github_mirrors/attachment
3
0
Fork 1
mirror of https://github.com/openappsec/attachment.git synced 2025-06-28 16:41:03 +03:00
Code Issues Packages Projects Releases Wiki Activity

Istio support (#30)

Browse Source 
* adding istio files

* fix the envoy CMakList file

* fix the envoy CMakList file

* adding the .mod file

* adding the webhook injector image

* adding istio files

* adding istio files

* fix the envoy CMakList file

* fix the envoy CMakList file

* adding the .mod file

* adding the webhook injector image

* adding istio files

* pulling from dev

* fix the envoy CMakList file

* adding istio files

* fix missing header

* fix wrong name of library

* fix envoy CMakeLists

* remove cloud guard names

* remove cloud guard names

* adding istio files

* adding istio files

* [JIRA] INXT-44274: test agent image

* add Daniel fixes

* remove zlib library

* remove nano attachment ut
This commit is contained in:
wiaam96 2025-02-11 12:01:51 +02:00 committed by GitHub
parent 26e2a38713
commit 23dbf06cd0
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
60 changed files with 11245 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
attachments/CMakeLists.txt
View File

@ -1 +1,3 @@
add_subdirectory(envoy)
add_subdirectory(nano_attachment)
add_subdirectory(nginx) add_subdirectory(nginx)

31
attachments/envoy/CMakeLists.txt Executable file
View File

@ -0,0 +1,31 @@
if(CMAKE_SYSTEM_PROCESSOR STREQUAL "x86_64" AND ATTACHMENT_TYPE STREQUAL "envoy")
set(ATTACHMENTS_INCLUDE_DIR ${PROJECT_SOURCE_DIR}/core/include/attachments)
set(NANO_ATTACHMENT_INCLUDE_DIR ${PROJECT_SOURCE_DIR}/attachments/nano_attachment)
set(SHMEM_LIBRARY_DIR ${CMAKE_BINARY_DIR}/core/shmem_ipc_2)
set(NANO_ATTACHMENT_LIBRARY_DIR ${CMAKE_BINARY_DIR}/attachments/nano_attachment)
set(NANO_ATTACHMENT_UTIL_LIBRARY_DIR ${CMAKE_BINARY_DIR}/attachments/nano_attachment/nano_attachment_util)
set(LIBRARIES "-lnano_attachment -lnano_attachment_util -lshmem_ipc_2")
set(ENVOY_ATTACHMENT_DIR ${CMAKE_CURRENT_SOURCE_DIR})
# Configure the build.sh script from the template
configure_file(
${PROJECT_SOURCE_DIR}/attachments/envoy/build_template
${CMAKE_BINARY_DIR}/attachments/envoy/build.sh
@ONLY
)
# Define a custom command to run the bash script
add_custom_target(
envoy_attachment ALL
COMMAND chmod +x ${CMAKE_BINARY_DIR}/attachments/envoy/build.sh
COMMAND ${CMAKE_BINARY_DIR}/attachments/envoy/build.sh
WORKING_DIRECTORY ${PROJECT_SOURCE_DIR}/attachments/envoy
COMMENT "Building envoy attachment"
)
add_dependencies(envoy_attachment shmem_ipc_2 nano_attachment nano_attachment_util)
install(FILES libenvoy_attachment.so DESTINATION ${CMAKE_BINARY_DIR}/attachments/envoy PERMISSIONS OWNER_READ OWNER_WRITE OWNER_EXECUTE GROUP_READ GROUP_EXECUTE WORLD_READ)
install(FILES libenvoy_attachment.so DESTINATION lib PERMISSIONS OWNER_READ OWNER_WRITE OWNER_EXECUTE GROUP_READ GROUP_EXECUTE WORLD_READ)
endif()

13
attachments/envoy/build_template Executable file
View File

@ -0,0 +1,13 @@
#!/bin/bash
# Set environment variables
SHMEM_LIBRARY_DIR="@SHMEM_LIBRARY_DIR@"
NANO_ATTACHMENT_LIBRARY_DIR="@NANO_ATTACHMENT_LIBRARY_DIR@"
NANO_ATTACHMENT_UTIL_LIBRARY_DIR="@NANO_ATTACHMENT_UTIL_LIBRARY_DIR@"
LIBRARIES="@LIBRARIES@"
ENVOY_ATTACHMENT_DIR="@ENVOY_ATTACHMENT_DIR@"
cd $ENVOY_ATTACHMENT_DIR
# Run the go build command
CGO_CFLAGS="-I@ATTACHMENTS_INCLUDE_DIR@ -I@NANO_ATTACHMENT_INCLUDE_DIR@" go build -o ${ENVOY_ATTACHMENT_DIR}/libenvoy_attachment.so -buildmode=c-shared -ldflags="-extldflags '-L${SHMEM_LIBRARY_DIR} -L${NANO_ATTACHMENT_LIBRARY_DIR} -L${NANO_ATTACHMENT_UTIL_LIBRARY_DIR} ${LIBRARIES}'"

284
attachments/envoy/config.go Executable file
View File

@ -0,0 +1,284 @@
package main
import (
"encoding/json"
"fmt"
"net/http"
"runtime"
"strconv"
"strings"
"sync"
"sync/atomic"
"time"
"github.com/go-chi/chi/v5"
xds "github.com/cncf/xds/go/xds/type/v3"
"google.golang.org/protobuf/types/known/anypb"
"github.com/envoyproxy/envoy/contrib/golang/common/go/api"
envoyHttp "github.com/envoyproxy/envoy/contrib/golang/filters/http/source/go/pkg/http"
)
/*
#include <pthread.h>
unsigned long get_thread_id() {
return (unsigned long)pthread_self();
}
#include "nano_attachment_common.h"
#include "nano_initializer.h"
#include "nano_attachment.h"
*/
import "C"
const Name = "cp_nano_filter"
const admin_api_server_info = "http://127.0.0.1:%s/server_info"
const keep_alive_interval = 10 * time.Second
var filter_id atomic.Int64
var attachments_map map[int]*nano_attachment = nil
var thread_to_attachment_mapping map[int]int = nil
var attachment_to_thread_mapping map[int]int = nil
var attachment_to_filter_request_structs map[int]*filterRequestStructs = nil
var mutex sync.Mutex
var last_keep_alive time.Time
type nano_attachment C.struct_NanoAttachment
// EnvoyServerInfo represents the structure of the JSON response from /server_info
type EnvoyServerInfo struct {
Concurrency int `json:"concurrency"`
}
func getEnvoyConcurrency() int {
concurrency_method := getEnv("CONCURRENCY_CALC", "numOfCores")
if concurrency_method == "numOfCores" {
api.LogWarnf("using number of CPU cores")
return runtime.NumCPU()
}
var conc_number string
switch concurrency_method {
case "istioCpuLimit":
conc_number = getEnv("ISTIO_CPU_LIMIT", "-1")
api.LogWarnf("using istioCpuLimit, conc_number %s", conc_number)
case "custom":
conc_number = getEnv("CONCURRENCY_NUMBER", "-1")
api.LogWarnf("using custom concurrency number, conc_number %s", conc_number)
default:
api.LogWarnf("unknown concurrency method %s, using number of CPU cores", concurrency_method)
return runtime.NumCPU()
}
if conc_number == "-1" {
api.LogWarnf("concurrency number is not set as an env variable, using number of CPU cores")
return runtime.NumCPU()
}
conc_num, err := strconv.Atoi(conc_number)
if err != nil || conc_num <= 0 {
api.LogWarnf("error converting concurrency number %s, using number of CPU cores", conc_number)
return runtime.NumCPU()
}
return conc_num
}
func configurationServer() {
r := chi.NewRouter()
r.Get("/load-config", func(w http.ResponseWriter, r *http.Request) {
mutex.Lock()
defer mutex.Unlock()
worker_ids := make([]int, 0)
workersParam := r.URL.Query().Get("workers")
num_of_workers := len(attachments_map) // concurrency
if workersParam == "" {
for i := 0; i < num_of_workers; i++ {
worker_ids = append(worker_ids, i)
}
} else {
workers := strings.Split(workersParam, ",")
for _, worker := range workers {
worker_id, err := strconv.Atoi(worker)
if worker_id >= num_of_workers {
api.LogWarnf(
"Can not load configuration of invalid worker ID %d. worker ID should be lower than: %d",
worker_id,
num_of_workers)
}
if err != nil || worker_id >= num_of_workers {
w.WriteHeader(http.StatusBadRequest)
w.Header().Set("Content-Type", "application/json")
w.Write([]byte(fmt.Sprintf(`{"error": "invalid worker ID: %s"}`, worker)))
return
}
worker_ids = append(worker_ids, worker_id)
}
}
workers_reload_status := make(map[string]string, len(worker_ids))
res := C.NANO_OK
for _, worker_id := range worker_ids {
worker_reload_res := C.RestartAttachmentConfiguration((*C.NanoAttachment)(attachments_map[worker_id]))
if worker_reload_res == C.NANO_ERROR {
res = C.NANO_ERROR
workers_reload_status[strconv.Itoa(worker_id)] = "Reload Configuraiton Failed"
continue
}
workers_reload_status[strconv.Itoa(worker_id)] = "Reload Configuraiton Succeded"
}
response, err := json.Marshal(workers_reload_status)
if err != nil {
api.LogWarnf("Error while sending reponse about reload configuration. Err: %s", err.Error())
response = []byte(`{"error": "Internal Error"}`)
}
if res == C.NANO_ERROR || err != nil {
w.WriteHeader(http.StatusInternalServerError)
}
w.Header().Set("Content-Type", "application/json")
w.Write(response)
})
http.ListenAndServe(":8119", r)
}
func init() {
last_keep_alive = time.Time{}
envoyHttp.RegisterHttpFilterConfigFactoryAndParser(Name, ConfigFactory, &parser{})
go configurationServer()
}
type config struct {}
type parser struct {}
func sendKeepAlive() {
for {
attachment_ptr := (*C.NanoAttachment)(attachments_map[0])
if attachment_ptr == nil {
return
}
C.SendKeepAlive(attachment_ptr)
time.Sleep(30 * time.Second)
}
}
func (p *parser) initFilterStructs() *filterRequestStructs {
return &filterRequestStructs {
http_start_data: (*C.HttpRequestFilterData)(C.malloc(C.sizeof_HttpRequestFilterData)),
http_meta_data: (*C.HttpMetaData)(C.malloc(C.sizeof_HttpMetaData)),
http_headers: (*C.HttpHeaders)(C.malloc(C.sizeof_HttpHeaders)),
http_headers_data: (*C.HttpHeaderData)(C.malloc(10000 * C.sizeof_HttpHeaderData)),
http_res_headers: (*C.ResHttpHeaders)(C.malloc(C.sizeof_ResHttpHeaders)),
http_body_data: (*C.nano_str_t)(C.malloc(10000 * C.sizeof_nano_str_t)),
attachment_data: (*C.AttachmentData)(C.malloc(C.sizeof_AttachmentData)),
}
}
// Parse the filter configuration. We can call the ConfigCallbackHandler to control the filter's
// behavior
func (p *parser) Parse(any *anypb.Any, callbacks api.ConfigCallbackHandler) (interface{}, error) {
conf := &config{}
if attachments_map != nil {
api.LogInfof("Waf Configuration already loaded")
return conf, nil
}
num_of_workers := getEnvoyConcurrency()
configStruct := &xds.TypedStruct{}
if err := any.UnmarshalTo(configStruct); err != nil {
return nil, err
}
attachments_map = make(map[int]*nano_attachment)
attachment_to_filter_request_structs = make(map[int]*filterRequestStructs)
attachment_to_thread_mapping = make(map[int]int, 0)
thread_to_attachment_mapping = make(map[int]int, 0)
api.LogInfof("Number of worker threds: %d", num_of_workers)
for worker_id := 0; worker_id < num_of_workers; worker_id++ {
attachment := C.InitNanoAttachment(C.uint8_t(0), C.int(worker_id), C.int(num_of_workers), C.int(C.fileno(C.stdout)))
for attachment == nil {
api.LogWarnf("attachment is nill going to sleep for two seconds and retry")
time.Sleep(2 * time.Second)
attachment = C.InitNanoAttachment(C.uint8_t(0), C.int(worker_id), C.int(num_of_workers), C.int(C.fileno(C.stdout)))
}
//mutex.Lock()
attachments_map[worker_id] = (*nano_attachment)(attachment)
attachment_to_filter_request_structs[worker_id] = p.initFilterStructs()
//mutex.Unlock()
}
go func (){
sendKeepAlive()
}()
return conf, nil
}
// Merge configuration from the inherited parent configuration
func (p *parser) Merge(parent interface{}, child interface{}) interface{} {
parentConfig := parent.(*config)
// copy one, do not update parentConfig directly.
newConfig := *parentConfig
return &newConfig
}
func ConfigFactory(c interface{}) api.StreamFilterFactory {
conf, ok := c.(*config)
if !ok {
panic("unexpected config type")
}
return func(callbacks api.FilterCallbackHandler) api.StreamFilter {
worker_thread_id := int(C.get_thread_id())
api.LogDebugf("worker_thread_id: %d", worker_thread_id)
if _, ok := thread_to_attachment_mapping[int(worker_thread_id)]; !ok {
api.LogDebugf("need to add new thread to the map")
map_size := len(attachment_to_thread_mapping)
if map_size < len(attachments_map) {
attachment_to_thread_mapping[map_size] = worker_thread_id
thread_to_attachment_mapping[worker_thread_id] = map_size
api.LogDebugf("len(attachment_to_thread_mapping): %d", len(attachment_to_thread_mapping))
api.LogDebugf("thread_to_attachment_mapping: %v", thread_to_attachment_mapping)
api.LogDebugf("attachment_to_thread_mapping: %v", attachment_to_thread_mapping)
} else {
panic("unexpected thread id")
}
}
worker_id := thread_to_attachment_mapping[int(worker_thread_id)]
api.LogDebugf("worker_id: %d", worker_id)
filter_id.Add(1)
session_id := filter_id.Load()
attachment_ptr := attachments_map[worker_id]
session_data := C.InitSessionData((*C.NanoAttachment)(attachment_ptr), C.SessionID(session_id))
return &filter{
callbacks: callbacks,
config: conf,
session_id: session_id,
cp_attachment: attachment_ptr,
session_data: session_data,
request_structs: attachment_to_filter_request_structs[worker_id],
}
}
}
func main() {}

489
attachments/envoy/filter.go Executable file
View File

@ -0,0 +1,489 @@
package main
/*
#include <pthread.h>
unsigned long get_thread_id_2() {
return (unsigned long)pthread_self();
}
#include <stdlib.h>
#include <string.h>
#include "nano_attachment_common.h"
#include "nano_attachment.h"
HttpHeaderData* createHttpHeaderDataArray(int size) {
return (HttpHeaderData*)malloc(size * sizeof(HttpHeaderData));
}
HttpMetaData* createHttpMetaData() {
return (HttpMetaData*)malloc(sizeof(HttpMetaData));
}
void setHeaderElement(HttpHeaderData* arr, int index, nano_str_t key, nano_str_t value) {
if (arr == NULL) {
return;
}
arr[index].key = key;
arr[index].value = value;
}
*/
import "C"
import (
"github.com/envoyproxy/envoy/contrib/golang/common/go/api"
"strconv"
"strings"
"unsafe"
)
func convertBlockPageToString(block_page C.BlockPageData) string {
block_page_size := block_page.title_prefix.len +
block_page.title.len +
block_page.body_prefix.len +
block_page.body.len +
block_page.uuid_prefix.len +
block_page.uuid.len +
block_page.uuid_suffix.len
block_page_bytes := make([]byte, block_page_size)
location := 0
location = copyToSlice(
block_page_bytes,
unsafe.Pointer(block_page.title_prefix.data),
C.size_t(block_page.title_prefix.len),
location)
location = copyToSlice(
block_page_bytes,
unsafe.Pointer(block_page.title.data),
C.size_t(block_page.title.len),
location)
location = copyToSlice(
block_page_bytes,
unsafe.Pointer(block_page.body_prefix.data),
C.size_t(block_page.body_prefix.len),
location)
location = copyToSlice(
block_page_bytes,
unsafe.Pointer(block_page.body.data),
C.size_t(block_page.body.len),
location)
location = copyToSlice(
block_page_bytes,
unsafe.Pointer(block_page.uuid_prefix.data),
C.size_t(block_page.uuid_prefix.len),
location)
location = copyToSlice(
block_page_bytes,
unsafe.Pointer(block_page.uuid.data),
C.size_t(block_page.uuid.len),
location)
copyToSlice(
block_page_bytes,
unsafe.Pointer(block_page.uuid_suffix.data),
C.size_t(block_page.uuid_suffix.len),
location)
return string(block_page_bytes)
}
// The callbacks in the filter, like `DecodeHeaders`, can be implemented on demand.
// Because api.PassThroughStreamFilter provides a default implementation.
type filter struct {
api.PassThroughStreamFilter
callbacks api.FilterCallbackHandler
path string
config *config
session_id int64
session_data *C.HttpSessionData
cp_attachment *nano_attachment
request_structs *filterRequestStructs
body_buffer_chunk int
}
type filterRequestStructs struct {
http_start_data *C.HttpRequestFilterData
http_meta_data *C.HttpMetaData
http_headers *C.HttpHeaders
http_headers_data *C.HttpHeaderData
http_res_headers *C.ResHttpHeaders
http_body_data *C.nano_str_t
attachment_data *C.AttachmentData
}
func (f *filterRequestStructs) ZeroInitialize() {
if f.http_start_data != nil {
C.memset(unsafe.Pointer(f.http_start_data), 0, C.size_t(unsafe.Sizeof(*f.http_start_data)))
}
if f.http_meta_data != nil {
C.memset(unsafe.Pointer(f.http_meta_data), 0, C.size_t(unsafe.Sizeof(*f.http_meta_data)))
}
if f.http_headers != nil {
C.memset(unsafe.Pointer(f.http_headers), 0, C.size_t(unsafe.Sizeof(*f.http_headers)))
}
if f.http_headers_data != nil {
C.memset(unsafe.Pointer(f.http_headers_data), 0, C.size_t(unsafe.Sizeof(*f.http_headers_data)))
}
if f.attachment_data != nil {
C.memset(unsafe.Pointer(f.attachment_data), 0, C.size_t(unsafe.Sizeof(*f.attachment_data)))
}
}
func (f *filter) isSessionFinalized() bool {
return C.IsSessionFinalized((*C.NanoAttachment)(f.cp_attachment), (*C.HttpSessionData)(f.session_data)) == 1
}
func (f *filter) sendData(data unsafe.Pointer, chunkType C.HttpChunkType) C.AttachmentVerdictResponse {
attachment_data := f.request_structs.attachment_data
attachment_data.session_id = C.uint32_t(f.session_id)
attachment_data.chunk_type = chunkType // Adjust type as needed
attachment_data.session_data = f.session_data // Ensure `f.session_data` is compatible
attachment_data.data = C.DataBuffer(data) // Ensure `data` is compatible with `C.DataBuffer`
return C.SendDataNanoAttachment((*C.NanoAttachment)(f.cp_attachment), attachment_data)
}
func (f *filter) handleCustomResponse(verdict_response *C.AttachmentVerdictResponse) api.StatusType {
if verdict_response.web_response_data.web_response_type == C.CUSTOM_WEB_RESPONSE {
headers := map[string][]string{
"Content-Type": []string{"text/html"},
}
block_page_parts := C.GetBlockPage(
(*C.NanoAttachment)(f.cp_attachment),
(*C.HttpSessionData)(f.session_data),
(*C.AttachmentVerdictResponse)(verdict_response))
return f.sendLocalReplyInternal(int(block_page_parts.response_code), convertBlockPageToString(block_page_parts), headers)
}
redirect_data := C.GetRedirectPage(
(*C.NanoAttachment)(f.cp_attachment),
(*C.HttpSessionData)(f.session_data),
(*C.AttachmentVerdictResponse)(verdict_response))
redirect_location := redirect_data.redirect_location
redirect_location_slice := unsafe.Slice((*byte)(unsafe.Pointer(redirect_location.data)), redirect_location.len)
headers := map[string][]string{
"Location": []string{string(redirect_location_slice)},
}
return f.sendLocalReplyInternal(307, "", headers)
}
func (f *filter) finalizeRequest(verdict_response *C.AttachmentVerdictResponse) api.StatusType {
if C.AttachmentVerdict(verdict_response.verdict) == C.ATTACHMENT_VERDICT_DROP {
return f.handleCustomResponse(verdict_response)
}
return api.Continue
}
func (f *filter) handleHeaders(header api.HeaderMap) {
const envoy_headers_prefix = "x-envoy"
i := 0
header.Range(func(key, value string) bool {
if i > 10000 {
return true
}
api.LogInfof("inserting headers: key %s, value %s", key, value)
if strings.HasPrefix(key, envoy_headers_prefix) ||
key == "x-request-id" ||
key == ":method" ||
key == ":path" ||
key == ":scheme" ||
key == "x-forwarded-proto" {
return true
}
if key == ":authority" {
key = "Host"
}
key_nano_str := createNanoStrWithoutCopy(key)
value_nano_str := createNanoStrWithoutCopy(value)
C.setHeaderElement((*C.HttpHeaderData)(f.request_structs.http_headers_data), C.int(i), key_nano_str, value_nano_str)
i++
return true
})
http_headers := f.request_structs.http_headers
http_headers.data = f.request_structs.http_headers_data
http_headers.headers_count = C.size_t(i)
}
func (f *filter) sendBody(buffer api.BufferInstance, is_req bool) C.AttachmentVerdictResponse {
chunk_type := C.HTTP_REQUEST_BODY
if !is_req {
chunk_type = C.HTTP_RESPONSE_BODY
}
data := buffer.Bytes()
data_len := len(data)
buffer_size := 8 * 1024
num_of_buffers := ((data_len - 1) / buffer_size) + 1
// TO DO: FIX THIS ASAP
if num_of_buffers > 10000 {
num_of_buffers = 10000
}
for i := 0; i < num_of_buffers; i++ {
nanoStrPtr := (*C.nano_str_t)(unsafe.Pointer(uintptr(unsafe.Pointer(f.request_structs.http_body_data)) + uintptr(i)*unsafe.Sizeof(*f.request_structs.http_body_data)))
nanoStrPtr.data = (*C.uchar)(unsafe.Pointer(&data[i * buffer_size]))
if i + 1 == num_of_buffers {
nanoStrPtr.len = C.size_t(data_len - (i * buffer_size))
} else {
nanoStrPtr.len = C.size_t(buffer_size)
}
}
http_chunks_array := C.HttpBody{
data: f.request_structs.http_body_data,
bodies_count: C.size_t(num_of_buffers),
}
api.LogInfof("sending body data: %+v", http_chunks_array)
return f.sendData(unsafe.Pointer(&http_chunks_array), C.HttpChunkType(chunk_type))
}
func (f *filter) sendStartTransaction(start_transaction_data *C.HttpRequestFilterData) C.AttachmentVerdictResponse {
return f.sendData(unsafe.Pointer(&start_transaction_data), C.HTTP_REQUEST_FILTER)
}
func (f *filter) handleStartTransaction(header api.RequestHeaderMap) {
stream_info := f.callbacks.StreamInfo()
ip_location := 0
port_location := 1
listening_address := stream_info.DownstreamLocalAddress()
listening_address_arr := strings.Split(listening_address, ":")
listening_port, _ := strconv.Atoi(listening_address_arr[port_location])
client_address := stream_info.DownstreamRemoteAddress()
client_addr_arr := strings.Split(client_address, ":")
client_port, _ := strconv.Atoi(client_addr_arr[port_location])
host := strings.Split(header.Host(), ":")[0]
protocol, _ := stream_info.Protocol()
// init start transaction struct
meta_data := f.request_structs.http_meta_data
meta_data.http_protocol = createNanoStr(protocol)
meta_data.method_name = createNanoStr(header.Method())
meta_data.host = createNanoStr(host)
meta_data.listening_ip = createNanoStr(listening_address_arr[ip_location])
meta_data.listening_port = C.uint16_t(listening_port)
meta_data.uri = createNanoStr(header.Path())
meta_data.client_ip = createNanoStr(client_addr_arr[ip_location])
meta_data.client_port = C.uint16_t(client_port)
}
func (f *filter) sendLocalReplyInternal(ret_code int, custom_response string, headers map[string][]string) api.StatusType {
f.callbacks.SendLocalReply(ret_code, custom_response, headers, 0, "")
return api.LocalReply
}
func (f *filter) endInspectionPart(chunk_type C.HttpChunkType) api.StatusType {
api.LogInfof("Ending inspection for current chunk")
res := f.sendData(nil, chunk_type)
if C.AttachmentVerdict(res.verdict) != C.ATTACHMENT_VERDICT_INSPECT {
api.LogInfof("got final verict: %v", res.verdict)
return f.finalizeRequest(&res)
}
return api.Continue
}
// Callbacks which are called in request path
// The endStream is true if the request doesn't have body
func (f *filter) DecodeHeaders(header api.RequestHeaderMap, endStream bool) api.StatusType {
ret := api.Continue
defer RecoverPanic(&ret)
if f.isSessionFinalized() {
api.LogInfof("session has already been inspected, no need for further inspection")
return api.Continue
}
f.handleStartTransaction(header)
f.handleHeaders(header)
http_start_data := f.request_structs.http_start_data
http_start_data.meta_data = f.request_structs.http_meta_data
http_start_data.req_headers = f.request_structs.http_headers
http_start_data.contains_body = C.bool(!endStream)
res := f.sendData(unsafe.Pointer(http_start_data), C.HTTP_REQUEST_FILTER)
if C.AttachmentVerdict(res.verdict) != C.ATTACHMENT_VERDICT_INSPECT {
api.LogInfof("got final verict: %v", res.verdict)
return f.finalizeRequest(&res)
}
return ret
}
// DecodeData might be called multiple times during handling the request body.
// The endStream is true when handling the last piece of the body.
func (f *filter) DecodeData(buffer api.BufferInstance, endStream bool) api.StatusType {
ret := api.Continue
defer RecoverPanic(&ret)
if f.isSessionFinalized() {
return api.Continue
}
if endStream && buffer.Len() == 0 {
return f.endInspectionPart(C.HttpChunkType(C.HTTP_REQUEST_END))
}
if buffer.Len() == 0 {
return ret
}
res := f.sendBody(buffer, true)
if C.AttachmentVerdict(res.verdict) != C.ATTACHMENT_VERDICT_INSPECT {
api.LogInfof("got final verict: %v", res.verdict)
return f.finalizeRequest(&res)
}
if endStream {
return f.endInspectionPart(C.HttpChunkType(C.HTTP_REQUEST_END))
}
return ret
}
// Callbacks which are called in response path
// The endStream is true if the response doesn't have body
func (f *filter) EncodeHeaders(header api.ResponseHeaderMap, endStream bool) api.StatusType {
ret := api.Continue
defer RecoverPanic(&ret)
if f.isSessionFinalized() {
return api.Continue
}
const content_length_key = "content-length"
const status_code_key = ":status"
content_length_str, _ := header.Get(content_length_key)
status_code_str, _ := header.Get(status_code_key)
content_length, _ := strconv.Atoi(content_length_str)
status_code, _ := strconv.Atoi(status_code_str)
f.handleHeaders(header)
res_http_headers := f.request_structs.http_res_headers
res_http_headers.headers = f.request_structs.http_headers
res_http_headers.content_length = C.uint64_t(content_length)
res_http_headers.response_code = C.uint16_t(status_code)
res := f.sendData(unsafe.Pointer(res_http_headers), C.HTTP_RESPONSE_HEADER)
if C.AttachmentVerdict(res.verdict) != C.ATTACHMENT_VERDICT_INSPECT {
api.LogInfof("got final verict: %v", res.verdict)
return f.finalizeRequest(&res)
}
if endStream {
return f.endInspectionPart(C.HttpChunkType(C.HTTP_RESPONSE_END))
}
return ret
}
func injectBodyChunk(
curr_modification *C.struct_NanoHttpModificationList,
body_buffer_chunk int,
buffer *api.BufferInstance) {
for curr_modification != nil {
if (int(curr_modification.modification.orig_buff_index) == body_buffer_chunk) {
mod := curr_modification.modification // type: HttpInjectData
modifications := C.GoString(curr_modification.modification_buffer)
new_buffer:= insertAtPosition((*buffer).String(), modifications, int(mod.injection_pos))
(*buffer).SetString(new_buffer)
}
curr_modification = curr_modification.next
}
}
// EncodeData might be called multiple times during handling the response body.
// The endStream is true when handling the last piece of the body.
func (f *filter) EncodeData(buffer api.BufferInstance, endStream bool) api.StatusType {
ret := api.Continue
defer RecoverPanic(&ret)
if f.isSessionFinalized() {
return api.Continue
}
if endStream && buffer.Len() == 0 {
return f.endInspectionPart(C.HttpChunkType(C.HTTP_RESPONSE_END))
}
if buffer.Len() == 0 {
return ret
}
res := f.sendBody(buffer, false)
injectBodyChunk(res.modifications, f.body_buffer_chunk, &buffer)
f.body_buffer_chunk++
if C.AttachmentVerdict(res.verdict) != C.ATTACHMENT_VERDICT_INSPECT {
api.LogInfof("got final verict: %v", res.verdict)
return f.finalizeRequest(&res)
}
if endStream {
return f.endInspectionPart(C.HttpChunkType(C.HTTP_RESPONSE_END))
}
return ret
}
// ____________NOT IMPLEMENTED AT THE MOMENT____________
func (f *filter) DecodeTrailers(trailers api.RequestTrailerMap) api.StatusType {
// support suspending & resuming the filter in a background goroutine
return api.Continue
}
func (f *filter) EncodeTrailers(trailers api.ResponseTrailerMap) api.StatusType {
return api.Continue
}
// OnLog is called when the HTTP stream is ended on HTTP Connection Manager filter.
func (f *filter) OnLog() {}
// OnLogDownstreamStart is called when HTTP Connection Manager filter receives a new HTTP request
// (required the corresponding access log type is enabled)
func (f *filter) OnLogDownstreamStart() {}
// OnLogDownstreamPeriodic is called on any HTTP Connection Manager periodic log record
// (required the corresponding access log type is enabled)
func (f *filter) OnLogDownstreamPeriodic() {}
func (f *filter) OnDestroy(reason api.DestroyReason) {
freeHttpMetaDataFields(f.request_structs.http_meta_data)
f.request_structs.ZeroInitialize()
C.FiniSessionData((*C.NanoAttachment)(f.cp_attachment), f.session_data)
}

20
attachments/envoy/go.mod Executable file
View File

@ -0,0 +1,20 @@
module gitlab.ngen.checkpoint.com/Ngen/agent-core/attachments/envoy
// the version should >= 1.18
go 1.20
// NOTICE: these lines could be generated automatically by "go mod tidy"
require (
github.com/cncf/xds/go v0.0.0-20231128003011-0fa0005c9caa
github.com/envoyproxy/envoy v1.29.8-0.20240702140355-f3e7e90ed021
google.golang.org/protobuf v1.34.2
)
require github.com/go-chi/chi/v5 v5.1.0
require (
github.com/envoyproxy/protoc-gen-validate v1.0.2 // indirect
github.com/golang/protobuf v1.5.3 // indirect
google.golang.org/genproto/googleapis/api v0.0.0-20240102182953-50ed04b92917 // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20240102182953-50ed04b92917 // indirect
)

26
attachments/envoy/go.sum Executable file
View File

@ -0,0 +1,26 @@
github.com/cncf/xds/go v0.0.0-20231128003011-0fa0005c9caa h1:jQCWAUqqlij9Pgj2i/PB79y4KOPYVyFYdROxgaCwdTQ=
github.com/cncf/xds/go v0.0.0-20231128003011-0fa0005c9caa/go.mod h1:x/1Gn8zydmfq8dk6e9PdstVsDgu9RuyIIJqAaF//0IM=
github.com/envoyproxy/envoy v1.28.1-0.20231218050644-ca5d45d1887a h1:PQveCjvjXZS400K7z+uuouN/Q/dLhLpB5a/6GIC4v34=
github.com/envoyproxy/envoy v1.28.1-0.20231218050644-ca5d45d1887a/go.mod h1:STO/nOGQMw2DNOFTaokM1VY72GJBs0mbXq0I1lJr0XQ=
github.com/envoyproxy/envoy v1.29.8-0.20240702140355-f3e7e90ed021 h1:mTisjPVHGpxlWi7Yj7PnpxD0GeoauHcWvEgch069i+M=
github.com/envoyproxy/envoy v1.29.8-0.20240702140355-f3e7e90ed021/go.mod h1:ujBFxE543X8OePZG+FbeR9LnpBxTLu64IAU7A20EB9A=
github.com/envoyproxy/envoy v1.31.0 h1:NsTo+medzu0bMffXAjl+zKaViLOShKuIZWQnKKYq0/4=
github.com/envoyproxy/envoy v1.31.0/go.mod h1:ujBFxE543X8OePZG+FbeR9LnpBxTLu64IAU7A20EB9A=
github.com/envoyproxy/protoc-gen-validate v1.0.2 h1:QkIBuU5k+x7/QXPvPPnWXWlCdaBFApVqftFV6k087DA=
github.com/envoyproxy/protoc-gen-validate v1.0.2/go.mod h1:GpiZQP3dDbg4JouG/NNS7QWXpgx6x8QiMKdmN72jogE=
github.com/go-chi/chi/v5 v5.1.0 h1:acVI1TYaD+hhedDJ3r54HyA6sExp3HfXq7QWEEY/xMw=
github.com/go-chi/chi/v5 v5.1.0/go.mod h1:DslCQbL2OYiznFReuXYUmQ2hGd1aDpCnlMNITLSKoi8=
github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
github.com/golang/protobuf v1.5.3 h1:KhyjKVUg7Usr/dYsdSqoFveMYd5ko72D+zANwlG1mmg=
github.com/golang/protobuf v1.5.3/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38=
golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
google.golang.org/genproto/googleapis/api v0.0.0-20240102182953-50ed04b92917 h1:rcS6EyEaoCO52hQDupoSfrxI3R6C2Tq741is7X8OvnM=
google.golang.org/genproto/googleapis/api v0.0.0-20240102182953-50ed04b92917/go.mod h1:CmlNWB9lSezaYELKS5Ym1r44VrrbPUa7JTvw+6MbpJ0=
google.golang.org/genproto/googleapis/rpc v0.0.0-20240102182953-50ed04b92917 h1:6G8oQ016D88m1xAKljMlBOOGWDZkes4kMhgGFlf8WcQ=
google.golang.org/genproto/googleapis/rpc v0.0.0-20240102182953-50ed04b92917/go.mod h1:xtjpI3tXFPP051KaWnhvxkiubL/6dJ18vLVf7q2pTOU=
google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
google.golang.org/protobuf v1.34.2 h1:6xV6lTsCfpGD21XK49h7MhtcApnLqkfYgPcdHftf6hg=
google.golang.org/protobuf v1.34.2/go.mod h1:qYOHts0dSfpeUzUFpOMr/WGzszTmLH+DiWniOlNbLDw=

108
attachments/envoy/utils.go Executable file
View File

@ -0,0 +1,108 @@
package main
/*
#include <string.h>
#include "nano_attachment_common.h"
#include "nano_attachment.h"
#include <stdlib.h>
*/
import "C"
import (
"github.com/envoyproxy/envoy/contrib/golang/common/go/api"
"reflect"
"unsafe"
"os"
"runtime"
"strconv"
)
func getEnv(key, defaultValue string) string {
value, exists := os.LookupEnv(key)
if !exists {
return defaultValue
}
return value
}
var INSERT_POS_ERR_MSG = "Got invalid insertion position, will not insert."
func copyToSlice(dest []byte, src unsafe.Pointer, size C.size_t, location int) int {
C.memcpy(unsafe.Pointer(&dest[location]), src, size)
return location + int(size)
}
func newNanoStr(data []byte) *C.nano_str_t {
nanoStr := (*C.nano_str_t)(C.malloc(C.size_t(unsafe.Sizeof(C.nano_str_t{}))))
if nanoStr == nil {
panic("failed to allocate memory for nano_str_t struct")
}
nanoStr.len = C.size_t(len(data))
return nanoStr
}
func insertAtPosition(buff string, injection string, pos int) string {
if pos < 0 || pos > len(buff) {
api.LogDebugf(
INSERT_POS_ERR_MSG +
" Position: " +
strconv.Itoa(pos) +
", buffer's lenght: " +
strconv.Itoa(len(buff)))
return buff
}
return_buff := buff[:pos] + injection + buff[pos:]
return return_buff
}
func createNanoStr(str string) C.nano_str_t {
c_str := C.CString(str)
nanoStr := C.nano_str_t{
len: C.size_t(len(str)),
data: (*C.uchar)(unsafe.Pointer(c_str)),
}
return nanoStr
}
func createNanoStrWithoutCopy(str string) C.nano_str_t {
nanoStr := C.nano_str_t{
len: C.size_t(len(str)),
data: (*C.uchar)(unsafe.Pointer((*(*reflect.StringHeader)(unsafe.Pointer(&str))).Data)),
}
return nanoStr
}
func freeNanoStr(str *C.nano_str_t) {
C.free(unsafe.Pointer(str.data))
}
func freeHttpMetaDataFields(meta_data *C.HttpMetaData) {
freeNanoStr(&(*meta_data).http_protocol)
freeNanoStr(&(*meta_data).method_name)
freeNanoStr(&(*meta_data).host)
freeNanoStr(&(*meta_data).listening_ip)
freeNanoStr(&(*meta_data).uri)
freeNanoStr(&(*meta_data).client_ip)
}
func freeHeaders(header_arr *C.HttpHeaderData, header_slice []C.HttpHeaderData) {
C.free(unsafe.Pointer(header_arr))
for _, header := range header_slice {
freeNanoStr(&(header.key))
freeNanoStr(&(header.value))
}
}
func RecoverPanic(ret *api.StatusType) {
if e := recover(); e != nil {
const size = 64 << 10
buf := make([]byte, size)
buf = buf[:runtime.Stack(buf, false)]
api.LogErrorf("http: panic serving: %v\n%s", e, buf)
*ret = api.Continue
}
}

30
attachments/nano_attachment/CMakeLists.txt Normal file
View File

@ -0,0 +1,30 @@
add_subdirectory(nano_attachment_util)
include_directories(include)
set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -D_GNU_SOURCE -lpthread -Wall")
link_directories(${CMAKE_BINARY_DIR}/core)
link_directories(${CMAKE_BINARY_DIR}/core/shmem_ipc)
include_directories(${PROJECT_SOURCE_DIR}/core/include/attachments)
add_library(
nano_attachment
SHARED
nano_attachment.c
nano_configuration.c
nano_initializer.c
nano_utils.c
nano_attachment_io.c
nano_attachment_thread.c
nano_attachment_sender.c
nano_attachment_sender_thread.c
nano_attachment_metric.c
nano_compression.c
)
target_link_libraries(nano_attachment shmem_ipc_2 nano_attachment_util osrc_compression_utils)
install(TARGETS nano_attachment DESTINATION lib)
install(TARGETS nano_attachment DESTINATION nginx_attachment/lib PERMISSIONS OWNER_READ OWNER_WRITE OWNER_EXECUTE GROUP_READ GROUP_EXECUTE WORLD_READ)

22
attachments/nano_attachment/include/mock_nano_access.h Normal file
View File

@ -0,0 +1,22 @@
#ifndef __MOCK_ACCESS_H__
#define __MOCK_ACCESS_H__
#include "cmock.h"
extern "C" {
#include <unistd.h> // For the access function
}
class NanoAccessMocker : public CMockMocker<NanoAccessMocker>
{
public:
MOCK_METHOD2(access, int(const char *path, int mode));
};
CMOCK_MOCK_FUNCTION2(
NanoAccessMocker,
access,
int(const char *path, int mode)
);
#endif // __MOCK_ACCESS_H__

213
attachments/nano_attachment/include/mock_nano_attachment_io.h Normal file
View File

@ -0,0 +1,213 @@
#ifndef __MOCK_NANO_INITIALIZER_IO_H__
#define __MOCK_NANO_INITIALIZER_IO_H__
#include "cmock.h"
#include "nano_attachment_common.h"
extern "C" {
#include "nano_attachment_io.h"
}
class NanoAttachmentIoMocker : public CMockMocker<NanoAttachmentIoMocker>
{
public:
MOCK_METHOD1(
connect_to_comm_socket,
NanoCommunicationResult(NanoAttachment *attachment)
);
MOCK_METHOD1(
connect_to_registration_socket,
NanoCommunicationResult(NanoAttachment *attachment)
);
MOCK_METHOD6(
nano_metadata_sender,
void(
NanoAttachment *attachment,
HttpMetaData *metadata,
HttpEventThreadCtx *ctx,
uint32_t cur_request_id,
unsigned int *num_of_messages_sent,
bool is_verdict_requested
)
);
MOCK_METHOD7(
nano_header_sender,
void(
NanoAttachment *attachment,
HttpHeaders *headers,
HttpEventThreadCtx *ctx,
AttachmentDataType header_type,
uint32_t cur_request_id,
unsigned int *num_messages_sent,
bool is_verdict_requested
)
);
MOCK_METHOD5(
nano_send_response_code,
void(
NanoAttachment *attachment,
uint16_t response_code,
HttpEventThreadCtx *ctx,
uint32_t cur_request_id,
unsigned int *num_messages_sent
)
);
MOCK_METHOD5(
nano_send_response_content_length,
void(
NanoAttachment *attachment,
uint64_t content_length,
HttpEventThreadCtx *ctx,
uint32_t cur_request_id,
unsigned int *num_messages_sent
)
);
MOCK_METHOD6(
nano_body_sender,
void(
NanoAttachment *attachment,
HttpBody *bodies,
HttpEventThreadCtx *ctx,
AttachmentDataType body_type,
uint32_t cur_request_id,
unsigned int *num_messages_sent
)
);
MOCK_METHOD5(
nano_end_transaction_sender,
void(
NanoAttachment *attachment,
AttachmentDataType end_transaction_type,
HttpEventThreadCtx *ctx,
SessionID cur_request_id,
unsigned int *num_messages_sent
)
);
MOCK_METHOD4(
nano_request_delayed_verdict,
void(
NanoAttachment *attachment,
HttpEventThreadCtx *ctx,
SessionID cur_request_id,
unsigned int *num_messages_sent
)
);
MOCK_METHOD1(nano_send_metric_data_sender, void(NanoAttachment *Attachment));
};
CMOCK_MOCK_FUNCTION1(
NanoAttachmentIoMocker,
connect_to_comm_socket,
NanoCommunicationResult(NanoAttachment *attachment)
);
CMOCK_MOCK_FUNCTION1(
NanoAttachmentIoMocker,
connect_to_registration_socket,
NanoCommunicationResult(NanoAttachment *attachment)
);
CMOCK_MOCK_FUNCTION6(
NanoAttachmentIoMocker,
nano_metadata_sender,
void(
NanoAttachment *attachment,
HttpMetaData *metadata,
HttpEventThreadCtx *ctx,
uint32_t cur_request_id,
unsigned int *num_of_messages_sent,
bool is_verdict_requested
)
);
CMOCK_MOCK_FUNCTION7(
NanoAttachmentIoMocker,
nano_header_sender,
void(
NanoAttachment *attachment,
HttpHeaders *headers,
HttpEventThreadCtx *ctx,
AttachmentDataType header_type,
uint32_t cur_request_id,
unsigned int *num_messages_sent,
bool is_verdict_requested
)
);
CMOCK_MOCK_FUNCTION5(
NanoAttachmentIoMocker,
nano_send_response_code,
void(
NanoAttachment *attachment,
uint16_t response_code,
HttpEventThreadCtx *ctx,
uint32_t cur_request_id,
unsigned int *num_messages_sent
)
);
CMOCK_MOCK_FUNCTION5(
NanoAttachmentIoMocker,
nano_send_response_content_length,
void(
NanoAttachment *attachment,
uint64_t content_length,
HttpEventThreadCtx *ctx,
uint32_t cur_request_id,
unsigned int *num_messages_sent
)
);
CMOCK_MOCK_FUNCTION6(
NanoAttachmentIoMocker,
nano_body_sender,
void(
NanoAttachment *attachment,
HttpBody *bodies,
HttpEventThreadCtx *ctx,
AttachmentDataType body_type,
uint32_t cur_request_id,
unsigned int *num_messages_sent
)
);
CMOCK_MOCK_FUNCTION5(
NanoAttachmentIoMocker,
nano_end_transaction_sender,
void(
NanoAttachment *attachment,
AttachmentDataType end_transaction_type,
HttpEventThreadCtx *ctx,
SessionID cur_request_id,
unsigned int *num_messages_sent
)
);
CMOCK_MOCK_FUNCTION4(
NanoAttachmentIoMocker,
nano_request_delayed_verdict,
void(
NanoAttachment *attachment,
HttpEventThreadCtx *ctx,
SessionID cur_request_id,
unsigned int *num_messages_sent
)
);
CMOCK_MOCK_FUNCTION1(
NanoAttachmentIoMocker,
nano_send_metric_data_sender,
void(NanoAttachment *Attachment)
);
#endif // __MOCK_NANO_INITIALIZER_IO_H__

72
attachments/nano_attachment/include/mock_nano_attachment_sender.h Normal file
View File

@ -0,0 +1,72 @@
#ifndef __MOCK_NANO_ATTACHMENT_SENDER_H__
#define __MOCK_NANO_ATTACHMENT_SENDER_H__
#include "cmock.h"
#include "nano_attachment_common.h"
extern "C" {
#include "nano_attachment_sender.h"
}
class NanoAttachmentSenderMocker : public CMockMocker<NanoAttachmentSenderMocker>
{
public:
MOCK_METHOD2(SendMetadata, AttachmentVerdictResponse(NanoAttachment *attachment, AttachmentData *data));
MOCK_METHOD2(SendRequestHeaders, AttachmentVerdictResponse(NanoAttachment *attachment, AttachmentData *data));
MOCK_METHOD2(SendResponseHeaders, AttachmentVerdictResponse(NanoAttachment *attachment, AttachmentData *data));
MOCK_METHOD2(SendRequestBody, AttachmentVerdictResponse(NanoAttachment *attachment, AttachmentData *data));
MOCK_METHOD2(SendResponseBody, AttachmentVerdictResponse(NanoAttachment *attachment, AttachmentData *data));
MOCK_METHOD2(SendRequestEnd, AttachmentVerdictResponse(NanoAttachment *attachment, AttachmentData *data));
MOCK_METHOD2(SendResponseEnd, AttachmentVerdictResponse(NanoAttachment *attachment, AttachmentData *data));
MOCK_METHOD1(SendMetricData, NanoCommunicationResult(NanoAttachment *attachment));
};
CMOCK_MOCK_FUNCTION2(
NanoAttachmentSenderMocker,
SendMetadata,
AttachmentVerdictResponse(NanoAttachment *attachment, AttachmentData *data)
);
CMOCK_MOCK_FUNCTION2(
NanoAttachmentSenderMocker,
SendRequestHeaders,
AttachmentVerdictResponse(NanoAttachment *attachment, AttachmentData *data)
);
CMOCK_MOCK_FUNCTION2(
NanoAttachmentSenderMocker,
SendResponseHeaders,
AttachmentVerdictResponse(NanoAttachment *attachment, AttachmentData *data)
);
CMOCK_MOCK_FUNCTION2(
NanoAttachmentSenderMocker,
SendRequestBody,
AttachmentVerdictResponse(NanoAttachment *attachment, AttachmentData *data)
);
CMOCK_MOCK_FUNCTION2(
NanoAttachmentSenderMocker,
SendResponseBody,
AttachmentVerdictResponse(NanoAttachment *attachment, AttachmentData *data)
);
CMOCK_MOCK_FUNCTION2(
NanoAttachmentSenderMocker,
SendRequestEnd,
AttachmentVerdictResponse(NanoAttachment *attachment, AttachmentData *data)
);
CMOCK_MOCK_FUNCTION2(
NanoAttachmentSenderMocker,
SendResponseEnd,
AttachmentVerdictResponse(NanoAttachment *attachment, AttachmentData *data)
);
CMOCK_MOCK_FUNCTION1(
NanoAttachmentSenderMocker,
SendMetricData,
NanoCommunicationResult(NanoAttachment *attachment)
);
#endif // __MOCK_NANO_ATTACHMENT_SENDER_H__

42
attachments/nano_attachment/include/mock_nano_attachment_thread.h Normal file
View File

@ -0,0 +1,42 @@
#ifndef __MOCK_NANO_ATTACHMENT_THREAD_H__
#define __MOCK_NANO_ATTACHMENT_THREAD_H__
#include "cmock.h"
#include "nano_attachment_common.h"
extern "C" {
#include "nano_attachment_thread.h"
}
class NanoAttachmentThreadMocker : public CMockMocker<NanoAttachmentThreadMocker>
{
public:
MOCK_METHOD7(
NanoRunInThreadTimeout,
int(
NanoAttachment *attachment,
AttachmentData *data,
CpThreadRoutine thread_func,
void *arg,
int timeout_msecs,
char *func_name,
TransactionType transaction_type
)
);
};
CMOCK_MOCK_FUNCTION7(
NanoAttachmentThreadMocker,
NanoRunInThreadTimeout,
int(
NanoAttachment *attachment,
AttachmentData *data,
CpThreadRoutine thread_func,
void *arg,
int timeout_msecs,
char *func_name,
TransactionType transaction_type
)
);
#endif // __MOCK_NANO_ATTACHMENT_THREAD_H__

72
attachments/nano_attachment/include/mock_nano_compression.h Executable file
View File

@ -0,0 +1,72 @@
#ifndef __MOCK_NANO_COMPRESSION_H__
#define __MOCK_NANO_COMPRESSION_H__
#include "cmock.h"
#include "nano_attachment_common.h"
extern "C" {
#include "nano_compression.h"
}
class NanoCompressionMocker : public CMockMocker<NanoCompressionMocker>
{
public:
MOCK_METHOD3(
nano_compress_body,
HttpBody*(
NanoAttachment *attachment,
HttpBody *bodies,
HttpSessionData *session_data_p
)
);
MOCK_METHOD3(
nano_decompress_body,
HttpBody*(
NanoAttachment *attachment,
HttpBody *bodies,
HttpSessionData *session_data_p
)
);
MOCK_METHOD3(
nano_free_compressed_body,
void(
NanoAttachment *attachment,
HttpBody *bodies,
HttpSessionData *session_data_p
)
);
};
CMOCK_MOCK_FUNCTION3(
NanoCompressionMocker,
nano_compress_body,
HttpBody*(
NanoAttachment *attachment,
HttpBody *bodies,
HttpSessionData *session_data_p
)
);
CMOCK_MOCK_FUNCTION3(
NanoCompressionMocker,
nano_decompress_body,
HttpBody*(
NanoAttachment *attachment,
HttpBody *bodies,
HttpSessionData *session_data_p
)
);
CMOCK_MOCK_FUNCTION3(
NanoCompressionMocker,
nano_free_compressed_body,
void(
NanoAttachment *attachment,
HttpBody *bodies,
HttpSessionData *session_data_p
)
);
#endif // __MOCK_NANO_COMPRESSION_H__

39
attachments/nano_attachment/include/mock_nano_configuration.h Normal file
View File

@ -0,0 +1,39 @@
#ifndef __MOCK_NANO_CONFIGURATION_H__
#define __MOCK_NANO_CONFIGURATION_H__
#include "cmock.h"
#include "nano_attachment_common.h"
extern "C" {
#include "nano_configuration.h"
}
class NanoConfigurationMocker : public CMockMocker<NanoConfigurationMocker>
{
public:
MOCK_METHOD2(
init_attachment_config,
NanoCommunicationResult(
NanoAttachment *attachment,
const char *conf_path
)
);
MOCK_METHOD1(reset_attachment_config, NanoCommunicationResult(NanoAttachment *attachment));
};
CMOCK_MOCK_FUNCTION2(
NanoConfigurationMocker,
init_attachment_config,
NanoCommunicationResult(
NanoAttachment *attachment,
const char *conf_path
)
);
CMOCK_MOCK_FUNCTION1(
NanoConfigurationMocker,
reset_attachment_config,
NanoCommunicationResult(NanoAttachment *attachment)
);
#endif // __MOCK_NANO_CONFIGURATION_H__

52
attachments/nano_attachment/include/mock_nano_initializer.h Normal file
View File

@ -0,0 +1,52 @@
#ifndef __MOCK_NANO_INITIALIZER_H__
#define __MOCK_NANO_INITIALIZER_H__
#include "cmock.h"
#include "nano_attachment_common.h"
extern "C" {
#include "nano_initializer.h"
}
class NanoInitializerMocker : public CMockMocker<NanoInitializerMocker>
{
public:
MOCK_METHOD1(nano_attachment_init_process, NanoCommunicationResult(NanoAttachment *attachment));
MOCK_METHOD5(
write_to_service,
NanoCommunicationResult(
NanoAttachment *attachment,
int *socket,
void *data,
uint32_t size,
struct timeval *absolute_end_time
)
);
MOCK_METHOD1(handle_shmem_corruption, NanoCommunicationResult(NanoAttachment *attachment));
};
CMOCK_MOCK_FUNCTION1(
NanoInitializerMocker,
nano_attachment_init_process,
NanoCommunicationResult(NanoAttachment *attachment)
);
CMOCK_MOCK_FUNCTION5(
NanoInitializerMocker,
write_to_service,
NanoCommunicationResult(
NanoAttachment *attachment,
int *socket,
void *data,
uint32_t size,
struct timeval *absolute_end_time
)
);
CMOCK_MOCK_FUNCTION1(
NanoInitializerMocker,
handle_shmem_corruption,
NanoCommunicationResult(NanoAttachment *attachment)
);
#endif // __MOCK_NANO_INITIALIZER_H__

22
attachments/nano_attachment/include/mock_nano_poll.h Normal file
View File

@ -0,0 +1,22 @@
#ifndef __MOCK_NANO_POLL_H__
#define __MOCK_NANO_POLL_H__
#include "cmock.h"
extern "C" {
#include <poll.h>
}
class NanoPollMocker : public CMockMocker<NanoPollMocker>
{
public:
MOCK_METHOD3(poll, int(pollfd *fds, nfds_t nfds, int timeout));
};
CMOCK_MOCK_FUNCTION3(
NanoPollMocker,
poll,
int(pollfd *fds, nfds_t nfds, int timeout)
);
#endif // __MOCK_NANO_POLL_H__

23
attachments/nano_attachment/include/mock_nano_sender_thread.h Normal file
View File

@ -0,0 +1,23 @@
#ifndef __MOCK_NANO_ATTACHMENT_SENDER_THREAD_H__
#define __MOCK_NANO_ATTACHMENT_SENDER_THREAD_H__
#include "cmock.h"
#include "nano_attachment_common.h"
extern "C" {
#include "nano_attachment_sender_thread.h"
}
class NanoSenderThreadMocker : public CMockMocker<NanoSenderThreadMocker>
{
public:
MOCK_METHOD1(SendRequestEndThread, void *(void *_ctx));
};
CMOCK_MOCK_FUNCTION1(
NanoSenderThreadMocker,
SendRequestEndThread,
void *(void *_ctx)
);
#endif // __MOCK_NANO_ATTACHMENT_SENDER_THREAD_H__

50
attachments/nano_attachment/include/mock_nano_socket.h Normal file
View File

@ -0,0 +1,50 @@
#ifndef __MOCK_NANO_SOCKET_H__
#define __MOCK_NANO_SOCKET_H__
#include "cmock.h"
extern "C" {
#include <sys/socket.h>
}
class NanoSocketMocker : public CMockMocker<NanoSocketMocker>
{
public:
MOCK_METHOD3(socket, int(int domain, int type, int protocol));
MOCK_METHOD3(connect, int(int sockfd, const struct sockaddr *addr, socklen_t addrlen));
MOCK_METHOD1(close, int(int sockfd));
MOCK_METHOD3(write, ssize_t(int fd, const void *buf, size_t count));
MOCK_METHOD3(read, ssize_t(int fd, void *buf, size_t count));
};
CMOCK_MOCK_FUNCTION3(
NanoSocketMocker,
socket,
int(int domain, int type, int protocol)
);
CMOCK_MOCK_FUNCTION3(
NanoSocketMocker,
connect,
int(int sockfd, const struct sockaddr *addr, socklen_t addrlen)
);
CMOCK_MOCK_FUNCTION1(
NanoSocketMocker,
close,
int(int sockfd)
);
CMOCK_MOCK_FUNCTION3(
NanoSocketMocker,
write,
ssize_t(int fd, const void *buf, size_t count)
);
CMOCK_MOCK_FUNCTION3(
NanoSocketMocker,
read,
ssize_t(int fd, void *buf, size_t count)
);
#endif // __MOCK_NANO_SOCKET_H__

22
attachments/nano_attachment/include/mock_nano_stat.h Normal file
View File

@ -0,0 +1,22 @@
#ifndef __MOCK_NANO_STAT_H__
#define __MOCK_NANO_STAT_H__
#include "cmock.h"
extern "C" {
#include <sys/stat.h>
}
class NanoStatMocker : public CMockMocker<NanoStatMocker>
{
public:
MOCK_METHOD2(mkdir, int(const char *pathname, mode_t mode));
};
CMOCK_MOCK_FUNCTION2(
NanoStatMocker,
mkdir,
int(const char *pathname, mode_t mode)
);
#endif // __MOCK_NANO_STAT_H__

107
attachments/nano_attachment/include/mock_shmem_ipc.h Normal file
View File

@ -0,0 +1,107 @@
#ifndef __MOCK_SHMEM_IPC__
#define __MOCK_SHMEM_IPC__
#include "cmock.h"
#include "cptest.h"
extern "C" {
#include "shmem_ipc_2.h"
}
class NanoShmemIPCMocker : public CMockMocker<NanoShmemIPCMocker>
{
public:
MOCK_METHOD7(
initIpc,
SharedMemoryIPC *(
const char queue_name[32],
uint32_t user_id,
uint32_t group_id,
int is_owner,
uint16_t num_of_queue_elem,
const LoggingData *logging_data,
void (*debug_func)(
const LoggingData *loggin_data,
uint32_t worker_id,
int is_error,
const char *func,
const char *file,
int line_num,
const char *fmt,
...
)
)
);
MOCK_METHOD2(destroyIpc, void(SharedMemoryIPC *ipc, int is_owner));
MOCK_METHOD2(resetIpc, void(SharedMemoryIPC *ipc, uint16_t num_of_data_segments));
MOCK_METHOD3(
sendData,
int(SharedMemoryIPC *ipc, const uint16_t data_to_send_size, const char *data_to_send)
);
MOCK_METHOD4(
sendChunkedData,
int(
SharedMemoryIPC *ipc,
const uint16_t *data_to_send_sizes,
const char **data_elem_to_send,
const uint8_t num_of_data_elem
)
);
MOCK_METHOD3(
receiveData,
int(SharedMemoryIPC *ipc, uint16_t *received_data_size, const char **received_data)
);
MOCK_METHOD1(popData, int(SharedMemoryIPC *ipc));
MOCK_METHOD1(isDataAvailable, int(SharedMemoryIPC *ipc));
MOCK_METHOD2(isCorruptedShmem, int(SharedMemoryIPC *ipc, int));
};
CMOCK_MOCK_FUNCTION7(
NanoShmemIPCMocker,
initIpc,
SharedMemoryIPC *(
const char queue_name[32],
uint32_t user_id,
uint32_t group_id,
int is_owner,
uint16_t num_of_queue_elem,
const LoggingData *logging_data,
void (*debug_func)(
const LoggingData *loggin_data,
uint32_t worker_id,
int is_error,
const char *func,
const char *file,
int line_num,
const char *fmt,
...
)
)
);
CMOCK_MOCK_FUNCTION2(NanoShmemIPCMocker, destroyIpc, void(SharedMemoryIPC *ipc, int is_owner));
CMOCK_MOCK_FUNCTION3(
NanoShmemIPCMocker,
sendData,
int(SharedMemoryIPC *ipc, const uint16_t data_to_send_size, const char *data_to_send)
)
CMOCK_MOCK_FUNCTION4(
NanoShmemIPCMocker,
sendChunkedData,
int(
SharedMemoryIPC *ipc,
const uint16_t *data_to_send_sizes,
const char **data_elem_to_send,
const uint8_t num_of_data_elem
)
);
CMOCK_MOCK_FUNCTION3(
NanoShmemIPCMocker,
receiveData,
int(SharedMemoryIPC *ipc, uint16_t *received_data_size, const char **received_data)
);
CMOCK_MOCK_FUNCTION1(NanoShmemIPCMocker, popData, int(SharedMemoryIPC *ipc));
CMOCK_MOCK_FUNCTION1(NanoShmemIPCMocker, isDataAvailable, int(SharedMemoryIPC *ipc));
CMOCK_MOCK_FUNCTION2(NanoShmemIPCMocker, resetIpc, void(SharedMemoryIPC *ipc, uint16_t num_of_data_segments));
CMOCK_MOCK_FUNCTION2(NanoShmemIPCMocker, isCorruptedShmem, int(SharedMemoryIPC *ipc, int));
#endif // __MOCK_SHMEM_IPC__

616
attachments/nano_attachment/nano_attachment.c Normal file
View File

@ -0,0 +1,616 @@
#include "nano_attachment.h"
#include <stdlib.h>
#include <unistd.h>
#include <string.h>
#include <time.h>
#include <errno.h>
#include <sys/un.h>
#include <sys/socket.h>
#include "nano_attachment_sender.h"
#include "nano_attachment_metric.h"
#include "nano_initializer.h"
#include "nano_configuration.h"
#include "nano_utils.h"
#include "attachment_types.h"
#include "nano_blockpage.h"
#include "compression_utils.h"
#include "nano_compression.h"
NanoAttachment *
InitNanoAttachment(uint8_t attachment_type, int worker_id, int num_of_workers, int logging_fd)
{
NanoAttachment *attachment = malloc(sizeof(NanoAttachment));
if (attachment == NULL) {
return NULL;
}
memset(attachment, 0, sizeof(NanoAttachment));
attachment->shared_verdict_signal_path[0] = '\0';
attachment->worker_id = worker_id;
attachment->num_of_workers = num_of_workers;
attachment->nano_user_id = getuid();
attachment->nano_group_id = getgid();
attachment->registration_socket = -1;
attachment->registration_state = NOT_REGISTERED;
attachment->attachment_type = attachment_type;
attachment->nano_service_ipc = NULL;
attachment->comm_socket = -1;
attachment->logging_data = NULL;
if (set_docker_id(attachment) == NANO_ERROR) {
write_dbg(attachment, 0, DBG_LEVEL_WARNING, "Could not evaluate container id");
close_logging_fd(attachment);
free(attachment);
return NULL;
}
if (set_logging_fd(attachment, logging_fd) == NANO_ERROR) {
free(attachment);
return NULL;
}
attachment->logging_data = initLoggingData(
attachment->logging_fd,
DBG_LEVEL_INFO,
attachment->worker_id
);
if (attachment->logging_data == NULL) {
write_dbg(attachment, 0, DBG_LEVEL_WARNING, "Failed to initialize logging data");
return NULL;
}
if (set_unique_id(attachment) == NANO_ERROR) {
write_dbg(attachment, 0, DBG_LEVEL_WARNING, "Could not evaluate unique name");
close_logging_fd(attachment);
free(attachment);
return NULL;
}
attachment->is_configuration_updated = NANO_ERROR;
attachment->current_config_version = 0;
attachment->fail_mode_verdict = NANO_OK;
attachment->fail_mode_delayed_verdict = NANO_OK;
attachment->dbg_level = DBG_LEVEL_INFO;
attachment->num_of_connection_attempts = 0;
attachment->fail_open_timeout = 50;
attachment->fail_open_delayed_timeout = 150;
attachment->sessions_per_minute_limit_verdict = ATTACHMENT_VERDICT_ACCEPT;
attachment->max_sessions_per_minute = 0;
attachment->req_max_proccessing_ms_time = 3000;
attachment->res_max_proccessing_ms_time = 3000;
attachment->registration_thread_timeout_msec = 100;
attachment->req_start_thread_timeout_msec = 100;
attachment->req_header_thread_timeout_msec = 100;
attachment->req_body_thread_timeout_msec = 150;
attachment->res_header_thread_timeout_msec = 100;
attachment->res_body_thread_timeout_msec = 150;
attachment->waiting_for_verdict_thread_timeout_msec = 150;
attachment->metric_timeout_timeout = 100;
attachment->inspection_mode = NON_BLOCKING_THREAD;
attachment->num_of_nano_ipc_elements = 200;
attachment->keep_alive_interval_msec = DEFAULT_KEEP_ALIVE_INTERVAL_MSEC;
if (nano_attachment_init_process(attachment) != NANO_OK) {
write_dbg(attachment, 0, DBG_LEVEL_WARNING, "Could not initialize nano attachment");
close_logging_fd(attachment);
free(attachment);
return NULL;
}
reset_metric_data(attachment);
return attachment;
};
void
FiniNanoAttachment(NanoAttachment *attachment)
{
close_logging_fd(attachment);
free(attachment);
};
NanoCommunicationResult
RestartAttachmentConfiguration(NanoAttachment *attachment)
{
return reset_attachment_config(attachment);
};
HttpSessionData *
InitSessionData(NanoAttachment *attachment, SessionID session_id)
{
HttpSessionData *session_data = malloc(sizeof(HttpSessionData));
if (session_data == NULL) {
return NULL;
}
write_dbg(
attachment,
session_id,
DBG_LEVEL_TRACE,
"Initiating session data"
);
session_data->was_request_fully_inspected = 0;
session_data->verdict = TRAFFIC_VERDICT_INSPECT;
session_data->session_id = session_id;
session_data->remaining_messages_to_reply = 0;
session_data->req_proccesing_time = 0;
session_data->res_proccesing_time = 0;
session_data->processed_req_body_size = 0;
session_data->processed_res_body_size = 0;
session_data->response_data.compression_type = NO_COMPRESSION;
session_data->response_data.compression_stream = NULL;
session_data->response_data.decompression_stream = NULL;
return session_data;
};
void
FiniSessionData(NanoAttachment *attachment, HttpSessionData *session_data)
{
write_dbg(
attachment,
session_data->session_id,
DBG_LEVEL_DEBUG,
"Freeing session data for session_id"
);
if (session_data->response_data.compression_stream != NULL) {
finiCompressionStream(session_data->response_data.compression_stream);
session_data->response_data.compression_stream = NULL;
}
if (session_data->response_data.decompression_stream != NULL) {
finiCompressionStream(session_data->response_data.decompression_stream);
session_data->response_data.decompression_stream = NULL;
}
free(session_data);
};
void
UpdateMetric(NanoAttachment *attachment, AttachmentMetricType metric_type, uint64_t value)
{
updateMetricField(attachment, metric_type, value);
}
void
SendAccumulatedMetricData(NanoAttachment *attachment)
{
SendMetricData(attachment);
}
AttachmentVerdictResponse
SendDataNanoAttachment(NanoAttachment *attachment, AttachmentData *data)
{
switch (data->chunk_type) {
case HTTP_REQUEST_FILTER: {
return SendRequestFilter(attachment, data);
}
case HTTP_REQUEST_METADATA: {
return SendMetadata(attachment, data);
}
case HTTP_REQUEST_HEADER: {
return SendRequestHeaders(attachment, data);
}
case HTTP_REQUEST_BODY: {
return SendRequestBody(attachment, data);
}
case HTTP_REQUEST_END: {
return SendRequestEnd(attachment, data);
}
case HTTP_RESPONSE_HEADER: {
return SendResponseHeaders(attachment, data);
}
case HTTP_RESPONSE_BODY: {
return SendResponseBody(attachment, data);
}
case HTTP_RESPONSE_END: {
return SendResponseEnd(attachment, data);
}
default:
break;
}
AttachmentVerdictResponse response = {
.verdict = ATTACHMENT_VERDICT_INSPECT,
.session_id = data->session_id,
.modifications = NULL
};
return response;
}
///
/// @brief Connects to the keep-alive socket.
///
/// @param attachment A pointer to a NanoAttachment struct containing attachment information.
///
/// @return An int representing an opened socket, if failed returns -1.
///
static int
connect_to_keep_alive_socket(NanoAttachment *attachment)
{
struct sockaddr_un server;
int keep_alive_socket;
// Connect a new socket.
keep_alive_socket = socket(AF_UNIX, SOCK_STREAM, 0);
if (keep_alive_socket < 0) {
write_dbg(
attachment,
attachment->worker_id,
DBG_LEVEL_WARNING,
"Could not create socket, Error: %s",
strerror(errno)
);
return keep_alive_socket;
}
server.sun_family = AF_UNIX;
strncpy(server.sun_path, SHARED_KEEP_ALIVE_PATH, sizeof(server.sun_path) - 1);
if (connect(keep_alive_socket, (struct sockaddr *)&server, sizeof(struct sockaddr_un)) != -1 ) {
return keep_alive_socket;
}
write_dbg(
attachment,
attachment->worker_id,
DBG_LEVEL_DEBUG,
"Could not connect to nano service. Path: %s, Error: %s, Errno: %d",
server.sun_path,
strerror(errno),
errno
);
close(keep_alive_socket);
return -1;
}
///
/// @brief Sends the keep-alive signal to the alive socket.
///
/// @param attachment A pointer to a NanoAttachment struct containing attachment information.
/// @param keep_alive_socket Socket descriptor for the keep-alive socket.
///
/// @return A NanoCommunicationResult indicating the result of the communication operation.
///
static NanoCommunicationResult
send_keep_alive_to_alive_socket(NanoAttachment *attachment, int keep_alive_socket)
{
uint8_t container_id_size = strlen(attachment->container_id);
struct timeval timeout = get_absolute_timeout_val_sec(1);
NanoCommunicationResult res;
// Exchanging worker id with the nano service.
res = write_to_service(
attachment,
&keep_alive_socket,
&attachment->worker_id,
sizeof(attachment->worker_id),
&timeout
);
if (res != NANO_OK) {
// Failed to send worker id
write_dbg(attachment, attachment->worker_id, DBG_LEVEL_WARNING, "Failed to send worker id");
return NANO_ERROR;
}
// Exchanging container id size with the nano service.
res = write_to_service(
attachment,
&keep_alive_socket,
&container_id_size,
sizeof(container_id_size),
&timeout
);
if (res != NANO_OK) {
// Failed to send container id size.
write_dbg(attachment, attachment->worker_id, DBG_LEVEL_WARNING, "Failed to send container id size");
return NANO_ERROR;
}
if (container_id_size > 0) {
// Exchanging container id with the nano service.
res = write_to_service(
attachment,
&keep_alive_socket,
attachment->container_id,
container_id_size,
&timeout
);
if (res != NANO_OK) {
// Failed to send container id name.
write_dbg(attachment, attachment->worker_id, DBG_LEVEL_WARNING, "Failed to send container id");
return NANO_ERROR;
}
}
return NANO_OK;
}
void
SendKeepAlive(NanoAttachment *attachment)
{
int keep_alive_socket;
NanoCommunicationResult res;
write_dbg(
attachment,
attachment->worker_id,
DBG_LEVEL_DEBUG,
"Keep alive signal. Family id: %s, UID: %u",
attachment->container_id,
attachment->worker_id
);
keep_alive_socket = connect_to_keep_alive_socket(attachment);
if (keep_alive_socket < 0) {
write_dbg(attachment, attachment->worker_id, DBG_LEVEL_WARNING, "Failed to connect to keep alive socket");
return;
}
write_dbg(
attachment,
attachment->worker_id,
DBG_LEVEL_DEBUG,
"connected to socket: %d. sending keep alive signals"
);
res = send_keep_alive_to_alive_socket(attachment, keep_alive_socket);
if (res == NANO_ERROR) {
write_dbg(attachment, attachment->worker_id, DBG_LEVEL_WARNING, "Failed to send keep alive data");
}
close(keep_alive_socket);
}
int
IsSessionFinalized(NanoAttachment *attachment, HttpSessionData *session_data)
{
if (session_data->verdict == TRAFFIC_VERDICT_INSPECT) {
write_dbg(
attachment,
attachment->worker_id,
DBG_LEVEL_TRACE,
"Inspecting data for session id: %d",
session_data->session_id
);
return 0;
}
write_dbg(
attachment,
attachment->worker_id,
DBG_LEVEL_TRACE,
"Skipping already inspected for session id: %d",
session_data->session_id
);
return 1;
}
NanoWebResponseType
GetWebResponseType(
NanoAttachment *attachment,
HttpSessionData *session_data,
AttachmentVerdictResponse *response
)
{
if (response->web_response_data == NULL) {
write_dbg(
attachment,
session_data->session_id,
DBG_LEVEL_WARNING,
"Trying to get web response with no response object"
);
return NO_WEB_RESPONSE;
}
return response->web_response_data->web_response_type;
}
int
IsResponseWithModification(
NanoAttachment *attachment,
HttpSessionData *session_data,
AttachmentVerdictResponse *response
)
{
int res = response->modifications != NULL;
write_dbg(
attachment,
session_data->session_id,
DBG_LEVEL_TRACE,
"Response %s have modifications",
res ? "does" : "does not"
);
return res;
}
NanoResponseModifications
GetResponseModifications(
NanoAttachment *attachment,
HttpSessionData *session_data,
AttachmentVerdictResponse *response
)
{
if (response == NULL) {
write_dbg(
attachment,
session_data->session_id,
DBG_LEVEL_WARNING,
"Trying to get modifications with no response object"
);
return (NanoResponseModifications) {
.modifications = NULL
};
}
return (NanoResponseModifications) {
.modifications = response->modifications
};
}
BlockPageData
GetBlockPage(NanoAttachment *attachment, HttpSessionData *session_data, AttachmentVerdictResponse *response)
{
WebResponseData *web_response_data = response->web_response_data;
CustomResponseData *custom_response_data;
if (web_response_data->web_response_type != CUSTOM_WEB_RESPONSE) {
write_dbg(
attachment,
session_data->session_id,
DBG_LEVEL_WARNING,
"Trying to generate custom block page with a non custom response object"
);
return (BlockPageData) {
.response_code = 0,
.title_prefix = { .len = 0, .data = NULL },
.title = { .len = 0, .data = NULL },
.body_prefix = { .len = 0, .data = NULL },
.body = { .len = 0, .data = NULL },
.uuid_prefix = { .len = 0, .data = NULL },
.uuid = { .len = 0, .data = NULL },
.uuid_suffix = { .len = 0, .data = NULL }
};
}
write_dbg(
attachment,
session_data->session_id,
DBG_LEVEL_TRACE,
"Getting custom block page"
);
custom_response_data = (CustomResponseData *) web_response_data->data;
return (BlockPageData) {
.response_code = custom_response_data->response_code,
.title_prefix = { .len = strlen(title_prefix), .data = (unsigned char *)title_prefix },
.title = { .len = strlen((char *)custom_response_data->title), .data = custom_response_data->title },
.body_prefix = { .len = strlen(body_prefix), .data = (unsigned char *)body_prefix },
.body = { .len = strlen((char *)custom_response_data->body), .data = custom_response_data->body },
.uuid_prefix = { .len = strlen(uuid_prefix), .data = (unsigned char *)uuid_prefix },
.uuid = { .len = strlen((char *)web_response_data->uuid), .data = web_response_data->uuid },
.uuid_suffix = { .len = strlen(uuid_suffix), .data = (unsigned char *)uuid_suffix }
};
}
RedirectPageData
GetRedirectPage(NanoAttachment *attachment, HttpSessionData *session_data, AttachmentVerdictResponse *response)
{
WebResponseData *web_response_data = response->web_response_data;
RedirectData *redirect_data;
if (web_response_data->web_response_type != REDIRECT_WEB_RESPONSE) {
write_dbg(
attachment,
session_data->session_id,
DBG_LEVEL_WARNING,
"Trying to generate custom block page with a non redirect response object"
);
return (RedirectPageData) {
.redirect_location = { .len = 0, .data = NULL }
};
}
write_dbg(
attachment,
session_data->session_id,
DBG_LEVEL_TRACE,
"Getting redirect data"
);
redirect_data = (RedirectData *) web_response_data->data;
return (RedirectPageData) {
.redirect_location = {
.len = strlen((char*)redirect_data->redirect_location),
.data = redirect_data->redirect_location
}
};
}
void
FreeAttachmentResponseContent(
NanoAttachment *attachment,
HttpSessionData *session_data,
AttachmentVerdictResponse *response
)
{
NanoHttpModificationList *current_modification;
NanoHttpModificationList *modification_list;
if (response == NULL) {
write_dbg(
attachment,
session_data->session_id,
DBG_LEVEL_WARNING,
"Attempting to free NULL response"
);
return;
}
write_dbg(
attachment,
session_data->session_id,
DBG_LEVEL_TRACE,
"Freeing AttachmentResponse object"
);
if (response->web_response_data != NULL) {
write_dbg(
attachment,
session_data->session_id,
DBG_LEVEL_TRACE,
"Freeing custom web response data"
);
free(response->web_response_data->data);
free(response->web_response_data);
response->web_response_data = NULL;
}
if (response->modifications != NULL) {
modification_list = response->modifications;
while (modification_list) {
write_dbg(
attachment,
session_data->session_id,
DBG_LEVEL_TRACE,
"Freeing modifications list"
);
current_modification = modification_list;
modification_list = modification_list->next;
free(current_modification);
}
response->modifications = NULL;
}
return;
}
HttpBody *
compressBody(NanoAttachment *attachment, HttpSessionData *session_data, HttpBody *bodies)
{
return nano_compress_body(attachment, bodies, session_data);
}
HttpBody *
decompressBody(NanoAttachment *attachment, HttpSessionData *session_data, HttpBody *bodies)
{
return nano_decompress_body(attachment, bodies, session_data);
}
void
freeCompressedBody(NanoAttachment *attachment, HttpSessionData *session_data, HttpBody *bodies)
{
nano_free_compressed_body(attachment, bodies, session_data);
}

1776
attachments/nano_attachment/nano_attachment_io.c Normal file
View File

File diff suppressed because it is too large Load Diff

230
attachments/nano_attachment/nano_attachment_io.h Normal file
View File

@ -0,0 +1,230 @@
#ifndef __NANO_ATTACHMENT_IO_H__
#define __NANO_ATTACHMENT_IO_H__
#include <unistd.h>
#include "nano_attachment_common.h"
#include "nano_initializer.h"
#include "nano_attachment_sender_thread.h"
#include "shmem_ipc_2.h"
/// @brief Sends session data chunk to a nano service for inspection.
///
/// This function sends the provided data fragments to the nano service for inspection.
///
/// @param attachment A pointer to a NanoAttachment structure representing the attachment to the nano service.
/// @param fragments An array of pointers to character arrays representing the data fragments to send.
/// @param fragments_sizes An array of uint16_t values representing the sizes of the data fragments.
/// @param num_of_data_elem An 8-bit integer representing the number of data elements (fragments) to send.
/// @param cur_session_id An unsigned 32-bit integer representing the current session ID.
/// @param chunk_type An enumeration representing the type of data chunk being sent.
///
/// @return NANO_OK if the data is sent successfully, NANO_ERROR otherwise.
///
NanoCommunicationResult
send_session_data_to_service(
NanoAttachment *attachment,
char **fragments,
const uint16_t *fragments_sizes,
uint8_t num_of_data_elem,
uint32_t cur_session_id,
AttachmentDataType chunk_type
);
///
/// @brief Connect to the communication socket.
///
/// This function creates a new socket and connects it to the verdict
/// Unix domain socket address. If the attachment already has a communication
/// socket open, it is closed before creating a new one.
///
/// @param[in] attachment The NanoAttachment struct containing socket information.
/// @returns A NanoCommunicationResult indicating the success of the operation.
///
NanoCommunicationResult connect_to_comm_socket(NanoAttachment *attachment);
///
/// @brief Create an unix socket and connect to the attachment registration service.
/// @param[in] attachment Points to initiated NanoAttachment struct.
/// @returns NanoCommunicationResult
/// - #NANO_OK
/// - #NANO_ERROR
///
NanoCommunicationResult connect_to_registration_socket(NanoAttachment *attachment);
/// @brief Receives and processes replies from a nano service regarding traffic inspection verdicts.
///
/// This function waits for replies from the service and handles each reply based on the verdict received.
///
/// @param attachment A pointer to a NanoAttachment structure representing the attachment to the nano service.
/// @param session_data A pointer to a HttpSessionData which holds the session data.
/// @param web_response_data A pointer to a WebResponseData structure representing the response data.
/// @param modification_list A pointer to a pointer to a NanoHttpModificationList structure
/// representing a list of HTTP modifications.
///
/// @return NANO_OK if the function completes successfully
/// NANO_ERROR if an error occurs during processing
/// NANO_HTTP_FORBIDDEN if a drop verdict is received.
///
NanoCommunicationResult
service_reply_receiver(
NanoAttachment *attachment,
HttpSessionData *session_data,
WebResponseData **web_response_data,
NanoHttpModificationList **modification_list,
AttachmentDataType chunk_type
);
///
/// @brief Sends request start metadata for inspection to the nano service.
///
/// @param attachment Pointer to the NanoAttachment struct representing the attachment.
/// @param metadata Pointer to the HttpMetaData struct containing the HTTP metadata.
/// @param ctx Pointer to the HttpEventThreadCtx struct containing the HTTP event context.
/// @param cur_request_id The current request ID.
/// @param num_of_messages_sent Pointer to an unsigned int to store the number of messages sent.
/// @param is_verdict_requested Boolean value indicating if a verdict is requested.
///
void
nano_metadata_sender(
NanoAttachment *attachment,
HttpMetaData *metadata,
HttpEventThreadCtx *ctx,
uint32_t cur_request_id,
unsigned int *num_of_messages_sent,
bool is_verdict_requested
);
///
/// @brief Sends a response code for inspection.
///
/// This function sends a response code for inspection to a service.
///
/// @param attachment A pointer to the NanoAttachment structure.
/// @param response_code The response code to send.
/// @param ctx The HttpEventThreadCtx context.
/// @param cur_request_id The current request ID.
/// @param num_messages_sent A pointer to the number of messages sent.
///
void
nano_send_response_code(
NanoAttachment *attachment,
uint16_t response_code,
HttpEventThreadCtx *ctx,
uint32_t cur_request_id,
unsigned int *num_messages_sent
);
///
/// @brief Sends the content length to the intaker.
///
/// This function sends the content length to the intaker for processing.
///
/// @param attachment A pointer to the NanoAttachment structure.
/// @param content_length The content length to send.
/// @param ctx The HttpEventThreadCtx context.
/// @param cur_request_id The current request ID.
/// @param num_messages_sent A pointer to the number of messages sent.
///
void
nano_send_response_content_length(
NanoAttachment *attachment,
uint64_t content_length,
HttpEventThreadCtx *ctx,
uint32_t cur_request_id,
unsigned int *num_messages_sent
);
///
/// @brief Sends HTTP headers for inspection using a NanoAttachment.
///
/// This function takes a NanoAttachment pointer, an HttpHeaders struct containing the headers to send,
/// the type of the headers (request or response), the current request ID, and a pointer to store
/// the number of messages sent.
///
/// @param attachment Pointer to the NanoAttachment struct representing the attachment.
/// @param headers Pointer to the HttpHeaders struct containing the headers to send.
/// @param ctx Pointer to the HttpEventThreadCtx struct containing the context of the current thread.
/// @param header_type Type of the headers (REQUEST_HEADER or RESPONSE_HEADER).
/// @param cur_request_id Current request ID.
/// @param num_messages_sent Pointer to an unsigned int to store the number of messages sent.
///
void
nano_header_sender(
NanoAttachment *attachment,
HttpHeaders *headers,
HttpEventThreadCtx *ctx,
AttachmentDataType header_type,
uint32_t cur_request_id,
unsigned int *num_messages_sent,
bool is_verdict_requested
);
///
/// @brief Sends the body of a request or response for inspection to a nano service.
///
/// This function iterates over the body chunks, creates fragments, and sends them
/// in bulk to the service. It also handles the final chunk and updates the number
/// of messages sent.
///
/// @param attachment Pointer to a NanoAttachment struct representing the attachment/module.
/// @param bodies Pointer to an HttpBody struct containing the HTTP request/response body data.
/// @param ctx Pointer to an HttpEventThreadCtx struct representing the HTTP event thread context.
/// @param body_type Enum value indicating whether the body is a request or response body.
/// @param cur_request_id Current request ID for logging and tracking purposes.
/// @param num_messages_sent Pointer to an unsigned int to track the number of messages sent.
///
void
nano_body_sender(
NanoAttachment *attachment,
HttpBody *bodies,
HttpEventThreadCtx *ctx,
AttachmentDataType body_type,
uint32_t cur_request_id,
unsigned int *num_messages_sent
);
///
/// @brief Sends an end transaction event to a service for inspection.
///
/// @param attachment The NanoAttachment struct representing the attachment/module.
/// @param end_transaction_type The type of end transaction event (REQUEST_END or RESPONSE_END).
/// @param ctx Pointer to the HttpEventThreadCtx struct containing the context of the current thread.
/// @param cur_request_id The ID of the current request.
/// @param num_messages_sent Pointer to an unsigned integer to store the number of messages sent.
/// @return NANO_OK if the end transaction event was sent successfully, NANO_ERROR otherwise.
///
void
nano_end_transaction_sender(
NanoAttachment *attachment,
AttachmentDataType end_transaction_type,
HttpEventThreadCtx *ctx,
SessionID cur_request_id,
unsigned int *num_messages_sent
);
///
/// @brief Sends delayed transaction event to a service for inspection.
///
/// @param attachment The NanoAttachment struct representing the attachment/module.
/// @param ctx Pointer to the HttpEventThreadCtx struct containing the context of the current thread.
/// @param cur_request_id The ID of the current request.
/// @param num_messages_sent Pointer to an unsigned integer to store the number of messages sent.
///
void
nano_request_delayed_verdict(
NanoAttachment *attachment,
HttpEventThreadCtx *ctx,
SessionID cur_request_id,
unsigned int *num_messages_sent
);
///
/// @brief Sends attachment's metric data to the service.
///
/// @param attachment The NanoAttachment struct representing the attachment/module, which contains the metric data.
///
void
nano_send_metric_data_sender(NanoAttachment *attachment);
#endif // __NANO_ATTACHMENT_IO_H__

83
attachments/nano_attachment/nano_attachment_metric.c Normal file
View File

@ -0,0 +1,83 @@
#include "nano_attachment_metric.h"
#include "nano_initializer.h"
#include "nano_attachment_common.h"
void
reset_metric_data(NanoAttachment *attachment)
{
int i;
for (i = 0 ; i < METRIC_TYPES_COUNT ; i++) {
attachment->metric_data[i] = 0;
attachment->metric_average_data_divisor[i] = 0;
}
}
static void
updateCounterMetricField(NanoAttachment *attachment, AttachmentMetricType metric_type, uint64_t value)
{
attachment->metric_data[metric_type] += value;
}
static void
updateAverageMetricField(NanoAttachment *attachment, AttachmentMetricType metric_type, uint64_t value)
{
attachment->metric_data[metric_type] =
(((attachment->metric_data[metric_type] * attachment->metric_average_data_divisor[metric_type]) + value) /
(attachment->metric_average_data_divisor[metric_type] + 1));
attachment->metric_average_data_divisor[metric_type] += 1;
}
static void
updateMaxMetricField(NanoAttachment *attachment, AttachmentMetricType metric_type, uint64_t value)
{
if (attachment->metric_data[metric_type] < value) attachment->metric_data[metric_type] = value;
}
static void
updateMinMetricField(NanoAttachment *attachment, AttachmentMetricType metric_type, uint64_t value)
{
if (attachment->metric_data[metric_type] == 0) {
attachment->metric_data[metric_type] = value;
} else if (attachment->metric_data[metric_type] > value) {
attachment->metric_data[metric_type] = value;
}
}
void
updateMetricField(NanoAttachment *attachment, AttachmentMetricType metric_type, uint64_t value)
{
switch (metric_type) {
case CPU_USAGE:
case AVERAGE_VM_MEMORY_USAGE:
case AVERAGE_RSS_MEMORY_USAGE:
case AVERAGE_REQ_BODY_SIZE_UPON_TIMEOUT:
case AVERAGE_RES_BODY_SIZE_UPON_TIMEOUT:
case AVERAGE_OVERALL_PPROCESSING_TIME_UNTIL_VERDICT:
case AVERAGE_REQ_PPROCESSING_TIME_UNTIL_VERDICT:
case AVERAGE_RES_PPROCESSING_TIME_UNTIL_VERDICT: {
if (value != 0) updateAverageMetricField(attachment, metric_type, value);
break;
}
case MAX_VM_MEMORY_USAGE:
case MAX_RSS_MEMORY_USAGE:
case MAX_REQ_BODY_SIZE_UPON_TIMEOUT:
case MAX_RES_BODY_SIZE_UPON_TIMEOUT:
case MAX_OVERALL_PPROCESSING_TIME_UNTIL_VERDICT:
case MAX_REQ_PPROCESSING_TIME_UNTIL_VERDICT:
case MAX_RES_PPROCESSING_TIME_UNTIL_VERDICT: {
if (value != 0) updateMaxMetricField(attachment, metric_type, value);
break;
}
case MIN_REQ_BODY_SIZE_UPON_TIMEOUT:
case MIN_RES_BODY_SIZE_UPON_TIMEOUT:
case MIN_OVERALL_PPROCESSING_TIME_UNTIL_VERDICT:
case MIN_REQ_PPROCESSING_TIME_UNTIL_VERDICT:
case MIN_RES_PPROCESSING_TIME_UNTIL_VERDICT: {
if (value != 0) updateMinMetricField(attachment, metric_type, value);
break;
}
default:
updateCounterMetricField(attachment, metric_type, value);
}
}

33
attachments/nano_attachment/nano_attachment_metric.h Normal file
View File

@ -0,0 +1,33 @@
#ifndef __NANO_ATTACHMENT_METRIC_H__
#define __NANO_ATTACHMENT_METRIC_H__
#include "nano_attachment_common.h"
#include "nano_initializer.h"
///
/// @brief Updates a specified metric field of the NanoAttachment structure.
///
/// This function updates the value of a specified metric field within the NanoAttachment structure.
/// It selects the appropriate update strategy (counter, average, maximum, or minimum) based on the type
/// of the metric provided. For average, maximum, and minimum metrics, the function updates the metric value
/// only if the provided value is non-zero. For counter metrics, the value is always incremented.
///
/// @param attachment A pointer to the NanoAttachment structure.
/// @param metric_type The type of the metric to be updated. This determines the update strategy used.
/// @param value The value to update the metric with. For average, maximum, and minimum metrics,
/// this value must be non-zero to be considered.
///
void updateMetricField(NanoAttachment *attachment, AttachmentMetricType metric_type, uint64_t value);
///
/// @brief Resets all metric data fields of the NanoAttachment structure.
///
/// This function resets the metric data and the average data divisor fields within the NanoAttachment structure
/// to zero. It is typically used to initialize or clear the metric data before starting a new measurement session
/// or after completing an existing session.
///
/// @param attachment A pointer to the NanoAttachment structure.
///
void reset_metric_data(NanoAttachment *attachment);
#endif // __NANO_ATTACHMENT_METRIC_H__

795
attachments/nano_attachment/nano_attachment_sender.c Normal file
View File

@ -0,0 +1,795 @@
#include "nano_attachment_sender.h"
#include <time.h>
#include <stdlib.h>
#include "nano_attachment_sender_thread.h"
#include "nano_attachment_thread.h"
#include "nano_utils.h"
#include "nano_attachment_metric.h"
static unsigned char default_uuid[] = "20118dba-81f7-4999-8e94-003cf242f5dd\0";
static const size_t default_uuid_size = 37;
static unsigned char default_title[] = "Default Title\0";
static const size_t default_title_size = 14;
static unsigned char default_body[] = "Default Body\0";
static const size_t default_body_size = 13;
static uint16_t default_response_code = 403;
///
/// @brief Creates a default block page.
///
/// @param attachment Pointer to the NanoAttachment struct representing the attachment.
/// @param session_id The session ID associated with the attachment.
/// @return A pointer to a WebResponseData struct containing the default block page data.
///
static WebResponseData*
CreateDefaultBlockPage(NanoAttachment *attachment, SessionID session_id)
{
WebResponseData *web_response_data = NULL;
CustomResponseData *custom_response_data = NULL;
web_response_data = (WebResponseData *)malloc(sizeof(WebResponseData));
if (web_response_data == NULL) {
write_dbg(
attachment,
session_id,
DBG_LEVEL_WARNING,
"Failed to allocate memory for WebResponseData"
);
return NULL;
}
custom_response_data = (CustomResponseData *)malloc(sizeof(CustomResponseData));
if (custom_response_data == NULL) {
write_dbg(
attachment,
session_id,
DBG_LEVEL_WARNING,
"Failed to allocate memory for CustomResponseData"
);
free(web_response_data);
return NULL;
}
web_response_data->web_response_type = CUSTOM_WEB_RESPONSE;
memcpy(web_response_data->uuid, default_uuid, default_uuid_size);
custom_response_data->response_code = default_response_code;
memcpy(custom_response_data->title, default_title, default_title_size);
memcpy(custom_response_data->body, default_body, default_body_size);
web_response_data->data = (DataBuffer*)custom_response_data;
return web_response_data;
}
///
/// @brief Get a string representation of the AttachmentVerdict enum.
///
/// @param verdict The AttachmentVerdict enum value.
/// @return A string representation of the enum value.
///
static const char*
AttachmentVerdictToString(AttachmentVerdict verdict)
{
switch (verdict) {
case ATTACHMENT_VERDICT_INSPECT:
return "inspect";
case ATTACHMENT_VERDICT_ACCEPT:
return "accept";
case ATTACHMENT_VERDICT_DROP:
return "drop";
case ATTACHMENT_VERDICT_INJECT:
return "inject";
default:
return "unknown";
}
}
///
/// @brief Sends a verdict response for a corrupt memory condition.
///
/// @param attachment Pointer to the NanoAttachment struct representing the attachment.
/// @param session_data_p Pointer to the HttpSessionData struct containing the session data.
/// @return An AttachmentVerdictResponse struct containing the session ID and verdict.
///
static AttachmentVerdictResponse
SendCorruptMemoryVerdict(NanoAttachment *attachment, HttpSessionData *session_data_p)
{
AttachmentVerdictResponse response = {
.session_id = session_data_p->session_id,
.web_response_data = NULL,
.modifications = NULL
};
if (attachment->fail_mode_verdict == NANO_OK) {
updateMetricField(attachment, INSPECTION_OPEN_FAILURES_COUNT, 1);
response.verdict = ATTACHMENT_VERDICT_ACCEPT;
session_data_p->verdict = TRAFFIC_VERDICT_ACCEPT;
} else {
updateMetricField(attachment, INSPECTION_CLOSE_FAILURES_COUNT, 1);
response.verdict = ATTACHMENT_VERDICT_DROP;
session_data_p->verdict = TRAFFIC_VERDICT_DROP;
response.web_response_data = CreateDefaultBlockPage(attachment, session_data_p->session_id);
}
write_dbg(
attachment,
response.session_id,
DBG_LEVEL_DEBUG,
"Shared memory is corrupted, returning default fail mode verdict. Session id: %d, verdict: %s",
response.session_id,
response.verdict == ATTACHMENT_VERDICT_ACCEPT ? "accept" : "drop"
);
return response;
}
///
/// @brief Sends a verdict response for a thread timeout condition.
///
/// @param attachment Pointer to the NanoAttachment struct representing the attachment.
/// @param session_id The session ID associated with the attachment.
/// @param ctx Pointer to the HttpEventThreadCtx struct containing the HTTP event context.
/// @return An AttachmentVerdictResponse struct containing the session ID and verdict.
///
static AttachmentVerdictResponse
SendThreadTimeoutVerdict(NanoAttachment *attachment, SessionID session_id, HttpEventThreadCtx *ctx)
{
AttachmentVerdictResponse response = {
.session_id = session_id,
.web_response_data = NULL,
.modifications = NULL
};
if (attachment->fail_mode_verdict == NANO_OK) {
response.verdict = ATTACHMENT_VERDICT_ACCEPT;
ctx->session_data_p->verdict = TRAFFIC_VERDICT_ACCEPT;
} else {
response.verdict = ATTACHMENT_VERDICT_DROP;
ctx->session_data_p->verdict = TRAFFIC_VERDICT_DROP;
response.web_response_data = CreateDefaultBlockPage(attachment, session_id);
}
write_dbg(
attachment,
response.session_id,
DBG_LEVEL_DEBUG,
"Thread failed, returning fail mode verdict. Session id: %d, verdict: %s",
response.session_id,
response.verdict == ATTACHMENT_VERDICT_ACCEPT ? "accept" : "drop"
);
return response;
}
///
/// @brief Finalizes a successful response by determining the verdict based on the HTTP response code.
///
/// @param attachment Pointer to the NanoAttachment struct representing the attachment.
/// @param session_id The session ID associated with the attachment.
/// @param ctx Pointer to the HttpEventThreadCtx struct containing the HTTP event context.
/// @return An AttachmentVerdictResponse struct containing the session ID and verdict.
///
static AttachmentVerdictResponse
FinalizeSuccessfulResponse(
NanoAttachment *attachment,
SessionID session_id,
HttpEventThreadCtx *ctx
)
{
AttachmentVerdictResponse response = {
.session_id = session_id,
.web_response_data = ctx->web_response_data,
.modifications = ctx->modifications
};
switch (ctx->session_data_p->verdict) {
case TRAFFIC_VERDICT_INSPECT:
response.verdict = ATTACHMENT_VERDICT_INSPECT;
break;
case TRAFFIC_VERDICT_ACCEPT:
response.verdict = ATTACHMENT_VERDICT_ACCEPT;
break;
case TRAFFIC_VERDICT_DROP:
response.verdict = ATTACHMENT_VERDICT_DROP;
break;
case TRAFFIC_VERDICT_INJECT:
// Not yet supported
response.verdict = ATTACHMENT_VERDICT_INSPECT;
break;
default:
write_dbg(
attachment,
session_id,
DBG_LEVEL_WARNING,
"Unknown verdict %d",
ctx->session_data_p->verdict
);
response.verdict = ATTACHMENT_VERDICT_INSPECT;
break;
}
updateMetricField(attachment, INSPECTION_SUCCESSES_COUNT, 1);
write_dbg(
attachment,
response.session_id,
DBG_LEVEL_DEBUG,
"Finalizing successful response to Session id: %d, verdict: %s",
response.session_id,
AttachmentVerdictToString(response.verdict)
);
return response;
}
///
/// @brief Finalizes an irrelevant response by setting the verdict to accept.
///
/// @param attachment Pointer to the NanoAttachment struct representing the attachment.
/// @param session_id The session ID associated with the attachment.
/// @return An AttachmentVerdictResponse struct containing the session ID and verdict.
///
static AttachmentVerdictResponse
FinalizeIrrelevantResponse(NanoAttachment *attachment, SessionID session_id)
{
AttachmentVerdictResponse response = {
.verdict = ATTACHMENT_VERDICT_ACCEPT,
.session_id = session_id,
.web_response_data = NULL,
.modifications = NULL
};
updateMetricField(attachment, IRRELEVANT_VERDICTS_COUNT, 1);
write_dbg(
attachment,
response.session_id,
DBG_LEVEL_TRACE,
"Finalizing irrelevant response to Session id: %d",
response.session_id
);
return response;
}
///
/// @brief Finalizes a failed response by determining the verdict
/// based on the fail mode verdict associated with the attachment.
///
/// @param attachment Pointer to the NanoAttachment struct representing the attachment.
/// @param session_id The session ID associated with the attachment.
/// @param ctx Pointer to the HttpEventThreadCtx struct containing the HTTP event context.
/// @return An AttachmentVerdictResponse struct containing the session ID and verdict.
///
static AttachmentVerdictResponse
FinalizeFailedResponse(NanoAttachment *attachment, SessionID session_id, HttpEventThreadCtx *ctx)
{
AttachmentVerdictResponse response = {
.session_id = session_id,
.web_response_data = NULL,
.modifications = NULL
};
if (attachment->fail_mode_verdict == NANO_OK) {
updateMetricField(attachment, INSPECTION_OPEN_FAILURES_COUNT, 1);
response.verdict = ATTACHMENT_VERDICT_ACCEPT;
ctx->session_data_p->verdict = TRAFFIC_VERDICT_ACCEPT;
} else {
updateMetricField(attachment, INSPECTION_CLOSE_FAILURES_COUNT, 1);
response.verdict = ATTACHMENT_VERDICT_DROP;
ctx->session_data_p->verdict = TRAFFIC_VERDICT_DROP;
response.web_response_data = CreateDefaultBlockPage(attachment, session_id);
}
write_dbg(
attachment,
response.session_id,
DBG_LEVEL_TRACE,
"Handling Failure with fail %s mode",
response.verdict == ATTACHMENT_VERDICT_ACCEPT ? "open" : "close"
);
return response;
}
AttachmentVerdictResponse
SendRequestFilter(NanoAttachment *attachment, AttachmentData *data)
{
HttpEventThreadCtx ctx;
HttpSessionData *session_data_p = data->session_data;
SessionID session_id = session_data_p->session_id;
int res;
write_dbg(
attachment,
session_id,
DBG_LEVEL_DEBUG,
"Request filter handling session ID: %d",
session_id
);
if (handle_shmem_corruption(attachment) == NANO_ERROR) {
return SendCorruptMemoryVerdict(attachment, session_data_p);
}
write_dbg(attachment, session_id, DBG_LEVEL_DEBUG, "spawn SendRequestFilterThread");
res = NanoRunInThreadTimeout(
attachment,
data,
SendRequestFilterThread,
(void *)&ctx,
attachment->req_header_thread_timeout_msec,
"SendRequestFilterThread",
REQUEST
);
if (!res) {
updateMetricField(attachment, REQ_METADATA_THREAD_TIMEOUT, 1);
return SendThreadTimeoutVerdict(attachment, session_id, &ctx);
}
write_dbg(
attachment,
session_id,
DBG_LEVEL_DEBUG,
"finished SendMetadataThread successfully. res=%d",
ctx.res
);
if (ctx.res == NANO_DECLINED) {
return FinalizeIrrelevantResponse(attachment, session_id);
}
if (ctx.res != NANO_HTTP_FORBIDDEN && ctx.res != NANO_OK) {
return FinalizeFailedResponse(attachment, session_id, &ctx);
}
return FinalizeSuccessfulResponse(attachment, session_id, &ctx);
}
AttachmentVerdictResponse
SendMetadata(NanoAttachment *attachment, AttachmentData *data)
{
HttpEventThreadCtx ctx;
HttpSessionData *session_data_p = data->session_data;
SessionID session_id = session_data_p->session_id;
int res;
write_dbg(
attachment,
session_id,
DBG_LEVEL_DEBUG,
"Request start handling session ID: %d",
session_id
);
if (handle_shmem_corruption(attachment) == NANO_ERROR) {
return SendCorruptMemoryVerdict(attachment, session_data_p);
}
write_dbg(attachment, session_id, DBG_LEVEL_DEBUG, "spawn SendMetadataThread");
res = NanoRunInThreadTimeout(
attachment,
data,
SendMetadataThread,
(void *)&ctx,
attachment->req_start_thread_timeout_msec,
"SendMetadataThread",
REQUEST
);
if (!res) {
updateMetricField(attachment, REQ_METADATA_THREAD_TIMEOUT, 1);
return SendThreadTimeoutVerdict(attachment, session_id, &ctx);
}
write_dbg(
attachment,
session_id,
DBG_LEVEL_DEBUG,
"finished SendMetadataThread successfully. res=%d",
ctx.res
);
if (ctx.res == NANO_DECLINED) {
return FinalizeIrrelevantResponse(attachment, session_id);
}
if (ctx.res != NANO_HTTP_FORBIDDEN && ctx.res != NANO_OK) {
return FinalizeFailedResponse(attachment, session_id, &ctx);
}
return FinalizeSuccessfulResponse(attachment, session_id, &ctx);
}
AttachmentVerdictResponse
SendRequestHeaders(NanoAttachment *attachment, AttachmentData *data)
{
HttpEventThreadCtx ctx;
HttpSessionData *session_data_p = data->session_data;
SessionID session_id = session_data_p->session_id;
int res;
write_dbg(
attachment,
session_id,
DBG_LEVEL_DEBUG,
"Request header handling session ID: %d",
session_id
);
if (handle_shmem_corruption(attachment) == NANO_ERROR) {
return SendCorruptMemoryVerdict(attachment, session_data_p);
}
write_dbg(attachment, session_id, DBG_LEVEL_DEBUG, "spawn SendRequestHeadersThread");
res = NanoRunInThreadTimeout(
attachment,
data,
SendRequestHeadersThread,
(void *)&ctx,
attachment->req_header_thread_timeout_msec,
"SendRequestHeadersThread",
REQUEST
);
if (!res) {
updateMetricField(attachment, REQ_HEADER_THREAD_TIMEOUT, 1);
return SendThreadTimeoutVerdict(attachment, session_id, &ctx);
}
write_dbg(
attachment,
session_id,
DBG_LEVEL_DEBUG,
"finished SendRequestHeadersThread successfully. res=%d",
ctx.res
);
if (session_data_p->verdict == TRAFFIC_VERDICT_DELAYED) {
write_dbg(attachment, session_id, DBG_LEVEL_DEBUG, "spawn SendDelayedVerdictRequestThread");
res = NanoRunInThreadTimeout(
attachment,
data,
SendDelayedVerdictRequestThread,
(void *)&ctx,
attachment->waiting_for_verdict_thread_timeout_msec,
"SendDelayedVerdictRequestThread",
REQUEST
);
if (!res) {
updateMetricField(attachment, HOLD_THREAD_TIMEOUT, 1);
return SendThreadTimeoutVerdict(attachment, session_id, &ctx);
}
write_dbg(
attachment,
session_id,
DBG_LEVEL_DEBUG,
"finished SendDelayedVerdictRequestThread successfully. res=%d",
ctx.res
);
}
if (ctx.res != NANO_HTTP_FORBIDDEN && ctx.res != NANO_OK) {
return FinalizeFailedResponse(attachment, session_id, &ctx);
}
return FinalizeSuccessfulResponse(attachment, session_id, &ctx);
}
AttachmentVerdictResponse
SendResponseHeaders(NanoAttachment *attachment, AttachmentData *data)
{
HttpEventThreadCtx ctx;
HttpSessionData *session_data_p = data->session_data;
SessionID session_id = session_data_p->session_id;
int res;
write_dbg(
attachment,
session_id,
DBG_LEVEL_DEBUG,
"Response header handling session ID: %d",
session_id
);
if (handle_shmem_corruption(attachment) == NANO_ERROR) {
return SendCorruptMemoryVerdict(attachment, session_data_p);
}
write_dbg(attachment, session_id, DBG_LEVEL_DEBUG, "spawn SendResponseHeadersThread");
res = NanoRunInThreadTimeout(
attachment,
data,
SendResponseHeadersThread,
(void *)&ctx,
attachment->res_header_thread_timeout_msec,
"SendResponseHeadersThread",
RESPONSE
);
if (!res) {
updateMetricField(attachment, RES_HEADER_THREAD_TIMEOUT, 1);
return SendThreadTimeoutVerdict(attachment, session_id, &ctx);
}
write_dbg(
attachment,
session_id,
DBG_LEVEL_DEBUG,
"finished SendResponseHeadersThread successfully. res=%d",
ctx.res
);
if (ctx.res != NANO_HTTP_FORBIDDEN && ctx.res != NANO_OK) {
return FinalizeFailedResponse(attachment, session_id, &ctx);
}
return FinalizeSuccessfulResponse(attachment, session_id, &ctx);
}
AttachmentVerdictResponse
SendRequestBody(NanoAttachment *attachment, AttachmentData *data)
{
HttpEventThreadCtx ctx;
HttpSessionData *session_data_p = data->session_data;
SessionID session_id = session_data_p->session_id;
int res;
write_dbg(attachment, session_id, DBG_LEVEL_DEBUG, "Request body handling session ID: %d", session_id);
if (handle_shmem_corruption(attachment) == NANO_ERROR) {
return SendCorruptMemoryVerdict(attachment, session_data_p);
}
write_dbg(attachment, session_id, DBG_LEVEL_DEBUG, "spawn SendRequestBodyThread");
res = NanoRunInThreadTimeout(
attachment,
data,
SendRequestBodyThread,
(void *)&ctx,
attachment->req_body_thread_timeout_msec,
"SendRequestBodyThread",
REQUEST
);
if (!res) {
updateMetricField(attachment, REQ_BODY_THREAD_TIMEOUT, 1);
return SendThreadTimeoutVerdict(attachment, session_id, &ctx);
}
write_dbg(
attachment,
session_id,
DBG_LEVEL_DEBUG,
"finished SendRequestBodyThread successfully. res=%d",
ctx.res
);
if (session_data_p->verdict == TRAFFIC_VERDICT_DELAYED) {
write_dbg(attachment, session_id, DBG_LEVEL_DEBUG, "spawn SendDelayedVerdictRequestThread");
res = NanoRunInThreadTimeout(
attachment,
data,
SendDelayedVerdictRequestThread,
(void *)&ctx,
attachment->waiting_for_verdict_thread_timeout_msec,
"SendDelayedVerdictRequestThread",
REQUEST
);
if (!res) {
updateMetricField(attachment, HOLD_THREAD_TIMEOUT, 1);
return SendThreadTimeoutVerdict(attachment, session_id, &ctx);
}
write_dbg(
attachment,
session_id,
DBG_LEVEL_DEBUG,
"finished SendDelayedVerdictRequestThread successfully. res=%d",
ctx.res
);
}
if (ctx.res != NANO_HTTP_FORBIDDEN && ctx.res != NANO_OK) {
return FinalizeFailedResponse(attachment, session_id, &ctx);
}
return FinalizeSuccessfulResponse(attachment, session_id, &ctx);
}
AttachmentVerdictResponse
SendResponseBody(NanoAttachment *attachment, AttachmentData *data)
{
HttpEventThreadCtx ctx;
HttpSessionData *session_data_p = data->session_data;
SessionID session_id = session_data_p->session_id;
int res;
write_dbg(attachment, session_id, DBG_LEVEL_DEBUG, "Response body handling session ID: %d", session_id);
if (handle_shmem_corruption(attachment) == NANO_ERROR) {
return SendCorruptMemoryVerdict(attachment, session_data_p);
}
write_dbg(attachment, session_id, DBG_LEVEL_DEBUG, "spawn SendResponseBodyThread");
res = NanoRunInThreadTimeout(
attachment,
data,
SendResponseBodyThread,
(void *)&ctx,
attachment->res_body_thread_timeout_msec,
"SendResponseBodyThread",
RESPONSE
);
if (!res) {
updateMetricField(attachment, RES_BODY_THREAD_TIMEOUT, 1);
return SendThreadTimeoutVerdict(attachment, session_id, &ctx);
}
write_dbg(
attachment,
session_id,
DBG_LEVEL_DEBUG,
"finished SendResponseBodyThread successfully. res=%d",
ctx.res
);
if (ctx.res != NANO_HTTP_FORBIDDEN && ctx.res != NANO_OK) {
return FinalizeFailedResponse(attachment, session_id, &ctx);
}
return FinalizeSuccessfulResponse(attachment, session_id, &ctx);
}
AttachmentVerdictResponse
SendRequestEnd(NanoAttachment *attachment, AttachmentData *data)
{
HttpEventThreadCtx ctx;
HttpSessionData *session_data_p = data->session_data;
SessionID session_id = session_data_p->session_id;
int res;
write_dbg(
attachment,
session_id,
DBG_LEVEL_DEBUG,
"Request end handling session ID: %d",
session_id
);
if (handle_shmem_corruption(attachment) == NANO_ERROR) {
return SendCorruptMemoryVerdict(attachment, session_data_p);
}
write_dbg(attachment, session_id, DBG_LEVEL_DEBUG, "spawn SendRequestEndThread");
res = NanoRunInThreadTimeout(
attachment,
data,
SendRequestEndThread,
(void *)&ctx,
attachment->req_header_thread_timeout_msec,
"SendRequestEndThread",
REQUEST
);
if (!res) {
updateMetricField(attachment, REQ_END_THREAD_TIMEOUT, 1);
return SendThreadTimeoutVerdict(attachment, session_id, &ctx);
}
write_dbg(
attachment,
session_id,
DBG_LEVEL_DEBUG,
"finished SendRequestEndThread successfully. res=%d",
ctx.res
);
if (ctx.res != NANO_HTTP_FORBIDDEN && ctx.res != NANO_OK) {
return FinalizeFailedResponse(attachment, session_id, &ctx);
}
return FinalizeSuccessfulResponse(attachment, session_id, &ctx);
}
AttachmentVerdictResponse
SendResponseEnd(NanoAttachment *attachment, AttachmentData *data)
{
HttpEventThreadCtx ctx;
HttpSessionData *session_data_p = data->session_data;
SessionID session_id = session_data_p->session_id;
int res;
write_dbg(
attachment,
session_id,
DBG_LEVEL_DEBUG,
"Response end handling session ID: %d",
session_id
);
if (handle_shmem_corruption(attachment) == NANO_ERROR) {
return SendCorruptMemoryVerdict(attachment, session_data_p);
}
write_dbg(attachment, session_id, DBG_LEVEL_DEBUG, "spawn SendResponseEndThread");
res = NanoRunInThreadTimeout(
attachment,
data,
SendResponseEndThread,
(void *)&ctx,
attachment->req_header_thread_timeout_msec,
"SendResponseEndThread",
RESPONSE
);
if (!res) {
updateMetricField(attachment, RES_END_THREAD_TIMEOUT, 1);
return SendThreadTimeoutVerdict(attachment, session_id, &ctx);
}
write_dbg(
attachment,
session_id,
DBG_LEVEL_DEBUG,
"finished SendResponseEndThread successfully. res=%d",
ctx.res
);
if (ctx.res != NANO_HTTP_FORBIDDEN && ctx.res != NANO_OK) {
return FinalizeFailedResponse(attachment, session_id, &ctx);
}
return FinalizeSuccessfulResponse(attachment, session_id, &ctx);
}
NanoCommunicationResult
SendMetricData(NanoAttachment *attachment)
{
HttpEventThreadCtx ctx;
int res;
write_dbg(
attachment,
0,
DBG_LEVEL_DEBUG,
"Sending metric data saved in worker ID: %d",
attachment->worker_id
);
if (handle_shmem_corruption(attachment) == NANO_ERROR) {
write_dbg(
attachment,
0,
DBG_LEVEL_DEBUG,
"Failed to send metric data, shmem corruption Worker ID: %d",
attachment->worker_id
);
return NANO_ERROR;
}
res = NanoRunInThreadTimeout(
attachment,
NULL,
SendMetricToServiceThread,
(void *)&ctx,
attachment->metric_timeout_timeout,
"SendMetricToServiceThread",
METRICS
);
if (!res) {
write_dbg(
attachment,
0,
DBG_LEVEL_DEBUG,
"Thread timeout while sending metric data from worker ID: %d",
attachment->worker_id
);
return NANO_ERROR;
}
return NANO_OK;
}

137
attachments/nano_attachment/nano_attachment_sender.h Normal file
View File

@ -0,0 +1,137 @@
#ifndef __NANO_ATTACHMENT_SENDER_H__
#define __NANO_ATTACHMENT_SENDER_H__
#include "nano_attachment_common.h"
#include "nano_initializer.h"
///
/// @brief Sends start request data to the nano service.
///
/// This function handles the sending of starting meta data, request headers and end request to the nano service.
/// It creates a new thread to perform the sending operation, ensuring that the main execution flow
/// is not blocked. It also handles potential errors and timeouts that may occur during
/// the sending process.
///
/// @param attachment A pointer to the NanoAttachment structure.
/// @param data A pointer to AttachmentData structure containing the data to send and the session data.
///
/// @return An AttachmentVerdictResponse structure indicating the outcome of the operation.
///
AttachmentVerdictResponse SendRequestFilter(NanoAttachment *attachment, AttachmentData *data);
///
/// @brief Sends start request data to the nano service.
///
/// This function handles the sending of starting meta data to the nano service. It creates
/// a new thread to perform the sending operation, ensuring that the main execution flow
/// is not blocked. It also handles potential errors and timeouts that may occur during
/// the sending process.
///
/// @param attachment A pointer to the NanoAttachment structure.
/// @param data A pointer to AttachmentData structure containing the data to send and the session data.
///
/// @return An AttachmentVerdictResponse structure indicating the outcome of the operation.
///
AttachmentVerdictResponse SendMetadata(NanoAttachment *attachment, AttachmentData *data);
///
/// @brief Sends request headers to the nano service.
///
/// This function handles the sending of request headers to the nano service. It creates
/// a new thread to perform the sending operation, ensuring that the main execution flow
/// is not blocked. It also handles potential errors and timeouts that may occur during
/// the sending process.
///
/// @param attachment A pointer to the NanoAttachment structure.
/// @param data A pointer to AttachmentData structure containing the headers to send and the session data.
///
/// @return An AttachmentVerdictResponse structure indicating the outcome of the operation.
///
AttachmentVerdictResponse SendRequestHeaders(NanoAttachment *attachment, AttachmentData *data);
///
/// @brief Sends response headers to the nano service.
///
/// This function handles the sending of response headers to the nano service. It creates
/// a new thread to perform the sending operation, ensuring that the main execution flow
/// is not blocked. It also handles potential errors and timeouts that may occur during
/// the sending process.
///
/// @param attachment A pointer to the NanoAttachment structure.
/// @param data A pointer to AttachmentData structure containing the headers to send and the session data.
///
/// @return An AttachmentVerdictResponse structure indicating the outcome of the operation.
///
AttachmentVerdictResponse SendResponseHeaders(NanoAttachment *attachment, AttachmentData *data);
///
/// @brief Sends request body to the nano service.
///
/// This function handles the sending of request body to the nano service. It creates
/// a new thread to perform the sending operation, ensuring that the main execution flow
/// is not blocked. It also handles potential errors and timeouts that may occur during
/// the sending process.
///
/// @param attachment A pointer to the NanoAttachment structure.
/// @param data A pointer to AttachmentData structure containing the body to send and the session data.
///
/// @return An AttachmentVerdictResponse structure indicating the outcome of the operation.
///
AttachmentVerdictResponse SendRequestBody(NanoAttachment *attachment, AttachmentData *data);
///
/// @brief Sends response body to the nano service.
///
/// This function handles the sending of response body to the nano service. It creates
/// a new thread to perform the sending operation, ensuring that the main execution flow
/// is not blocked. It also handles potential errors and timeouts that may occur during
/// the sending process.
///
/// @param attachment A pointer to the NanoAttachment structure.
/// @param data A pointer to AttachmentData structure containing the body to send and the session data.
///
/// @return An AttachmentVerdictResponse structure indicating the outcome of the operation.
///
AttachmentVerdictResponse SendResponseBody(NanoAttachment *attachment, AttachmentData *data);
///
/// @brief Sends end request signal to the nano service.
///
/// This function handles the sending a request end signal to the nano service. It creates
/// a new thread to perform the sending operation, ensuring that the main execution flow
/// is not blocked. It also handles potential errors and timeouts that may occur during
/// the sending process.
///
/// @param attachment A pointer to the NanoAttachment structure.
/// @param data A pointer to AttachmentData structure containing the necessery data to send and the session data.
///
/// @return An AttachmentVerdictResponse structure indicating the outcome of the operation.
///
AttachmentVerdictResponse SendRequestEnd(NanoAttachment *attachment, AttachmentData *data);
///
/// @brief Sends end response signal to the nano service.
///
/// This function handles the sending a response end signal to the nano service. It creates
/// a new thread to perform the sending operation, ensuring that the main execution flow
/// is not blocked. It also handles potential errors and timeouts that may occur during
/// the sending process.
///
/// @param attachment A pointer to the NanoAttachment structure.
/// @param data A pointer to AttachmentData structure containing the necessery data to send and the session data.
///
/// @return An AttachmentVerdictResponse structure indicating the outcome of the operation.
///
AttachmentVerdictResponse SendResponseEnd(NanoAttachment *attachment, AttachmentData *data);
///
/// @brief Sends metric data to the nano service and resets it on the attachment.
///
/// @param attachment A pointer to the NanoAttachment structure that contains metrics data.
///
/// @return An NanoCommunication enum indicating the outcome of the operation.
/// NANO_OK if the operation was successful, NANO_ERROR otherwise.
///
NanoCommunicationResult SendMetricData(NanoAttachment *attachment);
#endif // __NANO_ATTACHMENT_SENDER_H__

330
attachments/nano_attachment/nano_attachment_sender_thread.c Normal file
View File

@ -0,0 +1,330 @@
#include "nano_attachment_sender_thread.h"
#include <string.h>
#include <stdlib.h>
#include "nano_initializer.h"
#include "nano_attachment_sender.h"
#include "nano_attachment_common.h"
#include "nano_attachment_io.h"
#include "nano_utils.h"
#include "nano_compression.h"
static HttpHeaderData *
get_http_header(HttpHeaders *http_headers, const char *header_name) {
size_t i;
for (i = 0; i < http_headers->headers_count; ++i) {
if (strcmp((char*)http_headers->data[i].key.data, header_name) == 0) {
return &http_headers->data[i];
}
}
return NULL;
}
static void
set_response_content_encoding(
NanoAttachment *attachment,
HttpSessionData *session_data_p,
HttpHeaders *http_headers
)
{
write_dbg(
attachment,
session_data_p->session_id,
DBG_LEVEL_TRACE,
"Determining response body's content encoding"
);
const HttpHeaderData *content_encoding = get_http_header(http_headers, "content-encoding");
if (content_encoding == NULL) {
session_data_p->response_data.compression_type = NO_COMPRESSION;
return;
}
if (strcmp((char*)content_encoding->value.data, "gzip") == 0) {
session_data_p->response_data.compression_type = GZIP;
} else if (strcmp((char*)content_encoding->value.data, "deflate") == 0) {
session_data_p->response_data.compression_type = ZLIB;
} else if (strcmp((char*)content_encoding->value.data, "identity") == 0) {
session_data_p->response_data.compression_type = NO_COMPRESSION;
} else {
write_dbg(
attachment,
session_data_p->session_id,
DBG_LEVEL_WARNING,
"Unsupported response content encoding: %.*s",
content_encoding->value.data
);
session_data_p->response_data.compression_type = NO_COMPRESSION;
}
}
void
init_thread_ctx(HttpEventThreadCtx *ctx, NanoAttachment *attachment, AttachmentData *data)
{
ctx->attachment = attachment;
ctx->data = data;
ctx->session_data_p = (data == NULL) ? NULL : data->session_data;
ctx->res = NANO_OK;
ctx->web_response_data = NULL;
ctx->modifications = NULL;
}
void *
RegistrationCommSocketThread(void *_ctx)
{
HttpEventThreadCtx *ctx = (HttpEventThreadCtx *)_ctx;
NanoAttachment *attachment = ctx->attachment;
ctx->res = connect_to_comm_socket(attachment);
return NULL;
}
void *
RegistrationSocketThread(void *_ctx)
{
HttpEventThreadCtx *ctx = (HttpEventThreadCtx *)_ctx;
NanoAttachment *attachment = ctx->attachment;
ctx->res = connect_to_registration_socket(attachment);
return 0;
}
void *
SendRequestFilterThread(void *_ctx)
{
HttpEventThreadCtx *ctx = (HttpEventThreadCtx *)_ctx;
HttpRequestFilterData *start_data = (HttpRequestFilterData*)ctx->data->data;
HttpMetaData *metadata = start_data->meta_data;
HttpHeaders *headers = start_data->req_headers;
bool contains_body = start_data->contains_body;
NanoAttachment *attachment = ctx->attachment;
HttpSessionData *session_data_p = ctx->session_data_p;
bool is_verdict_requested = false;
nano_metadata_sender(
attachment,
metadata,
ctx,
session_data_p->session_id,
&session_data_p->remaining_messages_to_reply,
is_verdict_requested
);
nano_header_sender(
attachment,
headers,
ctx,
REQUEST_HEADER,
session_data_p->session_id,
&session_data_p->remaining_messages_to_reply,
is_verdict_requested
);
if (!contains_body) {
nano_end_transaction_sender(
attachment,
REQUEST_END,
ctx,
session_data_p->session_id,
&session_data_p->remaining_messages_to_reply
);
}
return NULL;
}
void *
SendMetadataThread(void *_ctx)
{
HttpEventThreadCtx *ctx = (HttpEventThreadCtx *)_ctx;
HttpMetaData *metadata = (HttpMetaData*)ctx->data->data;
NanoAttachment *attachment = ctx->attachment;
HttpSessionData *session_data_p = ctx->session_data_p;
bool is_verdict_requested = false;
nano_metadata_sender(
attachment,
metadata,
ctx,
session_data_p->session_id,
&session_data_p->remaining_messages_to_reply,
is_verdict_requested
);
return NULL;
}
void *
SendRequestHeadersThread(void *_ctx)
{
HttpEventThreadCtx *ctx = (HttpEventThreadCtx *)_ctx;
HttpHeaders *headers = (HttpHeaders*)ctx->data->data;
NanoAttachment *attachment = ctx->attachment;
HttpSessionData *session_data_p = ctx->session_data_p;
bool is_verdict_requested = false;
nano_header_sender(
attachment,
headers,
ctx,
REQUEST_HEADER,
session_data_p->session_id,
&session_data_p->remaining_messages_to_reply,
is_verdict_requested
);
return NULL;
}
void *
SendResponseHeadersThread(void *_ctx)
{
HttpEventThreadCtx *ctx = (HttpEventThreadCtx *)_ctx;
ResHttpHeaders *headers = (ResHttpHeaders*)ctx->data->data;
NanoAttachment *attachment = ctx->attachment;
HttpSessionData *session_data_p = ctx->session_data_p;
HttpHeaders *http_headers = headers->headers;
bool is_verdict_requested = true;
nano_send_response_code(
attachment,
headers->response_code,
ctx,
session_data_p->session_id,
&session_data_p->remaining_messages_to_reply
);
nano_send_response_content_length(
attachment,
headers->content_length,
ctx,
session_data_p->session_id,
&session_data_p->remaining_messages_to_reply
);
set_response_content_encoding(
attachment,
session_data_p,
http_headers
);
nano_header_sender(
attachment,
http_headers,
ctx,
RESPONSE_HEADER,
session_data_p->session_id,
&session_data_p->remaining_messages_to_reply,
is_verdict_requested
);
return NULL;
}
void *
SendRequestBodyThread(void *_ctx)
{
HttpEventThreadCtx *ctx = (HttpEventThreadCtx *)_ctx;
HttpBody *bodies = (HttpBody*)ctx->data->data;
NanoAttachment *attachment = ctx->attachment;
HttpSessionData *session_data_p = ctx->session_data_p;
nano_body_sender(
attachment,
bodies,
ctx,
REQUEST_BODY,
session_data_p->session_id,
&session_data_p->remaining_messages_to_reply
);
return NULL;
}
void *
SendResponseBodyThread(void *_ctx)
{
HttpEventThreadCtx *ctx = (HttpEventThreadCtx *)_ctx;
HttpBody *bodies = (HttpBody*)ctx->data->data;
NanoAttachment *attachment = ctx->attachment;
HttpSessionData *session_data_p = ctx->session_data_p;
nano_body_sender(
attachment,
bodies,
ctx,
RESPONSE_BODY,
session_data_p->session_id,
&session_data_p->remaining_messages_to_reply
);
return NULL;
}
void *
SendRequestEndThread(void *_ctx)
{
HttpEventThreadCtx *ctx = (HttpEventThreadCtx *)_ctx;
NanoAttachment *attachment = ctx->attachment;
HttpSessionData *session_data_p = ctx->session_data_p;
nano_end_transaction_sender(
attachment,
REQUEST_END,
ctx,
session_data_p->session_id,
&session_data_p->remaining_messages_to_reply
);
return NULL;
}
void *
SendResponseEndThread(void *_ctx)
{
HttpEventThreadCtx *ctx = (HttpEventThreadCtx *)_ctx;
NanoAttachment *attachment = ctx->attachment;
HttpSessionData *session_data_p = ctx->session_data_p;
nano_end_transaction_sender(
attachment,
RESPONSE_END,
ctx,
session_data_p->session_id,
&session_data_p->remaining_messages_to_reply
);
return NULL;
}
void *
SendDelayedVerdictRequestThread(void *_ctx)
{
HttpEventThreadCtx *ctx = (HttpEventThreadCtx *)_ctx;
NanoAttachment *attachment = ctx->attachment;
HttpSessionData *session_data_p = ctx->session_data_p;
nano_request_delayed_verdict(
attachment,
ctx,
session_data_p->session_id,
&session_data_p->remaining_messages_to_reply
);
return NULL;
}
void *
SendMetricToServiceThread(void *_data)
{
HttpEventThreadCtx *ctx = (HttpEventThreadCtx *)_data;
NanoAttachment *attachment = ctx->attachment;
nano_send_metric_data_sender(attachment);
return NULL;
}

178
attachments/nano_attachment/nano_attachment_sender_thread.h Normal file
View File

@ -0,0 +1,178 @@
#ifndef __NANO_ATTACHMENT_SENDER_THREAD_H__
#define __NANO_ATTACHMENT_SENDER_THREAD_H__
#include "nano_attachment_common.h"
#include "nano_initializer.h"
/// @struct HttpEventThreadCtx
/// @brief Holds all the information needed to communicate with the attachment service.
typedef struct HttpEventThreadCtx
{
NanoAttachment *attachment; ///< NanoAttachment.
AttachmentData *data; ///< Attachment data.
HttpSessionData *session_data_p; ///< Provided session data.
/// Connection results with the attachment service
/// - #NANO_OK
/// - #NANO_ERROR
NanoCommunicationResult res;
WebResponseData *web_response_data; ///< Web response data.
NanoHttpModificationList *modifications; ///< Context's modification.
} HttpEventThreadCtx;
///
/// @brief Initializes a thread context structure for an NANO event thread.
///
/// This function initializes a thread context structure with the provided data
/// and default values for other fields.
///
/// @param ctx A pointer to a struct HttpEventThreadCtx structure representing the thread context to initialize.
/// @param attachment A pointer to a NanoAttachment structure representing the attachment data for the thread.
/// @param data A pointer to an AttachmentData structure representing the attachment data for the thread.
///
void
init_thread_ctx(HttpEventThreadCtx *ctx, NanoAttachment *attachment, AttachmentData *data);
///
/// @brief Connect attachment communication socket to the nano service.
///
/// @param _ctx A pointer to the HttpEventThreadCtx context.
///
/// @return NULL.
///
void * RegistrationCommSocketThread(void *_ctx);
///
/// @brief Connect attachment to registration socket to the nano service.
///
/// @param _ctx A pointer to the HttpEventThreadCtx context.
///
/// @return NULL.
///
void * RegistrationSocketThread(void *_ctx);
///
/// @brief Sends request start data to the nano service.
///
/// This thread function sends metadata to start a request interaction with the nano service.
///
/// @param _ctx A pointer to the HttpEventThreadCtx context.
///
/// @return NULL.
///
void * SendMetadataThread(void *_ctx);
///
/// @brief Sends request headers to the nano service.
///
/// This thread function sends request headers to the nano service using the provided
/// HttpEventThreadCtx context. It updates the session data and handles any
/// errors that occur during the header sending process.
///
/// @param _ctx A pointer to the HttpEventThreadCtx context.
///
/// @return NULL.
///
void * SendRequestHeadersThread(void *_ctx);
///
/// @brief Sends response headers to the nano service.
///
/// This thread function sends response headers to the nano service using the provided
/// HttpEventThreadCtx context. It updates the session data and handles any
/// errors that occur during the header sending process.
///
/// @param _ctx A pointer to the HttpEventThreadCtx context.
///
/// @return NULL.
///
void * SendResponseHeadersThread(void *_ctx);
///
/// @brief Sends request body to the nano service.
///
/// This thread function sends request body to the nano service using the provided
/// HttpEventThreadCtx context. It updates the session data and handles any
/// errors that occur during the body sending process.
///
/// @param _ctx A pointer to the HttpEventThreadCtx context.
///
/// @return NULL.
///
void * SendRequestBodyThread(void *_ctx);
///
/// @brief Sends response body to the nano service.
///
/// This thread function sends response body to the nano service using the provided
/// HttpEventThreadCtx context. It updates the session data and handles any
/// errors that occur during the body sending process.
///
/// @param _ctx A pointer to the HttpEventThreadCtx context.
///
/// @return NULL.
///
void * SendResponseBodyThread(void *_ctx);
///
/// @brief Sends request end data to the nano service.
///
/// This thread function sends signal to the nano service that the response has ended
/// and with it the whole session transaction.
///
/// @param _ctx A pointer to the HttpEventThreadCtx context.
///
/// @return NULL.
///
void * SendRequestEndThread(void *_ctx);
///
/// @brief Sends response end data to the nano service.
///
/// This thread function sends signal to the nano service that the response has ended
/// and with it the whole session transaction.
///
/// @param _ctx A pointer to the HttpEventThreadCtx context.
///
/// @return NULL.
///
void * SendResponseEndThread(void *_ctx);
///
/// @brief Thread function to send request filters.
///
/// This thread function sends metadata, request headers and end request
/// to the nano service using the provided HttpEventThreadCtx context.
/// It updates the session data and handles any errors that occur during the header sending process.
///
/// @param _ctx A pointer to the HttpEventThreadCtx context.
///
/// @return NULL
///
void * SendRequestFilterThread(void *_ctx);
///
/// @brief Send query for requesting delayed data verdict.
///
/// This thread function sends a delayed data query to the service and waits for the response.
///
/// @param _ctx A pointer to the HttpEventThreadCtx context.
///
/// @return NULL.
///
void * SendDelayedVerdictRequestThread(void *_ctx);
///
/// @brief Send data metric fo the service.
///
/// This thread function sends data metric to the service and resets it.
///
/// @param _ctx A pointer to the HttpEventThreadCtx context.
///
/// @return NULL.
///
void * SendMetricToServiceThread(void *_data);
#endif // __NANO_ATTACHMENT_SENDER_THREAD_H__

233
attachments/nano_attachment/nano_attachment_thread.c Normal file
View File

@ -0,0 +1,233 @@
#include "nano_attachment_thread.h"
#include <pthread.h>
#include <sched.h>
#include <stdio.h>
#include <errno.h>
#include <time.h>
#include <unistd.h>
#include "nano_attachment_sender.h"
#include "nano_attachment_sender_thread.h"
#include "nano_utils.h"
#include "nano_attachment_metric.h"
///
/// @brief Calculate the processing time of a transaction and update the session data accordingly.
///
/// @param session_data_p Pointer to the HttpSessionData struct containing session data.
/// @param thread_time_begin Pointer to the timespec struct representing the start time of the transaction.
/// @param transaction_type The type of transaction (REQUEST or RESPONSE).
///
static void
CalcProcessingTime(
HttpSessionData *session_data_p,
struct timespec *thread_time_begin,
TransactionType transaction_type
)
{
struct timespec thread_time_end;
if (transaction_type == START || transaction_type == METRICS) return;
clock_gettime(CLOCK_REALTIME, &thread_time_end);
double begin_usec = (thread_time_begin->tv_sec * 1000 * 1000) + (thread_time_begin->tv_nsec / 1000);
double end_usec = (thread_time_end.tv_sec * 1000 * 1000) + (thread_time_end.tv_nsec / 1000);
double elapsed = end_usec - begin_usec;
if (transaction_type == REQUEST) {
session_data_p->req_proccesing_time += elapsed;
} else {
session_data_p->res_proccesing_time += elapsed;
}
}
///
/// @brief runs the provided routine with the arguments in a non thread and without a timeout.
/// @param[in, out] attachment A pointer to the NanoAttachment struct.
/// @param[in] session_id The session ID.
/// @param[in, out] thread_func A pointer to the provided routine to run in a thread.
/// @param[in, out] arg Routine's arguments.
/// @param[in, out] func_name Called thread timeout.
/// @returns 1
///
int
NanoRunInWithoutThreadTimeout(
NanoAttachment *attachment,
SessionID session_id,
CpThreadRoutine thread_func,
void *arg,
char *func_name
)
{
write_dbg(
attachment,
session_id,
DBG_LEVEL_TRACE,
"Executing cb in blocking mode, fn=%s",
func_name
);
thread_func(arg);
return 1;
}
int
NanoRunInThreadTimeout(
NanoAttachment *attachment,
AttachmentData *data,
CpThreadRoutine thread_func,
void *arg,
int timeout_msecs,
char *func_name,
TransactionType transaction_type
)
{
int status = 0;
int ret = 0;
void *res = NULL;
pthread_t thread;
struct timespec ts;
struct timespec thread_time_begin;
uint32_t session_id;
HttpEventThreadCtx *ctx = (HttpEventThreadCtx *)arg;
session_id = (data == NULL) ? attachment->worker_id : data->session_data->session_id;
init_thread_ctx(ctx, attachment, data);
if (attachment->inspection_mode == NO_THREAD) {
return NanoRunInWithoutThreadTimeout(attachment, session_id, thread_func, arg, func_name);
}
if (clock_gettime(CLOCK_REALTIME, &thread_time_begin) == -1) {
updateMetricField(attachment, THREAD_FAILURE, 1);
write_dbg(
attachment,
session_id,
DBG_LEVEL_ERROR,
"clock_gettime(CLOCK_REALTIME) failed. Status: %s",
strerror(errno)
);
return 0;
}
/// Runs the routine in a dedicated thread.
write_dbg(
attachment,
session_id,
DBG_LEVEL_TRACE,
"Executing cb in dedicated thread, fn=%s",
func_name
);
if (pthread_create(&thread, NULL, thread_func, arg) != 0) {
updateMetricField(attachment, THREAD_FAILURE, 1);
write_dbg(
attachment,
session_id,
DBG_LEVEL_TRACE,
"pthread_create failed with errno=%d, fn=%s",
errno,
func_name
);
return 0;
}
if (attachment->inspection_mode == BLOCKING_THREAD) {
// Runs the function in a blocking thread.
status = pthread_join(thread, &res);
write_dbg(
attachment,
session_id,
DBG_LEVEL_TRACE,
"pthread_join returned from blocking call. status=%d, fn=%s",
status,
func_name
);
return status == 0;
}
if (clock_gettime(CLOCK_REALTIME, &ts) == -1) {
updateMetricField(attachment, THREAD_FAILURE, 1);
write_dbg(
attachment,
session_id,
DBG_LEVEL_ERROR,
"clock_gettime(CLOCK_REALTIME) failed. Status: %s",
strerror(errno)
);
return 0;
}
// Convert milliseconds to timespec
ts.tv_sec += timeout_msecs / 1000;
ts.tv_nsec += (timeout_msecs % 1000) * 1000 * 1000;
if (ts.tv_nsec > 1000 * 1000 * 1000) {
ts.tv_nsec -= 1000 * 1000 * 1000;
++ts.tv_sec;
}
long long tv_nsec = ts.tv_nsec + (timeout_msecs % 1000) * 1000000;
ts.tv_sec += timeout_msecs / 1000 + tv_nsec / 1000000000;
ts.tv_nsec = tv_nsec % 1000000000;
status = pthread_timedjoin_np(thread, NULL, &ts);
if (status != 0) {
write_dbg(
attachment,
session_id,
status == ETIMEDOUT ? DBG_LEVEL_DEBUG : DBG_LEVEL_WARNING,
"pthread_timejoin_np returns with %d (%s), fn=%s",
status,
strerror(status),
func_name
);
ret = pthread_cancel(thread);
write_dbg(
attachment,
session_id,
DBG_LEVEL_DEBUG,
"pthread_cancel returns with ret=%d, fn=%s",
ret,
func_name
);
ret = pthread_join(thread, &res);
if (ret != 0) {
updateMetricField(attachment, THREAD_FAILURE, 1);
write_dbg(
attachment,
session_id,
DBG_LEVEL_WARNING,
"pthread_join failed while fail open is enabled. RET=%d, fn=%s",
ret,
func_name
);
return ret != 0;
}
updateMetricField(attachment, res == PTHREAD_CANCELED ? THREAD_TIMEOUT : THREAD_FAILURE, 1);
if (res == PTHREAD_CANCELED) {
write_dbg(attachment, session_id, DBG_LEVEL_DEBUG, "thread was canceled, fn=%s", func_name);
}
write_dbg(attachment, session_id, DBG_LEVEL_DEBUG, "pthread_join returns with ret=%d", ret);
} else {
write_dbg(
attachment,
session_id,
DBG_LEVEL_TRACE,
"Successfully executed thread. fn=%s",
func_name
);
}
if (data != NULL) {
CalcProcessingTime(data->session_data, &thread_time_begin, transaction_type);
}
return status == 0;
}

46
attachments/nano_attachment/nano_attachment_thread.h Normal file
View File

@ -0,0 +1,46 @@
#ifndef __NANO_ATTACHMENT_THREAD_H__
#define __NANO_ATTACHMENT_THREAD_H__
#include <stdbool.h>
#include "nano_initializer.h"
typedef void *(*CpThreadRoutine)(void *); ///< Func
typedef enum TransactionType
{
START,
REQUEST,
RESPONSE,
METRICS,
REGISTRATION
} TransactionType;
///
/// @brief Runs a function in a thread with a timeout.
///
/// This function runs the specified thread function in a dedicated thread with a timeout.
/// If the function does not complete within the specified timeout, it is cancelled.
///
/// @param[in] attachment The NanoAttachment object.
/// @param[in] data The AttachmentData object.
/// @param[in] thread_func The function to run in the thread.
/// @param[in] arg The argument to pass to the thread function.
/// @param[in] timeout_msecs The timeout value in milliseconds.
/// @param[in] func_name The name of the function for debugging purposes.
/// @param[in] transaction_type The type of transaction (request or response), used for timeout.
///
/// @return Returns 1 if the function completes within the timeout, 0 otherwise.
///
int
NanoRunInThreadTimeout(
NanoAttachment *attachment,
AttachmentData *data,
CpThreadRoutine thread_func,
void *arg,
int timeout_msecs,
char *func_name,
TransactionType transaction_type
);
#endif // __NANO_ATTACHMENT_THREAD_H__

8
attachments/nano_attachment/nano_attachment_util/CMakeLists.txt Normal file
View File

@ -0,0 +1,8 @@
add_definitions(-DUSERSPACE)
add_library(nano_attachment_util SHARED nano_attachment_util.cc)
target_link_libraries(nano_attachment_util http_configuration)
# add_subdirectory(nano_attachment_util_ut)
install(TARGETS nano_attachment_util DESTINATION lib)
install(TARGETS nano_attachment_util DESTINATION nginx_attachment/lib PERMISSIONS OWNER_READ OWNER_WRITE OWNER_EXECUTE GROUP_READ GROUP_EXECUTE WORLD_READ)

251
attachments/nano_attachment/nano_attachment_util/nano_attachment_util.cc Normal file
View File

@ -0,0 +1,251 @@
// Copyright (C) 2022 Check Point Software Technologies Ltd. All rights reserved.
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
#include "nano_attachment_util.h"
#include <arpa/inet.h>
#include "http_configuration.h"
using namespace std;
static HttpAttachmentConfiguration conf_data;
int
initAttachmentConfig(c_str conf_file)
{
return conf_data.init(conf_file);
}
NanoHttpInspectionMode
getInspectionMode()
{
return static_cast<NanoHttpInspectionMode>(conf_data.getNumericalValue("nginx_inspection_mode"));
}
unsigned int
getNumOfNginxIpcElements()
{
return conf_data.getNumericalValue("num_of_nginx_ipc_elements");
}
unsigned int
getKeepAliveIntervalMsec()
{
return conf_data.getNumericalValue("keep_alive_interval_msec");
}
unsigned int
getDbgLevel()
{
return conf_data.getNumericalValue("dbg_level");
}
int
isDebugContext(c_str client, c_str server, unsigned int port, c_str method, c_str host, c_str uri)
{
auto &ctx = conf_data.getDebugContext();
return
(ctx.client == "" || ctx.client == client) &&
(ctx.server == "" || ctx.server == server) &&
(ctx.port == 0 || ctx.port == port) &&
(ctx.method == "" || ctx.method == method) &&
(ctx.host == "" || ctx.host == host) &&
(ctx.uri == "" || ctx.uri == uri);
}
c_str
getStaticResourcesPath()
{
return conf_data.getStringValue("static_resources_path").c_str();
}
int
isFailOpenMode()
{
return conf_data.getNumericalValue("is_fail_open_mode_enabled");
}
unsigned int
getFailOpenTimeout()
{
return conf_data.getNumericalValue("fail_open_timeout");
}
int
isFailOpenHoldMode()
{
return conf_data.getNumericalValue("is_fail_open_mode_hold_enabled");
}
unsigned int
getFailOpenHoldTimeout()
{
return conf_data.getNumericalValue("fail_open_hold_timeout");
}
unsigned int
getMaxSessionsPerMinute()
{
return conf_data.getNumericalValue("max_sessions_per_minute");
}
int
isFailOpenOnSessionLimit()
{
return conf_data.getStringValue("sessions_per_minute_limit_verdict") == "Accept";
}
unsigned int
getRegistrationThreadTimeout()
{
return conf_data.getNumericalValue("registration_thread_timeout_msec");
}
unsigned int
getReqProccessingTimeout()
{
return conf_data.getNumericalValue("req_proccessing_timeout_msec");
}
unsigned int
getReqHeaderThreadTimeout()
{
return conf_data.getNumericalValue("req_header_thread_timeout_msec");
}
unsigned int
getReqBodyThreadTimeout()
{
return conf_data.getNumericalValue("req_body_thread_timeout_msec");
}
unsigned int
getResProccessingTimeout()
{
return conf_data.getNumericalValue("res_proccessing_timeout_msec");
}
unsigned int
getResHeaderThreadTimeout()
{
return conf_data.getNumericalValue("res_header_thread_timeout_msec");
}
unsigned int
getResBodyThreadTimeout()
{
return conf_data.getNumericalValue("res_body_thread_timeout_msec");
}
unsigned int
getWaitingForVerdictThreadTimeout()
{
return conf_data.getNumericalValue("waiting_for_verdict_thread_timeout_msec");
}
int
isIPAddress(c_str ip_str)
{
int address_family = AF_INET;
for (int i = 0; ip_str[i]; ++i) {
if (ip_str[i] == ':') address_family = AF_INET6;
}
char placeholder[16];
return inet_pton(address_family, ip_str, placeholder);
}
struct IpAddress
{
union {
struct in_addr ipv4;
struct in6_addr ipv6;
} ip;
bool is_ipv4;
bool
operator<(const IpAddress &other) const
{
if (is_ipv4 != other.is_ipv4) return is_ipv4 < other.is_ipv4;
if (is_ipv4) return memcmp(&ip.ipv4, &other.ip.ipv4, sizeof(struct in_addr)) < 0;
return memcmp(&ip.ipv6, &other.ip.ipv6, sizeof(struct in6_addr)) < 0;
}
bool
operator<=(const IpAddress &other) const
{
return !(other < *this);
}
};
static IpAddress
createIPAddress(c_str ip_str)
{
IpAddress res;
for (int i = 0; ip_str[i]; ++i) {
if (ip_str[i] == ':') {
res.is_ipv4 = false;
inet_pton(AF_INET6, ip_str, &res.ip.ipv6);
return res;
}
}
res.is_ipv4 = true;
inet_pton(AF_INET, ip_str, &res.ip.ipv4);
return res;
}
static bool
isIPInRange(const IpAddress &ip, const IpAddress &start, const IpAddress &end)
{
if (ip.is_ipv4 != start.is_ipv4 || ip.is_ipv4 != end.is_ipv4) return false;
return start <= ip && ip <= end;
}
static bool
isIPInRange(const IpAddress &ip, const string &range)
{
auto delimiter = range.find('-');
if (delimiter == string::npos) {
if (!isIPAddress(range.c_str())) return false;
auto address = createIPAddress(range.c_str());
return isIPInRange(ip, address, address);
}
auto start_str = range.substr(0, delimiter);
if (!isIPAddress(start_str.c_str())) return false;
auto start_addr = createIPAddress(start_str.c_str());
auto end_str = range.substr(delimiter + 1);
if (!isIPAddress(end_str.c_str())) return false;
auto end_addr = createIPAddress(end_str.c_str());
return isIPInRange(ip, start_addr, end_addr);
}
int
isSkipSource(c_str ip_str)
{
if (!isIPAddress(ip_str)) return 0;
auto ip = createIPAddress(ip_str);
for (auto &range : conf_data.getExcludeSources()) {
if (isIPInRange(ip, range)) return 1;
}
return 0;
}

8
attachments/nano_attachment/nano_attachment_util/nano_attachment_util_ut/CMakeLists.txt Normal file
View File

@ -0,0 +1,8 @@
include_directories(${Boost_INCLUDE_DIRS})
include_directories(${CMAKE_SOURCE_DIR}/attachments/nano_attachment/nano_attachment_util)
add_unit_test(
nano_attachment_util_ut
"nano_attachment_util_ut.cc"
"nano_attachment_util"
)

125
attachments/nano_attachment/nano_attachment_util/nano_attachment_util_ut/nano_attachment_util_ut.cc Normal file
View File

@ -0,0 +1,125 @@
#include <fstream>
#include <boost/algorithm/string.hpp>
#include <stdlib.h>
#include <arpa/inet.h>
#include "nano_attachment_util.h"
#include "cptest.h"
#include "c_common/ip_common.h"
using namespace std;
using namespace testing;
class HttpAttachmentUtilTest : public Test
{
public:
string
createIPRangesString(const vector<string> &ip_ranges)
{
stringstream ip_ranges_string_stream;
ip_ranges_string_stream << "[";
for (auto iterator = ip_ranges.begin(); iterator < ip_ranges.end() - 1; iterator++) {
ip_ranges_string_stream << "\"" << *iterator << "\"" << ", ";
}
ip_ranges_string_stream << "\"" << ip_ranges.back() << "\"]";
return ip_ranges_string_stream.str();
}
const string attachment_configuration_file_name = "cp_nano_http_attachment_conf";
const vector<string> ip_ranges = { "8.8.8.8", "9.9.9.9-10.10.10.10", "0:0:0:0:0:0:0:2-0:0:0:0:0:0:0:5"};
const string static_resources_path = "/dev/shm/static_resources/";
};
TEST_F(HttpAttachmentUtilTest, GetValidAttachmentConfiguration)
{
string valid_configuration =
"{\n"
"\"context_values\": {"
"\"clientIp\": \"1.2.3.4\","
"\"listeningIp\": \"5.6.7.8\","
"\"uriPrefix\": \"/abc\","
"\"hostName\": \"test\","
"\"httpMethod\": \"GET\","
"\"listeningPort\": 80"
"},"
"\"is_fail_open_mode_enabled\": 0,\n"
"\"fail_open_timeout\": 1234,\n"
"\"is_fail_open_mode_hold_enabled\": 1,\n"
"\"fail_open_hold_timeout\": 4321,\n"
"\"sessions_per_minute_limit_verdict\": \"Accept\",\n"
"\"max_sessions_per_minute\": 0,\n"
"\"num_of_nginx_ipc_elements\": 200,\n"
"\"keep_alive_interval_msec\": 10000,\n"
"\"dbg_level\": 2,\n"
"\"nginx_inspection_mode\": 1,\n"
"\"operation_mode\": 0,\n"
"\"req_body_thread_timeout_msec\": 155,\n"
"\"req_proccessing_timeout_msec\": 42,\n"
"\"registration_thread_timeout_msec\": 101,\n"
"\"res_proccessing_timeout_msec\": 420,\n"
"\"res_header_thread_timeout_msec\": 1,\n"
"\"res_body_thread_timeout_msec\": 0,\n"
"\"waiting_for_verdict_thread_timeout_msec\": 75,\n"
"\"req_header_thread_timeout_msec\": 10,\n"
"\"ip_ranges\": " + createIPRangesString(ip_ranges) + ",\n"
"\"static_resources_path\": \"" + static_resources_path + "\""
"}\n";
ofstream valid_configuration_file(attachment_configuration_file_name);
valid_configuration_file << valid_configuration;
valid_configuration_file.close();
EXPECT_EQ(initAttachmentConfig(attachment_configuration_file_name.c_str()), 1);
EXPECT_EQ(getDbgLevel(), 2u);
EXPECT_EQ(getStaticResourcesPath(), static_resources_path);
EXPECT_EQ(isFailOpenMode(), 0);
EXPECT_EQ(getFailOpenTimeout(), 1234u);
EXPECT_EQ(isFailOpenHoldMode(), 1);
EXPECT_EQ(getFailOpenHoldTimeout(), 4321u);
EXPECT_EQ(isFailOpenOnSessionLimit(), 1);
EXPECT_EQ(getMaxSessionsPerMinute(), 0u);
EXPECT_EQ(getNumOfNginxIpcElements(), 200u);
EXPECT_EQ(getKeepAliveIntervalMsec(), 10000u);
EXPECT_EQ(getResProccessingTimeout(), 420u);
EXPECT_EQ(getReqProccessingTimeout(), 42u);
EXPECT_EQ(getRegistrationThreadTimeout(), 101u);
EXPECT_EQ(getReqHeaderThreadTimeout(), 10u);
EXPECT_EQ(getReqBodyThreadTimeout(), 155u);
EXPECT_EQ(getResHeaderThreadTimeout(), 1u);
EXPECT_EQ(getResBodyThreadTimeout(), 0u);
EXPECT_EQ(getWaitingForVerdictThreadTimeout(), 75u);
EXPECT_EQ(getInspectionMode(), NanoHttpInspectionMode::BLOCKING_THREAD);
EXPECT_EQ(isDebugContext("1.2.3.4", "5.6.7.8", 80, "GET", "test", "/abc"), 1);
EXPECT_EQ(isDebugContext("1.2.3.9", "5.6.7.8", 80, "GET", "test", "/abc"), 0);
EXPECT_EQ(isDebugContext("1.2.3.4", "5.6.7.9", 80, "GET", "test", "/abc"), 0);
EXPECT_EQ(isDebugContext("1.2.3.4", "5.6.7.8", 88, "GET", "test", "/abc"), 0);
EXPECT_EQ(isDebugContext("1.2.3.4", "5.6.7.8", 80, "POST", "test", "/abc"), 0);
EXPECT_EQ(isDebugContext("1.2.3.4", "5.6.7.8", 80, "GET", "est", "/abc"), 0);
EXPECT_EQ(isDebugContext("1.2.3.4", "5.6.7.8", 80, "GET", "test", "/ab"), 0);
EXPECT_EQ(isSkipSource("8.8.8.8"), 1);
EXPECT_EQ(isSkipSource("8.8.8.9"), 0);
EXPECT_EQ(isSkipSource("8.8.8.10"), 0);
EXPECT_EQ(isSkipSource("9.9.9.8"), 0);
EXPECT_EQ(isSkipSource("9.9.9.9"), 1);
EXPECT_EQ(isSkipSource("9.255.0.0"), 1);
EXPECT_EQ(isSkipSource("10.10.10.10"), 1);
EXPECT_EQ(isSkipSource("10.10.10.11"), 0);
EXPECT_EQ(isSkipSource("0:0:0:0:0:0:0:1"), 0);
EXPECT_EQ(isSkipSource("0:0:0:0:0:0:0:2"), 1);
EXPECT_EQ(isSkipSource("0:0:0:0:0:0:0:4"), 1);
EXPECT_EQ(isSkipSource("0:0:0:0:0:0:0:5"), 1);
EXPECT_EQ(isSkipSource("0:0:0:0:0:0:0:6"), 0);
}
TEST_F(HttpAttachmentUtilTest, CheckIPAddrValidity)
{
EXPECT_EQ(isIPAddress("10.0.0.1"), 1);
EXPECT_EQ(isIPAddress("2001:0db8:85a3:0000:0000:8a2e:0370:7334"), 1);
EXPECT_EQ(isIPAddress("333.0.0.1"), 0);
EXPECT_EQ(isIPAddress("2001:0gb8:85a3:0000:0000:8a2e:0370:7334"), 0);
}

24
attachments/nano_attachment/nano_blockpage.h Normal file
View File

File diff suppressed because one or more lines are too long

130
attachments/nano_attachment/nano_compression.c Executable file
View File

@ -0,0 +1,130 @@
#include "nano_compression.h"
#include <stdlib.h>
#include "nano_attachment_common.h"
#include "nano_initializer.h"
#include "compression_utils.h"
#include "nano_utils.h"
HttpBody *
nano_compress_body(
NanoAttachment *attachment,
HttpBody *bodies,
HttpSessionData *session_data_p
)
{
CompressionResult compression_result;
HttpBody *compressed_body;
size_t i;
if (session_data_p->response_data.compression_type == NO_COMPRESSION) {
return NULL;
}
write_dbg(
attachment,
session_data_p->session_id,
DBG_LEVEL_TRACE,
"Compressing body"
);
if (session_data_p->response_data.compression_stream == NULL) {
session_data_p->response_data.compression_stream = initCompressionStream();
}
compressed_body = malloc(sizeof(HttpBody));
if (compressed_body == NULL) {
return NULL;
}
compressed_body->bodies_count = bodies->bodies_count;
compressed_body->data = malloc(bodies->bodies_count * sizeof(nano_str_t));
if (compressed_body->data == NULL) {
free(compressed_body);
return NULL;
}
for (i = 0; i < bodies->bodies_count; ++i) {
compression_result = compressData(
session_data_p->response_data.compression_stream,
session_data_p->response_data.compression_type,
bodies->data[i].len,
bodies->data[i].data,
i == bodies->bodies_count - 1
);
compressed_body->data[i].len = compression_result.num_output_bytes;
compressed_body->data[i].data = compression_result.output;
}
return compressed_body;
}
HttpBody *
nano_decompress_body(
NanoAttachment *attachment,
HttpBody *bodies,
HttpSessionData *session_data_p
)
{
DecompressionResult decompression_result;
HttpBody *decompressed_body;
size_t i;
if (session_data_p->response_data.compression_type == NO_COMPRESSION) {
return NULL;
}
write_dbg(
attachment,
session_data_p->session_id,
DBG_LEVEL_TRACE,
"Decompressing body"
);
if (session_data_p->response_data.decompression_stream == NULL) {
session_data_p->response_data.decompression_stream = initCompressionStream();
}
decompressed_body = malloc(sizeof(HttpBody));
if (decompressed_body == NULL) {
return NULL;
}
decompressed_body->bodies_count = bodies->bodies_count;
decompressed_body->data = malloc(bodies->bodies_count * sizeof(nano_str_t));
if (decompressed_body->data == NULL) {
free(decompressed_body);
return NULL;
}
for (i = 0; i < bodies->bodies_count; ++i) {
decompression_result = decompressData(
session_data_p->response_data.decompression_stream,
bodies->data[i].len,
bodies->data[i].data
);
decompressed_body->data[i].len = decompression_result.num_output_bytes;
decompressed_body->data[i].data = decompression_result.output;
}
return decompressed_body;
}
void
nano_free_compressed_body(
NanoAttachment *attachment,
HttpBody *bodies,
HttpSessionData *session_data_p
)
{
if (bodies == NULL) {
return;
}
write_dbg(
attachment,
session_data_p->session_id,
DBG_LEVEL_TRACE,
"Freeing compressed body"
);
free(bodies->data);
free(bodies);
}

45
attachments/nano_attachment/nano_compression.h Executable file
View File

@ -0,0 +1,45 @@
#ifndef __NANO_COMPRESSION_H__
#define __NANO_COMPRESSION_H__
#include "nano_attachment_sender_thread.h"
/// @brief Compresses the given HTTP body using the specified compression type in the session data.
///
/// @param attachment Pointer to the NanoAttachment structure.
/// @param bodies Pointer to the HttpBody structure containing the data to be compressed.
/// @param session_data_p Pointer to the HttpSessionData structure containing session-specific data.
///
/// @return Pointer to a new HttpBody structure containing the compressed data,
/// or NULL if compression is not needed or fails.
HttpBody *nano_compress_body(
NanoAttachment *attachment,
HttpBody *bodies,
HttpSessionData *session_data_p
);
/// @brief Decompresses the given HTTP body using the specified compression type in the session data.
///
/// @param attachment Pointer to the NanoAttachment structure.
/// @param bodies Pointer to the HttpBody structure containing the data to be decompressed.
/// @param session_data_p Pointer to the HttpSessionData structure containing session-specific data.
///
/// @return Pointer to a new HttpBody structure containing the decompressed data,
/// or NULL if decompression is not needed or fails.
HttpBody *nano_decompress_body(
NanoAttachment *attachment,
HttpBody *bodies,
HttpSessionData *session_data_p
);
/// @brief Frees the memory allocated for the compressed HTTP body.
///
/// @param attachment Pointer to the NanoAttachment structure.
/// @param bodies Pointer to the HttpBody structure containing the compressed data to be freed.
/// @param session_data_p Pointer to the HttpSessionData structure containing session-specific data.
void nano_free_compressed_body(
NanoAttachment *attachment,
HttpBody *bodies,
HttpSessionData *session_data_p
);
#endif // __NANO_COMPRESSION_H__

144
attachments/nano_attachment/nano_configuration.c Normal file
View File

@ -0,0 +1,144 @@
#include "nano_configuration.h"
#include "nano_attachment_common.h"
#include "nano_utils.h"
#include "nano_attachment_util.h"
#include <unistd.h>
#include <sys/types.h>
NanoCommunicationResult
init_attachment_config(NanoAttachment *attachment, const char *conf_path)
{
int new_dbg_level = DBG_LEVEL_COUNT;
if (access(conf_path, F_OK) != 0) return NANO_ERROR;
if (attachment->is_configuration_updated == NANO_OK) return NANO_OK;
// Initiate attachment using the file in the provided conf_path.
if (!initAttachmentConfig(conf_path)) {
write_dbg(attachment, attachment->worker_id, DBG_LEVEL_WARNING, "Failed to load the configuration");
return NANO_ERROR;
}
new_dbg_level = getDbgLevel();
if (new_dbg_level >= DBG_LEVEL_COUNT) {
write_dbg(
attachment,
attachment->worker_id,
DBG_LEVEL_WARNING,
"Illegal debug level received: %d",
new_dbg_level
);
attachment->is_configuration_updated = NANO_ERROR;
return NANO_ERROR;
}
write_dbg(attachment, attachment->worker_id, DBG_LEVEL_DEBUG, "Setting debug level to: %d", new_dbg_level);
// Setting a new debug level.
attachment->dbg_level = new_dbg_level;
// Setting fail open/close.
attachment->fail_mode_verdict = isFailOpenMode() == 1 ? NANO_OK : NANO_ERROR;
attachment->fail_open_timeout = getFailOpenTimeout();
// Setting fail delayed open/close
attachment->fail_mode_delayed_verdict = isFailOpenHoldMode() == 1 ? NANO_OK : NANO_ERROR;
attachment->fail_open_delayed_timeout = getFailOpenHoldTimeout();
// Setting attachment's variables.
attachment->sessions_per_minute_limit_verdict =
isFailOpenOnSessionLimit() ? ATTACHMENT_VERDICT_ACCEPT : ATTACHMENT_VERDICT_DROP;
attachment->max_sessions_per_minute = getMaxSessionsPerMinute();
attachment->inspection_mode = getInspectionMode();
if (attachment->inspection_mode >= INSPECTION_MODE_COUNT) {
write_dbg(
attachment,
attachment->worker_id,
DBG_LEVEL_WARNING,
"Illegal inspection mode received: %d",
attachment->inspection_mode
);
attachment->is_configuration_updated = NANO_ERROR;
return NANO_ERROR;
}
attachment->req_max_proccessing_ms_time = getReqProccessingTimeout();
attachment->res_max_proccessing_ms_time = getResProccessingTimeout();
attachment->registration_thread_timeout_msec = getRegistrationThreadTimeout();
attachment->req_header_thread_timeout_msec = getReqHeaderThreadTimeout();
attachment->req_body_thread_timeout_msec = getReqBodyThreadTimeout();
attachment->res_header_thread_timeout_msec = getResHeaderThreadTimeout();
attachment->res_body_thread_timeout_msec = getResBodyThreadTimeout();
attachment->waiting_for_verdict_thread_timeout_msec = getWaitingForVerdictThreadTimeout();
attachment->num_of_nano_ipc_elements = getNumOfNginxIpcElements();
attachment->keep_alive_interval_msec = getKeepAliveIntervalMsec();
// set_static_resources_path(getStaticResourcesPath());
attachment->is_configuration_updated = NANO_OK;
attachment->logging_data->dbg_level = attachment->dbg_level;
attachment->logging_data->worker_id = attachment->worker_id;
attachment->logging_data->fd = attachment->logging_fd;
write_dbg(
attachment,
attachment->worker_id,
DBG_LEVEL_INFO,
"Successfully loaded configuration. "
"inspection mode: %d, "
"debug level: %d, "
"failure mode: %s, "
"fail mode timeout: %u msec, "
"failure delayed mode: %s, "
"fail mode delayed timeout: %u msec, "
"sessions per minute limit verdict: %s, "
"max sessions per minute: %u, "
"req max processing time: %u msec, "
"res max processing time: %u msec, "
"registration thread timeout: %u msec, "
"req start thread timeout: %u msec, "
"req header thread timeout: %u msec, "
"req body thread timeout: %u msec, "
"res header thread timeout: %u msec, "
"res body thread timeout: %u msec, "
"delayed thread timeout: %u msec, "
"static resources path: %s, "
"num of nginx ipc elements: %u, "
"keep alive interval msec: %u msec",
attachment->inspection_mode,
attachment->dbg_level,
(attachment->fail_mode_verdict == NANO_OK ? "fail-open" : "fail-close"),
attachment->fail_open_timeout,
(attachment->fail_mode_delayed_verdict == NANO_OK ? "fail-open" : "fail-close"),
attachment->fail_open_delayed_timeout,
attachment->sessions_per_minute_limit_verdict == ATTACHMENT_VERDICT_ACCEPT ? "Accept" : "Drop",
attachment->max_sessions_per_minute,
attachment->req_max_proccessing_ms_time,
attachment->res_max_proccessing_ms_time,
attachment->registration_thread_timeout_msec,
attachment->req_start_thread_timeout_msec,
attachment->req_header_thread_timeout_msec,
attachment->req_body_thread_timeout_msec,
attachment->res_header_thread_timeout_msec,
attachment->res_body_thread_timeout_msec,
attachment->waiting_for_verdict_thread_timeout_msec,
getStaticResourcesPath(),
attachment->num_of_nano_ipc_elements,
attachment->keep_alive_interval_msec
);
return NANO_OK;
}
NanoCommunicationResult
reset_attachment_config(NanoAttachment *attachment)
{
write_dbg(attachment, attachment->worker_id, DBG_LEVEL_INFO, "Resetting attachment configuration");
attachment->is_configuration_updated = NANO_ERROR;
attachment->current_config_version++;
return init_attachment_config(attachment, SHARED_ATTACHMENT_CONF_PATH);
}

37
attachments/nano_attachment/nano_configuration.h Normal file
View File

@ -0,0 +1,37 @@
/// @file nano_configuration.h
#ifndef __NANO_CONFIGURATION_H__
#define __NANO_CONFIGURATION_H__
#include <sys/time.h>
#include <assert.h>
#include "nano_attachment_common.h"
#include "nano_initializer.h"
///
/// @brief Initializes the general configuration for a NanoAttachment object.
///
/// This function initializes the general configuration for the specified NanoAttachment object
/// using the configuration file located at the specified path. It updates various configuration
/// parameters such as debug level, fail-open/fail-close mode, session limits, timeouts, and others
/// based on the configuration file.
///
/// @param attachment A pointer to the NanoAttachment object to initialize the configuration for.
/// @param conf_path The path to the configuration file.
/// @return A NanoCommunicationResult indicating the result of the operation.
///
NanoCommunicationResult init_attachment_config(NanoAttachment *attachment, const char *conf_path);
///
/// @brief Resets the configuration of a NanoAttachment object.
///
/// This function resets the configuration of the specified NanoAttachment object by
/// marking it as not updated, incrementing the current configuration version, and
/// reinitializing the general configuration using the specified configuration path.
///
/// @param attachment A pointer to the NanoAttachment object to reset the configuration for.
/// @return A NanoCommunicationResult indicating the result of the operation.
///
NanoCommunicationResult reset_attachment_config(NanoAttachment *attachment);
#endif // __NANO_CONFIGURATION_H__

859
attachments/nano_attachment/nano_initializer.c Normal file
View File

@ -0,0 +1,859 @@
// Copyright (C) 2022 Check Point Software Technologies Ltd. All rights reserved.
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
/// @file nano_initializer.c
#include "nano_initializer.h"
#include <poll.h>
#include <stdint.h>
#include <dirent.h>
#include <arpa/inet.h>
#include <pthread.h>
#include <sys/socket.h>
#include <sys/un.h>
#include <sys/stat.h>
#include <stdio.h>
#include <stdlib.h>
#include <errno.h>
#include <fcntl.h>
#include "nano_attachment_common.h"
#include "attachment_types.h"
#include "nano_configuration.h"
#include "nano_attachment_io.h"
#include "shmem_ipc_2.h"
#include "nano_utils.h"
#include "nano_attachment_sender_thread.h"
#include "nano_attachment_thread.h"
NanoCommunicationResult
write_to_service(
NanoAttachment *attachment,
int *socket,
void *data,
uint32_t size,
struct timeval *absolute_end_time)
{
int res = 0;
// `remaining_size` and `cur_data_ptr` are used to keep track of where we are in the memory.
// This allows us to write to the socket in parts (if we need to).
uint32_t remaining_size = size;
char *cur_data_ptr = data;
while (remaining_size > 0) {
// If the operation exceeded the allowed time, treat it as a failure.
if (is_absolute_timeout_reached(absolute_end_time)) {
close(*socket);
*socket = -1;
write_dbg(
attachment,
0,
DBG_LEVEL_TRACE,
"Reached timeout while communicating with the socket"
);
return NANO_TIMEOUT;
}
res = write(*socket, (void *)cur_data_ptr, remaining_size);
// `res` is -1 in case of an error: write functions failed or socket wasn't available.
if (res < 0) {
close(*socket);
*socket = -1;
write_dbg(
attachment,
0,
DBG_LEVEL_TRACE,
"Failed to communicate with the socket, Error: %s",
strerror(errno)
);
return NANO_ERROR;
}
remaining_size -= res;
cur_data_ptr += res;
}
return NANO_OK;
}
NanoCommunicationResult
read_from_service(
NanoAttachment *attachment,
int *socket,
void *data,
uint32_t size,
struct timeval *absolute_end_time)
{
int res = 0;
// `remaining_size` and `cur_data_ptr` are used to keep track of where we are in the memory.
// This allows us to read from the socket in parts (if we need to).
uint32_t remaining_size = size;
char *cur_data_ptr = data;
while (remaining_size > 0) {
// If the operation exceeded the allowed time, treat it as a failure.
if (is_absolute_timeout_reached(absolute_end_time)) {
close(*socket);
*socket = -1;
write_dbg(
attachment,
0,
DBG_LEVEL_TRACE,
"Reached timeout while communicating with the socket"
);
return NANO_TIMEOUT;
}
// The read operation must not block the attachment indefinitely.
// To avoid that we check whether the socket has data to be read prior to the read operation.
// If the socket doesn't have data to be read from within a reasonable time, we treat this as an error.
struct pollfd s_poll;
s_poll.fd = *socket;
s_poll.events = POLLIN;
s_poll.revents = 0;
res = poll(&s_poll, 1, 3000);
if (res <= 0 || (s_poll.revents & POLLIN) == 0) {
close(*socket);
*socket = -1;
write_dbg(
attachment,
0,
DBG_LEVEL_TRACE,
"Failed to communicate with the socket, Error: %s",
strerror(errno)
);
return NANO_ERROR;
}
res = read(*socket, (void *)cur_data_ptr, remaining_size);
remaining_size -= res;
cur_data_ptr += res;
}
return NANO_OK;
}
///
/// @brief Send communication data to the communication socket.
///
/// This function sends various data (unique identifier, process UID, process GID)
/// to the service through the communication socket. It sends the data in the
/// following order:
/// 1. The length of the unique identifier for this instance.
/// 2. The unique identifier for this instance.
/// 3. The process UID.
/// 4. The process GID.
///
/// @param[in] attachment The NanoAttachment struct containing the data to send.
/// @returns A NanoCommunicationResult indicating the success of the operation.
/// - #NANO_OK: The data was successfully sent.
/// - #NANO_ERROR: An error occurred during data transmission.
///
NanoCommunicationResult
send_comm_data_to_comm_socket(NanoAttachment *attachment)
{
NanoCommunicationResult res;
uint8_t uid_size_to_send = strlen(attachment->unique_id);
struct timeval timeout = get_absolute_timeout_val_sec(1);
res = write_to_service(
attachment,
&attachment->comm_socket,
&uid_size_to_send,
sizeof(uid_size_to_send),
&timeout
);
if (res != NANO_OK) {
write_dbg(attachment, 0, DBG_LEVEL_WARNING, "Failed to send unique id size");
return NANO_ERROR;
}
res = write_to_service(
attachment,
&attachment->comm_socket,
attachment->unique_id,
uid_size_to_send,
&timeout
);
if (res != NANO_OK) {
write_dbg(attachment, 0, DBG_LEVEL_WARNING, "Failed to send unique id %s", attachment->unique_id);
return NANO_ERROR;
}
res = write_to_service(
attachment,
&attachment->comm_socket,
&attachment->nano_user_id,
sizeof(uint32_t),
&timeout
);
if (res != NANO_OK) {
write_dbg(attachment, 0, DBG_LEVEL_WARNING, "Failed to send nano user id");
return NANO_ERROR;
}
res = write_to_service(
attachment,
&attachment->comm_socket,
&attachment->nano_group_id,
sizeof(uint32_t),
&timeout
);
if (res != NANO_OK) {
write_dbg(attachment, 0, DBG_LEVEL_WARNING, "Failed to send nano group id");
return NANO_ERROR;
}
return NANO_OK;
}
///
/// @brief Initialize the signaling socket for communication.
///
/// This function connects to the communication socket, sends communication data,
/// and waits for an acknowledgment from the service that communication has been
/// established. If any step fails, the function closes the communication socket
/// and returns an error.
///
/// @param[in] attachment The NanoAttachment struct containing socket information.
/// @returns A NanoCommunicationResult indicating the success of the operation.
///
/// - #NANO_OK: Signaling socket initialized successfully.
/// - #NANO_ERROR: An error occurred during initialization.
///
static NanoCommunicationResult
init_signaling_socket(NanoAttachment *attachment)
{
uint8_t initialization_ack;
HttpEventThreadCtx ctx;
int t_res;
NanoCommunicationResult res;
struct timeval timeout = get_absolute_timeout_val_sec(1);
write_dbg(attachment, 0, DBG_LEVEL_DEBUG, "spawn RegistrationCommSocketThread");
t_res = NanoRunInThreadTimeout(
attachment,
NULL,
RegistrationCommSocketThread,
(void *)&ctx,
attachment->registration_thread_timeout_msec,
"RegistrationCommSocketThread",
REGISTRATION
);
if (!t_res || ctx.res != NANO_OK) {
write_dbg(attachment, 0, DBG_LEVEL_WARNING, "Failed to connect to connection socket");
close(attachment->comm_socket);
attachment->comm_socket = -1;
if (attachment->registration_state != PENDING) {
attachment->registration_state = NOT_REGISTERED;
}
return NANO_ERROR;
}
res = send_comm_data_to_comm_socket(attachment);
if (res != NANO_OK) {
write_dbg(attachment, 0, DBG_LEVEL_WARNING, "Failed to send comm data");
close(attachment->comm_socket);
attachment->comm_socket = -1;
if (attachment->registration_state != PENDING) {
attachment->registration_state = NOT_REGISTERED;
}
return NANO_ERROR;
}
// Get an acknowledgement form the service that communication has been established.
res = read_from_service(
attachment,
&attachment->comm_socket,
&initialization_ack,
sizeof(initialization_ack),
&timeout
);
if (res != NANO_OK) {
write_dbg(attachment, 0, DBG_LEVEL_WARNING, "Failed to read communication ack");
close(attachment->comm_socket);
attachment->comm_socket = -1;
if (attachment->registration_state != PENDING) {
attachment->registration_state = NOT_REGISTERED;
}
return NANO_ERROR;
}
write_dbg(
attachment,
0,
DBG_LEVEL_DEBUG,
"Successfully connected on client socket %d",
attachment->comm_socket
);
return NANO_OK;
}
static NanoCommunicationResult
createDirectory(NanoAttachment *attachment, const char *path)
{
struct stat st;
if (stat(path, &st) == 0) {
write_dbg(
attachment,
0,
DBG_LEVEL_DEBUG,
"Nano attachment logging directory already exists"
);
return NANO_OK;
}
if (mkdir(path, 0755) == 0) {
write_dbg(
attachment,
0,
DBG_LEVEL_DEBUG,
"Successfully created logging directory"
);
return NANO_OK;
}
write_dbg(
attachment,
0,
DBG_LEVEL_WARNING,
"Failed to create logging directory"
);
return NANO_ERROR;
}
NanoCommunicationResult
set_docker_id(NanoAttachment *attachment)
{
size_t len = MAX_NGINX_UID_LEN;
char *line = NULL;
char *docker_ptr = NULL;
char *containerd_ptr = NULL;
FILE *file = fopen(CONTAINER_ID_FILE_PATH, "r");
if (file == NULL) {
write_dbg(attachment, 0, DBG_LEVEL_WARNING, "Failed to open %s", CONTAINER_ID_FILE_PATH);
return NANO_ERROR;
}
write_dbg(attachment, 0, DBG_LEVEL_DEBUG, "opened file %s", CONTAINER_ID_FILE_PATH);
line = malloc(MAX_NGINX_UID_LEN);
if (line == NULL) {
write_dbg(attachment, 0, DBG_LEVEL_DEBUG, "Failed to allocate memory for reading docker id file");
fclose(file);
return NANO_ERROR;
}
// Reading the file line by line.
bool uid_read = false;
while (getline(&line, &len, file) != -1) {
docker_ptr = strstr(line, "docker/");
containerd_ptr = strstr(line, "cri-containerd-");
if (docker_ptr != NULL)
{
// We've found a line with "docker/" so the identifier will be right after that.
write_dbg(attachment, 0, DBG_LEVEL_DEBUG, "checking for docker/");
docker_ptr += strlen("docker/");
strncpy(attachment->container_id, docker_ptr, MAX_CONTAINER_ID_LEN - 1);
attachment->container_id[MAX_CONTAINER_ID_LEN - 1] = '\0';
uid_read = true;
break;
}
if (containerd_ptr != NULL)
{
write_dbg(attachment, 0, DBG_LEVEL_DEBUG, "checking for cri-containerd-");
containerd_ptr += strlen("cri-containerd-");
strncpy(attachment->container_id, containerd_ptr, MAX_CONTAINER_ID_LEN - 1);
attachment->container_id[MAX_CONTAINER_ID_LEN - 1] = '\0';
uid_read = true;
break;
}
}
if (!uid_read) {
const char *env_var_name = "OPENAPPSEC_UID"; // Replace with your environment variable name
const char *env_value = getenv(env_var_name);
if (env_value) {
strncpy(attachment->container_id, env_value, MAX_CONTAINER_ID_LEN - 1);
attachment->container_id[MAX_CONTAINER_ID_LEN - 1] = '\0';
uid_read = true;
}
}
free(line);
fclose(file);
if (!uid_read) {
write_dbg(attachment, 0, DBG_LEVEL_WARNING, "Severe error - failed to get uid!");
}
return NANO_OK;
}
///
///@brief Sends registration data to the registration socket.
///
/// This function sends registration data to the registration socket of the given NanoAttachment.
/// It sends the attachment type, worker ID, total number of workers,
/// and the size and content of the container id (docker ID).
/// If any of the send operations fail, it returns NANO_ERROR; otherwise, it returns NANO_OK.
///
///@param attachment The NanoAttachment containing the registration socket and other necessary information.
///@return NanoCommunicationResult Returns NANO_OK if the registration data is successfully sent, otherwise NANO_ERROR.
///
NanoCommunicationResult
send_registration_data_to_registration_socket(NanoAttachment *attachment)
{
uint8_t attachment_type = attachment->attachment_type;
uint8_t worker_id = attachment->worker_id + 1;
uint8_t workers_amount = attachment->num_of_workers;
struct timeval absolute_timeout = get_absolute_timeout_val_sec(1);
uint8_t container_id_size = strlen(attachment->container_id);
NanoCommunicationResult res;
// Send to the attachment manager the following details:
// 1. The type of the attachment (fixed NGINX).
// 2. The number of this worker.
// 3. The total amount of workers.
// 4. The size of the docker ID.
// 5. If the docker ID isn't empty (size 0), the docker id itself.
// If any of these fail - return an error.
res = write_to_service(
attachment,
&attachment->registration_socket,
&attachment_type,
sizeof(attachment_type),
&absolute_timeout
);
if (res != NANO_OK) {
write_dbg(attachment, 0, DBG_LEVEL_WARNING, "Failed to send attachment type");
return NANO_ERROR;
}
res = write_to_service(
attachment,
&attachment->registration_socket,
&worker_id,
sizeof(worker_id),
&absolute_timeout
);
if (res != NANO_OK) {
write_dbg(attachment, 0, DBG_LEVEL_WARNING, "Failed to send worker ID");
return NANO_ERROR;
}
res = write_to_service(
attachment,
&attachment->registration_socket,
&workers_amount,
sizeof(workers_amount),
&absolute_timeout
);
if (res != NANO_OK) {
write_dbg(attachment, 0, DBG_LEVEL_WARNING, "Failed to send workers amount");
return NANO_ERROR;
}
res = write_to_service(
attachment,
&attachment->registration_socket,
&container_id_size,
sizeof(container_id_size),
&absolute_timeout
);
if (res != NANO_OK) {
write_dbg(attachment, 0, DBG_LEVEL_WARNING, "Failed to send container id size");
return NANO_ERROR;
}
if (container_id_size > 0) {
res = write_to_service(
attachment,
&attachment->registration_socket,
attachment->container_id,
container_id_size,
&absolute_timeout
);
if (res != NANO_OK) {
write_dbg(attachment, 0, DBG_LEVEL_WARNING, "Failed to send container id");
return NANO_ERROR;
}
}
return NANO_OK;
}
///
/// @brief Reads the verdict signal path from the registration socket.
///
/// This function reads the verdict signal path from the registration socket of the given NanoAttachment.
/// It first reads the length of the signal path, then reads the signal path itself.
/// If the read operations fail or the path length exceeds the maximum allowed length, it returns NANO_ERROR;
/// otherwise, it returns NANO_OK.
///
/// @param attachment The NanoAttachment containing the registration socket and other necessary information.
/// @return NanoCommunicationResult Returns NANO_OK if the signal path is successfully read, otherwise NANO_ERROR.
///
NanoCommunicationResult
read_verdict_signal_path_from_registration_socket(NanoAttachment *attachment)
{
uint8_t path_length;
int registration_socket = attachment->registration_socket;
uint8_t worker_id = attachment->worker_id + 1;
uint8_t workers_amount = attachment->num_of_workers;
NanoCommunicationResult res;
struct timeval absolute_timeout = get_absolute_timeout_val_sec(1);
// Read from the attachment manager:
// 1. The length of signal path.
// 2. The signal path itself.
// If that fails - return an error.
res = read_from_service(
attachment,
&attachment->registration_socket,
&path_length,
sizeof(path_length),
&absolute_timeout
);
if (res != NANO_OK) {
write_dbg(attachment, 0, DBG_LEVEL_WARNING, "Failed to read path length");
return NANO_ERROR;
}
if (path_length >= MAX_SHARED_MEM_PATH_LEN) {
write_dbg(attachment, 0, DBG_LEVEL_WARNING, "Verdict path length is too long");
return NANO_ERROR;
}
res = read_from_service(
attachment,
&attachment->registration_socket,
attachment->shared_verdict_signal_path,
path_length,
&absolute_timeout
);
if (res != NANO_OK) {
write_dbg(attachment, 0, DBG_LEVEL_WARNING, "Failed to read socket path");
return NANO_ERROR;
}
// Successfully go the shared communication path - add null termination and exit.
attachment->shared_verdict_signal_path[path_length] = '\0';
write_dbg(
attachment,
0,
DBG_LEVEL_DEBUG,
"Successfully registered on client. socket: %d, instance ID: %u, instances amount: %u, received path: %s",
registration_socket,
(uint32_t)worker_id,
(uint32_t)workers_amount,
attachment->shared_verdict_signal_path
);
return NANO_OK;
}
NanoCommunicationResult
register_to_attachments_manager(NanoAttachment *attachment)
{
NanoCommunicationResult res;
HttpEventThreadCtx ctx;
int t_res;
// If there was an old socket, close it.
if (attachment->registration_socket > 0) {
close(attachment->registration_socket);
attachment->registration_socket = -1;
}
write_dbg(attachment, 0, DBG_LEVEL_DEBUG, "spawn RegistrationSocketThread");
t_res = NanoRunInThreadTimeout(
attachment,
NULL,
RegistrationSocketThread,
(void *)&ctx,
attachment->registration_thread_timeout_msec,
"RegistrationSocketThread",
REGISTRATION
);
if (!t_res || ctx.res != NANO_OK) {
write_dbg(
attachment,
0,
DBG_LEVEL_WARNING,
"Failed to connect to registration socket"
);
close(attachment->registration_socket);
attachment->registration_socket = -1;
return NANO_ERROR;
}
res = send_registration_data_to_registration_socket(attachment);
if (res != NANO_OK) {
write_dbg(
attachment,
0,
DBG_LEVEL_WARNING,
"Failed to send registration data"
);
close(attachment->registration_socket);
attachment->registration_socket = -1;
return NANO_ERROR;
}
res = read_verdict_signal_path_from_registration_socket(attachment);
if (res != NANO_OK) {
write_dbg(
attachment,
0,
DBG_LEVEL_WARNING,
"Failed to read verdict signal path"
);
close(attachment->registration_socket);
attachment->registration_socket = -1;
return NANO_ERROR;
}
close(attachment->registration_socket);
attachment->registration_socket = -1;
return NANO_OK;
}
NanoCommunicationResult
set_unique_id(NanoAttachment *attachment)
{
unsigned int unique_id_size = 0;
long unsigned int nano_worker_id = attachment->worker_id + 1;
if (strlen(attachment->container_id) > 0) {
unique_id_size += snprintf(
attachment->unique_id,
MAX_NGINX_UID_LEN,
"%s_%lu",
attachment->container_id,
nano_worker_id);
} else {
unique_id_size += snprintf(attachment->unique_id, MAX_NGINX_UID_LEN, "%lu", nano_worker_id);
}
if (unique_id_size <= 0) {
write_dbg(attachment, 0, DBG_LEVEL_WARNING, "Failed to set attachment's unique_id");
return NANO_ERROR;
}
if (unique_id_size >= MAX_NGINX_UID_LEN) {
write_dbg(attachment, 0, DBG_LEVEL_INFO, "Unique ID is too long, trancheated to: %s", attachment->unique_id);
}
write_dbg(attachment, 0, DBG_LEVEL_INFO, "Successfully set attachment's unique_id: '%s'", attachment->unique_id);
return NANO_OK;
}
NanoCommunicationResult
set_logging_fd(NanoAttachment *attachment, int logging_fd)
{
char full_logging_path[128];
if (logging_fd > 0) {
attachment->is_default_fd = 0;
attachment->logging_fd = logging_fd;
write_dbg(attachment, 0, DBG_LEVEL_DEBUG, "Successfully set provided logging_fd");
return NANO_OK;
}
if (createDirectory(attachment, LOGGING_DIRECTORY_PATH) != NANO_OK) {
return NANO_ERROR;
}
snprintf(full_logging_path, sizeof(full_logging_path), "%s-%s.dbg", LOGGING_FILE_PATH, attachment->container_id);
attachment->logging_fd = open(full_logging_path, O_WRONLY | O_CREAT | O_APPEND, 0644);
if (attachment->logging_fd < 0) {
return NANO_ERROR;
}
attachment->is_default_fd = 1;
write_dbg(attachment, 0, DBG_LEVEL_WARNING, "Successfully opened logging file");
return NANO_OK;
}
void
close_logging_fd(NanoAttachment *attachment)
{
if (attachment->logging_fd > 0 && attachment->is_default_fd) {
close(attachment->logging_fd);
attachment->logging_fd = -1;
}
free(attachment->logging_data);
attachment->logging_data = NULL;
}
NanoCommunicationResult
nano_attachment_init_process(NanoAttachment *attachment)
{
attachment->nano_user_id = getuid();
attachment->nano_group_id = getgid();
attachment->num_of_connection_attempts++;
init_attachment_config(attachment, SHARED_ATTACHMENT_CONF_PATH);
if (access(SHARED_REGISTRATION_SIGNAL_PATH, F_OK) != 0) {
write_dbg(attachment, 0, DBG_LEVEL_TRACE, "Attachment registration manager is turned off");
return NANO_ABORT;
}
if (attachment->registration_state == PENDING) {
write_dbg(attachment, 0, DBG_LEVEL_INFO, "Registration to the Attachments Manager is in process");
return NANO_ERROR;
}
if (attachment->registration_state == NOT_REGISTERED) {
// Register with the attachment manager.
if (register_to_attachments_manager(attachment) == NANO_ERROR) {
write_dbg(attachment, 0, DBG_LEVEL_INFO, "Failed to register to Attachments Manager service");
return NANO_ERROR;
}
attachment->registration_state = REGISTERED;
}
if (init_attachment_config(attachment, SHARED_ATTACHMENT_CONF_PATH) == NANO_ERROR) {
write_dbg(attachment, 0, DBG_LEVEL_WARNING, "Failed to initialize attachment's configuration");
return NANO_ERROR;
}
if (attachment->comm_socket < 0) {
// Signal to the service to start communication.
write_dbg(attachment, 0, DBG_LEVEL_DEBUG, "Registering to nano service");
if (init_signaling_socket(attachment) == NANO_ERROR) {
write_dbg(attachment, 0, DBG_LEVEL_DEBUG, "Failed to register to the Nano Service");
return NANO_ERROR;
}
}
// Initalize the the communication channel with the service.
if (attachment->nano_service_ipc == NULL) {
write_dbg(attachment, 0, DBG_LEVEL_INFO, "Initializing IPC channel");
attachment->nano_service_ipc = initIpc(
attachment->unique_id,
attachment->nano_user_id,
attachment->nano_group_id,
0,
attachment->num_of_nano_ipc_elements,
attachment->logging_data,
write_dbg_impl
);
if (attachment->nano_service_ipc == NULL) {
restart_communication(attachment);
write_dbg(attachment, 0, DBG_LEVEL_INFO, "Failed to initialize IPC with nano service");
return NANO_ERROR;
}
}
write_dbg(
attachment,
0,
DBG_LEVEL_INFO,
"NGINX attachment (UID='%s') successfully registered to nano service after %d attempts.",
attachment->unique_id,
attachment->num_of_connection_attempts
);
attachment->num_of_connection_attempts = 0;
return NANO_OK;
}
NanoCommunicationResult
restart_communication(NanoAttachment *attachment)
{
write_dbg(attachment, 0, DBG_LEVEL_TRACE, "Restarting communication channels with nano service");
if (attachment->nano_service_ipc != NULL) {
destroyIpc(attachment->nano_service_ipc, 0);
attachment->nano_service_ipc = NULL;
}
if (init_signaling_socket(attachment) == NANO_ERROR) {
if (register_to_attachments_manager(attachment) == NANO_ERROR) {
write_dbg(attachment, 0, DBG_LEVEL_DEBUG, "Failed to register to Attachments Manager service");
return NANO_ERROR;
}
if (init_signaling_socket(attachment) == NANO_ERROR) {
write_dbg(attachment, 0, DBG_LEVEL_DEBUG, "Failed to init the signaling socket");
return NANO_ERROR;
}
}
attachment->nano_service_ipc = initIpc(
attachment->unique_id,
attachment->nano_user_id,
attachment->nano_group_id,
0,
attachment->num_of_nano_ipc_elements,
attachment->logging_data,
write_dbg_impl
);
if (attachment->nano_service_ipc == NULL) {
write_dbg(attachment, 0, DBG_LEVEL_DEBUG, "Failed to init IPC");
return NANO_ERROR;
}
return NANO_OK;
}
void
disconnect_communication(NanoAttachment *attachment)
{
write_dbg(attachment, 0, DBG_LEVEL_DEBUG, "Disconnecting communication channels with nano service");
if (attachment->comm_socket > 0) {
close(attachment->comm_socket);
attachment->comm_socket = -1;
}
if (attachment->nano_service_ipc != NULL) {
destroyIpc(attachment->nano_service_ipc, 0);
attachment->nano_service_ipc = NULL;
}
}
NanoCommunicationResult
handle_shmem_corruption(NanoAttachment *attachment)
{
NanoCommunicationResult res;
if (attachment->nano_service_ipc == NULL) {
disconnect_communication(attachment);
res = restart_communication(attachment);
if (res != NANO_OK) {
write_dbg(attachment, 0, DBG_LEVEL_WARNING, "Failed to restart communication");
return NANO_ERROR;
}
}
if (isCorruptedShmem(attachment->nano_service_ipc, 0)) {
write_dbg(attachment, 0, DBG_LEVEL_WARNING, "Shared memory is corrupted! restarting communication");
disconnect_communication(attachment);
return NANO_ERROR;
}
return NANO_OK;
}
int
isIpcReady(NanoAttachment *attachment)
{
return attachment->nano_service_ipc != NULL && attachment->comm_socket > 0;
}

218
attachments/nano_attachment/nano_initializer.h Normal file
View File

@ -0,0 +1,218 @@
// Copyright (C) 2022 Check Point Software Technologies Ltd. All rights reserved.
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
/// @file nano_initializer.h
#ifndef __NANO_INITIALIZER_H__
#define __NANO_INITIALIZER_H__
#include <stdint.h>
#include <stdio.h>
#include <string.h>
#include "nano_attachment_common.h"
#include "shmem_ipc_2.h"
#define LOGGING_DIRECTORY_PATH "/var/log/nano_attachment" ///< Default logging directory path.
#define LOGGING_FILE_NAME "nano_attachment" ///< Default logging file name.
#define LOGGING_FILE_PATH LOGGING_DIRECTORY_PATH "/" LOGGING_FILE_NAME
typedef enum nano_attachment_registration_state {
NOT_REGISTERED,
PENDING,
REGISTERED
} nano_attachment_registration_state; ///< Indicates the current attachment registation stage.
typedef struct NanoAttachment {
char unique_id[MAX_NGINX_UID_LEN]; // Holds the unique identifier for this instance.
char container_id[MAX_NGINX_UID_LEN]; // Holds the container id of the attachment.
char shared_verdict_signal_path[MAX_SHARED_MEM_PATH_LEN]; // Holds the path associating the attachment and service.
uint8_t worker_id; // Holds the worker number of the attachment.
uint8_t num_of_workers; // Holds the number of workers in the attachment.
uint32_t nano_user_id; // Holds the user id of the attachment.
uint32_t nano_group_id; // Holds the group id of the attachment.
int registration_socket; // Holds the file descriptor used for registering the instance.
nano_attachment_registration_state registration_state; // Holds the current attachment registation stage.
uint8_t attachment_type; // Holds the type of the attachment.
SharedMemoryIPC *nano_service_ipc; // Holds the shared memory IPC of the nano service.
int comm_socket; // Holds the communication socket of the attachment.
int is_default_fd; // Holds a value indicating if the logging file descriptor is the default one.
int logging_fd; // Holds the file descriptor for logging.
LoggingData *logging_data; // Holds the logging data of the attachment.
NanoCommunicationResult is_configuration_updated; // Holds the result of the configuration update.
unsigned int current_config_version; // Holds the current configuration version.
int fail_mode_verdict; ///< Fail open verdict incase of a timeout.
int fail_mode_delayed_verdict; ///< Fail open verdict incase of a timeout when waiting for delayed verdict.
nano_http_cp_debug_level_e dbg_level; ///< Default debug level.
int num_of_connection_attempts; ///< Maximum number of attempted connections.
unsigned int fail_open_timeout; ///< Fail open timeout in milliseconds.
unsigned int fail_open_delayed_timeout; ///< Fail open delayed timeout in milliseconds.
AttachmentVerdict sessions_per_minute_limit_verdict; ///< Session per minute limit verdict.
unsigned int max_sessions_per_minute; ///< Masimum session per minute.
unsigned int req_max_proccessing_ms_time; ///< Total Request processing timeout in milliseconds.
unsigned int res_max_proccessing_ms_time; ///< Total Response processing timeout in milliseconds.
unsigned int registration_thread_timeout_msec; ///< Registration timeout in milliseconds.
unsigned int req_start_thread_timeout_msec; ///< Request start processing timeout in milliseconds.
unsigned int req_header_thread_timeout_msec; ///< Request header processing timeout in milliseconds.
unsigned int req_body_thread_timeout_msec; ///< Request body processing timeout in milliseconds.
unsigned int res_header_thread_timeout_msec; ///< Response header processing timeout in milliseconds.
unsigned int res_body_thread_timeout_msec; ///< Response body processing timeout in milliseconds.
unsigned int waiting_for_verdict_thread_timeout_msec; ///< Wait thread processing timeout in milliseconds.
unsigned int metric_timeout_timeout; ///< Metric timeout in milliseconds.
NanoHttpInspectionMode inspection_mode; ///< Default inspection mode.
unsigned int num_of_nano_ipc_elements; ///< Number of NANO IPC elements.
uint64_t keep_alive_interval_msec; ///< Keep alive interval in milliseconds.
#ifdef __cplusplus
uint64_t metric_data[static_cast<int>(AttachmentMetricType::METRIC_TYPES_COUNT)];
uint64_t metric_average_data_divisor[static_cast<int>(AttachmentMetricType::METRIC_TYPES_COUNT)];
#else
uint64_t metric_data[METRIC_TYPES_COUNT];
uint64_t metric_average_data_divisor[METRIC_TYPES_COUNT];
#endif
} NanoAttachment;
///
/// @brief Initialize all the attachments resources and communication channels.
/// @param[in] attachment Points to initiated NanoAttachment struct.
/// @returns NanoCommunicationResult
/// - #NANO_OK
/// - #NANO_ERROR
/// - #NANO_ABORT
///
NanoCommunicationResult nano_attachment_init_process(NanoAttachment *attachment);
///
/// @brief Preforms send information to the service via a socket.
///
/// This function writes data to the socket associated with the given NanoAttachment.
/// It writes data in parts if necessary, keeping track of the remaining data to be written.
/// If the write operation fails or exceeds the allowed timeout, it returns NANO_ERROR;
/// otherwise, it returns NANO_OK.
///
/// @param Points to the NanoAttachment struct.
/// @param socket The socket to write to.
/// @param data The pointer to the data to be written.
/// @param size The size of the data to be written, excluding the null terminator.
/// @param absolute_end_time The absolute till the writing is allowed.
/// @return NanoCommunicationResult Returns NANO_OK if the write operation is successful, otherwise NANO_ERROR.
///
NanoCommunicationResult write_to_service(
NanoAttachment *attachment,
int *socket,
void *data,
uint32_t size,
struct timeval *absolute_end_time);
///
/// @brief Preforms receive information from the service via a socket.
///
/// This function reads data from the socket associated with the given NanoAttachment.
/// It reads data in parts if necessary, keeping track of the remaining data to be read.
/// It checks if the socket has data to be read prior to the read operation to avoid blocking indefinitely.
/// If the read operation fails or exceeds the allowed timeout, it returns NANO_ERROR;
/// otherwise, it returns NANO_OK.
///
/// @param attachment Points to the NanoAttachment struct.
/// @param socket The socket to read from.
/// @param data The pointer to the buffer where the read data will be stored.
/// @param size The size of the data to be read.
/// @param absolute_end_time The absolute till the reading is allowed.
/// @return NanoCommunicationResult Returns NANO_OK if the read operation is successful, otherwise NANO_ERROR.
///
NanoCommunicationResult read_from_service(
NanoAttachment *attachment,
int *socket,
void *data,
uint32_t size,
struct timeval *absolute_end_time);
///
/// @brief Sets a unique identifier for the NanoAttachment based on its container ID and worker ID.
///
/// @param attachment Pointer to the NanoAttachment structure for which to set the unique ID.
/// @return NANO_OK if the unique ID was successfully set, otherwise an error code.
///
NanoCommunicationResult set_unique_id(NanoAttachment *attachment);
///
/// @brief Sets the container ID for the NanoAttachment by reading it from CONTAINER_ID_FILE_PATH value.
///
/// @param attachment Pointer to the NanoAttachment structure for which to set the container ID.
/// @return NANO_OK if the container ID was successfully set, otherwise an error code.
///
NanoCommunicationResult set_docker_id(NanoAttachment *attachment);
///
/// @brief Sets the file descriptor for logging in the NanoAttachment structure.
///
/// If an invalid fd passed, the default logging file descriptor is set to write to LOGGING_FILE_PATH variable.
///
/// @param attachment Pointer to the NanoAttachment struct to set the logging file descriptor.
/// @param logging_fd The file descriptor to set.
/// @return NANO_OK if the logging file descriptor is set successfully, NANO_ERROR otherwise.
///
NanoCommunicationResult set_logging_fd(NanoAttachment *attachment, int logging_fd);
///
/// @brief Closes the logging file descriptor in the NanoAttachment structure.
///
/// @param attachment Pointer to the NanoAttachment struct to close the logging file descriptor.
///
void close_logging_fd(NanoAttachment *attachment);
///
/// @brief Closes any existing communication to the service and tries to open a new one.
/// @param[in] attachment Points to initiated NanoAttachment struct.
/// @returns NanoCommunicationResult
/// - #NANO_OK
/// - #NANO_ERROR
///
NanoCommunicationResult restart_communication(NanoAttachment *attachment);
///
/// @brief Checks that the shared memory with the service isn't corrupted, disconnect if it is.
/// @param[in] attachment Points to initiated NanoAttachment struct.
/// @returns NanoCommunicationResult
/// - #NANO_OK
/// - #NANO_ERROR
///
NanoCommunicationResult handle_shmem_corruption(NanoAttachment *attachment);
///
/// @brief Closes all the communication channels with the service.
/// @param[in] attachment Points to initiated NanoAttachment struct.
///
void disconnect_communication(NanoAttachment *attachment);
///
/// @brief Checks if communication with the service is up and running.
/// @param[in] attachment Points to initiated NanoAttachment struct.
/// @returns NanoCommunicationResult - 1 if communication is active, otherwise 0.
///
int isIpcReady(NanoAttachment *attachment);
///
/// @brief Register the attachment instance with the attachment manager to associate it with a service.
/// @param[in] attachment Points to initiated NanoAttachment struct.
/// @returns NanoCommunicationResult
/// - #NANO_OK
/// - #NANO_ERROR
///
NanoCommunicationResult register_to_attachments_manager(NanoAttachment *attachment);
#endif // __NANO_INITIALIZER_H__

131
attachments/nano_attachment/nano_utils.c Normal file
View File

@ -0,0 +1,131 @@
// Copyright (C) 2022 Check Point Software Technologies Ltd. All rights reserved.
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
/// @file nano_utils.c
#include "nano_utils.h"
#include "nano_attachment_common.h"
#include <time.h>
#include <stdarg.h>
#include <math.h>
#include <unistd.h>
#include <stdio.h>
///
/// @brief Gets the current time using a fast, coarse-grained clock.
///
/// This function uses CLOCK_MONOTONIC_COARSE to retrieve the current time,
/// which provides a fast timestamp. The function returns
/// the current time as a struct timeval, which represents seconds and microseconds.
///
/// @return struct timeval The current time as seconds and microseconds.
///
static struct timeval
getCurrTimeFast()
{
struct timeval curr_time;
struct timespec curr_time_mono;
clock_gettime(CLOCK_MONOTONIC_COARSE, &curr_time_mono);
curr_time.tv_sec = curr_time_mono.tv_sec;
curr_time.tv_usec = curr_time_mono.tv_nsec/1000.0;
return curr_time;
}
void
write_dbg_impl(
const LoggingData *logging_data,
uint32_t session_id,
int _dbg_level,
const char *func,
const char *file,
int line_num,
const char *fmt,
...
)
{
if (logging_data == NULL) return;
if (_dbg_level < logging_data->dbg_level) return;
char debug_str[2048] = {0};
char session_id_str[32] = {0};
char unique_id[32] = "uniqueId";
va_list args;
time_t ttime;
int millisec;
struct timeval tv;
char time_stamp[64];
char str_uid[140];
int pid = 0;
time(&ttime);
tv = getCurrTimeFast();
millisec = lrint(tv.tv_usec/1000.0);
if (millisec>=1000) {
// Allow for rounding up to nearest second
millisec -=1000;
tv.tv_sec++;
}
strftime(time_stamp, sizeof(time_stamp), "%FT%T", localtime(&ttime));
if (!pid) pid = getpid();
if (session_id > 0) {
snprintf(session_id_str, sizeof(session_id_str) - 1, "<session id %d> ", session_id);
}
// Prints the debug given all the data and a formatter.
snprintf(
str_uid,
sizeof(str_uid) - 1,
"|%s.%03d: %s@%s:%d [uid %s | pid %d] %s| ",
time_stamp,
millisec,
func,
file,
line_num,
unique_id,
pid,
session_id_str
);
va_start(args, fmt);
vsnprintf(debug_str, sizeof(debug_str) - 1, fmt, args);
va_end(args);
dprintf(logging_data->fd, "%s%s\n", str_uid, debug_str);
}
struct timeval
get_absolute_timeout_val_sec(const int delta_time_in_sec)
{
struct timeval time;
time = getCurrTimeFast();
time.tv_sec += delta_time_in_sec;
return time;
}
int
is_absolute_timeout_reached(struct timeval *timeout)
{
struct timeval curr_time;
curr_time = getCurrTimeFast();
return (timercmp(timeout, &curr_time, <));
}

90
attachments/nano_attachment/nano_utils.h Normal file
View File

@ -0,0 +1,90 @@
// Copyright (C) 2022 Check Point Software Technologies Ltd. All rights reserved.
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
/// @file nano_utils.h
#ifndef __NANO_UTILS_H__
#define __NANO_UTILS_H__
#include <sys/time.h>
#include <assert.h>
#include "nano_initializer.h"
typedef struct LoggingData {
int dbg_level;
int worker_id;
int fd;
} LoggingData;
#ifndef __FILENAME__
#define __FILENAME__ (strrchr(__FILE__, '/') ? strrchr(__FILE__, '/') + 1 : __FILE__)
#endif
#define write_dbg(attachment, session_id, _dbg_level, fmt, ...) \
{ \
write_dbg_impl( \
attachment->logging_data, \
session_id, \
_dbg_level, \
__func__, \
__FILENAME__, \
__LINE__, \
fmt, \
##__VA_ARGS__ \
); \
if ((_dbg_level) == DBG_LEVEL_ASSERT) assert(0); \
}
///
/// @brief Writing into debug implementation.
/// @param[in] LoggingData Logging data.
/// @param[in] session_id Session ID.
/// @param[in] _dbg_level Debug level to write into.
/// @param[in] func Function name from which the write debug was called from.
/// @param[in] file File from which the debug function was called from.
/// @param[in] line_num Line number of the write debug was called on.
/// @param[in] fmt Debug formatter.
/// @param[in] ... Extra values to write into the debug using the formatter.
///
void
write_dbg_impl(
const LoggingData *logging_data,
uint32_t session_id,
int _dbg_level,
const char *func,
const char *file,
int line_num,
const char *fmt,
...
);
///
/// @brief Get delta current time + delta_time_in_sec value in seconds.
/// @param[in] delta_time_in_sec Delta time to return
/// @returns timeval struct with tv_sec value of += delta_time_in_sec.
///
struct timeval get_absolute_timeout_val_sec(const int delta_time_in_sec);
///
/// @brief Check if a timeout has been reached.
///
/// This function compares the specified timeout value with the current time
/// to determine if the timeout has been reached.
///
/// @param[in] timeout A pointer to a struct timeval representing the timeout value.
/// @return 1 if the timeout has been reached, 0 otherwise.
///
int is_absolute_timeout_reached(struct timeval *timeout);
#endif // __NANO_UTILS_H__

1
core/CMakeLists.txt
View File

@ -1,3 +1,4 @@
add_subdirectory(shmem_ipc) add_subdirectory(shmem_ipc)
add_subdirectory(shmem_ipc_2)
add_subdirectory(compression) add_subdirectory(compression)
add_subdirectory(attachments) add_subdirectory(attachments)

258
core/include/attachments/nano_attachment.h Executable file
View File

@ -0,0 +1,258 @@
#ifndef __NANO_ATTACHMENT_H__
#define __NANO_ATTACHMENT_H__
#include "nano_attachment_common.h"
typedef struct NanoAttachment NanoAttachment;
///
/// @brief Initializes a NanoAttachment structure.
///
/// This function initializes a NanoAttachment structure with the specified parameters and default values.
///
/// @param attachment_type The type of attachment to initialize.
/// @param worker_id The ID of the worker associated with the attachment.
/// @param num_of_workers The total number of workers.
/// @param logging_fd The file descriptor for logging.
///
/// @return A pointer to the initialized NanoAttachment structure if the function completes, NULL otherwise.
///
NanoAttachment * InitNanoAttachment(uint8_t attachment_type, int worker_id, int num_of_workers, int logging_fd);
///
/// @brief Cleans up resources associated with a NanoAttachment structure and deallocates memory.
///
/// This function performs cleanup operations on a NanoAttachment structure and deallocates
/// the memory associated with it.
/// The function closes the logging file descriptor associated with the NanoAttachment
/// and frees the memory allocated for the structure.
///
/// @param attachment A pointer to the NanoAttachment structure to be cleaned up.
///
void FiniNanoAttachment(NanoAttachment *attachment);
///
/// @brief Restarts the configuration of a NanoAttachment.
///
/// @param attachment A pointer to the NanoAttachment whose configuration is to be restarted.
///
/// @return A NanoCommunicationResult indicating the success or failure of the operation.
NanoCommunicationResult RestartAttachmentConfiguration(NanoAttachment *attachment);
///
/// @brief Initializes a HttpSessionData structure with default values.
///
/// This function dynamically allocates memory for a HttpSessionData structure
/// and initializes its fields with default values.
///
/// @param attachment A pointer to the NanoAttachment structure associated with the session.
/// @param session_id The ID of the session to be initialized.
///
/// @return A pointer to the initialized HttpSessionData structure if the function completes, NULL otherwise.
///
HttpSessionData * InitSessionData(NanoAttachment *attachment, SessionID session_id);
///
/// @brief Cleans up and deallocates resources associated with a HttpSessionData structure.
///
/// This function performs cleanup operations on a HttpSessionData structure and deallocates
/// the memory associated with it. It writes a debug message indicating the session ID being
/// freed, and then frees the memory allocated for the HttpSessionData structure.
///
/// @param attachment A pointer to the NanoAttachment structure associated with the session.
/// @param session_data A pointer to the HttpSessionData structure to be cleaned up.
///
void FiniSessionData(NanoAttachment *attachment, HttpSessionData *session_data);
///
/// @brief Updates a metric associated with a NanoAttachment.
///
/// This function updates a metric associated with a NanoAttachment structure
/// based on the provided metric type and value. It delegates the actual updating
/// of the metric to the helper function updateMetricField.
///
/// @param attachment A pointer to the NanoAttachment structure associated with the metric.
/// @param metric The type of metric to be updated.
/// @param value The value to be incorporated into the metric calculation.
///
void UpdateMetric(NanoAttachment *attachment, AttachmentMetricType metric, uint64_t value);
///
/// @brief Sends metric data that been accumulated in the attachment to the service.
///
/// @param attachment A pointer to the NanoAttachment structure associated with the metric.
///
void SendAccumulatedMetricData(NanoAttachment *attachment);
///
/// @brief Processes and sends attachment data to the appropriate handlers.
///
/// This function processes the attachment data based on its chunk type and sends
/// it to the appropriate handler functions. If the chunk type is not recognized,
/// it sets a default verdict of ATTACHMENT_VERDICT_INSPECT and returns an AttachmentVerdictResponse
/// structure containing the default verdict and the session ID from the provided AttachmentData.
///
/// @param attachment A pointer to the NanoAttachment structure associated with the data.
/// @param data A pointer to the AttachmentData structure containing the data to be processed.
///
/// @return An AttachmentVerdictResponse structure containing the verdict and session ID.
///
AttachmentVerdictResponse SendDataNanoAttachment(NanoAttachment *attachment, AttachmentData *data);
///
/// @brief Sends a keep-alive signal using a socket connection.
///
/// @param attachment A pointer to a NanoAttachment struct containing attachment information.
///
void SendKeepAlive(NanoAttachment *attachment);
///
/// @brief Checks if a session is finalized based on the session's verdict.
///
/// @param attachment The NanoAttachment object associated with the session.
/// @param session_data The HttpSessionData object representing the session.
///
/// @return Returns 0 if the session is not finalized, 1 otherwise.
///
int IsSessionFinalized(NanoAttachment *attachment, HttpSessionData *session_data);
///
/// @brief Checks if the response contains modifications.
///
/// This function determines whether the provided response contains modifications.
///
/// @param attachment A pointer to a NanoAttachment structure representing the attachment.
/// @param session_data A pointer to a HttpSessionData structure containing session data.
/// @param response A pointer to an AttachmentVerdictResponse structure representing the response.
///
/// @return 1 if the response contains modifications, 0 otherwise.
///
int IsResponseWithModification(
NanoAttachment *attachment,
HttpSessionData *session_data,
AttachmentVerdictResponse *response
);
///
/// @brief Retrieves response modifications from the given attachment and session data.
///
/// @param attachment Pointer to a NanoAttachment object.
/// @param session_data Pointer to HttpSessionData object containing session information.
/// @param response Pointer to an AttachmentVerdictResponse object.
///
/// @return NanoResponseModifications structure containing response modifications.
///
NanoResponseModifications GetResponseModifications(
NanoAttachment *attachment,
HttpSessionData *session_data,
AttachmentVerdictResponse *response
);
///
/// @brief Retrieves the type of web response associated with the given attachment and session data.
///
/// This function checks if the provided response object contains valid web response data.
/// If the response object is null, it logs a warning and returns NO_WEB_RESPONSE.
/// Otherwise, it returns the type of web response contained in the response object.
///
/// @param attachment Pointer to the NanoAttachment structure associated with the request.
/// @param session_data Pointer to the HttpSessionData structure containing session-related data.
/// @param response Pointer to the AttachmentVerdictResponse structure containing response data.
///
/// @return The type of web response, or NO_WEB_RESPONSE if no response object is provided.
///
NanoWebResponseType GetWebResponseType(
NanoAttachment *attachment,
HttpSessionData *session_data,
AttachmentVerdictResponse *response
);
///
/// @brief Retrieves the block page data for a response.
///
/// @param attachment The NanoAttachment object associated with the session.
/// @param session_data The HttpSessionData object representing the session.
/// @param response The AttachmentVerdictResponse object containing the verdict.
///
/// @return
///
BlockPageData GetBlockPage(
NanoAttachment *attachment,
HttpSessionData *session_data,
AttachmentVerdictResponse *response
);
///
/// @brief Retrieves the redict page data for a response.
///
/// @param attachment The NanoAttachment object associated with the session.
/// @param session_data The HttpSessionData object representing the session.
/// @param response The AttachmentVerdictResponse object containing the verdict.
///
/// @return
///
RedirectPageData GetRedirectPage(
NanoAttachment *attachment,
HttpSessionData *session_data,
AttachmentVerdictResponse *response
);
///
/// @brief Free allocated resources of an AttachmentVerdictResponse.
///
/// This function frees the allocated resources of an AttachmentVerdictResponse.
///
/// @param attachment The NanoAttachment object associated with the session.
/// @param session_data The HttpSessionData object representing the session.
/// @param response The AttachmentVerdictResponse object to be freed.
///
void FreeAttachmentResponseContent(
NanoAttachment *attachment,
HttpSessionData *session_data,
AttachmentVerdictResponse *response
);
///
/// @brief Compresses HttpBody and return allocated compressed body.
///
/// @param attachment The NanoAttachment object associated with the session.
/// @param session_data The HttpSessionData object representing the session.
/// @param bodies The bodies pointer to be compressed.
///
HttpBody * compressBody(
NanoAttachment *attachment,
HttpSessionData *session_data,
HttpBody *bodies
);
///
/// @brief Compresses HttpBody and return allocated compressed body.
///
/// @param attachment The NanoAttachment object associated with the session.
/// @param session_data The HttpSessionData object representing the session.
/// @param bodies The bodies pointer to be decompressed.
///
HttpBody * decompressBody(
NanoAttachment *attachment,
HttpSessionData *session_data,
HttpBody *bodies
);
///
/// @brief Free allocated compressed body.
///
/// This function frees the allocated resources of HttpBody object.
///
/// @param attachment The NanoAttachment object associated with the session.
/// @param session_data The HttpSessionData object representing the session.
/// @param bodies The bodies pointer to be freed.
///
void
freeCompressedBody(
NanoAttachment *attachment,
HttpSessionData *session_data,
HttpBody *bodies
);
#endif // __NANO_ATTACHMENT_H__

489
core/include/attachments/nano_attachment_common.h Normal file
View File

@ -0,0 +1,489 @@
#ifndef __NANO_ATTACHMENT_COMMON_H__
#define __NANO_ATTACHMENT_COMMON_H__
#include <stddef.h>
#include <stdint.h>
#include <stdbool.h>
#include <sys/types.h>
#include <assert.h>
#include "compression_utils.h"
typedef uint32_t SessionID;
typedef void* DataBuffer;
#define MAX_NGINX_UID_LEN 32
#define MAX_SHARED_MEM_PATH_LEN 128
#define NUM_OF_NGINX_IPC_ELEMENTS 200
#define DEFAULT_KEEP_ALIVE_INTERVAL_MSEC 300000u
#define SHARED_MEM_PATH "/dev/shm/"
#define SHARED_REGISTRATION_SIGNAL_PATH SHARED_MEM_PATH "check-point/cp-nano-attachment-registration"
#define SHARED_KEEP_ALIVE_PATH SHARED_MEM_PATH "check-point/cp-nano-attachment-registration-expiration-socket"
#define SHARED_VERDICT_SIGNAL_PATH SHARED_MEM_PATH "check-point/cp-nano-http-transaction-handler"
#define SHARED_ATTACHMENT_CONF_PATH SHARED_MEM_PATH "cp_nano_http_attachment_conf"
#define DEFAULT_STATIC_RESOURCES_PATH SHARED_MEM_PATH "static_resources"
#define INJECT_POS_IRRELEVANT -1
#define CORRUPTED_SESSION_ID 0
#define METRIC_PERIODIC_TIMEOUT 600
#define MAX_CONTAINER_ID_LEN 12
#define CONTAINER_ID_FILE_PATH "/proc/self/cgroup"
#define RESPONSE_PAGE_PARTS 4
#define UUID_SIZE 64
#define CUSTOM_RESPONSE_TITLE_SIZE 64
#define CUSTOM_RESPONSE_BODY_SIZE 128
#define REDIRECT_RESPONSE_LOCATION_SIZE 512
#ifdef __cplusplus
typedef enum class NanoWebResponseType
#else
typedef enum NanoWebResponseType
#endif
{
CUSTOM_WEB_RESPONSE,
REDIRECT_WEB_RESPONSE,
NO_WEB_RESPONSE
} NanoWebResponseType;
#ifdef __cplusplus
typedef enum class NanoHttpInspectionMode
#else
typedef enum NanoHttpInspectionMode
#endif
{
NON_BLOCKING_THREAD,
BLOCKING_THREAD,
NO_THREAD,
INSPECTION_MODE_COUNT
} NanoHttpInspectionMode;
#ifdef __cplusplus
typedef enum class NanoCommunicationResult
#else
typedef enum NanoCommunicationResult
#endif
{
NANO_OK,
NANO_ERROR,
NANO_ABORT,
NANO_AGAIN,
NANO_HTTP_FORBIDDEN,
NANO_DECLINED,
NANO_TIMEOUT
} NanoCommunicationResult;
#ifdef __cplusplus
typedef enum class nano_http_cp_debug_level
#else
typedef enum nano_http_cp_debug_level
#endif
{
DBG_LEVEL_TRACE,
DBG_LEVEL_DEBUG,
DBG_LEVEL_INFO,
DBG_LEVEL_WARNING,
DBG_LEVEL_ERROR,
#ifndef __cplusplus
DBG_LEVEL_ASSERT,
#endif
DBG_LEVEL_COUNT
} nano_http_cp_debug_level_e;
#ifdef __cplusplus
typedef enum class AttachmentMetricType
#else
typedef enum AttachmentMetricType
#endif
{
TRANSPARENTS_COUNT,
TOTAL_TRANSPARENTS_TIME,
INSPECTION_OPEN_FAILURES_COUNT,
INSPECTION_CLOSE_FAILURES_COUNT,
INSPECTION_SUCCESSES_COUNT,
INJECT_VERDICTS_COUNT,
DROP_VERDICTS_COUNT,
ACCEPT_VERDICTS_COUNT,
IRRELEVANT_VERDICTS_COUNT,
RECONF_VERDICTS_COUNT,
INSPECT_VERDICTS_COUNT,
HOLD_VERDICTS_COUNT,
AVERAGE_OVERALL_PPROCESSING_TIME_UNTIL_VERDICT,
MAX_OVERALL_PPROCESSING_TIME_UNTIL_VERDICT,
MIN_OVERALL_PPROCESSING_TIME_UNTIL_VERDICT,
AVERAGE_REQ_PPROCESSING_TIME_UNTIL_VERDICT,
MAX_REQ_PPROCESSING_TIME_UNTIL_VERDICT,
MIN_REQ_PPROCESSING_TIME_UNTIL_VERDICT,
AVERAGE_RES_PPROCESSING_TIME_UNTIL_VERDICT,
MAX_RES_PPROCESSING_TIME_UNTIL_VERDICT,
MIN_RES_PPROCESSING_TIME_UNTIL_VERDICT,
THREAD_TIMEOUT,
REG_THREAD_TIMEOUT,
REQ_METADATA_THREAD_TIMEOUT,
REQ_HEADER_THREAD_TIMEOUT,
REQ_BODY_THREAD_TIMEOUT,
REQ_END_THREAD_TIMEOUT,
AVERAGE_REQ_BODY_SIZE_UPON_TIMEOUT,
MAX_REQ_BODY_SIZE_UPON_TIMEOUT,
MIN_REQ_BODY_SIZE_UPON_TIMEOUT,
RES_HEADER_THREAD_TIMEOUT,
RES_BODY_THREAD_TIMEOUT,
RES_END_THREAD_TIMEOUT,
HOLD_THREAD_TIMEOUT,
AVERAGE_RES_BODY_SIZE_UPON_TIMEOUT,
MAX_RES_BODY_SIZE_UPON_TIMEOUT,
MIN_RES_BODY_SIZE_UPON_TIMEOUT,
THREAD_FAILURE,
REQ_PROCCESSING_TIMEOUT,
RES_PROCCESSING_TIMEOUT,
REQ_FAILED_TO_REACH_UPSTREAM,
REQ_FAILED_COMPRESSION_COUNT,
RES_FAILED_COMPRESSION_COUNT,
REQ_FAILED_DECOMPRESSION_COUNT,
RES_FAILED_DECOMPRESSION_COUNT,
REQ_SUCCESSFUL_COMPRESSION_COUNT,
RES_SUCCESSFUL_COMPRESSION_COUNT,
REQ_SUCCESSFUL_DECOMPRESSION_COUNT,
RES_SUCCESSFUL_DECOMPRESSION_COUNT,
CORRUPTED_ZIP_SKIPPED_SESSION_COUNT,
CPU_USAGE,
AVERAGE_VM_MEMORY_USAGE,
AVERAGE_RSS_MEMORY_USAGE,
MAX_VM_MEMORY_USAGE,
MAX_RSS_MEMORY_USAGE,
REQUEST_OVERALL_SIZE_COUNT,
RESPONSE_OVERALL_SIZE_COUNT,
METRIC_TYPES_COUNT
} AttachmentMetricType;
#ifdef __cplusplus
typedef enum class AttachmentDataType
#else
typedef enum AttachmentDataType
#endif
{
REQUEST_START,
REQUEST_HEADER,
REQUEST_BODY,
REQUEST_END,
RESPONSE_CODE,
RESPONSE_HEADER,
RESPONSE_BODY,
RESPONSE_END,
CONTENT_LENGTH,
METRIC_DATA_FROM_PLUGIN,
REQUEST_DELAYED_VERDICT
} AttachmentDataType;
#ifdef __cplusplus
typedef enum class HttpChunkType
#else
typedef enum HttpChunkType
#endif
{
HTTP_REQUEST_FILTER,
HTTP_REQUEST_METADATA,
HTTP_REQUEST_HEADER,
HTTP_REQUEST_BODY,
HTTP_REQUEST_END,
HTTP_RESPONSE_HEADER,
HTTP_RESPONSE_BODY,
HTTP_RESPONSE_END,
HOLD_DATA
} HttpChunkType;
#ifdef __cplusplus
typedef enum class ServiceVerdict
#else
typedef enum ServiceVerdict
#endif
{
TRAFFIC_VERDICT_INSPECT,
TRAFFIC_VERDICT_ACCEPT,
TRAFFIC_VERDICT_DROP,
TRAFFIC_VERDICT_INJECT,
TRAFFIC_VERDICT_IRRELEVANT,
TRAFFIC_VERDICT_RECONF,
TRAFFIC_VERDICT_DELAYED
} ServiceVerdict;
#ifdef __cplusplus
typedef enum class AttachmentVerdict
#else
typedef enum AttachmentVerdict
#endif
{
ATTACHMENT_VERDICT_INSPECT,
ATTACHMENT_VERDICT_ACCEPT,
ATTACHMENT_VERDICT_DROP,
ATTACHMENT_VERDICT_INJECT
} AttachmentVerdict;
#ifdef __cplusplus
typedef enum class HttpModificationType
#else
typedef enum HttpModificationType
#endif
{
APPEND,
INJECT,
REPLACE
} HttpModificationType;
typedef struct __attribute__((__packed__)) HttpInjectData {
int64_t injection_pos;
HttpModificationType mod_type;
uint16_t injection_size;
uint8_t is_header;
uint8_t orig_buff_index;
char data[0];
} HttpInjectData;
typedef struct __attribute__((__packed__)) HttpWebResponseData {
uint8_t web_response_type;
uint8_t uuid_size;
union {
struct __attribute__((__packed__)) NanoHttpCpCustomWebResponseData {
uint16_t response_code;
uint8_t title_size;
uint8_t body_size;
char data[0];
} custom_response_data;
struct __attribute__((__packed__)) NanoHttpCpRedirectData {
uint8_t unused_dummy;
uint8_t add_event_id;
uint16_t redirect_location_size;
char redirect_location[0];
} redirect_data;
} response_data;
} HttpWebResponseData;
typedef struct {
size_t len;
unsigned char *data;
} nano_str_t;
typedef struct CustomResponseData {
uint16_t response_code;
unsigned char title[CUSTOM_RESPONSE_TITLE_SIZE];
unsigned char body[CUSTOM_RESPONSE_BODY_SIZE];
} CustomResponseData;
typedef struct RedirectData {
unsigned char redirect_location[REDIRECT_RESPONSE_LOCATION_SIZE];
} RedirectData;
typedef struct WebResponseData {
NanoWebResponseType web_response_type;
unsigned char uuid[UUID_SIZE];
DataBuffer data;
} WebResponseData;
#ifdef __cplusplus
typedef enum class HttpMetaDataType
#else
typedef enum HttpMetaDataType
#endif
{
HTTP_PROTOCOL_SIZE,
HTTP_PROTOCOL_DATA,
HTTP_METHOD_SIZE,
HTTP_METHOD_DATA,
HOST_NAME_SIZE,
HOST_NAME_DATA,
LISTENING_ADDR_SIZE,
LISTENING_ADDR_DATA,
LISTENING_PORT,
URI_SIZE,
URI_DATA,
CLIENT_ADDR_SIZE,
CLIENT_ADDR_DATA,
CLIENT_PORT,
PARSED_HOST_SIZE,
PARSED_HOST_DATA,
PARSED_URI_SIZE,
PARSED_URI_DATA,
META_DATA_COUNT
} HttpMetaDataType;
#ifdef __cplusplus
typedef enum class HttpHeaderDataType
#else
typedef enum HttpHeaderDataType
#endif
{
HEADER_KEY_SIZE,
HEADER_KEY_DATA,
HEADER_VAL_SIZE,
HEADER_VAL_DATA,
HEADER_DATA_COUNT
} HttpHeaderDataType;
/// @struct NanoHttpModificationList
/// @brief A node that holds all the information regarding modifications.
typedef struct NanoHttpModificationList {
struct NanoHttpModificationList *next; ///< Next node.
HttpInjectData modification; ///< Modification data.
char *modification_buffer; ///< Modification buffer used to store extra needed data.
} NanoHttpModificationList;
/// @struct NanoHttpResponseData
/// Holds all the data for Compression in a session.
typedef struct {
/// Original compression type, can hold the following values:
/// - #GZIP
/// - #ZLIB
CompressionType compression_type;
/// Compression stream
CompressionStream *compression_stream;
/// Decompression stream
CompressionStream *decompression_stream;
} NanoHttpResponseData;
/// @struct HttpSessionData
/// @brief Holds all the session's information needed to communicate with the nano service.
/// @details Such as to save verdict and session ID between the request and the response
typedef struct HttpSessionData {
int was_request_fully_inspected; ///< Holds if the request fully inspected.
ServiceVerdict verdict; ///< Holds the session's verdict from the Nano Service.
uint32_t session_id; ///< Current session's Id.
unsigned int remaining_messages_to_reply; ///< Remaining messages left for the agent to respond to.
NanoHttpResponseData response_data; ///< Holds session's response data.
double req_proccesing_time; ///< Holds session's request processing time.
double res_proccesing_time; ///< Holds session's response processing time.
uint64_t processed_req_body_size; ///< Holds session's request body's size.
uint64_t processed_res_body_size; ///< Holds session's response body's size'.
} HttpSessionData;
typedef struct HttpMetaData {
nano_str_t http_protocol;
nano_str_t method_name;
nano_str_t host;
nano_str_t listening_ip;
uint16_t listening_port;
nano_str_t uri;
nano_str_t client_ip;
uint16_t client_port;
nano_str_t parsed_host;
nano_str_t parsed_uri;
} HttpMetaData;
typedef struct HttpHeaderData {
nano_str_t key;
nano_str_t value;
} HttpHeaderData;
typedef struct HttpHeaders {
HttpHeaderData *data;
size_t headers_count;
} HttpHeaders;
typedef struct HttpRequestFilterData {
HttpMetaData *meta_data;
HttpHeaders *req_headers;
bool contains_body;
} HttpRequestFilterData;
typedef struct ResHttpHeaders {
HttpHeaders *headers;
uint16_t response_code;
uint64_t content_length;
} ResHttpHeaders;
typedef struct HttpBody {
nano_str_t *data;
size_t bodies_count;
} HttpBody;
typedef struct AttachmentData {
SessionID session_id;
HttpChunkType chunk_type;
HttpSessionData *session_data;
DataBuffer data;
} AttachmentData;
typedef union __attribute__((__packed__)) HttpModifyData {
HttpInjectData inject_data[0];
HttpWebResponseData web_response_data[0];
} HttpModifyData;
typedef struct __attribute__((__packed__)) HttpReplyFromService {
uint16_t verdict;
SessionID session_id;
uint8_t modification_count;
HttpModifyData modify_data[0];
} HttpReplyFromService;
typedef struct AttachmentVerdictResponse {
AttachmentVerdict verdict;
SessionID session_id;
WebResponseData *web_response_data;
NanoHttpModificationList *modifications;
} AttachmentVerdictResponse;
typedef struct __attribute__((__packed__)) AttachmentRequest {
struct __attribute__((__packed__)) connection {
int sockaddr;
int local_sockaddr;
} connection;
struct __attribute__((__packed__)) http_protocol {
int len;
int data;
} http_protocol;
struct __attribute__((__packed__)) method {
int name;
int data;
} method;
struct __attribute__((__packed__)) uri {
int len;
int data;
} uri;
struct __attribute__((__packed__)) unparsed_uri {
int len;
int data;
} unparsed_uri;
} AttachmentRequest;
typedef struct BlockPageData {
uint16_t response_code;
nano_str_t title_prefix;
nano_str_t title;
nano_str_t body_prefix;
nano_str_t body;
nano_str_t uuid_prefix;
nano_str_t uuid;
nano_str_t uuid_suffix;
} BlockPageData;
typedef struct RedirectPageData {
nano_str_t redirect_location;
} RedirectPageData;
typedef struct NanoResponseModifications {
NanoHttpModificationList *modifications;
} NanoResponseModifications;
typedef struct __attribute__((__packed__)) NanoHttpMetricData {
uint16_t data_type;
#ifdef __cplusplus
uint64_t data[static_cast<int>(AttachmentMetricType::METRIC_TYPES_COUNT)];
#else
uint64_t data[METRIC_TYPES_COUNT];
#endif
} NanoHttpMetricData;
#endif // __NANO_ATTACHMENT_COMMON_H__

67
core/include/attachments/nano_attachment_util.h Normal file
View File

@ -0,0 +1,67 @@
// Copyright (C) 2022 Check Point Software Technologies Ltd. All rights reserved.
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
#ifndef __NGINX_ATTACHMENT_UTIL__
#define __NGINX_ATTACHMENT_UTIL__
#include <stdio.h>
#include "nano_attachment_common.h"
#ifdef __cplusplus
extern "C" {
#endif // __cplusplus
#define IP_STR_MAX_LEN 40
typedef const char * c_str;
int initAttachmentConfig(c_str conf_file);
NanoHttpInspectionMode getInspectionMode();
unsigned int getNumOfNginxIpcElements();
unsigned int getKeepAliveIntervalMsec();
unsigned int getDbgLevel();
int isDebugContext(c_str client, c_str server, unsigned int port, c_str method, c_str host, c_str uri);
c_str getStaticResourcesPath();
int isFailOpenMode();
unsigned int getFailOpenTimeout();
int isFailOpenHoldMode();
unsigned int getFailOpenHoldTimeout();
unsigned int getMaxSessionsPerMinute();
int isFailOpenOnSessionLimit();
unsigned int getRegistrationThreadTimeout();
unsigned int getReqProccessingTimeout();
unsigned int getReqHeaderThreadTimeout();
unsigned int getReqBodyThreadTimeout();
unsigned int getResProccessingTimeout();
unsigned int getResHeaderThreadTimeout();
unsigned int getResBodyThreadTimeout();
unsigned int getWaitingForVerdictThreadTimeout();
int isIPAddress(c_str ip_str);
int isSkipSource(c_str ip_str);
#ifdef __cplusplus
}
#endif
#endif // __NGINX_ATTACHMENT_UTIL__

79
core/include/attachments/shmem_ipc_2.h Executable file
View File

@ -0,0 +1,79 @@
// Copyright (C) 2022 Check Point Software Technologies Ltd. All rights reserved.
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
#ifndef __SHMEM_IPC_H__
#define __SHMEM_IPC_H__
#include <stdint.h>
#include <sys/types.h>
#ifdef __cplusplus
extern "C"
{
#endif // __cplusplus
typedef struct LoggingData LoggingData;
typedef struct SharedMemoryIPC SharedMemoryIPC;
extern const int corrupted_shmem_error;
LoggingData * initLoggingData(int dbg_level, int worker_id, int fd);
SharedMemoryIPC * initIpc(
const char queue_name[32],
const uint32_t user_id,
const uint32_t group_id,
int is_owner,
uint16_t num_of_queue_elem,
const LoggingData *logging_data,
void (*debug_func)(
const LoggingData *loggin_data,
uint32_t worker_id,
int is_error,
const char *func,
const char *file,
int line_num,
const char *fmt,
...
)
);
void destroyIpc(SharedMemoryIPC *ipc, int is_owner);
int sendData(SharedMemoryIPC *ipc, const uint16_t data_to_send_size, const char *data_to_send);
int
sendChunkedData(
SharedMemoryIPC *ipc,
const uint16_t *data_to_send_sizes,
const char **data_elem_to_send,
const uint8_t num_of_data_elem
);
int receiveData(SharedMemoryIPC *ipc, uint16_t *received_data_size, const char **received_data);
int popData(SharedMemoryIPC *ipc);
int isDataAvailable(SharedMemoryIPC *ipc);
void resetIpc(SharedMemoryIPC *ipc, uint16_t num_of_data_segments);
void dumpIpcMemory(SharedMemoryIPC *ipc);
int isCorruptedShmem(SharedMemoryIPC *ipc, int is_owner);
#ifdef __cplusplus
}
#endif // __cplusplus
#endif // __SHMEM_IPC_H__

6
core/shmem_ipc_2/CMakeLists.txt Executable file
View File

@ -0,0 +1,6 @@
add_library(shmem_ipc_2 SHARED shmem_ipc.c shared_ring_queue.c)
target_link_libraries(shmem_ipc_2 -lrt)
install(TARGETS shmem_ipc_2 DESTINATION lib)
install(TARGETS shmem_ipc_2 DESTINATION nginx_attachment/lib PERMISSIONS OWNER_READ OWNER_WRITE OWNER_EXECUTE GROUP_READ GROUP_EXECUTE WORLD_READ)

55
core/shmem_ipc_2/shared_ipc_debug.h Executable file
View File

@ -0,0 +1,55 @@
// Copyright (C) 2022 Check Point Software Technologies Ltd. All rights reserved.
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
#ifndef __SHARED_IPC_DEBUG_H__
#define __SHARED_IPC_DEBUG_H__
typedef struct LoggingData {
int dbg_level;
int worker_id;
int fd;
} LoggingData;
extern void (*debug_int)(
const LoggingData *loggin_data,
uint32_t worker_id,
int is_error,
const char *func,
const char *file,
int line_num,
const char *fmt,
...
);
#ifndef __FILENAME__
#define __FILENAME__ (strrchr(__FILE__, '/') ? strrchr(__FILE__, '/') + 1 : __FILE__)
#endif
enum debugLevel { TraceLevel = 0, DebugLevel = 1, WarningLevel = 3 };
#define writeDebug(logging_data, debug_level, fmt, ...) \
{ \
debug_int( \
logging_data, \
(logging_data)->worker_id, \
debug_level, \
__func__, \
__FILENAME__, \
__LINE__, \
fmt, \
##__VA_ARGS__ \
); \
}
#endif // __SHARED_IPC_DEBUG_H__

652
core/shmem_ipc_2/shared_ring_queue.c Executable file
View File

@ -0,0 +1,652 @@
// Copyright (C) 2022 Check Point Software Technologies Ltd. All rights reserved.
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
#include "shared_ring_queue.h"
#include <stdlib.h>
#include <stdio.h>
#include <string.h>
#include <sys/mman.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <unistd.h>
#include <ctype.h>
#include <errno.h>
#include "shared_ipc_debug.h"
static const uint16_t empty_buff_mgmt_magic = 0xfffe;
static const uint16_t skip_buff_mgmt_magic = 0xfffd;
static const uint32_t max_write_size = 0xfffc;
const uint16_t max_num_of_data_segments = sizeof(DataSegment)/sizeof(uint16_t);
// LCOV_EXCL_START Reason: Handing it to Envoy prototype development
static int
getNumOfDataSegmentsNeeded(LoggingData *logging_data, uint16_t data_size)
{
int res = (data_size + SHARED_MEMORY_SEGMENT_ENTRY_SIZE - 1) / SHARED_MEMORY_SEGMENT_ENTRY_SIZE;
writeDebug(
logging_data,
TraceLevel,
"Checking amount of segments needed. Res: %d, data size: %u, shmem entry size: %u",
res,
data_size,
SHARED_MEMORY_SEGMENT_ENTRY_SIZE
);
return res;
}
static int
isThereEnoughMemoryInQueue(
LoggingData *logging_data,
SharedRingGlobalData *global_data,
uint16_t write_pos,
uint16_t read_pos,
uint8_t num_of_elem_to_push
)
{
int res;
writeDebug(
logging_data,
TraceLevel, "Checking if memory has space for new elements. "
"Num of elements to push: %u, write index: %u, read index: %u, amount of queue segments: %u",
num_of_elem_to_push,
write_pos,
read_pos,
global_data->g_num_of_data_segments
);
if (num_of_elem_to_push >= global_data->g_num_of_data_segments) {
writeDebug(
logging_data,
TraceLevel,
"Amount of elements to push is larger then amount of available elements in the queue"
);
return 0;
}
// add skipped elements during write that does not fit from cur write position till end of queue
if (write_pos + num_of_elem_to_push > global_data->g_num_of_data_segments) {
num_of_elem_to_push += global_data->g_num_of_data_segments - write_pos;
}
// removing the aspect of circularity in queue and simulating as if the queue continued at its end
if (write_pos + num_of_elem_to_push >= global_data->g_num_of_data_segments) {
read_pos += global_data->g_num_of_data_segments;
}
res = write_pos + num_of_elem_to_push < read_pos || write_pos >= read_pos;
writeDebug(logging_data, TraceLevel, "Finished checking if there is enough place in shared memory. Res: %d", res);
return res;
}
static int
isGetPossitionSucceccful(
SharedRingQueue *queue,
SharedRingGlobalData *global_data,
uint16_t *read_pos,
uint16_t *write_pos
)
{
if (global_data->g_num_of_data_segments == 0) return 0;
*read_pos = queue->read_pos;
*write_pos = queue->write_pos;
if (queue->num_of_data_segments != global_data->g_num_of_data_segments) return 0;
if (queue->size_of_memory != global_data->g_memory_size) return 0;
if (*read_pos > global_data->g_num_of_data_segments) return 0;
if (*write_pos > global_data->g_num_of_data_segments) return 0;
return 1;
}
void
resetRingQueue(LoggingData *logging_data, SharedRingQueue *queue, uint16_t num_of_data_segments)
{
(void)logging_data;
uint16_t *buffer_mgmt;
unsigned int idx;
queue->read_pos = 0;
queue->write_pos = 0;
queue->num_of_data_segments = num_of_data_segments;
buffer_mgmt = (uint16_t *)queue->mgmt_segment.data;
for (idx = 0; idx < queue->num_of_data_segments; idx++) {
buffer_mgmt[idx] = empty_buff_mgmt_magic;
}
}
SharedRingGlobalData *
createSharedRingGlobalData(LoggingData *logging_data)
{
SharedRingGlobalData *global_data = (SharedRingGlobalData *)malloc(sizeof(SharedRingGlobalData));
if (global_data == NULL) {
writeDebug(logging_data, WarningLevel, "Failed to allocate memory for global data\n");
return NULL;
}
global_data->g_rx_fd = -1;
global_data->g_tx_fd = -1;
global_data->g_memory_size = -1;
global_data->g_rx_location_name[0] = '\0';
global_data->g_tx_location_name[0] = '\0';
global_data->g_num_of_data_segments = 0;
return global_data;
}
SharedRingQueue *
createSharedRingQueue(
LoggingData *logging_data,
const char *shared_location_name,
uint16_t num_of_data_segments,
int is_owner,
int is_tx,
SharedRingGlobalData *global_data
)
{
SharedRingQueue *queue = NULL;
uint16_t *buffer_mgmt;
uint16_t shmem_fd_flags = is_owner ? O_RDWR | O_CREAT : O_RDWR;
int32_t fd = -1;
uint32_t size_of_memory;
unsigned int idx;
writeDebug(logging_data, TraceLevel, "Creating a new shared ring queue");
if (num_of_data_segments > max_num_of_data_segments) {
writeDebug(
logging_data,
WarningLevel,
"createSharedRingQueue: Cannot create data segment with %d elements (max number of elements is %u)\n",
num_of_data_segments,
max_num_of_data_segments
);
return NULL;
}
global_data->g_num_of_data_segments = num_of_data_segments;
fd = shm_open(shared_location_name, shmem_fd_flags, S_IRWXU | S_IRWXG | S_IRWXO);
if (fd == -1) {
writeDebug(
logging_data,
WarningLevel,
"createSharedRingQueue: Failed to open shared memory for '%s'. Errno: %d\n",
shared_location_name,
errno
);
return NULL;
}
size_of_memory = sizeof(SharedRingQueue) + (num_of_data_segments * sizeof(DataSegment));
if (is_owner && ftruncate(fd, size_of_memory + 1) != 0) {
writeDebug(
logging_data,
WarningLevel,
"createSharedRingQueue: Failed to ftruncate shared memory '%s' to size '%x'\n",
shared_location_name,
size_of_memory
);
close(fd);
return NULL;
}
queue = (SharedRingQueue *)mmap(0, size_of_memory, PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0);
if (queue == NULL) {
writeDebug(
logging_data,
WarningLevel,
"createSharedRingQueue: Error allocating queue for '%s' of size=%x\n",
shared_location_name,
size_of_memory
);
close(fd);
return NULL;
}
if (is_owner) {
snprintf(queue->shared_location_name, MAX_ONE_WAY_QUEUE_NAME_LENGTH, "%s", shared_location_name);
queue->num_of_data_segments = num_of_data_segments;
queue->read_pos = 0;
queue->write_pos = 0;
queue->size_of_memory = size_of_memory;
buffer_mgmt = (uint16_t *)queue->mgmt_segment.data;
for (idx = 0; idx < queue->num_of_data_segments; idx++) {
buffer_mgmt[idx] = empty_buff_mgmt_magic;
}
queue->owner_fd = fd;
} else {
queue->user_fd = fd;
}
global_data->g_memory_size = size_of_memory;
if (is_tx) {
global_data->g_tx_fd = fd;
snprintf(global_data->g_tx_location_name, MAX_ONE_WAY_QUEUE_NAME_LENGTH, "%s", shared_location_name);
} else {
global_data->g_rx_fd = fd;
snprintf(global_data->g_rx_location_name, MAX_ONE_WAY_QUEUE_NAME_LENGTH, "%s", shared_location_name);
}
writeDebug(
logging_data,
TraceLevel,
"Successfully created a new shared ring queue. "
"Shared memory path: %s, number of segments: %u, is owner: %d, "
"fd flags: %u, fd: %d, memory size: %u, read index: %u, write index: %u",
shared_location_name,
queue->num_of_data_segments,
is_owner,
shmem_fd_flags,
fd,
queue->size_of_memory,
queue->read_pos,
queue->write_pos
);
return queue;
}
void
destroySharedRingQueue(
LoggingData *logging_data,
SharedRingQueue *queue,
SharedRingGlobalData *global_data,
int is_owner,
int is_tx
)
{
uint32_t size_of_memory = global_data->g_memory_size;
int32_t fd = 0;
if(is_owner) {
queue->owner_fd = 0;
} else {
queue->user_fd = 0;
}
if (is_tx) {
fd = global_data->g_tx_fd;
global_data->g_tx_fd = -1;
} else {
fd = global_data->g_rx_fd;
global_data->g_rx_fd = -1;
}
if (munmap(queue, size_of_memory) != 0) {
writeDebug(logging_data, WarningLevel, "destroySharedRingQueue: Failed to unmap shared ring queue\n");
}
if (fd > 0) close(fd);
fd = 0;
// shm_open cleanup
if(is_owner) {
shm_unlink(is_tx ? global_data->g_tx_location_name : global_data->g_rx_location_name);
}
writeDebug(logging_data, TraceLevel, "Successfully destroyed shared ring queue. Is owner: %d", is_owner);
}
void
dumpRingQueueShmem(LoggingData *logging_data, SharedRingQueue *queue)
{
uint16_t segment_idx;
uint16_t data_idx;
uint16_t *buffer_mgmt = NULL;
char data_byte;
writeDebug(
logging_data,
WarningLevel,
"owner_fd: %d, user_fd: %d, size_of_memory: %d, write_pos: %d, read_pos: %d, num_of_data_segments: %d\n",
queue->owner_fd,
queue->user_fd,
queue->size_of_memory,
queue->write_pos,
queue->read_pos,
queue->num_of_data_segments
);
writeDebug(logging_data, WarningLevel, "mgmt_segment:");
buffer_mgmt = (uint16_t *)queue->mgmt_segment.data;
for (segment_idx = 0; segment_idx < queue->num_of_data_segments; segment_idx++) {
writeDebug(logging_data, WarningLevel, "%s%u", (segment_idx == 0 ? " " : ", "), buffer_mgmt[segment_idx]);
}
writeDebug(logging_data, WarningLevel, "\ndata_segment: ");
for (segment_idx = 0; segment_idx < queue->num_of_data_segments; segment_idx++) {
writeDebug(
logging_data,
WarningLevel,
"\nMgmt index: %u, value: %u,\nactual data: ",
segment_idx,
buffer_mgmt[segment_idx]
);
for (data_idx = 0; data_idx < SHARED_MEMORY_SEGMENT_ENTRY_SIZE; data_idx++) {
data_byte = queue->data_segment[segment_idx].data[data_idx];
writeDebug(logging_data, WarningLevel, isprint(data_byte) ? "%c" : "%02X", data_byte);
}
}
writeDebug(logging_data, WarningLevel, "\nEnd of memory\n");
}
int
peekToQueue(
LoggingData *logging_data,
SharedRingQueue *queue,
SharedRingGlobalData *global_data,
const char **output_buffer,
uint16_t *output_buffer_size
)
{
uint16_t read_pos;
uint16_t write_pos;
uint16_t *buffer_mgmt = (uint16_t *)queue->mgmt_segment.data;
if (!isGetPossitionSucceccful(queue, global_data, &read_pos, &write_pos)) {
writeDebug(logging_data, WarningLevel, "Corrupted shared memory - cannot peek");
return -1;
}
writeDebug(
logging_data,
TraceLevel,
"Reading data from queue. Read index: %u, number of queue elements: %u",
read_pos,
global_data->g_num_of_data_segments
);
if (read_pos == write_pos) {
writeDebug(logging_data, WarningLevel, "peekToQueue: Failed to read from an empty queue\n");
return -1;
}
if (read_pos >= global_data->g_num_of_data_segments) {
writeDebug(
logging_data,
WarningLevel,
"peekToQueue: Failed to read from a corrupted queue! (read_pos= %d > num_of_data_segments=%d)\n",
read_pos,
global_data->g_num_of_data_segments
);
return CORRUPTED_SHMEM_ERROR;
}
if (buffer_mgmt[read_pos] == skip_buff_mgmt_magic) {
for ( ; read_pos < global_data->g_num_of_data_segments &&
buffer_mgmt[read_pos] == skip_buff_mgmt_magic;
++read_pos) {
buffer_mgmt[read_pos] = empty_buff_mgmt_magic;
}
}
if (read_pos == global_data->g_num_of_data_segments) read_pos = 0;
*output_buffer_size = buffer_mgmt[read_pos];
*output_buffer = queue->data_segment[read_pos].data;
queue->read_pos = read_pos;
writeDebug(
logging_data,
TraceLevel,
"Successfully read data from queue. Data size: %u, new Read index: %u",
*output_buffer_size,
queue->read_pos
);
return 0;
}
int
pushBuffersToQueue(
LoggingData *logging_data,
SharedRingQueue *queue,
SharedRingGlobalData *global_data,
const char **input_buffers,
const uint16_t *input_buffers_sizes,
const uint8_t num_of_input_buffers
)
{
int idx;
uint32_t large_total_elem_size = 0;
uint16_t read_pos;
uint16_t write_pos;
uint16_t total_elem_size;
uint16_t *buffer_mgmt = (uint16_t *)queue->mgmt_segment.data;
uint16_t end_pos;
uint16_t num_of_segments_to_write;
char *current_copy_pos;
if (!isGetPossitionSucceccful(queue, global_data, &read_pos, &write_pos)) {
writeDebug(logging_data, WarningLevel, "Corrupted shared memory - cannot push new buffers");
return -1;
}
writeDebug(
logging_data,
TraceLevel,
"Writing new data to queue. write index: %u, number of queue elements: %u, number of elements to push: %u",
write_pos,
global_data->g_num_of_data_segments,
num_of_input_buffers
);
for (idx = 0; idx < num_of_input_buffers; idx++) {
large_total_elem_size += input_buffers_sizes[idx];
if (large_total_elem_size > max_write_size) {
writeDebug(
logging_data,
WarningLevel,
"Requested write size %u exceeds the %u write limit",
large_total_elem_size,
max_write_size
);
return -2;
}
}
total_elem_size = (uint16_t)large_total_elem_size;
num_of_segments_to_write = getNumOfDataSegmentsNeeded(logging_data, total_elem_size);
writeDebug(
logging_data,
TraceLevel,
"Checking if there is enough space to push new data. Total new data size: %u, number of segments needed: %u",
total_elem_size,
num_of_segments_to_write
);
if (!isThereEnoughMemoryInQueue(logging_data, global_data, write_pos, read_pos, num_of_segments_to_write)) {
writeDebug(logging_data, DebugLevel, "Cannot write to a full queue");
return -3;
}
if (write_pos >= global_data->g_num_of_data_segments) {
writeDebug(
logging_data,
DebugLevel,
"Cannot write to a location outside the queue. Write index: %u, number of queue elements: %u",
write_pos,
global_data->g_num_of_data_segments
);
return -4;
}
if (write_pos + num_of_segments_to_write > global_data->g_num_of_data_segments) {
for ( ; write_pos < global_data->g_num_of_data_segments; ++write_pos) {
buffer_mgmt[write_pos] = skip_buff_mgmt_magic;
}
write_pos = 0;
}
writeDebug(
logging_data,
TraceLevel,
"Setting new management data. Write index: %u, total elements in index: %u",
write_pos,
total_elem_size
);
buffer_mgmt[write_pos] = total_elem_size;
current_copy_pos = queue->data_segment[write_pos].data;
for (idx = 0; idx < num_of_input_buffers; idx++) {
writeDebug(
logging_data,
TraceLevel,
"Writing data to queue. Data index: %u, data size: %u, copy destination: %p",
idx,
input_buffers_sizes[idx],
current_copy_pos
);
memcpy(current_copy_pos, input_buffers[idx], input_buffers_sizes[idx]);
current_copy_pos += input_buffers_sizes[idx];
}
write_pos++;
end_pos = write_pos + num_of_segments_to_write - 1;
for ( ; write_pos < end_pos; ++write_pos) {
buffer_mgmt[write_pos] = skip_buff_mgmt_magic;
}
if (write_pos >= global_data->g_num_of_data_segments) write_pos = 0;
queue->write_pos = write_pos;
writeDebug(logging_data, TraceLevel, "Successfully pushed data to queue. New write index: %u", write_pos);
return 0;
}
int
pushToQueue(
LoggingData *logging_data,
SharedRingQueue *queue,
SharedRingGlobalData *global_data,
const char *input_buffer,
const uint16_t input_buffer_size
)
{
return pushBuffersToQueue(logging_data, queue, global_data, &input_buffer, &input_buffer_size, 1);
}
int
popFromQueue(LoggingData *logging_data, SharedRingQueue *queue, SharedRingGlobalData *global_data)
{
uint16_t num_of_read_segments;
uint16_t read_pos;
uint16_t write_pos;
uint16_t end_pos;
uint16_t *buffer_mgmt = (uint16_t *)queue->mgmt_segment.data;
if (!isGetPossitionSucceccful(queue, global_data, &read_pos, &write_pos)) {
writeDebug(logging_data, WarningLevel, "Corrupted shared memory - cannot pop data");
return -1;
}
writeDebug(
logging_data,
TraceLevel,
"Removing data from queue. new data to queue. Read index: %u, number of queue elements: %u",
read_pos,
global_data->g_num_of_data_segments
);
if (read_pos == write_pos) {
writeDebug(logging_data, TraceLevel, "Cannot pop data from empty queue");
return -1;
}
num_of_read_segments = getNumOfDataSegmentsNeeded(logging_data, buffer_mgmt[read_pos]);
if (read_pos + num_of_read_segments > global_data->g_num_of_data_segments) {
for ( ; read_pos < global_data->g_num_of_data_segments; ++read_pos ) {
buffer_mgmt[read_pos] = empty_buff_mgmt_magic;
}
read_pos = 0;
}
end_pos = read_pos + num_of_read_segments;
for ( ; read_pos < end_pos; ++read_pos ) {
buffer_mgmt[read_pos] = empty_buff_mgmt_magic;
}
if (read_pos < global_data->g_num_of_data_segments && buffer_mgmt[read_pos] == skip_buff_mgmt_magic) {
for ( ; read_pos < global_data->g_num_of_data_segments; ++read_pos ) {
buffer_mgmt[read_pos] = empty_buff_mgmt_magic;
}
}
writeDebug(
logging_data,
TraceLevel,
"Size of data to remove: %u, number of queue elements to free: %u, current read index: %u, end index: %u",
buffer_mgmt[read_pos],
num_of_read_segments,
read_pos,
end_pos
);
if (read_pos == global_data->g_num_of_data_segments) read_pos = 0;
queue->read_pos = read_pos;
writeDebug(logging_data, TraceLevel, "Successfully popped data from queue. New read index: %u", read_pos);
return 0;
}
int
isQueueEmpty(SharedRingQueue *queue)
{
return queue->read_pos == queue->write_pos;
}
int
isCorruptedQueue(LoggingData *logging_data, SharedRingQueue *queue, SharedRingGlobalData *global_data, int is_tx)
{
writeDebug(
logging_data,
TraceLevel,
"Checking if shared ring queue is corrupted. "
"g_num_of_data_segments = %u, queue->num_of_data_segments = %u, queue->read_pos = %u, queue->write_pos = %u, "
"g_memory_size = %d, queue->size_of_memory = %d, "
"queue->shared_location_name = %s, g_tx_location_name = %s, g_rx_location_name = %s, is_tx = %d",
global_data->g_num_of_data_segments,
queue->num_of_data_segments,
queue->read_pos,
queue->write_pos,
global_data->g_memory_size,
queue->size_of_memory,
queue->shared_location_name,
global_data->g_tx_location_name,
global_data->g_rx_location_name,
is_tx
);
if (global_data->g_num_of_data_segments == 0) return 0;
if (queue->num_of_data_segments != global_data->g_num_of_data_segments) return 1;
if (queue->size_of_memory != global_data->g_memory_size) return 1;
if (queue->read_pos > global_data->g_num_of_data_segments) return 1;
if (queue->write_pos > global_data->g_num_of_data_segments) return 1;
if (strcmp(
queue->shared_location_name,
is_tx ? global_data->g_tx_location_name : global_data->g_rx_location_name
) != 0
) return 1;
return 0;
}
// LCOV_EXCL_STOP

114
core/shmem_ipc_2/shared_ring_queue.h Executable file
View File

@ -0,0 +1,114 @@
// Copyright (C) 2022 Check Point Software Technologies Ltd. All rights reserved.
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
#ifndef __SHARED_RING_QUEUE_H__
#define __SHARED_RING_QUEUE_H__
#include <stdint.h>
#include <stdio.h>
#ifdef __cplusplus
extern "C"
{
#endif // __cplusplus
#define SHARED_MEMORY_SEGMENT_ENTRY_SIZE 1024
#define MAX_ONE_WAY_QUEUE_NAME_LENGTH 64
#define CORRUPTED_SHMEM_ERROR -2
typedef struct LoggingData LoggingData;
typedef struct SharedRingGlobalData {
char g_rx_location_name[MAX_ONE_WAY_QUEUE_NAME_LENGTH];
char g_tx_location_name[MAX_ONE_WAY_QUEUE_NAME_LENGTH];
int32_t g_rx_fd;
int32_t g_tx_fd;
int32_t g_memory_size;
uint16_t g_num_of_data_segments;
} SharedRingGlobalData;
typedef struct DataSegment {
char data[SHARED_MEMORY_SEGMENT_ENTRY_SIZE];
} DataSegment;
typedef struct __attribute__((__packed__)) SharedRingQueue {
char shared_location_name[MAX_ONE_WAY_QUEUE_NAME_LENGTH];
int32_t owner_fd;
int32_t user_fd;
int32_t size_of_memory;
uint16_t write_pos;
uint16_t read_pos;
uint16_t num_of_data_segments;
DataSegment mgmt_segment;
DataSegment data_segment[0];
} SharedRingQueue;
SharedRingQueue *
createSharedRingQueue(
LoggingData *logging_data,
const char *shared_location_name,
uint16_t num_of_data_segments,
int is_owner,
int is_tx,
SharedRingGlobalData *global_data
);
SharedRingGlobalData * createSharedRingGlobalData(LoggingData *logging_data);
void destroySharedRingQueue(
LoggingData *logging_data,
SharedRingQueue *queue,
SharedRingGlobalData *global_data,
int is_owner,
int is_tx
);
int isQueueEmpty(SharedRingQueue *queue);
int isCorruptedQueue(LoggingData *logging_data, SharedRingQueue *queue, SharedRingGlobalData *global_data, int is_tx);
int peekToQueue(
LoggingData *logging_data,
SharedRingQueue *queue,
SharedRingGlobalData *global_data,
const char **output_buffer,
uint16_t *output_buffer_size
);
int popFromQueue(LoggingData *logging_data, SharedRingQueue *queue, SharedRingGlobalData *global_data);
int pushToQueue(
LoggingData *logging_data,
SharedRingQueue *queue,
SharedRingGlobalData *global_data,
const char *input_buffer,
const uint16_t input_buffer_size
);
void resetRingQueue(LoggingData *logging_data, SharedRingQueue *queue, uint16_t num_of_data_segments);
void dumpRingQueueShmem(LoggingData *logging_data, SharedRingQueue *queue);
int
pushBuffersToQueue(
LoggingData *logging_data,
SharedRingQueue *queue,
SharedRingGlobalData *global_data,
const char **input_buffers,
const uint16_t *input_buffers_sizes,
const uint8_t num_of_input_buffers
);
#ifdef __cplusplus
}
#endif // __cplusplus
#endif // __SHARED_RING_QUEUE_H__

419
core/shmem_ipc_2/shmem_ipc.c Executable file
View File

@ -0,0 +1,419 @@
// Copyright (C) 2022 Check Point Software Technologies Ltd. All rights reserved.
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
#include "shmem_ipc_2.h"
#include <stdlib.h>
#include <sys/file.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <string.h>
#include <unistd.h>
#include <stdio.h>
#include <stdarg.h>
#include "shared_ring_queue.h"
#include "shared_ipc_debug.h"
#define UNUSED(x) (void)(x)
const int corrupted_shmem_error = CORRUPTED_SHMEM_ERROR;
static const size_t max_one_way_queue_name_length = MAX_ONE_WAY_QUEUE_NAME_LENGTH;
static const size_t max_shmem_path_length = 72;
struct SharedMemoryIPC {
char shm_name[32];
SharedRingQueue *rx_queue;
SharedRingQueue *tx_queue;
SharedRingGlobalData *global_data;
LoggingData logging_data;
};
// LCOV_EXCL_START Reason: Handing it to Envoy prototype development
void
debugInitial(
const LoggingData *loggin_data,
uint32_t worker_id,
int is_error,
const char *func,
const char *file,
int line_num,
const char *fmt,
...
)
{
UNUSED(is_error);
UNUSED(func);
UNUSED(file);
UNUSED(line_num);
UNUSED(loggin_data);
UNUSED(worker_id);
// Temporarily disabled till Shmem debugging is properly fixed.
// va_list args;
// va_start(args, fmt);
// vprintf(fmt, args);
// va_end(args);
UNUSED(fmt);
}
void (*debug_int)(
const LoggingData *loggin_data,
uint32_t worker_id,
int is_error,
const char *func,
const char *file,
int line_num,
const char *fmt,
...
) = debugInitial;
static int
isTowardsOwner(int is_owner, int is_tx)
{
if (is_owner) return !is_tx;
return is_tx;
}
static SharedRingQueue *
createOneWayIPCQueue(
LoggingData *logging_data,
const char *name,
const uint32_t user_id,
const uint32_t group_id,
int is_tx_queue,
int is_owner,
uint16_t num_of_queue_elem,
SharedRingGlobalData *global_data
)
{
SharedRingQueue *ring_queue = NULL;
char queue_name[max_one_way_queue_name_length];
char shmem_path[max_shmem_path_length];
const char *direction = isTowardsOwner(is_owner, is_tx_queue) ? "rx" : "tx";
snprintf(queue_name, sizeof(queue_name) - 1, "__cp_nano_%s_shared_memory_%s__", direction, name);
writeDebug(
logging_data,
TraceLevel,
"Creating one way IPC queue. Name: %s, direction: %s, size: %d",
name,
direction,
num_of_queue_elem
);
ring_queue = createSharedRingQueue(
logging_data,
queue_name,
num_of_queue_elem,
is_owner,
isTowardsOwner(is_owner, is_tx_queue),
global_data
);
if (ring_queue == NULL) {
writeDebug(
logging_data,
WarningLevel,
"Failed to create %s shared ring queue of size=%d for '%s'\n",
direction,
num_of_queue_elem,
queue_name
);
return NULL;
}
int ret = snprintf(shmem_path, sizeof(shmem_path) - 1, "/dev/shm/%s", queue_name);
if (ret < 0 || (size_t)ret < (strlen(direction) + strlen(name))) {
return NULL;
}
if (is_owner && chmod(shmem_path, 0666) == -1) {
writeDebug(logging_data, WarningLevel, "Failed to set the permissions");
destroySharedRingQueue(logging_data, ring_queue, global_data, is_owner, isTowardsOwner(is_owner, is_tx_queue));
return NULL;
}
writeDebug(
logging_data,
TraceLevel,
"Successfully created one way IPC queue. "
"Name: %s, user id: %u, group id: %u, is owner: %d, number of queue elements: %u, direction: %s, path: %s",
queue_name,
user_id,
group_id,
is_owner,
num_of_queue_elem,
direction,
shmem_path
);
return ring_queue;
}
LoggingData *
initLoggingData(int dbg_level, int worker_id, int fd)
{
LoggingData *logging_data = malloc(sizeof(LoggingData));
if (logging_data == NULL) {
return NULL;
}
logging_data->dbg_level = dbg_level;
logging_data->worker_id = worker_id;
logging_data->fd = fd;
return logging_data;
}
SharedMemoryIPC *
initIpc(
const char queue_name[32],
uint32_t user_id,
uint32_t group_id,
int is_owner,
uint16_t num_of_queue_elem,
const LoggingData *logging_data,
void (*debug_func)(
const LoggingData *loggin_data,
uint32_t worker_id,
int is_error,
const char *func,
const char *file,
int line_num,
const char *fmt,
...
)
)
{
UNUSED(debug_func);
SharedMemoryIPC *ipc = NULL;
// debug_int = debug_func;
debug_int = debugInitial;
writeDebug(
logging_data,
TraceLevel,
"Initializing new IPC. "
"Queue name: %s, user id: %u, group id: %u, is owner: %d, number of queue elements: %u\n",
queue_name,
user_id,
group_id,
is_owner,
num_of_queue_elem
);
ipc = malloc(sizeof(SharedMemoryIPC));
if (ipc == NULL) {
writeDebug(logging_data, WarningLevel, "Failed to allocate Shared Memory IPC for '%s'\n", queue_name);
debug_int = debugInitial;
return NULL;
}
ipc->logging_data.dbg_level = logging_data->dbg_level;
ipc->logging_data.worker_id = logging_data->worker_id;
ipc->logging_data.fd = logging_data->fd;
ipc->global_data = createSharedRingGlobalData(&(ipc->logging_data));
if (ipc->global_data == NULL) {
writeDebug(logging_data, WarningLevel, "Failed to allocate global data for '%s'\n", queue_name);
debug_int = debugInitial;
free(ipc);
return NULL;
}
ipc->rx_queue = NULL;
ipc->tx_queue = NULL;
ipc->rx_queue = createOneWayIPCQueue(
&(ipc->logging_data),
queue_name,
user_id,
group_id,
0,
is_owner,
num_of_queue_elem,
ipc->global_data
);
if (ipc->rx_queue == NULL) {
writeDebug(
&(ipc->logging_data),
WarningLevel,
"Failed to allocate rx queue. "
"Queue name: %s, user id: %u, group id: %u, is owner: %d, number of queue elements: %u",
queue_name,
user_id,
group_id,
is_owner,
num_of_queue_elem
);
destroyIpc(ipc, is_owner);
debug_int = debugInitial;
return NULL;
}
ipc->tx_queue = createOneWayIPCQueue(
&(ipc->logging_data),
queue_name,
user_id,
group_id,
1,
is_owner,
num_of_queue_elem,
ipc->global_data
);
if (ipc->tx_queue == NULL) {
writeDebug(
&(ipc->logging_data),
WarningLevel,
"Failed to allocate rx queue. "
"Queue name: %s, user id: %u, group id: %u, is owner: %d, number of queue elements: %u",
queue_name,
user_id,
group_id,
is_owner,
num_of_queue_elem
);
destroyIpc(ipc, is_owner);
debug_int = debugInitial;
return NULL;
}
writeDebug(&(ipc->logging_data), TraceLevel, "Successfully allocated IPC");
strncpy(ipc->shm_name, queue_name, sizeof(ipc->shm_name));
return ipc;
}
void
resetIpc(SharedMemoryIPC *ipc, uint16_t num_of_data_segments)
{
writeDebug(&(ipc->logging_data), TraceLevel, "Reseting IPC queues\n");
resetRingQueue(&(ipc->logging_data), ipc->rx_queue, num_of_data_segments);
resetRingQueue(&(ipc->logging_data), ipc->tx_queue, num_of_data_segments);
}
void
destroyIpc(SharedMemoryIPC *shmem, int is_owner)
{
writeDebug(&(shmem->logging_data), TraceLevel, "Destroying IPC queues\n");
if (shmem->rx_queue != NULL) {
destroySharedRingQueue(
&(shmem->logging_data),
shmem->rx_queue,
shmem->global_data,
is_owner,
isTowardsOwner(is_owner, 0)
);
shmem->rx_queue = NULL;
}
if (shmem->tx_queue != NULL) {
destroySharedRingQueue(
&(shmem->logging_data),
shmem->tx_queue,
shmem->global_data,
is_owner,
isTowardsOwner(is_owner, 1)
);
shmem->tx_queue = NULL;
}
free(shmem->global_data);
debug_int = debugInitial;
free(shmem);
}
void
dumpIpcMemory(SharedMemoryIPC *ipc)
{
writeDebug(&(ipc->logging_data), WarningLevel, "Ipc memory dump:\n");
writeDebug(&(ipc->logging_data), WarningLevel, "RX queue:\n");
dumpRingQueueShmem(&(ipc->logging_data), ipc->rx_queue);
writeDebug(&(ipc->logging_data), WarningLevel, "TX queue:\n");
dumpRingQueueShmem(&(ipc->logging_data), ipc->tx_queue);
}
int
sendData(SharedMemoryIPC *ipc, const uint16_t data_to_send_size, const char *data_to_send)
{
writeDebug(&(ipc->logging_data), TraceLevel, "Sending data of size %u\n", data_to_send_size);
return pushToQueue(&(ipc->logging_data), ipc->tx_queue, ipc->global_data, data_to_send, data_to_send_size);
}
int
sendChunkedData(
SharedMemoryIPC *ipc,
const uint16_t *data_to_send_sizes,
const char **data_elem_to_send,
const uint8_t num_of_data_elem
)
{
writeDebug(&(ipc->logging_data), TraceLevel, "Sending %u chunks of data\n", num_of_data_elem);
return pushBuffersToQueue(
&(ipc->logging_data),
ipc->tx_queue,
ipc->global_data,
data_elem_to_send,
data_to_send_sizes,
num_of_data_elem
);
}
int
receiveData(SharedMemoryIPC *ipc, uint16_t *received_data_size, const char **received_data)
{
int res = peekToQueue(&(ipc->logging_data), ipc->rx_queue, ipc->global_data, received_data, received_data_size);
writeDebug(
&(ipc->logging_data),
TraceLevel,
"Received data from queue. Res: %d, data size: %u\n",
res,
*received_data_size
);
return res;
}
int
popData(SharedMemoryIPC *ipc)
{
int res = popFromQueue(&(ipc->logging_data), ipc->rx_queue, ipc->global_data);
writeDebug(&(ipc->logging_data), TraceLevel, "Popped data from queue. Res: %d\n", res);
return res;
}
int
isDataAvailable(SharedMemoryIPC *ipc)
{
int res = !isQueueEmpty(ipc->rx_queue);
writeDebug(&(ipc->logging_data), TraceLevel, "Checking if there is data pending to be read. Res: %d\n", res);
return res;
}
int
isCorruptedShmem(SharedMemoryIPC *ipc, int is_owner)
{
if (isCorruptedQueue(&(ipc->logging_data), ipc->rx_queue, ipc->global_data, isTowardsOwner(is_owner, 0)) ||
isCorruptedQueue(&(ipc->logging_data), ipc->tx_queue, ipc->global_data, isTowardsOwner(is_owner, 1))
) {
writeDebug(
&(ipc->logging_data),
WarningLevel,
"Detected corrupted shared memory queue. Shared memory name: %s",
ipc->shm_name
);
return 1;
}
return 0;
}
// LCOV_EXCL_STOP

26
docker/openappsec-waf-webhook/Dockerfile Executable file
View File

@ -0,0 +1,26 @@
# Use Python 3.9 slim image as the base
FROM python:3.9-slim
# Install dependencies
RUN pip install kubernetes cryptography flask --progress-bar off
# Create directory for certs
RUN mkdir -p /certs
# Copy the Python scripts
COPY keygen.py /app/keygen.py
COPY webhook_server.py /app/webhook_server.py
COPY secretgen.py /app/secretgen.py
COPY run.sh /app/run.sh
# Make the script executable
RUN chmod +x /app/run.sh
# Set the working directory
WORKDIR /app
# Expose port 443
EXPOSE 443
# Run the webhook server
CMD ["/app/run.sh"]

85
docker/openappsec-waf-webhook/keygen.py Executable file
View File

@ -0,0 +1,85 @@
#!/usr/bin/python3
import base64
import os
import argparse
import subprocess
from shutil import which
from pathlib import Path
def generate_keys(service, namespace, directory="generated"):
"Generate key material and configuration for Kubernetes admission controllers"
if not which("openssl"):
raise click.UsageError("Unable to detect the openssl CLI tool on the path")
if not os.path.exists(directory):
os.makedirs(directory)
print("==> Generating CA")
command = """openssl genrsa -out ca.key 2048
openssl req -x509 -new -nodes -key ca.key -days 100000 -out ca.crt -subj '/CN=admission_ca'"""
subprocess.run(command, cwd=directory, shell=True, stderr=subprocess.DEVNULL)
print("==> Creating configuration")
with open(os.path.sep.join((directory, "server.conf")), "w") as f:
f.write(
"""[req]
default_bits = 2048
req_extensions = v3_req
distinguished_name = req_distinguished_name
req_extensions = req_ext
prompt = no
[ req_distinguished_name ]
CN = {service}.{namespace}.svc
[ v3_req ]
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
extendedKeyUsage = clientAuth, serverAuth
[ req_ext ]
subjectAltName = @alt_names
[alt_names]
DNS.1 = {service}
DNS.2 = {service}.{namespace}
DNS.3 = {service}.{namespace}.svc
""".format(service = service, namespace = namespace)
)
print("==> Generating private key and certificate")
address = "{}.{}.svc".format(service, namespace)
command = """openssl genrsa -out server.key 2048
openssl req -out server.csr -newkey rsa:2048 -nodes -keyout server.key -config server.conf
openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out server.crt -days 100000 -extensions req_ext -extfile server.conf""".format(
ADDRESS = address
)
subprocess.run(command, cwd=directory, shell=True, stderr=subprocess.DEVNULL)
print("==> Key material generated")
with open(os.path.sep.join((directory, "ca.crt")), "rb") as f:
ca_cert = f.read()
print("Use this as the caBundle:")
print(base64.b64encode(ca_cert).decode("ascii"))
print("==> Command to create secret")
print("Run this to upload the key material to a Kubernetes secret")
print()
print(
"kubectl --namespace={0} create secret tls {1}-certs --cert={2}/server.crt --key={2}/server.key".format(
namespace, service, directory
)
)
if __name__ == "__main__":
parser = argparse.ArgumentParser(description = 'Check Point Webhooks K8s Webhook Keygen')
parser.add_argument("namespace", help = "Destination namespace")
args = parser.parse_args()
generate_keys("envoy-injector", args.namespace)

10
docker/openappsec-waf-webhook/run.sh Executable file
View File

@ -0,0 +1,10 @@
#!/bin/bash
# Start certificate manager in the background
# Start the webhook server
while [ true ]; do
echo "Starting Webhook Server"
python3 webhook_server.py
echo "Webhook Server crashed, restarting..."
sleep 5 # Pause before restarting
done

65
docker/openappsec-waf-webhook/secretgen.py Executable file
View File

@ -0,0 +1,65 @@
#!/usr/bin/python
import os
import base64
import kubernetes.client
from kubernetes.client.rest import ApiException
from kubernetes import client, config
from pprint import pprint
# Key generation script
import keygen
SERVICE_PATH = "/var/run/secrets/kubernetes.io/serviceaccount/"
API_SERVER = "https://kubernetes.default.svc"
GENERATED_CERTS_FOLDER = "/certs/"
config.load_incluster_config()
def getToken():
with open(os.path.sep.join((SERVICE_PATH, "token")), "r") as f:
return f.read()
def main():
# First, generate keys
keygen.generate_keys("openappsec-waf-webhook-svc", os.environ["K8S_NAMESPACE"], GENERATED_CERTS_FOLDER)
found = None
api_instance = client.AdmissionregistrationV1Api()
try:
api_response = api_instance.list_mutating_webhook_configuration()
for result in api_response.items:
print(result.metadata.name)
if "openappsec-waf.injector" in result.metadata.name:
pprint(result)
found = result
break
if found is None:
raise Exception("Could not find webhook")
# Change the CA file
with open(os.path.sep.join((GENERATED_CERTS_FOLDER, "ca.crt")), "rb") as f:
cert = base64.b64encode(f.read()).decode("utf-8")
print("CA Cert:", cert)
# Update cert
for webhook in found.webhooks:
if "openappsec-waf.injector" in webhook.name:
webhook.client_config.ca_bundle = cert;
# Patch
response = api_instance.patch_mutating_webhook_configuration(found.metadata.name, found, pretty = "true")
pprint(response)
except ApiException as e:
print("Exception when calling AdmissionregistrationApi->get_api_group: %s\n" % e)
if __name__ == "__main__":
main()

653
docker/openappsec-waf-webhook/webhook_server.py Executable file
View File

@ -0,0 +1,653 @@
import os
import json
import logging
import base64
import secretgen
import sys
from kubernetes import client, config
from flask import Flask, request, jsonify, Response
app = Flask(__name__)
# Read agent image and tag from environment variables
AGENT_IMAGE = os.getenv('AGENT_IMAGE', 'ghcr.io/openappsec/agent')
AGENT_TAG = os.getenv('AGENT_TAG', 'latest')
FULL_AGENT_IMAGE = f"{AGENT_IMAGE}:{AGENT_TAG}"
config.load_incluster_config()
def configure_logging():
# Read the DEBUG_LEVEL from environment variables, defaulting to WARNING
DEBUG_LEVEL = os.getenv('DEBUG_LEVEL', 'WARNING').upper()
# Map the string value of DEBUG_LEVEL to actual logging level
logging_levels = {
'DEBUG': logging.DEBUG,
'INFO': logging.INFO,
'WARNING': logging.WARNING,
'ERROR': logging.ERROR,
'CRITICAL': logging.CRITICAL
}
# Set the logging level based on the environment variable
log_level = logging_levels.get(DEBUG_LEVEL, logging.INFO)
# Configure Flask's logger to handle the specified logging level
handler = logging.StreamHandler()
handler.setLevel(log_level)
formatter = logging.Formatter('%(asctime)s - %(levelname)s - %(message)s')
handler.setFormatter(formatter)
# Remove any existing handlers
if app.logger.hasHandlers():
app.logger.handlers.clear()
app.logger.addHandler(handler)
app.logger.setLevel(log_level)
# The sidecar container spec with configurable image
def get_sidecar_container():
app.logger.debug("Entering get_sidecar_container()")
token = os.getenv("TOKEN")
sidecar = {
"name": "infinity-next-nano-agent",
"image": FULL_AGENT_IMAGE,
"imagePullPolicy": "Always",
"command": ["/cp-nano-agent"],
"args": [
"--token",
token
],
"env": [
{"name": "registered_server", "value": "NGINX Server"}
],
"volumeMounts": [
{"name": "envoy-attachment-shared", "mountPath": "/envoy/attachment/shared/"}
],
"resources": {
"requests": {
"cpu": "200m"
}
},
"securityContext": {
"runAsNonRoot": False,
"runAsUser": 0
},
"terminationMessagePath": "/dev/termination-log",
"terminationMessagePolicy": "File"
}
app.logger.debug(f"Sidecar container spec: {sidecar}")
app.logger.debug("Exiting get_sidecar_container()")
return sidecar
def get_init_container():
# Define the initContainer you want to inject
init_container = {
"name": "prepare-attachment",
"image": FULL_AGENT_IMAGE,
"imagePullPolicy": "Always",
"command": [
"sh", "-c",
"mkdir -p /envoy/attachment/shared && cp -r /envoy/attachment/lib* /envoy/attachment/shared"
],
"volumeMounts": [
{
"mountPath": "/envoy/attachment/shared",
"name": "envoy-attachment-shared"
}
]
}
app.logger.debug(f"Init container spec: {init_container}")
app.logger.debug("Exiting get_init_container()")
return init_container
# The volume mount configuration for both the original and sidecar containers
def get_volume_mount():
app.logger.debug("Entering get_volume_mount()")
volume_mount = {
"name": "envoy-attachment-shared",
"mountPath": "/usr/lib/attachment/"
}
app.logger.debug(f"Volume mount spec: {volume_mount}")
app.logger.debug("Exiting get_volume_mount()")
return volume_mount
# Volume definition for the pod
def get_volume_definition():
app.logger.debug("Entering get_volume_definition()")
volume_def = {
"name": "envoy-attachment-shared",
"emptyDir": {}
}
app.logger.debug(f"Volume definition: {volume_def}")
app.logger.debug("Exiting get_volume_definition()")
return volume_def
def add_env_if_not_exist(containers, container_name, patches):
# Find the container by name
container = next((c for c in containers if c.get('name') == container_name), None)
if container:
# Get the existing environment variables (if any)
env_vars = container.get('env', None)
if env_vars is None:
# If no env variables exist, add an empty env array first
patches.append({
"op": "add",
"path": f"/spec/containers/{containers.index(container)}/env",
"value": []
})
def add_env_variable_value_from(containers, container_name, env_var_name, env_value, patches, value_from):
"""Adds or updates a specified environment variable in a given container."""
container_index = next((i for i, container in enumerate(containers) if container['name'] == container_name), None)
if container_index is not None:
env_vars = containers[container_index].get('env', [])
existing_env_var = next((env for env in env_vars if env['name'] == env_var_name), None)
if existing_env_var:
env_var_patch = {
"op": "replace",
"path": f"/spec/containers/{container_index}/env/{env_vars.index(existing_env_var)}",
"value": {"name": env_var_name, "valueFrom": value_from}
}
patches.append(env_var_patch)
app.logger.debug(f"Updated {env_var_name} environment variable in {container_name} container to use valueFrom.")
else:
env_var_patch = {
"op": "add",
"path": f"/spec/containers/{container_index}/env/-",
"value": {"name": env_var_name, "valueFrom": value_from}
}
patches.append(env_var_patch)
app.logger.debug(f"Added {env_var_name} environment variable with valueFrom to {container_name} container.")
else:
app.logger.warning(f"{container_name} container not found; no environment variable modification applied.")
def add_env_variable(containers, container_name, env_var_name, env_value, patches):
"""Adds or updates a specified environment variable in a given container."""
# Find the specified container by name
container_index = next((i for i, container in enumerate(containers) if container['name'] == container_name), None)
if container_index is not None:
# Get the list of environment variables for the specified container
env_vars = containers[container_index].get('env', [])
# Find the specified environment variable if it exists
existing_env_var = next((env for env in env_vars if env['name'] == env_var_name), None)
# If the environment variable exists, handle it based on its name
if existing_env_var:
current_value = existing_env_var['value']
if env_var_name == 'LD_LIBRARY_PATH':
# For LD_LIBRARY_PATH, append env_value if not already present
if env_value not in current_value:
new_value = f"{current_value}:{env_value}"
env_var_patch = {
"op": "replace",
"path": f"/spec/containers/{container_index}/env/{env_vars.index(existing_env_var)}/value",
"value": new_value
}
patches.append(env_var_patch)
app.logger.debug(f"Updated {env_var_name} environment variable in {container_name} container to new value.")
else:
app.logger.debug(f"{env_var_name} already exists with the correct value; no changes made.")
else:
# For other environment variables, replace the value directly
env_var_patch = {
"op": "replace",
"path": f"/spec/containers/{container_index}/env/{env_vars.index(existing_env_var)}/value",
"value": env_value
}
patches.append(env_var_patch)
app.logger.debug(f"Replaced {env_var_name} environment variable in {container_name} container with new value.")
else:
# Add the environment variable if it does not exist
env_var_patch = {
"op": "add",
"path": f"/spec/containers/{container_index}/env/-",
"value": {
"name": env_var_name,
"value": env_value
}
}
patches.append(env_var_patch)
app.logger.debug(f"Added {env_var_name} environment variable to {container_name} container.")
else:
app.logger.warning(f"{container_name} container not found; no environment variable modification applied.")
def remove_env_variable(containers, container_name, env_var_name, patches):
"""Removes a specified environment variable from a given container if it exists."""
# Find the specified container by name
container_index = next((i for i, container in enumerate(containers) if container['name'] == container_name), None)
if container_index is not None:
# Get the list of environment variables for the specified container
env_vars = containers[container_index].get('env', [])
# Check if the specified environment variable exists
env_var_exists = any(env['name'] == env_var_name for env in env_vars)
# Remove the environment variable if it exists
if env_var_exists:
# Find the index of the specified environment variable in the env array
env_var_index = next(i for i, env in enumerate(env_vars) if env['name'] == env_var_name)
patches.append({
"op": "remove",
"path": f"/spec/containers/{container_index}/env/{env_var_index}"
})
app.logger.debug(f"Removed {env_var_name} environment variable from {container_name} container.")
else:
app.logger.debug(f"{env_var_name} does not exist, nothing to remove.")
else:
app.logger.warning(f"{container_name} container not found; no environment variable modification applied.")
def create_or_update_envoy_filter(name, namespace, selector_label_name, selector_label_value):
api = client.CustomObjectsApi()
# Define the EnvoyFilter specification
envoy_filter_spec = {
"apiVersion": "networking.istio.io/v1alpha3",
"kind": "EnvoyFilter",
"metadata": {
"name": name,
"namespace": namespace,
"labels": {
"owner": "waf"
}
},
"spec": {
"workloadSelector": {
"labels": {
selector_label_name: selector_label_value
}
},
"configPatches": [
{
"applyTo": "HTTP_FILTER",
"match": {
"context": "GATEWAY",
"listener": {
"filterChain": {
"filter": {
"name": "envoy.filters.network.http_connection_manager"
}
}
}
},
"patch": {
"operation": "INSERT_BEFORE",
"value": {
"name": "envoy.filters.http.golang",
"typed_config": {
"@type": "type.googleapis.com/envoy.extensions.filters.http.golang.v3alpha.Config",
"library_id": "cp_nano_filter",
"library_path": "/usr/lib/attachment/libenvoy_attachment.so",
"plugin_name": "cp_nano_filter",
"plugin_config": {
"@type": "type.googleapis.com/xds.type.v3.TypedStruct",
"type_url": "type.googleapis.com/envoy.extensions.filters.http.golang.v3alpha.PluginConfig",
"value": {
"prefix_localreply_body": "Configured local reply from go"
}
}
}
}
}
}
]
}
}
# Check if the EnvoyFilter exists
try:
existing_envoy_filter = api.get_namespaced_custom_object(
group="networking.istio.io",
version="v1alpha3",
namespace=namespace,
plural="envoyfilters",
name=name
)
# Compare workloadSelector labels
existing_labels = existing_envoy_filter.get("spec", {}).get("workloadSelector", {}).get("labels", {})
new_labels = envoy_filter_spec["spec"]["workloadSelector"]["labels"]
if existing_labels == new_labels:
app.logger.info(f"EnvoyFilter '{name}' already exists with matching selector labels.")
return
else:
# Update the existing EnvoyFilter's workloadSelector labels
existing_envoy_filter["spec"]["workloadSelector"]["labels"] = new_labels
api.replace_namespaced_custom_object(
group="networking.istio.io",
version="v1alpha3",
namespace=namespace,
plural="envoyfilters",
name=name,
body=existing_envoy_filter
)
app.logger.info(f"EnvoyFilter '{name}' updated successfully with new selector labels.")
return
except client.exceptions.ApiException as e:
if e.status == 404:
# EnvoyFilter doesn't exist, proceed with creation
api.create_namespaced_custom_object(
group="networking.istio.io",
version="v1alpha3",
namespace=namespace,
plural="envoyfilters",
body=envoy_filter_spec
)
app.logger.info(f"EnvoyFilter '{name}' created successfully.")
def remove_envoy_filter_by_selector(namespace, selector_label_name, selector_label_value):
api = client.CustomObjectsApi()
try:
# List all EnvoyFilters in the namespace
existing_envoy_filters = api.list_namespaced_custom_object(
group="networking.istio.io",
version="v1alpha3",
namespace=namespace,
plural="envoyfilters"
)
# Check if there is any EnvoyFilter with the same selector labels
for item in existing_envoy_filters.get("items", []):
workload_selector = item["spec"].get("workloadSelector", {}).get("labels", {})
if workload_selector.get(selector_label_name) == selector_label_value:
# Delete the matching EnvoyFilter
api.delete_namespaced_custom_object(
group="networking.istio.io",
version="v1alpha3",
namespace=namespace,
plural="envoyfilters",
name=item["metadata"]["name"],
body=client.V1DeleteOptions()
)
print(f"EnvoyFilter '{item['metadata']['name']}' with matching selector labels deleted successfully.")
return
print("No EnvoyFilter found with the specified selector labels.")
except client.exceptions.ApiException as e:
print(f"Failed to delete EnvoyFilter: {e}")
@app.route('/mutate', methods=['POST'])
def mutate():
app.logger.debug("Received request to mutate deployment.")
try:
request_data = request.get_json()
app.logger.debug("Admission Review Request: %s", json.dumps(request_data, indent=2))
except Exception as e:
app.logger.error("Failed to parse request JSON: %s", str(e))
return Response(status=400)
# Extract the UID and the object from the request
uid = request_data.get('request', {}).get('uid', '')
obj = request_data.get('request', {}).get('object', {})
namespace = request_data.get("request", {}).get("namespace")
app.logger.debug("Extracted UID: %s", uid)
app.logger.debug("Extracted Object: %s", json.dumps(obj, indent=2))
# Initialize patches
patches = []
# Extract deployment annotations and spec
annotations = obj.get('metadata', {}).get('annotations', {})
spec = obj.get('spec', {})
app.logger.debug("Current annotations: %s", json.dumps(annotations, indent=2))
app.logger.debug("Deployment spec: %s", json.dumps(spec, indent=2))
# Check if the 'original-configuration' annotation already exists
if 'original-configuration' not in annotations:
app.logger.debug("Original configuration annotation not found, storing original spec.")
# Store the original spec in an annotation as a JSON string
original_spec_json = json.dumps(spec)
patches.append({
"op": "add",
"path": "/metadata/annotations/original-configuration",
"value": original_spec_json
})
app.logger.debug("Added original-configuration annotation patch: %s", patches[-1])
# Extract containers and check if sidecar exists
containers = obj.get('spec', {}).get('containers', [])
init_containers = obj.get('spec', {}).get('initContainers', [])
volumes = obj.get('spec', {}).get('volumes', [])
app.logger.debug("Current containers in the pod: %s", json.dumps(containers, indent=2))
sidecar_exists = any(container['name'] == 'infinity-next-nano-agent' for container in containers)
init_container_exist = any(init_container['name'] == 'prepare-attachment' for init_container in init_containers)
volume_exist = any(volume['name'] == 'envoy-attachment-shared' for volume in volumes)
app.logger.debug("Does sidecar 'infinity-next-nano-agent' exist? %s", sidecar_exists)
# Determine if we should remove the injected data
REMOVE_WAF = os.getenv('REMOVE_INJECTED_DATA', 'false').lower() == 'true'
DEPLOY_FILTER = os.getenv('DEPLOY_ENVOY_FILTER', 'false').lower() == 'true'
ISTIO_CONTAINER_NAME = os.getenv('ISTIO_CONTAINER_NAME', 'istio-proxy')
LIBRARY_PATH_VALUE = os.getenv('LIBRARY_PATH_VALUE', '/usr/lib/attachment')
SELECTOR_LABEL_NAME = os.getenv("SELECTOR_LABEL_NAME")
SELECTOR_LABEL_VALUE = os.getenv("SELECTOR_LABEL_VALUE")
CONCURRENCY_CALC_VALUE = os.getenv('CONCURRENCY_CALC')
CONFIG_PORT_VALUE = os.getenv('CONFIG_PORT')
CONCURRENCY_NUMBER_VALUE = os.getenv('CONCURRENCY_NUMBER')
if REMOVE_WAF:
if DEPLOY_FILTER and SELECTOR_LABEL_NAME and SELECTOR_LABEL_VALUE:
remove_envoy_filter_by_selector(namespace, SELECTOR_LABEL_NAME, SELECTOR_LABEL_VALUE)
app.logger.debug("Removing injected sidecar and associated resources.")
# Remove ld library path env variable
if ISTIO_CONTAINER_NAME:
if CONCURRENCY_NUMBER_VALUE:
remove_env_variable(containers, ISTIO_CONTAINER_NAME, 'CONCURRENCY_NUMBER', patches)
if CONFIG_PORT_VALUE:
remove_env_variable(containers, ISTIO_CONTAINER_NAME, 'CONFIG_PORT', patches)
if CONCURRENCY_CALC_VALUE:
remove_env_variable(containers, ISTIO_CONTAINER_NAME, 'CONCURRENCY_CALC', patches)
if LIBRARY_PATH_VALUE:
remove_env_variable(containers, ISTIO_CONTAINER_NAME, 'LD_LIBRARY_PATH', patches)
if 'shareProcessNamespace' in obj.get('spec', {}):
patches.append({
"op": "remove",
"path": "/spec/shareProcessNamespace"
})
app.logger.debug("Removed shareProcessNamespace patch")
else:
app.logger.debug("shareProcessNamespace not found; no patch to remove it")
# Remove the init container if it exists
if init_container_exist:
for idx, init_container in enumerate(init_containers):
if init_container['name'] == 'prepare-attachment':
patches.append({
"op": "remove",
"path": f"/spec/initContainers/{idx}"
})
app.logger.debug(f"Removed init container patch: {patches[-1]}")
break # Stop once we find and remove the target container
# Remove the sidecar container if it exists
if sidecar_exists:
for idx, container in enumerate(containers):
volume_mounts = container.get('volumeMounts', [])
for idx_v, volume_mount in enumerate(volume_mounts):
if volume_mount['name'] == 'envoy-attachment-shared':
patches.append({
"op": "remove",
"path": f"/spec/containers/{idx}/volumeMounts/{idx_v}"
})
app.logger.debug(f"Removed volumeMount: {patches[-1]}")
if container['name'] == 'infinity-next-nano-agent':
patches.append({
"op": "remove",
"path": f"/spec/containers/{idx}"
})
app.logger.debug(f"Removed sidecar container patch: {patches[-1]}")
# Remove the volume if it exists
if volume_exist:
for idx, volume in enumerate(volumes):
if volume['name'] == 'envoy-attachment-shared':
patches.append({
"op": "remove",
"path": f"/spec/volumes/{idx}"
})
app.logger.debug(f"Removed volume patch: {patches[-1]}")
break # Stop once we find and remove the target container
else:
app.logger.debug("Before if: Sidecar 'infinity-next-nano-agent' does not exist. Preparing to add it.")
# Define the sidecar container
sidecar = get_sidecar_container()
# Define the init container()
init_container = get_init_container()
# Define the volume mount for istio-proxy
volume_mount = get_volume_mount()
# Define the volume
volume_def = get_volume_definition()
if ISTIO_CONTAINER_NAME:
add_env_if_not_exist(containers, ISTIO_CONTAINER_NAME, patches)
add_env_variable_value_from(containers, ISTIO_CONTAINER_NAME, 'OPENAPPSEC_UID', None, patches, value_from={"fieldRef": {"fieldPath": "metadata.uid"}})
if LIBRARY_PATH_VALUE:
add_env_variable(containers, ISTIO_CONTAINER_NAME, 'LD_LIBRARY_PATH', LIBRARY_PATH_VALUE, patches)
if CONCURRENCY_CALC_VALUE:
add_env_variable(containers, ISTIO_CONTAINER_NAME, 'CONCURRENCY_CALC', CONCURRENCY_CALC_VALUE, patches)
if CONFIG_PORT_VALUE:
add_env_variable(containers, ISTIO_CONTAINER_NAME, 'CONFIG_PORT', CONFIG_PORT_VALUE, patches)
if CONCURRENCY_NUMBER_VALUE:
add_env_variable(containers, ISTIO_CONTAINER_NAME, 'CONCURRENCY_NUMBER', CONCURRENCY_NUMBER_VALUE, patches)
else:
app.logger.debug("ISTIO_CONTAINER_NAME skipping environment variable addition")
# Add the sidecar container
if not sidecar_exists:
# Add shareProcessNamespace if not already set
patches.append({
"op": "add",
"path": "/spec/shareProcessNamespace",
"value": True
})
app.logger.debug("Added shareProcessNamespace patch")
patches.append({
"op": "add",
"path": "/spec/containers/-",
"value": sidecar
})
app.logger.debug("Added sidecar container patch: %s", patches[-1])
# Add the volume mount to istio-proxy container (assumes istio-proxy is first container)
patches.append({
"op": "add",
"path": "/spec/containers/0/volumeMounts/-",
"value": volume_mount
})
app.logger.debug("Added volume mount patch to istio-proxy: %s", patches[-1])
# Add the new volume definition
patches.append({
"op": "add",
"path": "/spec/volumes/-",
"value": volume_def
})
app.logger.debug("Added volume definition patch: %s", patches[-1])
if DEPLOY_FILTER and SELECTOR_LABEL_NAME and SELECTOR_LABEL_VALUE:
RELEASE_NAME = os.getenv('RELEASE_NAME', 'openappsec-waf-injected')
envoy_filter_name = RELEASE_NAME + "-waf-filter"
create_or_update_envoy_filter(envoy_filter_name, namespace, SELECTOR_LABEL_NAME, SELECTOR_LABEL_VALUE)
else:
app.logger.debug("Before else: Sidecar 'infinity-next-nano-agent' already exists. Checking for image updates.")
# Optionally, update the sidecar image and tag if necessary
for idx, container in enumerate(containers):
if container['name'] == 'infinity-next-nano-agent':
current_image = container.get('image', '')
app.logger.debug("Current sidecar image: %s", current_image)
app.logger.debug("Desired sidecar image: %s", FULL_AGENT_IMAGE)
if current_image != FULL_AGENT_IMAGE:
patches.append({
"op": "replace",
"path": f"/spec/containers/{idx}/image",
"value": FULL_AGENT_IMAGE
})
app.logger.debug(f"Updated sidecar image patch: {patches[-1]}")
break # Sidecar found and handled
if not init_container_exist:
# Add the initContainer to the pod spec in the deployment
if 'initContainers' in obj['spec']:
obj['spec']['initContainers'].append(init_container)
else:
obj['spec']['initContainers'] = [init_container]
patches.append({
"op": "add",
"path": "/spec/initContainers",
"value": obj['spec']['initContainers']
})
else:
app.logger.debug("Before else: init-container 'prepare-attachment' already exists. Checking for image updates.")
# Optionally, update the sidecar image and tag if necessary
for idx, container in enumerate(containers):
if container['name'] == 'prepare-attachment':
current_image = container.get('image', '')
app.logger.debug("Current init container image: %s", current_image)
app.logger.debug("Desired init container image: %s", FULL_AGENT_IMAGE)
if current_image != FULL_AGENT_IMAGE:
patches.append({
"op": "replace",
"path": f"/spec/containers/{idx}/image",
"value": FULL_AGENT_IMAGE
})
app.logger.debug(f"Updated sidecar image patch: {patches[-1]}")
break # Sidecar found and handled
app.logger.info("Total patches: %s", json.dumps(patches, indent=2))
# Prepare the AdmissionReview response
admission_response = {
"kind": "AdmissionReview",
"apiVersion": "admission.k8s.io/v1",
"response": {
"uid": uid,
"allowed": True,
"patchType": "JSONPatch",
"patch": base64.b64encode(json.dumps(patches).encode('utf-8')).decode('utf-8')
}
}
app.logger.debug("Sending admission response: %s", json.dumps(admission_response, indent=2))
return jsonify(admission_response)
if __name__ == '__main__':
# Configure logger
configure_logging()
# Ensure certificates exist
secretgen.main()
if not os.path.exists("/certs/server.crt") or not os.path.exists("/certs/server.key"):
print("Error: Certificates not found. Exiting...")
exit(1)
cli = sys.modules['flask.cli']
cli.show_server_banner = lambda *x: None
# Run the Flask app with the generated certificates
app.run(host='0.0.0.0', port=443, ssl_context=('/certs/server.crt', '/certs/server.key'))