The sip-rtp-correlation repo's v2.0 changelog (JIRA GAL-602, tracked at jira.geedge.net) documents a rewrite of the VoIP correlation job onto an internal, config-driven "Easy Stream" framework (com.geedgenetworks.flink.easy.*), replacing the earlier bespoke Storm/Flink implementation in log-stream-voip-relation (com.zdjizhi.*). The rewrite registers correlation-adjacent primitives (IS_INTERNAL_IP_ADDRESS, HAS_EXTERNAL_IP_ADDRESS, STREAM_DIR, SNOWFLAKE_ID, SORT_ADDRESS) as reusable UDFs behind a common UDFFactory interface rather than one-off job code.
基于 Easy Stream 框架的配置化改造
Defense implications
- Confirms Galaxy/TSG_OLAP correlation jobs (VoIP and, by inference, the sibling GTP-C/RADIUS correlation repos noted elsewhere in this corpus) are converging on a shared, config-driven streaming platform with a common UDF library -- individual correlation capabilities (internal/external IP classification, address sorting/canonicalization, direction inference) are becoming platform-level building blocks rather than bespoke per-job logic, which should be assumed to propagate to other correlation jobs on the same framework over time.
Cited artifacts
mesalab_git—galaxy/tsg_olap/sip-rtp-correlation.bundle:src/site/markdown/changelogs.md(document)mesalab_git—galaxy/tsg_olap/sip-rtp-correlation.bundle:src/main/java/com/geedgenetworks/flink/easy/application/voip/VoipUDFFactory.java(source-code)
Provenance pointers only — no leak content is rehosted. Raw material: Enlace Hacktivista.
Related findings
Release 24.04 (28 APR 2024) adds province/city-granularity ("administrative area") geo-tagging to every session and security-event log for both client and server -- client_country/client_super_administrative_area/ client_administrative_area/client_sub_administrative_area and the server-side equivalents -- plus Client ASN/Server ASN as dedicated Statistics Rule Metric datasets, confirming sub-national geolocation is a standard enrichment field across TSG's logging pipeline, not a specialized lookup.
The app_recommend Flink job (Recommendation.java, job name "RECOMMENDATION-APP-CIP") keys incoming traffic by (app_label, client_ip), computes a sliding-window top-N of active client IPs per identified application via TopnHotItem's priority queue, and HbaseSink persists the result as an app-to-client-IP-list association -- row key MD5(app_label), columns app_label/client_ip_list/last_update_time -- in HBase. This is the source of the "Recommend App Active Client IP" troubleshooting lookup referenced in galaxy-troubleshooting-api's Release 21.12 changelog.
galaxy-troubleshooting-api's Postman collection defines a full "DoS Threat Map" dashboard API suite (folder-scoped request names: dos-threat-map-top- source-countries, dos-threat-map-top-destination-countries, dos-threat-map- top-victims, dos-threat-map-attack-type, dos-threat-map-severity, dos-threat- map-destination-ip-distribution, dos-threat-map-attack-connection, dos-threat-map-attack-volume-summary, dos-threat-map-attack-volume-trend), plus a separate DNS-amplification "Resolver" detection dataset and a per-victim-IP historical traffic-trend query -- confirming Galaxy exposes operator-facing DDoS-detection/geolocation dashboards built on top of TSG telemetry, distinct from its censorship/content-blocking function.
The `session_record` schema includes explicit boolean-style flag columns ssl_esni_flag and ssl_ech_flag, confirming that TSG/Galaxy tags every session with whether Encrypted SNI or Encrypted ClientHello was used -- giving the operator session-level visibility into ECH/ESNI adoption even where it cannot decrypt the underlying SNI.
galaxy-troubleshooting-api's Release 22.08 (31 AUG 2022) changelog adds four dedicated "recommend" endpoints that resolve IMSI, IMEI, phone number, and APN to GTP tunnel-endpoint ID (TEID) -- i.e. mobile-core identity-to-tunnel correlation exposed as a first-class, individually testable API surface at Galaxy's OLAP layer, corroborating the tsg_olap subtree's relationship-gtpc-user component. A "Top Subscribers" report existed on the same platform until it was explicitly removed in Release 24.04 (28 APR 2024).
The same `session_record` schema includes a literal `mail_password` column alongside mail_account/mail_from/mail_to/mail_cc/mail_bcc/mail_subject/ mail_attachment_name and a full per-session `mail_eml_file` capture, plus `ftp_account` and `ftp_url` -- confirming Galaxy's OLAP layer stores cleartext mail and FTP credentials and full message content per session, not just connection metadata.