490 lines
22 KiB
C++
490 lines
22 KiB
C++
#include "logger.h"
|
||
|
||
struct json_spec
|
||
{
|
||
const char *log_filed_name;
|
||
enum tfe_http_std_field field_id;
|
||
};
|
||
|
||
enum _log_action //Bigger action number is prior.
|
||
{
|
||
LG_ACTION_NONE = 0x00,
|
||
LG_ACTION_MONIT = 0x01,
|
||
LG_ACTION_FORWARD = 0x02, /* N/A */
|
||
LG_ACTION_REJECT = 0x10,
|
||
LG_ACTION_DROP = 0x20, /* N/A */
|
||
LG_ACTION_MANIPULATE = 0x30,
|
||
LG_ACTION_RATELIMIT = 0x40, /* N/A */
|
||
LG_ACTION_LOOP = 0x60, /* N/A */
|
||
LG_ACTION_WHITELIST = 0x80,
|
||
__LG_ACTION_MAX
|
||
};
|
||
|
||
static int get_rr_str2json(cJSON *object, dns_info_t *dns_info, int *dns_sec)
|
||
{
|
||
int i = 0;
|
||
char ip_str[128];
|
||
dns_rr_t *dns_rr = NULL;
|
||
cJSON *one_rr_object = NULL;
|
||
cJSON *dns_rr_array = NULL;
|
||
|
||
if (object == NULL || dns_info == NULL || dns_sec == NULL)
|
||
{
|
||
return -1;
|
||
}
|
||
|
||
dns_rr_array = cJSON_CreateArray();
|
||
|
||
for (i = 0; i < dns_info->rr_count; i++)
|
||
{
|
||
one_rr_object = cJSON_CreateObject();
|
||
dns_rr = &(dns_info->rr[i]);
|
||
|
||
if (dns_rr->type == DNS_TYPE_OPT)
|
||
{
|
||
cJSON_AddStringToObject(one_rr_object, "name", (const char *)(dns_rr->name));
|
||
cJSON_AddNumberToObject(one_rr_object, "type", dns_rr->type);
|
||
cJSON_AddNumberToObject(one_rr_object, "udp_payload", dns_rr->rr_class);
|
||
cJSON_AddNumberToObject(one_rr_object, "rcode", (int)(dns_rr->ttl >> 24));
|
||
cJSON_AddNumberToObject(one_rr_object, "version", (int)((dns_rr->ttl >> 16) & 0xFF));
|
||
cJSON_AddNumberToObject(one_rr_object, "Z", (int)(dns_rr->ttl && 0xFFFF));
|
||
cJSON_AddNumberToObject(one_rr_object, "rdlength", dns_rr->rdlength);
|
||
}
|
||
else
|
||
{
|
||
cJSON_AddStringToObject(one_rr_object, "name", (const char *)(dns_rr->name));
|
||
cJSON_AddNumberToObject(one_rr_object, "type", dns_rr->type);
|
||
cJSON_AddNumberToObject(one_rr_object, "class", dns_rr->rr_class);
|
||
cJSON_AddNumberToObject(one_rr_object, "ttl", dns_rr->ttl);
|
||
cJSON_AddNumberToObject(one_rr_object, "rdlength", dns_rr->rdlength);
|
||
}
|
||
|
||
if (dns_rr->rdata.a == NULL)
|
||
{
|
||
cJSON_AddItemToArray(dns_rr_array, one_rr_object);
|
||
continue;
|
||
}
|
||
|
||
switch (dns_rr->type)
|
||
{
|
||
case DNS_TYPE_A:
|
||
inet_ntop(AF_INET, (void *)(dns_rr->rdata.a), ip_str, sizeof(ip_str));
|
||
cJSON_AddStringToObject(one_rr_object, "a", ip_str);
|
||
break;
|
||
case DNS_TYPE_NS:
|
||
cJSON_AddStringToObject(one_rr_object, "ns", (const char *)(dns_rr->rdata.ns));
|
||
break;
|
||
case DNS_TYPE_MD:
|
||
cJSON_AddStringToObject(one_rr_object, "md", (const char *)(dns_rr->rdata.md));
|
||
break;
|
||
case DNS_TYPE_MF:
|
||
cJSON_AddStringToObject(one_rr_object, "mf", (const char *)(dns_rr->rdata.mf));
|
||
break;
|
||
case DNS_TYPE_CNAME:
|
||
cJSON_AddStringToObject(one_rr_object, "cname", (const char *)(dns_rr->rdata.cname));
|
||
break;
|
||
case DNS_TYPE_SOA:
|
||
cJSON_AddStringToObject(one_rr_object, "mname", (const char *)(dns_rr->rdata.soa.mname));
|
||
cJSON_AddStringToObject(one_rr_object, "rname", (const char *)(dns_rr->rdata.soa.rname));
|
||
cJSON_AddNumberToObject(one_rr_object, "serial", dns_rr->rdata.soa.serial);
|
||
cJSON_AddNumberToObject(one_rr_object, "refresh", dns_rr->rdata.soa.refresh);
|
||
cJSON_AddNumberToObject(one_rr_object, "retry", dns_rr->rdata.soa.retry);
|
||
cJSON_AddNumberToObject(one_rr_object, "cname", dns_rr->rdata.soa.expire);
|
||
cJSON_AddNumberToObject(one_rr_object, "minimum", dns_rr->rdata.soa.minimum);
|
||
break;
|
||
case DNS_TYPE_MB:
|
||
cJSON_AddStringToObject(one_rr_object, "mb", (const char *)(dns_rr->rdata.mb));
|
||
break;
|
||
case DNS_TYPE_MG:
|
||
cJSON_AddStringToObject(one_rr_object, "mg", (const char *)(dns_rr->rdata.mg));
|
||
break;
|
||
case DNS_TYPE_MR:
|
||
cJSON_AddStringToObject(one_rr_object, "mr", (const char *)(dns_rr->rdata.mr));
|
||
break;
|
||
case DNS_TYPE_NULL:
|
||
cJSON_AddNumberToObject(one_rr_object, "size", dns_rr->rdata.null.size);
|
||
cJSON_AddStringToObject(one_rr_object, "null", (const char *)(dns_rr->rdata.null.null));
|
||
break;
|
||
case DNS_TYPE_WKS:
|
||
cJSON_AddStringToObject(one_rr_object, "addr", ip_str);
|
||
cJSON_AddNumberToObject(one_rr_object, "protocol", dns_rr->rdata.wks.protocol);
|
||
cJSON_AddStringToObject(one_rr_object, "bitmap", (const char *)(dns_rr->rdata.wks.bitmap));
|
||
cJSON_AddNumberToObject(one_rr_object, "size", dns_rr->rdata.wks.size);
|
||
break;
|
||
case DNS_TYPE_PTR:
|
||
cJSON_AddStringToObject(one_rr_object, "ptr", (const char *)(dns_rr->rdata.ptr));
|
||
break;
|
||
case DNS_TYPE_HINFO:
|
||
cJSON_AddStringToObject(one_rr_object, "cpu", (const char *)(dns_rr->rdata.hinfo.cpu));
|
||
cJSON_AddStringToObject(one_rr_object, "os", (const char *)(dns_rr->rdata.hinfo.os));
|
||
break;
|
||
case DNS_TYPE_MINFO:
|
||
cJSON_AddStringToObject(one_rr_object, "rmailbx", (const char *)(dns_rr->rdata.minfo.rmailbx));
|
||
cJSON_AddStringToObject(one_rr_object, "emailbx", (const char *)(dns_rr->rdata.minfo.emailbx));
|
||
break;
|
||
case DNS_TYPE_MX:
|
||
cJSON_AddStringToObject(one_rr_object, "exchange", (const char *)(dns_rr->rdata.mx.exchange));
|
||
cJSON_AddNumberToObject(one_rr_object, "preference", dns_rr->rdata.mx.preference);
|
||
break;
|
||
case DNS_TYPE_TXT:
|
||
cJSON_AddStringToObject(one_rr_object, "txt", (char *)(dns_rr->rdata.txt.txt));
|
||
cJSON_AddNumberToObject(one_rr_object, "size", dns_rr->rdata.txt.size);
|
||
break;
|
||
case DNS_TYPE_RP:
|
||
cJSON_AddStringToObject(one_rr_object, "mailbox", (char *)(dns_rr->rdata.rp.mailbox));
|
||
cJSON_AddStringToObject(one_rr_object, "txt_rr", (char *)(dns_rr->rdata.rp.txt_rr));
|
||
break;
|
||
case DNS_TYPE_AAAA:
|
||
inet_ntop(AF_INET6, dns_rr->rdata.aaaa, ip_str, sizeof(ip_str));
|
||
cJSON_AddStringToObject(one_rr_object, "aaaa", ip_str);
|
||
break;
|
||
case DNS_TYPE_OPT:
|
||
break;
|
||
case DNS_TYPE_DS:
|
||
*dns_sec = 2;
|
||
cJSON_AddNumberToObject(one_rr_object, "key_tag", dns_rr->rdata.ds.key_tag);
|
||
cJSON_AddNumberToObject(one_rr_object, "algo", dns_rr->rdata.ds.algo);
|
||
cJSON_AddNumberToObject(one_rr_object, "digest_type", dns_rr->rdata.ds.digest_type);
|
||
cJSON_AddStringToObject(one_rr_object, "digest", (char *)(dns_rr->rdata.ds.digest));
|
||
break;
|
||
case DNS_TYPE_RRSIG:
|
||
*dns_sec = 2;
|
||
cJSON_AddNumberToObject(one_rr_object, "type_covered", dns_rr->rdata.rrsig.type_covered);
|
||
cJSON_AddNumberToObject(one_rr_object, "algo", dns_rr->rdata.rrsig.algo);
|
||
cJSON_AddNumberToObject(one_rr_object, "labels", dns_rr->rdata.rrsig.labels);
|
||
cJSON_AddNumberToObject(one_rr_object, "original_ttl", dns_rr->rdata.rrsig.original_ttl);
|
||
cJSON_AddNumberToObject(one_rr_object, "sig_expiration", dns_rr->rdata.rrsig.sig_expiration);
|
||
cJSON_AddNumberToObject(one_rr_object, "sig_inception", dns_rr->rdata.rrsig.sig_inception);
|
||
cJSON_AddNumberToObject(one_rr_object, "key_tag", dns_rr->rdata.rrsig.key_tag);
|
||
cJSON_AddStringToObject(one_rr_object, "signer_name", (const char *)(dns_rr->rdata.rrsig.signer_name));
|
||
cJSON_AddStringToObject(one_rr_object, "signature", (char *)(dns_rr->rdata.rrsig.signature));
|
||
break;
|
||
case DNS_TYPE_NSEC:
|
||
*dns_sec = 2;
|
||
cJSON_AddStringToObject(one_rr_object, "next_domain", (const char *)(dns_rr->rdata.nsec.next_domain));
|
||
cJSON_AddStringToObject(one_rr_object, "type_bit_maps", (char *)(dns_rr->rdata.nsec.type_bit_maps));
|
||
break;
|
||
case DNS_TYPE_DNSKEY:
|
||
*dns_sec = 2;
|
||
cJSON_AddNumberToObject(one_rr_object, "flags", dns_rr->rdata.dnskey.flags);
|
||
cJSON_AddNumberToObject(one_rr_object, "protocol", dns_rr->rdata.dnskey.protocol);
|
||
cJSON_AddNumberToObject(one_rr_object, "algo", dns_rr->rdata.dnskey.algo);
|
||
cJSON_AddStringToObject(one_rr_object, "public_key", (char *)(dns_rr->rdata.dnskey.public_key));
|
||
break;
|
||
case DNS_TYPE_NSEC3:
|
||
*dns_sec = 2;
|
||
cJSON_AddNumberToObject(one_rr_object, "hash_algo", dns_rr->rdata.nsec3.hash_algo);
|
||
cJSON_AddNumberToObject(one_rr_object, "flags", dns_rr->rdata.nsec3.flags);
|
||
cJSON_AddNumberToObject(one_rr_object, "iteration", dns_rr->rdata.nsec3.iteration);
|
||
cJSON_AddNumberToObject(one_rr_object, "salt_len", dns_rr->rdata.nsec3.salt_len);
|
||
cJSON_AddNumberToObject(one_rr_object, "hash_len", dns_rr->rdata.nsec3.hash_len);
|
||
cJSON_AddStringToObject(one_rr_object, "salt_value", (char *)(dns_rr->rdata.nsec3.salt_value));
|
||
cJSON_AddStringToObject(one_rr_object, "next_hash_owner", (char *)(dns_rr->rdata.nsec3.next_hash_owner));
|
||
cJSON_AddStringToObject(one_rr_object, "type_bit_maps", (char *)(dns_rr->rdata.nsec3.type_bit_maps));
|
||
break;
|
||
case DNS_TYPE_NSEC3PARAM:
|
||
cJSON_AddNumberToObject(one_rr_object, "hash_algo", dns_rr->rdata.nsec3param.hash_algo);
|
||
cJSON_AddNumberToObject(one_rr_object, "flags", dns_rr->rdata.nsec3param.flags);
|
||
cJSON_AddNumberToObject(one_rr_object, "iteration", dns_rr->rdata.nsec3param.iteration);
|
||
cJSON_AddNumberToObject(one_rr_object, "salt_len", dns_rr->rdata.nsec3param.salt_len);
|
||
cJSON_AddStringToObject(one_rr_object, "salt_value", (char *)(dns_rr->rdata.nsec3param.salt_value));
|
||
break;
|
||
case DNS_QTYPE_AXFR:
|
||
break;
|
||
case DNS_QTYPE_MAILB:
|
||
continue;
|
||
break;
|
||
case DNS_QTYPE_MAILA:
|
||
break;
|
||
case DNS_QTYPE_ANY:
|
||
break;
|
||
default:
|
||
break;
|
||
}
|
||
|
||
cJSON_AddItemToArray(dns_rr_array, one_rr_object);
|
||
}
|
||
|
||
cJSON_AddItemToObject(object, "rr", dns_rr_array);
|
||
|
||
return 0;
|
||
}
|
||
|
||
static void add_dns_info_to_log(cJSON *common_obj, dns_info_t *dns_info)
|
||
{
|
||
int i = 0;
|
||
dns_rr_t *rr = NULL;
|
||
int dns_sec = 1;
|
||
char *cname = NULL, *rr_buf = NULL;
|
||
|
||
cJSON_AddNumberToObject(common_obj, "doh_qr", dns_info->hdr_info.qr);
|
||
cJSON_AddNumberToObject(common_obj, "doh_aa", dns_info->hdr_info.aa);
|
||
cJSON_AddNumberToObject(common_obj, "doh_message_id", dns_info->hdr_info.id);
|
||
cJSON_AddNumberToObject(common_obj, "doh_opcode", dns_info->hdr_info.opcode);
|
||
cJSON_AddNumberToObject(common_obj, "doh_ra", dns_info->hdr_info.ra);
|
||
cJSON_AddNumberToObject(common_obj, "doh_rcode", dns_info->hdr_info.rcode);
|
||
cJSON_AddNumberToObject(common_obj, "doh_rd", dns_info->hdr_info.rd);
|
||
cJSON_AddNumberToObject(common_obj, "doh_tc", dns_info->hdr_info.tc);
|
||
cJSON_AddNumberToObject(common_obj, "doh_qdcount", dns_info->hdr_info.qdcount);
|
||
cJSON_AddNumberToObject(common_obj, "doh_ancount", dns_info->hdr_info.ancount);
|
||
cJSON_AddNumberToObject(common_obj, "doh_nscount", dns_info->hdr_info.aucount);
|
||
cJSON_AddNumberToObject(common_obj, "doh_arcount", dns_info->hdr_info.adcount);
|
||
|
||
if ((strlen((char *)dns_info->query_question.qname)) > 0)
|
||
{
|
||
cJSON_AddStringToObject(common_obj, "doh_qname", (char *)dns_info->query_question.qname);
|
||
cJSON_AddNumberToObject(common_obj, "doh_qtype", dns_info->query_question.qtype);
|
||
cJSON_AddNumberToObject(common_obj, "doh_qclass", dns_info->query_question.qclass);
|
||
}
|
||
|
||
cJSON *item = NULL;
|
||
cJSON *cname_array = cJSON_CreateArray();
|
||
for (i = 0; i < dns_info->rr_count && dns_info->rr != NULL; i++)
|
||
{
|
||
rr = &dns_info->rr[i];
|
||
if (rr != NULL && rr->type == DNS_TYPE_CNAME)
|
||
{
|
||
if (rr->rdata.cname != NULL)
|
||
{
|
||
item = cJSON_CreateString((const char *)rr->rdata.cname);
|
||
cJSON_AddItemToArray(cname_array, item);
|
||
}
|
||
}
|
||
}
|
||
|
||
cname = cJSON_PrintUnformatted(cname_array);
|
||
if (cname)
|
||
{
|
||
if (strlen(cname) > 0)
|
||
{
|
||
cJSON_AddStringToObject(common_obj, "doh_cname", cname);
|
||
}
|
||
free(cname);
|
||
}
|
||
cJSON_Delete(cname_array);
|
||
cname_array = NULL;
|
||
|
||
cJSON *object = cJSON_CreateObject();
|
||
get_rr_str2json(object, dns_info, &dns_sec);
|
||
rr_buf = cJSON_PrintUnformatted(object);
|
||
cJSON_AddStringToObject(common_obj, "doh_rr", rr_buf);
|
||
free(rr_buf);
|
||
rr_buf = NULL;
|
||
cJSON_Delete(object);
|
||
object = NULL;
|
||
|
||
cJSON_AddNumberToObject(common_obj, "doh_sub", dns_sec);
|
||
}
|
||
|
||
int doh_kafka_init(const char *profile, struct doh_conf *conf)
|
||
{
|
||
const char *section = "kafka";
|
||
MESA_load_profile_int_def(profile, section, "ENTRANCE_ID", &(conf->entry_id), 0);
|
||
MESA_load_profile_int_def(profile, section, "en_sendlog", &conf->en_sendlog, 1);
|
||
if (!conf->en_sendlog)
|
||
{
|
||
return 0;
|
||
}
|
||
conf->device_id = (const char *)tfe_bussiness_resouce_get(DEVICE_ID);
|
||
conf->effective_device_tag = (const char *)tfe_bussiness_resouce_get(EFFECTIVE_DEVICE_TAG);
|
||
conf->kafka_logger = (tfe_kafka_logger_t *)tfe_bussiness_resouce_get(KAFKA_LOGGER);
|
||
if (conf->kafka_logger && !conf->kafka_logger->enable)
|
||
{
|
||
TFE_LOG_ERROR(conf->local_logger, "Doh sendlog ENABLE, but tfe kafka logger DISABLED.");
|
||
return -1;
|
||
}
|
||
|
||
return 0;
|
||
}
|
||
|
||
int doh_send_log(struct doh_conf *handle, const struct tfe_http_session *http, const struct tfe_stream *stream, struct doh_ctx *ctx)
|
||
{
|
||
Maat_rule_t *result = ctx->result;
|
||
size_t result_num = ctx->result_num;
|
||
dns_info_t *dns_info = ctx->doh_req;
|
||
const struct tfe_stream_addr *addr = stream->addr;
|
||
const char *tmp_val = NULL;
|
||
cJSON *common_obj = NULL, *per_hit_obj = NULL;
|
||
char *log_payload = NULL;
|
||
int kafka_status = 0;
|
||
int send_cnt = 0;
|
||
time_t cur_time;
|
||
char src_ip_str[MAX(INET6_ADDRSTRLEN, INET_ADDRSTRLEN)] = {0};
|
||
char dst_ip_str[MAX(INET6_ADDRSTRLEN, INET_ADDRSTRLEN)] = {0};
|
||
|
||
const char *app_proto[] = {"unkonw", "http1", "http2"};
|
||
struct json_spec req_fields[] = {{"doh_cookie", TFE_HTTP_COOKIE},
|
||
{"doh_referer", TFE_HTTP_REFERER},
|
||
{"doh_user_agent", TFE_HTTP_USER_AGENT}};
|
||
struct json_spec resp_fields[] = {{"doh_content_type", TFE_HTTP_CONT_TYPE},
|
||
{"doh_content_length", TFE_HTTP_CONT_LENGTH},
|
||
{"doh_set_cookie", TFE_HTTP_SET_COOKIE}};
|
||
|
||
if (!handle->en_sendlog)
|
||
{
|
||
return 0;
|
||
}
|
||
|
||
common_obj = cJSON_CreateObject();
|
||
cur_time = time(NULL);
|
||
|
||
cJSON_AddNumberToObject(common_obj, "common_start_time", cur_time);
|
||
cJSON_AddNumberToObject(common_obj, "common_end_time", cur_time);
|
||
cJSON_AddStringToObject(common_obj, "doh_version", app_proto[http->major_version]);
|
||
cJSON_AddStringToObject(common_obj, "common_schema_type", "DoH");
|
||
|
||
char opt_val[24] = { 0 };
|
||
uint16_t opt_out_size; unsigned int common_direction=0;
|
||
struct tfe_cmsg *cmsg = tfe_stream_get0_cmsg(stream);
|
||
if (cmsg != NULL)
|
||
{
|
||
int ret = tfe_cmsg_get_value(cmsg, TFE_CMSG_STREAM_TRACE_ID, (unsigned char *)opt_val, sizeof(opt_val), &opt_out_size);
|
||
if (ret == 0)
|
||
{
|
||
cJSON_AddStringToObject(common_obj, "common_stream_trace_id", opt_val);
|
||
}
|
||
ret = tfe_cmsg_get_value(cmsg, TFE_CMSG_COMMON_DIRECTION, (unsigned char *)&common_direction, sizeof(common_direction), &opt_out_size);
|
||
if (ret==0)
|
||
{
|
||
cJSON_AddNumberToObject(common_obj, "common_direction", common_direction); //0：域内->域外，1：域外->域内，描述的是CLIENT_IP信息
|
||
}
|
||
}
|
||
|
||
if (http->req)
|
||
{
|
||
char *request_line = NULL;
|
||
struct tfe_http_req_spec req_spec = http->req->req_spec;
|
||
asprintf(&request_line, "%s %s HTTP/%d.%d", http_std_method_to_string(req_spec.method), req_spec.url, http->major_version, http->minor_version);
|
||
cJSON_AddStringToObject(common_obj, "doh_request_line", request_line);
|
||
free(request_line);
|
||
}
|
||
|
||
if (http->resp)
|
||
{
|
||
char *response_line = NULL;
|
||
struct tfe_http_resp_spec resp_spec = http->resp->resp_spec;
|
||
asprintf(&response_line, "HTTP/%d.%d %d OK", http->major_version, http->minor_version, resp_spec.resp_code);
|
||
cJSON_AddStringToObject(common_obj, "doh_response_line", response_line);
|
||
free(response_line);
|
||
}
|
||
|
||
switch (addr->addrtype)
|
||
{
|
||
case TFE_ADDR_STREAM_TUPLE4_V4:
|
||
cJSON_AddNumberToObject(common_obj, "common_address_type", 4);
|
||
inet_ntop(AF_INET, &addr->tuple4_v4->saddr, src_ip_str, sizeof(src_ip_str));
|
||
inet_ntop(AF_INET, &addr->tuple4_v4->daddr, dst_ip_str, sizeof(dst_ip_str));
|
||
cJSON_AddStringToObject(common_obj, "common_client_ip", src_ip_str);
|
||
cJSON_AddStringToObject(common_obj, "common_server_ip", dst_ip_str);
|
||
cJSON_AddNumberToObject(common_obj, "common_client_port", ntohs(addr->tuple4_v4->source));
|
||
cJSON_AddNumberToObject(common_obj, "common_server_port", ntohs(addr->tuple4_v4->dest));
|
||
cJSON_AddStringToObject(common_obj, "common_l4_protocol", "IPv4_TCP");
|
||
break;
|
||
case TFE_ADDR_STREAM_TUPLE4_V6:
|
||
cJSON_AddNumberToObject(common_obj, "common_address_type", 6);
|
||
inet_ntop(AF_INET6, &addr->tuple4_v6->saddr, src_ip_str, sizeof(src_ip_str));
|
||
inet_ntop(AF_INET6, &addr->tuple4_v6->daddr, dst_ip_str, sizeof(dst_ip_str));
|
||
cJSON_AddStringToObject(common_obj, "common_client_ip", src_ip_str);
|
||
cJSON_AddStringToObject(common_obj, "common_server_ip", dst_ip_str);
|
||
cJSON_AddNumberToObject(common_obj, "common_client_port", ntohs(addr->tuple4_v6->source));
|
||
cJSON_AddNumberToObject(common_obj, "common_server_port", ntohs(addr->tuple4_v6->dest));
|
||
cJSON_AddStringToObject(common_obj, "common_l4_protocol", "IPv6_TCP");
|
||
break;
|
||
default:
|
||
break;
|
||
}
|
||
size_t c2s_byte_num = 0, s2c_byte_num = 0;
|
||
tfe_stream_info_get(stream, INFO_FROM_DOWNSTREAM_RX_OFFSET, &c2s_byte_num, sizeof(c2s_byte_num));
|
||
tfe_stream_info_get(stream, INFO_FROM_UPSTREAM_RX_OFFSET, &s2c_byte_num, sizeof(s2c_byte_num));
|
||
|
||
cJSON_AddNumberToObject(common_obj, "common_link_id", 0);
|
||
cJSON_AddNumberToObject(common_obj, "common_stream_dir", 3); //1:c2s, 2:s2c, 3:double
|
||
cJSON_AddStringToObject(common_obj, "common_sled_ip", handle->kafka_logger->local_ip_str);
|
||
cJSON_AddNumberToObject(common_obj, "common_vsys_id", handle->kafka_logger->vsys_id);
|
||
cJSON_AddNumberToObject(common_obj, "common_entrance_id", handle->entry_id);
|
||
cJSON_AddStringToObject(common_obj, "common_device_id", handle->device_id);
|
||
cJSON_AddNumberToObject(common_obj, "common_c2s_byte_num", c2s_byte_num);
|
||
cJSON_AddNumberToObject(common_obj, "common_s2c_byte_num", s2c_byte_num);
|
||
cJSON_AddStringToObject(common_obj, "doh_url", http->req->req_spec.url);
|
||
cJSON_AddStringToObject(common_obj, "doh_host", http->req->req_spec.host);
|
||
if(handle->effective_device_tag)
|
||
{
|
||
cJSON_AddStringToObject(common_obj, "common_device_tag", handle->effective_device_tag);
|
||
}
|
||
|
||
for (size_t i = 0; i < sizeof(req_fields) / sizeof(struct json_spec); i++)
|
||
{
|
||
tmp_val = tfe_http_std_field_read(http->req, req_fields[i].field_id);
|
||
if (tmp_val != NULL)
|
||
{
|
||
cJSON_AddStringToObject(common_obj, req_fields[i].log_filed_name, tmp_val);
|
||
}
|
||
}
|
||
for (size_t i = 0; i < sizeof(resp_fields) / sizeof(struct json_spec) && http->resp != NULL; i++)
|
||
{
|
||
tmp_val = tfe_http_std_field_read(http->resp, resp_fields[i].field_id);
|
||
if (tmp_val != NULL)
|
||
{
|
||
cJSON_AddStringToObject(common_obj, resp_fields[i].log_filed_name, tmp_val);
|
||
}
|
||
}
|
||
|
||
if (ctx->location_client)
|
||
{
|
||
cJSON_AddStringToObject(common_obj, "common_client_location", ctx->location_client);
|
||
}
|
||
if (ctx->location_server)
|
||
{
|
||
cJSON_AddStringToObject(common_obj, "common_server_location", ctx->location_server);
|
||
}
|
||
if (ctx->asn_client)
|
||
{
|
||
cJSON_AddStringToObject(common_obj, "common_client_asn", ctx->asn_client);
|
||
}
|
||
if (ctx->asn_server)
|
||
{
|
||
cJSON_AddStringToObject(common_obj, "common_server_asn", ctx->asn_server);
|
||
}
|
||
|
||
add_dns_info_to_log(common_obj, dns_info);
|
||
for (size_t i = 0; i < result_num; i++)
|
||
{
|
||
|
||
TFE_LOG_DEBUG(handle->local_logger, "URL: %s, policy_id: %d, service: %d, do_log:%d",
|
||
http->req->req_spec.url,
|
||
result[i].config_id,
|
||
result[i].service_id,
|
||
result[i].do_log);
|
||
|
||
if (result[i].do_log == 0)
|
||
{
|
||
continue;
|
||
}
|
||
|
||
per_hit_obj = cJSON_Duplicate(common_obj, 1);
|
||
cJSON_AddNumberToObject(per_hit_obj, "common_policy_id", result[i].config_id);
|
||
cJSON_AddNumberToObject(per_hit_obj, "common_service", result[i].service_id);
|
||
cJSON_AddNumberToObject(per_hit_obj, "common_action", LG_ACTION_MANIPULATE);
|
||
cJSON_AddStringToObject(per_hit_obj, "common_sub_action", "redirect");
|
||
|
||
log_payload = cJSON_PrintUnformatted(per_hit_obj);
|
||
|
||
TFE_LOG_DEBUG(handle->local_logger, "%s", log_payload);
|
||
|
||
kafka_status = tfe_kafka_logger_send(handle->kafka_logger, log_payload, strlen(log_payload));
|
||
free(log_payload);
|
||
cJSON_Delete(per_hit_obj);
|
||
if (kafka_status < 0)
|
||
{
|
||
TFE_LOG_ERROR(handle->local_logger, "Kafka produce failed: %s", rd_kafka_err2name(rd_kafka_last_error()));
|
||
}
|
||
else
|
||
{
|
||
send_cnt++;
|
||
}
|
||
}
|
||
|
||
cJSON_Delete(common_obj);
|
||
return send_cnt;
|
||
}
|