gfwleak/tango-tfe
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

完成pangu http发送业务日志功能开发。

Browse Source
This commit is contained in:
zhengchao
2018-09-15 17:52:06 +08:00
parent 254f3fbbd1
commit d83e978643
3 changed files with 181 additions and 160 deletions
Download Patch File Download Diff File Expand all files Collapse all files

133
plugin/business/pangu-http/pangu_http.cpp
View File

@@ -201,11 +201,11 @@ struct pangu_http_ctx
char* action_para;
scan_status_t mid;
stream_para_t sp;
struct Maat_rule_t* exec_rule;
struct Maat_rule_t* monit_rule;
int monit_num;
char* exec_para;
struct Maat_rule_t* enforce_rules;
size_t n_enforce;
char* enforce_para;
struct replace_ctx *rep_ctx;
int thread_id;
};
@@ -230,11 +230,14 @@ static void pangu_http_ctx_free(struct pangu_http_ctx* ctx)
ctx->rep_ctx->http_body=NULL;
//todo destroy http_half;
assert(ctx->rep_ctx->replacing==NULL);
FREE(&(ctx->rep_ctx));
FREE(&ctx->rep_ctx);
}
FREE(&ctx->enforce_rules);
FREE(&ctx->enforce_para);
Maat_clean_status(&(ctx->mid));
assert(ctx->sp==NULL);
ctx->mid=NULL;
free(ctx);
FREE(&ctx);
}
inline void addr_tfe2sapp(const struct tfe_stream_addr* tfe_addr, struct ipaddr* sapp_addr)
{
@@ -243,41 +246,31 @@ inline void addr_tfe2sapp(const struct tfe_stream_addr* tfe_addr, struct ipaddr*
return;
}
/*
20180909记录
1）const char * tfe_http_field_iterate(const struct tfe_http_half * half, void * interator, struct http_field_name * name); void**?
2)http入口函数返回值增加 enum tfe_bussiness_action
3)struct http_field_name中的field_name内存是如何分配到？
4）http对上层要暴露evbuffer吗？
5） uint64_t cont_len;
uint64_t cont_range_from;
uint64_t cont_range_to;
需要保留吗？accept_encoding?
6）entry函数中缺少thread id;
7) plugin init and deinit cb;
8) add http session open and close cb;
9)enum tfe_bussiness_action pangu_http_entry(const struct tfe_stream * stream, const struct tfe_http_session * session,
uint64_t event, const char* body_frag, size_t frag_size, unsigned int thread_id void ** pme)
*/
static enum pangu_action decide_ctrl_action(const Maat_rule_t* hit_result,int cnt,const Maat_rule_t**enforce_rule)
//enforce_rules[0] contains execute action.
static enum pangu_action decide_ctrl_action(const struct Maat_rule_t* hit_rules,size_t n_hit,
struct Maat_rule_t**enforce_rules, size_t* n_enforce)
{
int i=0;
const Maat_rule_t* tmp_rule=hit_result;
enum pangu_action tmp_action=PG_ACTION_NONE;
for(i=0;i<cnt;i++)
size_t n_monit=0, exist_enforce_num=0,i=0;
const struct Maat_rule_t* prior_rule=hit_rules;
struct Maat_rule_t monit_rule[n_hit];
enum pangu_action prior_action=PG_ACTION_NONE;
for(i=0;i<n_hit;i++)
{
if((enum pangu_action)hit_result[i].action>tmp_action)
if((enum pangu_action)hit_rules[i].action==PG_ACTION_MONIT)
{
tmp_rule=hit_result+i;
tmp_action=(enum pangu_action)hit_result[i].action;
memcpy(monit_rule+n_monit,hit_rules+i, sizeof(struct Maat_rule_t));
n_monit++;
}
else if((enum pangu_action)hit_result[i].action==tmp_action)
if((enum pangu_action)hit_rules[i].action>prior_action)
{
if(hit_result[i].config_id<tmp_rule->config_id)
prior_rule=hit_rules+i;
prior_action=(enum pangu_action)hit_rules[i].action;
}
else if((enum pangu_action)hit_rules[i].action==prior_action)
{
if(hit_rules[i].config_id<prior_rule->config_id)
{
tmp_rule=hit_result+i;
prior_rule=hit_rules+i;
}
}
@@ -286,8 +279,26 @@ static enum pangu_action decide_ctrl_action(const Maat_rule_t* hit_result,int cn
continue;
}
}
*enforce_rule=tmp_rule;
return tmp_action;
if(prior_action==PG_ACTION_WHITELIST)
{
return PG_ACTION_WHITELIST;
}
exist_enforce_num=*n_enforce;
if(prior_action==PG_ACTION_MONIT)
{
*n_enforce+=n_monit;
}
else
{
*n_enforce+=n_monit+1;
}
*enforce_rules=(struct Maat_rule_t*)realloc(*enforce_rules, sizeof(struct Maat_rule_t)*(*n_enforce));
memcpy(*enforce_rules+exist_enforce_num, prior_rule, sizeof(struct Maat_rule_t));
memcpy(*enforce_rules+exist_enforce_num+1, monit_rule, n_monit*sizeof(struct Maat_rule_t));
return prior_action;
}
//https://github.com/AndiDittrich/HttpErrorPages
static void html_generate(const char* enforce_para, char** page_buff,size_t *page_size)
@@ -556,7 +567,7 @@ void http_replace(const struct tfe_stream * stream, const struct tfe_http_sessio
{
ctx->rep_ctx=rep_ctx=ALLOC(struct replace_ctx, 1);
rep_ctx->rule=ALLOC(struct replace_rule, MAX_EDIT_ZONE_NUM);
rep_ctx->n_rule=format_replace_rule(ctx->exec_para, rep_ctx->rule, MAX_EDIT_ZONE_NUM);
rep_ctx->n_rule=format_replace_rule(ctx->enforce_para, rep_ctx->rule, MAX_EDIT_ZONE_NUM);
}
if(events&EV_HTTP_REQ_HDR)
{
@@ -653,17 +664,17 @@ static void http_reject(const struct tfe_http_session * session, uint64_t events
char cont_len_str[TFE_STRING_MAX];
struct tfe_http_session* to_write_sess=NULL;
ret=sscanf(ctx->exec_para,"code=%d;",&resp_code);
ret=sscanf(ctx->enforce_para,"code=%d;",&resp_code);
if(ret!=1)
{
TFE_LOG_ERROR(g_pangu_rt->local_logger, "Invalid reject rule %d paramter %s",
ctx->exec_rule->config_id, ctx->exec_para);
ctx->enforce_rules->config_id, ctx->enforce_para);
goto error_out;
}
to_write_sess=tfe_http_session_allow_write(session);
response=tfe_http_session_response_create(to_write_sess, resp_code);
html_generate(ctx->exec_para, &page_buff, &page_size);
html_generate(ctx->enforce_para, &page_buff, &page_size);
_wrap_std_field_write(response, TFE_HTTP_CONT_TYPE, "text/html; charset=utf-8");
snprintf(cont_len_str,sizeof(cont_len_str), "%lu", page_size);
_wrap_std_field_write(response, TFE_HTTP_CONT_LENGTH, cont_len_str);
@@ -680,12 +691,12 @@ static void http_redirect(const struct tfe_http_session * session, uint64_t even
char* url=NULL;
struct tfe_http_half* response=NULL;
struct tfe_http_session* to_write=NULL;
url=ALLOC(char, ctx->exec_rule->serv_def_len);
ret=sscanf(ctx->exec_para,"code=%d%[^;];url=%*[^;];",&resp_code,url);
url=ALLOC(char, ctx->enforce_rules->serv_def_len);
ret=sscanf(ctx->enforce_para,"code=%d%[^;];url=%*[^;];",&resp_code,url);
if(ret!=2)
{
TFE_LOG_ERROR(g_pangu_rt->local_logger, "Invalid redirect rule %d paramter %s",
ctx->exec_rule->config_id, ctx->exec_para);
ctx->enforce_rules->config_id, ctx->enforce_para);
goto error_out;
}
@@ -707,10 +718,9 @@ enum pangu_action http_scan(const struct tfe_http_session * session, uint64_t ev
const char* field_val=NULL;
struct http_field_name field_name;
struct Maat_rule_t result[MAX_SCAN_RESULT];
const struct Maat_rule_t* choosen=NULL;
char buff[TFE_STRING_MAX], *p=NULL;
int scan_ret=0, hit_cnt=0, table_id=0, read_rule_ret=0;
unsigned int i=0;
int scan_ret=0, table_id=0, read_rule_ret=0;
size_t hit_cnt=0, i=0;
if(events&EV_HTTP_REQ_HDR)
{
scan_ret=Maat_full_scan_string(g_pangu_rt->maat, g_pangu_rt->scan_table_id[PXY_CTRL_HTTP_URL],
@@ -765,26 +775,24 @@ enum pangu_action http_scan(const struct tfe_http_session * session, uint64_t ev
}
if(hit_cnt>0)
{
ctx->action=decide_ctrl_action(result, hit_cnt, &choosen);
ctx->exec_rule=ALLOC(struct Maat_rule_t, 1);
memcpy(ctx->exec_rule, choosen, sizeof(struct Maat_rule_t));
if(ctx->exec_rule->serv_def_len>MAX_SERVICE_DEFINE_LEN)
ctx->action=decide_ctrl_action(result, hit_cnt, &ctx->enforce_rules, &ctx->n_enforce);
if(ctx->enforce_rules[0].serv_def_len>MAX_SERVICE_DEFINE_LEN)
{
ctx->exec_para=ALLOC(char, ctx->exec_rule->serv_def_len);
read_rule_ret=Maat_read_rule(g_pangu_rt->maat, ctx->exec_rule,
MAAT_RULE_SERV_DEFINE, ctx->exec_para, ctx->exec_rule->serv_def_len);
assert(read_rule_ret== ctx->exec_rule->serv_def_len);
ctx->enforce_para=ALLOC(char, ctx->enforce_rules->serv_def_len);
read_rule_ret=Maat_read_rule(g_pangu_rt->maat, ctx->enforce_rules+0,
MAAT_RULE_SERV_DEFINE, ctx->enforce_para, ctx->enforce_rules[0].serv_def_len);
assert(read_rule_ret== ctx->enforce_rules[0].serv_def_len);
}
if(hit_cnt>1)
{
p=buff;
for(i=0;i<(unsigned int)hit_cnt;i++)
for(i=0;i<hit_cnt;i++)
{
p+=snprintf(p, sizeof(buff)-(p-buff), "%d:", result[i].config_id);
}
*p='\0';
TFE_LOG_INFO(g_pangu_rt->local_logger, "Multiple rules matched: url=%s num=%d ids=%s execute=%d.",
session->req->req_spec.url, hit_cnt, buff, ctx->exec_rule->config_id);
TFE_LOG_INFO(g_pangu_rt->local_logger, "Multiple rules matched: url=%s num=%lu ids=%s execute=%d.",
session->req->req_spec.url, hit_cnt, buff, ctx->enforce_rules[0].config_id);
}
}
return ctx->action;
@@ -796,7 +804,6 @@ void pangu_on_http_begin(const struct tfe_stream * stream,
{
struct pangu_http_ctx* ctx=*(struct pangu_http_ctx**)pme;
struct Maat_rule_t result[MAX_SCAN_RESULT];
const struct Maat_rule_t* choosen=NULL;
struct ipaddr sapp_addr;
int hit_cnt=0;
assert(ctx==NULL);
@@ -806,7 +813,7 @@ void pangu_on_http_begin(const struct tfe_stream * stream,
result, MAX_SCAN_RESULT, &(ctx->mid), (int)thread_id);
if(hit_cnt>0)
{
ctx->action=decide_ctrl_action(result, hit_cnt, &choosen);
ctx->action=decide_ctrl_action(result, hit_cnt, &ctx->enforce_rules, &ctx->n_enforce);
}
if(ctx->action==PG_ACTION_WHITELIST)
{
@@ -820,10 +827,10 @@ void pangu_on_http_end(const struct tfe_stream * stream,
{
struct pangu_http_ctx* ctx=*(struct pangu_http_ctx**)pme;
struct pangu_log log_msg={.stream=stream, .http=session, .result=ctx->exec_rule, .result_num=1};
struct pangu_log log_msg={.stream=stream, .http=session, .result=ctx->enforce_rules, .result_num=1};
if(ctx->action!=PG_ACTION_NONE)
{
pangu_log_send(g_pangu_rt->send_logger, &log_msg, NULL, 0);
pangu_log_send(g_pangu_rt->send_logger, &log_msg);
}
pangu_http_ctx_free(ctx);
*pme=NULL;