Skip to content

Commit

Permalink
update filter
Browse files Browse the repository at this point in the history
  • Loading branch information
zhengyuli committed May 11, 2015
1 parent 5d62cf1 commit c162cdf
Show file tree
Hide file tree
Showing 5 changed files with 61 additions and 52 deletions.
37 changes: 19 additions & 18 deletions src/app_service/app_service_manager.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -16,13 +16,10 @@

/* AppService padding filter */
#define APP_SERVICE_PADDING_BPF_FILTER "icmp"
/* AppService ip fragment filter */
#define APP_SERVICE_IP_FRAGMENT_BPF_FILTER \
"(tcp and (ip[6] & 0x20 != 0 or (ip[6] & 0x20 = 0 and ip[6:2] & 0x1fff != 0)))"
/* AppService filter */
#define APP_SERVICE_BPF_FILTER "(ip host %s and (tcp port %u or %s)) or "
#define APP_SERVICE_BPF_FILTER "ip host %s or "
/* AppService filter length */
#define APP_SERVICE_BPF_FILTER_LENGTH 256
#define APP_SERVICE_BPF_FILTER_LENGTH 64

/* AppService master hash table rwlock */
static pthread_rwlock_t appServiceHashTableMasterRWLock;
Expand Down Expand Up @@ -131,7 +128,7 @@ getFilterForEachAppService (void *data, void *args) {

len = strlen (filter);
snprintf (filter + len, APP_SERVICE_BPF_FILTER_LENGTH, APP_SERVICE_BPF_FILTER,
appSvc->ip, appSvc->port, APP_SERVICE_IP_FRAGMENT_BPF_FILTER);
appSvc->ip);
return 0;
}

Expand All @@ -147,7 +144,7 @@ getAppServicesFilter (void) {
int ret;
u_int svcNum;
char *filter;
u_int filterLen;
u_int filterLen, len;

pthread_rwlock_rdlock (&appServiceHashTableMasterRWLock);

Expand All @@ -161,17 +158,21 @@ getAppServicesFilter (void) {
}
memset (filter, 0, filterLen);

ret = hashLoopDo (appServiceHashTableMaster, getFilterForEachAppService, filter);
if (ret < 0) {
if (svcNum) {
strcat (filter, "((");
ret = hashLoopDo (appServiceHashTableMaster, getFilterForEachAppService, filter);
if (ret < 0) {
pthread_rwlock_unlock (&appServiceHashTableMasterRWLock);
LOGE ("Get BPF filter from each appService error.\n");
free (filter);
return NULL;
}
pthread_rwlock_unlock (&appServiceHashTableMasterRWLock);
LOGE ("Get BPF filter from each appService error.\n");
free (filter);
return NULL;
}

pthread_rwlock_unlock (&appServiceHashTableMasterRWLock);

strcat (filter, APP_SERVICE_PADDING_BPF_FILTER);
len = strlen (filter);
snprintf (filter + len - 4, 32, ") and tcp) or icmp");
} else
strcat (filter, APP_SERVICE_PADDING_BPF_FILTER);

return filter;
}
Expand Down Expand Up @@ -701,7 +702,7 @@ syncAppServicesCache (void) {
if (ret < 0 || ret != strlen (appSvcsStr))
LOGE ("Dump to appServices cache file error.\n");
else
LOGD ("Sync appServices cache success:\n%s\n", appSvcsStr);
LOGI ("Sync appServices cache success:\n%s\n", appSvcsStr);

close (fd);
free (appSvcsStr);
Expand Down Expand Up @@ -747,7 +748,7 @@ syncAppServicesBlacklistCache (void) {
if (ret < 0 || ret != strlen (appSvcsStr))
LOGE ("Dump to appServices blacklist cache file error.\n");
else
LOGD ("Sync appServices blacklist cache success:\n%s\n", appSvcsStr);
LOGI ("Sync appServices blacklist cache success:\n%s\n", appSvcsStr);

close (fd);
free (appSvcsStr);
Expand Down
8 changes: 5 additions & 3 deletions src/proto_detection/proto_detect_service.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -89,6 +89,9 @@ protoDetectService (void *args) {
goto exit;
}

/* Display task schedule policy info */
displayTaskSchedPolicyInfo ("ProtoDetectService");

pcapDev = getNetDevPcapDescForProtoDetection ();
datalinkType = getNetDevDatalinkTypeForProtoDetection ();
topologyEntrySendSock = getTopologyEntrySendSock ();
Expand All @@ -102,7 +105,7 @@ protoDetectService (void *args) {
}

/* Init ip context */
ret = initIpContext ();
ret = initIpContext (True);
if (ret < 0) {
LOGE ("Init ip context error.\n");
goto destroyLogContext;
Expand Down Expand Up @@ -157,8 +160,7 @@ protoDetectService (void *args) {
ret = ipDefragProcess (iph, &captureTime, &newIphdr);
if (ret < 0)
LOGE ("Ip packet defragment error.\n");

if (newIphdr) {
else if (newIphdr) {
switch (newIphdr->ipProto) {
/* Tcp packet process */
case IPPROTO_TCP:
Expand Down
59 changes: 33 additions & 26 deletions src/protocol/ip_packet.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -30,6 +30,9 @@ static __thread listHead ipQueueExpireTimeoutList;
/* Ip host fragment hash table */
static __thread hashTablePtr ipQueueHashTable = NULL;

/* Ip process purpose, for proto analysis or detect */
static __thread boolean doProtoDetect = False;

static void
displayIphdr (iphdrPtr iph) {
u_short offset, flags;
Expand All @@ -51,6 +54,28 @@ displayIphdr (iphdrPtr iph) {
(iph->iphLen * 4), ntohs (iph->ipLen), offset, ((flags & IP_MF) ? 1 : 0));
}

/* Check ip packet to drop */
static boolean
ipPktShouldDrop (iphdrPtr iph) {
tcphdrPtr tcph;
char ipSrcStr [16], ipDestStr [16];

if (iph->ipProto == IPPROTO_TCP) {
tcph = (tcphdrPtr) ((u_char *) iph + (iph->iphLen * 4));

inet_ntop (AF_INET, (void *) &iph->ipSrc, ipSrcStr, sizeof (ipSrcStr));
inet_ntop (AF_INET, (void *) &iph->ipDest, ipDestStr, sizeof (ipDestStr));

if (getAppServiceProtoAnalyzer (ipSrcStr, ntohs (tcph->source)) ||
getAppServiceProtoAnalyzer (ipDestStr, ntohs (tcph->dest)))
return False;
else
return True;
}

return False;
}

static ipFragPtr
newIpFrag (iphdrPtr iph) {
u_short iphLen, ipLen, offset, end;
Expand Down Expand Up @@ -316,27 +341,6 @@ checkIpHeader (iphdrPtr iph) {
return 0;
}

/* Check whether ip packet should be dropped */
static boolean
ipPktShouldDrop (iphdrPtr iph) {
tcphdrPtr tcph;
char ipSrcStr [16], ipDestStr [16];

if (iph->ipProto == IPPROTO_TCP) {
tcph = (tcphdrPtr) ((u_char *) iph + (iph->iphLen * 4));

inet_ntop (AF_INET, (void *) &iph->ipSrc, ipSrcStr, sizeof (ipSrcStr));
inet_ntop (AF_INET, (void *) &iph->ipDest, ipDestStr, sizeof (ipDestStr));

if (getAppServiceProtoAnalyzer (ipSrcStr, ntohs (tcph->source)) ||
getAppServiceProtoAnalyzer (ipDestStr, ntohs (tcph->dest)))
return False;
else
return True;
} else
return True;
}

/**
* @brief Ip packet defragment processor.
*
Expand Down Expand Up @@ -381,7 +385,10 @@ ipDefragProcess (iphdrPtr iph, timeValPtr tm, iphdrPtr *newIph) {
if ((flags & IP_MF) == 0 && offset == 0) {
if (ipq)
delIpQueueFromHash (ipq);
*newIph = iph;
if (!doProtoDetect && ipPktShouldDrop (iph))
*newIph = NULL;
else
*newIph = iph;
return 0;
}

Expand Down Expand Up @@ -479,13 +486,11 @@ ipDefragProcess (iphdrPtr iph, timeValPtr tm, iphdrPtr *newIph) {
return -1;
} else {
displayIphdr (tmpIph);

if (ipPktShouldDrop (tmpIph)) {
if (!doProtoDetect && ipPktShouldDrop (tmpIph)) {
free (tmpIph);
*newIph = NULL;
} else
*newIph = tmpIph;

return 0;
}
} else {
Expand All @@ -504,7 +509,9 @@ resetIpContext (void) {

/* Init ip context */
int
initIpContext (void) {
initIpContext (boolean protoDetectFlag) {
doProtoDetect = protoDetectFlag;

initListHead (&ipQueueExpireTimeoutList);

ipQueueHashTable = hashNew (DEFAULT_IPQUEUE_HASH_TABLE_SIZE);
Expand Down
2 changes: 1 addition & 1 deletion src/protocol/ip_packet.h
View file
Original file line number Diff line number Diff line change
Expand Up @@ -47,7 +47,7 @@ ipDefragProcess (iphdrPtr iph, timeValPtr tm, iphdrPtr *newIph);
int
resetIpContext (void);
int
initIpContext (void);
initIpContext (boolean protoDetectFlag);
void
destroyIpContext (void);
/*=======================Interfaces definition end=========================*/
Expand Down
7 changes: 3 additions & 4 deletions src/protocol/ip_process_service.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -171,7 +171,7 @@ ipProcessService (void *args) {
ipPktRecvSock = getIpPktRecvSock ();

/* Init ip context */
ret = initIpContext ();
ret = initIpContext (False);
if (ret < 0) {
LOGE ("Init ip context error.\n");
goto destroyLogContext;
Expand Down Expand Up @@ -212,10 +212,9 @@ ipProcessService (void *args) {
ret = ipDefragProcess (iph, tm, &newIph);
if (ret < 0)
LOGE ("Ip packet defragment error.\n");

if (newIph) {
else if (newIph) {
switch (newIph->ipProto) {
/* Tcp packet dispatch */
/* Tcp packet dispatch */
case IPPROTO_TCP:
tcpPacketDispatch (newIph, tm);
break;
Expand Down

0 comments on commit c162cdf

Please sign in to comment.