Skip to content

Commit e8100b3

Browse files
KutumovKutumov
authored
Add ja5h and ja5t access log (#2321)
1 parent 5e583b8 commit e8100b3

File tree

4 files changed

+65
-27
lines changed

4 files changed

+65
-27
lines changed

‎fw/access_log.c

Lines changed: 50 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
/**
22
* Tempesta FW
33
*
4-
* Copyright (C) 2022-2024 Tempesta Technologies, Inc.
4+
* Copyright (C) 2022-2025 Tempesta Technologies, Inc.
55
*
66
* This program is free software; you can redistribute it and/or modify it
77
* under the terms of the GNU General Public License as published by
@@ -39,27 +39,32 @@
3939
! code that fills its value !
4040
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
4141
*/
42-
#define ACCESS_LOG_LINE(FIXED, UNTRUNCATABLE, TRUNCATABLE) \
43-
FIXED(__BNR) \
44-
UNTRUNCATABLE(client_ip) \
45-
FIXED(" \"") \
46-
UNTRUNCATABLE(vhost) \
47-
FIXED("\" \"") \
48-
UNTRUNCATABLE(method) \
49-
FIXED(" ") \
50-
TRUNCATABLE(uri) \
51-
FIXED(" ") \
52-
UNTRUNCATABLE(version) \
53-
FIXED("\" ") \
54-
UNTRUNCATABLE(status) \
55-
FIXED(" ") \
56-
UNTRUNCATABLE(content_length) \
57-
FIXED(" \"") \
58-
TRUNCATABLE(referer) \
59-
FIXED("\" \"") \
60-
TRUNCATABLE(user_agent) \
42+
#define ACCESS_LOG_LINE(FIXED, UNTRUNCATABLE, TRUNCATABLE) \
43+
FIXED(__BNR) \
44+
UNTRUNCATABLE(client_ip) \
45+
FIXED(" \"") \
46+
UNTRUNCATABLE(vhost) \
47+
FIXED("\" \"") \
48+
UNTRUNCATABLE(method) \
49+
FIXED(" ") \
50+
TRUNCATABLE(uri) \
51+
FIXED(" ") \
52+
UNTRUNCATABLE(version) \
53+
FIXED("\" ") \
54+
UNTRUNCATABLE(status) \
55+
FIXED(" ") \
56+
UNTRUNCATABLE(content_length) \
57+
FIXED(" \"") \
58+
TRUNCATABLE(referer) \
59+
FIXED("\" \"") \
60+
TRUNCATABLE(user_agent) \
61+
FIXED("\" \"") \
62+
UNTRUNCATABLE(ja5_tls) \
63+
FIXED("\" \"") \
64+
UNTRUNCATABLE(ja5_http) \
6165
FIXED("\"")
6266

67+
6368
#define ACCESS_LOG_OFF 0
6469
#define ACCESS_LOG_DMESG 1
6570
#define ACCESS_LOG_MMAP 2
@@ -289,6 +294,9 @@ do_access_log_req_mmap(TfwHttpReq *req, u16 resp_status,
289294
char *data, *p;
290295
struct timespec64 ts;
291296
u16 len;
297+
TlsJa5t *tls_ja5t = TFW_CONN_TLS(req->conn) ?
298+
&tfw_tls_context(req->conn)->sess.ja5t : NULL;
299+
292300

293301
room_size = tfw_mmap_buffer_get_room(mmap_buffer, &data);
294302
if (room_size < sizeof(TfwBinLogEvent))
@@ -363,6 +371,12 @@ do_access_log_req_mmap(TfwHttpReq *req, u16 resp_status,
363371
req->h_tbl->tbl + TFW_HTTP_HDR_USER_AGENT);
364372
WRITE_STR_FIELD(ua);
365373

374+
if (tls_ja5t)
375+
WRITE_FIELD(*tls_ja5t);
376+
else
377+
TFW_MMAP_LOG_FIELD_RESET(event, TFW_MMAP_LOG_JA5T);
378+
WRITE_FIELD(req->ja5h);
379+
366380
if (*dropped) {
367381
WRITE_FIELD(*dropped);
368382
*dropped = 0;
@@ -394,10 +408,12 @@ do_access_log_req_dmesg(TfwHttpReq *req, int resp_status, unsigned long resp_con
394408
BasicStr client_ip, vhost, method, version;
395409
/* These fields are only here to hold estimation of appropriate fields
396410
* length in characters */
397-
BasicStr status, content_length;
411+
BasicStr status, content_length, ja5_tls, ja5_http;
398412
BasicStr missing = { "-", 1 };
399413
TfwStr truncated_in[TRUNCATABLE_FIELDS_COUNT];
400414
BasicStr truncated_out[TRUNCATABLE_FIELDS_COUNT];
415+
TlsJa5t *tls_ja5t = TFW_CONN_TLS(req->conn) ?
416+
&tfw_tls_context(req->conn)->sess.ja5t : NULL;
401417

402418
/* client_ip
403419
*
@@ -466,6 +482,15 @@ do_access_log_req_dmesg(TfwHttpReq *req, int resp_status, unsigned long resp_con
466482
ADD_HDR(idx_referer, TFW_HTTP_HDR_REFERER);
467483
ADD_HDR(idx_user_agent, TFW_HTTP_HDR_USER_AGENT);
468484

485+
#define FMT_ja5_tls "ja5t=%llx"
486+
#define ARG_ja5_tls , (tls_ja5t ? *(u64 *)tls_ja5t : 0)
487+
ja5_tls.data = "";
488+
ja5_tls.len = 16;
489+
#define FMT_ja5_http "ja5h=%llx"
490+
#define ARG_ja5_http , (*(u64 *)&req->ja5h)
491+
ja5_http.data = "";
492+
ja5_http.len = 16;
493+
469494
/* Now we calculate first estimation of
470495
* "maximum allowed truncated string length" */
471496
#define ESTIMATE_FIXED(str) + (sizeof(str) - 1)
@@ -519,6 +544,10 @@ do_access_log_req_dmesg(TfwHttpReq *req, int resp_status, unsigned long resp_con
519544
#undef FMT_vhost
520545
#undef ARG_client_ip
521546
#undef FMT_client_ip
547+
#undef FMT_ja5_tls
548+
#undef ARG_ja5_tls
549+
#undef FMT_ja5_http
550+
#undef ARG_ja5_http
522551
}
523552

524553
void

‎fw/access_log.h

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
/**
22
* Tempesta FW
33
*
4-
* Copyright (C) 2022-2024 Tempesta Technologies, Inc.
4+
* Copyright (C) 2022-2025 Tempesta Technologies, Inc.
55
*
66
* This program is free software; you can redistribute it and/or modify it
77
* under the terms of the GNU General Public License as published by
@@ -65,6 +65,8 @@ typedef enum {
6565
TFW_MMAP_LOG_URI,
6666
TFW_MMAP_LOG_REFERER,
6767
TFW_MMAP_LOG_USER_AGENT,
68+
TFW_MMAP_LOG_JA5T,
69+
TFW_MMAP_LOG_JA5H,
6870
TFW_MMAP_LOG_DROPPED,
6971
TFW_MMAP_LOG_MAX
7072
} TfwBinLogFields;
@@ -90,7 +92,9 @@ static inline int tfw_mmap_log_field_len(TfwBinLogFields field)
9092
[TFW_MMAP_LOG_URI] = 0,
9193
[TFW_MMAP_LOG_REFERER] = 0,
9294
[TFW_MMAP_LOG_USER_AGENT] = 0,
93-
[TFW_MMAP_LOG_DROPPED] = 8,
95+
[TFW_MMAP_LOG_JA5T] = 8,
96+
[TFW_MMAP_LOG_JA5H] = 8,
97+
[TFW_MMAP_LOG_DROPPED] = 8
9498
};
9599
return TfwBinLogFieldsLens[field];
96100
}

‎utils/clickhouse.cc

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
/**
22
* Tempesta FW
33
*
4-
* Copyright (C) 2024 Tempesta Technologies, Inc.
4+
* Copyright (C) 2024-2025 Tempesta Technologies, Inc.
55
*
66
* This program is free software; you can redistribute it and/or modify it
77
* under the terms of the GNU General Public License as published by
@@ -31,7 +31,8 @@ constexpr char table_creation_querry[] = "CREATE TABLE IF NOT EXISTS "
3131
"access_log (timestamp DateTime64(3, 'UTC'), address IPv6, method UInt8, "
3232
"version UInt8, status UInt16, response_content_length UInt32, "
3333
"response_time UInt32, vhost String, uri String, referer String, "
34-
"user_agent String, dropped_events UInt64, PRIMARY KEY(timestamp));";
34+
"user_agent String, ja5t UInt64, ja5h UInt64, dropped_events UInt64,"
35+
"PRIMARY KEY(timestamp));";
3536

3637
static auto
3738
now_ms()

‎utils/tfw_logger.cc

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
/**
22
* Tempesta FW
33
*
4-
* Copyright (C) 2024 Tempesta Technologies, Inc.
4+
* Copyright (C) 2024-2025 Tempesta Technologies, Inc.
55
*
66
* This program is free software; you can redistribute it and/or modify it
77
* under the terms of the GNU General Public License as published by
@@ -66,7 +66,9 @@ static const TfwField tfw_fields[] = {
6666
[TFW_MMAP_LOG_URI] = {"uri", clickhouse::Type::String},
6767
[TFW_MMAP_LOG_REFERER] = {"referer", clickhouse::Type::String},
6868
[TFW_MMAP_LOG_USER_AGENT] = {"user_agent", clickhouse::Type::String},
69-
[TFW_MMAP_LOG_DROPPED] = {"dropped_events", clickhouse::Type::UInt64},
69+
[TFW_MMAP_LOG_JA5T] = {"ja5t", clickhouse::Type::UInt64},
70+
[TFW_MMAP_LOG_JA5H] = {"ja5h", clickhouse::Type::UInt64},
71+
[TFW_MMAP_LOG_DROPPED] = {"dropped_events", clickhouse::Type::UInt64}
7072
};
7173

7274
std::atomic<bool> stop_flag{false};
@@ -190,6 +192,8 @@ read_access_log_event(const char *data, int size, TfwClickhouse *clickhouse)
190192
READ_STR(TFW_MMAP_LOG_REFERER);
191193
READ_STR(TFW_MMAP_LOG_USER_AGENT);
192194

195+
READ_INT(TFW_MMAP_LOG_JA5T, clickhouse::ColumnUInt64, uint64_t);
196+
READ_INT(TFW_MMAP_LOG_JA5H, clickhouse::ColumnUInt64, uint64_t);
193197
READ_INT(TFW_MMAP_LOG_DROPPED, clickhouse::ColumnUInt64, uint64_t);
194198

195199
return p - data;

0 commit comments

Comments
 (0)