diff --git a/conf/sce.conf b/conf/sce.conf index 563d9df..68a119c 100644 --- a/conf/sce.conf +++ b/conf/sce.conf @@ -22,6 +22,7 @@ foreign_cont_dir=resource/foreign_files redis_db_idx=0 redis_server=127.0.0.1 redis_port_range=6379 +max_chaining_size=32 [packet_io] # bypass_all_traffic:1 NF2NF and SF2SF diff --git a/platform/include/policy.h b/platform/include/policy.h index 3640511..c5293e0 100644 --- a/platform/include/policy.h +++ b/platform/include/policy.h @@ -119,6 +119,7 @@ void policy_enforcer_destory(struct policy_enforcer *enforcer); // return 0 : success // return -1 : error int policy_enforcer_register(struct policy_enforcer *enforcer); +int policy_enforce_max_chaining_size(struct policy_enforcer *enforcer); struct selected_chaining *selected_chaining_create(int chaining_size); void selected_chaining_destory(struct selected_chaining *chaining); diff --git a/platform/src/packet_io.cpp b/platform/src/packet_io.cpp index 687ca3a..17c0ead 100644 --- a/platform/src/packet_io.cpp +++ b/platform/src/packet_io.cpp @@ -1142,7 +1142,7 @@ static int handle_session_opening(struct metadata *meta, struct ctrl_pkt_parser s_ctx->first_ctrl_pkt.addr_string = addr_tuple4_to_str(&(s_ctx->first_ctrl_pkt.tuple4)); s_ctx->first_ctrl_pkt.header_data = strndup(meta->raw_data, meta->l7_offset); s_ctx->first_ctrl_pkt.header_len = meta->l7_offset; - s_ctx->chaining = selected_chaining_create(128); + s_ctx->chaining = selected_chaining_create(policy_enforce_max_chaining_size(thread->ref_enforcer)); LOG_INFO("%s: session %lu %s active first", LOG_TAG_PKTIO, s_ctx->session_id, s_ctx->first_ctrl_pkt.addr_string); diff --git a/platform/src/policy.cpp b/platform/src/policy.cpp index a8a22e3..5823806 100644 --- a/platform/src/policy.cpp +++ b/platform/src/policy.cpp @@ -47,6 +47,7 @@ struct policy_config int redis_db_idx; char redis_server[2048]; char redis_port_range[2048]; + int max_chaining_size; }; struct policy_enforcer @@ -312,6 +313,7 @@ static void policy_enforcer_config(const char *profile, struct policy_config *co MESA_load_profile_int_def(profile, "MAAT", "redis_db_idx", &(config->redis_db_idx), 0); MESA_load_profile_string_def(profile, "MAAT", "redis_server", config->redis_server, sizeof(config->redis_server), "127.0.0.1"); MESA_load_profile_string_def(profile, "MAAT", "redis_port_range", config->redis_port_range, sizeof(config->redis_server), "6379"); + MESA_load_profile_int_def(profile, "MAAT", "max_chaining_size", &(config->max_chaining_size), 32); if (strlen(config->accept_path)) { @@ -339,6 +341,7 @@ static void policy_enforcer_config(const char *profile, struct policy_config *co LOG_DEBUG("%s: MAAT->redis_db_idx : %d", LOG_TAG_POLICY, config->redis_db_idx); LOG_DEBUG("%s: MAAT->redis_server : %s", LOG_TAG_POLICY, config->redis_server); LOG_DEBUG("%s: MAAT->redis_port_range : %s", LOG_TAG_POLICY, config->redis_port_range); + LOG_DEBUG("%s: MAAT->max_chaining_size : %d", LOG_TAG_POLICY, config->max_chaining_size); } static void chaining_param_new_cb(int table_id, const char *key, const char *table_line, MAAT_PLUGIN_EX_DATA *ad, long argl, void *argp) @@ -1253,6 +1256,11 @@ void policy_enforcer_destory(struct policy_enforcer *enforcer) } } +int policy_enforce_max_chaining_size(struct policy_enforcer *enforcer) +{ + return enforcer->config.max_chaining_size; +} + // return 0 : success // return -1 : error int policy_enforcer_register(struct policy_enforcer *enforcer)