diff --git a/package/ctcgfw/oaf/Makefile b/package/ctcgfw/oaf/Makefile old mode 100644 new mode 100755 index 3cd46611a4..f0725ce9ee --- a/package/ctcgfw/oaf/Makefile +++ b/package/ctcgfw/oaf/Makefile @@ -10,9 +10,8 @@ include $(INCLUDE_DIR)/package.mk PKG_AUTOLOAD:=oaf define KernelPackage/oaf - SECTION:=Kernel - CATEGORY:=Kernel modules - SUBMENU:=Netfilter Extensions + SECTION:=Derry Apps + CATEGORY:=Derry Apps TITLE:=open app filter kernel module FILES:=$(PKG_BUILD_DIR)/oaf.ko KCONFIG:= diff --git a/package/ctcgfw/oaf/src/Makefile b/package/ctcgfw/oaf/src/Makefile old mode 100644 new mode 100755 diff --git a/package/ctcgfw/oaf/src/af_utils.c b/package/ctcgfw/oaf/src/af_utils.c old mode 100644 new mode 100755 diff --git a/package/ctcgfw/oaf/src/af_utils.h b/package/ctcgfw/oaf/src/af_utils.h old mode 100644 new mode 100755 diff --git a/package/ctcgfw/oaf/src/app_filter.c b/package/ctcgfw/oaf/src/app_filter.c old mode 100644 new mode 100755 index b4587c8e54..0a502fab6f --- a/package/ctcgfw/oaf/src/app_filter.c +++ b/package/ctcgfw/oaf/src/app_filter.c @@ -11,6 +11,7 @@ #include #include #include +#include #include #include #include @@ -36,7 +37,8 @@ DEFINE_RWLOCK(af_feature_lock); #define feature_list_read_unlock() read_unlock_bh(&af_feature_lock); #define feature_list_write_lock() write_lock_bh(&af_feature_lock); #define feature_list_write_unlock() write_unlock_bh(&af_feature_lock); - +// 注意有重传报文 +#define MAX_PARSE_PKT_NUM 16 #define MIN_HTTP_DATA_LEN 16 #define MAX_APP_NAME_LEN 64 #define MAX_FEATURE_NUM_PER_APP 16 @@ -771,6 +773,7 @@ int app_filter_match(flow_info_t *flow) return AF_FALSE; } +#define APP_FILTER_DROP_BITS 0xf0000000 /* 在netfilter框架注册的钩子 */ @@ -786,24 +789,57 @@ static u_int32_t app_filter_hook(unsigned int hook, const struct net_device *out, int (*okfn)(struct sk_buff *)){ #endif + unsigned long long total_packets = 0; + flow_info_t flow; // 4.10-->4.11 nfct-->_nfct #if LINUX_VERSION_CODE >= KERNEL_VERSION(4,11,0) struct nf_conn *ct = (struct nf_conn *)skb->_nfct; #else struct nf_conn *ct = (struct nf_conn *)skb->nfct; #endif + if (ct == NULL) { //AF_ERROR("ct is null\n"); return NF_ACCEPT; } - flow_info_t flow; + +#if defined(CONFIG_NF_CONNTRACK_MARK) + if (ct->mark != 0) + if (APP_FILTER_DROP_BITS == (ct->mark & APP_FILTER_DROP_BITS)){ + return NF_DROP; + } +#endif +// 3.12.74-->3.13-rc1 +#if LINUX_VERSION_CODE >= KERNEL_VERSION(3,13,0) + struct nf_conn_acct *acct; + acct = nf_conn_acct_find(ct); + if (!acct) + return NF_ACCEPT; + total_packets = (unsigned long long)atomic64_read(&acct->counter[IP_CT_DIR_ORIGINAL].packets) + + (unsigned long long)atomic64_read(&acct->counter[IP_CT_DIR_REPLY].packets); +#else + struct nf_conn_counter *counter; + counter = nf_conn_acct_find(ct); + if (!counter) + return NF_ACCEPT; + total_packets = (unsigned long long)atomic64_read(&counter[IP_CT_DIR_ORIGINAL].packets) + + (unsigned long long)atomic64_read(&counter[IP_CT_DIR_REPLY].packets); +#endif + if (total_packets > MAX_PARSE_PKT_NUM){ + return NF_ACCEPT; + } memset((char *)&flow, 0x0, sizeof(flow_info_t)); parse_flow_base(skb, &flow); parse_http_proto(&flow); parse_https_proto(&flow); //dump_flow_info(&flow); - if (app_filter_match(&flow)) + if (app_filter_match(&flow)){ + +#if defined(CONFIG_NF_CONNTRACK_MARK) + ct->mark |= APP_FILTER_DROP_BITS; +#endif return NF_DROP; + } return NF_ACCEPT; } diff --git a/package/ctcgfw/oaf/src/app_filter.h b/package/ctcgfw/oaf/src/app_filter.h old mode 100644 new mode 100755 diff --git a/package/ctcgfw/oaf/src/app_filter_config.c b/package/ctcgfw/oaf/src/app_filter_config.c old mode 100644 new mode 100755 diff --git a/package/ctcgfw/oaf/src/app_filter_feature.c b/package/ctcgfw/oaf/src/app_filter_feature.c old mode 100644 new mode 100755 diff --git a/package/ctcgfw/oaf/src/cJSON.c b/package/ctcgfw/oaf/src/cJSON.c old mode 100644 new mode 100755 diff --git a/package/ctcgfw/oaf/src/cJSON.h b/package/ctcgfw/oaf/src/cJSON.h old mode 100644 new mode 100755 diff --git a/package/ctcgfw/oaf/src/regexp.c b/package/ctcgfw/oaf/src/regexp.c old mode 100644 new mode 100755 diff --git a/package/ctcgfw/open-app-filter/Makefile b/package/ctcgfw/open-app-filter/Makefile old mode 100644 new mode 100755 index d4a6cb484a..a9a495dc86 --- a/package/ctcgfw/open-app-filter/Makefile +++ b/package/ctcgfw/open-app-filter/Makefile @@ -11,8 +11,8 @@ include $(INCLUDE_DIR)/package.mk #include $(INCLUDE_DIR)/kernel.mk define Package/appfilter - SECTION:=net - CATEGORY:=Network + SECTION:=Derry Apps + CATEGORY:=Derry Apps TITLE:=App filter userspace module endef diff --git a/package/ctcgfw/open-app-filter/files/feature.cfg b/package/ctcgfw/open-app-filter/files/feature.cfg index 5b4bb762ec..83c8ac0be7 100755 --- a/package/ctcgfw/open-app-filter/files/feature.cfg +++ b/package/ctcgfw/open-app-filter/files/feature.cfg @@ -31,6 +31,7 @@ 3013 YY:[udp;;;;;02:00|03:00|04:08,udp;;;;;00:4f|01:00|02:00] 3014 濡╁獨鐩存挱:[tcp;;;guojiang.tv;;] 3015 鑿犺悵鐩存挱:[tcp;;;;;00:03|01:00|02:00|03:00] +3016 鑺掓灉tv:[tcp;;443;mgtv;;,tcp;;80;mgtv;;,tcp;;443;hitv;;] #class shopping 4001 娣樺疂:[tcp;;;taobao;;,tcp;;;alicdn.com;;,tcp;;;tmall.com;;,tcp;;;;;00:d3|01:00,,tcp;;;;;00:d4|01:00,,tcp;;;;;00:d3|01:00] @@ -54,3 +55,9 @@ 6005 鍚屽煄鎬ヨ仒:[tcp;;;xiaomei;;] 6006 棰嗚嫳:[tcp;;;linkedin;;] 6007 鏂楃背:[tcp;;;doumi;;] + +#class download +7001 杩呴浄:[udp;12345;;;;,udp;15000;;;;,tcp;;54321;;;,tcp;;12345;;;,udp;6881;;;;,tcp;;;xunlei.com;;,tcp;;;sandai;;,udp;;8000;;;,udp;;12346;;;,udp;12346;;;;] +7002 AppStore:[tcp;;80;iosapps.itunes.apple.com;;] +7003 samba鍏变韩:[tcp;;445;;;] +7004 ftp鏂囦欢浼犺緭:[tcp;;21;;;]