#include #include #include #include #include #include #include #include #include "stream.h" #include "MESA_prof_load.h" #include "MESA_handle_logger.h" #include "field_stat2.h" #include "kni_entry.h" #include "kni_comm.h" const char *g_kni_fs2_name[FS2_COLUMN_NUM] = { "TAPALL", "UDP", "IP", "WHITE_IP", "WHITE_DOMAIN", "INTERCEPT", "RATELIMIT", "REPLACE", "HTTP", "SSL", "NOT_PROC", "TUN_WRITE", "TUN_READ", "SEND_MASION", "CLIENT_HELLO", "SSL_SNI(P)", "D_IPV6_OPT", "D_NOT_HTABLE", "D_NOT_IPV4/6", "D_NOT_IPV4/6", "D_E_ADDHTABLE", "D_OTHER", "REPR_TOTAL", "REPR_E_SOCK", "REPR_E_SET", "REPR_E_QIN", "REPR_E_QOUT", "REPR_SND", "REPR_E_SND", "PKT_QIN", "PKT_E_QIN", "PKT_QOUT", "PKT_E_QOUT", "PKT_WR", "PKT_E_WR", "LINK_OPENED", "LINK_CLS_TO", "LINK_CLS_FIN", "LINK_CLS_DROPME", "PME_NUM", "WINPROB_REPLY", "HTABLE_ADD", "HTABLE_DEL" }; char* kni_memncasemem(const char *strsrc,int len1,const char *substr,int len2) { char *p1,*p2,*pend; unsigned char *p; unsigned char *substrS; int i,lenth; if((strsrc==NULL)||substr==NULL) return NULL; if(len1addrtype == ADDR_TYPE_IPV4) { sport = ntohs(addr->tuple4_v4->source); dport = ntohs(addr->tuple4_v4->dest); inet_ntop(AF_INET, (void *)&(addr->tuple4_v4->saddr), saddr_str, INET_ADDRSTRLEN); inet_ntop(AF_INET, (void *)&(addr->tuple4_v4->daddr), daddr_str, INET_ADDRSTRLEN); } else if(addr->addrtype == ADDR_TYPE_IPV6) { sport = ntohs(addr->tuple4_v6->source); dport = ntohs(addr->tuple4_v6->dest); inet_ntop(AF_INET6, (void *)&(addr->tuple4_v6->saddr), saddr_str, INET6_ADDRSTRLEN); inet_ntop(AF_INET6, (void *)&(addr->tuple4_v6->daddr), daddr_str, INET6_ADDRSTRLEN); } else { MESA_handle_runtime_log(g_kni_comminfo.logger,RLOG_LV_INFO,module,"addr->type is %d",addr->addrtype); return -1; } if(protocol==KNI_FLAG_HTTP) { MESA_handle_runtime_log(g_kni_comminfo.logger,RLOG_LV_INFO,module,"addr:%s,%d,%s,%d,%s,domain:%s,%s,%s,config_id:%d,keyring_id:%d,c_fd:%d,s_fd:%d", saddr_str,sport,daddr_str,dport,"HTTP",domain,scan_result,action,pmeinfo->cfg_id,pmeinfo->keyring_id,pmeinfo->client_fd,pmeinfo->server_fd); } else if(protocol==KNI_FLAG_SSL) { MESA_handle_runtime_log(g_kni_comminfo.logger,RLOG_LV_INFO,module,"addr:%s,%d,%s,%d,%s,domain:%s,%s,%s,config_id:%d,keyring_id:%d,c_fd:%d,s_fd:%d", saddr_str,sport,daddr_str,dport,"SSL",domain+5,scan_result,action,pmeinfo->cfg_id,pmeinfo->keyring_id,pmeinfo->client_fd,pmeinfo->server_fd); } else { MESA_handle_runtime_log(g_kni_comminfo.logger,RLOG_LV_INFO,module,"addr:%s,%d,%s,%d,domain:%s,%s,%s,config_id:%d",saddr_str,sport,daddr_str,dport,domain,scan_result,action,pmeinfo->cfg_id); } return 0; } //TODO:LEVEL int kni_log_debug(int level,char* module,const void* a_packet,const char* format,...) { // if((a_packet == NULL)) { return 0; } unsigned short sport=0; unsigned short dport=0; char saddr_str[INET6_ADDRSTRLEN ]={0}; char daddr_str[INET6_ADDRSTRLEN ]={0}; struct ip* ipv4_hdr = (struct ip*)a_packet; struct kni_ipv6_hdr* ipv6_hdr = (struct kni_ipv6_hdr*)a_packet; struct tcphdr* tcphdr = NULL; char buf[4096] = {0}; va_list list; va_start(list, format); vsnprintf(buf, 4069, format, list); va_end(list); if(ipv4_hdr->ip_v==4) { tcphdr=(struct tcphdr*)((char*)ipv4_hdr+4*(ipv4_hdr->ip_hl)); inet_ntop(AF_INET, (void *)&((ipv4_hdr->ip_src).s_addr), saddr_str, INET_ADDRSTRLEN); inet_ntop(AF_INET, (void *)&((ipv4_hdr->ip_dst).s_addr), daddr_str, INET_ADDRSTRLEN); } else if((ipv6_hdr->ip6_flags[0] & 0xF0) == 0x60) { if(ipv6_hdr->ip6_nex_hdr != NEXTHDR_TCP) { return -1; } tcphdr =(struct tcphdr*)( (unsigned char*)ipv6_hdr + sizeof(struct kni_ipv6_hdr)); inet_ntop(AF_INET6, (void *)&(ipv6_hdr->ip6_src), saddr_str, INET6_ADDRSTRLEN); inet_ntop(AF_INET6, (void *)&(ipv6_hdr->ip6_dst), daddr_str, INET6_ADDRSTRLEN); } sport=ntohs(tcphdr->source); dport=ntohs(tcphdr->dest); MESA_handle_runtime_log(g_kni_comminfo.logger,level,module,"addr:%s,%d,%s,%d %s",saddr_str,sport,daddr_str,dport,buf); return 0; } int kni_log_debug_bak(int level,char* module,const void* a_packet,char* content) { unsigned short sport=0; unsigned short dport=0; char saddr_str[INET6_ADDRSTRLEN ]={0}; char daddr_str[INET6_ADDRSTRLEN ]={0}; struct ip* ipv4_hdr = (struct ip*)a_packet; struct kni_ipv6_hdr* ipv6_hdr = (struct kni_ipv6_hdr*)a_packet; struct tcphdr* tcphdr = NULL; if(ipv4_hdr->ip_v==4) { tcphdr=(struct tcphdr*)((char*)ipv4_hdr+4*(ipv4_hdr->ip_hl)); inet_ntop(AF_INET, (void *)&((ipv4_hdr->ip_src).s_addr), saddr_str, INET_ADDRSTRLEN); inet_ntop(AF_INET, (void *)&((ipv4_hdr->ip_dst).s_addr), daddr_str, INET_ADDRSTRLEN); } else if((ipv6_hdr->ip6_flags[0] & 0xF0) == 0x60) { if(ipv6_hdr->ip6_nex_hdr != NEXTHDR_TCP) { return -1; } tcphdr =(struct tcphdr*)( (unsigned char*)ipv6_hdr + sizeof(struct kni_ipv6_hdr)); inet_ntop(AF_INET, (void *)&(ipv6_hdr->ip6_src), saddr_str, INET6_ADDRSTRLEN); inet_ntop(AF_INET, (void *)&(ipv6_hdr->ip6_dst), daddr_str, INET6_ADDRSTRLEN); } sport=ntohs(tcphdr->source); dport=ntohs(tcphdr->dest); MESA_handle_runtime_log(g_kni_comminfo.logger,level,module,"addr:%s,%d,%s,%d %s",saddr_str,sport,daddr_str,dport,content); return 0; } /**************************************************************************** if(sportip_hl)); sport=ntohs(tcphdr->source); dport=ntohs(tcphdr->dest); if((sportip_src).s_addr)ip_dst).s_addr)))) { reverse_flag=1; } if(reverse_flag==1) { ipaddr->saddr=(iphdr->ip_dst).s_addr; ipaddr->daddr=(iphdr->ip_src).s_addr; ipaddr->source=tcphdr->dest; ipaddr->dest=tcphdr->source; } else { ipaddr->saddr=(iphdr->ip_src).s_addr; ipaddr->daddr=(iphdr->ip_dst).s_addr; ipaddr->source=tcphdr->source; ipaddr->dest=tcphdr->dest; } return reverse_flag; } /**************************************************************************** if(sportsource); dport=ntohs(tcphdr->dest); if(sportsaddr, ipv6_hdr->ip6_dst.s6_addr32, sizeof(ipaddr->saddr)); memcpy(ipaddr->daddr, ipv6_hdr->ip6_src.s6_addr32, sizeof(ipaddr->daddr)); ipaddr->source=tcphdr->dest; ipaddr->dest=tcphdr->source; } else { memcpy(ipaddr->saddr, ipv6_hdr->ip6_src.s6_addr32, sizeof(ipaddr->saddr)); memcpy(ipaddr->daddr, ipv6_hdr->ip6_dst.s6_addr32, sizeof(ipaddr->daddr)); ipaddr->source=tcphdr->source; ipaddr->dest=tcphdr->dest; } return reverse_flag; } int kni_get_tcpinfo(struct kni_wndpro_reply_info* lastpkt_info,struct kni_tcp_hdr* tcphdr,int tcplen) { lastpkt_info->seq=ntohl(tcphdr->th_seq); lastpkt_info->ack=ntohl(tcphdr->th_ack); lastpkt_info->len=tcplen; lastpkt_info->wndsize=ntohs(tcphdr->th_win); if(tcphdr->th_flags&TH_SYN) { lastpkt_info->syn_flag=1; } return 0; } int kni_get_tcpopt(struct kni_tcp_hdr* tcphdr,int tcp_hdr_len,unsigned short* mss,unsigned char* winscale,unsigned char* scak,unsigned char* timestamps) { *mss=KNI_DEFAULT_MSS; *winscale=KNI_DEFAULT_WINSCLE; int remain_len=tcp_hdr_len; struct kni_tcp_opt_format* tcp_opt=NULL; if((tcp_hdr_len<=20)||(tcp_hdr_len>64)) { return 0; } tcp_opt=(struct kni_tcp_opt_format*)((char*)tcphdr+TCPHDR_DEFAULT_LEN); remain_len-=TCPHDR_DEFAULT_LEN; while(remain_len) { if(tcp_opt->type==KNI_TCPOPT_MSS) //MSS { remain_len-=tcp_opt->len; *mss=htons(*(unsigned short*)(tcp_opt->content)); tcp_opt=(struct kni_tcp_opt_format*)((char*)tcp_opt+tcp_opt->len); continue; } else if(tcp_opt->type==KNI_TCPOPT_WINSCALE) //winscale { remain_len-=tcp_opt->len; *winscale=*(unsigned char*)(tcp_opt->content); tcp_opt=(struct kni_tcp_opt_format*)((char*)tcp_opt+tcp_opt->len); continue; } else if(tcp_opt->type==KNI_TCPOPT_SACKOK) //scak { remain_len-=tcp_opt->len; *scak=1; tcp_opt=(struct kni_tcp_opt_format*)((char*)tcp_opt+tcp_opt->len); continue; } else if(tcp_opt->type==KNI_TCPOPT_TIMESTAMP) //timestamp { remain_len-=tcp_opt->len; *timestamps=1; tcp_opt=(struct kni_tcp_opt_format*)((char*)tcp_opt+tcp_opt->len); continue; } else if((tcp_opt->type==0)||(tcp_opt->type==1)) { remain_len-=1; tcp_opt=(struct kni_tcp_opt_format*)((char*)tcp_opt+1); continue; } else { remain_len-=tcp_opt->len; tcp_opt=(struct kni_tcp_opt_format*)((char*)tcp_opt+tcp_opt->len); continue; } } return 0; } char* kni_get_payload(const struct streaminfo* pstream,int* datalen) { char* data=NULL; if(pstream->type==STREAM_TYPE_TCP) { data=(char*)(pstream->ptcpdetail->pdata); *datalen=pstream->ptcpdetail->datalen; } else if(pstream->type==STREAM_TYPE_UDP) { data=(char*)(pstream->pudpdetail->pdata); *datalen=pstream->pudpdetail->datalen; } else { data=NULL; *datalen=0; } return data; } int kni_filestate2_set(int thread_seq,enum kni_FS_COLUME colum_index,int bytes,int pktnum) { g_kni_fs2_info.column_value_pkt[thread_seq][colum_index]+=pktnum; g_kni_fs2_info.column_value_bytes[thread_seq][colum_index]+=bytes; return 0; } int kni_filestate2_init() { int i=0; // int j=0; int value=1; unsigned int fs2_sport=0; char fs2_filename[KNI_MAX_BUFLEN]={0}; char fs2_sip[KNI_MAX_BUFLEN]={0}; MESA_load_profile_string_def((char*)KNI_CONF_FILENAME,(char*)KNI_FS_MODE,(char*)"filestat2_filename",fs2_filename,KNI_MAX_BUFLEN,(char*)"./log/kni_fs2.log"); MESA_load_profile_string_def((char*)KNI_CONF_FILENAME,(char*)KNI_FS_MODE,(char*)"filestat2_sip",fs2_sip,KNI_MAX_BUFLEN,(char*)"0.0.0.0"); MESA_load_profile_uint_def((char*)KNI_CONF_FILENAME,(char*)KNI_FS_MODE,(char*)"filestat2_sport",(unsigned int*)&fs2_sport,0); g_kni_fs2_info.handler=FS_create_handle(); FS_set_para(g_kni_fs2_info.handler, OUTPUT_DEVICE,fs2_filename, strlen(fs2_filename)+1); FS_set_para(g_kni_fs2_info.handler, PRINT_MODE, &value, sizeof(value)); FS_set_para(g_kni_fs2_info.handler, STAT_CYCLE, &value, sizeof(value)); FS_set_para(g_kni_fs2_info.handler, CREATE_THREAD, &value, sizeof(value)); FS_set_para(g_kni_fs2_info.handler, APP_NAME, FS2_APPNAME, strlen(FS2_APPNAME)+1); if(fs2_sport!=0) { FS_set_para(g_kni_fs2_info.handler, STATS_SERVER_IP, fs2_sip, strlen(fs2_sip)+1); FS_set_para(g_kni_fs2_info.handler, STATS_SERVER_PORT,&fs2_sport,sizeof(int)); } for(i=0;iserv_def_len > KNI_SERVICE_LEN) { pmeinfo->ser_def_len = 0; MESA_handle_runtime_log(g_kni_comminfo.logger,RLOG_LV_FATAL,(char*)"get_service_defined", "maat_result->serv_def_len is %d,large than KNI_SERVICE_LEN %d",maat_result->serv_def_len,KNI_SERVICE_LEN); return -1; } pmeinfo->cfg_id = maat_result->config_id; pmeinfo->ser_def_len = maat_result->serv_def_len; assert((int)sizeof(pmeinfo->service_defined) > maat_result->serv_def_len); memcpy(pmeinfo->service_defined,maat_result->service_defined,maat_result->serv_def_len); } return 0; } int kni_get_keyring(struct kni_pme_info* pmeinfo) { char* tmp = NULL; tmp = kni_memncasemem(pmeinfo->service_defined, pmeinfo->ser_def_len,(char*)"keyring_id=", strlen("keyring_id=")); if(tmp == NULL) { MESA_handle_runtime_log(g_kni_comminfo.logger,RLOG_LV_FATAL,"KEYRING_ID","there is no keyring id!cfg_id:%d,region:%s",pmeinfo->cfg_id,pmeinfo->service_defined); return -1; } tmp += strlen("keyring_id="); pmeinfo->keyring_id= atoi(tmp); return 0; } int kni_process_maatresult(int result_num,struct Maat_rule_t* maat_result,struct kni_pme_info* pmeinfo) { int i=0; int cur_action = KNI_ACTION_NONE; int old_action = pmeinfo->action; int keyring_id_old = 0; for(i=0;iaction=cur_action; pmeinfo->cfg_id=maat_result[i].config_id; return 0; } old_action = pmeinfo->action; pmeinfo->action= kni_order_action(old_action,cur_action); if(old_action != pmeinfo->action) { kni_get_service_defined(cur_action,&maat_result[i],pmeinfo); } if((pmeinfo->ipsscan_action!= KNI_ACTION_MONITOR) && (pmeinfo->action == KNI_ACTION_MONITOR)) { keyring_id_old = pmeinfo->keyring_id; kni_get_keyring(pmeinfo); pmeinfo->keyring_id = pmeinfo->keyring_id>keyring_id_old ? pmeinfo->keyring_id : keyring_id_old; } } if((result_num == -2) && (pmeinfo->action == KNI_ACTION_NONE)) { pmeinfo->action = KNI_ACTION_HALFHIT; } return 0; }