diff --git a/bin/tsg_log_field.conf b/bin/tsg_log_field.conf index 574e7d9..3a5b7f8 100644 --- a/bin/tsg_log_field.conf +++ b/bin/tsg_log_field.conf @@ -117,7 +117,8 @@ STRING http_response_body 104 STRING mail_eml_file 105 LONG common_vsys_id 106 STRING dtls_sni 107 -STRING common_tunnel_endpoint_a_desc 108 -STRING common_tunnel_endpoint_b_desc 109 -LONG common_t_vsys_id 110 -STRING common_app_full_path 111 \ No newline at end of file +STRING common_tunnel_endpoint_a_desc 108 +STRING common_tunnel_endpoint_b_desc 109 +LONG common_t_vsys_id 110 +STRING common_app_full_path 111 +LONG common_flags 112 diff --git a/bin/tsg_static_tableinfo.conf b/bin/tsg_static_tableinfo.conf index 4c0371d..d76ed27 100644 --- a/bin/tsg_static_tableinfo.conf +++ b/bin/tsg_static_tableinfo.conf @@ -89,3 +89,5 @@ 77 TSG_TUNNEL_ENDPOINT ip_plugin {"row_id":1,"ip_type":2,"start_ip":3,"end_ip":4,"valid":6,"estimate_size":4194304} 78 TSG_TUNNEL_LABEL plugin {"key":2,"valid":3} -- 79 TSG_SECURITY_TUNNEL virtual TSG_OBJ_TUNNEL_ID -- +80 TSG_OBJ_FLAG flag -- +81 TSG_SECURITY_FLAG virtual TSG_OBJ_FLAG -- \ No newline at end of file diff --git a/src/tsg_entry.cpp b/src/tsg_entry.cpp index 131175d..a34f93e 100644 --- a/src/tsg_entry.cpp +++ b/src/tsg_entry.cpp @@ -686,6 +686,9 @@ static int master_send_log(const struct streaminfo *a_stream, struct Maat_rule_t TLD_append(TLD_handle, schema_field_name, (void *)g_tsg_proto_name2id[PROTO_APP].name, TLD_TYPE_STRING); } + char *flags_field_name=log_field_id2name(g_tsg_log_instance, LOG_COMMON_FLAGS); + TLD_append(TLD_handle, flags_field_name, (void *)context->session_flag, TLD_TYPE_LONG); + if(context!=NULL && context->hited_app_id>0) { char app_label_name[512]={0}; @@ -1892,6 +1895,32 @@ static int app_identify_result_cb(const struct streaminfo *a_stream, int bridge_ return 0; } +static int session_flags_identify_result_cb(const struct streaminfo *a_stream, int bridge_id, void *data) +{ + if(data==NULL) + { + return 0; + } + + struct master_context *context=NULL; + struct Maat_rule_t scan_result[MAX_RESULT_NUM]={0}; + + context=(struct master_context *)get_struct_project(a_stream, g_tsg_para.context_project_id); + if(context==NULL) + { + init_context((void **)(&context), a_stream->threadnum); + set_struct_project(a_stream, g_tsg_para.context_project_id, (void *)context); + } + + context->session_flag=*(unsigned long *)(data); + + int hit_num=tsg_scan_session_flags(g_tsg_maat_feather, a_stream, scan_result, MAX_RESULT_NUM, &context->mid, g_tsg_para.table_id[TABLE_SESSION_FLAGS], context->session_flag, a_stream->threadnum); + + master_deal_scan_result(a_stream, context, scan_result, hit_num, NULL); + + return 0; +} + static int deal_pending_state(const struct streaminfo *a_stream, struct master_context *context, struct Maat_rule_t *result, int result_num, void *a_packet) { @@ -2010,6 +2039,7 @@ static unsigned char tsg_master_data_entry(const struct streaminfo *a_stream, vo if(is_hited_allow(context->result, context->hit_cnt)) { + state=APP_STATE_KILL_OTHER|APP_STATE_GIVEME; break; } @@ -2037,6 +2067,19 @@ static unsigned char tsg_master_data_entry(const struct streaminfo *a_stream, vo hit_num+=scan_application_id_and_properties(a_stream, scan_result+hit_num, MAX_RESULT_NUM-hit_num, context, &(gather_result[i]), thread_seq); } + if(context->session_flag>0) + { + hit_num+=tsg_scan_session_flags(g_tsg_maat_feather, + a_stream, + scan_result+hit_num, + MAX_RESULT_NUM-hit_num, + &context->mid, + g_tsg_para.table_id[TABLE_SESSION_FLAGS], + context->session_flag, + thread_seq + ); + } + p_result=tsg_policy_decision_criteria(scan_result, hit_num); if(p_result!=NULL && p_result->action!=TSG_ACTION_MONITOR) { @@ -2335,6 +2378,7 @@ extern "C" int TSG_MASTER_INIT() MESA_load_profile_string_def(tsg_conffile, "SYSTEM", "APP_IDENTIFY_RESULT_BRIDGE", g_tsg_para.bridge_name[BRIDGE_TYPE_APP_IDENTIFY_RESULT],_MAX_TABLE_NAME_LEN, "APP_IDENTIFY_RESULT_BRIDGE"); MESA_load_profile_string_def(tsg_conffile, "SYSTEM", "SKETCH_NOTIFY_BRIDGE_NAME", g_tsg_para.bridge_name[BRIDGE_TYPE_RECV_CONN_SKETCH_DATA],_MAX_TABLE_NAME_LEN, "TSG_CONN_SKETCH_NOTIFY_DATA"); MESA_load_profile_string_def(tsg_conffile, "SYSTEM", "MASTER_NOTIFY_BRIDGE_NAME", g_tsg_para.bridge_name[BRIDGE_TYPE_SEND_CONN_SKETCH_DATA],_MAX_TABLE_NAME_LEN, "TSG_MASTER_NOTIFY_DATA"); + MESA_load_profile_string_def(tsg_conffile, "SESSION_FLAGS", "FLAGS_NOTIFY_BRIDGE_NAME", g_tsg_para.bridge_name[BRIDGE_TYPE_NOTIFY_FLAGS],_MAX_TABLE_NAME_LEN, "SESSION_FLAGS_SYNC_NOTIFY_DATA"); for(i=0; i0) + { + MESA_handle_runtime_log(g_tsg_para.logger, + RLOG_LV_DEBUG, + "SCAN_FLAGS", + "Hit flag=%llu policy_id: %d service: %d action: %d addr: %s", + flag, + result[0].config_id, + result[0].service_id, + (unsigned char)result[0].action, + PRINTADDR(a_stream, g_tsg_para.level) + ); + + return ret; + } + + MESA_handle_runtime_log(g_tsg_para.logger, RLOG_LV_DEBUG, "SCAN_FLAG", "Not hit flag=%llu ret: %d stream_dir: %d addr: %s", flag, ret, a_stream->dir, PRINTADDR(a_stream, g_tsg_para.level)); + + return 0; +} struct Maat_rule_t *tsg_fetch_deny_rule(Maat_rule_t *result, int result_num) { diff --git a/src/tsg_send_log_internal.h b/src/tsg_send_log_internal.h index 5bb5ab7..c9459b1 100644 --- a/src/tsg_send_log_internal.h +++ b/src/tsg_send_log_internal.h @@ -133,6 +133,7 @@ typedef enum _tsg_log_field_id LOG_COMMON_TUNNELS_ENDPOINT_B_DESC, LOG_COMMON_TRAFFIC_VSYSTEM_ID, LOG_COMMON_APP_FULL_PATH, + LOG_COMMON_FLAGS, LOG_COMMON_MAX }tsg_log_field_id_t;