diff --git a/bin/tsg_log_field.conf b/bin/tsg_log_field.conf index fac4bee..b47e4ee 100644 --- a/bin/tsg_log_field.conf +++ b/bin/tsg_log_field.conf @@ -49,4 +49,5 @@ STRING common_clinet_location 41 STRING common_server_location 42 STRING quic_sni 43 STRING ssl_ja3_fingerprint 44 -STRING common_data_center 45 \ No newline at end of file +STRING common_data_center 45 +STRING common_l7_protocol 46 \ No newline at end of file diff --git a/src/tsg_entry.cpp b/src/tsg_entry.cpp index 4a170d7..cd8b738 100644 --- a/src/tsg_entry.cpp +++ b/src/tsg_entry.cpp @@ -193,7 +193,7 @@ static int init_context(void **pme, tsg_protocol_t proto, struct Maat_rule_t *p_ return 0; } -static char *schema_index2string(tsg_protocol_t proto) +char *tsg_schema_index2string(tsg_protocol_t proto) { char *schema_field_value=NULL; @@ -258,7 +258,7 @@ static int master_send_log(struct streaminfo *a_stream, struct Maat_rule_t *p_re { schema_field_name=log_field_id2name(g_tsg_log_instance, LOG_COMMON_SCHAME_TYPE); - schema_field_value=schema_index2string(identify_info->proto); + schema_field_value=tsg_schema_index2string(identify_info->proto); if(schema_field_value!=NULL) { TLD_append(TLD_handle, schema_field_name, (void *)schema_field_value, TLD_TYPE_STRING); diff --git a/src/tsg_entry.h b/src/tsg_entry.h index 1459c51..337a5a2 100644 --- a/src/tsg_entry.h +++ b/src/tsg_entry.h @@ -210,6 +210,7 @@ int tsg_scan_shared_policy(Maat_feather_t maat_feather, struct _identify_info *i void location_free_data(int table_id, MAAT_PLUGIN_EX_DATA* ad, long argl, void* argp); void ASN_free_data(int table_id, MAAT_PLUGIN_EX_DATA* ad, long argl, void* argp); void subscribe_id_free_data(int table_id, MAAT_PLUGIN_EX_DATA* ad, long argl, void* argp); +char *tsg_schema_index2string(tsg_protocol_t proto); #endif diff --git a/src/tsg_send_log.cpp b/src/tsg_send_log.cpp index 0c43608..1d03a44 100644 --- a/src/tsg_send_log.cpp +++ b/src/tsg_send_log.cpp @@ -188,12 +188,19 @@ static int set_common_sub_action(struct TLD_handle_t *handle, char *field_name, int set_common_field_from_label(struct tsg_log_instance_t *_instance, struct TLD_handle_t *_handle, struct streaminfo *a_stream) { char buff[512]={0}; + char *l7_protocol=NULL; struct _location_info_t *location=NULL; struct _session_attribute_label_t *internal_label=NULL; internal_label=(struct _session_attribute_label_t *)project_req_get_struct(a_stream, _instance->internal_project_id); if(internal_label!=NULL) - { + { + l7_protocol=tsg_schema_index2string(internal_label->proto); + if(l7_protocol!=NULL) + { + TLD_append(_handle, _instance->id2field[LOG_COMMON_L7_PROTOCOL].name, (void *)l7_protocol, TLD_TYPE_STRING); + } + TLD_append(_handle, _instance->id2field[LOG_COMMON_ESTABLISH_LATENCY_MS].name, (void *)internal_label->establish_latency_ms, TLD_TYPE_LONG); if(internal_label->client_asn!=NULL) diff --git a/src/tsg_send_log_internal.h b/src/tsg_send_log_internal.h index 0cc43b4..be01b7c 100644 --- a/src/tsg_send_log_internal.h +++ b/src/tsg_send_log_internal.h @@ -70,6 +70,7 @@ typedef enum _tsg_log_field_id LOG_QUIC_SNI, LOG_SSL_JA3_FINGERPRINT, LOG_COMMON_DATA_CENTER, + LOG_COMMON_L7_PROTOCOL, LOG_COMMON_MAX }tsg_log_field_id_t;