From 36525dab339a2db6650ab1f04d750da869dd1e54 Mon Sep 17 00:00:00 2001 From: CN_SZTL Date: Mon, 2 Dec 2019 23:47:21 +0800 Subject: [PATCH] OpenAppFilter: update --- package/ctcgfw/oaf/src/app_filter.c | 55 +++++++++++++++++-- .../ctcgfw/open-app-filter/files/feature.cfg | 14 +++-- 2 files changed, 60 insertions(+), 9 deletions(-) mode change 100755 => 100644 package/ctcgfw/open-app-filter/files/feature.cfg diff --git a/package/ctcgfw/oaf/src/app_filter.c b/package/ctcgfw/oaf/src/app_filter.c index b4587c8e54..868a36140a 100644 --- a/package/ctcgfw/oaf/src/app_filter.c +++ b/package/ctcgfw/oaf/src/app_filter.c @@ -11,6 +11,7 @@ #include #include #include +#include #include #include #include @@ -36,7 +37,8 @@ DEFINE_RWLOCK(af_feature_lock); #define feature_list_read_unlock() read_unlock_bh(&af_feature_lock); #define feature_list_write_lock() write_lock_bh(&af_feature_lock); #define feature_list_write_unlock() write_unlock_bh(&af_feature_lock); - +// 注意有重传报文 +#define MAX_PARSE_PKT_NUM 16 #define MIN_HTTP_DATA_LEN 16 #define MAX_APP_NAME_LEN 64 #define MAX_FEATURE_NUM_PER_APP 16 @@ -519,7 +521,7 @@ void parse_http_proto(flow_info_t *flow) } if (flow->sport != 80 && flow->dport != 80) return; - for (i = 0; i < data_len - 4; i++) { + for (i = 0; i < data_len; i++) { if (data[i] == 0x0d && data[i + 1] == 0x0a){ if (0 == memcmp(&data[start], "POST ", 5)) { flow->http.match = AF_TRUE; @@ -535,7 +537,7 @@ void parse_http_proto(flow_info_t *flow) flow->http.url_len = i - start - 4; //dump_str("post request", flow->http.url_pos, flow->http.url_len); } - else if (0 == memcmp(&data[start], "Host: ", 6) ){ + else if (0 == memcmp(&data[start], "Host:", 5) ){ flow->http.host_pos = data + start + 6; flow->http.host_len = i - start - 6; //dump_str("host ", flow->http.host_pos, flow->http.host_len); @@ -771,6 +773,7 @@ int app_filter_match(flow_info_t *flow) return AF_FALSE; } +#define APP_FILTER_DROP_BITS 0xf0000000 /* 在netfilter框架注册的钩子 */ @@ -786,6 +789,8 @@ static u_int32_t app_filter_hook(unsigned int hook, const struct net_device *out, int (*okfn)(struct sk_buff *)){ #endif + unsigned long long total_packets = 0; + flow_info_t flow; // 4.10-->4.11 nfct-->_nfct #if LINUX_VERSION_CODE >= KERNEL_VERSION(4,11,0) struct nf_conn *ct = (struct nf_conn *)skb->_nfct; @@ -796,14 +801,54 @@ static u_int32_t app_filter_hook(unsigned int hook, //AF_ERROR("ct is null\n"); return NF_ACCEPT; } - flow_info_t flow; + + if (!nf_ct_is_confirmed(ct)){ + return NF_ACCEPT; + } + +#if defined(CONFIG_NF_CONNTRACK_MARK) + if (ct->mark != 0) + if (APP_FILTER_DROP_BITS == (ct->mark & APP_FILTER_DROP_BITS)){ + return NF_DROP; + } +#endif + +// 3.12.74-->3.13-rc1 +#if LINUX_VERSION_CODE >= KERNEL_VERSION(3,13,0) + struct nf_conn_acct *acct; + acct = nf_conn_acct_find(ct); + if (!acct) + return NF_ACCEPT; + total_packets = (unsigned long long)atomic64_read(&acct->counter[IP_CT_DIR_ORIGINAL].packets) + + (unsigned long long)atomic64_read(&acct->counter[IP_CT_DIR_REPLY].packets); +#else + + struct nf_conn_counter *counter; + counter = nf_conn_acct_find(ct); + + if (!counter) + return NF_ACCEPT; + + total_packets = (unsigned long long)atomic64_read(&counter[IP_CT_DIR_ORIGINAL].packets) + + (unsigned long long)atomic64_read(&counter[IP_CT_DIR_REPLY].packets); + +#endif + if (total_packets > MAX_PARSE_PKT_NUM){ + return NF_ACCEPT; + } + memset((char *)&flow, 0x0, sizeof(flow_info_t)); parse_flow_base(skb, &flow); parse_http_proto(&flow); parse_https_proto(&flow); //dump_flow_info(&flow); - if (app_filter_match(&flow)) + if (app_filter_match(&flow)){ + +#if defined(CONFIG_NF_CONNTRACK_MARK) + ct->mark |= APP_FILTER_DROP_BITS; +#endif return NF_DROP; + } return NF_ACCEPT; } diff --git a/package/ctcgfw/open-app-filter/files/feature.cfg b/package/ctcgfw/open-app-filter/files/feature.cfg old mode 100755 new mode 100644 index cd98fc1006..733308e04c --- a/package/ctcgfw/open-app-filter/files/feature.cfg +++ b/package/ctcgfw/open-app-filter/files/feature.cfg @@ -7,7 +7,7 @@ #class game 2001 鐜嬭呰崳鑰:[tcp;;;;;00:33|01:66|02:00|03:09,udp;;;;;00:01|01:02|02:00|03:00] -2002 缁濆湴姹傜敓:[tcp;;;;;00:43|1:66|02:aa,tcp;;;;;00:33|1:66|03:0a|05:0a|,tcp;;;;;00:01|1:00|02:00,udp;;;;;00:59|01:ad|03:45|05:e4,udp;;;;;00:b9|01:5d|03:39|05:77] +2002 鍜屽钩绮捐嫳:[tcp;;;;;00:43|1:66|02:aa,tcp;;;;;00:33|1:66|03:0a|05:0a|,tcp;;;;;00:01|1:00|02:00,udp;;;;;00:59|01:ad|03:45|05:e4,udp;;;;;00:b9|01:5d|03:39|05:77] 2003 鑻遍泟鑱旂洘:[udp;;;;;44:00|45:00|46:00|47:02] 2004 鑽掗噹琛屽姩:[udp;;;;;00:05|01:09,tcp;;;;;00:02|01:00|02:00|03:00] 2005 娆箰鏂楀湴涓:[tcp;;8000;;;00:74|01:67|02:77|03:5f] @@ -15,24 +15,28 @@ 2007 鏄庢棩涔嬪悗:[udp;;;;;00:05|01:09|02:00,tcp;;;;;00:02|01:00|02:00|03:00|04:00|05:00] 2008 QQ椋炶溅:[udp;;;;;00:28|01:28,tcp;;10000;;;00:33|01:66|02:00|03:08] 2009 璺戣窇鍗′竵杞:[tcp;;8888;;;00:33|01:66|02:00|03:08] +2010 寮蹇冩秷娑堜箰:[tcp;;80;happyelements;;] +2011 鐙傞噹椋欒溅:[tcp;;;asphalt9;;] +2012 鐜囧湡涔嬫花:[tcp;;10001;;;00:00|01:00,tcp;;8001;;;00:00|01:00] +2013 涓鍒浼犱笘:[tcp;;8040;;;00:47|01:45] #class video 3001 鎶栭煶鐭棰:[tcp;;80;-dy-;;,tcp;;;-dy.;;] 3002 鐏北灏忚棰:[tcp;;;.huoshan.com;;,tcp;;;hs.pstatp.com;;,tcp;;;hs.ixigua.com;;] 3003 鑵捐瑙嗛:[tcp;;443;v.qq.com;;,tcp;;443;tc.qq.com;;,tcp;;443;video.qq.com;;,tcp;;443;btrace.qq.com;;] -3004 鐖卞鑹:[tcp;;443;iqiyi.com;;,tcp;;443;irs01.com;;] +3004 鐖卞鑹:[tcp;;443;iqiyi.com;;,tcp;;443;iqiyi.com;;] 3005 寰:[tcp;;80;;;00:34|01:16|02:75,tcp;;80;weishi.qq.com;;] 3006 鏂楅奔鐩存挱:[tcp;;;douyu;;,tcp;;;douyu;;-2:2f|-1:00] -3007 鐔婄尗鐩存挱:[tcp;;;panda;;,tcp;;;;;00:00|01:06|02:00] 3008 铏庣墮鐩存挱:[tcp;;;huya;;,udp;;;;;01:00|02:00|03:00|04:23,udp;;;;;01:00|02:00|03:00|04:24] 3009 蹇墜:[tcp;;;kuaishou;;,tcp;;;ksyuncdn.com;;,tcp;;;.gifshow.com;;,tcp;;;yximgs.com;;] -3010 灏忕孩涔:[tcp;;;xiaohongshu;;] +3010 灏忕孩涔:[tcp;;;xiaohongshu;;,tcp;;;xhscdn;;] 3011 鑺辨鐩存挱:[tcp;;;huajiao;;] 3012 鏄犲鐩存挱:[tcp;;;;.inke.cn;] 3013 YY:[udp;;;;;02:00|03:00|04:08,udp;;;;;00:4f|01:00|02:00] 3014 濡╁獨鐩存挱:[tcp;;;guojiang.tv;;] 3015 鑿犺悵鐩存挱:[tcp;;;;;00:03|01:00|02:00|03:00] 3016 鑺掓灉tv:[tcp;;443;mgtv;;,tcp;;80;mgtv;;,tcp;;443;hitv;;] +3017 瑗跨摐瑙嗛:[tcp;;;xg.ixigua;;,tcp;;443;snsdk;;,tcp;;;xg-p.ixigua;;] #class shopping 4001 娣樺疂:[tcp;;;taobao;;,tcp;;;alicdn.com;;,tcp;;;tmall.com;;,tcp;;;;;00:d3|01:00,,tcp;;;;;00:d4|01:00,,tcp;;;;;00:d3|01:00] @@ -62,3 +66,5 @@ 7002 AppStore:[tcp;;80;iosapps.itunes.apple.com;;] 7003 samba鍏变韩:[tcp;;445;;;] 7004 ftp鏂囦欢浼犺緭:[tcp;;21;;;] +7005 Vivo搴旂敤鍟嗗簵:[tcp;;443;appstore.vivo;;,tcp;;443;apkappdefwsdl.vivo;;] +