gfwleak/tango-kni
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

bugfix:适配结构体session_attribute_label名称变更和修改宏MAX_DOAMIN_LEN为MAX_DOMAIN_LEN

Browse Source
This commit is contained in:
fumingwei
2021-08-10 12:13:40 +08:00
parent 7431a6837f
commit 534a9de16d
3 changed files with 146 additions and 64 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
entry/include/kni_entry.h
View File

@@ -115,8 +115,8 @@ struct pme_info{
char stream_traceid[24]; char stream_traceid[24];
//cjson check protocol //cjson check protocol
union{ union{
char host[MAX_DOAMIN_LEN]; //http only char host[MAX_DOMAIN_LEN]; //http only
char sni[MAX_DOAMIN_LEN]; //ssl only char sni[MAX_DOMAIN_LEN]; //ssl only
}domain; }domain;
int domain_len; int domain_len;
//tfe_release = 1: tfe don't need pmeinfo //tfe_release = 1: tfe don't need pmeinfo
@@ -150,7 +150,7 @@ struct pme_info{
//for proxy tcp option //for proxy tcp option
struct proxy_tcp_option pxy_tcp_option; struct proxy_tcp_option pxy_tcp_option;
int pxy_tcp_option_is_scan; int pxy_tcp_option_is_scan;
struct _session_attribute_label_t *session_attribute_label; struct session_attribute_label *session_attribute;
}; };
struct wrapped_packet{ struct wrapped_packet{
@@ -177,7 +177,7 @@ struct kni_marsio_handle{
struct protocol_identify_result{ struct protocol_identify_result{
int protocol; int protocol;
char domain[MAX_DOAMIN_LEN]; char domain[MAX_DOMAIN_LEN];
int domain_len; int domain_len;
}; };

4
entry/src/kni_dynamic_bypass.cpp
View File

@@ -231,7 +231,7 @@ static int get_ssl_conn_info(struct pme_info *pmeinfo,struct pkt_info *pktinfo,
const char *sip=NULL, *sport=NULL, *dip=NULL, *dport=NULL; const char *sip=NULL, *sport=NULL, *dip=NULL, *dport=NULL;
char *addr_str = NULL; char *addr_str = NULL;
if(pmeinfo->session_attribute_label->ja3_fingerprint == NULL) if(pmeinfo->session_attribute->ja3_fingerprint == NULL)
{ {
KNI_LOG_DEBUG(logger, "Dynamic bypass:get stream label ja3_fingerprint is null, stream traceid = %s", pmeinfo->stream_traceid); KNI_LOG_DEBUG(logger, "Dynamic bypass:get stream label ja3_fingerprint is null, stream traceid = %s", pmeinfo->stream_traceid);
return 1; return 1;
@@ -242,7 +242,7 @@ static int get_ssl_conn_info(struct pme_info *pmeinfo,struct pkt_info *pktinfo,
ssl_feature->vlen = snprintf(ssl_feature->value, SSL_INFO_LEN, "%s:%s:%s", ssl_feature->vlen = snprintf(ssl_feature->value, SSL_INFO_LEN, "%s:%s:%s",
pmeinfo->session_attribute_label->ja3_fingerprint,sip, pmeinfo->session_attribute->ja3_fingerprint,sip,
pmeinfo->domain_len > 0 ? (char*)&(pmeinfo->domain): dip); pmeinfo->domain_len > 0 ? (char*)&(pmeinfo->domain): dip);
FREE(&addr_str); FREE(&addr_str);

198
entry/src/kni_entry.cpp
View File

@@ -304,23 +304,23 @@ int wrapped_kni_cmsg_set(struct kni_cmsg *cmsg, uint16_t type, const unsigned ch
static int session_attribute_cmsg_set(struct kni_cmsg *cmsg, struct pme_info *pmeinfo) static int session_attribute_cmsg_set(struct kni_cmsg *cmsg, struct pme_info *pmeinfo)
{ {
struct _session_attribute_label_t *session_attribute_label = pmeinfo->session_attribute_label; struct session_attribute_label *session_attribute = pmeinfo->session_attribute;
int ret = 0; int ret = 0;
char empty_arr[MAX_STR_FIELD_LEN] = {0}; char empty_arr[MAX_STR_FIELD_LEN] = {0};
do { do {
if(session_attribute_label->client_subscribe_id == NULL) if(session_attribute->client_subscribe_id == NULL)
ret = wrapped_kni_cmsg_set(cmsg,TFE_CMSG_SRC_SUB_ID, (const unsigned char*)empty_arr, strlen(empty_arr), pmeinfo); ret = wrapped_kni_cmsg_set(cmsg,TFE_CMSG_SRC_SUB_ID, (const unsigned char*)empty_arr, strlen(empty_arr), pmeinfo);
else else
ret = wrapped_kni_cmsg_set(cmsg,TFE_CMSG_SRC_SUB_ID, (const unsigned char*)session_attribute_label->client_subscribe_id->subscribe_id, strlen(session_attribute_label->client_subscribe_id->subscribe_id), pmeinfo); ret = wrapped_kni_cmsg_set(cmsg,TFE_CMSG_SRC_SUB_ID, (const unsigned char*)session_attribute->client_subscribe_id->subscribe_id, strlen(session_attribute->client_subscribe_id->subscribe_id), pmeinfo);
if(ret < 0) break; if(ret < 0) break;
if(session_attribute_label->server_subscribe_id == NULL) if(session_attribute->server_subscribe_id == NULL)
ret = wrapped_kni_cmsg_set(cmsg,TFE_CMSG_DST_SUB_ID, (const unsigned char*)empty_arr, strlen(empty_arr), pmeinfo); ret = wrapped_kni_cmsg_set(cmsg,TFE_CMSG_DST_SUB_ID, (const unsigned char*)empty_arr, strlen(empty_arr), pmeinfo);
else else
ret = wrapped_kni_cmsg_set(cmsg,TFE_CMSG_DST_SUB_ID, (const unsigned char*)session_attribute_label->server_subscribe_id->subscribe_id, strlen(session_attribute_label->server_subscribe_id->subscribe_id), pmeinfo); ret = wrapped_kni_cmsg_set(cmsg,TFE_CMSG_DST_SUB_ID, (const unsigned char*)session_attribute->server_subscribe_id->subscribe_id, strlen(session_attribute->server_subscribe_id->subscribe_id), pmeinfo);
if(ret < 0) break; if(ret < 0) break;
if(session_attribute_label->client_asn == NULL) if(session_attribute->client_asn == NULL)
{ {
ret = wrapped_kni_cmsg_set(cmsg,TFE_CMSG_SRC_ASN, (const unsigned char*)empty_arr, strlen(empty_arr), pmeinfo); ret = wrapped_kni_cmsg_set(cmsg,TFE_CMSG_SRC_ASN, (const unsigned char*)empty_arr, strlen(empty_arr), pmeinfo);
if(ret < 0) break; if(ret < 0) break;
@@ -329,13 +329,22 @@ static int session_attribute_cmsg_set(struct kni_cmsg *cmsg, struct pme_info *pm
} }
else else
{ {
ret = wrapped_kni_cmsg_set(cmsg,TFE_CMSG_SRC_ASN, (const unsigned char*)session_attribute_label->client_asn->asn, strlen(session_attribute_label->client_asn->asn), pmeinfo); if(session_attribute->client_asn->asn_id == NULL){
ret = wrapped_kni_cmsg_set(cmsg,TFE_CMSG_SRC_ASN, (const unsigned char*)empty_arr, strlen(empty_arr), pmeinfo);
}else{
ret = wrapped_kni_cmsg_set(cmsg,TFE_CMSG_SRC_ASN, (const unsigned char*)session_attribute->client_asn->asn_id, strlen(session_attribute->client_asn->asn_id), pmeinfo);
}
if(ret < 0) break; if(ret < 0) break;
ret = wrapped_kni_cmsg_set(cmsg,TFE_CMSG_SRC_ORGANIZATION, (const unsigned char*)session_attribute_label->client_asn->organization, strlen(session_attribute_label->client_asn->organization), pmeinfo); if(session_attribute->client_asn->organization){
ret = wrapped_kni_cmsg_set(cmsg,TFE_CMSG_SRC_ORGANIZATION, (const unsigned char*)empty_arr, strlen(empty_arr), pmeinfo);
}
else{
ret = wrapped_kni_cmsg_set(cmsg,TFE_CMSG_SRC_ORGANIZATION, (const unsigned char*)session_attribute->client_asn->organization, strlen(session_attribute->client_asn->organization), pmeinfo);
}
if(ret < 0) break; if(ret < 0) break;
} }
if(session_attribute_label->server_asn == NULL) if(session_attribute->server_asn == NULL)
{ {
ret = wrapped_kni_cmsg_set(cmsg,TFE_CMSG_DST_ASN, (const unsigned char*)empty_arr, strlen(empty_arr), pmeinfo); ret = wrapped_kni_cmsg_set(cmsg,TFE_CMSG_DST_ASN, (const unsigned char*)empty_arr, strlen(empty_arr), pmeinfo);
if(ret < 0) break; if(ret < 0) break;
@@ -344,13 +353,21 @@ static int session_attribute_cmsg_set(struct kni_cmsg *cmsg, struct pme_info *pm
} }
else else
{ {
ret = wrapped_kni_cmsg_set(cmsg,TFE_CMSG_DST_ASN, (const unsigned char*)session_attribute_label->server_asn->asn, strlen(session_attribute_label->server_asn->asn), pmeinfo); if(session_attribute->server_asn->asn_id == NULL){
ret = wrapped_kni_cmsg_set(cmsg,TFE_CMSG_DST_ASN, (const unsigned char*)empty_arr, strlen(empty_arr), pmeinfo);
}else{
ret = wrapped_kni_cmsg_set(cmsg,TFE_CMSG_DST_ASN, (const unsigned char*)session_attribute->server_asn->asn_id, strlen(session_attribute->server_asn->asn_id), pmeinfo);
}
if(ret < 0) break; if(ret < 0) break;
ret = wrapped_kni_cmsg_set(cmsg,TFE_CMSG_DST_ORGANIZATION, (const unsigned char*)session_attribute_label->server_asn->organization, strlen(session_attribute_label->server_asn->organization), pmeinfo); if(session_attribute->server_asn->organization == NULL){
ret = wrapped_kni_cmsg_set(cmsg,TFE_CMSG_DST_ORGANIZATION, (const unsigned char*)empty_arr, strlen(empty_arr), pmeinfo);
}else{
ret = wrapped_kni_cmsg_set(cmsg,TFE_CMSG_DST_ORGANIZATION, (const unsigned char*)session_attribute->server_asn->organization, strlen(session_attribute->server_asn->organization), pmeinfo);
}
if(ret < 0) break; if(ret < 0) break;
} }
if(session_attribute_label->client_location == NULL) if(session_attribute->client_location == NULL)
{ {
ret = wrapped_kni_cmsg_set(cmsg,TFE_CMSG_SRC_IP_LOCATION_COUNTRY, (const unsigned char*)empty_arr, strlen(empty_arr), pmeinfo); ret = wrapped_kni_cmsg_set(cmsg,TFE_CMSG_SRC_IP_LOCATION_COUNTRY, (const unsigned char*)empty_arr, strlen(empty_arr), pmeinfo);
if(ret < 0) break; if(ret < 0) break;
@@ -361,15 +378,27 @@ static int session_attribute_cmsg_set(struct kni_cmsg *cmsg, struct pme_info *pm
} }
else else
{ {
ret = wrapped_kni_cmsg_set(cmsg,TFE_CMSG_SRC_IP_LOCATION_COUNTRY, (const unsigned char*)session_attribute_label->client_location->country_full, strlen(session_attribute_label->client_location->country_full), pmeinfo); if(session_attribute->client_location->country_full == NULL){
ret = wrapped_kni_cmsg_set(cmsg,TFE_CMSG_SRC_IP_LOCATION_COUNTRY, (const unsigned char*)empty_arr, strlen(empty_arr), pmeinfo);
}else{
ret = wrapped_kni_cmsg_set(cmsg,TFE_CMSG_SRC_IP_LOCATION_COUNTRY, (const unsigned char*)session_attribute->client_location->country_full, strlen(session_attribute->client_location->country_full), pmeinfo);
}
if(ret < 0) break; if(ret < 0) break;
ret = wrapped_kni_cmsg_set(cmsg,TFE_CMSG_SRC_IP_LOCATION_PROVINE, (const unsigned char*)session_attribute_label->client_location->province_full, strlen(session_attribute_label->client_location->province_full), pmeinfo); if(session_attribute->client_location->province_full == NULL){
ret = wrapped_kni_cmsg_set(cmsg,TFE_CMSG_SRC_IP_LOCATION_PROVINE, (const unsigned char*)empty_arr, strlen(empty_arr), pmeinfo);
}else{
ret = wrapped_kni_cmsg_set(cmsg,TFE_CMSG_SRC_IP_LOCATION_PROVINE, (const unsigned char*)session_attribute->client_location->province_full, strlen(session_attribute->client_location->province_full), pmeinfo);
}
if(ret < 0) break; if(ret < 0) break;
ret = wrapped_kni_cmsg_set(cmsg,TFE_CMSG_SRC_IP_LOCATION_CITY, (const unsigned char*)session_attribute_label->client_location->city_full, strlen(session_attribute_label->client_location->city_full), pmeinfo); if(session_attribute->client_location->city_full == NULL){
ret = wrapped_kni_cmsg_set(cmsg,TFE_CMSG_SRC_IP_LOCATION_CITY, (const unsigned char*)empty_arr, strlen(empty_arr), pmeinfo);
}else{
ret = wrapped_kni_cmsg_set(cmsg,TFE_CMSG_SRC_IP_LOCATION_CITY, (const unsigned char*)session_attribute->client_location->city_full, strlen(session_attribute->client_location->city_full), pmeinfo);
}
if(ret < 0) break; if(ret < 0) break;
} }
if(session_attribute_label->server_location == NULL) if(session_attribute->server_location == NULL)
{ {
ret = wrapped_kni_cmsg_set(cmsg,TFE_CMSG_DST_IP_LOCATION_COUNTRY, (const unsigned char*)empty_arr, strlen(empty_arr), pmeinfo); ret = wrapped_kni_cmsg_set(cmsg,TFE_CMSG_DST_IP_LOCATION_COUNTRY, (const unsigned char*)empty_arr, strlen(empty_arr), pmeinfo);
if(ret < 0) break; if(ret < 0) break;
@@ -380,32 +409,44 @@ static int session_attribute_cmsg_set(struct kni_cmsg *cmsg, struct pme_info *pm
} }
else else
{ {
ret = wrapped_kni_cmsg_set(cmsg,TFE_CMSG_DST_IP_LOCATION_COUNTRY, (const unsigned char*)session_attribute_label->server_location->country_full, strlen(session_attribute_label->server_location->country_full), pmeinfo); if(session_attribute->server_location->country_full == NULL){
ret = wrapped_kni_cmsg_set(cmsg,TFE_CMSG_DST_IP_LOCATION_COUNTRY, (const unsigned char*)empty_arr, strlen(empty_arr), pmeinfo);
}else{
ret = wrapped_kni_cmsg_set(cmsg,TFE_CMSG_DST_IP_LOCATION_COUNTRY, (const unsigned char*)session_attribute->server_location->country_full, strlen(session_attribute->server_location->country_full), pmeinfo);
}
if(ret < 0) break; if(ret < 0) break;
ret = wrapped_kni_cmsg_set(cmsg,TFE_CMSG_DST_IP_LOCATION_PROVINE, (const unsigned char*)session_attribute_label->server_location->province_full, strlen(session_attribute_label->server_location->province_full), pmeinfo); if(session_attribute->server_location->province_full == NULL){
ret = wrapped_kni_cmsg_set(cmsg,TFE_CMSG_DST_IP_LOCATION_PROVINE, (const unsigned char*)empty_arr, strlen(empty_arr), pmeinfo);
}else{
ret = wrapped_kni_cmsg_set(cmsg,TFE_CMSG_DST_IP_LOCATION_PROVINE, (const unsigned char*)session_attribute->server_location->province_full, strlen(session_attribute->server_location->province_full), pmeinfo);
}
if(ret < 0) break; if(ret < 0) break;
ret = wrapped_kni_cmsg_set(cmsg,TFE_CMSG_DST_IP_LOCATION_CITY, (const unsigned char*)session_attribute_label->server_location->city_full, strlen(session_attribute_label->server_location->city_full), pmeinfo); if(session_attribute->server_location->city_full == NULL){
ret = wrapped_kni_cmsg_set(cmsg,TFE_CMSG_DST_IP_LOCATION_CITY, (const unsigned char*)empty_arr, strlen(empty_arr), pmeinfo);
}else{
ret = wrapped_kni_cmsg_set(cmsg,TFE_CMSG_DST_IP_LOCATION_CITY, (const unsigned char*)session_attribute->server_location->city_full, strlen(session_attribute->server_location->city_full), pmeinfo);
}
if(ret < 0) break; if(ret < 0) break;
} }
if(session_attribute_label->ja3_fingerprint == NULL) if(session_attribute->ja3_fingerprint == NULL)
ret = wrapped_kni_cmsg_set(cmsg,TFE_CMSG_SSL_CLIENT_JA3_FINGERPRINT, (const unsigned char*)empty_arr, strlen(empty_arr), pmeinfo); ret = wrapped_kni_cmsg_set(cmsg,TFE_CMSG_SSL_CLIENT_JA3_FINGERPRINT, (const unsigned char*)empty_arr, strlen(empty_arr), pmeinfo);
else else
ret = wrapped_kni_cmsg_set(cmsg,TFE_CMSG_SSL_CLIENT_JA3_FINGERPRINT, (const unsigned char*)session_attribute_label->ja3_fingerprint, strlen(session_attribute_label->ja3_fingerprint), pmeinfo); ret = wrapped_kni_cmsg_set(cmsg,TFE_CMSG_SSL_CLIENT_JA3_FINGERPRINT, (const unsigned char*)session_attribute->ja3_fingerprint, strlen(session_attribute->ja3_fingerprint), pmeinfo);
ret = wrapped_kni_cmsg_set(cmsg,TFE_CMSG_FQDN_CAT_ID_NUM, (const unsigned char*)&(session_attribute_label->fqdn_category_id_num), sizeof(unsigned int), pmeinfo); ret = wrapped_kni_cmsg_set(cmsg,TFE_CMSG_FQDN_CAT_ID_NUM, (const unsigned char*)&(session_attribute->fqdn_category_id_num), sizeof(unsigned int), pmeinfo);
if(session_attribute_label->fqdn_category_id_num <= 0 || session_attribute_label->fqdn_category_id_num > 8) if(session_attribute->fqdn_category_id_num <= 0 || session_attribute->fqdn_category_id_num > 8)
{ {
ret = wrapped_kni_cmsg_set(cmsg,TFE_CMSG_FQDN_CAT_ID_VAL, (const unsigned char*)empty_arr, strlen(empty_arr), pmeinfo); ret = wrapped_kni_cmsg_set(cmsg,TFE_CMSG_FQDN_CAT_ID_VAL, (const unsigned char*)empty_arr, strlen(empty_arr), pmeinfo);
} }
else else
{ {
char fqdn_val[sizeof(session_attribute_label->fqdn_category_id)] = {0}; char fqdn_val[sizeof(session_attribute->fqdn_category_id)] = {0};
for(int i = 0 ; i < session_attribute_label->fqdn_category_id_num; i ++) for(int i = 0 ; i < session_attribute->fqdn_category_id_num; i ++)
{ {
memcpy((void *)(fqdn_val + i * (sizeof(unsigned int))), (void *)&(session_attribute_label->fqdn_category_id[i]), sizeof(unsigned int)); memcpy((void *)(fqdn_val + i * (sizeof(unsigned int))), (void *)&(session_attribute->fqdn_category_id[i]), sizeof(unsigned int));
} }
ret = wrapped_kni_cmsg_set(cmsg,TFE_CMSG_FQDN_CAT_ID_VAL, (const unsigned char*)fqdn_val,session_attribute_label->fqdn_category_id_num *sizeof(unsigned int) , pmeinfo); ret = wrapped_kni_cmsg_set(cmsg,TFE_CMSG_FQDN_CAT_ID_VAL, (const unsigned char*)fqdn_val,session_attribute->fqdn_category_id_num *sizeof(unsigned int) , pmeinfo);
} }
}while(0); }while(0);
@@ -995,73 +1036,114 @@ static int dabloom_add(struct pkt_info *pktinfo, int thread_seq){
static struct _session_attribute_label_t * kni_pull_session_attribute_results(struct streaminfo *a_stream,struct pme_info *pmeinfo) static struct session_attribute_label * kni_pull_session_attribute_results(struct streaminfo *a_stream,struct pme_info *pmeinfo)
{ {
struct _session_attribute_label_t *session_attribute_label = NULL; struct session_attribute_label *session_attribute = NULL;
void *logger = g_kni_handle->local_logger; void *logger = g_kni_handle->local_logger;
session_attribute_label = (struct _session_attribute_label_t *)project_req_get_struct(a_stream, g_kni_handle->session_attribute_id); session_attribute = (struct session_attribute_label *)project_req_get_struct(a_stream, g_kni_handle->session_attribute_id);
if(session_attribute_label != NULL) if(session_attribute != NULL)
{ {
KNI_LOG_DEBUG(logger, "share-session-attribute: Success to get the session attribute results,stream traceid = %s", pmeinfo->stream_traceid); KNI_LOG_DEBUG(logger, "share-session-attribute: Success to get the session attribute results,stream traceid = %s", pmeinfo->stream_traceid);
if(session_attribute_label->client_subscribe_id == NULL) if(session_attribute->client_subscribe_id == NULL)
KNI_LOG_DEBUG(logger, "share-session-attribute: source subscribe id is NULL,stream traceid = %s",pmeinfo->stream_traceid); KNI_LOG_DEBUG(logger, "share-session-attribute: source subscribe id is NULL,stream traceid = %s",pmeinfo->stream_traceid);
else else
KNI_LOG_DEBUG(logger, "share-session-attribute: source subscribe id is: %s,stream traceid = %s",session_attribute_label->client_subscribe_id->subscribe_id,pmeinfo->stream_traceid); KNI_LOG_DEBUG(logger, "share-session-attribute: source subscribe id is: %s,stream traceid = %s",session_attribute->client_subscribe_id->subscribe_id,pmeinfo->stream_traceid);
if(session_attribute_label->server_subscribe_id == NULL) if(session_attribute->server_subscribe_id == NULL)
KNI_LOG_DEBUG(logger, "share-session-attribute: destination subscribe id is NULL,stream traceid = %s",pmeinfo->stream_traceid); KNI_LOG_DEBUG(logger, "share-session-attribute: destination subscribe id is NULL,stream traceid = %s",pmeinfo->stream_traceid);
else else
KNI_LOG_DEBUG(logger, "share-session-attribute: destination subscribe id is: %s,stream traceid = %s",session_attribute_label->server_subscribe_id->subscribe_id,pmeinfo->stream_traceid); KNI_LOG_DEBUG(logger, "share-session-attribute: destination subscribe id is: %s,stream traceid = %s",session_attribute->server_subscribe_id->subscribe_id,pmeinfo->stream_traceid);
if(session_attribute_label->client_asn == NULL) if(session_attribute->client_asn == NULL)
KNI_LOG_DEBUG(logger, "share-session-attribute: source asn and organization is NULL,stream traceid = %s",pmeinfo->stream_traceid); KNI_LOG_DEBUG(logger, "share-session-attribute: source asn and organization is NULL,stream traceid = %s",pmeinfo->stream_traceid);
else else
{ {
KNI_LOG_DEBUG(logger, "share-session-attribute: source asn is: %s,stream traceid = %s",session_attribute_label->client_asn->asn, pmeinfo->stream_traceid); if(session_attribute->client_asn->asn_id == NULL){
KNI_LOG_DEBUG(logger, "share-session-attribute: source organization is: %s,stream traceid = %s",session_attribute_label->client_asn->organization, pmeinfo->stream_traceid); KNI_LOG_DEBUG(logger, "share-session-attribute: source asn is NULL,stream traceid = %s", pmeinfo->stream_traceid);
}else{
KNI_LOG_DEBUG(logger, "share-session-attribute: source asn is: %s,stream traceid = %s",session_attribute->client_asn->asn_id, pmeinfo->stream_traceid);
}
if(session_attribute->client_asn->organization == NULL){
KNI_LOG_DEBUG(logger, "share-session-attribute: source organization is: NULL,stream traceid = %s",pmeinfo->stream_traceid);
}else{
KNI_LOG_DEBUG(logger, "share-session-attribute: source organization is: %s,stream traceid = %s",session_attribute->client_asn->organization, pmeinfo->stream_traceid);
}
} }
if(session_attribute_label->server_asn == NULL) if(session_attribute->server_asn == NULL)
KNI_LOG_DEBUG(logger, "share-session-attribute: destination asn and organization is NULL,stream traceid = %s",pmeinfo->stream_traceid); KNI_LOG_DEBUG(logger, "share-session-attribute: destination asn and organization is NULL,stream traceid = %s",pmeinfo->stream_traceid);
else else
{ {
KNI_LOG_DEBUG(logger, "share-session-attribute: destination asn:%s,stream traceid = %s",session_attribute_label->server_asn->asn,pmeinfo->stream_traceid); if(session_attribute->server_asn->asn_id == NULL){
KNI_LOG_DEBUG(logger, "share-session-attribute: destination organization:%s,stream traceid = %s",session_attribute_label->server_asn->organization,pmeinfo->stream_traceid); KNI_LOG_DEBUG(logger, "share-session-attribute: destination asn: NULL,stream traceid = %s",pmeinfo->stream_traceid);
}else{
KNI_LOG_DEBUG(logger, "share-session-attribute: destination asn:%s,stream traceid = %s",session_attribute->server_asn->asn_id,pmeinfo->stream_traceid);
}
if(session_attribute->server_asn->organization == NULL){
KNI_LOG_DEBUG(logger, "share-session-attribute: destination organization NULL,stream traceid = %s",pmeinfo->stream_traceid);
}else{
KNI_LOG_DEBUG(logger, "share-session-attribute: destination organization:%s,stream traceid = %s",session_attribute->server_asn->organization,pmeinfo->stream_traceid);
}
} }
if(session_attribute_label->client_location == NULL) if(session_attribute->client_location == NULL)
KNI_LOG_DEBUG(logger, "share-session-attribute: source ip location is NULL,stream traceid = %s",pmeinfo->stream_traceid); KNI_LOG_DEBUG(logger, "share-session-attribute: source ip location is NULL,stream traceid = %s",pmeinfo->stream_traceid);
else else
{ {
KNI_LOG_DEBUG(logger, "share-session-attribute: source ip location country is: %s,stream traceid = %s",session_attribute_label->client_location->country_full,pmeinfo->stream_traceid); if(session_attribute->client_location->country_full == NULL){
KNI_LOG_DEBUG(logger, "share-session-attribute: source ip location province is: %s,stream traceid = %s",session_attribute_label->client_location->province_full,pmeinfo->stream_traceid); KNI_LOG_DEBUG(logger, "share-session-attribute: source ip location country is NULL,stream traceid = %s",pmeinfo->stream_traceid);
KNI_LOG_DEBUG(logger, "share-session-attribute: source ip location city is: %s,stream traceid = %s",session_attribute_label->client_location->city_full,pmeinfo->stream_traceid); }else{
KNI_LOG_DEBUG(logger, "share-session-attribute: source ip location country is: %s,stream traceid = %s",session_attribute->client_location->country_full,pmeinfo->stream_traceid);
}
if(session_attribute->client_location->province_full == NULL){
KNI_LOG_DEBUG(logger, "share-session-attribute: source ip location province is NULL,stream traceid = %s",pmeinfo->stream_traceid);
}
else{
KNI_LOG_DEBUG(logger, "share-session-attribute: source ip location province is: %s,stream traceid = %s",session_attribute->client_location->province_full,pmeinfo->stream_traceid);
}
if(session_attribute->client_location->city_full == NULL){
KNI_LOG_DEBUG(logger, "share-session-attribute: source ip location city is NULL,stream traceid = %s",pmeinfo->stream_traceid);
}else{
KNI_LOG_DEBUG(logger, "share-session-attribute: source ip location city is: %s,stream traceid = %s",session_attribute->client_location->city_full,pmeinfo->stream_traceid);
}
} }
if(session_attribute_label->server_location == NULL) if(session_attribute->server_location == NULL)
KNI_LOG_DEBUG(logger, "share-session-attribute: destination ip location is NULL,stream traceid = %s",pmeinfo->stream_traceid); KNI_LOG_DEBUG(logger, "share-session-attribute: destination ip location is NULL,stream traceid = %s",pmeinfo->stream_traceid);
else else
{ {
KNI_LOG_DEBUG(logger, "share-session-attribute: destination ip location country is: %s,stream traceid = %s",session_attribute_label->server_location->country_full,pmeinfo->stream_traceid); if(session_attribute->server_location->country_full == NULL){
KNI_LOG_DEBUG(logger, "share-session-attribute: destination ip location province is: %s,stream traceid = %s",session_attribute_label->server_location->province_full,pmeinfo->stream_traceid); KNI_LOG_DEBUG(logger, "share-session-attribute: destination ip location country is NULL,stream traceid = %s",pmeinfo->stream_traceid);
KNI_LOG_DEBUG(logger, "share-session-attribute: destination ip location city is: %s,stream traceid = %s",session_attribute_label->server_location->city_full,pmeinfo->stream_traceid); }else{
KNI_LOG_DEBUG(logger, "share-session-attribute: destination ip location country is: %s,stream traceid = %s",session_attribute->server_location->country_full,pmeinfo->stream_traceid);
} }
if(session_attribute_label->ja3_fingerprint == NULL) if(session_attribute->server_location->province_full,pmeinfo->stream_traceid == NULL){
KNI_LOG_DEBUG(logger, "share-session-attribute: destination ip location province is NULL,stream traceid = %s",pmeinfo->stream_traceid);
}else{
KNI_LOG_DEBUG(logger, "share-session-attribute: destination ip location province is: %s,stream traceid = %s",session_attribute->server_location->province_full,pmeinfo->stream_traceid);
}
if(session_attribute->server_location->city_full == NULL){
KNI_LOG_DEBUG(logger, "share-session-attribute: destination ip location city is NULL,stream traceid = %s",pmeinfo->stream_traceid);
}else{
KNI_LOG_DEBUG(logger, "share-session-attribute: destination ip location city is: %s,stream traceid = %s",session_attribute->server_location->city_full,pmeinfo->stream_traceid);
}
}
if(session_attribute->ja3_fingerprint == NULL)
KNI_LOG_DEBUG(logger, "share-session-attribute: ja3_fingerprint is NULL,stream traceid = %s",pmeinfo->stream_traceid); KNI_LOG_DEBUG(logger, "share-session-attribute: ja3_fingerprint is NULL,stream traceid = %s",pmeinfo->stream_traceid);
else else
KNI_LOG_DEBUG(logger, "share-session-attribute: ja3_fingerprint is %s,stream traceid = %s",session_attribute_label->ja3_fingerprint,pmeinfo->stream_traceid); KNI_LOG_DEBUG(logger, "share-session-attribute: ja3_fingerprint is %s,stream traceid = %s",session_attribute->ja3_fingerprint,pmeinfo->stream_traceid);
if(session_attribute_label->fqdn_category_id_num < 0 || session_attribute_label->fqdn_category_id_num > 8) if(session_attribute->fqdn_category_id_num < 0 || session_attribute->fqdn_category_id_num > 8)
{ {
KNI_LOG_DEBUG(logger, "share-session-attribute: fqdn_category_id_num out of range( 0 <= value <= 8), value = %d,stream traceid = %s",session_attribute_label->fqdn_category_id_num,pmeinfo->stream_traceid); KNI_LOG_DEBUG(logger, "share-session-attribute: fqdn_category_id_num out of range( 0 <= value <= 8), value = %d,stream traceid = %s",session_attribute->fqdn_category_id_num,pmeinfo->stream_traceid);
} }
else else
{ {
for(int i= 0; i < session_attribute_label->fqdn_category_id_num; i ++) for(int i= 0; i < session_attribute->fqdn_category_id_num; i ++)
{ {
KNI_LOG_DEBUG(logger, "share-session-attribute: fqdn_category_id[%d] = %u,stream traceid = %s",i,session_attribute_label->fqdn_category_id[i],pmeinfo->stream_traceid); KNI_LOG_DEBUG(logger, "share-session-attribute: fqdn_category_id[%d] = %u,stream traceid = %s",i,session_attribute->fqdn_category_id[i],pmeinfo->stream_traceid);
} }
} }
@@ -1071,7 +1153,7 @@ static struct _session_attribute_label_t * kni_pull_session_attribute_results(st
KNI_LOG_ERROR(logger, "share-session-attribute: Failed to get the session attribute results,stream traceid = %s", pmeinfo->stream_traceid); KNI_LOG_ERROR(logger, "share-session-attribute: Failed to get the session attribute results,stream traceid = %s", pmeinfo->stream_traceid);
} }
return session_attribute_label; return session_attribute;
} }
@@ -1248,7 +1330,7 @@ static int first_data_intercept(struct streaminfo *stream, struct pme_info *pmei
} }
// //
if(pmeinfo->session_attribute_label == NULL) if(pmeinfo->session_attribute == NULL)
{ {
KNI_LOG_DEBUG(g_kni_handle->local_logger, "Intercept error: Get share session attribute error,stream traceid = %s", pmeinfo->stream_traceid); KNI_LOG_DEBUG(g_kni_handle->local_logger, "Intercept error: Get share session attribute error,stream traceid = %s", pmeinfo->stream_traceid);
goto error_out; goto error_out;
@@ -1486,7 +1568,7 @@ char first_data_process(struct streaminfo *stream, struct pme_info *pmeinfo, str
pmeinfo->do_log = pmeinfo->maat_result.do_log; pmeinfo->do_log = pmeinfo->maat_result.do_log;
pmeinfo->thread_seq = thread_seq; pmeinfo->thread_seq = thread_seq;
pmeinfo->is_dynamic_bypass = 0; pmeinfo->is_dynamic_bypass = 0;
pmeinfo->session_attribute_label = kni_pull_session_attribute_results(stream,pmeinfo); pmeinfo->session_attribute = kni_pull_session_attribute_results(stream,pmeinfo);
maat_hit = 1; maat_hit = 1;
char *action_str = kni_maat_action_trans(pmeinfo->action); char *action_str = kni_maat_action_trans(pmeinfo->action);
KNI_LOG_INFO(logger, "intercept_policy_scan: %s, %s, maat_hit = %d, policy_id = %d, action = %d(%s), stream traceid = %s", KNI_LOG_INFO(logger, "intercept_policy_scan: %s, %s, maat_hit = %d, policy_id = %d, action = %d(%s), stream traceid = %s",