策略验证支持minidump

common/include/verify_policy.h

@@ -11,6 +11,8 @@
 #include <event2/event.h>
 #include "verify_policy_utils.h"
 
+struct breakpad_instance;
+
 enum verify_policy_type
 {
     PXY_TABLE_SECURITY,
@@ -51,6 +53,7 @@ enum security_scan_table
 	PXY_SECURITY_HTTP_RES_HDR,
 	PXY_SECURITY_HTTP_RES_BODY,
 	PXY_SECURITY_SUBSCRIBE_ID,
+    PXY_SECURITY_APP_ID,
     PXY_SECURITY_HTTPS_SNI,
     PXY_SECURITY_HTTPS_CN,
     PXY_SECURITY_HTTPS_SAN,
@@ -66,7 +69,6 @@ enum security_scan_table
     PXY_SECURITY_FTP_URI,
     PXY_SECURITY_FTP_CONTENT,
     PXY_SECURITY_FTP_ACCOUNT,
-    PXY_SECURITY_APP_ID,
     PXY_SECURITY_IP_SRC_ASN,
     PXY_SECURITY_IP_DST_ASN,
     PXY_SECURITY_IP_SRC_LOCATION,
@@ -114,6 +116,7 @@ struct verify_policy
 	unsigned int log_level;
 	unsigned int nr_work_threads;
 	unsigned int listen_port;
+    struct breakpad_instance * breakpad;
 	struct verify_policy_thread *work_threads[VERIFY_ARRAY_MAX];
 };
 

platform/CMakeLists.txt

@@ -12,5 +12,7 @@ target_link_libraries(verify-policy pthread dl
 		MESA_handle_logger
 		MESA_prof_load
 		gperftools-static
-		cjson)
+		breakpad-client-static
+		cjson
+		${SYSTEMD_LIBRARIES})
 

platform/src/verify_policy.cpp

@@ -5,6 +5,10 @@
 	> Created Time: 2019年08月23日 星期五 14时41分17秒
  ************************************************************************/
 
+/* Breakpad */
+#include <client/linux/handler/exception_handler.h>
+#include <common/linux/http_upload.h>
+
 #include<iostream>
 #include <stdio.h>
 #include <stdlib.h>
@@ -21,6 +25,8 @@
 #include <netinet/in.h>//inet_addr
 #include <arpa/inet.h>//inet_addr
 #include <MESA/stream.h>
+#include <sys/stat.h>
+#include <libgen.h>
 
 #include "verify_policy.h"
 #include <MESA/MESA_prof_load.h>
@@ -599,6 +605,225 @@ finish:
     return xret;
 }
 
+struct breakpad_instance
+{
+	unsigned int en_breakpad;
+	char minidump_dir_prefix[VERIFY_STRING_MAX];
+	google_breakpad::ExceptionHandler * exceptionHandler;
+
+	/* Upload to crash server */
+	unsigned int en_breakpad_upload;
+	char minidump_sentry_upload_url[VERIFY_STRING_MAX];
+
+	/* Upload tools name */
+	char upload_tools_filename[VERIFY_STRING_MAX];
+
+	/* Upload tools exec command */
+	char * upload_tools_exec_argv[64];
+	char * minidump_filename;
+};
+
+static void _mkdir(const char *dir)
+{
+	char tmp[PATH_MAX];
+	char * p = NULL;
+	size_t len;
+
+	snprintf(tmp, sizeof(tmp), "%s", dir);
+	len = strlen(tmp);
+	if (tmp[len - 1] == '/')
+		tmp[len - 1] = 0;
+	for (p = tmp + 1; *p; p++)
+	{
+		if (*p == '/')
+		{
+			*p = 0;
+			mkdir(tmp, S_IRWXU);
+			*p = '/';
+		}
+	}
+	mkdir(tmp, S_IRWXU);
+}
+
+int breakpad_init_minidump_upload(struct breakpad_instance * instance, const char * profile)
+{
+	int ret = 0;
+	char execpath[PATH_MAX] = {};
+	char * execdirname = NULL;
+
+	ret = MESA_load_profile_string_nodef(profile, "system", "breakpad_upload_url",
+		instance->minidump_sentry_upload_url, sizeof(instance->minidump_sentry_upload_url));
+
+	if (unlikely(ret < 0))
+	{
+		mesa_runtime_log(RLOG_LV_FATAL, MODULE_NAME, "breakpad_upload_url is necessary, failed. ");
+		goto errout;
+	}
+
+	ret = readlink("/proc/self/exe", execpath, sizeof(execpath));
+	if(unlikely(ret < 0))
+	{
+		mesa_runtime_log(RLOG_LV_FATAL, MODULE_NAME, "Failed at readlink /proc/self/exec: %s", strerror(errno));
+		/* after log, reset errno */
+		errno = 0;
+		goto errout;
+	}
+
+	execdirname = dirname(execpath);
+	snprintf(instance->upload_tools_filename, sizeof(instance->upload_tools_filename) - 1,
+		"%s/%s", execdirname, "minidump_upload");
+
+
+	/* Execfile */
+	instance->upload_tools_exec_argv[0] = strdup(instance->upload_tools_filename);
+
+	/* Firstly, Product Name and Product Version */
+	instance->upload_tools_exec_argv[1] = strdup("-p");
+	instance->upload_tools_exec_argv[2] = strdup("tfe");
+	instance->upload_tools_exec_argv[3] = strdup("-v");
+	instance->upload_tools_exec_argv[4] = strdup(version());
+
+	/* Minidump file location, now we don't know it */
+	instance->minidump_filename = (char *)ALLOC(char, PATH_MAX);
+	instance->upload_tools_exec_argv[5] = instance->minidump_filename;
+
+	/* Minidup upload url */
+	instance->upload_tools_exec_argv[6] = strdup(instance->minidump_sentry_upload_url);
+	instance->upload_tools_exec_argv[7] = NULL;
+	return 0;
+
+errout:
+	return -1;
+}
+
+static bool tfe_breakpad_dump_to_file(const google_breakpad::MinidumpDescriptor& descriptor,
+	void* context, bool succeeded)
+{
+	fprintf(stderr, "Crash happened, minidump path:  %s\n", descriptor.path());
+	return succeeded;
+}
+
+static bool tfe_breakpad_dump_and_report(const google_breakpad::MinidumpDescriptor& descriptor,
+	void* context, bool succeeded)
+{
+	struct breakpad_instance * instance = g_verify_proxy->breakpad;
+	int ret = 0;
+
+	strncpy(instance->minidump_filename, descriptor.path(),  PATH_MAX - 1);
+	fprintf(stderr, "Crash happened, prepare upload the minidump file:  %s\n", descriptor.path());
+
+	ret = access(instance->minidump_filename, F_OK | R_OK);
+	if (ret < 0)
+	{
+		fprintf(stderr, "minidump file is not existed, cannot upload minidump file");
+		return succeeded;
+	}
+
+	/* Firstly, fork an child process */
+	pid_t exec_child_pid = fork();
+	if (exec_child_pid == 0)
+	{
+		/* As a child, exec minidump upload tools */
+		ret = execv(instance->upload_tools_filename, instance->upload_tools_exec_argv);
+		if (ret < 0)
+		{
+			fprintf(stderr, "Failed at exec the upload program %s: %s\n",
+				instance->upload_tools_filename, strerror(errno));
+			/* after log, reset errno */
+			errno = 0;
+		}
+
+		exit(EXIT_FAILURE);
+	}
+	else if (exec_child_pid > 0)
+	{
+		fprintf(stderr, "Starting upload minidump, PID = %d. \n", exec_child_pid);
+		return succeeded;
+	}
+	else
+	{
+		/* failed at fork, cannot upload the minidump */
+		fprintf(stderr, "Failed at fork(), cannot upload minidump file. :  %s\n", strerror(errno));
+		/* after log, reset errno */
+		errno = 0;
+		return succeeded;
+	}
+}
+
+struct breakpad_instance * breakpad_init(const char * profile)
+{
+	struct breakpad_instance * instance = ALLOC(struct breakpad_instance, 1);
+	assert(instance != nullptr);
+
+	int ret = 0;
+	unsigned int disable_coredump;
+	MESA_load_profile_uint_def(profile, "system", "disable_coredump", &disable_coredump, 0);
+	if (disable_coredump > 0)
+	{
+		const struct rlimit __rlimit_vars = {.rlim_cur = 0, .rlim_max = 0};
+		ret = setrlimit(RLIMIT_CORE, &__rlimit_vars);
+		if (ret < 0)
+		{
+			mesa_runtime_log(RLOG_LV_FATAL, MODULE_NAME, "setrlimit(RLIMIT_CORE, 0) failed: %s", strerror(errno));
+			/* after log, reset errno */
+			errno = 0;
+		}
+	}
+
+	MESA_load_profile_uint_def(profile, "system", "enable_breakpad", &instance->en_breakpad, 1);
+	if (instance->en_breakpad <= 0)
+	{
+		mesa_runtime_log(RLOG_LV_FATAL, MODULE_NAME, "Breakpad Crash Reporting System is disabled. ");
+		return instance;
+	}
+
+	MESA_load_profile_string_def(profile, "system", "breakpad_minidump_dir",
+		instance->minidump_dir_prefix, sizeof(instance->minidump_dir_prefix), "/tmp/crashreport");
+
+	MESA_load_profile_uint_def(profile, "system", "enable_breakpad_upload",
+		&instance->en_breakpad_upload, 0);
+
+	/* Create the minidump dir if it is not existed */
+	_mkdir(instance->minidump_dir_prefix);
+
+	if (instance->en_breakpad_upload)
+	{
+		/* Try to init the breakpad upload */
+		ret = breakpad_init_minidump_upload(instance, profile);
+		if (ret < 0)
+		{
+			mesa_runtime_log(RLOG_LV_FATAL, MODULE_NAME, "Breakpad upload init failed, using local breakpad dumpfile");
+			instance->en_breakpad_upload = 0;
+		}
+
+		/* When we use breakpad, do not generate any coredump file */
+		const struct rlimit __rlimit_vars = {.rlim_cur = 0, .rlim_max = 0};
+		ret = setrlimit(RLIMIT_CORE, &__rlimit_vars);
+		if (ret < 0)
+		{
+			mesa_runtime_log(RLOG_LV_FATAL, MODULE_NAME, "setrlimit(RLIMIT_CORE, 0) failed: %s", strerror(errno));
+			/* after log, reset errno */
+			errno = 0;
+		}
+	}
+
+	if (instance->en_breakpad_upload)
+	{
+		instance->exceptionHandler = new google_breakpad::ExceptionHandler(
+			google_breakpad::MinidumpDescriptor(instance->minidump_dir_prefix), NULL,
+			tfe_breakpad_dump_and_report, NULL, true, -1);
+	}
+	else
+	{
+		instance->exceptionHandler = new google_breakpad::ExceptionHandler(
+			google_breakpad::MinidumpDescriptor(instance->minidump_dir_prefix), NULL,
+			tfe_breakpad_dump_to_file, NULL, true, -1);
+	}
+	mesa_runtime_log(RLOG_LV_INFO, MODULE_NAME, "Breakpad Crash Report is enable. ");
+	mesa_runtime_log(RLOG_LV_INFO, MODULE_NAME, "Minidump Dir: %s", instance->minidump_dir_prefix);
+	return instance;
+}
+
 int main(int argc, char * argv[])
 {
 	const char * main_profile = "./conf/verify_policy.conf";
@@ -642,6 +867,9 @@ int main(int argc, char * argv[])
 	mesa_runtime_log(RLOG_LV_DEBUG, MODULE_NAME, "Read table_info_security.conf, take time %lu(s)", end_time.tv_sec - start_time.tv_sec);
 	printf("Read table_info_security.conf, take time %lu(s)\n", end_time.tv_sec - start_time.tv_sec);
 
+	g_verify_proxy->breakpad = breakpad_init(main_profile);
+	CHECK_OR_EXIT(g_verify_proxy->breakpad, "Failed at starting breakpad. Exit.");
+
 	ret = pangu_policy_work_thread_run(g_verify_proxy);
 
 	return ret;

scan/src/pangu_http.cpp

@@ -798,7 +798,7 @@ size_t http_policy_scan(enum verify_policy_type policy_type, struct verify_polic
 		goto decide;
 	}
 
-	if (protocol_field == PXY_CTRL_APP_ID || protocol_field == PXY_SECURITY_APP_ID)
+	if (protocol_field == PXY_CTRL_APP_ID)
 	{
 		int scan_val=atoi(value);
 		scan_ret=Maat_scan_intval(g_pangu_rt->maat[policy_type], g_pangu_rt->scan_table_id[policy_type][protocol_field], scan_val, ctx->result+hit_cnt, MAX_SCAN_RESULT-hit_cnt, &(ctx->scan_mid), ctx->thread_id);

vendor/CMakeLists.txt

@@ -55,6 +55,30 @@ add_dependencies(gmock googletest)
 set_property(TARGET gmock PROPERTY IMPORTED_LOCATION ${INSTALL_DIR}/lib/libgmock.a)
 set_property(TARGET gmock PROPERTY INTERFACE_INCLUDE_DIRECTORIES ${INSTALL_DIR}/include)
 
+### Google Breakpad Binary
+### Caution: This package is a pre-compiled binary package, only used in x86_64 servers.
+ExternalProject_Add(breakpad
+	PREFIX breakpad
+	URL ${CMAKE_CURRENT_SOURCE_DIR}/breakpad-master-abfe08e.tar.gz
+	URL_MD5 96fb25a9d96cc55db71a7f374ad363b4
+	CONFIGURE_COMMAND ./configure --prefix=<INSTALL_DIR>
+	BUILD_IN_SOURCE 1)
+
+ExternalProject_Get_Property(breakpad INSTALL_DIR)
+file(MAKE_DIRECTORY ${INSTALL_DIR}/include/breakpad)
+
+add_library(breakpad-client-static STATIC IMPORTED GLOBAL)
+add_dependencies(breakpad-client-static breakpad)
+set_property(TARGET breakpad-client-static PROPERTY IMPORTED_LOCATION ${INSTALL_DIR}/lib/libbreakpad_client.a)
+set_property(TARGET breakpad-client-static PROPERTY INTERFACE_INCLUDE_DIRECTORIES ${INSTALL_DIR}/include/breakpad)
+target_link_libraries(breakpad-client-static INTERFACE pthread)
+
+# install the minidump tools to target binary dir
+install(PROGRAMS ${INSTALL_DIR}/bin/minidump-2-core DESTINATION bin COMPONENT)
+install(PROGRAMS ${INSTALL_DIR}/bin/minidump_dump DESTINATION bin COMPONENT )
+install(PROGRAMS ${INSTALL_DIR}/bin/minidump_stackwalk DESTINATION bin COMPONENT)
+install(PROGRAMS ${INSTALL_DIR}/bin/minidump_upload DESTINATION bin COMPONENT)
+
 ### gperftools
 ExternalProject_Add(gperftools
         PREFIX gperftools
@@ -104,4 +128,3 @@ add_library(pcre2-static STATIC IMPORTED GLOBAL)
 add_dependencies(pcre2-static pcre2)
 set_property(TARGET pcre2-static PROPERTY IMPORTED_LOCATION ${INSTALL_DIR}/lib/libpcre2-8.a)
 set_property(TARGET pcre2-static PROPERTY INTERFACE_INCLUDE_DIRECTORIES ${INSTALL_DIR}/include)
-