TSG's sapp/firewall components run as Kubernetes pods, built from a "MESA_Platform" monorepo (path fragment .../MESA_Platform/sapp/... visible in a crash log), using jemalloc. A 2024-03 SIP-heavy deployment triggered jemalloc memory-purge deadlocks under high UDP concurrency, crashing the firewall pod every 2-4 days; fixed via jemalloc tuning and a session-count cap in the SIP plugin config.
MESA_Platform/sapp/src/timer/sapp_timer.c...kubectl rollout restart deploy/tsg-traffic-engine-vsys-1-firewall...sed -ci 's/session_expire_num=1000/session_expire_num=10/' /opt/tsg/sapp/conf/sip/sip_main.conf
Defense implications
- Directly ties the MESA Lab codebase to the commercial TSG product at the build-path level, beyond publicly-reported personnel overlap.
- SIP/VoIP-heavy traffic has caused documented stability problems in at least one deployment -- transports mimicking/tunneling through SIP may exploit this instability class, though deployment-specific and possibly patched.
Related findings
An internal TSG operations/troubleshooting manual lays out TSG's full traffic pipeline (NIC -> mrzcpd/marsio capture driver -> sapp DPI engine -> firewall/proxy(KNI->TFE)/active-defense/WAN-NAT policy branches) and shows engineers using maat_redis_tool to pull the live Redis-synced blocking policy tables (TSG_SECURITY_COMPILE, TSG_OBJ_IP_ADDR, TSG_OBJ_APP_ID) and filter them by numeric policy/object ID to debug why a block rule isn't firing.
The internal 'MAAT网络流处理配置统一描述框架' engineering manual (v3.1.20, author 郑超, 2021) documents MAAT's Redis-synced rule-compilation framework and its RuleScan/Hyperscan-based pattern-matching engine (libmaatframe.so / librulescan), and records that RuleScan's fast-scan feature caused a production outage on 2019-03-19 and has been disabled ever since.
Raw structured DNS event logs (dated 2021-08-23) captured from what appears to be a GFW-adjacent DNS monitoring/injection pipeline use a schema purpose-built for DNS response forgery ('CHEAT_TYPE', 'CHEAT_RCODE', 'CHEAT_STRATEGY', 'CHEAT_RR', 'INJECTED_PKT_FILE' fields) alongside per-query geolocation; sampled records show lookups for facebook.com and tiktokv.com originating from residential China Telecom/Unicom/Mobile subscriber IPs in Guangdong, Zhejiang, Anhui and other provinces, resolving against both domestic and foreign (8.8.8.8, OpenDNS) resolvers.
A 2023 MESA Lab monthly report describes the 'TF' project's active-defense work: test cases for serial ('串联') HTTP hijack/tamper and parallel ('并联') DNS race-injection ('DNS抢答'), performance tuning that scaled active-defense capacity from 3 to 5 units, converting two existing TSG boxes to active-defense mode, and rewriting the active-defense flow-control logic to no longer depend on sapp.
The same 224-column TSG per-session log schema carries a full TLS- interception field set — proxy_pinning_status, proxy_intercept_status, proxy_passthrough_reason, proxy_cert_verify, proxy_intercept_error, sc_rsp_raw and sc_rsp_decrypted (raw vs. decrypted server response content) — plus ssl_esni_flag and ssl_ech_flag (explicit ECH/ESNI-usage flags), ssl_ja3_hash/ssl_ja3s_hash, and ssh_hassh (SSH client fingerprinting), confirming certstore-style MITM interception, ECH/ESNI detection, and TLS/SSH fingerprinting are all first-class fields logged on every session, not experimental add-ons.
TSG's core per-session log schema (a 224-column CSV export, four near- identical copies in this batch) includes subscriber-identity fields — subscriber_id, imei, imsi, apn, and phone_number — directly alongside the standard 5-tuple/app-classification fields in the *same* record, meaning every inspected session is natively correlated to a subscriber identity by design, not as a bolted-on side system.