完成polling接口改造和重复流量识别功能

common/CMakeLists.txt

@@ -11,3 +11,8 @@ target_link_libraries(test_cmsg PRIVATE common)
 add_executable(test_uuid test/test_uuid.cpp)
 target_include_directories(test_uuid PRIVATE include)
 target_link_libraries(test_uuid PRIVATE uuid common)
+
+### test_dabloom
+add_executable(test_dabloom test/test_dabloom.cpp)
+target_include_directories(test_dabloom PRIVATE include)
+target_link_libraries(test_dabloom PRIVATE dabloom common)

common/include/kni_utils.h

@@ -20,6 +20,7 @@
 #define	KNI_PATH_MAX			256
 #define KNI_SYMBOL_MAX			64
 #define KNI_DOMAIN_MAX 			256
+#define KNI_ADDR_MAX            128
 
 #ifndef MAX
 #define MAX(a, b)  	(((a) > (b)) ? (a) : (b))
@@ -57,19 +58,26 @@ struct kni_tcpopt_info{
 	uint16_t mss;
 	uint8_t wscale_set;
 	uint8_t wscale;
-	uint8_t ts;
+	uint8_t ts_set;
 	uint8_t sack;
+	uint32_t ts_value;
 };
 
 //field_stat
-#define KNI_FIELD_MAX  64
+#define KNI_FS_FIELD_MAX    64
+#define KNI_FS_COLUMN_MAX   256
+#define KNI_FS_LINE_MAX     256
 enum kni_field{
 	KNI_FIELD_INTCP_STM,
 	KNI_FIELD_BYP_STM,
-	KNI_FIELD_POLICY_BYP,
+	KNI_FIELD_BYP_STM_POLICY,
-	KNI_FIELD_PME_NEW_FAIL,
+	KNI_FIELD_BYP_STM_PME_NEW_FAIL,
-	KNI_FIELD_NO_TFE,
+	KNI_FIELD_BYP_STM_NO_TFE,
+	KNI_FIELD_BYP_STM_ERR,
+	KNI_FIELD_BYP_STM_DUP_TFC,
 	KNI_FIELD_STATE_UNKNOWN,
+	KNI_FIELD_DUP_TFC_STM,
+	//stream error
 	KNI_FIELD_STM_ERR,
 	KNI_FIELD_NO_SYN,
 	KNI_FIELD_SINGLE_DIR,
@@ -77,10 +85,9 @@ enum kni_field{
 	KNI_FIELD_NO_SA,
 	KNI_FIELD_ACTION_INVALID,
 	KNI_FIELD_NO_DATA,
-	KNI_FIELD_IPV4HDR_PARSE_FAIL,
+	KNI_FIELD_IPHDR_PARSE_FAIL,
-	KNI_FIELD_IPV6HDR_PARSE_FAIL,
-	KNI_FIELD_KA_ADD_FAIL,
 	KNI_FIELD_EXCEED_MTU,
+	KNI_FIELD_STMERR_TUPLE2STM_ADD_FAIL,
 	KNI_FIELD_SENDTO_TFE_FAIL,
 	//others
 	KNI_FIELD_NULL_PKT,
@@ -92,27 +99,43 @@ enum kni_field{
 	KNI_FIELD_SENDLOG_FAIL,
 	KNI_FIELD_PME_NEW_SUCC,
 	KNI_FIELD_PME_FREE,
+	KNI_FIELD_IPV4HDR_PARSE_FAIL,
+	KNI_FIELD_IPV6HDR_PARSE_FAIL,
 	KNI_FIELD_ID2PME_ADD_SUCC,
 	KNI_FIELD_ID2PME_ADD_FAIL,
 	KNI_FIELD_ID2PME_DEL_SUCC,
 	KNI_FIELD_ID2PME_DEL_FAIL,
-	KNI_FIELD_KEEPALIVE_REPLAY_ADD_SUCC,
+	KNI_FIELD_TUPLE2STM_ADD_SUCC,
-	KNI_FIELD_KEEPALIVE_REPLAY_DEL_SUCC,
+	KNI_FIELD_TUPLE2STM_ADD_FAIL,
-	KNI_FIELD_KEEPALIVE_REPLAY_DEL_FAIL,
+	KNI_FIELD_TUPLE2STM_DEL_SUCC,
+	KNI_FIELD_TUPLE2STM_DEL_FAIL,
 	KNI_FIELD_KNI_INTCP_BYTES,
 	KNI_FIELD_TFE_INTCP_BYTES,
 	KNI_FIELD_KNI_INTCP_STM,
 	KNI_FIELD_TFE_INTCP_STM,
+	KNI_FIELD_TUPLE2STM_SEARCH_SUCC,
+	KNI_FIELD_TUPLE2STM_SEARCH_FAIL,
+	KNI_FIELD_SAPP_INJECT_SUCC,
+	KNI_FIELD_SAPP_INJECT_FAIL,
+	KNI_FIELD_BLOOM_SEARCH_SUCC,
+	KNI_FIELD_BLOOM_SEARCH_FAIL,
+	KNI_FIELD_BLOOM_ADD_SUCC,
+	KNI_FIELD_BLOOM_ADD_FAIL,
 	//KNI_FIELD_TFE_STATUS_BASE must be last 
 	KNI_FIELD_TFE_STATUS_BASE,
 };
 
 struct kni_field_stat_handle{
 	screen_stat_handle_t handle;
-	int fields[KNI_FIELD_MAX];
+	int fields[KNI_FS_FIELD_MAX];
+	int column_ids[KNI_FS_COLUMN_MAX];
+	int line_ids[KNI_FS_LINE_MAX];
+	int column_cnt;
+	int line_cnt;
 };
 
 struct pkt_info{
+	addr_type_t addr_type;
 	union{
 		struct iphdr *v4;
 		struct ip6_hdr *v6;
@@ -135,7 +158,8 @@ enum kni_ipv6hdr_parse_error{
 	KNI_IPV6HDR_PARSE_ERROR_INVALID_TYPE = -3,
 };
 
-int kni_stream_addr_trans(const struct layer_addr *addr, addr_type_t addr_type, char *output, int len);
+int kni_addr_trans_v4(struct stream_tuple4_v4 *tuple4, char *output, int len);
+int kni_addr_trans_v6(struct stream_tuple4_v6 *tuple4, char *output, int len);
 uint16_t kni_ip_checksum(const void *buf, size_t hdr_len);
 uint16_t kni_tcp_checksum(const void *_buf, size_t len, in_addr_t src_addr, in_addr_t dest_addr);
 uint16_t kni_tcp_checksum_v6(const void *_buf, size_t len, struct in6_addr src_addr, struct in6_addr dest_addr);

common/src/kni_utils.cpp

@@ -3,22 +3,24 @@
 #include <netinet/ip6.h>
 #include <net/if.h>
 
-int kni_stream_addr_trans(const struct layer_addr *addr, addr_type_t addr_type, char *output, int len){
+int kni_addr_trans_v4(struct stream_tuple4_v4 *tuple4, char *output, int len){
+	char saddr[INET_ADDRSTRLEN];
+	char daddr[INET_ADDRSTRLEN];
+	inet_ntop(AF_INET, &(tuple4->saddr), saddr, INET_ADDRSTRLEN);
+	inet_ntop(AF_INET, &(tuple4->daddr), daddr, INET_ADDRSTRLEN);
+	uint16_t source = ntohs(tuple4->source);
+	uint16_t dest = ntohs(tuple4->dest);
+	snprintf(output, len, "%s:%d -> %s:%d", saddr, source, daddr, dest);
+	return 0;
+}
+
+int kni_addr_trans_v6(struct stream_tuple4_v6 *tuple4, char *output, int len){
 	char saddr[INET6_ADDRSTRLEN];
 	char daddr[INET6_ADDRSTRLEN];
-	uint16_t source, dest;
+	inet_ntop(AF_INET6, tuple4->saddr, saddr, INET6_ADDRSTRLEN);
-	if(addr_type == ADDR_TYPE_IPV6){
+	inet_ntop(AF_INET6, tuple4->daddr, daddr, INET6_ADDRSTRLEN);
-		inet_ntop(AF_INET6, &(addr->tuple4_v6->saddr), saddr, INET6_ADDRSTRLEN);
+	uint16_t source = ntohs(tuple4->source);
-		inet_ntop(AF_INET6, &(addr->tuple4_v6->daddr), daddr, INET6_ADDRSTRLEN);
+	uint16_t dest = ntohs(tuple4->dest);
-		source = ntohs(addr->tuple4_v6->source);
-		dest = ntohs(addr->tuple4_v6->dest);
-	}
-	else{
-		inet_ntop(AF_INET, &(addr->tuple4_v4->saddr), saddr, INET6_ADDRSTRLEN);
-		inet_ntop(AF_INET, &(addr->tuple4_v4->daddr), daddr, INET6_ADDRSTRLEN);
-		source = ntohs(addr->tuple4_v4->source);
-		dest = ntohs(addr->tuple4_v4->dest);
-	}
 	snprintf(output, len, "%s:%d -> %s:%d", saddr, source, daddr, dest);
 	return 0;
 }
@@ -195,7 +197,8 @@ struct kni_tcpopt_info* kni_get_tcpopt(struct tcphdr* tcphdr,int tcphdr_len){
                         break;
                     case TCPOPT_TIMESTAMP:
                         if ((opsize == TCPOLEN_TIMESTAMP)){
-                            tcpopt->ts = 1;
+                            tcpopt->ts_set = 1;
+							tcpopt->ts_value = *(uint32_t*)ptr;
                         }
                         break;
                     case TCPOPT_SACK_PERMITTED:
@@ -333,6 +336,7 @@ int kni_ipv4_header_parse(const void *a_packet, struct pkt_info *pktinfo){
 	if(a_packet == NULL){
 		return KNI_IPV4HDR_PARSE_ERROR_NULL_PACKET;
 	}
+	pktinfo->addr_type = ADDR_TYPE_IPV4;
 	pktinfo->iphdr.v4 = (struct iphdr*)a_packet;
 	pktinfo->iphdr_len = pktinfo->iphdr.v4->ihl * 4;
 	pktinfo->ip_totlen = ntohs(pktinfo->iphdr.v4->tot_len);
@@ -347,6 +351,7 @@ int kni_ipv6_header_parse(const void *a_packet, struct pkt_info *pktinfo){
 	if(a_packet == NULL){
 		return KNI_IPV6HDR_PARSE_ERROR_NULL_PACKET;
 	}
+	pktinfo->addr_type = ADDR_TYPE_IPV6;
 	pktinfo->iphdr.v6 = (struct ip6_hdr*)a_packet;
 	pktinfo->ip_totlen = ntohs(pktinfo->iphdr.v6->ip6_ctlun.ip6_un1.ip6_un1_plen) + sizeof(struct ip6_hdr);
 	uint8_t next_hdr_type = pktinfo->iphdr.v6->ip6_ctlun.ip6_un1.ip6_un1_nxt;

common/test/test_dabloom.cpp

@@ -0,0 +1,10 @@
+#include <stdio.h>
+#include <stdlib.h>
+extern "C" {
+    #include "dablooms.h"
+}
+
+
+int main(int argc, char *argv[]){
+    
+}

conf/kni.conf

@@ -2,36 +2,33 @@
 log_path = ./log/kni/kni.log
 log_level = 10
 tfe_node_count = 3
-tfe_data_recv_thread_num = 8
+manage_eth = enp7s0
-manage_eth = eth0
-#keepalive_replay: window update replay
-keepalive_replay_switch = 1
 
 [tfe0]
 enabled = 1
 mac_addr = fe:65:b7:03:50:bd
-dev_eth_symbol = eth7
+dev_eth_symbol = ens1f5
-ip_addr = 192.168.10.38
+ip_addr = 192.168.100.2
 
 [tfe1]
 enabled = 1
 mac_addr = fe:65:b7:03:50:bd
-dev_eth_symbol = eth8
+dev_eth_symbol = ens1f6
-ip_addr = 192.168.10.39
+ip_addr = 192.168.100.3
 
 [tfe2]
 enabled = 1
 mac_addr = fe:65:b7:03:50:bd
-dev_eth_symbol = eth9
+dev_eth_symbol = ens1f7
-ip_addr = 192.168.10.40
+ip_addr = 192.168.100.4
 
 [tfe_cmsg_receiver]
-listen_eth = eth0
+listen_eth = ens1.100
 listen_port = 2475
 
 [watch_dog]
 switch = 1
-listen_eth = eth0
+listen_eth = ens1.100
 listen_port = 2476
 keepalive_idle = 2
 keepalive_intvl = 1
@@ -39,12 +36,12 @@ keepalive_cnt = 3
 
 [maat]
 #readconf_mode: 0 = iris, 1 = json, 2 = redis
-readconf_mode = 1
+readconf_mode = 2
-tableinfo_path = ./conf/kni/maat_tableinfo.conf
+tableinfo_path = ./etc/kni/maat_tableinfo.conf
-maatjson_path = ./conf/kni/maat_test.json
+maatjson_path = ./etc/kni/maat_test.json
-redis_ip = 192.168.10.120
+redis_ip = 192.168.10.31
-redis_port = 6390
+redis_port = 6379
-redis_index = 4
+redis_index = 0
 tablename_intercept_ip = PXY_INTERCEPT_IP
 tablename_intercept_domain = PXY_INTERCEPT_DOMAIN
 #default_action: 0x80 = bypass, 0x02 = intercept
@@ -53,11 +50,11 @@ default_action = 128
 [send_logger]
 switch = 0
 kafka_topic = SESSION-RECORD-LOG
-kafka_brokerlist = 192.168.10.119:9092,192.168.10.122:9092,192.168.10.123:9092
+#kafka_brokerlist = 192.168.10.119:9092,192.168.10.122:9092,192.168.10.123:9092
+kafka_brokerlist = 192.168.10.52:9092
 
 [marsio]
 appsym = knifw
-dev_vxlan_symbol = vxlan_user
 src_mac_addr = 00:0e:c6:d6:72:c1
 
 [kafka]
@@ -65,6 +62,14 @@ queue.buffering.max.messages = 1000000
 topic.metadata.refresh.interval.ms = 600000
 security.protocol = MG
 
+#128:bypass, 2: intercept
+[dup_traffic]
+switch = 0
+action = 2
+capacity = 1000000
+error_rate = 0.05
+expiry_time = 30
+
 [traceid2pme_htable]
 mho_screen_print_ctrl = 0
 mho_thread_safe = 1
@@ -74,15 +79,12 @@ mho_hash_max_element_num = 640000
 mho_expire_time = 30
 mho_eliminate_type = LRU
 
-[keepalive_replay_htable]
+[tuple2stream_htable]
 mho_screen_print_ctrl = 0
-mho_thread_safe = 1
+mho_thread_safe = 0
 mho_mutex_num = 160
 mho_hash_slot_size = 160000
 mho_hash_max_element_num = 640000
-#must be 0
-mho_expire_time = 0
-mho_eliminate_type = LRU
 
 [field_stat]
 stat_path = ./fs2_kni.status

conf/sapp/kni/kni.inf

@@ -11,3 +11,7 @@ FUNC_NAME = kni_tcpall_entry
 [HTTP]
 FUNC_FLAG = HTTP_HOST 
 FUNC_NAME = kni_http_entry 
+
+[POLLING]
+FUNC_FLAG=ALL
+FUNC_NAME=kni_polling_all_entry

entry/CMakeLists.txt

@@ -1,3 +1,3 @@
 add_library(kni SHARED src/kni_entry.cpp src/kni_maat.cpp src/kni_send_logger.cpp src/tfe_mgr.cpp)
 target_include_directories(kni PUBLIC ${CMAKE_CURRENT_LIST_DIR}/include)
-target_link_libraries(kni common MESA_prof_load MESA_htable MESA_field_stat maatframe marsio uuid cjson rdkafka)
+target_link_libraries(kni common MESA_prof_load MESA_htable MESA_field_stat maatframe marsio uuid cjson rdkafka dabloom)

entry/include/kni_maat.h

@@ -25,7 +25,7 @@ enum kni_action{
 	KNI_ACTION_BYPASS = 0x80
 };
 
-struct kni_maat_handle* kni_maat_init(const char* profile, void *logger);
+struct kni_maat_handle* kni_maat_init(const char* profile, void *logger, int thread_count);
 void kni_maat_destroy(struct kni_maat_handle *handle);
 enum kni_action intercept_policy_scan(struct kni_maat_handle* handle, struct ipaddr *addr, char *domain, int domain_len, 
 		int thread_seq, int *policy_id, int *do_log, int *is_hit_policy);

entry/src/kni_maat.cpp

@@ -1,8 +1,6 @@
 #include "kni_utils.h"
 #include "kni_maat.h"
 
-extern int g_iThreadNum;
-
 
 /* default action: 
 	1. read kni.conf
@@ -62,7 +60,7 @@ void compile_ex_param_dup(int idx,	MAAT_RULE_EX_DATA *to, MAAT_RULE_EX_DATA *fro
 	return;
 }
 
-struct kni_maat_handle* kni_maat_init(const char* profile, void *logger){
+struct kni_maat_handle* kni_maat_init(const char* profile, void *logger, int thread_count){
 	const char *section = "maat";
 	int readconf_mode;
 	char tableinfo_path[KNI_PATH_MAX];
@@ -105,11 +103,11 @@ struct kni_maat_handle* kni_maat_init(const char* profile, void *logger){
 	KNI_LOG_ERROR(logger, "MESA_prof_load, [%s]:\n readconf_mode: %d\n tableinfo_path: %s\n tablename_intercept_ip: %s\n tablename_intercept_domain: %s\n"
 		"default_action: %d", section, readconf_mode, tableinfo_path, tablename_intercept_ip, 
 		tablename_intercept_domain, g_maat_default_action);
-	feather = Maat_feather(g_iThreadNum, tableinfo_path, logger);
+	feather = Maat_feather(thread_count, tableinfo_path, logger);
 	handle = ALLOC(struct kni_maat_handle, 1);
 	handle->feather = feather;
 	if(feather == NULL){
-		KNI_LOG_ERROR(logger, "Failed at Maat_feather, max_thread_num is %d, tableinfo_path is %s", g_iThreadNum, tableinfo_path);
+		KNI_LOG_ERROR(logger, "Failed at Maat_feather, max_thread_num is %d, tableinfo_path is %s", thread_count, tableinfo_path);
 		return NULL;
 	}
 	Maat_set_feather_opt(feather, MAAT_OPT_EFFECT_INVERVAL_MS, &effective_interval_ms, sizeof(effective_interval_ms));

entry/src/kni_tap.cpp

@@ -0,0 +1,74 @@
+#include <sys/ioctl.h>
+#include <fcntl.h>
+#include <linux/if_tun.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include "kni_utils.h" 
+#include "MESA_prof_load.h"
+
+struct kni_tap_handle{
+    int fd;
+    void *logger;
+};
+
+struct kni_tap_handle* kni_tap_init(void *logger){
+    struct kni_tap_handle * tap_handle = (struct kni_tap_handle*)malloc(sizeof(struct kni_tap_handle));
+
+    char tap_path[1024] = "tap";
+    char tap_name[IFNAMSIZ] = {0};
+    struct ifreq ifr;
+    int err = 0;
+    MESA_load_profile_string_def(".kniconf/kni.conf", "tap", (char*)"tap_path", tap_path, 1024, "/dev/net/tap");	
+	MESA_load_profile_string_def(".kniconf/kni.conf", "tap", (char*)"tap_name", tap_name, 1024, "/dev/net/tap");	
+    memset(&ifr, 0, sizeof(ifr));
+	ifr.ifr_flags = IFF_TAP | IFF_NO_PI | IFF_ONE_QUEUE;
+    if(*tap_name){
+        strncpy(ifr.ifr_name, tap_name, IFNAMSIZ);
+    }
+    if((tap_handle ->fd = open(tap_path, O_RDWR)) < 0){
+        KNI_LOG_ERROR(logger, "kni_tap_init():open error,errno is:%d,%s",errno,strerror(errno));
+        free(tap_handle);
+        return NULL;
+    }
+    err = ioctl(tap_handle ->fd, TUNSETIFF, (void *)&ifr);
+	if(err) {
+		KNI_LOG_ERROR(logger ,"kni_tap_init():ioctl error,errno is:%d,%s",errno,strerror(errno));
+		close(tap_handle ->fd);
+        free(tap_handle);
+		return NULL;
+	}
+    tap_handle->logger = logger;
+    retrun tap_handle;
+}
+
+
+int kni_tap_write(struct kni_tap_handle *handle, char *buff, uint16_t buff_len){
+	uint16_t send_len = write(handle->fd, buff, buff_len);
+	if(send_len < 0){
+        KNI_LOG_ERROR(handle->logger, "Failed at kni_tap_write, errno = %d(%s)", errno, strerror(errno));
+ 		return -1;
+	}
+    if(send_len < buff_len){
+        KNI_LOG_ERROR(handle->logger, "kni_tap_write: need send %dB, only send %dB", buff_len, send_len);
+        return -2;
+    }
+	return 0;
+}
+
+/*
+*   > 0 : read data length
+*   = 0 : read null
+*   = -1 : error
+*/
+int kni_tap_read(struct kni_tap_handle *handle, char *buff, uint16_t buff_len){
+    int recv_len = 0;
+	recv_len = read(handle -> fd, buff, buff_len);
+	if(recv_len < 0){
+        KNI_LOG_ERROR(handle -> logger, "kni_tap_read() error %d, %s", errno, strerror(errno));
+ 		return -1;
+	}
+	else{
+		return recv_len;
+	}
+	return 0;
+}

script/run.sh

@@ -1,11 +1,10 @@
-SAPP_RUN="/home/tsg/kni"
+SAPP_RUN="/home/tsg/sapp_v4"
-/bin/cp -f ../conf/sapp/conflist_business.inf $SAPP_RUN/plug/business/conflist_business.inf
 /bin/cp -rf ../conf/sapp/kni/ $SAPP_RUN/plug/business
-/bin/cp -f ../build/entry/libkni.so $SAPP_RUN/plug/business/kni/kni2.so
+rm -f $SAPP_RUN/plug/business/kni/kni2.so && /bin/cp -f ../build/entry/libkni.so $SAPP_RUN/plug/business/kni/kni2.so
 
-mkdir -p $SAPP_RUN/conf/kni
+mkdir -p $SAPP_RUN/etc/kni
-/bin/cp -f ../conf/kni.conf $SAPP_RUN/conf/kni/kni.conf
+/bin/cp -f ../conf/kni.conf $SAPP_RUN/etc/kni/kni.conf
-/bin/cp -f ../conf/maat/maat_test.json $SAPP_RUN/conf/kni/maat_test.json
+/bin/cp -f ../conf/maat/maat_test.json $SAPP_RUN/etc/kni/maat_test.json
-/bin/cp -f ../conf/maat/maat_tableinfo.conf $SAPP_RUN/conf/kni/maat_tableinfo.conf
+/bin/cp -f ../conf/maat/maat_tableinfo.conf $SAPP_RUN/etc/kni/maat_tableinfo.conf
-cat $SAPP_RUN/conf/project_list.conf | grep "kni_http_tag" >/dev/null 2>&1 && exit
+cat $SAPP_RUN/etc/project_list.conf | grep "kni_http_tag" >/dev/null 2>&1 && exit
-echo "kni_http_tag            struct" >> $SAPP_RUN/conf/project_list.conf
+echo "kni_http_tag            struct" >> $SAPP_RUN/etc/project_list.conf

vendor/CMakeLists.txt

@@ -37,7 +37,21 @@ add_dependencies(uuid libUUID)
 set_property(TARGET uuid PROPERTY IMPORTED_LOCATION ${INSTALL_DIR}/lib/libuuid.a)
 set_property(TARGET uuid PROPERTY INTERFACE_INCLUDE_DIRECTORIES ${INSTALL_DIR}/include)
 
+### dabloom
+ExternalProject_Add(dablooms PREFIX dablooms
+        URL ${CMAKE_CURRENT_SOURCE_DIR}/dablooms-v1.0.0-20190904.tar.gz
+        URL_MD5 9c49aaf1eefe5e0f836b46fc30287782
+        CONFIGURE_COMMAND cd .
+        BUILD_COMMAND cd ../dablooms && make
+        INSTALL_COMMAND cd ../dablooms && make install prefix=<INSTALL_DIR>)
 
+ExternalProject_Get_Property(dablooms INSTALL_DIR)
+file(MAKE_DIRECTORY ${INSTALL_DIR}/include)
+
+add_library(dabloom SHARED IMPORTED GLOBAL)
+add_dependencies(dabloom dablooms)
+set_property(TARGET dabloom PROPERTY IMPORTED_LOCATION ${INSTALL_DIR}/lib/libdablooms.a)
+set_property(TARGET dabloom PROPERTY INTERFACE_INCLUDE_DIRECTORIES ${INSTALL_DIR}/include)
 
 
 ### MESA Framework