nat_format", "Send multicast failed: %s", strerror(errno));
        cur_pkts[thread_seq]--;
        return -1;
    }

    cur_pkts[thread_seq] = 0;
    return 0;
}

// 初始化函数
int nat_format_init(void) {
    // 读取配置文件
    MESA_load_profile_uint_def(NAT_FORMAT_CONFIG_FILE, "NAT_FORMAT", "magic_num", &g_nat_format_info.magic_num, 0x004e4154);
    MESA_load_profile_uint_def(NAT_FORMAT_CONFIG_FILE, "NAT_FORMAT", "version", &g_nat_format_info.version, 0x0200);

    MESA_load_profile_int_def(NAT_FORMAT_CONFIG_FILE, "NAT_FORMAT_SEND", "batch_size", &g_nat_format_info.batch_size, 20);
    MESA_load_profile_string_def(NAT_FORMAT_CONFIG_FILE, "NAT_FORMAT_SEND", "host_ip", g_nat_format_info.host_ip, 16, "127.0.0.1");
    MESA_load_profile_int_def(NAT_FORMAT_CONFIG_FILE, "NAT_FORMAT_SEND", "host_port", &g_nat_format_info.host_port, 5678);
    MESA_load_profile_string_def(NAT_FORMAT_CONFIG_FILE, "NAT_FORMAT_SEND", "multicast_ip", g_nat_format_info.multicast_ip, 16, "224.88.88.88");
    MESA_load_profile_int_def(NAT_FORMAT_CONFIG_FILE, "NAT_FORMAT_SEND", "multicast_port", &g_nat_format_info.multicast_port, 0);

    MESA_load_profile_int_def(NAT_FORMAT_CONFIG_FILE, "NAT_FORMAT_RECEIVE_PORT", "hw_syslog", &g_nat_format_info.hw_syslog_port, 514);
    MESA_load_profile_int_def(NAT_FORMAT_CONFIG_FILE, "NAT_FORMAT_RECEIVE_PORT", "hw_binary", &g_nat_format_info.hw_binary_port, 515);
    MESA_load_profile_int_def(NAT_FORMAT_CONFIG_FILE, "NAT_FORMAT_RECEIVE_PORT", "h3_syslog", &g_nat_format_info.h3_syslog_port, 516);
    MESA_load_profile_int_def(NAT_FORMAT_CONFIG_FILE, "NAT_FORMAT_RECEIVE_PORT", "h3_binary", &g_nat_format_info.h3_binary_port, 517);
    MESA_load_profile_int_def(NAT_FORMAT_CONFIG_FILE, "NAT_FORMAT_RECEIVE_PORT", "dp_syslog", &g_nat_format_info.dp_syslog_port, 518);
    MESA_load_profile_int_def(NAT_FORMAT_CONFIG_FILE, "NAT_FORMAT_RECEIVE_PORT", "dp_binary", &g_nat_format_info.dp_binary_port, 519);

    MESA_load_profile_string_def(NAT_FORMAT_CONFIG_FILE, "NAT_FORMAT_LOG", "run_log_path", g_nat_format_info.log_path, sizeof(g_nat_format_info.log_path), "./log/nat_format.log");
    MESA_load_profile_uint_def(NAT_FORMAT_CONFIG_FILE, "NAT_FORMAT_LOG", "run_log_level", &g_nat_format_info.log_level, 10);
    g_nat_format_info.log = MESA_create_runtime_log_handle(g_nat_format_info.log_path, g_nat_format_info.log_level);
    if (g_nat_format_info.log == NULL) {
        printf("MESA_create_runtime_log_handle %s failed: %s\n", g_nat_format_info.log_path, strerror(errno));
        return -1;
    }

    // 分配并初始化组播报文存储空间，长度为 batch_size*46Bytes
    multicast_payloads = (char **)malloc(platform_thread_num * sizeof(char *));
    if (multicast_payloads == NULL) {
        printf("Memory of multicast_payloads allocation failure.\n");
        return -1;
    }
    for (int i = 0; i < platform_thread_num; i++) {
        multicast_payloads[i] = (char *)malloc(PAYLOAD_LEN * g_nat_format_info.batch_size);
        if (multicast_payloads[i] == NULL) {
            for (int j = 0; j < i; j++) {
                free(multicast_payloads[j]);
            }
            free(multicast_payloads);
            printf("Memory of multicast_payload for thread %d allocation failure.\n", i);
            return -1;
        }
        memset(multicast_payloads[i], 0, PAYLOAD_LEN * g_nat_format_info.batch_size);
    }
    cur_pkts = (int *)malloc(platform_thread_num * sizeof(int));
    memset(cur_pkts, 0, platform_thread_num * sizeof(int));

    // 组播地址
    dst_addr.sin_family = AF_INET;
    dst_addr.sin_addr.s_addr = inet_addr(g_nat_format_info.multicast_ip);
    dst_addr.sin_port = htons(g_nat_format_info.multicast_port);
    struct in_addr multicast_addr;
    inet_pton(AF_INET, g_nat_format_info.multicast_ip, &multicast_addr.s_addr);
    // 发包端口
    struct sockaddr_in src_addr;
    src_addr.sin_family = AF_INET;
    src_addr.sin_port = htons(g_nat_format_info.host_port);
    src_addr.sin_addr.s_addr = inet_addr(g_nat_format_info.host_ip);

    // 创建socket用于发包
    udp_sockets = (int *)malloc(platform_thread_num * sizeof(int));
    for (int i = 0; i < platform_thread_num; i++) {
        udp_sockets[i] = socket(AF_INET, SOCK_DGRAM, 0);
        if (udp_sockets[i] == -1) {
            free(udp_sockets);
            printf("UDP multicast socket for thread %d creation failed:%d, %s\n", i, errno, strerror(errno));
            return -1;
        }
        setsockopt(udp_sockets[i], IPPROTO_IP, IP_MULTICAST_IF, &multicast_addr, sizeof(multicast_addr));
        if (bind(udp_sockets[i], (struct sockaddr*)&src_addr, sizeof(src_addr)) < 0) {
            free(udp_sockets);
            printf("socket bind for thread %d failed:%d, %s\n", i, errno, strerror(errno));
            close(udp_sockets[i]);
            return -1;
        }
    }

    return 0;
}

// 卸载函数
void nat_format_destroy(void) {
    for (int j = 0; j < platform_thread_num; j++) {
        free(multicast_payloads[j]);
    }
    free(multicast_payloads);

    free(cur_pkts);

    free(udp_sockets);
}

// 入口函数
/*
    输入参数：
        a_udp: UDP流信息，详见stream.h；
        pme: UDP链接上下文信息；
        thread_seq: 线程号
        a_packet: 原始IP数据包
    返回值： 
        PROT_STATE_GIVEME: 业务插件继续需要给会话后续包；
        PROT_STATE_DROPME: 业务插件不再需要该会话后续包；
        PROT_STATE_KILLME: 业务插件对此流做FD动作，此流不再给其他插件。
*/
char nat_format_entry(struct streaminfo *a_udp, void **pme, int thread_seq, void *a_packet) {
    // 不处理空数据包
    if (a_packet == NULL) {
        return APP_STATE_GIVEME;
    }

    // 提取udp流信息
    char *udp_data = (char *)a_udp->pudpdetail->pdata;
    int32_t udp_data_len = a_udp->pudpdetail->datalen;
    unsigned short udp_port = ntohs(a_udp->addr.tuple4_v4->dest);

    // 相同的nat基础信息
    struct nat_payload nat_payload;
    nat_payload.magic_num = htonl(g_nat_format_info.magic_num);
    nat_payload.version = htons((unsigned short)g_nat_format_info.version);
    nat_payload.fw_ip = a_udp->addr.tuple4_v4->saddr;   // 防火墙ip为源ip，本身为二进制格式
    
    // 需要分别提取的nat信息 -- syslog格式每个报文只携带一条日志，二进制格式每个报文携带多条日志
    // 华为syslog
    if (udp_port == g_nat_format_info.hw_syslog_port) {
        // <190>2024-01-25 01:41:37 JXNC_LTGC_Eudemon_A %%01SECLOG/6/SESSION_TEARDOWN(l):IPVer=4,Protocol=udp,SourceIP=10.119.25.34,DestinationIP=220.248.192.13,SourcePort=35040,DestinationPort=53,SourceNatIP=118.212.209.248,SourceNatPort=6438,BeginTime=1706147236,EndTime=1706147236,SourceVpnID=0,DestinationVpnID=0,SourceZone=pscenet,DestinationZone=untrust,PolicyName=---,CloseReason=aged-out.
        // sscanf(udp_data, "%*[^>]>%20[0-9: -]%*[^/]/%*[0-9]/%19[A-Z_]%*[^:]:IPVer=%*[^,],Protocol=%*[^,],SourceIP=%19[^,],DestinationIP=%19[^,],SourcePort=%hu,DestinationPort=%hu,SourceNatIP=%19[^,],SourceNatPort=%hu,BeginTime=%u,EndTime=%u", fw_log_time, action_str, src_intra_ip, dst_ip, &nat_payload.src_intra_port, &nat_payload.dst_port, src_extra_ip, &nat_payload.src_extra_port, &nat_payload.stream_start_timestamp, &nat_payload.stream_end_timestamp);

        // 字段前的部分：防火墙日志生成时间、动作
        char fw_log_time[21];
        char action_str[20];
        if (sscanf(udp_data, "%*[^>]>%20[0-9: -]%*[^/]/%*[0-9]/%19[A-Z_]", fw_log_time, action_str) != 2) {
            MESA_handle_runtime_log(g_nat_format_info.log, RLOG_LV_INFO, "nat_format Huawei syslog", "NAT extraction fw_log_time or action_str failed");
            return APP_STATE_GIVEME;
        }

        struct tm fw_time;
        if (strptime(fw_log_time, "%Y-%m-%d %H:%M:%S ", &fw_time) == NULL) {
            MESA_handle_runtime_log(g_nat_format_info.log, RLOG_LV_INFO, "nat_format Huawei syslog", "firewall log generation time extraction failed: %s", fw_log_time);
            return APP_STATE_GIVEME;
        }
        nat_payload.fw_log_timestamp = (unsigned int)mktime(&fw_time);

        if (strcmp(action_str, HW_EVENT_ADD) == 0) {
            nat_payload.action = FORMAT_LOG_ACTION_ADD;
        } else if (strcmp(action_str, HW_EVENT_DEL) == 0) {
            nat_payload.action = FORMAT_LOG_ACTION_DEL;
        } else {
            MESA_handle_runtime_log(g_nat_format_info.log, RLOG_LV_INFO, "nat_format Huawei syslog", "Event field is an undefined value: %s", action_str);
            return APP_STATE_GIVEME;
        }
        
        // 字段部分（按顺序排列）：SourceIP、DestinationIP、SourcePort、DestinationPort、SourceNatIP、SourceNatPort、BeginTime、EndTime、Protocol
        // 依次对应nat_payload的：src_intra_ip, dst_ip, src_intra_port, &dst_port, src_extra_ip, src_extra_port, stream_start_timestamp, stream_end_timestamp, protocol

        if (extract_ip(udp_data, udp_data_len, "SourceIP", &nat_payload.src_intra_ip) < 0) {
            MESA_handle_runtime_log(g_nat_format_info.log, RLOG_LV_INFO, "nat_format Huawei syslog", "SourceIP Not Found");
            return APP_STATE_GIVEME;
        }

        if (extract_ip(udp_data, udp_data_len, "DestinationIP", &nat_payload.dst_ip) < 0) {
            MESA_handle_runtime_log(g_nat_format_info.log, RLOG_LV_INFO, "nat_format Huawei syslog", "DestinationIP Not Found");
            return APP_STATE_GIVEME;
        }

        if (extract_port(udp_data, udp_data_len, "SourcePort", &nat_payload.src_intra_port) < 0) {
            MESA_handle_runtime_log(g_nat_format_info.log, RLOG_LV_INFO, "nat_format Huawei syslog", "SourcePort Not Found");
            return APP_STATE_GIVEME;
        }

        if (extract_port(udp_data, udp_data_len, "DestinationPort", &nat_payload.dst_port) < 0) {
            MESA_handle_runtime_log(g_nat_format_info.log, RLOG_LV_INFO, "nat_format Huawei syslog", "DestinationPort Not Found");
            return APP_STATE_GIVEME;
        }

        if (extract_ip(udp_data, udp_data_len, "SourceNatIP", &nat_payload.src_extra_ip) < 0) {
            MESA_handle_runtime_log(g_nat_format_info.log, RLOG_LV_INFO, "nat_format Huawei syslog", "SourceNatIP Not Found");
            return APP_STATE_GIVEME;
        }

        if (extract_port(udp_data, udp_data_len, "SourceNatPort", &nat_payload.src_extra_port) < 0) {
            MESA_handle_runtime_log(g_nat_format_info.log, RLOG_LV_INFO, "nat_format Huawei syslog", "SourceNatPort Not Found");
            return APP_STATE_GIVEME;
        }

        if (extract_time(udp_data, udp_data_len, "BeginTime", &nat_payload.stream_start_timestamp) < 0) {
            MESA_handle_runtime_log(g_nat_format_info.log, RLOG_LV_INFO, "nat_format Huawei syslog", "BeginTime Not Found");
            return APP_STATE_GIVEME;
        }

        if (extract_time(udp_data, udp_data_len, "EndTime", &nat_payload.stream_end_timestamp) < 0) {
            MESA_handle_runtime_log(g_nat_format_info.log, RLOG_LV_INFO, "nat_format Huawei syslog", "EndTime Not Found");
            return APP_STATE_GIVEME;
        }

        if (extract_protocol_hw(udp_data, udp_data_len, "Protocol", &nat_payload.protocol) < 0) {
            MESA_handle_runtime_log(g_nat_format_info.log, RLOG_LV_INFO, "nat_format Huawei syslog", "Protocol Not Found");
            return APP_STATE_GIVEME;
        }

        // 将提取出来的信息写进组播载荷
        memcpy(multicast_payloads[thread_seq] + cur_pkts[thread_seq]*PAYLOAD_LEN, &nat_payload, PAYLOAD_LEN);
        cur_pkts[thread_seq]++;
        
        // 攒够20个进行发送
        if (cur_pkts[thread_seq] == g_nat_format_info.batch_size) {
            send_multicast(thread_seq);
        }
    } 
    // 华三syslog
    else if (udp_port == g_nat_format_info.h3_syslog_port) {
        // <6> Jan 25 09:08:33 2024 JXNC_HJZ_N6FW_H3C9014_1 %%10session/6/SESSION_IPV4_FLOW: -Slot=12.1; Protocol(1001)=UDP;Application(1002)=dns;SrcIPAddr(1003)=10.128.168.99;SrcPort(1004)=39000;NatSrcIPAddr(1005)=113.194.224.20;NatSrcPort(1006)=17306;DstIPAddr(1007)=220.248.192.13;DstPort(1008)=53;NatDstIPAddr(1009)=220.248.192.13;NatDstPort(1010)=53;InitPktCount(1044)=0;InitByteCount(1046)=0;RplyPktCount(1045)=0;RplyByteCount(1047)=0;RcvVPNInstance(1042)=;SndVPNInstance(1043)=;RcvDSLiteTunnelPeer(1040)=;SndDSLiteTunnelPeer(1041)=;BeginTime_e(1013)=01252024090804;EndTime_e(1014)=01252024090834;Event(1048)=(2)Aged for timeout;
        
        // 字段前的部分：防火墙日志生成时间
        char fw_log_time_month[10];
        char fw_log_time_other[15];
        char fw_log_time[25];
        if (sscanf(udp_data, "%*[^>]> %s %15[0-9: ]", fw_log_time_month, fw_log_time_other) != 2) {
            MESA_handle_runtime_log(g_nat_format_info.log, RLOG_LV_INFO, "nat_format Huasan syslog", "NAT extraction fw_log_time or action_str failed");
            return APP_STATE_GIVEME;
        }
        sprintf(fw_log_time, "%s %s", fw_log_time_month, fw_log_time_other);
        struct tm fw_time;
        if (strptime(fw_log_time, "%b %d %H:%M:%S %Y ", &fw_time) == NULL) {
            MESA_handle_runtime_log(g_nat_format_info.log, RLOG_LV_INFO, "nat_format Huasan syslog", "firewall log generation time extraction failed: %s", fw_log_time);
            return APP_STATE_GIVEME;
        }
        nat_payload.fw_log_timestamp = (unsigned int)mktime(&fw_time);

        // 字段部分（按顺序排列）：Protocol(1001)、SrcIPAddr(1003)、SrcPort(1004)、NatSrcIPAddr(1005)、NatSrcPort(1006)、DstIPAddr(1007)、DstPort(1008)、BeginTime_e(1013)、EndTime_e(1014)、Event(1048)

        if (extract_protocol_hs(udp_data, udp_data_len, "Protocol(1001)", &nat_payload.protocol) < 0) {
            MESA_handle_runtime_log(g_nat_format_info.log, RLOG_LV_INFO, "nat_format Huasan syslog", "Protocol(1001) Not Found");
            return APP_STATE_GIVEME;
        }

        if (extract_ip(udp_data, udp_data_len, "SrcIPAddr(1003)", &nat_payload.src_intra_ip) < 0) {
            MESA_handle_runtime_log(g_nat_format_info.log, RLOG_LV_INFO, "nat_format Huasan syslog", "SrcIPAddr(1003) Not Found");
            return APP_STATE_GIVEME;
        }

        if (extract_port(udp_data, udp_data_len, "SrcPort(1004)", &nat_payload.src_intra_port) < 0) {
            MESA_handle_runtime_log(g_nat_format_info.log, RLOG_LV_INFO, "nat_format Huasan syslog", "SrcPort(1004) Not Found");
            return APP_STATE_GIVEME;
        }

        if (extract_ip(udp_data, udp_data_len, "NatSrcIPAddr(1005)", &nat_payload.src_extra_ip) < 0) {
            MESA_handle_runtime_log(g_nat_format_info.log, RLOG_LV_INFO, "nat_format Huasan syslog", "NatSrcIPAddr(1005) Not Found");
            return APP_STATE_GIVEME;
        }

        if (extract_port(udp_data, udp_data_len, "NATSrcPort(1006)", &nat_payload.src_extra_port) < 0) {
            MESA_handle_runtime_log(g_nat_format_info.log, RLOG_LV_INFO, "nat_format Huasan syslog", "NATSrcPort(1006) Not Found");
            return APP_STATE_GIVEME;
        }

        if (extract_ip(udp_data, udp_data_len, "DstIPAddr(1007)", &nat_payload.dst_ip) < 0) {
            MESA_handle_runtime_log(g_nat_format_info.log, RLOG_LV_INFO, "nat_format Huasan syslog", "DstIPAddr(1007) Not Found");
            return APP_STATE_GIVEME;
        }

        if (extract_port(udp_data, udp_data_len, "DstPort(1008)", &nat_payload.dst_port) < 0) {
            MESA_handle_runtime_log(g_nat_format_info.log, RLOG_LV_INFO, "nat_format Huasan syslog", "DstPort(1008) Not Found");
            return APP_STATE_GIVEME;
        }

        if (extract_time(udp_data, udp_data_len, "BeginTime_e(1013)", &nat_payload.stream_start_timestamp) < 0) {
            MESA_handle_runtime_log(g_nat_format_info.log, RLOG_LV_INFO, "nat_format Huawei syslog", "BeginTime_e(1013) Not Found");
            return APP_STATE_GIVEME;
        }

        if (extract_time(udp_data, udp_data_len, "EndTime_e(1014)", &nat_payload.stream_end_timestamp) < 0) {
            MESA_handle_runtime_log(g_nat_format_info.log, RLOG_LV_INFO, "nat_format Huasan syslog", "EndTime_e(1014) Not Found");
            return APP_STATE_GIVEME;
        }

        if (extract_action_hs(udp_data, udp_data_len, "Event(1048)", &nat_payload.action) < 0) {
            MESA_handle_runtime_log(g_nat_format_info.log, RLOG_LV_INFO, "nat_format Huasan syslog", "EndTime_e(1014) Not Found");
            return APP_STATE_GIVEME;
        }        

        // 将提取出来的信息写进组播载荷
        memcpy(multicast_payloads[thread_seq] + cur_pkts[thread_seq]*PAYLOAD_LEN, &nat_payload, PAYLOAD_LEN);
        cur_pkts[thread_seq]++;
        
        // 攒够20个进行发送
        if (cur_pkts[thread_seq] == g_nat_format_info.batch_size) {
            send_multicast(thread_seq);
        }
    }
    // 迪普syslog TODO
    else if (udp_port == g_nat_format_info.dp_syslog_port) {
        return APP_STATE_GIVEME;
    }
    // 华为二进制
    else if (udp_port == g_nat_format_info.hw_binary_port) {
        // 从head提取必要信息
        struct hw_binary_log_head *hb_head = (struct hw_binary_log_head *)udp_data;
        int body_len = 0;
        int event_offset = 0;
        if (hb_head->Version == HW_BINARY_VERSION_3) {
            event_offset = HW_BINARY_BODY_V3_EVENT_OFFSET;
            if (hb_head->LogType == HW_BINARY_TYPE_IPV4) { body_len = HW_BINARY_BODY_LENGTH_V3_IPV4; }
            else {
                MESA_handle_runtime_log(g_nat_format_info.log, RLOG_LV_INFO, "nat_format Huawei Binary", "Unknown LogType %d for Version 0x03", hb_head->LogType);
                return APP_STATE_GIVEME;
            }
        } else if (hb_head->Version == HW_BINARY_VERSION_8) {
            event_offset = HW_BINARY_BODY_V8_EVENT_OFFSET;
            if (hb_head->LogType == HW_BINARY_TYPE_IPV4) { body_len = HW_BINARY_BODY_LENGTH_V8_IPV4; }
            else if (hb_head->LogType == HW_BINARY_TYPE_NOPAT) { body_len = HW_BINARY_BODY_LENGTH_V8_NOPAT; }
            else if (hb_head->LogType == HW_BINARY_TYPE_USER) { body_len = HW_BINARY_BODY_LENGTH_V8_USER; }
            else if (hb_head->LogType != HW_BINARY_TYPE_URL || hb_head->LogType != HW_BINARY_TYPE_TLV) {
                MESA_handle_runtime_log(g_nat_format_info.log, RLOG_LV_INFO, "nat_format Huawei Binary", "Unknown LogType %d for Version 0x08", hb_head->LogType);
                return APP_STATE_GIVEME;
            }
        } else { 
            MESA_handle_runtime_log(g_nat_format_info.log, RLOG_LV_INFO, "nat_format Huawei Binary", "Unknown Version %d", hb_head->Version);
            return APP_STATE_GIVEME;
        }
        u_int16_t log_num = ntohs(hb_head->Count);
        // 提取防火墙日志生成时间
        nat_payload.fw_log_timestamp = hb_head->Second;
        // 分别处理每一个body
        struct hw_binary_log_body *hb_body;
        int offset = sizeof(struct hw_binary_log_head);
        for (int i = 0; i < log_num; i++) {
            // 提取字段
            hb_body = (struct hw_binary_log_body *)(udp_data + offset);
            if (hb_body->Prot == HW_BINARY_PROT_ICMP) {
                nat_payload.protocol = FORMAT_LOG_PROTOCOL_ICMP;
            } else if (hb_body->Prot == HW_BINARY_PROT_TCP) {
                nat_payload.protocol = FORMAT_LOG_PROTOCOL_TCP;
            } else if (hb_body->Prot == HW_BINARY_PROT_UDP) {
                nat_payload.protocol = FORMAT_LOG_PROTOCOL_UDP;
            } else {
                MESA_handle_runtime_log(g_nat_format_info.log, RLOG_LV_INFO, "nat_format Huawei Binary", "Prot %d Not Define", hb_body->Prot);
                return APP_STATE_GIVEME;
            }
            nat_payload.src_intra_ip = hb_body->SourceIP;
            nat_payload.src_extra_ip = hb_body->SrcNatIP;
            nat_payload.dst_ip = hb_body->DestIP;
            nat_payload.src_intra_port = hb_body->SrcPort;
            nat_payload.src_extra_port = hb_body->SrcNatPort;
            nat_payload.dst_port = hb_body->DestPort;
            nat_payload.stream_start_timestamp = hb_body->StartTime;
            nat_payload.stream_end_timestamp = hb_body->EndTime;
            // 动作字段跳到后面的EventTrend判断
            char EventTrend = *(udp_data + offset + event_offset);
            if (EventTrend == HW_EVENT_NEW) {
                nat_payload.action = FORMAT_LOG_ACTION_ADD;
            } else if (EventTrend == HW_EVENT_AGED) {
                nat_payload.action = FORMAT_LOG_ACTION_DEL;
            } else {
                MESA_handle_runtime_log(g_nat_format_info.log, RLOG_LV_INFO, "nat_format Huawei Binary", "EventTrend %d Not Define",  EventTrend);
                return APP_STATE_GIVEME;
            }

            // 将提取出来的信息写进组播载荷
            memcpy(multicast_payloads[thread_seq] + cur_pkts[thread_seq]*PAYLOAD_LEN, &nat_payload, PAYLOAD_LEN);
            cur_pkts[thread_seq]++;

            // 攒够20个进行发送
            if (cur_pkts[thread_seq] == g_nat_format_info.batch_size) {
                send_multicast(thread_seq);
            }

            // 定位下一个body的offset -- 03版本28,08版本的IPV4、NOPAT为44，USER为209，URL、TLV每个不同，由附加长度确定
            if (i < log_num - 1) {
                if (body_len > 0) {
                    offset += body_len;
                } else {
                    char *tmp = (char *)hb_body;
                    u_int16_t AppendLength = ntohs(*(u_int16_t *)(tmp + sizeof(struct hw_binary_log_body) + HW_BINARY_BODY_V8_TLV_OFFSET));
                    offset += (HW_BINARY_BODY_LENGTH_V8_IPV4 + AppendLength);
                }
            }
        }
    }
    else if (udp_port == g_nat_format_info.h3_binary_port) {
        return APP_STATE_GIVEME;
    }
    else if (udp_port == g_nat_format_info.dp_binary_port) {
        return APP_STATE_GIVEME;
    }
    else {
        MESA_handle_runtime_log(g_nat_format_info.log, RLOG_LV_INFO, "nat_format", "Unknown Port.");
        return APP_STATE_GIVEME;
    }

    return APP_STATE_GIVEME;
}