OpenAppFilter: update
This commit is contained in:
CN_SZTL
parent
6fb73d7b6e
commit
36525dab33
@ -11,6 +11,7 @@
|
||||
#include <net/tcp.h>
|
||||
#include <linux/netfilter.h>
|
||||
#include <net/netfilter/nf_conntrack.h>
|
||||
#include <net/netfilter/nf_conntrack_acct.h>
|
||||
#include <linux/skbuff.h>
|
||||
#include <net/ip.h>
|
||||
#include <linux/types.h>
|
||||
@ -36,7 +37,8 @@ DEFINE_RWLOCK(af_feature_lock);
|
||||
#define feature_list_read_unlock() read_unlock_bh(&af_feature_lock);
|
||||
#define feature_list_write_lock() write_lock_bh(&af_feature_lock);
|
||||
#define feature_list_write_unlock() write_unlock_bh(&af_feature_lock);
|
||||
|
||||
// ×¢ÒâÓÐÖØ´«±¨ÎÄ
|
||||
#define MAX_PARSE_PKT_NUM 16
|
||||
#define MIN_HTTP_DATA_LEN 16
|
||||
#define MAX_APP_NAME_LEN 64
|
||||
#define MAX_FEATURE_NUM_PER_APP 16
|
||||
@ -519,7 +521,7 @@ void parse_http_proto(flow_info_t *flow)
|
||||
}
|
||||
if (flow->sport != 80 && flow->dport != 80)
|
||||
return;
|
||||
for (i = 0; i < data_len - 4; i++) {
|
||||
for (i = 0; i < data_len; i++) {
|
||||
if (data[i] == 0x0d && data[i + 1] == 0x0a){
|
||||
if (0 == memcmp(&data[start], "POST ", 5)) {
|
||||
flow->http.match = AF_TRUE;
|
||||
@ -535,7 +537,7 @@ void parse_http_proto(flow_info_t *flow)
|
||||
flow->http.url_len = i - start - 4;
|
||||
//dump_str("post request", flow->http.url_pos, flow->http.url_len);
|
||||
}
|
||||
else if (0 == memcmp(&data[start], "Host: ", 6) ){
|
||||
else if (0 == memcmp(&data[start], "Host:", 5) ){
|
||||
flow->http.host_pos = data + start + 6;
|
||||
flow->http.host_len = i - start - 6;
|
||||
//dump_str("host ", flow->http.host_pos, flow->http.host_len);
|
||||
@ -771,6 +773,7 @@ int app_filter_match(flow_info_t *flow)
|
||||
return AF_FALSE;
|
||||
}
|
||||
|
||||
#define APP_FILTER_DROP_BITS 0xf0000000
|
||||
|
||||
/* ÔÚnetfilter¿ò¼Ü×¢²áµÄ¹³×Ó */
|
||||
|
||||
@ -786,6 +789,8 @@ static u_int32_t app_filter_hook(unsigned int hook,
|
||||
const struct net_device *out,
|
||||
int (*okfn)(struct sk_buff *)){
|
||||
#endif
|
||||
unsigned long long total_packets = 0;
|
||||
flow_info_t flow;
|
||||
// 4.10-->4.11 nfct-->_nfct
|
||||
#if LINUX_VERSION_CODE >= KERNEL_VERSION(4,11,0)
|
||||
struct nf_conn *ct = (struct nf_conn *)skb->_nfct;
|
||||
@ -796,14 +801,54 @@ static u_int32_t app_filter_hook(unsigned int hook,
|
||||
//AF_ERROR("ct is null\n");
|
||||
return NF_ACCEPT;
|
||||
}
|
||||
flow_info_t flow;
|
||||
|
||||
if (!nf_ct_is_confirmed(ct)){
|
||||
return NF_ACCEPT;
|
||||
}
|
||||
|
||||
#if defined(CONFIG_NF_CONNTRACK_MARK)
|
||||
if (ct->mark != 0)
|
||||
if (APP_FILTER_DROP_BITS == (ct->mark & APP_FILTER_DROP_BITS)){
|
||||
return NF_DROP;
|
||||
}
|
||||
#endif
|
||||
|
||||
// 3.12.74-->3.13-rc1
|
||||
#if LINUX_VERSION_CODE >= KERNEL_VERSION(3,13,0)
|
||||
struct nf_conn_acct *acct;
|
||||
acct = nf_conn_acct_find(ct);
|
||||
if (!acct)
|
||||
return NF_ACCEPT;
|
||||
total_packets = (unsigned long long)atomic64_read(&acct->counter[IP_CT_DIR_ORIGINAL].packets)
|
||||
+ (unsigned long long)atomic64_read(&acct->counter[IP_CT_DIR_REPLY].packets);
|
||||
#else
|
||||
|
||||
struct nf_conn_counter *counter;
|
||||
counter = nf_conn_acct_find(ct);
|
||||
|
||||
if (!counter)
|
||||
return NF_ACCEPT;
|
||||
|
||||
total_packets = (unsigned long long)atomic64_read(&counter[IP_CT_DIR_ORIGINAL].packets)
|
||||
+ (unsigned long long)atomic64_read(&counter[IP_CT_DIR_REPLY].packets);
|
||||
|
||||
#endif
|
||||
if (total_packets > MAX_PARSE_PKT_NUM){
|
||||
return NF_ACCEPT;
|
||||
}
|
||||
|
||||
memset((char *)&flow, 0x0, sizeof(flow_info_t));
|
||||
parse_flow_base(skb, &flow);
|
||||
parse_http_proto(&flow);
|
||||
parse_https_proto(&flow);
|
||||
//dump_flow_info(&flow);
|
||||
if (app_filter_match(&flow))
|
||||
if (app_filter_match(&flow)){
|
||||
|
||||
#if defined(CONFIG_NF_CONNTRACK_MARK)
|
||||
ct->mark |= APP_FILTER_DROP_BITS;
|
||||
#endif
|
||||
return NF_DROP;
|
||||
}
|
||||
return NF_ACCEPT;
|
||||
}
|
||||
|
||||
|
||||
14
package/ctcgfw/open-app-filter/files/feature.cfg
Executable file → Normal file
14
package/ctcgfw/open-app-filter/files/feature.cfg
Executable file → Normal file
@ -7,7 +7,7 @@
|
||||
|
||||
#class game
|
||||
2001 王者荣耀:[tcp;;;;;00:33|01:66|02:00|03:09,udp;;;;;00:01|01:02|02:00|03:00]
|
||||
2002 绝地求生:[tcp;;;;;00:43|1:66|02:aa,tcp;;;;;00:33|1:66|03:0a|05:0a|,tcp;;;;;00:01|1:00|02:00,udp;;;;;00:59|01:ad|03:45|05:e4,udp;;;;;00:b9|01:5d|03:39|05:77]
|
||||
2002 和平精英:[tcp;;;;;00:43|1:66|02:aa,tcp;;;;;00:33|1:66|03:0a|05:0a|,tcp;;;;;00:01|1:00|02:00,udp;;;;;00:59|01:ad|03:45|05:e4,udp;;;;;00:b9|01:5d|03:39|05:77]
|
||||
2003 英雄联盟:[udp;;;;;44:00|45:00|46:00|47:02]
|
||||
2004 荒野行动:[udp;;;;;00:05|01:09,tcp;;;;;00:02|01:00|02:00|03:00]
|
||||
2005 欢乐斗地主:[tcp;;8000;;;00:74|01:67|02:77|03:5f]
|
||||
@ -15,24 +15,28 @@
|
||||
2007 明日之后:[udp;;;;;00:05|01:09|02:00,tcp;;;;;00:02|01:00|02:00|03:00|04:00|05:00]
|
||||
2008 QQ飞车:[udp;;;;;00:28|01:28,tcp;;10000;;;00:33|01:66|02:00|03:08]
|
||||
2009 跑跑卡丁车:[tcp;;8888;;;00:33|01:66|02:00|03:08]
|
||||
2010 开心消消乐:[tcp;;80;happyelements;;]
|
||||
2011 狂野飙车:[tcp;;;asphalt9;;]
|
||||
2012 率土之滨:[tcp;;10001;;;00:00|01:00,tcp;;8001;;;00:00|01:00]
|
||||
2013 一刀传世:[tcp;;8040;;;00:47|01:45]
|
||||
|
||||
#class video
|
||||
3001 抖音短视频:[tcp;;80;-dy-;;,tcp;;;-dy.;;]
|
||||
3002 火山小视频:[tcp;;;.huoshan.com;;,tcp;;;hs.pstatp.com;;,tcp;;;hs.ixigua.com;;]
|
||||
3003 腾讯视频:[tcp;;443;v.qq.com;;,tcp;;443;tc.qq.com;;,tcp;;443;video.qq.com;;,tcp;;443;btrace.qq.com;;]
|
||||
3004 爱奇艺:[tcp;;443;iqiyi.com;;,tcp;;443;irs01.com;;]
|
||||
3004 爱奇艺:[tcp;;443;iqiyi.com;;,tcp;;443;iqiyi.com;;]
|
||||
3005 微视:[tcp;;80;;;00:34|01:16|02:75,tcp;;80;weishi.qq.com;;]
|
||||
3006 斗鱼直播:[tcp;;;douyu;;,tcp;;;douyu;;-2:2f|-1:00]
|
||||
3007 熊猫直播:[tcp;;;panda;;,tcp;;;;;00:00|01:06|02:00]
|
||||
3008 虎牙直播:[tcp;;;huya;;,udp;;;;;01:00|02:00|03:00|04:23,udp;;;;;01:00|02:00|03:00|04:24]
|
||||
3009 快手:[tcp;;;kuaishou;;,tcp;;;ksyuncdn.com;;,tcp;;;.gifshow.com;;,tcp;;;yximgs.com;;]
|
||||
3010 小红书:[tcp;;;xiaohongshu;;]
|
||||
3010 小红书:[tcp;;;xiaohongshu;;,tcp;;;xhscdn;;]
|
||||
3011 花椒直播:[tcp;;;huajiao;;]
|
||||
3012 映客直播:[tcp;;;;.inke.cn;]
|
||||
3013 YY:[udp;;;;;02:00|03:00|04:08,udp;;;;;00:4f|01:00|02:00]
|
||||
3014 妩媚直播:[tcp;;;guojiang.tv;;]
|
||||
3015 菠萝直播:[tcp;;;;;00:03|01:00|02:00|03:00]
|
||||
3016 芒果tv:[tcp;;443;mgtv;;,tcp;;80;mgtv;;,tcp;;443;hitv;;]
|
||||
3017 西瓜视频:[tcp;;;xg.ixigua;;,tcp;;443;snsdk;;,tcp;;;xg-p.ixigua;;]
|
||||
|
||||
#class shopping
|
||||
4001 淘宝:[tcp;;;taobao;;,tcp;;;alicdn.com;;,tcp;;;tmall.com;;,tcp;;;;;00:d3|01:00,,tcp;;;;;00:d4|01:00,,tcp;;;;;00:d3|01:00]
|
||||
@ -62,3 +66,5 @@
|
||||
7002 AppStore:[tcp;;80;iosapps.itunes.apple.com;;]
|
||||
7003 samba共享:[tcp;;445;;;]
|
||||
7004 ftp文件传输:[tcp;;21;;;]
|
||||
7005 Vivo应用商店:[tcp;;443;appstore.vivo;;,tcp;;443;apkappdefwsdl.vivo;;]
|
||||
|
||||
|
||||
Loading…
Reference in New Issue
Block a user