From 9db145e34134ef41e608c9e92d62b31447df830d Mon Sep 17 00:00:00 2001 From: "Alan M. Carroll" Date: Wed, 5 Oct 2022 12:59:14 -0500 Subject: [PATCH] Add TS UUID extractor. --- doc/future.en.rst | 25 +--------------- doc/user/ExtractorReference.en.rst | 5 ++++ plugin/src/Ex_Ssn.cc | 30 +++++++++++++++++-- .../autest/gold_tests/basic/basic.replay.yaml | 18 +++++++++++ 4 files changed, 52 insertions(+), 26 deletions(-) diff --git a/doc/future.en.rst b/doc/future.en.rst index 6570cfb9..ef5f970f 100755 --- a/doc/future.en.rst +++ b/doc/future.en.rst @@ -13,8 +13,6 @@ This is future intended work and so may change radically. The essence should rem Session ======= -inbound-local-addr - inbound-remote-port inbound-local-port @@ -32,19 +30,6 @@ The extracted feature can be post processed using options in the :txb:drtv:`with having a pair where the first element is the feature extraction, and the second is a map of options. Currently the only planned modifier is "hash". -hash - "hash: " - - Hash the feature and reduce it to the range 1 .. ::code:`number`. Something like :: - - with: - - "{creq.url}" - - hash: 4096 - - This will get the client request URL, hash it, then (as evenly as possibl) reduce it to a number - in the range 1 .. 4096. - - slice Extract elements of a list. This takes two arguments, the left and right slice points. These are positions between elements of a list. Position 0 is before any element, and position -0 @@ -57,14 +42,6 @@ Comparisons Directives ********** -apply - "apply: [ , ]" - - Apply the regular expression ::code:`regex` to ::code:`string`. This updates the extraction argument - list such that capture groups in the regular expression can be extracted via numbered extractors. - E.g. "{2}" is replaced by the second capture group. Groups that do not exist or were not part of - the regular expression match yield the empty string. - call "call: " @@ -156,7 +133,7 @@ Issues * Matching on just the first value is annoyingly verbose. This would be noticeably better if there was an "apply" directive which loaded the :code:`with` context, e.g. regular expression groups - and :code:`...` without even trying to do matches.e43se + and :code:`...` without even trying to do matches. * Do_with support for :code:`do` in each comparison, this may be of more limited utility. But that would be verbose to (for instance) do something for every tuple with a specific first element diff --git a/doc/user/ExtractorReference.en.rst b/doc/user/ExtractorReference.en.rst index bb02b6cf..34507136 100755 --- a/doc/user/ExtractorReference.en.rst +++ b/doc/user/ExtractorReference.en.rst @@ -792,3 +792,8 @@ This is an ecletic collection of extractors that do not depend on transaction or These fields are poorly documented, the general recommendation being "read the kernel code" which seems a bit terse. Use with caution. + +.. extractor:: ts-uuid + :result: string + + The process level UUID for this instance of |TS|. diff --git a/plugin/src/Ex_Ssn.cc b/plugin/src/Ex_Ssn.cc index ea6e02a7..87d78218 100644 --- a/plugin/src/Ex_Ssn.cc +++ b/plugin/src/Ex_Ssn.cc @@ -603,7 +603,7 @@ Ex_inbound_cert_remote_subject_field::format(BufferWriter &w, Spec const &spec, } class Ex_outbound_cert_remote_subject_field : public StringExtractor - { +{ using self_type = Ex_outbound_cert_remote_subject_field; using super_type = StringExtractor; @@ -613,7 +613,7 @@ class Ex_outbound_cert_remote_subject_field : public StringExtractor BufferWriter &format(BufferWriter &w, Spec const &spec, Context &ctx) override; protected: - }; +}; Rv Ex_outbound_cert_remote_subject_field::validate(Config &, Spec &spec, const TextView &arg) @@ -638,6 +638,28 @@ Ex_outbound_cert_remote_subject_field::format(BufferWriter &w, Spec const &spec, return bwformat(w, spec, ssl_ctx.remote_subject_field(nid)); } /* ------------------------------------------------------------------------------------ */ +class Ex_ts_uuid : public StringExtractor { + using self_type = Ex_ts_uuid; + using super_type = StringExtractor; + +public: + static constexpr TextView NAME{"ts-uuid"}; + Rv validate(Config &cfg, Spec &spec, TextView const &arg) override; + BufferWriter &format(BufferWriter &w, Spec const &spec, Context &ctx) override; +}; + +Rv +Ex_ts_uuid::validate(Config &, Spec &, const TextView &) +{ + return {STRING}; +} + +BufferWriter& +Ex_ts_uuid::format(BufferWriter &w, const Spec &spec, Context &) +{ + return bwformat(w, spec, TSUuidStringGet(TSProcessUuidGet())); +} +/* ------------------------------------------------------------------------------------ */ namespace { // Extractors aren't constructed, they are always named references to singletons. @@ -663,6 +685,8 @@ Ex_outbound_cert_local_subject_field outbound_cert_local_subject_field; Ex_outbound_cert_remote_issuer_value outbound_cert_remote_issuer_value; Ex_outbound_cert_remote_subject_field outbound_cert_remote_subject_field; +Ex_ts_uuid ts_uuid; + [[maybe_unused]] bool INITIALIZED = []() -> bool { Extractor::define(Ex_inbound_txn_count::NAME, &inbound_txn_count); Extractor::define(Ex_inbound_sni::NAME, &inbound_sni); @@ -684,6 +708,8 @@ Ex_outbound_cert_remote_subject_field outbound_cert_remote_subject_field; Extractor::define(Ex_outbound_cert_remote_subject_field::NAME, &outbound_cert_remote_subject_field); Extractor::define(Ex_outbound_cert_remote_issuer_value::NAME, &outbound_cert_remote_issuer_value); + Extractor::define(Ex_ts_uuid::NAME, &ts_uuid); + return true; }(); } // namespace diff --git a/test/autest/gold_tests/basic/basic.replay.yaml b/test/autest/gold_tests/basic/basic.replay.yaml index 7891c799..b5a3d298 100644 --- a/test/autest/gold_tests/basic/basic.replay.yaml +++ b/test/autest/gold_tests/basic/basic.replay.yaml @@ -143,6 +143,9 @@ meta: - match: "2" do: - proxy-rsp-field: var + - match: "uuid" + do: + - proxy-rsp-field: ts-uuid remap-1: - with: ua-req-path @@ -180,6 +183,21 @@ sessions: - protocol: [ { name: ip, version : 4} ] transactions: # + - all: { headers: { fields: [[ uuid, ts-uuid]]}} + client-request: + <<: *base-req + url: "/uuid" + headers: + fields: + - [ Host, one.ex ] + server-response: + <<: *base-rsp + proxy-response: + status: 200 + headers: + fields: + - [ "ts-uuid", { as: present } ] + - all: { headers: { fields: [[ uuid, 1 ]]}} client-request: <<: *base-req