Skip to content

Commit 8be2c9a

Browse files
lzf575taloric
lzf575
authored and
taloric
committed
feat: parse web_sphere_mq TSH message
1 parent c9d390b commit 8be2c9a

7 files changed

Lines changed: 245 additions & 5 deletions

File tree

‎agent/crates/enterprise-utils/src/lib.rs‎

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -334,14 +334,22 @@ pub mod l7 {
334334
pub struct WebSphereMqParser {
335335
pub base: L7LogBase,
336336
pub orig_send_time: String,
337+
pub skip_frame: bool,
337338
}
338339

339340
impl WebSphereMqParser {
340-
pub fn check_payload(&mut self, _: &[u8]) -> Option<LogMessageType> {
341+
pub fn check_payload(&mut self, _: &[u8], _: bool) -> Option<LogMessageType> {
341342
unimplemented!()
342343
}
343344

344-
pub fn parse_payload(&mut self, _: &[u8], _: PacketDirection, _: bool) -> usize {
345+
pub fn parse_payload(
346+
&mut self,
347+
_: &[u8],
348+
_: PacketDirection,
349+
_: bool,
350+
_: bool,
351+
_: bool,
352+
) -> usize {
345353
unimplemented!()
346354
}
347355
}

‎agent/src/config/config.rs‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1834,12 +1834,16 @@ impl Default for Iso8583Config {
18341834
#[serde(default)]
18351835
pub struct WebSphereMqConfig {
18361836
pub parse_xml_enabled: bool,
1837+
pub decompress_enabled: bool,
1838+
pub filter_attributes_enabled: bool,
18371839
}
18381840

18391841
impl Default for WebSphereMqConfig {
18401842
fn default() -> Self {
18411843
Self {
18421844
parse_xml_enabled: true,
1845+
decompress_enabled: true,
1846+
filter_attributes_enabled: true,
18431847
}
18441848
}
18451849
}
@@ -3641,12 +3645,16 @@ impl Default for Iso8583ParseConfig {
36413645
#[derive(Clone, Debug, PartialEq, Eq)]
36423646
pub struct WebSphereMqParseConfig {
36433647
pub parse_xml_enabled: bool,
3648+
pub decompress_enabled: bool,
3649+
pub filter_attributes_enabled: bool,
36443650
}
36453651

36463652
impl Default for WebSphereMqParseConfig {
36473653
fn default() -> Self {
36483654
Self {
36493655
parse_xml_enabled: true,
3656+
decompress_enabled: true,
3657+
filter_attributes_enabled: true,
36503658
}
36513659
}
36523660
}

‎agent/src/config/handler.rs‎

100755100644
Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -768,6 +768,20 @@ impl From<&UserConfig> for FlowConfig {
768768
.protocol_special_config
769769
.web_sphere_mq
770770
.parse_xml_enabled,
771+
decompress_enabled: conf
772+
.processors
773+
.request_log
774+
.application_protocol_inference
775+
.protocol_special_config
776+
.web_sphere_mq
777+
.decompress_enabled,
778+
filter_attributes_enabled: conf
779+
.processors
780+
.request_log
781+
.application_protocol_inference
782+
.protocol_special_config
783+
.web_sphere_mq
784+
.filter_attributes_enabled,
771785
},
772786
obfuscate_enabled_protocols: L7ProtocolBitmap::from(
773787
conf.processors

‎agent/src/flow_generator/protocol_logs/mq/web_sphere_mq.rs‎

Lines changed: 13 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -291,8 +291,9 @@ pub struct WebSphereMqLog {
291291
}
292292

293293
impl L7ProtocolParserInterface for WebSphereMqLog {
294-
fn check_payload(&mut self, payload: &[u8], _param: &ParseParam) -> Option<LogMessageType> {
295-
self.parser.check_payload(payload)
294+
fn check_payload(&mut self, payload: &[u8], param: &ParseParam) -> Option<LogMessageType> {
295+
self.parser
296+
.check_payload(payload, param.web_sphere_mq_parse_conf.decompress_enabled)
296297
}
297298

298299
fn parse_payload(&mut self, payload: &[u8], param: &ParseParam) -> Result<L7ParseResult> {
@@ -303,6 +304,9 @@ impl L7ProtocolParserInterface for WebSphereMqLog {
303304

304305
let custom_policies =
305306
config.get_custom_field_policies(L7Protocol::WebSphereMq.into(), param);
307+
let parse_xml_enabled = param.web_sphere_mq_parse_conf.parse_xml_enabled;
308+
let decompress_enabled = param.web_sphere_mq_parse_conf.decompress_enabled;
309+
let filter_attributes_enabled = param.web_sphere_mq_parse_conf.filter_attributes_enabled;
306310
let mut pos = 0;
307311
let mut loop_count = 0;
308312
let mut results: Vec<L7ProtocolInfo> = Vec::with_capacity(Self::INIT_L7_RESULT_CAPACITY);
@@ -311,11 +315,17 @@ impl L7ProtocolParserInterface for WebSphereMqLog {
311315
let parsed_size = self.parser.parse_payload(
312316
&payload[pos..],
313317
param.direction,
314-
param.web_sphere_mq_parse_conf.parse_xml_enabled,
318+
parse_xml_enabled,
319+
decompress_enabled,
320+
filter_attributes_enabled,
315321
);
316322
if parsed_size == 0 {
317323
break;
318324
}
325+
if self.parser.skip_frame {
326+
pos += parsed_size;
327+
continue;
328+
}
319329
let mut info = WebSphereMqInfo::default();
320330
info.is_tls = param.is_tls();
321331
info.base.is_async = true;

‎server/agent_config/README-CH.md‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8114,6 +8114,78 @@ processors:
81148114

81158115
是否解析 XML 数据内容。
81168116

8117+
###### 解压数据包 {#processors.request_log.application_protocol_inference.protocol_special_config.web_sphere_mq.decompress_enabled}
8118+
8119+
**标签**:
8120+
8121+
<mark>agent_restart</mark>
8122+
<mark>ee_feature</mark>
8123+
8124+
**FQCN**:
8125+
8126+
`processors.request_log.application_protocol_inference.protocol_special_config.web_sphere_mq.decompress_enabled`
8127+
8128+
**默认值**:
8129+
```yaml
8130+
processors:
8131+
request_log:
8132+
application_protocol_inference:
8133+
protocol_special_config:
8134+
web_sphere_mq:
8135+
decompress_enabled: true
8136+
```
8137+
8138+
**模式**:
8139+
| Key | Value |
8140+
| ---- | ---------------------------- |
8141+
| Type | bool |
8142+
8143+
**详细描述**:
8144+
8145+
部分 web_sphere_mq 的消息中使用 zlib 压缩，开启此选项后，agent 在解析时会对数据包进行解压。
8146+
8147+
###### 属性字段过滤器 {#processors.request_log.application_protocol_inference.protocol_special_config.web_sphere_mq.filter_attributes_enabled}
8148+
8149+
**标签**:
8150+
8151+
<mark>agent_restart</mark>
8152+
<mark>ee_feature</mark>
8153+
8154+
**FQCN**:
8155+
8156+
`processors.request_log.application_protocol_inference.protocol_special_config.web_sphere_mq.filter_attributes_enabled`
8157+
8158+
**默认值**:
8159+
```yaml
8160+
processors:
8161+
request_log:
8162+
application_protocol_inference:
8163+
protocol_special_config:
8164+
web_sphere_mq:
8165+
filter_attributes_enabled: true
8166+
```
8167+
8168+
**模式**:
8169+
| Key | Value |
8170+
| ---- | ---------------------------- |
8171+
| Type | bool |
8172+
8173+
**详细描述**:
8174+
8175+
开启此选项后，agent 在解析时 XML 仅保留如下字段，减少数据存储。
8176+
- Document.ComConf.ConfInf.MT
8177+
- Document.ComConf.ConfInf.MsgId
8178+
- Document.ComConf.ConfInf.MsgPrcCd
8179+
- Document.ComConf.ConfInf.MsgRefId
8180+
- Document.ComConf.ConfInf.OrigSndDt
8181+
- Document.ComConf.ConfInf.OrigSndr
8182+
- Document.ComuCnfm.MsgId
8183+
- Document.ComuCnfm.MsgProCd
8184+
- Document.ComuCnfm.MsgRefId
8185+
- Document.ComuCnfm.MsgTp
8186+
- Document.ComuCnfm.OrigSndDt
8187+
- Document.ComuCnfm.OrigSndr
8188+
81178189
##### MySQL {#processors.request_log.application_protocol_inference.protocol_special_config.mysql}
81188190

81198191
###### 解压 MySQL 数据包 {#processors.request_log.application_protocol_inference.protocol_special_config.mysql.decompress_payload}

‎server/agent_config/README.md‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8297,6 +8297,79 @@ processors:
82978297

82988298
Whether to parse XML.
82998299

8300+
###### Decompress Payload {#processors.request_log.application_protocol_inference.protocol_special_config.web_sphere_mq.decompress_enabled}
8301+
8302+
**Tags**:
8303+
8304+
<mark>agent_restart</mark>
8305+
<mark>ee_feature</mark>
8306+
8307+
**FQCN**:
8308+
8309+
`processors.request_log.application_protocol_inference.protocol_special_config.web_sphere_mq.decompress_enabled`
8310+
8311+
**Default value**:
8312+
```yaml
8313+
processors:
8314+
request_log:
8315+
application_protocol_inference:
8316+
protocol_special_config:
8317+
web_sphere_mq:
8318+
decompress_enabled: true
8319+
```
8320+
8321+
**Schema**:
8322+
| Key | Value |
8323+
| ---- | ---------------------------- |
8324+
| Type | bool |
8325+
8326+
**Description**:
8327+
8328+
Some web_sphere_mq messages use zlib compression. When this option is enabled,
8329+
the agent will decompress the data packets during parsing.
8330+
8331+
###### Attribute Field Filter {#processors.request_log.application_protocol_inference.protocol_special_config.web_sphere_mq.filter_attributes_enabled}
8332+
8333+
**Tags**:
8334+
8335+
<mark>agent_restart</mark>
8336+
<mark>ee_feature</mark>
8337+
8338+
**FQCN**:
8339+
8340+
`processors.request_log.application_protocol_inference.protocol_special_config.web_sphere_mq.filter_attributes_enabled`
8341+
8342+
**Default value**:
8343+
```yaml
8344+
processors:
8345+
request_log:
8346+
application_protocol_inference:
8347+
protocol_special_config:
8348+
web_sphere_mq:
8349+
filter_attributes_enabled: true
8350+
```
8351+
8352+
**Schema**:
8353+
| Key | Value |
8354+
| ---- | ---------------------------- |
8355+
| Type | bool |
8356+
8357+
**Description**:
8358+
8359+
Enabling this option will cause the agent to retain only the following fields in the XML during parsing, reducing data storage.
8360+
- Document.ComConf.ConfInf.MT
8361+
- Document.ComConf.ConfInf.MsgId
8362+
- Document.ComConf.ConfInf.MsgPrcCd
8363+
- Document.ComConf.ConfInf.MsgRefId
8364+
- Document.ComConf.ConfInf.OrigSndDt
8365+
- Document.ComConf.ConfInf.OrigSndr
8366+
- Document.ComuCnfm.MsgId
8367+
- Document.ComuCnfm.MsgProCd
8368+
- Document.ComuCnfm.MsgRefId
8369+
- Document.ComuCnfm.MsgTp
8370+
- Document.ComuCnfm.OrigSndDt
8371+
- Document.ComuCnfm.OrigSndr
8372+
83008373
##### MySQL {#processors.request_log.application_protocol_inference.protocol_special_config.mysql}
83018374

83028375
###### Decompress MySQL Payload {#processors.request_log.application_protocol_inference.protocol_special_config.mysql.decompress_payload}

‎server/agent_config/template.yaml‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5898,6 +5898,61 @@ processors:
58985898
# ch: |-
58995899
# 是否解析 XML 数据内容。
59005900
parse_xml_enabled: true
5901+
# type: bool
5902+
# name:
5903+
# en: Decompress Payload
5904+
# ch: 解压数据包
5905+
# unit:
5906+
# range: []
5907+
# enum_options: []
5908+
# modification: agent_restart
5909+
# ee_feature: true
5910+
# description:
5911+
# en: |-
5912+
# Some web_sphere_mq messages use zlib compression. When this option is enabled,
5913+
# the agent will decompress the data packets during parsing.
5914+
# ch: |-
5915+
# 部分 web_sphere_mq 的消息中使用 zlib 压缩，开启此选项后，agent 在解析时会对数据包进行解压。
5916+
decompress_enabled: true
5917+
# type: bool
5918+
# name:
5919+
# en: Attribute Field Filter
5920+
# ch: 属性字段过滤器
5921+
# unit:
5922+
# range: []
5923+
# enum_options: []
5924+
# modification: agent_restart
5925+
# ee_feature: true
5926+
# description:
5927+
# en: |-
5928+
# Enabling this option will cause the agent to retain only the following fields in the XML during parsing, reducing data storage.
5929+
# - Document.ComConf.ConfInf.MT
5930+
# - Document.ComConf.ConfInf.MsgId
5931+
# - Document.ComConf.ConfInf.MsgPrcCd
5932+
# - Document.ComConf.ConfInf.MsgRefId
5933+
# - Document.ComConf.ConfInf.OrigSndDt
5934+
# - Document.ComConf.ConfInf.OrigSndr
5935+
# - Document.ComuCnfm.MsgId
5936+
# - Document.ComuCnfm.MsgProCd
5937+
# - Document.ComuCnfm.MsgRefId
5938+
# - Document.ComuCnfm.MsgTp
5939+
# - Document.ComuCnfm.OrigSndDt
5940+
# - Document.ComuCnfm.OrigSndr
5941+
# ch: |-
5942+
# 开启此选项后，agent 在解析时 XML 仅保留如下字段，减少数据存储。
5943+
# - Document.ComConf.ConfInf.MT
5944+
# - Document.ComConf.ConfInf.MsgId
5945+
# - Document.ComConf.ConfInf.MsgPrcCd
5946+
# - Document.ComConf.ConfInf.MsgRefId
5947+
# - Document.ComConf.ConfInf.OrigSndDt
5948+
# - Document.ComConf.ConfInf.OrigSndr
5949+
# - Document.ComuCnfm.MsgId
5950+
# - Document.ComuCnfm.MsgProCd
5951+
# - Document.ComuCnfm.MsgRefId
5952+
# - Document.ComuCnfm.MsgTp
5953+
# - Document.ComuCnfm.OrigSndDt
5954+
# - Document.ComuCnfm.OrigSndr
5955+
filter_attributes_enabled: true
59015956
# type: section
59025957
# name: MySQL
59035958
# description:

0 commit comments

Comments
 (0)