OpenAppFilter: update

package/ctcgfw/oaf/Makefile

@@ -10,9 +10,8 @@ include $(INCLUDE_DIR)/package.mk
 PKG_AUTOLOAD:=oaf
 
 define KernelPackage/oaf
-  SECTION:=Kernel
-  CATEGORY:=Kernel modules
-  SUBMENU:=Netfilter Extensions
+  SECTION:=Derry Apps
+  CATEGORY:=Derry Apps
   TITLE:=open app filter kernel module
   FILES:=$(PKG_BUILD_DIR)/oaf.ko 
   KCONFIG:=

package/ctcgfw/oaf/src/app_filter.c

@@ -11,6 +11,7 @@
 #include <net/tcp.h>
 #include <linux/netfilter.h>
 #include <net/netfilter/nf_conntrack.h>
+#include <net/netfilter/nf_conntrack_acct.h>
 #include <linux/skbuff.h>
 #include <net/ip.h>
 #include <linux/types.h>
@@ -36,7 +37,8 @@ DEFINE_RWLOCK(af_feature_lock);
 #define feature_list_read_unlock() 		read_unlock_bh(&af_feature_lock);
 #define feature_list_write_lock() 		write_lock_bh(&af_feature_lock);
 #define feature_list_write_unlock()		write_unlock_bh(&af_feature_lock);
-
+// ×¢ÒâÓÐÖØ´«±¨ÎÄ
+#define MAX_PARSE_PKT_NUM 16
 #define MIN_HTTP_DATA_LEN 16
 #define MAX_APP_NAME_LEN 64
 #define MAX_FEATURE_NUM_PER_APP 16 
@@ -771,6 +773,7 @@ int app_filter_match(flow_info_t *flow)
 	return AF_FALSE;
 }
 
+#define APP_FILTER_DROP_BITS 0xf0000000
 
 /* ÔÚnetfilter¿ò¼Ü×¢²áµÄ¹³×Ó */
 
@@ -786,24 +789,57 @@ static u_int32_t app_filter_hook(unsigned int hook,
 					           const struct net_device *out,
 					           int (*okfn)(struct sk_buff *)){
 #endif
+	unsigned long long total_packets = 0;
+	flow_info_t flow;
 // 4.10-->4.11 nfct-->_nfct
 #if LINUX_VERSION_CODE >= KERNEL_VERSION(4,11,0)
 	struct nf_conn *ct = (struct nf_conn *)skb->_nfct;
 #else
 	struct nf_conn *ct = (struct nf_conn *)skb->nfct;
 #endif
+
 	if (ct == NULL) {
 		//AF_ERROR("ct is null\n");
         return NF_ACCEPT;
     }
-	flow_info_t flow;
+
+#if defined(CONFIG_NF_CONNTRACK_MARK)
+	if (ct->mark != 0)
+	if (APP_FILTER_DROP_BITS == (ct->mark & APP_FILTER_DROP_BITS)){
+		return NF_DROP;
+	}
+#endif
+// 3.12.74-->3.13-rc1
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(3,13,0)
+	struct nf_conn_acct *acct;
+	acct = nf_conn_acct_find(ct);
+	if (!acct)
+		return NF_ACCEPT;
+	total_packets = (unsigned long long)atomic64_read(&acct->counter[IP_CT_DIR_ORIGINAL].packets) 
+		+ (unsigned long long)atomic64_read(&acct->counter[IP_CT_DIR_REPLY].packets);
+#else
+	struct nf_conn_counter *counter;
+	counter = nf_conn_acct_find(ct);
+	if (!counter)
+		return NF_ACCEPT;	
+	total_packets = (unsigned long long)atomic64_read(&counter[IP_CT_DIR_ORIGINAL].packets) 
+		+ (unsigned long long)atomic64_read(&counter[IP_CT_DIR_REPLY].packets);
+#endif
+	if (total_packets > MAX_PARSE_PKT_NUM){
+		return NF_ACCEPT;
+	}
 	memset((char *)&flow, 0x0, sizeof(flow_info_t));
 	parse_flow_base(skb, &flow);
 	parse_http_proto(&flow);
 	parse_https_proto(&flow);
 	//dump_flow_info(&flow);
-	if (app_filter_match(&flow))
+	if (app_filter_match(&flow)){
+		
+#if defined(CONFIG_NF_CONNTRACK_MARK)
+		ct->mark |= APP_FILTER_DROP_BITS;
+#endif
 		return NF_DROP;
+	}
 	return NF_ACCEPT;
 }
 

package/ctcgfw/open-app-filter/Makefile

@@ -11,8 +11,8 @@ include $(INCLUDE_DIR)/package.mk
 #include $(INCLUDE_DIR)/kernel.mk
 
 define Package/appfilter
-  SECTION:=net
-  CATEGORY:=Network
+  SECTION:=Derry Apps
+  CATEGORY:=Derry Apps
   TITLE:=App filter userspace module
 endef
 

package/ctcgfw/open-app-filter/files/feature.cfg

@@ -31,6 +31,7 @@
 3013 YY:[udp;;;;;02:00|03:00|04:08,udp;;;;;00:4f|01:00|02:00]
 3014 妩媚直播:[tcp;;;guojiang.tv;;]
 3015 菠萝直播:[tcp;;;;;00:03|01:00|02:00|03:00]
+3016 芒果tv:[tcp;;443;mgtv;;,tcp;;80;mgtv;;,tcp;;443;hitv;;]
 
 #class shopping
 4001 淘宝:[tcp;;;taobao;;,tcp;;;alicdn.com;;,tcp;;;tmall.com;;,tcp;;;;;00:d3|01:00,,tcp;;;;;00:d4|01:00,,tcp;;;;;00:d3|01:00]
@@ -54,3 +55,9 @@
 6005 同城急聘:[tcp;;;xiaomei;;]
 6006 领英:[tcp;;;linkedin;;]
 6007 斗米:[tcp;;;doumi;;]
+
+#class download
+7001 迅雷:[udp;12345;;;;,udp;15000;;;;,tcp;;54321;;;,tcp;;12345;;;,udp;6881;;;;,tcp;;;xunlei.com;;,tcp;;;sandai;;,udp;;8000;;;,udp;;12346;;;,udp;12346;;;;]
+7002 AppStore:[tcp;;80;iosapps.itunes.apple.com;;]
+7003 samba共享:[tcp;;445;;;]
+7004 ftp文件传输:[tcp;;21;;;]