修复TSG-6652: 用户自定义的APP所有识别结果使用common_userdefine_app_name展示,common_app_label展示用户自定义最大的一个

This commit is contained in:
liuxueli
2021-07-05 14:22:24 +08:00
parent 198c01a38e
commit d1a5729ce1
8 changed files with 155 additions and 117 deletions

View File

@@ -89,3 +89,4 @@ STRING common_apn 75
STRING common_imsi 76
STRING common_imei 77
STRING common_phone_number 78
STRING common_userdefine_app_name 79

View File

@@ -24,6 +24,7 @@ enum APP_IDENTIFY_ORIGIN
ORIGIN_USER_DEFINE,
ORIGIN_DKPT,
ORIGIN_QM_ENGINE,
ORIGIN_BUILT_IN,
ORIGIN_MAX
};

View File

@@ -69,17 +69,7 @@ id2field_t g_tsg_fs2_field[TSG_FS2_MAX]={{0, TSG_FS2_TCP_LINKS, "tcp_links"},
{0, TSG_FS2_APP_DPKT_RESULT, "D_result"},
{0, TSG_FS2_APP_Q_RESULT, "Q_result"},
{0, TSG_FS2_APP_USER_RESULT, "U_result"},
{0, TSG_FS2_APP_ONLY_DPKT_RESULT, "only_D_result"},
{0, TSG_FS2_APP_ONLY_Q_RESULT, "only_Q_result"},
{0, TSG_FS2_APP_ONLY_USER_RESULT, "only_U_result"},
{0, TSG_FS2_APP_DQ_SAME_RESULT, "DQ_same_result"},
{0, TSG_FS2_APP_DQ_DIFF_RESULT, "DQ_diff_result"},
{0, TSG_FS2_APP_DU_SAME_RESULT, "DU_same_result"},
{0, TSG_FS2_APP_DU_DIFF_RESULT, "DU_diff_result"},
{0, TSG_FS2_APP_QU_SAME_RESULT, "QU_same_result"},
{0, TSG_FS2_APP_QU_DIFF_RESULT, "QU_diff_result"},
{0, TSG_FS2_APP_DQU_SAME_RESULT, "DQU_same_result"},
{0, TSG_FS2_APP_DQU_DIFF_RESULT, "DQU_diff_result"}
{0, TSG_FS2_APP_BUILT_IN_RESULT, "B_result"}
};
id2field_t g_tsg_proto_name2id[PROTO_MAX]={{PROTO_UNKONWN, 0, "unknown"},
@@ -1340,6 +1330,9 @@ static int app_identify_result_cb(const struct streaminfo *a_stream, int bridge_
case ORIGIN_USER_DEFINE:
FS_operate(g_tsg_para.fs2_handle, g_tsg_para.fs2_field_id[TSG_FS2_APP_USER_RESULT], 0, FS_OP_ADD, 1);
break;
case ORIGIN_BUILT_IN:
FS_operate(g_tsg_para.fs2_handle, g_tsg_para.fs2_field_id[TSG_FS2_APP_BUILT_IN_RESULT], 0, FS_OP_ADD, 1);
break;
case ORIGIN_BASIC_PROTOCOL:
if(context->proto==PROTO_UNKONWN || context->proto==PROTO_APP)
{
@@ -1613,6 +1606,13 @@ extern "C" int TSG_MASTER_INIT()
MESA_handle_runtime_log(g_tsg_para.logger, RLOG_LV_FATAL, "PROJECT_REGISTER", "Register %s failed.", label_buff);
}
MESA_load_profile_string_def(tsg_conffile, "SYSTEM", "LINKINFO", label_buff, sizeof(label_buff), "mirror_linkinfo_from_mac");
g_tsg_para.linkinfo_project_id=project_customer_register(label_buff, PROJECT_VAL_TYPE_STRUCT);
if(g_tsg_para.linkinfo_project_id<0)
{
MESA_handle_runtime_log(g_tsg_para.logger, RLOG_LV_FATAL, "PROJECT_REGISTER", "Register %s failed.", label_buff);
}
MESA_load_profile_string_def(tsg_conffile, "SYSTEM", "APP_BRIDGE_NAME", label_buff, sizeof(label_buff), "APP_BRIDGE");
g_tsg_para.app_bridge_id=stream_bridge_build(label_buff, "w");
if(g_tsg_para.app_bridge_id<0)

View File

@@ -83,17 +83,7 @@ enum TSG_FS2_TYPE{
TSG_FS2_APP_DPKT_RESULT,
TSG_FS2_APP_Q_RESULT,
TSG_FS2_APP_USER_RESULT,
TSG_FS2_APP_ONLY_DPKT_RESULT,
TSG_FS2_APP_ONLY_Q_RESULT,
TSG_FS2_APP_ONLY_USER_RESULT,
TSG_FS2_APP_DQ_SAME_RESULT,
TSG_FS2_APP_DQ_DIFF_RESULT,
TSG_FS2_APP_DU_SAME_RESULT,
TSG_FS2_APP_DU_DIFF_RESULT,
TSG_FS2_APP_QU_SAME_RESULT,
TSG_FS2_APP_QU_DIFF_RESULT,
TSG_FS2_APP_DQU_SAME_RESULT,
TSG_FS2_APP_DQU_DIFF_RESULT,
TSG_FS2_APP_BUILT_IN_RESULT,
TSG_FS2_MAX
};
@@ -167,6 +157,7 @@ typedef struct _tsg_para
int priority_project_id;
int internal_project_id;
int context_project_id;
int linkinfo_project_id;
int gather_app_project_id;
int app_bridge_id;
int proto_flag; //tsg_protocol_t

View File

@@ -1775,7 +1775,7 @@ int tsg_app_id2name(int app_id, char *app_name, int app_name_len, int is_joint_p
dict=(struct app_id_dict_table *)Maat_plugin_get_EX_data(g_tsg_maat_feather, g_tsg_para.table_id[TABLE_APP_ID_DICT], (const char *)app_id_buff);
if(dict!=NULL)
{
if(dict->parent_app_id!=0)
if(dict->parent_app_id!=0 && is_joint_parent==1)
{
offset=snprintf(app_name, app_name_len, "%s.%s", dict->parent_app_name, dict->app_name);
}

View File

@@ -25,8 +25,6 @@
char TSG_SEND_LOG_VERSION_20200729=0;
struct tsg_log_instance_t *g_tsg_log_instance;
#define SET_FLAG(a, b, c) ((a)>0 ? (b)|=(c) : (a))
const id2field_t tld_type[TLD_TYPE_MAX]={{TLD_TYPE_UNKNOWN, TLD_TYPE_UNKNOWN, "UNKOWN"},
{TLD_TYPE_LONG, TLD_TYPE_LONG, "LONG"},
{TLD_TYPE_STRING, TLD_TYPE_STRING, "STRING"},
@@ -114,6 +112,45 @@ static int set_tcp_isn(struct tsg_log_instance_t *_instance, struct TLD_handle_t
return 1;
}
static int set_linkinfo(struct tsg_log_instance_t *_instance, struct TLD_handle_t *_handle, struct streaminfo *a_stream)
{
const char *linkinfo=(const char *)project_req_get_struct(a_stream, g_tsg_para.linkinfo_project_id);
if(linkinfo==NULL)
{
return 0;
}
cJSON *item=NULL;
cJSON *object=cJSON_Parse(linkinfo);
if(object)
{
item=cJSON_GetObjectItem(object, "common_direction");
if(item!=NULL)
{
TLD_append(_handle, (char *)"common_direction", (void *)(long)(item->valueint), TLD_TYPE_LONG);
}
item=cJSON_GetObjectItem(object, "common_egress_link_id");
if(item!=NULL)
{
TLD_append(_handle, (char *)"common_egress_link_id", (void *)(long)(item->valueint), TLD_TYPE_LONG);
}
item=cJSON_GetObjectItem(object, "common_ingress_link_id");
if(item!=NULL)
{
TLD_append(_handle, (char *)"common_ingress_link_id", (void *)(long)(item->valueint), TLD_TYPE_LONG);
}
cJSON_Delete(object);
object=NULL;
return 1;
}
return 0;
}
static int set_asn(struct TLD_handle_t *_handle, struct streaminfo *a_stream, char *field_name, struct _asn_info_t *asn_info)
{
char buff[1024]={0};
@@ -368,6 +405,34 @@ static int set_packet_bytes(struct tsg_log_instance_t *_instance, struct TLD_han
return 1;
}
static int set_userdefine_app(struct TLD_handle_t *_handle, char *field_name, struct app_identify_result *result, TLD_TYPE type)
{
if(result==NULL || result->app_id_num<=0)
{
return 0;
}
int i=0;
char app_name[256]={0};
cJSON *one_array=cJSON_CreateArray();
for(i=0; i<result->app_id_num; i++)
{
memset(app_name, 0, sizeof(app_name));
tsg_app_id2name(result->app_id[i], app_name, sizeof(app_name), 1);
if(strnlen(app_name, sizeof(app_name)) > 0)
{
cJSON_AddStringToObject(one_array, field_name, app_name);
}
}
TLD_append(_handle, field_name, one_array, TLD_TYPE_CJSON);
return 1;
}
static int get_l7_protocol(struct app_identify_result *result, char *protocol_list, int protocol_list_len, int *flag)
{
int i=0,offset=0;
@@ -396,6 +461,23 @@ static int get_l7_protocol(struct app_identify_result *result, char *protocol_li
return 1;
}
static unsigned int get_max_app_id(unsigned int *app_id_array, int app_id_num)
{
int i=0;
unsigned int max_app_id=app_id_array[0];
for(i=1; i< app_id_num; i++)
{
if(max_app_id<app_id_array[i])
{
max_app_id=app_id_array[i];
}
}
return max_app_id;
}
static int get_app_id(struct app_identify_result *result, unsigned int *app_id, unsigned int *surrogate_id, int *flag)
{
if(result->app_id_num>0 && (*flag)==0)
@@ -410,21 +492,33 @@ static int get_app_id(struct app_identify_result *result, unsigned int *app_id,
return 0;
}
static int get_app_id_list(struct app_identify_result *result, char *app_list, int app_list_len, char *surrogate_list, int surrogate_list_len)
static int get_app_id_list(cJSON *app_id_object, const char *field_name, struct app_identify_result *result)
{
int i=0;
int offset1=0,offset2=0;
if(result->app_id_num==0)
{
return 0;
}
cJSON *one_object=NULL;
cJSON *one_array=cJSON_CreateArray();
for(i=0; i<result->app_id_num; i++)
{
offset1+=snprintf(app_list+offset1, app_list_len-offset1, "APP%d=%d;", result->origin, result->app_id[i]);
offset2+=snprintf(surrogate_list+offset2, surrogate_list_len-offset2, "SURROGATE%d=%d;", result->origin, result->surrogate_id[i]);
one_object=cJSON_CreateObject();
cJSON_AddNumberToObject(one_object, "app_id", result->app_id[i]);
cJSON_AddNumberToObject(one_object, "surrogate_id", result->surrogate_id[i]);
cJSON_AddItemToArray(one_array, one_object);
}
cJSON_AddItemToObject(app_id_object, field_name, one_array);
return 1;
}
static int get_app_name_list(struct app_identify_result *result, char *app_name, int app_name_len, int *flag, int is_joint_parent)
static int get_app_name_list(unsigned int *app_id_array, int app_id_num, char *app_name, int app_name_len, int *flag, int is_joint_parent)
{
int i=0;
int offset=0;
@@ -434,7 +528,7 @@ static int get_app_name_list(struct app_identify_result *result, char *app_name,
return 0;
}
for(i=0; i<result->app_id_num; i++)
for(i=0; i<app_id_num; i++)
{
(*flag)=1;
@@ -444,7 +538,7 @@ static int get_app_name_list(struct app_identify_result *result, char *app_name,
offset++;
}
offset+=tsg_app_id2name(result->app_id[i], app_name+offset, app_name_len-offset, is_joint_parent);
offset+=tsg_app_id2name(app_id_array[i], app_name+offset, app_name_len-offset, is_joint_parent);
}
return 1;
@@ -453,13 +547,11 @@ static int get_app_name_list(struct app_identify_result *result, char *app_name,
static int set_app_id(struct tsg_log_instance_t *_instance, struct TLD_handle_t *_handle, struct streaminfo *a_stream)
{
int app_id_flag=0;
int app_offset=0;
int surrogate_offset=0;
int l7_protocol_flag=0;
char app_list[512]={0};
char app_name[512]={0};
unsigned int max_app_id=0;
char protocol_list[256]={0};
char surrogate_list[512]={0};
unsigned int one_app_id=0;
unsigned int one_surrogate_id=0;
struct gather_app_result *label=NULL;
@@ -495,99 +587,43 @@ static int set_app_id(struct tsg_log_instance_t *_instance, struct TLD_handle_t
}
else //string
{
app_offset=0;
surrogate_offset=0;
get_app_id_list(&(label->result[ORIGIN_USER_DEFINE]), app_list+app_offset, sizeof(app_list)-app_offset, surrogate_list+surrogate_offset, sizeof(surrogate_list)-surrogate_offset);
cJSON *app_id_object=cJSON_CreateObject();
get_app_id_list(app_id_object, "USER_DEFINE", &(label->result[ORIGIN_USER_DEFINE]));
get_app_id_list(app_id_object, "BUILT_IN", &(label->result[ORIGIN_BUILT_IN]));
get_app_id_list(app_id_object, "DKPT", &(label->result[ORIGIN_DKPT]));
get_app_id_list(app_id_object, "THIRD", &(label->result[ORIGIN_QM_ENGINE]));
app_offset=strlen(app_list);
surrogate_offset=strlen(surrogate_list);
get_app_id_list(&(label->result[ORIGIN_DKPT]), app_list+app_offset, sizeof(app_list)-app_offset, surrogate_list+surrogate_offset, sizeof(surrogate_list)-surrogate_offset);
TLD_append(_handle, _instance->id2field[LOG_COMMON_APP_ID].name, (void *)app_id_object, TLD_TYPE_CJSON);
app_offset=strlen(app_list);
surrogate_offset=strlen(surrogate_list);
get_app_id_list(&(label->result[ORIGIN_QM_ENGINE]), app_list+app_offset, sizeof(app_list)-app_offset, surrogate_list+surrogate_offset, sizeof(surrogate_list)-surrogate_offset);
set_userdefine_app(_handle, _instance->id2field[LOG_COMMON_USERDEFINE_APP].name, &(label->result[ORIGIN_USER_DEFINE]), TLD_TYPE_LONG);
get_app_name_list(&(label->result[ORIGIN_USER_DEFINE]), app_name, sizeof(app_name), &app_id_flag, 1);
if(app_id_flag!=1)
max_app_id=get_max_app_id(label->result[ORIGIN_USER_DEFINE].app_id, label->result[ORIGIN_USER_DEFINE].app_id_num);
if(max_app_id>0)
{
get_app_name_list(&(label->result[ORIGIN_DKPT]), app_name, sizeof(app_name), &app_id_flag, 0);
get_app_name_list(&max_app_id, 1, app_name, sizeof(app_name), &app_id_flag, 1);
}
if(app_id_flag!=1)
{
get_app_name_list(&(label->result[ORIGIN_QM_ENGINE]), app_name, sizeof(app_name), &app_id_flag, 1);
get_app_name_list(label->result[ORIGIN_BUILT_IN].app_id, label->result[ORIGIN_BUILT_IN].app_id_num, app_name, sizeof(app_name), &app_id_flag, 1);
}
if(app_id_flag!=1)
{
get_app_name_list(label->result[ORIGIN_DKPT].app_id, label->result[ORIGIN_DKPT].app_id_num, app_name, sizeof(app_name), &app_id_flag, 0);
}
if(app_id_flag!=1)
{
get_app_name_list(label->result[ORIGIN_QM_ENGINE].app_id, label->result[ORIGIN_QM_ENGINE].app_id_num, app_name, sizeof(app_name), &app_id_flag, 0);
}
if(app_id_flag==1)
{
TLD_append(_handle, _instance->id2field[LOG_COMMON_APP_ID].name, (void *)app_list, TLD_TYPE_STRING);
TLD_append(_handle, _instance->id2field[LOG_COMMON_APP_SURROGATE_ID].name, (void *)surrogate_list, TLD_TYPE_STRING);
TLD_append(_handle, _instance->id2field[LOG_COMMON_APP_LABEL].name, (void *)app_name, TLD_TYPE_STRING);
}
}
app_id_flag=0;
SET_FLAG(label->result[ORIGIN_DKPT].app_id_num, app_id_flag, 1);
SET_FLAG(label->result[ORIGIN_QM_ENGINE].app_id_num, app_id_flag, 2);
SET_FLAG(label->result[ORIGIN_USER_DEFINE].app_id_num, app_id_flag, 4);
switch(app_id_flag)
{
case 1:
FS_operate(g_tsg_para.fs2_handle, g_tsg_para.fs2_field_id[TSG_FS2_APP_ONLY_DPKT_RESULT], 0, FS_OP_ADD, 1);
break;
case 2:
FS_operate(g_tsg_para.fs2_handle, g_tsg_para.fs2_field_id[TSG_FS2_APP_ONLY_Q_RESULT], 0, FS_OP_ADD, 1);
break;
case 3:
if((label->result[ORIGIN_DKPT].app_id[label->result[ORIGIN_DKPT].app_id_num-1]) == (label->result[ORIGIN_QM_ENGINE].app_id[label->result[ORIGIN_QM_ENGINE].app_id_num-1]))
{
FS_operate(g_tsg_para.fs2_handle, g_tsg_para.fs2_field_id[TSG_FS2_APP_DQ_SAME_RESULT], 0, FS_OP_ADD, 1);
}
else
{
FS_operate(g_tsg_para.fs2_handle, g_tsg_para.fs2_field_id[TSG_FS2_APP_DQ_DIFF_RESULT], 0, FS_OP_ADD, 1);
}
break;
case 4:
FS_operate(g_tsg_para.fs2_handle, g_tsg_para.fs2_field_id[TSG_FS2_APP_ONLY_USER_RESULT], 0, FS_OP_ADD, 1);
break;
case 5:
if((label->result[ORIGIN_USER_DEFINE].app_id[label->result[ORIGIN_USER_DEFINE].app_id_num-1]) == (label->result[ORIGIN_DKPT].app_id[label->result[ORIGIN_DKPT].app_id_num-1]))
{
FS_operate(g_tsg_para.fs2_handle, g_tsg_para.fs2_field_id[TSG_FS2_APP_DU_SAME_RESULT], 0, FS_OP_ADD, 1);
}
else
{
FS_operate(g_tsg_para.fs2_handle, g_tsg_para.fs2_field_id[TSG_FS2_APP_DU_DIFF_RESULT], 0, FS_OP_ADD, 1);
}
break;
case 6:
if((label->result[ORIGIN_USER_DEFINE].app_id[label->result[ORIGIN_USER_DEFINE].app_id_num-1]) == (label->result[ORIGIN_QM_ENGINE].app_id[label->result[ORIGIN_QM_ENGINE].app_id_num-1]))
{
FS_operate(g_tsg_para.fs2_handle, g_tsg_para.fs2_field_id[TSG_FS2_APP_QU_SAME_RESULT], 0, FS_OP_ADD, 1);
}
else
{
FS_operate(g_tsg_para.fs2_handle, g_tsg_para.fs2_field_id[TSG_FS2_APP_QU_DIFF_RESULT], 0, FS_OP_ADD, 1);
}
break;
case 7:
if((label->result[ORIGIN_USER_DEFINE].app_id[label->result[ORIGIN_USER_DEFINE].app_id_num-1]) == (label->result[ORIGIN_QM_ENGINE].app_id[label->result[ORIGIN_QM_ENGINE].app_id_num-1]) &&
(label->result[ORIGIN_USER_DEFINE].app_id[label->result[ORIGIN_USER_DEFINE].app_id_num-1]) == (label->result[ORIGIN_DKPT].app_id[label->result[ORIGIN_DKPT].app_id_num-1]))
{
FS_operate(g_tsg_para.fs2_handle, g_tsg_para.fs2_field_id[TSG_FS2_APP_DQU_SAME_RESULT], 0, FS_OP_ADD, 1);
}
else
{
FS_operate(g_tsg_para.fs2_handle, g_tsg_para.fs2_field_id[TSG_FS2_APP_DQU_DIFF_RESULT], 0, FS_OP_ADD, 1);
}
break;
default:
break;
}
return 1;
}
@@ -1039,6 +1075,7 @@ int set_session_attributes(struct tsg_log_instance_t *_instance, struct TLD_hand
int TLD_append_streaminfo(struct tsg_log_instance_t *instance, struct TLD_handle_t *handle, struct streaminfo *a_stream)
{
int ret=0;
char *addr_proto=NULL;
char stream_id_buff[128]={0};
unsigned long long stream_id=0;
@@ -1051,10 +1088,15 @@ int TLD_append_streaminfo(struct tsg_log_instance_t *instance, struct TLD_handle
return -1;
}
ret=set_linkinfo(_instance, _handle, a_stream);
if(ret==0)
{
set_direction(_instance, _handle, a_stream);
}
set_app_id(_instance, _handle, a_stream);
set_tcp_isn(_instance, _handle, a_stream);
set_tuple4(_instance, _handle, a_stream);
set_direction(_instance, _handle, a_stream);
set_address_list(_instance, _handle, a_stream);
set_duraction(_instance, _handle, a_stream);
set_packet_bytes(_instance, _handle, a_stream);

View File

@@ -104,6 +104,7 @@ typedef enum _tsg_log_field_id
LOG_COMMON_GTP_IMSI,
LOG_COMMON_GTP_IMEI,
LOG_COMMON_GTP_MSISDN, //PHONE_NUMBER
LOG_COMMON_USERDEFINE_APP,
LOG_COMMON_MAX
}tsg_log_field_id_t;

View File

@@ -192,6 +192,8 @@ static char* parse_server_name_extension(const unsigned char* buff, size_t buff
strncpy(sni, (const char*)buff + pos + 3, len);
sni[len] = '\0';
*result = CHELLO_PARSE_SUCCESS;
default:
break;
}
pos += 3 + len;
}
@@ -373,8 +375,8 @@ struct ssl_chello* ssl_chello_parse(const unsigned char* buff, size_t buff_len,
_chello->min_version.major = buff[1];
_chello->min_version.minor = buff[2];
_chello->min_version.ossl_format=(uint16_t)_chello->min_version.major<<8|_chello->min_version.minor;
_chello->max_version.major = -1;
_chello->max_version.minor = -1;
_chello->max_version.major = (uint8_t)(-1);
_chello->max_version.minor = (uint8_t)(-1);
_chello->sni = NULL;
_chello->alpn = NULL;
_chello->cipher_suites = NULL;