OpenAppFilter: sync with upstream source
This commit is contained in:
CN_SZTL
parent
5213ce7da2
commit
bce94a2709
@ -36,7 +36,7 @@ function get_hostname_by_mac(dst_mac)
|
||||
end
|
||||
|
||||
function get_app_name_by_id(appid)
|
||||
local class_fd = io.popen("find /etc/appfilter/ -type f -name *.class |xargs cat |grep "..appid.."|awk '{print $2}'")
|
||||
local class_fd = io.popen("find /tmp/appfilter/ -type f -name *.class |xargs cat |grep "..appid.."|awk '{print $2}'")
|
||||
if class_fd then
|
||||
local name = class_fd:read("*l")
|
||||
class_fd:close()
|
||||
|
||||
@ -30,7 +30,7 @@ s.anonymous = true
|
||||
s.addremove = false
|
||||
|
||||
|
||||
local class_fd = io.popen("find /etc/appfilter/ -type f -name '*.class'")
|
||||
local class_fd = io.popen("find /tmp/appfilter/ -type f -name '*.class'")
|
||||
if class_fd then
|
||||
while true do
|
||||
local apps
|
||||
|
||||
@ -7,20 +7,21 @@ table.imagetable {
|
||||
border-color: #999999;
|
||||
border-collapse: collapse;
|
||||
}
|
||||
<!--
|
||||
table.imagetable th {
|
||||
background:#b5cfd2 url('cell-blue.jpg');
|
||||
border-width: 1px;
|
||||
padding: 8px;
|
||||
background:#f5f5f5
|
||||
border-width: 0px;
|
||||
padding: 5px;
|
||||
border-style: solid;
|
||||
border-color: #999999;
|
||||
}
|
||||
table.imagetable td {
|
||||
background:#dcddc0 url('cell-grey.jpg');
|
||||
border-width: 1px;
|
||||
padding: 8px;
|
||||
background:#ffffffff
|
||||
border-width: 0px;
|
||||
padding: 5px;
|
||||
border-style: solid;
|
||||
border-color: #999999;
|
||||
}
|
||||
}-->
|
||||
</style>
|
||||
<script type="text/javascript">//<![CDATA[
|
||||
|
||||
|
||||
@ -21,6 +21,7 @@
|
||||
#include "af_client.h"
|
||||
#include "af_client_fs.h"
|
||||
#include "af_log.h"
|
||||
#include "af_utils.h"
|
||||
|
||||
DEFINE_RWLOCK(af_client_lock);
|
||||
|
||||
@ -146,6 +147,50 @@ void check_client_expire(void)
|
||||
AF_CLIENT_UNLOCK_W();
|
||||
}
|
||||
|
||||
#define MAX_EXPIRED_VISIT_INFO_COUNT 10
|
||||
void flush_expired_visit_info(af_client_info_t *node)
|
||||
{
|
||||
int i;
|
||||
int count = 0;
|
||||
u_int32_t cur_timep = 0;
|
||||
int timeout = 0;
|
||||
cur_timep = af_get_timestamp_sec();
|
||||
for (i = 0; i < MAX_RECORD_APP_NUM; i++){
|
||||
if (node->visit_info[i].app_id == 0){
|
||||
return;
|
||||
}
|
||||
}
|
||||
for (i = 0; i < MAX_RECORD_APP_NUM; i++){
|
||||
if (count >= MAX_EXPIRED_VISIT_INFO_COUNT)
|
||||
break;
|
||||
|
||||
if (node->visit_info[i].total_num > 3){
|
||||
timeout = 180;
|
||||
}
|
||||
else{
|
||||
timeout = 60;
|
||||
}
|
||||
|
||||
if (cur_timep - node->visit_info[i].latest_time > timeout){
|
||||
// ³¬Ê±Çå³ý¼Ç¼
|
||||
memset(&node->visit_info[i], 0x0, sizeof(app_visit_info_t));
|
||||
count++;
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
void af_visit_info_timer_handle(void){
|
||||
af_client_info_t *node;
|
||||
int i;
|
||||
AF_CLIENT_LOCK_W();
|
||||
for (i = 0; i < MAX_AF_CLIENT_HASH_SIZE; i++){
|
||||
list_for_each_entry(node, &af_client_list_table[i], hlist) {
|
||||
flush_expired_visit_info(node);
|
||||
}
|
||||
}
|
||||
AF_CLIENT_UNLOCK_W();
|
||||
}
|
||||
static inline int get_packet_dir(struct net_device *in)
|
||||
{
|
||||
if (0 == strncmp(in->name, "br", 2)){
|
||||
|
||||
@ -30,7 +30,7 @@ enum NFC_PKT_DIR{
|
||||
|
||||
|
||||
#define MAX_VISIT_HISTORY_TIME 24
|
||||
#define MAX_RECORD_APP_NUM 32
|
||||
#define MAX_RECORD_APP_NUM 64
|
||||
|
||||
|
||||
typedef struct app_visit_info{
|
||||
@ -62,4 +62,8 @@ int af_client_init(void);
|
||||
void af_client_exit(void);
|
||||
af_client_info_t * find_af_client_by_ip(unsigned int ip);
|
||||
|
||||
void check_client_expire(void);
|
||||
|
||||
void af_visit_info_timer_handle(void);
|
||||
|
||||
#endif
|
||||
|
||||
@ -130,7 +130,9 @@ static int af_client_seq_show(struct seq_file *s, void *v)
|
||||
|
||||
for(i = 0; i < MAX_RECORD_APP_NUM; i++){
|
||||
if(node->visit_info[i].app_id == 0)
|
||||
break;
|
||||
continue;
|
||||
if(node->visit_info[i].total_num < 3)
|
||||
continue;
|
||||
cJSON *visit_obj = cJSON_CreateObject();
|
||||
cJSON_AddNumberToObject(visit_obj, "appid", node->visit_info[i].app_id);
|
||||
cJSON_AddNumberToObject(visit_obj, "latest_action", node->visit_info[i].latest_action);
|
||||
|
||||
@ -8,6 +8,9 @@
|
||||
#include "af_log.h"
|
||||
int af_log_lvl = 1;
|
||||
int af_test_mode = 0;
|
||||
// todo: rename af_log.c
|
||||
int g_oaf_enable __read_mostly = 0;
|
||||
|
||||
/*
|
||||
cat /proc/sys/oaf/debug
|
||||
*/
|
||||
@ -26,6 +29,13 @@ static struct ctl_table oaf_table[] = {
|
||||
.mode = 0666,
|
||||
.proc_handler = proc_dointvec,
|
||||
},
|
||||
{
|
||||
.procname = "enable",
|
||||
.data = &g_oaf_enable,
|
||||
.maxlen = sizeof(int),
|
||||
.mode = 0666,
|
||||
.proc_handler = proc_dointvec,
|
||||
},
|
||||
{
|
||||
}
|
||||
};
|
||||
|
||||
@ -6,6 +6,19 @@
|
||||
#include <linux/string.h>
|
||||
#include <linux/version.h>
|
||||
#include "af_utils.h"
|
||||
u_int32_t af_get_timestamp_sec(void)
|
||||
{
|
||||
#if LINUX_VERSION_CODE >= KERNEL_VERSION(4,17,0)
|
||||
struct timespec64 ts;
|
||||
ktime_get_ts64(&ts);
|
||||
return (u_int32_t)ts.tv_sec;
|
||||
#else
|
||||
struct timespec ts;
|
||||
ts = current_kernel_time();
|
||||
return ts.tv_sec;
|
||||
#endif
|
||||
|
||||
}
|
||||
|
||||
int check_local_network_ip(unsigned int ip)
|
||||
{
|
||||
|
||||
@ -1,5 +1,6 @@
|
||||
#ifndef AF_UTILS_H
|
||||
#define AF_UTILS_H
|
||||
u_int32_t af_get_timestamp_sec(void);
|
||||
|
||||
int check_local_network_ip(unsigned int ip);
|
||||
|
||||
|
||||
@ -707,22 +707,21 @@ int app_filter_match(flow_info_t *flow)
|
||||
}
|
||||
|
||||
#define APP_FILTER_DROP_BITS 0xf0000000
|
||||
u_int32_t af_get_timestamp_sec(void)
|
||||
{
|
||||
#if LINUX_VERSION_CODE >= KERNEL_VERSION(4,17,0)
|
||||
struct timespec64 ts;
|
||||
ktime_get_ts64(&ts);
|
||||
return (u_int32_t)ts.tv_sec;
|
||||
#else
|
||||
struct timespec ts;
|
||||
ts = current_kernel_time();
|
||||
return ts.tv_sec;
|
||||
#endif
|
||||
|
||||
|
||||
|
||||
static int af_get_visit_index(af_client_info_t *node, int app_id){
|
||||
int i;
|
||||
for(i = 0; i < MAX_RECORD_APP_NUM; i++){
|
||||
if(node->visit_info[i].app_id == app_id || node->visit_info[i].app_id == 0){
|
||||
return i;
|
||||
}
|
||||
}
|
||||
// default 0
|
||||
return 0;
|
||||
}
|
||||
|
||||
|
||||
|
||||
int __af_update_client_app_info(flow_info_t *flow, af_client_info_t *node)
|
||||
{
|
||||
int i;
|
||||
@ -734,38 +733,13 @@ int __af_update_client_app_info(flow_info_t *flow, af_client_info_t *node)
|
||||
AF_INFO("%s %d visit_app_num = %d\n", __func__, __LINE__, node->visit_app_num);
|
||||
int found = 0;
|
||||
|
||||
for(i = 0; i < MAX_RECORD_APP_NUM; i++){
|
||||
if(node->visit_info[i].app_id == flow->app_id){
|
||||
index = i;
|
||||
found = 1;
|
||||
break;
|
||||
}
|
||||
if(node->visit_info[i].app_id == 0)
|
||||
break;
|
||||
}
|
||||
index = af_get_visit_index(node, flow->app_id);
|
||||
|
||||
if(!found){
|
||||
index = 0;
|
||||
//超过最大个数，查询最老的
|
||||
for(i = 0; i < MAX_RECORD_APP_NUM; i++){
|
||||
if(node->visit_info[i].latest_time == 0){
|
||||
index = i;
|
||||
break;
|
||||
}
|
||||
if(node->visit_info[i].latest_time < node->visit_info[index].latest_time){
|
||||
// 清除之前的数据
|
||||
node->visit_info[i].total_num = 0;
|
||||
node->visit_info[i].drop_num = 0;
|
||||
index = i;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
if(index < 0 || index >= MAX_RECORD_APP_NUM){
|
||||
AF_ERROR("invalid index:%d\n\n", index);
|
||||
return 0;
|
||||
}
|
||||
|
||||
node->visit_info[index].total_num++;
|
||||
if(flow->drop)
|
||||
node->visit_info[index].drop_num++;
|
||||
@ -820,6 +794,9 @@ static u_int32_t app_filter_hook(unsigned int hook,
|
||||
#else
|
||||
struct nf_conn *ct = (struct nf_conn *)skb->nfct;
|
||||
#endif
|
||||
if (!g_oaf_enable){
|
||||
return NF_ACCEPT;
|
||||
}
|
||||
if(ct == NULL) {
|
||||
return NF_ACCEPT;
|
||||
}
|
||||
@ -922,6 +899,31 @@ void TEST_cJSON(void)
|
||||
}
|
||||
|
||||
|
||||
struct timer_list oaf_timer;
|
||||
|
||||
#define OAF_TIMER_INTERVAL 15
|
||||
static void oaf_timer_func(unsigned long ptr)
|
||||
{
|
||||
// check_client_expire();
|
||||
af_visit_info_timer_handle();
|
||||
mod_timer(&oaf_timer, jiffies + OAF_TIMER_INTERVAL * HZ);
|
||||
}
|
||||
|
||||
|
||||
void init_oaf_timer(void)
|
||||
{
|
||||
setup_timer(&oaf_timer, oaf_timer_func, OAF_TIMER_INTERVAL * HZ);
|
||||
mod_timer(&oaf_timer, jiffies + OAF_TIMER_INTERVAL * HZ);
|
||||
AF_INFO("init oaf timer...ok");
|
||||
}
|
||||
|
||||
void fini_port_timer(void)
|
||||
{
|
||||
del_timer_sync(&oaf_timer);
|
||||
AF_INFO("del oaf timer...ok");
|
||||
}
|
||||
|
||||
|
||||
/*
|
||||
Ä£¿é³õʼ»¯
|
||||
*/
|
||||
@ -940,6 +942,8 @@ static int __init app_filter_init(void)
|
||||
#else
|
||||
nf_register_hooks(app_filter_ops, ARRAY_SIZE(app_filter_ops));
|
||||
#endif
|
||||
init_oaf_timer();
|
||||
|
||||
AF_INFO("init app filter ........ok\n");
|
||||
return 0;
|
||||
}
|
||||
@ -950,6 +954,7 @@ static int __init app_filter_init(void)
|
||||
static void app_filter_fini(void)
|
||||
{
|
||||
AF_INFO("app filter module exit\n");
|
||||
fini_port_timer();
|
||||
#if LINUX_VERSION_CODE >= KERNEL_VERSION(4,13,0)
|
||||
nf_unregister_net_hooks(&init_net, app_filter_ops, ARRAY_SIZE(app_filter_ops));
|
||||
#else
|
||||
|
||||
@ -112,4 +112,6 @@ void af_init_app_status(void);
|
||||
int af_get_app_status(int appid);
|
||||
int regexp_match(char *reg, char *text);
|
||||
|
||||
extern int g_oaf_enable;
|
||||
|
||||
#endif
|
||||
|
||||
@ -33,16 +33,20 @@ load_rule()
|
||||
config_get enable "global" enable
|
||||
echo "enable = $enable"
|
||||
if [ x"$enable" != x"1" ];then
|
||||
echo "appfilter is disabled"
|
||||
return 0
|
||||
fi
|
||||
echo "appfilter is disabled"
|
||||
echo 0 >/proc/sys/oaf/enable>/dev/null
|
||||
return 0
|
||||
else
|
||||
insmod oaf >/dev/null
|
||||
echo 1 >/proc/sys/oaf/enable
|
||||
fi
|
||||
echo "appfilter is enabled"
|
||||
json_add_int "op" 1
|
||||
|
||||
json_add_object "data"
|
||||
json_add_array "apps"
|
||||
|
||||
for file in `ls /etc/appfilter/*.class`
|
||||
for file in `ls /tmp/appfilter/*.class`
|
||||
do
|
||||
class_name=`echo "$file" | awk -F/ '{print $4}'| awk -F. '{print $1}'`
|
||||
config_get appid_list "appfilter" "${class_name}apps"
|
||||
|
||||
@ -10,6 +10,7 @@
|
||||
2001 王者荣耀:[tcp;;;;;00:33|01:66|02:00|03:09,udp;;;;;00:01|01:02|02:00|03:00]
|
||||
2002 和平精英:[tcp;;;;;00:43|1:66|02:aa,tcp;;;;;00:33|1:66|03:0a|05:0a|,tcp;;;;;00:01|1:00|02:00,udp;;;;;00:59|01:ad|03:45|05:e4,udp;;;;;00:b9|01:5d|03:39|05:77]
|
||||
2003 英雄联盟:[udp;;;;;44:00|45:00|46:00|47:02]
|
||||
2015 我的世界:[tcp;;443;g79mclobt.nie.netease;;]
|
||||
2004 荒野行动:[udp;;;;;00:05|01:09,tcp;;;;;00:02|01:00|02:00|03:00]
|
||||
2005 欢乐斗地主:[tcp;;8000;;;00:74|01:67|02:77|03:5f]
|
||||
2006 梦幻西游:[tcp;;;;;00:0e|01:00|02:fe|03:ff]
|
||||
|
||||
@ -2,20 +2,18 @@
|
||||
|
||||
f_file=$1
|
||||
test -z "$f_file" && return
|
||||
|
||||
test -d /tmp/appfilter && return
|
||||
cur_class=""
|
||||
cur_class_file=""
|
||||
mkdir /tmp/appfilter
|
||||
while read line
|
||||
do
|
||||
echo "$line"| grep "^#class"
|
||||
if [ $? -eq 0 ];then
|
||||
# echo "match $line"
|
||||
# echo "cur_class=$cur_class"
|
||||
class=`echo $line| grep '#class' | awk '{print $2}'`
|
||||
if ! test -z "$class";then
|
||||
# echo "class=$class"
|
||||
cur_class=$class
|
||||
cur_class_file="/etc/appfilter/${cur_class}.class"
|
||||
cur_class_file="/tmp/appfilter/${cur_class}.class"
|
||||
if [ -e "$cur_class_file" ];then
|
||||
rm $cur_class_file
|
||||
fi
|
||||
|
||||
Loading…
Reference in New Issue
Block a user