gfwleak/tango-tfe
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

TSG-6228 修复 ATCA 性能测试时 perf 火焰图显示 tfe_stream_addr_to_str 耗时较高的问题

Browse Source
This commit is contained in:
luwenpeng
2021-04-28 18:01:32 +08:00
parent 68a8b6c94e
commit 19a3fe9217
7 changed files with 112 additions and 131 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
common/include/tfe_scan.h
View File

@@ -4,10 +4,10 @@
#define MAX_SCAN_RESULT 16
int tfe_scan_subscribe_id(const struct tfe_stream *stream, struct Maat_rule_t *result, scan_status_t *scan_mid,
int hit_cnt, unsigned int thread_id, void *logger, const char *addr);
int hit_cnt, unsigned int thread_id, void *logger);
int tfe_scan_ip_asn(const struct tfe_stream *stream, struct Maat_rule_t *result, scan_status_t *scan_mid,
int hit_cnt, unsigned int thread_id, void *logger, const char *addr, char **asn_server, char **asn_client);
int hit_cnt, unsigned int thread_id, void *logger, char **asn_server, char **asn_client);
int tfe_scan_ip_location(const struct tfe_stream *stream, struct Maat_rule_t *result, scan_status_t *scan_mid,
int hit_cnt, unsigned int thread_id, void *logger, const char *addr, char **location_server, char **location_client);
int hit_cnt, unsigned int thread_id, void *logger, char **location_server, char **location_client);
int tfe_scan_fqdn_cat(const struct tfe_stream *stream, struct Maat_rule_t *result, scan_status_t *scan_mid,
int hit_cnt, unsigned int thread_id, void *logger, const char *addr, int table_id);
int hit_cnt, unsigned int thread_id, void *logger, int table_id);

72
common/src/tfe_scan.cpp
View File

@@ -3,7 +3,7 @@
#include <tfe_scan.h>
int tfe_scan_subscribe_id(const struct tfe_stream *stream, struct Maat_rule_t *result, scan_status_t *scan_mid,
int hit_cnt, unsigned int thread_id, void *logger, const char *addr)
int hit_cnt, unsigned int thread_id, void *logger)
{
int scan_ret = 0;
int hit_cnt_ip = 0;
@@ -16,15 +16,15 @@ int tfe_scan_subscribe_id(const struct tfe_stream *stream, struct Maat_rule_t *r
scan_ret = tfe_cmsg_get_value(cmsg, TFE_CMSG_SRC_SUB_ID, (unsigned char *)source_subscribe_id, sizeof(source_subscribe_id), &opt_out_size);
if (scan_ret != 0)
{
TFE_LOG_ERROR(logger, "fetch src sub id from cmsg failed, ret: %d addr: %s", scan_ret, addr);
TFE_LOG_ERROR(logger, "fetch src sub id from cmsg failed, ret: %d addr: %s", scan_ret, stream->str_stream_info);
}
scan_ret = tfe_cmsg_get_value(cmsg, TFE_CMSG_DST_SUB_ID, (unsigned char *)dest_subscribe_id, sizeof(dest_subscribe_id), &opt_out_size);
if (scan_ret != 0)
{
TFE_LOG_ERROR(logger, "fetch dst sub id from cmsg failed, ret: %d addr: %s", scan_ret, addr);
TFE_LOG_ERROR(logger, "fetch dst sub id from cmsg failed, ret: %d addr: %s", scan_ret, stream->str_stream_info);
}
}
TFE_LOG_DEBUG(logger, "fetch src sub id:%s dst sub id:%s addr: %s", source_subscribe_id, dest_subscribe_id, addr);
TFE_LOG_DEBUG(logger, "fetch src sub id:%s dst sub id:%s addr: %s", source_subscribe_id, dest_subscribe_id, stream->str_stream_info);
if (strlen(source_subscribe_id))
{
@@ -35,13 +35,13 @@ int tfe_scan_subscribe_id(const struct tfe_stream *stream, struct Maat_rule_t *r
if (scan_ret > 0)
{
TFE_LOG_INFO(logger, "Scan src TSG_OBJ_SUBSCRIBER_ID, Hit subid: %s scan ret: %d policy_id: %d service: %d action: %d addr: %s",
source_subscribe_id, scan_ret, result[hit_cnt + hit_cnt_ip].config_id, result[hit_cnt + hit_cnt_ip].service_id, result[hit_cnt + hit_cnt_ip].action, addr);
source_subscribe_id, scan_ret, result[hit_cnt + hit_cnt_ip].config_id, result[hit_cnt + hit_cnt_ip].service_id, result[hit_cnt + hit_cnt_ip].action, stream->str_stream_info);
hit_cnt_ip += scan_ret;
}
else
{
TFE_LOG_INFO(logger, "Scan src TSG_OBJ_SUBSCRIBER_ID, NO hit subid: %s scan ret: %d addr: %s",
source_subscribe_id, scan_ret, addr);
source_subscribe_id, scan_ret, stream->str_stream_info);
}
}
@@ -54,13 +54,13 @@ int tfe_scan_subscribe_id(const struct tfe_stream *stream, struct Maat_rule_t *r
if (scan_ret > 0)
{
TFE_LOG_INFO(logger, "Scan dst TSG_OBJ_SUBSCRIBER_ID, Hit subid: %s scan ret: %d policy_id: %d service: %d action: %d addr: %s",
dest_subscribe_id, scan_ret, result[hit_cnt + hit_cnt_ip].config_id, result[hit_cnt + hit_cnt_ip].service_id, result[hit_cnt + hit_cnt_ip].action, addr);
dest_subscribe_id, scan_ret, result[hit_cnt + hit_cnt_ip].config_id, result[hit_cnt + hit_cnt_ip].service_id, result[hit_cnt + hit_cnt_ip].action, stream->str_stream_info);
hit_cnt_ip += scan_ret;
}
else
{
TFE_LOG_INFO(logger, "Scan dst TSG_OBJ_SUBSCRIBER_ID, NO hit subid: %s scan ret: %d addr: %s",
dest_subscribe_id, scan_ret, addr);
dest_subscribe_id, scan_ret, stream->str_stream_info);
}
}
@@ -68,7 +68,7 @@ int tfe_scan_subscribe_id(const struct tfe_stream *stream, struct Maat_rule_t *r
}
int tfe_scan_fqdn_cat(const struct tfe_stream *stream, struct Maat_rule_t *result, scan_status_t *scan_mid,
int hit_cnt, unsigned int thread_id, void *logger, const char *addr, int table_id)
int hit_cnt, unsigned int thread_id, void *logger, int table_id)
{
int scan_ret = 0;
unsigned int i = 0;
@@ -83,12 +83,12 @@ int tfe_scan_fqdn_cat(const struct tfe_stream *stream, struct Maat_rule_t *resul
scan_ret = tfe_cmsg_get_value(cmsg, TFE_CMSG_FQDN_CAT_ID_NUM, (unsigned char *)&category_id_num, sizeof(category_id_num), &opt_out_size);
if (scan_ret != 0)
{
TFE_LOG_ERROR(logger, "fetch fqdn cat id num from cmsg failed, ret: %d addr: %s", scan_ret, addr);
TFE_LOG_ERROR(logger, "fetch fqdn cat id num from cmsg failed, ret: %d addr: %s", scan_ret, stream->str_stream_info);
}
scan_ret = tfe_cmsg_get_value(cmsg, TFE_CMSG_FQDN_CAT_ID_VAL, (unsigned char *)category_id_val, sizeof(category_id_val), &opt_out_size);
if (scan_ret != 0)
{
TFE_LOG_ERROR(logger, "fetch fqdn cat id val from cmsg failed, ret: %d addr: %s", scan_ret, addr);
TFE_LOG_ERROR(logger, "fetch fqdn cat id val from cmsg failed, ret: %d addr: %s", scan_ret, stream->str_stream_info);
}
}
TFE_LOG_DEBUG(logger, "fetch fqdn cat id:%d val:%d,%d,%d,%d,%d,%d,%d,%d addr: %s", category_id_num,
@@ -100,7 +100,7 @@ int tfe_scan_fqdn_cat(const struct tfe_stream *stream, struct Maat_rule_t *resul
(category_id_num >= 6 ? category_id_val[5] : 0),
(category_id_num >= 7 ? category_id_val[6] : 0),
(category_id_num >= 8 ? category_id_val[7] : 0),
addr);
stream->str_stream_info);
for (i = 0; i < category_id_num && i < 8; i++)
{
@@ -109,20 +109,20 @@ int tfe_scan_fqdn_cat(const struct tfe_stream *stream, struct Maat_rule_t *resul
if (scan_ret > 0)
{
TFE_LOG_INFO(logger, "Scan FQDN_CAT, Hit catid: %d scan ret: %d policy_id: %d service: %d action: %d addr: %s",
category_id_val[i], scan_ret, result[hit_cnt + hit_cnt_fqdn].config_id, result[hit_cnt + hit_cnt_fqdn].service_id, result[hit_cnt + hit_cnt_fqdn].action, addr);
category_id_val[i], scan_ret, result[hit_cnt + hit_cnt_fqdn].config_id, result[hit_cnt + hit_cnt_fqdn].service_id, result[hit_cnt + hit_cnt_fqdn].action, stream->str_stream_info);
hit_cnt_fqdn += scan_ret;
}
else
{
TFE_LOG_INFO(logger, "Scan FQDN_CAT, NO hit catid: %d scan ret: %d addr: %s",
category_id_val[i], scan_ret, addr);
category_id_val[i], scan_ret, stream->str_stream_info);
}
}
return hit_cnt_fqdn;
}
int tfe_scan_ip_location(const struct tfe_stream *stream, struct Maat_rule_t *result, scan_status_t *scan_mid,
int hit_cnt, unsigned int thread_id, void *logger, const char *addr, char **location_server, char **location_client)
int hit_cnt, unsigned int thread_id, void *logger, char **location_server, char **location_client)
{
int scan_ret = 0;
int hit_cnt_ip = 0;
@@ -140,35 +140,35 @@ int tfe_scan_ip_location(const struct tfe_stream *stream, struct Maat_rule_t *re
scan_ret = tfe_cmsg_get_value(cmsg, TFE_CMSG_SRC_IP_LOCATION_COUNTRY, (unsigned char *)src_country, sizeof(src_country), &opt_out_size);
if (scan_ret != 0)
{
TFE_LOG_ERROR(logger, "fetch src country from cmsg failed, ret: %d addr: %s", scan_ret, addr);
TFE_LOG_ERROR(logger, "fetch src country from cmsg failed, ret: %d addr: %s", scan_ret, stream->str_stream_info);
}
scan_ret = tfe_cmsg_get_value(cmsg, TFE_CMSG_DST_IP_LOCATION_COUNTRY, (unsigned char *)dst_country, sizeof(dst_country), &opt_out_size);
if (scan_ret != 0)
{
TFE_LOG_ERROR(logger, "fetch dst country from cmsg failed, ret: %d addr: %s", scan_ret, addr);
TFE_LOG_ERROR(logger, "fetch dst country from cmsg failed, ret: %d addr: %s", scan_ret, stream->str_stream_info);
}
scan_ret = tfe_cmsg_get_value(cmsg, TFE_CMSG_SRC_IP_LOCATION_PROVINE, (unsigned char *)src_provine, sizeof(src_provine), &opt_out_size);
if (scan_ret != 0)
{
TFE_LOG_ERROR(logger, "fetch src provine from cmsg failed, ret: %d addr: %s", scan_ret, addr);
TFE_LOG_ERROR(logger, "fetch src provine from cmsg failed, ret: %d addr: %s", scan_ret, stream->str_stream_info);
}
scan_ret = tfe_cmsg_get_value(cmsg, TFE_CMSG_DST_IP_LOCATION_PROVINE, (unsigned char *)dst_provine, sizeof(dst_provine), &opt_out_size);
if (scan_ret != 0)
{
TFE_LOG_ERROR(logger, "fetch dst provine from cmsg failed, ret: %d addr: %s", scan_ret, addr);
TFE_LOG_ERROR(logger, "fetch dst provine from cmsg failed, ret: %d addr: %s", scan_ret, stream->str_stream_info);
}
scan_ret = tfe_cmsg_get_value(cmsg, TFE_CMSG_SRC_IP_LOCATION_CITY, (unsigned char *)src_city, sizeof(src_city), &opt_out_size);
if (scan_ret != 0)
{
TFE_LOG_ERROR(logger, "fetch src city from cmsg failed, ret: %d addr: %s", scan_ret, addr);
TFE_LOG_ERROR(logger, "fetch src city from cmsg failed, ret: %d addr: %s", scan_ret, stream->str_stream_info);
}
scan_ret = tfe_cmsg_get_value(cmsg, TFE_CMSG_DST_IP_LOCATION_CITY, (unsigned char *)dst_city, sizeof(dst_city), &opt_out_size);
if (scan_ret != 0)
{
TFE_LOG_ERROR(logger, "fetch dst city from cmsg failed, ret: %d addr: %s", scan_ret, addr);
TFE_LOG_ERROR(logger, "fetch dst city from cmsg failed, ret: %d addr: %s", scan_ret, stream->str_stream_info);
}
}
TFE_LOG_DEBUG(logger, "fetch src country:%s provine:%s city:%s; dst country:%s provine:%s city:%s addr: %s", src_country, src_provine, src_city, dst_country, dst_provine, dst_city, addr);
TFE_LOG_DEBUG(logger, "fetch src country:%s provine:%s city:%s; dst country:%s provine:%s city:%s addr: %s", src_country, src_provine, src_city, dst_country, dst_provine, dst_city, stream->str_stream_info);
if (strlen(dst_country) || strlen(dst_city))
{
@@ -181,13 +181,13 @@ int tfe_scan_ip_location(const struct tfe_stream *stream, struct Maat_rule_t *re
if (scan_ret > 0)
{
TFE_LOG_INFO(logger, "Scan TSG_SECURITY_DESTINATION_LOCATION, Hit location: %s scan ret: %d policy_id: %d service: %d action: %d addr: %s",
buff, scan_ret, result[hit_cnt + hit_cnt_ip].config_id, result[hit_cnt + hit_cnt_ip].service_id, result[hit_cnt + hit_cnt_ip].action, addr);
buff, scan_ret, result[hit_cnt + hit_cnt_ip].config_id, result[hit_cnt + hit_cnt_ip].service_id, result[hit_cnt + hit_cnt_ip].action, stream->str_stream_info);
hit_cnt_ip += scan_ret;
}
else
{
TFE_LOG_INFO(logger, "Scan TSG_SECURITY_DESTINATION_LOCATION, NO hit location: %s scan ret: %d addr: %s",
buff, scan_ret, addr);
buff, scan_ret, stream->str_stream_info);
}
memset(buff, 0, sizeof(buff));
snprintf(buff, sizeof(buff), "%s,%s,%s", dst_city, dst_provine, dst_country);
@@ -204,13 +204,13 @@ int tfe_scan_ip_location(const struct tfe_stream *stream, struct Maat_rule_t *re
if (scan_ret > 0)
{
TFE_LOG_INFO(logger, "Scan TSG_SECURITY_SOURCE_LOCATION, Hit location: %s scan ret: %d policy_id: %d service: %d action: %d addr: %s",
buff, scan_ret, result[hit_cnt + hit_cnt_ip].config_id, result[hit_cnt + hit_cnt_ip].service_id, result[hit_cnt + hit_cnt_ip].action, addr);
buff, scan_ret, result[hit_cnt + hit_cnt_ip].config_id, result[hit_cnt + hit_cnt_ip].service_id, result[hit_cnt + hit_cnt_ip].action, stream->str_stream_info);
hit_cnt_ip += scan_ret;
}
else
{
TFE_LOG_INFO(logger, "Scan TSG_SECURITY_SOURCE_LOCATION, NO hit location: %s scan ret: %d addr: %s",
buff, scan_ret, addr);
buff, scan_ret, stream->str_stream_info);
}
memset(buff, 0, sizeof(buff));
@@ -222,7 +222,7 @@ int tfe_scan_ip_location(const struct tfe_stream *stream, struct Maat_rule_t *re
}
int tfe_scan_ip_asn(const struct tfe_stream *stream, struct Maat_rule_t *result, scan_status_t *scan_mid,
int hit_cnt, unsigned int thread_id, void *logger, const char *addr, char **asn_server, char **asn_client)
int hit_cnt, unsigned int thread_id, void *logger, char **asn_server, char **asn_client)
{
int scan_ret = 0;
int hit_cnt_ip = 0;
@@ -238,25 +238,25 @@ int tfe_scan_ip_asn(const struct tfe_stream *stream, struct Maat_rule_t *result,
scan_ret = tfe_cmsg_get_value(cmsg, TFE_CMSG_SRC_ASN, (unsigned char *)src_asn, sizeof(src_asn), &opt_out_size);
if (scan_ret != 0)
{
TFE_LOG_ERROR(logger, "fetch src asn from cmsg failed, ret: %d addr: %s", scan_ret, addr);
TFE_LOG_ERROR(logger, "fetch src asn from cmsg failed, ret: %d addr: %s", scan_ret, stream->str_stream_info);
}
scan_ret = tfe_cmsg_get_value(cmsg, TFE_CMSG_DST_ASN, (unsigned char *)dst_asn, sizeof(dst_asn), &opt_out_size);
if (scan_ret != 0)
{
TFE_LOG_ERROR(logger, "fetch dst asn from cmsg failed, ret: %d addr: %s", scan_ret, addr);
TFE_LOG_ERROR(logger, "fetch dst asn from cmsg failed, ret: %d addr: %s", scan_ret, stream->str_stream_info);
}
scan_ret = tfe_cmsg_get_value(cmsg, TFE_CMSG_SRC_ORGANIZATION, (unsigned char *)src_org, sizeof(src_org), &opt_out_size);
if (scan_ret != 0)
{
TFE_LOG_ERROR(logger, "fetch src org from cmsg failed, ret: %d addr: %s", scan_ret, addr);
TFE_LOG_ERROR(logger, "fetch src org from cmsg failed, ret: %d addr: %s", scan_ret, stream->str_stream_info);
}
scan_ret = tfe_cmsg_get_value(cmsg, TFE_CMSG_DST_ORGANIZATION, (unsigned char *)dst_org, sizeof(dst_org), &opt_out_size);
if (scan_ret != 0)
{
TFE_LOG_ERROR(logger, "fetch dst org from cmsg failed, ret: %d addr: %s", scan_ret, addr);
TFE_LOG_ERROR(logger, "fetch dst org from cmsg failed, ret: %d addr: %s", scan_ret, stream->str_stream_info);
}
}
TFE_LOG_DEBUG(logger, "fetch src asn:%s org:%s; dst asn:%s org:%s addr: %s", src_asn, src_org, dst_asn, dst_org, addr);
TFE_LOG_DEBUG(logger, "fetch src asn:%s org:%s; dst asn:%s org:%s addr: %s", src_asn, src_org, dst_asn, dst_org, stream->str_stream_info);
if (strlen(dst_asn))
{
@@ -267,13 +267,13 @@ int tfe_scan_ip_asn(const struct tfe_stream *stream, struct Maat_rule_t *result,
if (scan_ret > 0)
{
TFE_LOG_INFO(logger, "Scan TSG_SECURITY_DESTINATION_ASN, Hit asn: %s scan ret: %d policy_id: %d service: %d action: %d addr: %s",
dst_asn, scan_ret, result[hit_cnt + hit_cnt_ip].config_id, result[hit_cnt + hit_cnt_ip].service_id, result[hit_cnt + hit_cnt_ip].action, addr);
dst_asn, scan_ret, result[hit_cnt + hit_cnt_ip].config_id, result[hit_cnt + hit_cnt_ip].service_id, result[hit_cnt + hit_cnt_ip].action, stream->str_stream_info);
hit_cnt_ip += scan_ret;
}
else
{
TFE_LOG_INFO(logger, "Scan TSG_SECURITY_DESTINATION_ASN, NO hit asn: %s scan ret: %d addr: %s",
dst_asn, scan_ret, addr);
dst_asn, scan_ret, stream->str_stream_info);
}
memset(buff, 0, sizeof(buff));
snprintf(buff, sizeof(buff), "%s(%s)", dst_asn, dst_org);
@@ -288,13 +288,13 @@ int tfe_scan_ip_asn(const struct tfe_stream *stream, struct Maat_rule_t *result,
if (scan_ret > 0)
{
TFE_LOG_INFO(logger, "Scan TSG_SECURITY_SOURCE_ASN, Hit asn: %s scan ret: %d policy_id: %d service: %d action: %d addr: %s",
src_asn, scan_ret, result[hit_cnt + hit_cnt_ip].config_id, result[hit_cnt + hit_cnt_ip].service_id, result[hit_cnt + hit_cnt_ip].action, addr);
src_asn, scan_ret, result[hit_cnt + hit_cnt_ip].config_id, result[hit_cnt + hit_cnt_ip].service_id, result[hit_cnt + hit_cnt_ip].action, stream->str_stream_info);
hit_cnt_ip += scan_ret;
}
else
{
TFE_LOG_INFO(logger, "Scan TSG_SECURITY_SOURCE_ASN, NO hit asn: %s scan ret: %d addr: %s",
src_asn, scan_ret, addr);
src_asn, scan_ret, stream->str_stream_info);
}
memset(buff, 0, sizeof(buff));

76
platform/src/ssl_service_cache.cpp
View File

@@ -18,6 +18,14 @@ struct ssl_svc_ja3
int ref_cnt;
};
struct ssl_svc_addr
{
const char *sip;
const char *sport;
const char *dip;
const char *dport;
};
static struct ssl_ja3_enforcer g_static_enforcer = {0};
static void ssl_svc_ja3_param_dup_cb(int table_id, MAAT_PLUGIN_EX_DATA *to, MAAT_PLUGIN_EX_DATA *from, long argl, void *argp)
@@ -110,7 +118,7 @@ static int ssl_svc_ja3_init(const char *table_name)
return 1;
}
enum ssl_ja3_pinning_status ssl_svc_ja3_scan(char *ja3_hash, char *addr_str)
enum ssl_ja3_pinning_status ssl_svc_ja3_scan(char *ja3_hash, const char *addr_str)
{
enum ssl_ja3_pinning_status ret = JA3_PINNING_STATUS_UNKNOWN;
struct ssl_svc_ja3 *param = NULL;
@@ -207,50 +215,42 @@ static void ssl_svc_free_server_st(void * data)
free(p);
return;
}
static size_t ssl_svc_server_st_mk_key(const struct ssl_chello* chello, const struct tfe_stream_addr * addr, char* key_buff, size_t sz)
static size_t ssl_svc_server_st_mk_key(struct ssl_svc_addr *addr_info, const struct ssl_chello* chello, const struct tfe_stream *tcp_stream, char* key_buff, size_t sz)
{
size_t key_len=0;
const char* sip=NULL, *sport=NULL, *dip=NULL, *dport=NULL;
char * addr_str= tfe_stream_addr_to_str(addr);
tfe_stream_addr_str_split(addr_str, &sip, &sport, &dip, &dport);
key_len=snprintf(key_buff, sz, "%s:%s:%s:", dip, dport, chello->sni?chello->sni:"null");
free(addr_str);
key_len=snprintf(key_buff, sz, "%s:%s:%s:", addr_info->dip, addr_info->dport, chello->sni ? chello->sni : "null");
return key_len;
}
static size_t ssl_svc_app_st_mk_key(const struct ssl_chello *chello, const struct tfe_stream *tcp_stream, char *key_buff, size_t sz)
static size_t ssl_svc_app_st_mk_key(struct ssl_svc_addr *addr_info, const struct ssl_chello *chello, const struct tfe_stream *tcp_stream, char *key_buff, size_t sz)
{
char ja3_val[64] = {0};
uint16_t ja3_len = 0;
size_t key_len = 0;
const char *sip = NULL, *sport = NULL, *dip = NULL, *dport = NULL;
char *addr_str = tfe_stream_addr_to_str(tcp_stream->addr);
struct tfe_cmsg *cmsg = tfe_stream_get0_cmsg(tcp_stream);
if (cmsg != NULL)
{
int ret = tfe_cmsg_get_value(cmsg, TFE_CMSG_SSL_CLIENT_JA3_FINGERPRINT, (unsigned char *)ja3_val, sizeof(ja3_val), &ja3_len);
if (ret != 0)
{
TFE_LOG_ERROR(g_default_logger, "failed at fetch ssl client ja3 fingerprint from cmsg: %s, %s", strerror(-ret), addr_str);
TFE_LOG_ERROR(g_default_logger, "failed at fetch ssl client ja3 fingerprint from cmsg: %s, %s", strerror(-ret), tcp_stream->str_stream_info);
}
else
{
TFE_LOG_DEBUG(g_default_logger, "fetch ssl client ja3 fingerprint:%s addr: %s", ja3_val, addr_str);
TFE_LOG_DEBUG(g_default_logger, "fetch ssl client ja3 fingerprint:%s addr: %s", ja3_val, tcp_stream->str_stream_info);
}
}
tfe_stream_addr_str_split(addr_str, &sip, &sport, &dip, &dport);
// If ja3 is successfully obtained, use ja3 to generate hashkey
if (strlen(ja3_val))
{
key_len = snprintf(key_buff, sz, "%s:%s", ja3_val, chello->sni ? chello->sni : dip);
free(addr_str);
key_len = snprintf(key_buff, sz, "%s:%s", ja3_val, chello->sni ? chello->sni : addr_info->dip);
return key_len;
}
// otherwise, splicing ssl attributes to generate hashkey
key_len=snprintf(key_buff, sz, "%d:%d:%s:%s", chello->min_version.ossl_format,
chello->max_version.ossl_format,
chello->sni?chello->sni: dip ,
chello->sni?chello->sni: addr_info->dip ,
chello->alpn?chello->alpn:"null");
if(chello->cipher_suites && sz-key_len>chello->cipher_suites_len)
{
@@ -266,25 +266,20 @@ static size_t ssl_svc_app_st_mk_key(const struct ssl_chello *chello, const struc
{
memcpy(key_buff+key_len, chello->supported_groups, chello->supported_groups_len);
key_len+=chello->supported_groups_len;
}
free(addr_str);
}
return key_len;
}
static size_t ssl_svc_client_st_mk_key(const struct ssl_chello *chello, const struct tfe_stream *tcp_stream, char *key_buff, size_t sz)
static size_t ssl_svc_client_st_mk_key(struct ssl_svc_addr *addr_info, const struct ssl_chello *chello, const struct tfe_stream *tcp_stream, char *key_buff, size_t sz)
{
size_t key_len=0;
const char* sip=NULL, *sport=NULL, *dip=NULL, *dport=NULL;
char *addr_str = tfe_stream_addr_to_str(tcp_stream->addr);
tfe_stream_addr_str_split(addr_str, &sip, &sport, &dip, &dport);
char chello_id_buff[sz];
size_t chello_id_len=0;
key_len=snprintf(key_buff, sz, "%s:", sip);
chello_id_len = ssl_svc_app_st_mk_key(chello, tcp_stream, chello_id_buff, sizeof(chello_id_buff));
key_len=snprintf(key_buff, sz, "%s:", addr_info->sip);
chello_id_len = ssl_svc_app_st_mk_key(addr_info, chello, tcp_stream, chello_id_buff, sizeof(chello_id_buff));
memcpy(key_buff+key_len, chello_id_buff, MIN(chello_id_len, sz-key_len));
key_len += MIN(chello_id_len, sz-key_len);
free(addr_str);
return key_len;
}
static long cli_st_read_cb(void * data, const uchar * key, uint size, void * user_arg)
@@ -433,20 +428,23 @@ int ssl_service_cache_read(struct ssl_service_cache *svc_cache, const struct ssl
return 0;
}
char * addr_str= tfe_stream_addr_to_str(tcp_stream->addr);
struct ssl_svc_addr addr_info = { NULL, NULL, NULL, NULL};
char *addr_str = tfe_strdup(tcp_stream->str_stream_info);
tfe_stream_addr_str_split(addr_str, &(addr_info.sip), &(addr_info.sport), &(addr_info.dip), &(addr_info.dport));
memset(hash_key, 0, sizeof(hash_key));
temp_key_sz = ssl_svc_client_st_mk_key(chello, tcp_stream, temp_key, sizeof(temp_key));
temp_key_sz = ssl_svc_client_st_mk_key(&addr_info, chello, tcp_stream, temp_key, sizeof(temp_key));
hash_key_sz = tfe_hexdump(hash_key, (unsigned char *)temp_key, temp_key_sz) - hash_key;
MESA_htable_search_cb(svc_cache->cli_st_hash, hash_key, (unsigned int) hash_key_sz, cli_st_read_cb, result, &cli_st_cb_ret);
TFE_LOG_DEBUG(g_default_logger, "client table, hash:%s, found:%d, sni:%s, addr:%s, mutual:%d, pinning:%d, err:%d",
hash_key, cli_st_cb_ret, chello->sni, addr_str, result->is_mutual_auth, result->cli_pinning_status, result->has_protocol_errors);
hash_key, cli_st_cb_ret, chello->sni, tcp_stream->str_stream_info, result->is_mutual_auth, result->cli_pinning_status, result->has_protocol_errors);
memset(hash_key, 0, sizeof(hash_key));
temp_key_sz = ssl_svc_server_st_mk_key(chello, tcp_stream->addr, temp_key, sizeof(temp_key));
temp_key_sz = ssl_svc_server_st_mk_key(&addr_info, chello, tcp_stream, temp_key, sizeof(temp_key));
hash_key_sz = tfe_hexdump(hash_key, (unsigned char *)temp_key, temp_key_sz) - hash_key;
MESA_htable_search_cb(svc_cache->srv_st_hash, hash_key, (unsigned int) hash_key_sz, srv_st_read_cb, result, &svr_st_cb_ret);
TFE_LOG_DEBUG(g_default_logger, "server table, hash:%s, found:%d, sni:%s, addr:%s, ct:%d, ev:%d",
hash_key, svr_st_cb_ret, chello->sni, addr_str, result->is_ct, result->is_ev);
hash_key, svr_st_cb_ret, chello->sni, tcp_stream->str_stream_info, result->is_ct, result->is_ev);
char ja3_hash[64] = {0};
uint16_t ja3_len = 0;
@@ -457,7 +455,7 @@ int ssl_service_cache_read(struct ssl_service_cache *svc_cache, const struct ssl
int ret = tfe_cmsg_get_value(cmsg, TFE_CMSG_SSL_CLIENT_JA3_FINGERPRINT, (unsigned char *)ja3_hash, sizeof(ja3_hash), &ja3_len);
if (ret == 0)
{
result->ja3_pinning_status = ssl_svc_ja3_scan(ja3_hash, addr_str);
result->ja3_pinning_status = ssl_svc_ja3_scan(ja3_hash, tcp_stream->str_stream_info);
if (result->ja3_pinning_status != JA3_PINNING_STATUS_UNKNOWN)
{
app_st_cb_ret = 1;
@@ -465,7 +463,7 @@ int ssl_service_cache_read(struct ssl_service_cache *svc_cache, const struct ssl
}
}
TFE_LOG_DEBUG(g_default_logger, "app table, hash:%s, found:%d, sni:%s, addr:%s, ja3_pinning_status:%d",
ja3_hash, app_st_cb_ret, chello->sni, addr_str, result->ja3_pinning_status);
ja3_hash, app_st_cb_ret, chello->sni, tcp_stream->str_stream_info, result->ja3_pinning_status);
free(addr_str);
@@ -491,24 +489,28 @@ void ssl_service_cache_write(struct ssl_service_cache *svc_cache, const struct s
{
return;
}
char *addr_str = tfe_stream_addr_to_str(tcp_stream->addr);
struct ssl_svc_addr addr_info = { NULL, NULL, NULL, NULL};
char *addr_str = tfe_strdup(tcp_stream->str_stream_info);
tfe_stream_addr_str_split(addr_str, &(addr_info.sip), &(addr_info.sport), &(addr_info.dip), &(addr_info.dport));
struct ssl_service_write_args write_args={svc_cache, status};
if(status->is_mutual_auth||status->cli_pinning_status!=PINNING_ST_NOT_PINNING||status->has_protocol_errors)
{
memset(hash_key, 0, sizeof(hash_key));
temp_key_sz = ssl_svc_client_st_mk_key(chello, tcp_stream, temp_key, sizeof(temp_key));
temp_key_sz = ssl_svc_client_st_mk_key(&addr_info, chello, tcp_stream, temp_key, sizeof(temp_key));
hash_key_sz = tfe_hexdump(hash_key, (unsigned char *)temp_key, temp_key_sz) - hash_key;
TFE_LOG_DEBUG(g_default_logger, "client table, hash:%s, sni:%s, addr:%s, mutual:%d, pinning:%d, err:%d",
hash_key, chello->sni, addr_str, status->is_mutual_auth, status->cli_pinning_status, status->has_protocol_errors);
hash_key, chello->sni, tcp_stream->str_stream_info, status->is_mutual_auth, status->cli_pinning_status, status->has_protocol_errors);
MESA_htable_search_cb(svc_cache->cli_st_hash, hash_key, (unsigned int) hash_key_sz, cli_st_write_cb, &write_args, &cli_st_cb_ret);
}
if(status->is_ct||status->is_ev)
{
memset(hash_key, 0, sizeof(hash_key));
temp_key_sz = ssl_svc_server_st_mk_key(chello, tcp_stream->addr, temp_key, sizeof(temp_key));
temp_key_sz = ssl_svc_server_st_mk_key(&addr_info, chello, tcp_stream, temp_key, sizeof(temp_key));
hash_key_sz = tfe_hexdump(hash_key, (unsigned char *)temp_key, temp_key_sz) - hash_key;
TFE_LOG_DEBUG(g_default_logger, "server table, hash:%s, sni:%s, addr:%s, ct:%d, ev:%d",
hash_key, chello->sni, addr_str, status->is_ct, status->is_ev);
hash_key, chello->sni, tcp_stream->str_stream_info, status->is_ct, status->is_ev);
MESA_htable_search_cb(svc_cache->srv_st_hash, hash_key, (unsigned int) hash_key_sz, srv_st_write_cb, &write_args, &svr_st_cb_ret);
}

20
platform/src/ssl_stream.cpp
View File

@@ -570,21 +570,17 @@ static void ssl_stream_free(struct ssl_stream * s_stream)
}
static void log_ssl_master_key(SSL* ssl, int fd, tfe_conn_dir dir, FILE* fp)
static void log_ssl_master_key(struct ssl_stream *s_stream, tfe_conn_dir dir, FILE* fp)
{
char* key_str=NULL;
key_str=ssl_ssl_masterkey_to_str(ssl);
key_str=ssl_ssl_masterkey_to_str(s_stream->ssl);
char time_str[TFE_SYMBOL_MAX];
time_t now=time(NULL);
tfe_thread_safe_ctime(&now, time_str, sizeof(time_str));
struct tfe_stream_addr* addr=tfe_stream_addr_create_by_fd(fd, dir);
char* addr_string=tfe_stream_addr_to_str(addr);
fprintf(fp, "#%s %s %s\n%s\n", time_str, tfe_stream_conn_dir_to_str(dir), addr_string?addr_string:NULL, key_str);
fprintf(fp, "#%s %s %s\n%s\n", time_str, tfe_stream_conn_dir_to_str(dir), s_stream->tcp_stream->str_stream_info ? s_stream->tcp_stream->str_stream_info : NULL, key_str);
free(key_str);
tfe_stream_addr_free(addr);
free(addr_string);
return;
}
@@ -1371,7 +1367,7 @@ static void ssl_server_connected_eventcb(struct bufferevent * bev, short events,
}
if(mgr->log_master_key)
{
log_ssl_master_key(s_stream->ssl, ctx->fd_upstream, CONN_DIR_UPSTREAM, mgr->fp_master_key);
log_ssl_master_key(s_stream, CONN_DIR_UPSTREAM, mgr->fp_master_key);
}
const unsigned char *alpn_data=NULL;
unsigned int alpn_len=0;
@@ -1413,7 +1409,6 @@ static void peek_chello_on_succ(future_result_t * result, void * user)
struct event_base* evbase=tfe_proxy_get_work_thread_evbase(ctx->tcp_stream->thread_id);
struct ssl_stream* s_stream=NULL;
struct ssl_chello* chello = ssl_peek_result_release_chello(result);//chello has been saved in ssl_stream.
char* addr_string=NULL;
if(chello->sni==NULL)
{
ATOMIC_INC(&(ctx->mgr->stat_val[SSL_NO_SNI]));
@@ -1426,9 +1421,8 @@ static void peek_chello_on_succ(future_result_t * result, void * user)
ret=ssl_service_cache_read(ctx->mgr->svc_cache, chello, s_stream->tcp_stream, svc_status);
if(ret==1)
{
addr_string=tfe_stream_addr_to_str(s_stream->tcp_stream->addr);
TFE_LOG_DEBUG(ctx->mgr->logger, "%s %s service status pinning:%d, mauth:%d, err:%d, ct:%d, ev:%d, ja3_pinning_status:%d",
addr_string,
s_stream->tcp_stream->str_stream_info,
chello->sni,
svc_status->cli_pinning_status,
svc_status->is_mutual_auth,
@@ -1436,8 +1430,6 @@ static void peek_chello_on_succ(future_result_t * result, void * user)
svc_status->is_ct,
svc_status->is_ev,
svc_status->ja3_pinning_status);
free(addr_string);
addr_string=NULL;
}
switch (svc_status->ja3_pinning_status)
{
@@ -1942,7 +1934,7 @@ static void ssl_client_connected_eventcb(struct bufferevent * bev, short events,
if(mgr->log_master_key)
{
log_ssl_master_key(s_stream->ssl, ctx->fd_downstream, CONN_DIR_DOWNSTREAM, mgr->fp_master_key);
log_ssl_master_key(s_stream, CONN_DIR_DOWNSTREAM, mgr->fp_master_key);
}
s_stream->negotiated_version=SSL_version(s_stream->ssl);
ssl_stream_set_cmsg_string(s_stream, TFE_CMSG_SSL_CLIENT_SIDE_VERSION, SSL_get_version(s_stream->ssl));

54
plugin/business/doh/src/doh.cpp
View File

@@ -94,7 +94,7 @@ static cJSON *doh_get_answer_records(cJSON *object, int qtype)
return NULL;
}
static void doh_get_cheat_data(Maat_rule_t *p_result, int qtype, struct doh_ctx *ctx)
static void doh_get_cheat_data(Maat_rule_t *p_result, int qtype, struct doh_ctx *ctx, const char *str_stream_info)
{
int i;
int answer_size = 0;
@@ -106,7 +106,7 @@ static void doh_get_cheat_data(Maat_rule_t *p_result, int qtype, struct doh_ctx
tmp = (char *)calloc(1, p_result->serv_def_len + 1);
Maat_read_rule(g_doh_conf->maat, p_result, MAAT_RULE_SERV_DEFINE, tmp, p_result->serv_def_len);
TFE_LOG_INFO(g_doh_conf->local_logger, "%s hit %d %s", ctx->addr_string, p_result->config_id, tmp);
TFE_LOG_INFO(g_doh_conf->local_logger, "%s hit %d %s", str_stream_info, p_result->config_id, tmp);
object = cJSON_Parse(tmp);
if (object == NULL)
@@ -210,19 +210,19 @@ static void doh_maat_scan(const struct tfe_stream *stream, const struct tfe_http
struct Maat_rule_t *p_result = NULL;
struct Maat_rule_t result[MAX_SCAN_RESULT];
scan_ret = tfe_scan_subscribe_id(stream, result, &(ctx->scan_mid), hit_cnt, ctx->thread_id, g_doh_conf->local_logger, ctx->addr_string);
scan_ret = tfe_scan_subscribe_id(stream, result, &(ctx->scan_mid), hit_cnt, ctx->thread_id, g_doh_conf->local_logger);
if (scan_ret > 0)
{
hit_cnt += scan_ret;
}
scan_ret = tfe_scan_ip_location(stream, result, &(ctx->scan_mid), hit_cnt, ctx->thread_id, g_doh_conf->local_logger, ctx->addr_string, &(ctx->location_server), &(ctx->location_client));
scan_ret = tfe_scan_ip_location(stream, result, &(ctx->scan_mid), hit_cnt, ctx->thread_id, g_doh_conf->local_logger, &(ctx->location_server), &(ctx->location_client));
if (scan_ret > 0)
{
hit_cnt += scan_ret;
}
scan_ret = tfe_scan_ip_asn(stream, result, &(ctx->scan_mid), hit_cnt, ctx->thread_id, g_doh_conf->local_logger, ctx->addr_string, &(ctx->asn_server), &(ctx->asn_client));
scan_ret = tfe_scan_ip_asn(stream, result, &(ctx->scan_mid), hit_cnt, ctx->thread_id, g_doh_conf->local_logger, &(ctx->asn_server), &(ctx->asn_client));
if (scan_ret > 0)
{
hit_cnt += scan_ret;
@@ -237,16 +237,16 @@ static void doh_maat_scan(const struct tfe_stream *stream, const struct tfe_http
if (scan_ret > 0)
{
TFE_LOG_INFO(g_doh_conf->local_logger, "Scan %s, Hit host: %s scan ret: %d policy_id: %d service: %d action: %d addr: %s",
g_doh_conf->tables[TYPE_HOST].name, host, scan_ret, result[hit_cnt].config_id, result[hit_cnt].service_id, result[hit_cnt].action, ctx->addr_string);
g_doh_conf->tables[TYPE_HOST].name, host, scan_ret, result[hit_cnt].config_id, result[hit_cnt].service_id, result[hit_cnt].action, stream->str_stream_info);
hit_cnt += scan_ret;
}
else
{
TFE_LOG_INFO(g_doh_conf->local_logger, "Scan %s, NO hit host: %s scan ret: %d addr: %s",
g_doh_conf->tables[TYPE_HOST].name, host, scan_ret, ctx->addr_string);
g_doh_conf->tables[TYPE_HOST].name, host, scan_ret, stream->str_stream_info);
}
scan_ret = tfe_scan_fqdn_cat(stream, result, &(ctx->scan_mid), hit_cnt, ctx->thread_id, g_doh_conf->local_logger, ctx->addr_string, g_doh_conf->tables[TYPE_HOST].id);
scan_ret = tfe_scan_fqdn_cat(stream, result, &(ctx->scan_mid), hit_cnt, ctx->thread_id, g_doh_conf->local_logger, g_doh_conf->tables[TYPE_HOST].id);
if( scan_ret > 0)
{
hit_cnt += scan_ret;
@@ -260,13 +260,13 @@ static void doh_maat_scan(const struct tfe_stream *stream, const struct tfe_http
if (scan_ret > 0)
{
TFE_LOG_INFO(g_doh_conf->local_logger, "Scan %s, Hit addr: %s scan ret: %d policy_id: %d service: %d action: %d",
g_doh_conf->tables[TYPE_ADDR].name, ctx->addr_string, scan_ret, result[hit_cnt].config_id, result[hit_cnt].service_id, result[hit_cnt].action);
g_doh_conf->tables[TYPE_ADDR].name, stream->str_stream_info, scan_ret, result[hit_cnt].config_id, result[hit_cnt].service_id, result[hit_cnt].action);
hit_cnt += scan_ret;
}
else
{
TFE_LOG_INFO(g_doh_conf->local_logger, "Scan %s, NO hit addr: %s scan ret: %d",
g_doh_conf->tables[TYPE_ADDR].name, ctx->addr_string, scan_ret);
g_doh_conf->tables[TYPE_ADDR].name, stream->str_stream_info, scan_ret);
}
// scan appid
@@ -274,13 +274,13 @@ static void doh_maat_scan(const struct tfe_stream *stream, const struct tfe_http
if (scan_ret > 0)
{
TFE_LOG_INFO(g_doh_conf->local_logger, "Scan %s, Hit proto: %d scan ret: %d policy_id: %d service: %d action: %d addr: %s",
g_doh_conf->tables[TYPE_APPID].name, app_id, scan_ret, result[hit_cnt].config_id, result[hit_cnt].service_id, result[hit_cnt].action, ctx->addr_string);
g_doh_conf->tables[TYPE_APPID].name, app_id, scan_ret, result[hit_cnt].config_id, result[hit_cnt].service_id, result[hit_cnt].action, stream->str_stream_info);
hit_cnt += scan_ret;
}
else
{
TFE_LOG_INFO(g_doh_conf->local_logger, "Scan %s, NO hit proto: %d scan ret: %d addr: %s",
g_doh_conf->tables[TYPE_APPID].name, app_id, scan_ret, ctx->addr_string);
g_doh_conf->tables[TYPE_APPID].name, app_id, scan_ret, stream->str_stream_info);
}
// scan qname
@@ -289,13 +289,13 @@ static void doh_maat_scan(const struct tfe_stream *stream, const struct tfe_http
if (scan_ret > 0)
{
TFE_LOG_INFO(g_doh_conf->local_logger, "Scan %s, Hit domain: %s scan ret: %d qtype: %d policy_id: %d service: %d action: %d addr: %s",
g_doh_conf->tables[TYPE_QNAME].name, qname, scan_ret, qtype, result[hit_cnt].config_id, result[hit_cnt].service_id, result[hit_cnt].action, ctx->addr_string);
g_doh_conf->tables[TYPE_QNAME].name, qname, scan_ret, qtype, result[hit_cnt].config_id, result[hit_cnt].service_id, result[hit_cnt].action, stream->str_stream_info);
hit_cnt += scan_ret;
}
else
{
TFE_LOG_INFO(g_doh_conf->local_logger, "Scan %s, NO hit domain: %s scan ret: %d addr: %s",
g_doh_conf->tables[TYPE_QNAME].name, qname, scan_ret, ctx->addr_string);
g_doh_conf->tables[TYPE_QNAME].name, qname, scan_ret, stream->str_stream_info);
}
if (hit_cnt)
@@ -306,7 +306,7 @@ static void doh_maat_scan(const struct tfe_stream *stream, const struct tfe_http
ctx->result_num = 1;
ctx->result = ALLOC(struct Maat_rule_t, ctx->result_num);
memcpy(ctx->result, p_result, sizeof(struct Maat_rule_t));
doh_get_cheat_data(p_result, qtype, ctx);
doh_get_cheat_data(p_result, qtype, ctx, stream->str_stream_info);
}
}
}
@@ -408,12 +408,6 @@ static void doh_ctx_free(struct doh_ctx *ctx)
ctx->http_req_body = NULL;
}
if (ctx->addr_string)
{
free(ctx->addr_string);
ctx->addr_string = NULL;
}
if (ctx->asn_client)
{
free(ctx->asn_client);
@@ -506,21 +500,21 @@ static void doh_process_req(const struct tfe_stream *stream, const struct tfe_ht
int temp_size = (req_len / 3 + 1) * 4;
char *temp = (char *)ALLOC(char, temp_size);
int len = base64_encode(temp, temp_size - 1, req_data, req_len);
TFE_LOG_ERROR(g_doh_conf->local_logger, "%s Doh parser request failed, PASSTHROUGH, data:%s", ctx->addr_string, len > 0 ? temp : "");
TFE_LOG_ERROR(g_doh_conf->local_logger, "%s Doh parser request failed, PASSTHROUGH, data:%s", stream->str_stream_info, len > 0 ? temp : "");
free(temp);
goto end;
}
TFE_LOG_DEBUG(g_doh_conf->local_logger, "%s qtype %d qname:%s",
ctx->addr_string, ctx->doh_req->query_question.qtype, ctx->doh_req->query_question.qname);
stream->str_stream_info, ctx->doh_req->query_question.qtype, ctx->doh_req->query_question.qname);
if (ctx->doh_req->query_question.qtype != DNS_TYPE_A && ctx->doh_req->query_question.qtype != DNS_TYPE_AAAA)
{
TFE_LOG_INFO(g_doh_conf->local_logger, "%s Doh qtype not A/AAAA, PASSTHROUGH", ctx->addr_string);
TFE_LOG_INFO(g_doh_conf->local_logger, "%s Doh qtype not A/AAAA, PASSTHROUGH", stream->str_stream_info);
goto end;
}
if (strlen((char *)ctx->doh_req->query_question.qname) == 0)
{
TFE_LOG_INFO(g_doh_conf->local_logger, "%s Doh qname is empty, PASSTHROUGH", ctx->addr_string);
TFE_LOG_INFO(g_doh_conf->local_logger, "%s Doh qname is empty, PASSTHROUGH", stream->str_stream_info);
goto end;
}
@@ -529,7 +523,7 @@ static void doh_process_req(const struct tfe_stream *stream, const struct tfe_ht
ctx->scan_mid = NULL;
if (!ctx->opts_num)
{
TFE_LOG_INFO(g_doh_conf->local_logger, "%s Doh no hit answer type, PASSTHROUGH", ctx->addr_string);
TFE_LOG_INFO(g_doh_conf->local_logger, "%s Doh no hit answer type, PASSTHROUGH", stream->str_stream_info);
goto end;
}
@@ -538,7 +532,7 @@ static void doh_process_req(const struct tfe_stream *stream, const struct tfe_ht
rsp_len = dns_cheat_response(ctx->doh_req, ctx->opts, ctx->opts_num, rsp_buff, rsp_size - 1);
if (rsp_len < 0)
{
TFE_LOG_ERROR(g_doh_conf->local_logger, "%s Doh cheat response failed: %d, PASSTHROUGH", ctx->addr_string, rsp_len);
TFE_LOG_ERROR(g_doh_conf->local_logger, "%s Doh cheat response failed: %d, PASSTHROUGH", stream->str_stream_info, rsp_len);
goto end;
}
@@ -640,8 +634,6 @@ void doh_on_begin(const struct tfe_stream *stream, const struct tfe_http_session
assert(ctx == NULL);
ctx = doh_ctx_new(thread_id);
ctx->addr_string = tfe_stream_addr_to_str(stream->addr);
*pme = ctx;
}
@@ -667,7 +659,7 @@ int doh_on_data(const struct tfe_stream *stream, const struct tfe_http_session *
ctx->count = 1;
ATOMIC_INC(&(g_doh_conf->stat_val[STAT_SESSION]));
TFE_LOG_DEBUG(g_doh_conf->local_logger, "%s method:%s content-type:%s accept:%s url:%s",
ctx->addr_string,
stream->str_stream_info,
http_std_method_to_string(session->req->req_spec.method),
tfe_http_std_field_read(session->req, TFE_HTTP_CONT_TYPE),
tfe_http_nonstd_field_read(session->req, "Accept"),
@@ -730,7 +722,7 @@ int doh_on_data(const struct tfe_stream *stream, const struct tfe_http_session *
len = tfe_decode_base64url(temp, dns_data);
if (len == 0)
{
TFE_LOG_ERROR(g_doh_conf->local_logger, "%s Doh base64 decode uri failed:%s, PASSTHROUGH", ctx->addr_string, session->req->req_spec.uri);
TFE_LOG_ERROR(g_doh_conf->local_logger, "%s Doh base64 decode uri failed:%s, PASSTHROUGH", stream->str_stream_info, session->req->req_spec.uri);
goto error;
}

1
plugin/business/doh/src/pub.h
View File

@@ -80,7 +80,6 @@ struct doh_ctx
int magic_num;
int manipulate;
int opts_num;
char *addr_string;
size_t result_num;
Maat_rule_t *result;
cheat_pkt_opt_t *opts;

12
plugin/business/pangu-http/src/pangu_http.cpp
View File

@@ -1948,13 +1948,11 @@ enum pangu_action http_scan(const struct tfe_http_session * session, enum tfe_ht
{
hit_cnt += scan_ret;
}
char *addr_string = tfe_stream_addr_to_str(stream->addr);
scan_ret = tfe_scan_fqdn_cat(stream, result, &(ctx->scan_mid), hit_cnt, ctx->thread_id, g_pangu_rt->local_logger, addr_string, g_pangu_rt->scan_table_id[PXY_CTRL_HTTP_FQDN]);
scan_ret = tfe_scan_fqdn_cat(stream, result, &(ctx->scan_mid), hit_cnt, ctx->thread_id, g_pangu_rt->local_logger, g_pangu_rt->scan_table_id[PXY_CTRL_HTTP_FQDN]);
if (scan_ret > 0)
{
hit_cnt += scan_ret;
}
free(addr_string);
}
const char * str_url = session->req->req_spec.url;
@@ -2359,20 +2357,19 @@ void pangu_on_http_begin(const struct tfe_stream * stream,
assert(ctx == NULL);
ATOMIC_INC(&(g_pangu_rt->stat_val[STAT_SESSION]));
ctx = pangu_http_ctx_new(thread_id);
char* addr_string=tfe_stream_addr_to_str(stream->addr);
scan_ret = tfe_scan_subscribe_id(stream, result, &(ctx->scan_mid), hit_cnt, ctx->thread_id, g_pangu_rt->local_logger, addr_string);
scan_ret = tfe_scan_subscribe_id(stream, result, &(ctx->scan_mid), hit_cnt, ctx->thread_id, g_pangu_rt->local_logger);
if(scan_ret>0)
{
hit_cnt+=scan_ret;
}
scan_ret = tfe_scan_ip_location(stream, result, &(ctx->scan_mid), hit_cnt, ctx->thread_id, g_pangu_rt->local_logger, addr_string, &(ctx->ip_ctx.location_server), &(ctx->ip_ctx.location_client));
scan_ret = tfe_scan_ip_location(stream, result, &(ctx->scan_mid), hit_cnt, ctx->thread_id, g_pangu_rt->local_logger, &(ctx->ip_ctx.location_server), &(ctx->ip_ctx.location_client));
if(scan_ret>0)
{
hit_cnt+=scan_ret;
}
scan_ret = tfe_scan_ip_asn(stream, result, &(ctx->scan_mid), hit_cnt, ctx->thread_id, g_pangu_rt->local_logger, addr_string, &(ctx->ip_ctx.asn_server), &(ctx->ip_ctx.asn_client));
scan_ret = tfe_scan_ip_asn(stream, result, &(ctx->scan_mid), hit_cnt, ctx->thread_id, g_pangu_rt->local_logger, &(ctx->ip_ctx.asn_server), &(ctx->ip_ctx.asn_client));
if(scan_ret>0)
{
hit_cnt+=scan_ret;
@@ -2404,7 +2401,6 @@ void pangu_on_http_begin(const struct tfe_stream * stream,
}
*pme = ctx;
free(addr_string);
return;
}