更新rpm

# Conflicts:
#	roles/firewall/tasks/main.yml

deploy.yml

@@ -1,3 +1,15 @@
+- hosts:
+    - adc_mcn0
+    - adc_mcn1
+    - adc_mcn2
+    - adc_mcn3
+  remote_user: root
+  vars_files:
+    - install_config/group_vars/adc_global.yml
+  roles:
+    - framework
+    - kernel-ml
+
 - hosts: adc_mxn
   remote_user: root
   roles:
@@ -10,19 +22,18 @@
     - install_config/group_vars/adc_mcn0.yml
   roles:
 #    - tsg-env-mcn0
-    - framework
-    - kernel-ml
     - mrzcpd
     - sapp
     - tsg_master
     - kni
     - firewall
+    - tsg_app
     - http_healthcheck
-    - clotho
+    - packet_dump
     - certstore
     - cert-redis
     - telegraf_statistic
-    - tsg_device_tag
+#    - tsg_device_tag
 
 - hosts: adc_mcn1
   remote_user: root
@@ -31,8 +42,6 @@
     - install_config/group_vars/adc_mcn1.yml
   roles:
 #    - tsg-env-mcn1
-    - framework
-    - kernel-ml
     - mrzcpd
     - tfe
 
@@ -43,8 +52,6 @@
     - install_config/group_vars/adc_mcn2.yml
   roles:
 #    - tsg-env-mcn2
-    - framework
-    - kernel-ml
     - mrzcpd
     - tfe
 
@@ -55,11 +62,38 @@
     - install_config/group_vars/adc_mcn3.yml
   roles:
 #    - tsg-env-mcn3
-    - framework
-    - kernel-ml
     - mrzcpd
     - tfe
 
+- hosts: adc_mcn0
+  remote_user: root
+  roles:
+    - tsg-diagnose
+
+- hosts: 
+    - adc_mcn1
+    - adc_mcn2
+    - adc_mcn3
+  remote_user: root
+  roles:
+    - tsg-diagnose_sync_ca
+    
+- hosts: adc_mcn0
+  remote_user: root
+  roles:
+    - tsg-diagnose_stop_sync
+
+- hosts:
+    - adc_mcn0
+    - adc_mcn1
+    - adc_mcn2
+    - adc_mcn3
+  remote_user: root
+  vars_files:
+    - install_config/group_vars/adc_global.yml
+  roles:
+    - reboot
+
 - hosts: server-as-tun-mode
   remote_user: root
   vars_files:
@@ -73,11 +107,20 @@
     - tsg_master
     - kni
     - firewall
+    - tsg_app
     - http_healthcheck
-    - clotho
+    - packet_dump
     - certstore
     - cert-redis
     - tfe
     - telegraf_statistic
     - proxy_status
-    - tsg_device_tag
+#    - tsg_device_tag
+    - reboot
+
+- hosts: app_global
+  remote_user: root
+  vars_files:
+    - install_config/group_vars/app_global.yml
+  roles:
+    - app_global

install_config/group_vars/adc_global.yml

@@ -4,6 +4,10 @@ tsg_access_type: 3
 #####2: ADC;
 tsg_running_type: 2
 
+########################################
+#Deploy_finished_reboot
+Deploy_finished_reboot: 1
+
 ########################################
 #IP Config
 maat_redis_server:
@@ -23,6 +27,9 @@ cert_store_server:
 log_kafkabrokers:
   address: "1.1.1.1:9092,2.2.2.2:9092"
 
+monitor_outputs_influxdb:
+  url: "http://192.168.41.182:58086"
+
 log_minio:
   address: "192.168.40.168;"
   port: 9090
@@ -30,29 +37,32 @@ log_minio:
 #########################################
 #Log Level Config
 #日志等级 10:DEBUG 20:INFO 30:FATAL
-fw_ftp_log_level: 30
-fw_mail_log_level: 30
-fw_http_log_level: 30
-fw_dns_log_level: 30
-fw_quic_log_level: 30
-capture_packet_log_level: 30
-tsg_log_level: 30
-tsg_master_log_level: 30
-kni_log_level: 30
-tfe_log_level: 30
-tfe_http_log_level: 30
-pangu_log_level: 30
-doh_log_level: 30
-certstore_log_level: 30
-clotho_log_level: 10
+fw_ftp_log_level: 10
+fw_mail_log_level: 10
+fw_http_log_level: 10
+fw_dns_log_level: 10
+fw_quic_log_level: 10
+capture_packet_log_level: 10
+tsg_log_level: 10
+tsg_master_log_level: 10
+kni_log_level: 10
+
+#日志等级 DEBUG INFO FATAL
+tfe_log_level: DEBUG
+tfe_http_log_level: DEBUG
+pangu_log_level: DEBUG
+doh_log_level: DEBUG
+
+certstore_log_level: 10
+packet_dump_log_level: 10
 
 #######################################
 #Sapp Performance Config
 #Sapp工作在ADC计算板0时，建议使用如下30+8的配置，以保证更高的处理性能
 sapp:
-  worker_threads: 30
-  send_only_threads_max: 8
-  bind_mask: 0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37
+  worker_threads: 37
+  send_only_threads_max: 1
+  bind_mask: 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38
   inbound_route_dir: 1
 
 ########################################
@@ -75,15 +85,25 @@ kni:
 #Tfe Config
 tfe:
   nr_threads: 32
-  mc_cache_eth: lo 
-  keykeeper:
-    no_cache: 0
+  mirror_enable: 1
 
 ########################################
 #Marsio Config
 #marsio工作在ADC计算板时，建议使用如下配置，以保证更高的处理性能
 mrzcpd:
-  iocore: 44,45,46,47
+  iocore: 52,53,54,55
 
 mrtunnat:
-  lcore_id: 40,41,42,43
+  lcore_id: 48,49,50,51 
+
+#########################################
+#Tsg_app
+tsg_app_enable: 0
+app_global_ip: "1.1.1.1"
+applog_level: 10
+app_master_log_level: 10
+app_sketch_local_log_level: 10
+app_control_plug_log_level: 10
+
+
+breakpad_upload_url: http://127.0.0.1/

install_config/group_vars/adc_mcn0.yml

@@ -1,7 +1,7 @@
 #########################################
 #Mcn0管理口网卡名
 nic_mgr:
-  name: enp6s0
+  name: ens1f3
 
 #########################################
 #Mcn0流量接入网卡，固定配置
@@ -35,3 +35,5 @@ AllotAccess:
   virturlID_2: 104
   vvipv4_mask: 24
   vvipv6_mask: 64
+
+bladename: mcn0

install_config/group_vars/adc_mcn1.yml

@@ -1,7 +1,7 @@
 #########################################
 #Mcn1管理口网卡名
 nic_mgr:
-  name: enp6s0
+  name: ens1f3
 
 #########################################
 #Mcn1流量接入网卡，固定配置
@@ -15,3 +15,5 @@ nic_inner_ctrl:
 nic_traffic_mirror:
   name: ens1f2
   use_mrzcpd: 1
+
+bladename: mcn1

install_config/group_vars/adc_mcn2.yml

@@ -1,7 +1,7 @@
 #########################################
 #Mcn2管理口网卡名
 nic_mgr:
-  name: enp6s0
+  name: ens8f3
 
 #########################################
 #Mcn2流量接入网卡，固定配置
@@ -15,3 +15,5 @@ nic_inner_ctrl:
 nic_traffic_mirror:
   name: ens8f2
   use_mrzcpd: 1
+  
+bladename: mcn2

install_config/group_vars/adc_mcn3.yml

@@ -1,7 +1,7 @@
 #########################################
 #Mcn3管理口网卡名
 nic_mgr:
-  name: enp6s0
+  name: ens8f3
 
 #########################################
 #Mcn3流量接入网卡，固定配置
@@ -15,3 +15,5 @@ nic_inner_ctrl:
 nic_traffic_mirror:
   name: ens8f2
   use_mrzcpd: 1
+  
+bladename: mcn3

install_config/group_vars/app_global.yml

@@ -0,0 +1,10 @@
+#########################################
+app_sketch_global_log_level: 10
+
+maat_redis_server:
+  address: "192.168.40.168"
+  port: 7002
+  db: 0
+
+file_stat_ip: "1.1.1.1"
+  

install_config/group_vars/server_as_tun_mode.yml

@@ -4,6 +4,10 @@ tsg_access_type: 1
 #####0: Tun_mode;  1: normal;
 tsg_running_type: 1
 
+########################################
+#Deploy_finished_reboot
+Deploy_finished_reboot: 1
+
 ########################################
 #Server Basic Config
 nic_mgr:
@@ -47,10 +51,14 @@ capture_packet_log_level: 10
 tsg_log_level: 10
 tsg_master_log_level: 10
 kni_log_level: 10
-tfe_log_level: 10
-tfe_http_log_level: 10
-pangu_log_level: 10
-doh_log_level: 10
+
+
+#日志等级 DEBUG INFO FATAL
+tfe_log_level: DEBUG
+tfe_http_log_level: DEBUG
+pangu_log_level: DEBUG
+doh_log_level: DEBUG
+
 certstore_log_level: 10
 clotho_log_level: 10
 
@@ -58,9 +66,9 @@ clotho_log_level: 10
 #Sapp Performance Config
 #如果tsg_access_type=0，sapp跑在pcap模式，则以下配置可忽略
 sapp:
-  worker_threads: 16
-  send_only_threads_max: 8
-  bind_mask: 0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23
+  worker_threads: 23
+  send_only_threads_max: 1
+  bind_mask: 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24
   inbound_route_dir: 1
 
 #########################################
@@ -90,9 +98,7 @@ kni:
 #Tfe Config
 tfe:
   nr_threads: 32
-  mc_cache_eth: lo 
-  keykeeper:
-    no_cache: 0
+  mirror_enable: 1
 
 #########################################
 #Marsio Config
@@ -102,6 +108,15 @@ mrzcpd:
 mrtunnat:
   lcore_id: 38
 
+#########################################
+#Tsg_app
+tsg_app_enable: 1
+app_global_ip: "1.1.1.1"
+applog_level: 10
+app_master_log_level: 10
+app_sketch_local_log_level: 10
+app_control_plug_log_level: 10
+
 #########################################
 #ATCA Config
 #下列配置只在tsg_access_type=4时生效

install_config/hosts

@@ -4,6 +4,10 @@
 #变量device_id根据设备序号设置即可
 #变量vvipv4_1、vvipv4_2、vvipv6_1、vvipv6_2为Allot相关配置，其他环境可不填或直接删除变量
 #
+#20.09版本新增APP部署
+#[app_global]
+#0.0.0.0
+
 #[server-as-tun-mode]
 #1.1.1.1 device_id=device_1
 #
@@ -27,6 +31,7 @@
 #10.3.76.1 device_id=device_1
 #10.3.76.2 device_id=device_2
 
+[app_global]
 [server-as-tun-mode]
 [adc_mxn]
 [adc_mcn0]

roles/app_global/tasks/main.yml

@@ -0,0 +1,33 @@
+- name: "copy app_global rpm to destination server"
+  copy:
+    src: "{{ role_path }}/files/"
+    dest: /tmp/ansible_deploy/
+
+- name: "install app rpms from localhost"
+  yum:
+    name:
+      - /tmp/ansible_deploy/emqx-centos7-v4.1.2.x86_64.rpm
+      - /tmp/ansible_deploy/app-sketch-global-1.0.2.20200918.ab44d17-1.el7.x86_64.rpm
+    state: present
+
+- name: "template the app_sketch_global.conf"
+  template:
+    src: "{{ role_path }}/templates/app_sketch_global.conf.j2"
+    dest: /opt/tsg/app-sketch-global/conf/app_sketch_global.conf
+
+- name: "template the zlog.conf"
+  template:
+    src: "{{ role_path }}/templates/zlog.conf.j2"
+    dest: /opt/tsg/app-sketch-global/conf/zlog.conf
+
+- name: "Start emqx"
+  systemd:
+    name: emqx.service
+    state: started
+    enabled: yes
+
+- name: "Start app-sketch-global"
+  systemd:
+    name: app-sketch-global.service
+    state: started
+    enabled: yes

roles/app_global/templates/app_sketch_global.conf.j2

@@ -0,0 +1,41 @@
+[SYSTEM]
+#1:print on screen, 0:don't
+DEBUG_SWITCH = 1
+RUN_LOG_PATH = "conf/zlog.conf"
+
+[breakpad]
+disable_coredump=0
+enable_breakpad=1
+breakpad_minidump_dir=/tmp/app-sketch-global/crashreport
+enable_breakpad_upload=0
+breakpad_upload_url={{ breakpad_upload_url }}
+
+[CONFIG]
+#Number of running threads
+thread-nu = 1
+timeout = 3600
+address="tcp://127.0.0.1:1883"
+topic_name="APP_SIGNATURE_ID"
+client_name="ExampleClientSub"
+
+[maat]
+# 0:json 1: redis 2: iris
+maat_input_mode=1
+table_info=./resource/table_info.conf
+json_cfg_file=./resource/gtest.json
+stat_file=logs/verify-policy.status
+full_cfg_dir=verify-policy/
+inc_cfg_dir=verify-policy/
+
+maat_redis_server={{ maat_redis_server.address }}
+maat_redis_port_range={{ maat_redis_server.port }}
+maat_redis_db_index={{ maat_redis_server.db }}
+effect_interval_s=1
+accept_tags={"tags":[{"tag":"location","value":"Astana"}]}
+
+[stat]
+statsd_server={{ file_stat_ip }}
+statsd_port=8100
+statsd_cycle=5
+# FS_OUTPUT_STATSD=1, FS_OUTPUT_INFLUX_LINE=2
+statsd_format=2

roles/app_global/templates/zlog.conf.j2

@@ -0,0 +1,12 @@
+[global]
+default format = "%d(%c), %V, %F, %U, %m%n"
+[levels]
+DEBUG=10
+INFO=20
+FATAL=30
+[rules]
+*.fatal        "./logs/error.log.%d(%F)";
+*.{{ app_sketch_global_log_level }}		"./logs/app_sketch_global.log.%d(%F)"
+
+
+

roles/cert-redis/files/cert-redis/6379/6379.conf

@@ -160,7 +160,7 @@ loglevel notice
 # Specify the log file name. Also the empty string can be used to force
 # Redis to log on the standard output. Note that if you use standard
 # output for logging but daemonize, logs will be sent to /dev/null
-logfile "/home/tsg/cert-redis/6379/6379.log"
+logfile "/opt/tsg/cert-redis/6379/6379.log"
 
 # To enable logging to the system logger, just set 'syslog-enabled' to yes,
 # and optionally update the other syslog parameters to suit your needs.
@@ -244,7 +244,7 @@ dbfilename dump.rdb
 # The Append Only File will also be created inside this directory.
 #
 # Note that you must specify a directory here, not a file name.
-dir /home/tsg/cert-redis/6379/
+dir /opt/tsg/cert-redis/6379/
 
 ################################# REPLICATION #################################
 

roles/cert-redis/files/cert-redis/start-cert-redis

@@ -1,4 +1,4 @@
 #!/bin/bash
 #
 
-/usr/local/bin/redis-server /home/tsg/cert-redis/6379/6379.conf
+/usr/local/bin/redis-server /opt/tsg/cert-redis/6379/6379.conf

roles/cert-redis/tasks/main.yml

@@ -1,11 +1,11 @@
 - name: "copy cert-redis to destination server"
   copy:
     src: "{{ role_path }}/files/"
-    dest: /home/tsg
+    dest: /opt/tsg
     mode: 0755
 
 - name: "install cert-redis"
-  shell: cd /home/tsg/cert-redis;sh install.sh
+  shell: cd /opt/tsg/cert-redis;sh install.sh
 
 - name: "start cert-redis"
   systemd:

roles/certstore/tasks/main.yml

@@ -3,20 +3,25 @@
     src: "{{ role_path }}/files/"
     dest: "/tmp/ansible_deploy/"
 
-- name: Ensures /home/tsg exists
-  file: path=/home/tsg state=directory
+- name: Ensures /opt/tsg exists
+  file: path=/opt/tsg state=directory
   tags: mkdir
 
 - name: install certstore
   yum:
     name:
-      - /tmp/ansible_deploy/certstore-2.1.2.20200828.f507b3e-1.el7.x86_64.rpm
+      - /tmp/ansible_deploy/certstore-2.1.2.20200923.a36312c-1.el7.x86_64.rpm
     state: present
 
 - name: template certstore configure file
   template:
     src: "{{ role_path }}/templates/cert_store.ini.j2"
-    dest: /home/tsg/certstore/conf/cert_store.ini
+    dest: /opt/tsg/certstore/conf/cert_store.ini
+
+- name: template certstore zlog file
+  template:
+    src: "{{ role_path }}/templates/zlog.conf.j2"
+    dest: /opt/tsg/certstore/conf/zlog.conf
 
 - name: "start certstore"
   systemd:

roles/certstore/templates/cert_store.ini.j2

@@ -1,9 +1,15 @@
 [SYSTEM]
 #1:print on screen, 0:don't
 DEBUG_SWITCH = 1
-#10:DEBUG, 20:INFO, 30:FATAL
-RUN_LOG_LEVEL = {{ certstore_log_level }}
-RUN_LOG_PATH = ./logs
+RUN_LOG_PATH = "conf/zlog.conf"
+
+[breakpad]
+disable_coredump=0
+enable_breakpad=1
+breakpad_minidump_dir=/tmp/certstore/crashreport
+enable_breakpad_upload=0
+breakpad_upload_url= {{ breakpad_upload_url }}
+
 [CONFIG]
 #Number of running threads
 thread-nu = 4
@@ -14,7 +20,8 @@ expire_after = 30
 #Local default root certificate path
 local_debug = 1
 ca_path = ./cert/tango-ca-v3-trust-ca.pem
-untrusted_ca_path = ./cert/mesalab-ca-untrust.pem
+untrusted_ca_path = ./cert/tango-ca-v3-untrust-ca.pem
+
 [MAAT]
 #Configure the load mode,
 #0: using the configuration distribution network
@@ -31,18 +38,21 @@ inc_cfg_dir=./rule/inc/index
 full_cfg_dir=./rule/full/index
 #Json file path when json schema is used
 pxy_obj_keyring=./conf/pxy_obj_keyring.json
+
 [LIBEVENT]
 #Local monitor port number, default is 9991
 port = 9991
+
 [CERTSTORE_REDIS]
 #The Redis server IP address and port number where the certificate is stored locally
 ip = 127.0.0.1
 port = 6379
+
 [MAAT_REDIS]
 #Maat monitors the Redsi server IP address and port number
 ip = {{ maat_redis_server.address }}
 port = {{ maat_redis_server.port }}
 dbindex =  {{ maat_redis_server.db }}
 [stat]
-statsd_server=192.168.100.1
-statsd_port=8126
+statsd_server=127.0.0.1
+statsd_port=58100

roles/certstore/templates/zlog.conf.j2

@@ -0,0 +1,10 @@
+[global]
+default format = "%d(%c), %V, %F, %U, %m%n"
+[levels]
+DEBUG=10
+INFO=20
+FATAL=30
+[rules]
+*.fatal        "./logs/error.log.%d(%F)";
+*.{{ certstore_log_level }}        "./logs/certstore.log.%d(%F)"
+

roles/clotho/files/clotho.service

@@ -1,13 +0,0 @@
-[Unit]
-Description=clotho
-After=network.target
-After=network-online.target
-Wants=network-online.target
-
-[Service]
-ExecStart=/home/mesasoft/clotho/clotho
-ExecStop=killall clotho
-Type=forking
-
-[Install]
-WantedBy=multi-user.target

roles/clotho/tasks/main.yml

@@ -1,29 +0,0 @@
-- name: "copy clotho rpm to destination server"
-  copy:
-    src: "{{ role_path }}/files/clotho-debug-1.0.0.-1.el7.x86_64.rpm"
-    dest: /tmp/ansible_deploy/
-
-- name: "copy  clotho.service to destination server"
-  copy:
-    src: "{{ role_path }}/files/clotho.service"
-    dest: /usr/lib/systemd/system
-    mode: 0755
-
-- name: "install clotho rpm from localhost"
-  yum:
-    name:
-      - /tmp/ansible_deploy/clotho-debug-1.0.0.-1.el7.x86_64.rpm
-    state: present
-
-- name: "Template the clotho.conf"
-  template:
-    src: "{{ role_path }}/templates/clotho.conf.j2"
-    dest: /home/mesasoft/clotho/conf/clotho.conf 
-  tags: template
- 
-- name: "start clotho"
-  systemd:
-    name: clotho.service
-    enabled: yes
-    daemon_reload: yes
-

roles/clotho/templates/clotho.conf.j2

@@ -1,7 +0,0 @@
-[KAFKA]
-BROKER_LIST={{ log_kafkabrokers.address }}
-
-[SYSTEM]
-NIC_NAME={{ nic_mgr.name }}
-LOG_LEVEL={{ clotho_log_level }}
-LOG_PATH=log/clotho

roles/firewall/tasks/main.yml

@@ -11,22 +11,21 @@
     skip_broken: yes
   vars:
     fw_packages:
-      - /tmp/ansible_deploy/capture_packet_plug-3.0.2.09f193c-2.el7.x86_64.rpm
-      - /tmp/ansible_deploy/clotho-debug-1.0.0.-1.el7.x86_64.rpm
-      - /tmp/ansible_deploy/dns-2.0.6.d8317e9-2.el7.x86_64.rpm
-      - /tmp/ansible_deploy/ftp-1.0.6.2710506-2.el7.x86_64.rpm
-      - /tmp/ansible_deploy/fw_dns_plug-3.0.0.0a5d574-2.el7.x86_64.rpm
-      - /tmp/ansible_deploy/fw_ftp_plug-3.0.0.7a867ea-2.el7.x86_64.rpm
-      - /tmp/ansible_deploy/fw_http_plug-3.0.0.1ca1c65-2.el7.x86_64.rpm
-      - /tmp/ansible_deploy/fw_mail_plug-3.0.0.3b4e481-2.el7.x86_64.rpm
-      - /tmp/ansible_deploy/fw_quic_plug-3.0.0.b06d39c-2.el7.x86_64.rpm
-      - /tmp/ansible_deploy/fw_ssl_plug-3.0.1.7ea9976-2.el7.x86_64.rpm
-      - /tmp/ansible_deploy/http-2.0.3.9218b4b-2.el7.x86_64.rpm
-      - /tmp/ansible_deploy/mail-1.0.7.9e3be05-2.el7.x86_64.rpm
-      - /tmp/ansible_deploy/quic-1.1.6.d6755d8-2.el7.x86_64.rpm
-      - /tmp/ansible_deploy/ssl-1.0.3.e8482a4-2.el7.x86_64.rpm
-      - /tmp/ansible_deploy/tsg_conn_record-1.0.2.2afb19a-2.el7.x86_64.rpm
-      - /tmp/ansible_deploy/tsg_conn_sketch-2.0.v2.0_alpha.af621ca-2.el7.x86_64.rpm
+      - /tmp/ansible_deploy/capture_packet_plug-3.0.4.42574b7-2.el7.x86_64.rpm
+      - /tmp/ansible_deploy/conn_telemetry-1.0.2.8d6da43-2.el7.x86_64.rpm
+      - /tmp/ansible_deploy/dns-2.0.9.b639626-2.el7.x86_64.rpm
+      - /tmp/ansible_deploy/ftp-1.0.8.13d5fda-2.el7.x86_64.rpm
+      - /tmp/ansible_deploy/fw_dns_plug-3.0.2.dab58fa-2.el7.x86_64.rpm
+      - /tmp/ansible_deploy/fw_ftp_plug-3.0.1.0a78573-2.el7.x86_64.rpm
+      - /tmp/ansible_deploy/fw_http_plug-3.0.1.0c7e082-2.el7.x86_64.rpm
+      - /tmp/ansible_deploy/fw_mail_plug-3.0.1.02465eb-2.el7.x86_64.rpm
+      - /tmp/ansible_deploy/fw_quic_plug-3.0.1.b790ee1-2.el7.x86_64.rpm
+      - /tmp/ansible_deploy/fw_ssl_plug-3.0.4.a0b19ee-2.el7.x86_64.rpm
+      - /tmp/ansible_deploy/http-2.0.5.c61ad9a-2.el7.x86_64.rpm
+      - /tmp/ansible_deploy/mail-1.0.9.c1d3bde-2.el7.x86_64.rpm
+      - /tmp/ansible_deploy/quic-1.1.10.c2b90a0-2.el7.x86_64.rpm
+      - /tmp/ansible_deploy/ssl-1.0.9.69f3742-2.el7.x86_64.rpm
+      - /tmp/ansible_deploy/tsg_conn_sketch-2.0.6.abb4f4d-2.el7.x86_64.rpm
 
 - name: "Template the tsgconf/main.conf"
   template:

roles/firewall/templates/main.conf.j2

@@ -1,55 +1,57 @@
 [FTP_PLUG]
-LOG_PATH=./tsglog/fw_ftp_plug/fw_ftp_plug
+LOG_PATH="./tsglog/fw_ftp_plug/fw_ftp_plug"
 LOG_LEVEL={{ fw_ftp_log_level }}
 TIMEOUT=600
 
 [MAIL_PLUG]
-LOG_PATH=./tsglog/fw_mail_plug/fw_mail_plug
+LOG_PATH="./tsglog/fw_mail_plug/fw_mail_plug"
 LOG_LEVEL={{ fw_mail_log_level }}
 TIMEOUT=600
 
 [HTTP_PLUG]
-LOG_PATH=./tsglog/fw_http_plug/fw_http_plug
+LOG_PATH="./tsglog/fw_http_plug/fw_http_plug"
 LOG_LEVEL={{ fw_http_log_level }}
 
 [DNS_PLUG]
-LOG_PATH=./tsglog/fw_dns_plug/fw_dns_plug
+LOG_PATH="./tsglog/fw_dns_plug/fw_dns_plug"
 LOG_LEVEL={{ fw_dns_log_level }}
 
 [QUIC_PLUG]
-LOG_PATH=./tsglog/fw_quic_plug/fw_quic_plug
+LOG_PATH="./tsglog/fw_quic_plug/fw_quic_plug"
 LOG_LEVEL={{ fw_quic_log_level }}
 
 [MAAT]
-PROFILE=./tsgconf/maat.conf
-SUBSCRIBER_ID_TABLE=TSG_OBJ_SUBSCRIBER_ID
-CB_SUBSCRIBER_IP_TABLE=TSG_DYN_SUBSCRIBER_IP
-IP_ADDR_TABLE=TSG_SECURITY_ADDR
+PROFILE="./tsgconf/maat.conf"
+SUBSCRIBER_ID_TABLE="TSG_OBJ_SUBSCRIBER_ID"
+CB_SUBSCRIBER_IP_TABLE="TSG_DYN_SUBSCRIBER_IP"
+IP_ADDR_TABLE="TSG_SECURITY_ADDR"
 
 [TSG_LOG]
 MODE=1
-NIC_NAME={{ nic_mgr.name }}
+NIC_NAME="{{ nic_mgr.name }}"
 MAX_SERVICE=1
 LOG_LEVEL={{ tsg_log_level }}
-LOG_PATH=./tsglog/tsglog
-BROKER_LIST={{ log_kafkabrokers.address }}
-COMMON_FIELD_FILE=tsgconf/tsg_log_field.conf
+LOG_PATH="./tsglog/tsglog"
+BROKER_LIST="{{ log_kafkabrokers.address }}"
+COMMON_FIELD_FILE="tsgconf/tsg_log_field.conf"
 
 [STATISTIC]
 CYCLE=5
 TELEGRAF_PORT=8100
-TELEGRAF_IP=127.0.0.1
-OUTPUT_PATH=./tsg_statistic.log
-APP_NAME=statistic
+TELEGRAF_IP="127.0.0.1"
+OUTPUT_PATH="./tsg_statistic.log"
+APP_NAME="statistic"
 
 [FIELD_STAT]
 CYCLE=5
 TELEGRAF_PORT=8100
-TELEGRAF_IP=127.0.0.1
-OUTPUT_PATH=./tsg_stat.log
-APP_NAME=tsg_master
+TELEGRAF_IP="127.0.0.1"
+OUTPUT_PATH="./tsg_stat.log"
+APP_NAME="tsg_master"
 
 [SYSTEM]
+ENTRANCE_ID={{ tsg_master_entrance_id }}
 LOG_LEVEL={{ tsg_master_log_level }}
-LOG_PATH=./tsglog/tsg_master
-POLICY_PRIORITY_LABEL=POLICY_PRIORITY
+LOG_PATH="./tsglog/tsg_master"
+POLICY_PRIORITY_LABEL="POLICY_PRIORITY"
+DEVICE_ID_COMMAND="hostname | awk -F'-' '{print $3}'| awk -F'ADC' '{print $2}'"

roles/framework/tasks/main.yml

@@ -10,19 +10,21 @@
     skip_broken: yes
   vars:
     packages:
-      - /tmp/ansible_deploy/libMESA_field_stat-1.0.1.852c2df-1.el7.x86_64.rpm
-      - /tmp/ansible_deploy/libMESA_field_stat2-2.9.0.16ecf3b-2.el7.x86_64.rpm
-      - /tmp/ansible_deploy/libMESA_handle_logger-1.0.9.304259e-2.el7.x86_64.rpm
-      - /tmp/ansible_deploy/libMESA_htable-3.10.11.6275308-1.el7.x86_64.rpm
-      - /tmp/ansible_deploy/libMESA_prof_load-1.0.5.bf755de-1.el7.x86_64.rpm
-      - /tmp/ansible_deploy/libWiredLB-2.0.3.c7d131b-1.el7.x86_64.rpm
-      - /tmp/ansible_deploy/libcjson-1.7.8.542ad7f-1.el7.x86_64.rpm
-      - /tmp/ansible_deploy/libdocumentanalyze-2.0.4.efdfc29-1.el7.x86_64.rpm
-      - /tmp/ansible_deploy/libmaatframe-3.0.3.5931b44-2.el7.x86_64.rpm
-      - /tmp/ansible_deploy/librulescan-2.2.0.900d2b3-2.el7.x86_64.rpm
-      - /tmp/ansible_deploy/libwiredcfg-2.0.2.7ce1eea-1.el7.x86_64.rpm
-      - /tmp/ansible_deploy/lz4-1.7.5-3.el7.x86_64.rpm
+      - /tmp/ansible_deploy/libcjson-1.7.10.ab2896f-2.el7.x86_64.rpm
+      - /tmp/ansible_deploy/libdocumentanalyze-2.0.6.2d1abe0-2.el7.x86_64.rpm
+      - /tmp/ansible_deploy/libmaatframe-3.1.3.4fbcf21-2.el7.x86_64.rpm
+      - /tmp/ansible_deploy/libMESA_field_stat-1.0.2.6d45eed-2.el7.x86_64.rpm
+      - /tmp/ansible_deploy/libMESA_field_stat2-2.9.4.4e2dd78-2.el7.x86_64.rpm
+      - /tmp/ansible_deploy/libMESA_handle_logger-2.0.7.cb4ad71-2.el7.x86_64.rpm
+      - /tmp/ansible_deploy/libMESA_htable-3.10.12.cf4ccfc-2.el7.x86_64.rpm
+      - /tmp/ansible_deploy/libMESA_prof_load-1.0.6.c6da36a-2.el7.x86_64.rpm
       - /tmp/ansible_deploy/librdkafka-0.11.4-1.el7.x86_64.rpm
+      - /tmp/ansible_deploy/librulescan-2.2.1.1716a7b-2.el7.x86_64.rpm
+      - /tmp/ansible_deploy/libtsglua-1.0.8.0dbf2e6-2.el7.x86_64.rpm
+      - /tmp/ansible_deploy/libwiredcfg-2.0.6.67ae0ab-2.el7.x86_64.rpm
+      - /tmp/ansible_deploy/libWiredLB-2.0.5.4629165-2.el7.x86_64.rpm
+      - /tmp/ansible_deploy/lz4-1.7.5-3.el7.x86_64.rpm
+      - /tmp/ansible_deploy/libbreakpad_mini-1.0.2.a56ef00-2.el7.x86_64.rpm
 
 - name: "mkdir /etc/ld.so.conf.d/"
   file:

roles/kernel-ml/tasks/main.yml

@@ -40,6 +40,6 @@
     - tsg_access_type == 4
     - t_kernel_ml.changed
 
-- name: "reboot"
-  reboot:
-  when: t_kernel_ml.changed
+#- name: "reboot"
+#  reboot:
+#  when: t_kernel_ml.changed

roles/kni/tasks/main.yml

@@ -7,7 +7,7 @@
 - name: "install kni rpms from localhost"
   yum:
     name:
-      - /tmp/ansible_deploy/kni-20.07-1.el7.x86_64.rpm
+      - /tmp/ansible_deploy/kni-20.10.20201014.6d458ba-1.el7.x86_64.rpm
     state: present
 
 - name: Template the kni.conf

roles/kni/templates/kni.conf.j2

@@ -64,7 +64,7 @@ mho_hash_max_element_num = 2560000
 mho_expire_time = 30
 mho_eliminate_type = LRU
 
-//per thread
+#per thread
 [tuple2stream_htable]
 mho_screen_print_ctrl = 0
 mho_thread_safe = 0
@@ -77,7 +77,68 @@ mho_eliminate_type = LRU
 [field_stat]
 remote_switch = 1
 remote_ip = 127.0.0.1
-remote_port = 8100
+remote_port = 58100
 local_path = ./fs2_kni.status
 stat_cycle = 1
 print_mode = 1
+# 1:FS_OUTPUT_STATSD; 2:FS_OUTPUT_INFLUX_LINE
+statsd_format = 2
+APP_NAME = fs2_kni
+
+#self test Shunt rules security policy id
+[tsg_diagnose]
+enabled = 1
+security_policy_id = 3,10
+
+
+[ssl_dynamic_bypass]
+enabled = 1
+
+#kni dynamic bypass
+[traceid2sslinfo_htable]
+mho_screen_print_ctrl = 0
+mho_thread_safe = 1
+mho_mutex_num = 160
+mho_hash_slot_size = 80000
+mho_hash_max_element_num = 320000
+mho_expire_time = 300
+mho_eliminate_type = FIFO
+
+[sslinfo2bypass_htable]
+mho_screen_print_ctrl = 0
+mho_thread_safe = 1
+mho_mutex_num = 160
+mho_hash_slot_size = 640000
+mho_hash_max_element_num = 2560000
+mho_expire_time = 300
+mho_eliminate_type = FIFO
+
+[proxy_tcp_option]
+enabled = 1
+maat_table_compile = PXY_TCP_OPTION_COMPILE
+maat_table_addr = PXY_TCP_OPTION_ADDR
+maat_table_fqdn = PXY_TCP_OPTION_SERVER_FQDN
+enable_override = 0
+client_tcp_maxseg_enable = 0
+client_tcp_maxseg = 1460
+client_tcp_nodelay =  1
+client_tcp_ttl = 70
+client_tcp_keepalive_enable = 1
+client_tcp_keepalive_keepcnt = 8
+client_tcp_keepalive_keepidle = 30
+client_tcp_keepalive_keepintvl = 15
+client_tcp_user_timeout = 600
+server_tcp_maxseg_enable = 0
+server_tcp_maxseg = 1460
+server_tcp_nodelay = 1
+server_tcp_ttl = 75
+server_tcp_keepalive_enable = 1
+server_tcp_keepalive_keepcnt = 8
+server_tcp_keepalive_keepidle = 30
+server_tcp_keepalive_keepintvl = 15
+server_tcp_user_timeout = 600
+bypass_duplicated_packet = 0
+tcp_passthrough = 0
+
+[share_session_attribute]
+SESSION_ATTRIBUTE_LABEL=TSG_MASTER_INTERNAL_LABEL

roles/mrzcpd/tasks/main.yml

@@ -6,7 +6,7 @@
 
 - name: "install mrzcpd"
   yum:
-    name: /tmp/ansible_deploy/mrzcpd-4.3.25.d88306e-1.el7.x86_64.rpm
+    name: /tmp/ansible_deploy/mrzcpd-4.3.28.2d13de4-1.el7.x86_64.rpm
     state: present
 
 - name: "update sysconfig/mrzcpd"

roles/mrzcpd/templates/adc_inline/mrglobal.conf.adc_inline.j2

@@ -10,7 +10,7 @@ jumbo_frame=1
 max_rx_pkt_len=15360
 clear_tx_flags=1
 vlan-filter=1
-vlan-id-allow=1000,1001
+vlan-id-allow=1000,1001,4000,4001
 
 [device:{{nic_to_tfe.tfe0.name}}]
 jumbo_frame=1

roles/mrzcpd/templates/adc_inline/mrtunnat.conf.adc_inline.j2

@@ -16,3 +16,6 @@ enable=1
 c_router_vlan_id_0=1000
 i_router_vlan_id_0=1001
 en_mac_flipping_0=0
+c_router_vlan_id_1=4000
+i_router_vlan_id_1=4001
+en_mac_flipping_1=0

roles/mrzcpd/templates/adc_tun_mode/mrglobal.conf.adc_tun_mode.j2

@@ -8,7 +8,7 @@ jumbo_frame=1
 max_rx_pkt_len=15360
 clear_tx_flags=1
 vlan-filter=1
-vlan-id-allow=1000,1001,2000,2001
+vlan-id-allow=1000,1001,2000,2001,4000,4001
 vlan-pvid=0
 vlan-pvid-mode=2
 promisc=1

roles/mrzcpd/templates/adc_tun_mode/mrtunnat.conf.adc_tun_mode.j2

@@ -19,3 +19,6 @@ en_mac_flipping_0=0
 c_router_vlan_id_1=2000
 i_router_vlan_id_1=2001
 en_mac_flipping_1=0
+c_router_vlan_id_2=4000
+i_router_vlan_id_2=4001
+en_mac_flipping_2=0

roles/mrzcpd/templates/allot_access/mrglobal.conf.allot_access.j2

@@ -8,7 +8,7 @@ jumbo_frame=1
 max_rx_pkt_len=15360
 clear_tx_flags=1
 vlan-filter=1
-vlan-id-allow={{ AllotAccess.virturlID_1 }},{{ AllotAccess.virturlID_2 }}
+vlan-id-allow={{ AllotAccess.virturlID_1 }},{{ AllotAccess.virturlID_2 }},4000,4001,1000,1001
 vlan-pvid=0
 vlan-pvid-mode=2
 promisc=1

roles/mrzcpd/templates/allot_access/mrtunnat.conf.allot_access.j2

@@ -16,4 +16,10 @@ enable=1
 c_router_vlan_id_0={{ AllotAccess.virturlID_1 }}
 i_router_vlan_id_0={{ AllotAccess.virturlID_2 }}
 en_mac_flipping_0=1
+c_router_vlan_id_1=1000
+i_router_vlan_id_1=1001
+en_mac_flipping_1=0
+c_router_vlan_id_2=4000
+i_router_vlan_id_2=4001
+en_mac_flipping_2=0
 

roles/mrzcpd/templates/traffic_mirror/mrglobal.conf.traffic_mirror.j2

@@ -1,5 +1,5 @@
 [device]
-device=fake
+device={{nic_traffic_mirror.name}}
 sz_tunnel=8192
 sz_buffer=0