Skip to content

Commit bb8ea71

Browse files
lzf575lzf575
committed
feat: parse NetSign protocol
1 parent 155cbd0 commit bb8ea71

File tree

24 files changed

+864
-9
lines changed

24 files changed

+864
-9
lines changed

‎agent/crates/enterprise-utils/src/lib.rs‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -357,6 +357,55 @@ pub mod l7 {
357357
}
358358

359359
pub mod rpc {
360+
pub mod net_sign {
361+
use public::l7_protocol::LogMessageType;
362+
363+
pub const PROCESSOR_SIGN: &str = "RAWSignProcessor";
364+
pub const PROCESSOR_VERIFY: &str = "PBCRAWVerifyProcessor";
365+
366+
#[derive(Default, Debug, Clone)]
367+
pub struct NetSignFields {
368+
pub processor_name: String,
369+
pub operation: String,
370+
pub result_code: String,
371+
pub biz_data_parts: Vec<String>,
372+
pub sig_present: bool,
373+
pub sig_len: u32,
374+
pub cert_id: String,
375+
pub cert_serial: String,
376+
pub cert_validity: String,
377+
pub issuer_dn_ca: String,
378+
pub app_ver: String,
379+
}
380+
381+
impl NetSignFields {
382+
pub fn trace_id(&self) -> &str {
383+
self.biz_data_parts.get(0).map(|s| s.as_str()).unwrap_or("")
384+
}
385+
pub fn biz_data(&self) -> String {
386+
self.biz_data_parts.join("|")
387+
}
388+
pub fn biz_system(&self) -> &str {
389+
self.biz_data_parts.get(6).map(|s| s.as_str()).unwrap_or("")
390+
}
391+
pub fn signer_id(&self) -> String {
392+
String::new()
393+
}
394+
}
395+
396+
#[derive(Default)]
397+
pub struct NetSignParser;
398+
399+
impl NetSignParser {
400+
pub fn check_payload(&self, _: &[u8]) -> Option<LogMessageType> {
401+
unimplemented!()
402+
}
403+
pub fn parse_payload(&self, _: &[u8]) -> Option<NetSignFields> {
404+
unimplemented!()
405+
}
406+
}
407+
}
408+
360409
pub mod iso8583 {
361410
use public::bitmap::Bitmap;
362411

‎agent/crates/public/src/l7_protocol.rs‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -63,6 +63,7 @@ pub enum L7Protocol {
6363
SomeIp = 47,
6464
Iso8583 = 48,
6565
Triple = 49,
66+
NetSign = 50,
6667

6768
// SQL
6869
MySQL = 60,
@@ -149,6 +150,7 @@ impl From<String> for L7Protocol {
149150
"tls" => Self::TLS,
150151
"ping" => Self::Ping,
151152
"some/ip" | "someip" => Self::SomeIp,
153+
"netsign" | "net-sign" | "net_sign" => Self::NetSign,
152154
_ => Self::Unknown,
153155
}
154156
}

‎agent/src/common/l7_protocol_info.rs‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -131,6 +131,7 @@ cfg_if::cfg_if! {
131131
PingInfo(PingInfo),
132132
CustomInfo(CustomInfo),
133133
Iso8583Info(crate::flow_generator::protocol_logs::rpc::Iso8583Info),
134+
NetSignInfo(crate::flow_generator::protocol_logs::rpc::NetSignInfo),
134135
// add new protocol info below
135136
);
136137
}

‎agent/src/common/l7_protocol_log.rs‎

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ use super::l7_protocol_info::L7ProtocolInfo;
3434
use super::MetaPacket;
3535

3636
use crate::common::meta_packet::{IcmpData, ProtocolData};
37-
use crate::config::config::{Iso8583ParseConfig, WebSphereMqParseConfig};
37+
use crate::config::config::{Iso8583ParseConfig, NetSignParseConfig, WebSphereMqParseConfig};
3838
use crate::config::handler::LogParserConfig;
3939
use crate::config::OracleConfig;
4040
use crate::flow_generator::flow_map::FlowMapCounter;
@@ -103,6 +103,8 @@ macro_rules! impl_protocol_parser {
103103
#[cfg(feature = "enterprise")]
104104
"ISO-8583"=>Ok(Self::Iso8583(Default::default())),
105105
#[cfg(feature = "enterprise")]
106+
"NetSign"|"netsign"|"net_sign"=>Ok(Self::NetSign(Default::default())),
107+
#[cfg(feature = "enterprise")]
106108
"WebSphereMQ"=>Ok(Self::WebSphereMq(Default::default())),
107109
$(
108110
stringify!($proto) => Ok(Self::$proto(Default::default())),
@@ -202,6 +204,7 @@ cfg_if::cfg_if! {
202204
Tars(TarsLog),
203205
Oracle(crate::flow_generator::protocol_logs::OracleLog),
204206
Iso8583(crate::flow_generator::protocol_logs::Iso8583Log),
207+
NetSign(crate::flow_generator::protocol_logs::NetSignLog),
205208
MQTT(MqttLog),
206209
AMQP(AmqpLog),
207210
NATS(NatsLog),
@@ -691,6 +694,7 @@ pub struct ParseParam<'a> {
691694
pub oracle_parse_conf: OracleConfig,
692695
pub iso8583_parse_conf: Iso8583ParseConfig,
693696
pub web_sphere_mq_parse_conf: WebSphereMqParseConfig,
697+
pub net_sign_parse_conf: NetSignParseConfig,
694698
}
695699

696700
impl<'a> fmt::Debug for ParseParam<'a> {
@@ -723,6 +727,7 @@ impl<'a> fmt::Debug for ParseParam<'a> {
723727
.field("oracle_parse_conf", &self.oracle_parse_conf)
724728
.field("iso8583_parse_conf", &self.iso8583_parse_conf)
725729
.field("web_sphere_mq_parse_conf", &self.web_sphere_mq_parse_conf)
730+
.field("net_sign_parse_conf", &self.net_sign_parse_conf)
726731
.finish()
727732
}
728733
}
@@ -796,6 +801,7 @@ impl<'a> ParseParam<'a> {
796801
oracle_parse_conf: OracleConfig::default(),
797802
iso8583_parse_conf: Iso8583ParseConfig::default(),
798803
web_sphere_mq_parse_conf: WebSphereMqParseConfig::default(),
804+
net_sign_parse_conf: NetSignParseConfig::default(),
799805
}
800806
}
801807
}
@@ -841,6 +847,10 @@ impl<'a> ParseParam<'a> {
841847
self.web_sphere_mq_parse_conf = conf.clone();
842848
}
843849

850+
pub fn set_net_sign_conf(&mut self, conf: &NetSignParseConfig) {
851+
self.net_sign_parse_conf = *conf;
852+
}
853+
844854
pub fn reversed(&self) -> Self {
845855
Self {
846856
ip_src: self.ip_dst,
@@ -858,6 +868,7 @@ impl<'a> ParseParam<'a> {
858868
stats_counter: self.stats_counter.clone(),
859869
iso8583_parse_conf: self.iso8583_parse_conf.clone(),
860870
web_sphere_mq_parse_conf: self.web_sphere_mq_parse_conf.clone(),
871+
net_sign_parse_conf: self.net_sign_parse_conf,
861872
..*self
862873
}
863874
}

‎agent/src/config/config.rs‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1900,6 +1900,20 @@ impl Default for WebSphereMqConfig {
19001900
}
19011901
}
19021902

1903+
#[derive(Clone, Copy, Debug, Deserialize, PartialEq, Eq)]
1904+
#[serde(default)]
1905+
pub struct NetSignConfig {
1906+
pub extract_biz_data_enabled: bool,
1907+
}
1908+
1909+
impl Default for NetSignConfig {
1910+
fn default() -> Self {
1911+
Self {
1912+
extract_biz_data_enabled: false,
1913+
}
1914+
}
1915+
}
1916+
19031917
#[derive(Clone, Copy, Debug, Deserialize, PartialEq, Eq)]
19041918
#[serde(default)]
19051919
pub struct MysqlConfig {
@@ -1978,6 +1992,7 @@ pub struct ProtocolSpecialConfig {
19781992
pub oracle: OracleConfig,
19791993
pub iso8583: Iso8583Config,
19801994
pub web_sphere_mq: WebSphereMqConfig,
1995+
pub net_sign: NetSignConfig,
19811996
pub mysql: MysqlConfig,
19821997
pub grpc: GrpcConfig,
19831998
}
@@ -2048,6 +2063,7 @@ impl Default for Filters {
20482063
("Tars".to_string(), "1-65535".to_string()),
20492064
("SomeIP".to_string(), "1-65535".to_string()),
20502065
("ISO8583".to_string(), "1-65535".to_string()),
2066+
("NetSign".to_string(), "1-65535".to_string()),
20512067
("Triple".to_string(), "1-65535".to_string()),
20522068
("MySQL".to_string(), "1-65535".to_string()),
20532069
("PostgreSQL".to_string(), "1-65535".to_string()),
@@ -2080,6 +2096,7 @@ impl Default for Filters {
20802096
("Tars".to_string(), vec![]),
20812097
("SomeIP".to_string(), vec![]),
20822098
("ISO8583".to_string(), vec![]),
2099+
("NetSign".to_string(), vec![]),
20832100
("Triple".to_string(), vec![]),
20842101
("MySQL".to_string(), vec![]),
20852102
("PostgreSQL".to_string(), vec![]),
@@ -3713,6 +3730,11 @@ impl Default for WebSphereMqParseConfig {
37133730
}
37143731
}
37153732

3733+
#[derive(Clone, Copy, Default, Debug, PartialEq, Eq)]
3734+
pub struct NetSignParseConfig {
3735+
pub extract_biz_data_enabled: bool,
3736+
}
3737+
37163738
#[derive(Clone, Default, Debug, Deserialize, PartialEq, Eq)]
37173739
#[serde(default, rename_all = "kebab-case")]
37183740
pub struct BondGroup {

‎agent/src/config/handler.rs‎

Lines changed: 13 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -58,9 +58,9 @@ use super::config::{Ebpf, EbpfFileIoEvent, ProcessMatcher, SymbolTable};
5858
use super::{
5959
config::{
6060
ApiResources, Config, DpdkSource, ExtraLogFields, ExtraLogFieldsInfo, HttpEndpoint,
61-
HttpEndpointMatchRule, Iso8583ParseConfig, OracleConfig, PcapStream, PortConfig,
62-
ProcessorsFlowLogTunning, RequestLogTunning, SessionTimeout, TagFilterOperator, Timeouts,
63-
UserConfig, WebSphereMqParseConfig, GRPC_BUFFER_SIZE_MIN,
61+
HttpEndpointMatchRule, Iso8583ParseConfig, NetSignParseConfig, OracleConfig, PcapStream,
62+
PortConfig, ProcessorsFlowLogTunning, RequestLogTunning, SessionTimeout, TagFilterOperator,
63+
Timeouts, UserConfig, WebSphereMqParseConfig, GRPC_BUFFER_SIZE_MIN,
6464
},
6565
ConfigError, KubernetesPollerType, TrafficOverflowAction,
6666
};
@@ -529,6 +529,7 @@ pub struct FlowConfig {
529529
pub oracle_parse_conf: OracleConfig,
530530
pub iso8583_parse_conf: Iso8583ParseConfig,
531531
pub web_sphere_mq_parse_conf: WebSphereMqParseConfig,
532+
pub net_sign_parse_conf: NetSignParseConfig,
532533

533534
pub obfuscate_enabled_protocols: L7ProtocolBitmap,
534535
pub server_ports: Vec<u16>,
@@ -787,6 +788,15 @@ impl From<&UserConfig> for FlowConfig {
787788
.web_sphere_mq
788789
.filter_attributes_enabled,
789790
},
791+
net_sign_parse_conf: NetSignParseConfig {
792+
extract_biz_data_enabled: conf
793+
.processors
794+
.request_log
795+
.application_protocol_inference
796+
.protocol_special_config
797+
.net_sign
798+
.extract_biz_data_enabled,
799+
},
790800
obfuscate_enabled_protocols: L7ProtocolBitmap::from(
791801
conf.processors
792802
.request_log

‎agent/src/ebpf/kernel/include/common.h‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -77,6 +77,8 @@ enum traffic_protocol {
7777
PROTO_TARS = 46,
7878
PROTO_SOME_IP = 47,
7979
PROTO_ISO8583 = 48,
80+
PROTO_TRIPLE = 49,
81+
PROTO_NET_SIGN = 50,
8082
PROTO_MYSQL = 60,
8183
PROTO_POSTGRESQL = 61,
8284
PROTO_ORACLE = 62,

0 commit comments

Comments
 (0)