gfwleak/tango-kni
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

增加和tfe通信接口, 添加负载均衡功能等

Browse Source
This commit is contained in:
崔一鸣
2019-06-03 20:19:04 +08:00
parent 85aee8ba55
commit 1fa7a0673f
20 changed files with 1607 additions and 341 deletions
Download Patch File Download Diff File Expand all files Collapse all files

151
entry/src/kni_maat.cpp
View File

@@ -2,8 +2,16 @@
#include "kni_maat.h"
extern int g_iThreadNum;
int g_maat_default_action = -1;
struct kni_maat_handle{
Maat_feather_t feather;
int tableid_intercept_ip;
int tableid_intercept_domain;
void *logger;
};
void kni_maat_destroy(struct kni_maat_handle *handle){
if(handle != NULL){
if(handle->feather != NULL){
@@ -42,76 +50,125 @@ struct kni_maat_handle* kni_maat_init(const char* profile, void *logger){
char tablename_intercept_ip[KNI_SYMBOL_MAX];
char tablename_intercept_domain[KNI_SYMBOL_MAX];
char compile_alias[KNI_SYMBOL_MAX];
MESA_load_profile_int_def(profile, section, "readconf_mode", &readconf_mode, KNI_MAAT_READCONF_IRIS);
MESA_load_profile_string_def(profile, section, "tableinfo_path", tableinfo_path, sizeof(tableinfo_path), "unknown");
MESA_load_profile_string_def(profile, section, "tablename_intercept_ip", tablename_intercept_ip, sizeof(tablename_intercept_ip), "unknown");
MESA_load_profile_string_def(profile, section, "tablename_intercept_domain", tablename_intercept_domain, sizeof(tablename_intercept_domain), "unknown");
MESA_load_profile_string_def(profile, section, "compile_alias", compile_alias, sizeof(compile_alias), "unknown");
char maatjson_path[KNI_PATH_MAX];
char redis_ip[INET_ADDRSTRLEN];
int redis_port;
int redis_index;
Maat_feather_t feather = NULL;
int tableid_intercept_ip = -1;
int tableid_intercept_domain = -1;
struct kni_maat_handle *handle = NULL;
int ret = MESA_load_profile_int_nodef(profile, section, "readconf_mode", &readconf_mode);
if(ret < 0){
KNI_LOG_ERROR(logger, "MESA_prof_load: readconf_mode not set, profile is %s, section is %s", profile, section);
goto error_out;
}
ret = MESA_load_profile_string_nodef(profile, section, "tableinfo_path", tableinfo_path, sizeof(tableinfo_path));
if(ret < 0){
KNI_LOG_ERROR(logger, "MESA_prof_load: tableinfo_path not set, profile is %s, section is %s", profile, section);
goto error_out;
}
ret = MESA_load_profile_string_nodef(profile, section, "tablename_intercept_ip", tablename_intercept_ip, sizeof(tablename_intercept_ip));
if(ret < 0){
KNI_LOG_ERROR(logger, "MESA_prof_load: tablename_intercept_ip not set, profile is %s, section is %s", profile, section);
goto error_out;
}
ret = MESA_load_profile_string_nodef(profile, section, "tablename_intercept_domain", tablename_intercept_domain, sizeof(tablename_intercept_domain));
if(ret < 0){
KNI_LOG_ERROR(logger, "MESA_prof_load: tablename_intercept_domain not set, profile is %s, section is %s", profile, section);
goto error_out;
}
ret = MESA_load_profile_string_nodef(profile, section, "compile_alias", compile_alias, sizeof(compile_alias));
if(ret < 0){
KNI_LOG_ERROR(logger, "MESA_prof_load: compile_alias not set, profile is %s, section is %s", profile, section);
goto error_out;
}
KNI_LOG_INFO(logger, "MESA_prof_load, [%s]:\n readconf_mode: %d\n tableinfo_path: %s\n tablename_intercept_ip: %s\n tablename_intercept_domain: %s\n"
"compile_alias: %s\n", section, readconf_mode, tableinfo_path, tablename_intercept_ip, tablename_intercept_domain, compile_alias);
Maat_feather_t feather = Maat_feather(g_iThreadNum, tableinfo_path, logger);
feather = Maat_feather(g_iThreadNum, tableinfo_path, logger);
handle = ALLOC(struct kni_maat_handle, 1);
handle->feather = feather;
if(feather == NULL){
KNI_LOG_ERROR(logger, "Failed at Maat_feather, max_thread_num is %d, tableinfo_path is %s", g_iThreadNum, tableinfo_path);
return NULL;
}
if(readconf_mode == KNI_MAAT_READCONF_JSON){
char maatjson_path[KNI_PATH_MAX];
MESA_load_profile_string_def(profile, section, "maatjson_path", maatjson_path, sizeof(maatjson_path), "unknown");
KNI_LOG_INFO(logger, "MESA_prof_load, [%s]:\n maatjson_path: %s", section, maatjson_path);
Maat_set_feather_opt(feather, MAAT_OPT_JSON_FILE_PATH, maatjson_path, strlen(maatjson_path));
switch(readconf_mode){
case KNI_MAAT_READCONF_JSON:
ret = MESA_load_profile_string_nodef(profile, section, "maatjson_path", maatjson_path, sizeof(maatjson_path));
if(ret < 0){
KNI_LOG_ERROR(logger, "MESA_prof_load: maatjson_path not set, profile is %s, section is %s", profile, section);
goto error_out;
}
KNI_LOG_INFO(logger, "MESA_prof_load, [%s]:\n maatjson_path: %s", section, maatjson_path);
Maat_set_feather_opt(feather, MAAT_OPT_JSON_FILE_PATH, maatjson_path, strlen(maatjson_path));
break;
case KNI_MAAT_READCONF_IRIS:
break;
case KNI_MAAT_READCONF_REDIS:
ret = MESA_load_profile_string_nodef(profile, section, "redis_ip", redis_ip, sizeof(redis_ip));
if(ret < 0){
KNI_LOG_ERROR(logger, "MESA_prof_load: redis_ip not set, profile is %s, section is %s", profile, section);
goto error_out;
}
ret = MESA_load_profile_int_nodef(profile, section, "redis_port", &redis_port);
if(ret < 0){
KNI_LOG_ERROR(logger, "MESA_prof_load: redis_port not set, profile is %s, section is %s", profile, section);
goto error_out;
}
ret = MESA_load_profile_int_nodef(profile, section, "redis_index", &redis_index);
if(ret < 0){
KNI_LOG_ERROR(logger, "MESA_prof_load: redis_index not set, profile is %s, section is %s", profile, section);
goto error_out;
}
KNI_LOG_INFO(logger, "MESA_prof_load, [%s]:\n redis_ip: %s\n redis_port: %d\n redis_index: %d",
section, redis_ip, redis_port, redis_index);
Maat_set_feather_opt(feather, MAAT_OPT_REDIS_IP, (void*)redis_ip, strlen(redis_ip) + 1);
Maat_set_feather_opt(feather, MAAT_OPT_REDIS_PORT, (void*)&redis_port, sizeof(redis_port));
Maat_set_feather_opt(feather, MAAT_OPT_REDIS_INDEX, (void*)&redis_index, sizeof(redis_index));
break;
default:
break;
}
if(readconf_mode == KNI_MAAT_READCONF_IRIS){
//TODO
}
if(readconf_mode == KNI_MAAT_READCONF_REDIS){
char redis_ip[KNI_SYMBOL_MAX];
int redis_port;
int redis_index;
MESA_load_profile_string_def(profile, section, "redis_ip", redis_ip, sizeof(redis_ip), "unknown");
MESA_load_profile_int_def(profile, section, "redis_port", &redis_port, -1);
MESA_load_profile_int_def(profile, section, "redis_index", &redis_index, -1);
KNI_LOG_INFO(logger, "MESA_prof_load, [%s]:\n redis_ip: %s\n redis_port: %s\n redis_index: %d",
section, redis_ip, redis_port, redis_index);
Maat_set_feather_opt(feather, MAAT_OPT_REDIS_IP, (void*)redis_ip, strlen(redis_ip) + 1);
Maat_set_feather_opt(feather, MAAT_OPT_REDIS_PORT, (void*)&redis_port, sizeof(redis_port));
Maat_set_feather_opt(feather, MAAT_OPT_REDIS_INDEX, (void*)&redis_index, sizeof(redis_index));
}
int ret = Maat_initiate_feather(feather);
ret = Maat_initiate_feather(feather);
if(ret < 0){
KNI_LOG_ERROR(logger, "Failed at Maat_initiate_feather");
return NULL;
goto error_out;
}
int tableid_intercept_ip = Maat_table_register(feather, tablename_intercept_ip);
int tableid_intercept_domain = Maat_table_register(feather, tablename_intercept_domain);
tableid_intercept_ip = Maat_table_register(feather, tablename_intercept_ip);
tableid_intercept_domain = Maat_table_register(feather, tablename_intercept_domain);
if(tableid_intercept_ip < 0){
KNI_LOG_ERROR(logger, "Failed at Maat_table_register, tablename is %d, ret is %d",
tablename_intercept_ip, tableid_intercept_ip);
return NULL;
goto error_out;
}
if(tableid_intercept_domain < 0){
KNI_LOG_ERROR(logger, "Failed at Maat_table_register, tablename is %d, ret is %d",
tablename_intercept_domain, tableid_intercept_domain);
return NULL;
goto error_out;
}
struct kni_maat_handle *handle = ALLOC(struct kni_maat_handle, 1);
ret = Maat_rule_get_ex_new_index(feather, compile_alias, compile_ex_param_new, compile_ex_param_free, compile_ex_param_dup, 0, logger);
if(ret < 0){
KNI_LOG_ERROR(logger, "Failed at Maat_rule_get_ex_new_index, ret is %d", ret);
kni_maat_destroy(handle);
return NULL;
goto error_out;
}
handle->feather = feather;
handle->tableid_intercept_ip = tableid_intercept_ip;
handle->tableid_intercept_domain = tableid_intercept_domain;
handle->logger = logger;
return handle;
error_out:
kni_maat_destroy(handle);
return NULL;
}
static int maat_process_scan_result(struct kni_maat_handle *handle, int num, struct Maat_rule_t *result){
static int maat_process_scan_result(struct kni_maat_handle *handle, int num, struct Maat_rule_t *result, int *policy_id){
//void *logger = handle->logger;
int action = g_maat_default_action;
*policy_id = 0; //默认动作是编译表中policy_id=0的字段，所以默认policy_id=0;
for(int i = 0; i < num; i++){
action = result[i].action;
*policy_id = result[i].config_id;
if(action == KNI_ACTION_BYPASS){
return action;
}
@@ -121,7 +178,7 @@ static int maat_process_scan_result(struct kni_maat_handle *handle, int num, str
//TODO: Maat_rule_get_ex_new_index compile_ex_param_new: config_id = 0, 取action即为全局变量, 一旦配置更新就回调, tableinfo怎么写，回调表， 编译配置表
int kni_maat_scan_ip(struct kni_maat_handle *handle, struct ipaddr *addr, int thread_seq){
int kni_maat_scan_ip(struct kni_maat_handle *handle, struct ipaddr *addr, int thread_seq, int *policy_id){
//printf("default action is %d\n", g_maat_default_action);
void *logger = handle->logger;
struct Maat_rule_t result[KNI_MAAT_RULE_NUM_MAX];
@@ -132,17 +189,17 @@ int kni_maat_scan_ip(struct kni_maat_handle *handle, struct ipaddr *addr, int th
KNI_LOG_ERROR(logger, "Failed at Maat_scan_proto_addr, ret is %d", ret);
return g_maat_default_action;
}
int action = maat_process_scan_result(handle, ret, result);
int action = maat_process_scan_result(handle, ret, result, policy_id);
//for debug
char saddr[INET_ADDRSTRLEN];
inet_ntop(AF_INET, &(addr->v4->saddr), saddr, INET_ADDRSTRLEN);
KNI_LOG_DEBUG(logger, "ip is %s, ret is %d, action is %d\n", saddr, ret, action);
char stream_addr[KNI_SYMBOL_MAX] = "";
kni_stream_addr_trans(addr, stream_addr, sizeof(stream_addr));
KNI_LOG_DEBUG(logger, "maat_scan_ip, %s, policy_id = %d, action = %s\n",
stream_addr, *policy_id, action == KNI_ACTION_BYPASS ? "bypss" : "intercept");
return action;
}
int kni_maat_scan_domain(struct kni_maat_handle* handle, char *domain, int domain_len, int thread_seq){
int kni_maat_scan_domain(struct kni_maat_handle* handle, char *domain, int domain_len, int thread_seq, int *policy_id){
void *logger = handle->logger;
struct Maat_rule_t result[KNI_MAAT_RULE_NUM_MAX];
//必须要初始化为NULL, 不懂为什么
@@ -153,14 +210,14 @@ int kni_maat_scan_domain(struct kni_maat_handle* handle, char *domain, int domai
KNI_LOG_ERROR(logger, "Failed at Maat_full_scan_string, ret is %d", ret);
return g_maat_default_action;
}
int action = maat_process_scan_result(handle, ret, result);
int action = maat_process_scan_result(handle, ret, result, policy_id);
//for debug
char domain1[100] = "";
memcpy(domain1, domain, domain_len);
domain1[domain_len] = '\0';
KNI_LOG_DEBUG(logger, "domain is %s, ret is %d, action is %d\n", domain, ret, action);
KNI_LOG_DEBUG(logger, "maat_scan_domain: %s, policy_id = %d, action = %s\n",
domain, *policy_id, action == KNI_ACTION_BYPASS ? "bypss" : "intercept");
return action;
}