1/* -------------------------------------------------------------------------------------------------------------- 2 * FILE NAME l7_filter_main.c (for Linux Platform) 3 * DATE 10/25/2007 4 * AUTHOR/S Max Ding 5 * Description Layer 7 filter 6 * -------------------------------------------------------------------------------------------------------------- 7 */ 8 9//MODULE_AUTHOR("Matthew Strait <quadong@users.sf.net>, Ethan Sommer <sommere@users.sf.net>"); 10//MODULE_LICENSE("GPL"); 11//MODULE_DESCRIPTION("application layer match module"); 12 13/*******include start*******/ 14#ifdef __LINUX__ 15#include <linux/module.h> 16#include <linux/if.h> 17#include <linux/types.h> 18#include <linux/in.h> 19#include <linux/ip.h> 20#include <linux/skbuff.h> 21#include <linux/acosnatfw.h> 22#include <linux/netdevice.h> 23#include <linux/inetdevice.h> 24#include <linux/mm.h> 25 26#ifdef CONFIG_NETFILTER 27#include <linux/netfilter.h> 28#include <linux/netfilter_ipv4.h> 29#endif /* CONFIG_NETFILTER */ 30 31#include "bcmnvram.h" 32#endif /* __LINUX__ */ 33 34/* #define L7_DEBUG_ON */ 35 36#include "regexp/regexp.c" 37#include "l7_filter_main.h" 38 39/*******define start*******/ 40#ifdef L7_DEBUG_ON 41#define L7_DEBUG_PRI_0 0x00000000 42#define L7_DEBUG_PRI_1 0x00000001 43#define L7_DEBUG_PRI_2 0x00000002 44#define L7_DEBUG_PRI_3 0x00000004 45#define L7_DEBUG_PRI_4 0x00000008 46#define L7_DEBUG_PRI_5 0x00000010 47#define L7_DEBUG_PRI_6 0x00000020 48#define L7_DEBUG_PRI_7 0x00000040 49#define L7_DEBUG_PRI_a 0xffffffff 50#define L7_PRINTK_DEBUG printk 51#define L7_PRINTK_DEBUG_1 if (debug_pri & L7_DEBUG_PRI_1) printk 52#define L7_PRINTK_DEBUG_2 if (debug_pri & L7_DEBUG_PRI_2) printk 53#define L7_PRINTK_DEBUG_3 if (debug_pri & L7_DEBUG_PRI_3) printk 54#define L7_PRINTK_DEBUG_4 if (debug_pri & L7_DEBUG_PRI_4) printk 55#define L7_PRINTK_DEBUG_5 if (debug_pri & L7_DEBUG_PRI_5) printk 56#define L7_PRINTK_DEBUG_6 if (debug_pri & L7_DEBUG_PRI_6) printk 57#define L7_PRINTK_DEBUG_7 if (debug_pri & L7_DEBUG_PRI_7) printk 58 59#else/* else for #ifdef L7_DEBUG_ON */ 60 61#define L7_PRINTK_DEBUG printk 62#define L7_PRINTK_DEBUG_1 printk 63#define L7_PRINTK_DEBUG_2 printk 64#define L7_PRINTK_DEBUG_3 printk 65#define L7_PRINTK_DEBUG_4 printk 66#define L7_PRINTK_DEBUG_5 printk 67#define L7_PRINTK_DEBUG_6 printk 68#define L7_PRINTK_DEBUG_7 printk 69#endif/* end for #ifdef L7_DEBUG_ON */ 70 71/*******global and static variables start*******/ 72#ifdef L7_DEBUG_ON 73static int debug_pri = 0x00000001; 74MODULE_PARM(debug_pri, "i"); 75#endif 76 77/* Number of packets whose data we look at. */ 78static int num_packets = 20; 79 80static char tolower(char c); 81 82/* head of the link list of patterns */ 83static s_pattern_cache * first_pattern_cache = NULL; 84 85#ifdef CONFIG_NETFILTER 86int l7_filter_main(struct sk_buff *skb, int iDirection); 87static unsigned int l7_filter_hook(unsigned int hook, 88 struct sk_buff **skb, 89 const struct net_device *in, 90 const struct net_device *out, 91 int (*okfn)(struct sk_buff *)) 92{ 93 int dir; 94 95 if (hook == NF_IP_PRE_ROUTING) 96 dir = 0; 97 else if (hook == NF_IP_POST_ROUTING) 98 dir = 1; 99 else 100 return NF_ACCEPT; 101 102 local_bh_disable(); 103 l7_filter_main(*skb, dir); 104 local_bh_enable(); 105 106 return NF_ACCEPT; 107} 108 109static struct nf_hook_ops l7_filter_prerouting_ops = { 110#ifdef AG_LINUX_26 111 .owner = THIS_MODULE, 112#else 113 .list = {NULL, NULL}, 114#endif /* AG_LINUX_26 */ 115 .hook = l7_filter_hook, 116 .pf = PF_INET, 117 .hooknum = NF_IP_PRE_ROUTING, 118 .priority = NF_IP_PRI_LAST, 119}; 120static struct nf_hook_ops l7_filter_postrouting_ops = { 121#ifdef AG_LINUX_26 122 .owner = THIS_MODULE, 123#else 124 .list = {NULL, NULL}, 125#endif /* AG_LINUX_26 */ 126 .hook = l7_filter_hook, 127 .pf = PF_INET, 128 .hooknum = NF_IP_POST_ROUTING, 129 .priority = NF_IP_PRI_LAST, 130}; 131#endif /* CONFIG_NETFILTER */ 132 133/* Hard code for all expression of protocol. It's better to read them from *.pat files. */ 134static s_proto_regexp g_all_proto[] = 135{ 136 {"bittorrent", L7_ENUM_BITTORRENT, 0, "^(\\x13bittorrent protocol|azver\\x01$|get /scrape\\?info_hash=)|d1:ad2:id20:|\\x08'7P\\)[RP]"}, 137 {"fasttrack", L7_ENUM_FASTTRACK, 0, "^get (/.download/[ -~]*|/.supernode[ -~]|/.status[ -~]|/.network[ -~]*|/.files|/.hash=[0-9a-f]*/[ -~]*) http/1.1|user-agent: kazaa|x-kazaa(-username|-network|-ip|-supernodeip|-xferid|-xferuid|tag)|^give [0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]?[0-9]?[0-9]?"}, 138 {"edonkey", L7_ENUM_EDONKEY, 0, "^[\\xc5\\xd4\\xe3-\\xe5].?.?.?.?([\\x01\\x02\\x05\\x14\\x15\\x16\\x18\\x19\\x1a\\x1b\\x1c\\x20\\x21\\x32\\x33\\x34\\x35\\x36\\x38\\x40\\x41\\x42\\x43\\x46\\x47\\x48\\x49\\x4a\\x4b\\x4c\\x4d\\x4e\\x4f\\x50\\x51\\x52\\x53\\x54\\x55\\x56\\x57\\x58[\\x60\\x81\\x82\\x90\\x91\\x93\\x96\\x97\\x98\\x99\\x9a\\x9b\\x9c\\x9e\\xa0\\xa1\\xa2\\xa3\\xa4]|\\x59................?[ -~]|\\x96....$)"}, 139 {"gnutella", L7_ENUM_GNUTELLA, 0, "^(gnd[\\x01\\x02]?.?.?\\x01|gnutella connect/[012]\\.[0-9]\\x0d\\x0a|get /uri-res/n2r\\?urn:sha1:|get /.*user-agent: (gtk-gnutella|bearshare|mactella|gnucleus|gnotella|limewire|imesh)|get /.*content-type: application/x-gnutella-packets|giv [0-9]*:[0-9a-f]*/|queue [0-9a-f]* [1-9][0-9]?[0-9]?\\.[1-9][0-9]?[0-9]?\\.[1-9][0-9]?[0-9]?\\.[1-9][0-9]?[0-9]?:[1-9][0-9]?[0-9]?[0-9]?|gnutella.*content-type: application/x-gnutella|...................?lime)"}, 140 {"skypetoskype", L7_ENUM_SKYPETOSKYPE, 0, "^..\\x02............."}, 141 {"skypeout", L7_ENUM_SKYPEOUT, 0, "^(\\x01.?.?.?.?.?.?.?.?\\x01|\\x02.?.?.?.?.?.?.?.?\\x02|\\x03.?.?.?.?.?.?.?.?\\x03|\\x04.?.?.?.?.?.?.?.?\\x04|\\x05.?.?.?.?.?.?.?.?\\x05|\\x06.?.?.?.?.?.?.?.?\\x06|\\x07.?.?.?.?.?.?.?.?\\x07|\\x08.?.?.?.?.?.?.?.?\\x08|\\x09.?.?.?.?.?.?.?.?\\x09|\\x0a.?.?.?.?.?.?.?.?\\x0a|\\x0b.?.?.?.?.?.?.?.?\\x0b|\\x0c.?.?.?.?.?.?.?.?\\x0c|\\x0d.?.?.?.?.?.?.?.?\\x0d|\\x0e.?.?.?.?.?.?.?.?\\x0e|\\x0f.?.?.?.?.?.?.?.?\\x0f|\\x10.?.?.?.?.?.?.?.?\\x10|\\x11.?.?.?.?.?.?.?.?\\x11|\\x12.?.?.?.?.?.?.?.?\\x12\ 142|\\x13.?.?.?.?.?.?.?.?\\x13|\\x14.?.?.?.?.?.?.?.?\\x14|\\x15.?.?.?.?.?.?.?.?\\x15|\\x16.?.?.?.?.?.?.?.?\\x16|\\x17.?.?.?.?.?.?.?.?\\x17|\\x18.?.?.?.?.?.?.?.?\\x18|\\x19.?.?.?.?.?.?.?.?\\x19|\\x1a.?.?.?.?.?.?.?.?\\x1a|\\x1b.?.?.?.?.?.?.?.?\\x1b|\\x1c.?.?.?.?.?.?.?.?\\x1c|\\x1d.?.?.?.?.?.?.?.?\\x1d|\\x1e.?.?.?.?.?.?.?.?\\x1e|\\x1f.?.?.?.?.?.?.?.?\\x1f|\\x20.?.?.?.?.?.?.?.?\\x20|\\x21.?.?.?.?.?.?.?.?\\x21|\\x22.?.?.?.?.?.?.?.?\\x22|\\x23.?.?.?.?.?.?.?.?\\x23|\\$.?.?.?.?.?.?.?.?\\$|\\x25.?.?.?.?.?.?.?.?\\x25\ 143|\\x26.?.?.?.?.?.?.?.?\\x26|\\x27.?.?.?.?.?.?.?.?\\x27|\\(.?.?.?.?.?.?.?.?\\(|\\).?.?.?.?.?.?.?.?\\)|\\*.?.?.?.?.?.?.?.?\\*|\\+.?.?.?.?.?.?.?.?\\+|\\x2c.?.?.?.?.?.?.?.?\\x2c|\\x2d.?.?.?.?.?.?.?.?\\x2d|\\..?.?.?.?.?.?.?.?\\.|\\x2f.?.?.?.?.?.?.?.?\\x2f|\\x30.?.?.?.?.?.?.?.?\\x30|\\x31.?.?.?.?.?.?.?.?\\x31|\\x32.?.?.?.?.?.?.?.?\\x32|\\x33.?.?.?.?.?.?.?.?\\x33|\\x34.?.?.?.?.?.?.?.?\\x34|\\x35.?.?.?.?.?.?.?.?\\x35|\\x36.?.?.?.?.?.?.?.?\\x36|\\x37.?.?.?.?.?.?.?.?\\x37|\\x38.?.?.?.?.?.?.?.?\\x38\ 144|\\x39.?.?.?.?.?.?.?.?\\x39|\\x3a.?.?.?.?.?.?.?.?\\x3a|\\x3b.?.?.?.?.?.?.?.?\\x3b|\\x3c.?.?.?.?.?.?.?.?\\x3c|\\x3d.?.?.?.?.?.?.?.?\\x3d|\\x3e.?.?.?.?.?.?.?.?\\x3e|\\?.?.?.?.?.?.?.?.?\\?|\\x40.?.?.?.?.?.?.?.?\\x40|\\x41.?.?.?.?.?.?.?.?\\x41|\\x42.?.?.?.?.?.?.?.?\\x42|\\x43.?.?.?.?.?.?.?.?\\x43|\\x44.?.?.?.?.?.?.?.?\\x44|\\x45.?.?.?.?.?.?.?.?\\x45|\\x46.?.?.?.?.?.?.?.?\\x46|\\x47.?.?.?.?.?.?.?.?\\x47|\\x48.?.?.?.?.?.?.?.?\\x48|\\x49.?.?.?.?.?.?.?.?\\x49|\\x4a.?.?.?.?.?.?.?.?\\x4a|\\x4b.?.?.?.?.?.?.?.?\\x4b\ 145|\\x4c.?.?.?.?.?.?.?.?\\x4c|\\x4d.?.?.?.?.?.?.?.?\\x4d|\\x4e.?.?.?.?.?.?.?.?\\x4e|\\x4f.?.?.?.?.?.?.?.?\\x4f|\\x50.?.?.?.?.?.?.?.?\\x50|\\x51.?.?.?.?.?.?.?.?\\x51|\\x52.?.?.?.?.?.?.?.?\\x52|\\x53.?.?.?.?.?.?.?.?\\x53|\\x54.?.?.?.?.?.?.?.?\\x54|\\x55.?.?.?.?.?.?.?.?\\x55|\\x56.?.?.?.?.?.?.?.?\\x56|\\x57.?.?.?.?.?.?.?.?\\x57|\\x58.?.?.?.?.?.?.?.?\\x58|\\x59.?.?.?.?.?.?.?.?\\x59|\\x5a.?.?.?.?.?.?.?.?\\x5a|\\[.?.?.?.?.?.?.?.?\\[|\\\\.?.?.?.?.?.?.?.?\\\\|\\].?.?.?.?.?.?.?.?\\]|\\^.?.?.?.?.?.?.?.?\\^\ 146|\\x5f.?.?.?.?.?.?.?.?\\x5f|\\x60.?.?.?.?.?.?.?.?\\x60|\\x61.?.?.?.?.?.?.?.?\\x61|\\x62.?.?.?.?.?.?.?.?\\x62|\\x63.?.?.?.?.?.?.?.?\\x63|\\x64.?.?.?.?.?.?.?.?\\x64|\\x65.?.?.?.?.?.?.?.?\\x65|\\x66.?.?.?.?.?.?.?.?\\x66|\\x67.?.?.?.?.?.?.?.?\\x67|\\x68.?.?.?.?.?.?.?.?\\x68|\\x69.?.?.?.?.?.?.?.?\\x69|\\x6a.?.?.?.?.?.?.?.?\\x6a|\\x6b.?.?.?.?.?.?.?.?\\x6b|\\x6c.?.?.?.?.?.?.?.?\\x6c|\\x6d.?.?.?.?.?.?.?.?\\x6d|\\x6e.?.?.?.?.?.?.?.?\\x6e|\\x6f.?.?.?.?.?.?.?.?\\x6f|\\x70.?.?.?.?.?.?.?.?\\x70|\\x71.?.?.?.?.?.?.?.?\\x71\ 147|\\x72.?.?.?.?.?.?.?.?\\x72|\\x73.?.?.?.?.?.?.?.?\\x73|\\x74.?.?.?.?.?.?.?.?\\x74|\\x75.?.?.?.?.?.?.?.?\\x75|\\x76.?.?.?.?.?.?.?.?\\x76|\\x77.?.?.?.?.?.?.?.?\\x77|\\x78.?.?.?.?.?.?.?.?\\x78|\\x79.?.?.?.?.?.?.?.?\\x79|\\x7a.?.?.?.?.?.?.?.?\\x7a|\\{.?.?.?.?.?.?.?.?\\{|\\|.?.?.?.?.?.?.?.?\\||\\}.?.?.?.?.?.?.?.?\\}|\\x7e.?.?.?.?.?.?.?.?\\x7e|\\x7f.?.?.?.?.?.?.?.?\\x7f|\\x80.?.?.?.?.?.?.?.?\\x80|\\x81.?.?.?.?.?.?.?.?\\x81|\\x82.?.?.?.?.?.?.?.?\\x82|\\x83.?.?.?.?.?.?.?.?\\x83|\\x84.?.?.?.?.?.?.?.?\\x84|\\x85.?.?.?.?.?.?.?.?\\x85\ 148|\\x86.?.?.?.?.?.?.?.?\\x86|\\x87.?.?.?.?.?.?.?.?\\x87|\\x88.?.?.?.?.?.?.?.?\\x88|\\x89.?.?.?.?.?.?.?.?\\x89|\\x8a.?.?.?.?.?.?.?.?\\x8a|\\x8b.?.?.?.?.?.?.?.?\\x8b|\\x8c.?.?.?.?.?.?.?.?\\x8c|\\x8d.?.?.?.?.?.?.?.?\\x8d|\\x8e.?.?.?.?.?.?.?.?\\x8e|\\x8f.?.?.?.?.?.?.?.?\\x8f|\\x90.?.?.?.?.?.?.?.?\\x90|\\x91.?.?.?.?.?.?.?.?\\x91|\\x92.?.?.?.?.?.?.?.?\\x92|\\x93.?.?.?.?.?.?.?.?\\x93|\\x94.?.?.?.?.?.?.?.?\\x94|\\x95.?.?.?.?.?.?.?.?\\x95|\\x96.?.?.?.?.?.?.?.?\\x96|\\x97.?.?.?.?.?.?.?.?\\x97|\\x98.?.?.?.?.?.?.?.?\\x98|\\x99.?.?.?.?.?.?.?.?\\x99\ 149|\\x9a.?.?.?.?.?.?.?.?\\x9a|\\x9b.?.?.?.?.?.?.?.?\\x9b|\\x9c.?.?.?.?.?.?.?.?\\x9c|\\x9d.?.?.?.?.?.?.?.?\\x9d|\\x9e.?.?.?.?.?.?.?.?\\x9e|\\x9f.?.?.?.?.?.?.?.?\\x9f|\\xa0.?.?.?.?.?.?.?.?\\xa0|\\xa1.?.?.?.?.?.?.?.?\\xa1|\\xa2.?.?.?.?.?.?.?.?\\xa2|\\xa3.?.?.?.?.?.?.?.?\\xa3|\\xa4.?.?.?.?.?.?.?.?\\xa4|\\xa5.?.?.?.?.?.?.?.?\\xa5|\\xa6.?.?.?.?.?.?.?.?\\xa6|\\xa7.?.?.?.?.?.?.?.?\\xa7|\\xa8.?.?.?.?.?.?.?.?\\xa8|\\xa9.?.?.?.?.?.?.?.?\\xa9|\\xaa.?.?.?.?.?.?.?.?\\xaa|\\xab.?.?.?.?.?.?.?.?\\xab|\\xac.?.?.?.?.?.?.?.?\\xac|\\xad.?.?.?.?.?.?.?.?\\xad\ 150|\\xae.?.?.?.?.?.?.?.?\\xae|\\xaf.?.?.?.?.?.?.?.?\\xaf|\\xb0.?.?.?.?.?.?.?.?\\xb0|\\xb1.?.?.?.?.?.?.?.?\\xb1|\\xb2.?.?.?.?.?.?.?.?\\xb2|\\xb3.?.?.?.?.?.?.?.?\\xb3|\\xb4.?.?.?.?.?.?.?.?\\xb4|\\xb5.?.?.?.?.?.?.?.?\\xb5|\\xb6.?.?.?.?.?.?.?.?\\xb6|\\xb7.?.?.?.?.?.?.?.?\\xb7|\\xb8.?.?.?.?.?.?.?.?\\xb8|\\xb9.?.?.?.?.?.?.?.?\\xb9|\\xba.?.?.?.?.?.?.?.?\\xba|\\xbb.?.?.?.?.?.?.?.?\\xbb|\\xbc.?.?.?.?.?.?.?.?\\xbc|\\xbd.?.?.?.?.?.?.?.?\\xbd|\\xbe.?.?.?.?.?.?.?.?\\xbe|\\xbf.?.?.?.?.?.?.?.?\\xbf|\\xc0.?.?.?.?.?.?.?.?\\xc0|\\xc1.?.?.?.?.?.?.?.?\\xc1\ 151|\\xc2.?.?.?.?.?.?.?.?\\xc2|\\xc3.?.?.?.?.?.?.?.?\\xc3|\\xc4.?.?.?.?.?.?.?.?\\xc4|\\xc5.?.?.?.?.?.?.?.?\\xc5|\\xc6.?.?.?.?.?.?.?.?\\xc6|\\xc7.?.?.?.?.?.?.?.?\\xc7|\\xc8.?.?.?.?.?.?.?.?\\xc8|\\xc9.?.?.?.?.?.?.?.?\\xc9|\\xca.?.?.?.?.?.?.?.?\\xca|\\xcb.?.?.?.?.?.?.?.?\\xcb|\\xcc.?.?.?.?.?.?.?.?\\xcc|\\xcd.?.?.?.?.?.?.?.?\\xcd|\\xce.?.?.?.?.?.?.?.?\\xce|\\xcf.?.?.?.?.?.?.?.?\\xcf|\\xd0.?.?.?.?.?.?.?.?\\xd0|\\xd1.?.?.?.?.?.?.?.?\\xd1|\\xd2.?.?.?.?.?.?.?.?\\xd2|\\xd3.?.?.?.?.?.?.?.?\\xd3|\\xd4.?.?.?.?.?.?.?.?\\xd4|\\xd5.?.?.?.?.?.?.?.?\\xd5\ 152|\\xd6.?.?.?.?.?.?.?.?\\xd6|\\xd7.?.?.?.?.?.?.?.?\\xd7|\\xd8.?.?.?.?.?.?.?.?\\xd8|\\xd9.?.?.?.?.?.?.?.?\\xd9|\\xda.?.?.?.?.?.?.?.?\\xda|\\xdb.?.?.?.?.?.?.?.?\\xdb|\\xdc.?.?.?.?.?.?.?.?\\xdc|\\xdd.?.?.?.?.?.?.?.?\\xdd|\\xde.?.?.?.?.?.?.?.?\\xde|\\xdf.?.?.?.?.?.?.?.?\\xdf|\\xe0.?.?.?.?.?.?.?.?\\xe0|\\xe1.?.?.?.?.?.?.?.?\\xe1|\\xe2.?.?.?.?.?.?.?.?\\xe2|\\xe3.?.?.?.?.?.?.?.?\\xe3|\\xe4.?.?.?.?.?.?.?.?\\xe4|\\xe5.?.?.?.?.?.?.?.?\\xe5|\\xe6.?.?.?.?.?.?.?.?\\xe6|\\xe7.?.?.?.?.?.?.?.?\\xe7|\\xe8.?.?.?.?.?.?.?.?\\xe8|\\xe9.?.?.?.?.?.?.?.?\\xe9\ 153|\\xea.?.?.?.?.?.?.?.?\\xea|\\xeb.?.?.?.?.?.?.?.?\\xeb|\\xec.?.?.?.?.?.?.?.?\\xec|\\xed.?.?.?.?.?.?.?.?\\xed|\\xee.?.?.?.?.?.?.?.?\\xee|\\xef.?.?.?.?.?.?.?.?\\xef|\\xf0.?.?.?.?.?.?.?.?\\xf0|\\xf1.?.?.?.?.?.?.?.?\\xf1|\\xf2.?.?.?.?.?.?.?.?\\xf2|\\xf3.?.?.?.?.?.?.?.?\\xf3|\\xf4.?.?.?.?.?.?.?.?\\xf4|\\xf5.?.?.?.?.?.?.?.?\\xf5|\\xf6.?.?.?.?.?.?.?.?\\xf6|\\xf7.?.?.?.?.?.?.?.?\\xf7|\\xf8.?.?.?.?.?.?.?.?\\xf8|\\xf9.?.?.?.?.?.?.?.?\\xf9|\\xfa.?.?.?.?.?.?.?.?\\xfa|\\xfb.?.?.?.?.?.?.?.?\\xfb|\\xfc.?.?.?.?.?.?.?.?\\xfc|\\xfd.?.?.?.?.?.?.?.?\\xfd\ 154|\\xfe.?.?.?.?.?.?.?.?\\xfe|\\xff.?.?.?.?.?.?.?.?\\xff)"}, 155 {"netgeareva", L7_ENUM_NETGEAREVA, 0, "^...\\x53\\x4a\\x61\\x6d"}, 156 //{"ftp", 7, 0, "^220[\\x09-\\x0d -~]*ftp"}, 157 //{"http", 8, 0, "http/(0\\.9|1\\.0|1\\.1) [1-5][0-9][0-9] [\\x09-\\x0d -~]*(connection:|content-type:|content-length:|date:)|post [\\x09-\\x0d -~]* http/[01]\\.[019]"}, 158 //{"msnmessenger", 9, 0, "ver [0-9]+ msnp[1-9][0-9]? [\\x09-\\x0d -~]*cvr0\\x0d\\x0a$|usr 1 [!-~]+ [0-9. ]+\\x0d\\x0a$|ans 1 [!-~]+ [0-9. ]+\\x0d\\x0a$"}, 159 //{"xunlei", 10, 0, "^[()]...?.?.?(reg|get|query)"}, 160 //{"ares", 11, 0, "^\\x03[]Z].?.?\\x05$"}, 161}; 162 163/* temporary buffer for pre-processing expression data */ 164static char g_exp[APP_DATA_BUF_MAX_LEN]; 165 166/* temporary buffer for converting app data into lowercase */ 167static char g_app_data[APP_DATA_BUF_MAX_LEN]; 168 169#ifdef L7_DEBUG_ON 170static int all_packet_in = 0; 171static int all_packet_out = 0; 172static int packet_has_pri_in = 0; 173static int packet_has_pri_out = 0; 174#endif 175 176 177#define QOS_PRIORITY_HIGHEST 3 178#define QOS_PRIORITY_HIGH 2 179#define QOS_PRIORITY_NORMAL 1 180#define QOS_PRIORITY_LOW 0 181#define QOS_PRIORITY_UNSPECIFIED -1 182 183static int qos_l7_apps_priority[L7_ENUM_TOTAL + 1]; /* Apps enum starts from 1 to L7_ENUM_TOTAL, 0 is unused */ 184 185static void load_apps_priority(void) 186{ 187 char qos_l7_appls[1024]; 188 char *temp; 189 int apps, priority, i; 190 191 /* Set default apps priority */ 192 for (i=0; i<=L7_ENUM_TOTAL; i++) 193 qos_l7_apps_priority[i] = QOS_PRIORITY_UNSPECIFIED; 194 195 strcpy(qos_l7_appls, nvram_safe_get("qos_l7_apps")); 196 197 temp = strtok(qos_l7_appls, " "); 198 while (temp) 199 { 200 sscanf(temp, "%d:%d", &apps, &priority); 201 202 /* Do Sanity check */ 203 if (apps >= 1 && apps <= L7_ENUM_TOTAL && 204 priority >= QOS_PRIORITY_LOW && priority <= QOS_PRIORITY_HIGHEST) 205 { 206 printk("L7 apps %d, priority %d\n", apps, priority); 207 qos_l7_apps_priority[apps] = priority; 208 } 209 210 temp = strtok(NULL, " "); 211 } 212} 213 214#define QOS_DSCP_VALUE_HIGHEST (0x38 << 2) 215#define QOS_DSCP_VALUE_HIGH (0x28 << 2) 216#define QOS_DSCP_VALUE_NORMAL (0x0 << 2) 217#define QOS_DSCP_VALUE_LOW (0x10 << 2) 218 219unsigned char prio_to_dscp(unsigned char prio) 220{ 221 if (prio == QOS_PRIORITY_HIGHEST) 222 return QOS_DSCP_VALUE_HIGHEST; 223 else 224 if (prio == QOS_PRIORITY_HIGH) 225 return QOS_DSCP_VALUE_HIGH; 226 else 227 if (prio == QOS_PRIORITY_LOW) 228 return QOS_DSCP_VALUE_LOW; 229 else 230 return QOS_DSCP_VALUE_NORMAL; 231} 232 233UINT16 CalcChecksum(unsigned char *pbData, int iLength) 234{ 235 int nLeft = iLength % 2; /* this addr has odd byte? */ 236 UINT16 wChecksum; 237 int iIndex; 238 UINT32 dwSum = 0; 239 240 for (iIndex=0; iIndex < iLength-1; iIndex+=2) 241 { 242 dwSum += (pbData[iIndex] << 8) | (pbData[iIndex+1]); 243 } 244 245 if (nLeft != 0) 246 dwSum += (pbData[iLength-1] << 8); 247 248 249 dwSum = (dwSum >> 16) + (dwSum & 0xffff); /* add hi 16 to low 16 */ 250 dwSum += (dwSum >> 16); /* add carry */ 251 wChecksum = ~dwSum; /* truncate to 16 bits */ 252 return (wChecksum); 253 254} 255 256static int modify_dscp(struct sk_buff *skb, int apps) 257{ 258 int pkt_prio; 259 int l7_prio; 260 int i; 261 262 pkt_prio = skb->cb[sizeof(skb->cb) - 3]; 263 l7_prio = qos_l7_apps_priority[apps]; 264 265 //printk("#### Got L7apps %d, orig prio %d, l7 prio %d\n", apps, pkt_prio, l7_prio); 266 267 if (l7_prio > pkt_prio) 268 { 269 unsigned char *ipHdr; 270 unsigned int ipHdrLen; 271 UINT16 csum; 272 273#if 0 274 printk("skb->data: "); 275 276 for (i=0; i<20; i++) 277 printk("%02X ", (unsigned char)skb->data[i]); 278 printk("\n"); 279#endif 280 /* Get start of IP header & TCP header */ 281 ipHdr = &(skb->data[0]); 282 ipHdrLen = (ipHdr[0] & 0x0F) * 4; 283 284 /* Modify the DSCP value */ 285 ipHdr[1] = prio_to_dscp(l7_prio); 286 287 /* Recompute TCP checksum */ 288 ipHdr[10] = 0; 289 ipHdr[11] = 0; 290 csum = CalcChecksum(ipHdr, ipHdrLen); 291 ipHdr[10] = (csum & 0xFF00) >> 8; 292 ipHdr[11] = (csum & 0xFF); 293 294 // printk("!!!!!! Promote L7apps %d prio from %d to %d\n", apps, pkt_prio, l7_prio); 295 } 296 return 0; 297 298} 299 300/*******function start*******/ 301 302unsigned char layer7_scan_all(struct sk_buff *skb, char *app_data, int appdatalen) 303{ 304 s_pattern_cache *node = first_pattern_cache; 305 int str_len = 0; 306 int i = 0; 307 308#ifdef L7_DEBUG_ON 309 L7_PRINTK_DEBUG_3("layer7_scan_all start\n"); 310#endif 311 312 str_len = ((sizeof(g_app_data)-1) > appdatalen) ? appdatalen : (sizeof(g_app_data)-1); 313 for (i=0; i<str_len; i++) 314 g_app_data[i] = tolower(app_data[i]); 315 g_app_data[i] = 0; 316 317 while (node != NULL) 318 { 319 if (regexec(node->pattern, g_app_data)) 320 { 321#ifdef L7_DEBUG_ON 322 L7_PRINTK_DEBUG_7("layer7 filter match: expression: %s\n", node->regex_string); 323 L7_PRINTK_DEBUG_1("layer7 filter match: protocol: %s\n", node->proto_name); 324#endif 325 return node->proto_enum; 326 } 327 328 node = node->next; 329 } 330 return 0;//dismatch 331} 332/* Returns offset the into the skb->data that the application data starts */ 333static int app_data_offset(const struct sk_buff *skb) 334{ 335 /* In case we are ported somewhere (ebtables?) where skb->nh.iph 336 isn't set, this can be gotten from 4*(skb->data[0] & 0x0f) as well. */ 337#ifdef LINUX26 338 int ip_hl = 4 * ip_hdr(skb)->ihl; 339#else /* LINUX26 */ 340 int ip_hl = 4*skb->nh.iph->ihl; 341#endif 342 343#ifdef LINUX26 344 if ( ip_hdr(skb)->protocol == IPPROTO_TCP ) 345#else /* LINUX26 */ 346 if ( skb->nh.iph->protocol == IPPROTO_TCP ) 347#endif /* LINUX26 */ 348 { 349 /* 12 == offset into TCP header for the header length field. 350 Can't get this with skb->h.th->doff because the tcphdr 351 struct doesn't get set when routing (this is confirmed to be 352 true in Netfilter as well as QoS.) */ 353 int tcp_hl = 4*(skb->data[ip_hl + 12] >> 4); 354 355 return ip_hl + tcp_hl; 356 } 357#ifdef LINUX26 358 else if ( ip_hdr(skb)->protocol == IPPROTO_UDP ) 359#else /* LINUX26 */ 360 else if ( skb->nh.iph->protocol == IPPROTO_UDP ) 361#endif /* LINUX26 */ 362 { 363 return ip_hl + 8; /* UDP header is always 8 bytes */ 364 } 365#ifdef LINUX26 366 else if ( ip_hdr(skb)->protocol == IPPROTO_ICMP ) 367#else /* LINUX26 */ 368 else if ( skb->nh.iph->protocol == IPPROTO_ICMP ) 369#endif /* LINUX26 */ 370 { 371 return ip_hl + 8; /* ICMP header is 8 bytes */ 372 } 373 else 374 { 375 if (net_ratelimit()) 376 L7_PRINTK_DEBUG_3(KERN_ERR "layer7: tried to handle unknown protocol!\n"); 377 return ip_hl + 8; /* something reasonable */ 378 } 379} 380 381int l7_filter_main(struct sk_buff *skb, int iDirection) 382{ 383 unsigned char *app_data; 384 unsigned int appdatalen; 385 T_ConnEntry *pConn; 386 unsigned char proto_enum = 0; 387 int iModifyType = 0; 388#ifdef L7_DEBUG_ON 389 int i = 0; 390 int iLen = sizeof(g_all_proto)/sizeof(g_all_proto[0]); 391#endif 392 393#ifdef L7_DEBUG_ON 394 L7_PRINTK_DEBUG_2("l7_filter_main start skb: %x, all_in out: %d %d, has_pri_in out: %d %d, in or out: %d\n", 395 skb, all_packet_in, all_packet_out, packet_has_pri_in, packet_has_pri_out, iDirection); 396 if (0 == ((all_packet_out+all_packet_in)&0xff))//print per 256 packets 397 L7_PRINTK_DEBUG_1("l7_filter_main start per 256, skb: %x, all_in out: %d %d, has_pri_in out: %d %d, in or out: %d\n", 398 skb, all_packet_in, all_packet_out, packet_has_pri_in, packet_has_pri_out, iDirection); 399 if (0 == ((all_packet_out+all_packet_in)&0x03ff))//list identified packets status of every proto per 1024 packets 400 { 401 L7_PRINTK_DEBUG_1("*********************** start ************************\n"); 402 L7_PRINTK_DEBUG_1("l7_filter_main per 1024, all_out: %d, has_pri_out: %d\n", 403 all_packet_out, packet_has_pri_out); 404 for (i=0; i<iLen; i++) 405 L7_PRINTK_DEBUG_1("Proto %s identified %d packets\n", g_all_proto[i].proto_name, g_all_proto[i].proto_packet_count); 406 L7_PRINTK_DEBUG_1("************************ end *************************\n"); 407 } 408 if (iDirection) 409 all_packet_out++; 410 else 411 all_packet_in++; 412#endif 413 414 if (NULL == skb) 415 return L7_ERROR; 416 417 skb->cb[sizeof(skb->cb)-4] = L7_ENUM_INIT;//initial value: -1(0xff) 418 419#ifdef LINUX26 420 pConn = FindConnByHash(ip_hdr(skb), &iModifyType, iDirection); 421#else /* LINUX26 */ 422 pConn = FindConnByHash(skb->nh.iph, &iModifyType, iDirection); 423#endif /* LINUX26 */ 424 425 if (NULL == pConn) 426 { 427#ifdef L7_DEBUG_ON 428 if (iDirection) 429 L7_PRINTK_DEBUG_2("l7_filter_main FindConnByHash fail.\n"); 430#endif 431 return L7_SUCCESS; 432 } 433 434#ifdef L7_DEBUG_ON 435 L7_PRINTK_DEBUG_3("l7_filter_main pConn: %x, pConn->packet_count: %d\n", pConn, pConn->packet_count); 436#endif 437 if (pConn->proto_enum != 0) 438 { 439 if (iDirection) 440 { 441#ifdef L7_DEBUG_ON 442 packet_has_pri_out++; 443 g_all_proto[pConn->proto_enum-1].proto_packet_count++; 444#endif 445 skb->cb[sizeof(skb->cb)-4] = pConn->proto_enum; 446 if (skb->cb[sizeof(skb->cb)-5]) 447 modify_dscp(skb, pConn->proto_enum); 448 } 449#ifdef L7_DEBUG_ON 450 else 451 packet_has_pri_in++; 452 L7_PRINTK_DEBUG_3("l7_filter_main pConn->proto_enum: %d\n", pConn->proto_enum); 453#endif 454 return L7_SUCCESS; 455 } 456 457 if (pConn->packet_count > num_packets) 458 { 459#ifdef L7_DEBUG_ON 460 L7_PRINTK_DEBUG_3("too many packets, l7_filter_main pConn->packet_count: %d\n", pConn->packet_count); 461#endif 462 if (iDirection) 463 { 464 skb->cb[sizeof(skb->cb)-4] = pConn->proto_enum; 465 if (skb->cb[sizeof(skb->cb)-5]) 466 modify_dscp(skb, pConn->proto_enum); 467 } 468 469 return L7_SUCCESS; 470 } 471 pConn->packet_count++; 472 473 if (skb_is_nonlinear(skb)) 474 { 475#ifdef LINUX26 476 if (skb_linearize(skb) != 0) 477#else /* LINUX26 */ 478 if (skb_linearize(skb, GFP_ATOMIC) != 0) 479#endif /* LINUX26 */ 480 { 481 if (net_ratelimit()) 482 L7_PRINTK_DEBUG_1(KERN_ERR "layer7: failed to linearize packet, bailing.\n"); 483 return L7_SUCCESS; 484 } 485 } 486 487 /* now that the skb is linearized, it's safe to set these. */ 488 app_data = skb->data + app_data_offset(skb); 489 appdatalen = skb->tail - app_data; 490 491 proto_enum = layer7_scan_all(skb, app_data, appdatalen); 492 493 if (proto_enum == L7_ENUM_NETGEAREVA) 494 { 495 if ((pConn->bProtocol != UDP_PROTOCOL) 496 || ((pConn->bNatType != AG_PORT_FORWARDING) 497 && ((ntohs(pConn->wDestPort) < EVA_PORT_START) || (ntohs(pConn->wDestPort) > EVA_PORT_END))) 498 || ((pConn->bNatType == AG_PORT_FORWARDING) 499 && ((ntohs(pConn->wSourcePort) < EVA_PORT_START) || (ntohs(pConn->wSourcePort) > EVA_PORT_END)))) 500 { 501 proto_enum = 0; 502 } 503 } 504 505 if (proto_enum != 0) 506 { 507#ifdef L7_DEBUG_ON 508 L7_PRINTK_DEBUG_1("l7_filter_main identify the conn %x, in %dth packet.\n", pConn, pConn->packet_count); 509#endif 510 if (iDirection) 511 { 512#ifdef L7_DEBUG_ON 513 packet_has_pri_out++; 514 g_all_proto[proto_enum-1].proto_packet_count++; 515#endif 516 skb->cb[sizeof(skb->cb)-4] = proto_enum; 517 if (skb->cb[sizeof(skb->cb)-5]) 518 modify_dscp(skb, pConn->proto_enum); 519 } 520#ifdef L7_DEBUG_ON 521 else 522 packet_has_pri_in++; 523#endif 524 pConn->proto_enum = proto_enum; 525 return L7_SUCCESS; 526 } 527 return L7_SUCCESS; 528} 529 530static int isxdigit(char c) 531{ 532 if ((c >= '0' && c <= '9') 533 || (c >= 'a' && c <= 'f') 534 || (c >= 'A' && c <= 'F')) 535 return 1; 536 else 537 return 0; 538} 539 540static char tolower(char c) 541{ 542 if (c >= 'A' && c <= 'Z') 543 c += 0x20; 544 return c; 545} 546 547static int hex2dec(char c) 548{ 549 switch (c) 550 { 551 case '0' ... '9': 552 return c - '0'; 553 case 'a' ... 'f': 554 return c - 'a' + 10; 555 case 'A' ... 'F': 556 return c - 'A' + 10; 557 default: 558#ifdef L7_DEBUG_ON 559 L7_PRINTK_DEBUG_2("hex2dec: bad value!\n"); 560#endif 561 return 0; 562 } 563} 564 565int pre_process(char *str_out, char *str_in, int str_out_len) 566{ 567 char *result = str_out; 568 char *s = str_in; 569 int sindex = 0, rindex = 0; 570 571 while ( sindex < strlen(s) && (rindex + 1 < str_out_len)) 572 { 573 if ( sindex + 3 < strlen(s) && 574 s[sindex] == '\\' && s[sindex+1] == 'x' && 575 isxdigit(s[sindex + 2]) && isxdigit(s[sindex + 3]) ) 576 { 577 /* carefully remember to call tolower here... */ 578 result[rindex] = tolower( hex2dec(s[sindex + 2])*16 + 579 hex2dec(s[sindex + 3] ) ); 580 581 switch ( result[rindex] ) 582 { 583 case 0x24: 584 case 0x28: 585 case 0x29: 586 case 0x2a: 587 case 0x2b: 588 case 0x2e: 589 case 0x3f: 590 case 0x5b: 591 case 0x5c: 592 case 0x5d: 593 case 0x5e: 594 case 0x7c: 595#ifdef L7_DEBUG_ON 596 L7_PRINTK_DEBUG_1("Warning: layer7 regexp contains a control character, %c, in hex (\\x%c%c).\n" 597 "I recommend that you write this as %c or \\%c, depending on what you meant.\n", 598 result[rindex], s[sindex + 2], s[sindex + 3], result[rindex], result[rindex]); 599#endif 600 break; 601 case 0x00: 602#ifdef L7_DEBUG_ON 603 L7_PRINTK_DEBUG_1("Warning: null (\\x00) in layer7 regexp. A null terminates the regexp string!\n"); 604#endif 605 break; 606 default: 607 break; 608 } 609 610 sindex += 3; /* 4 total */ 611 } 612 else 613 result[rindex] = tolower(s[sindex]); 614 615 sindex++; 616 rindex++; 617 } 618 result[rindex] = '\0'; 619 620 if (rindex > 0) 621 return 0; 622 else 623 return 1; 624} 625 626int load_all_pattern(void) 627{ 628 /* establish the link list of patterns*/ 629 s_pattern_cache * node = first_pattern_cache; 630 s_pattern_cache * tmp; 631 unsigned int len; 632 unsigned int num_proto = sizeof(g_all_proto)/sizeof(s_proto_regexp); 633 int i = 0; 634 635#ifdef L7_DEBUG_ON 636 L7_PRINTK_DEBUG_1("l7 filter, load_all_pattern start, num_proto: %d\n", num_proto); 637#endif 638 639 for (i=0; i<num_proto; i++) 640 { 641#ifdef L7_DEBUG_ON 642 L7_PRINTK_DEBUG_2("load_all_pattern for loop: %d, proto_regexp: %s,\n 643 sizeof(s_pattern_cache): %d.\n", 644 i, g_all_proto[i].proto_regexp, sizeof(s_pattern_cache)); 645#endif 646 if (0 != pre_process(g_exp, g_all_proto[i].proto_regexp, sizeof(g_exp))) 647 continue; 648 649 /* Be paranoid about running out of memory to avoid list corruption. */ 650 tmp = kmalloc(sizeof(s_pattern_cache), GFP_ATOMIC); 651 if (!tmp) 652 { 653 L7_PRINTK_DEBUG_1("layer7: out of memory in compile_and_cache, bailing. 1\n"); 654 if (net_ratelimit()) 655 L7_PRINTK_DEBUG_1(KERN_ERR "layer7: out of memory in compile_and_cache, bailing.\n"); 656 return NULL; 657 } 658 659 tmp->regex_string = kmalloc(strlen(g_exp) + 1, GFP_ATOMIC); 660 if (NULL == tmp->regex_string) 661 { 662 L7_PRINTK_DEBUG_1("layer7: out of memory in compile_and_cache, bailing. 2\n"); 663 if (net_ratelimit()) 664 L7_PRINTK_DEBUG_1(KERN_ERR "layer7: out of memory in compile_and_cache, bailing.\n"); 665 kfree(tmp); 666 return NULL; 667 } 668 669 tmp->pattern = regcomp(g_exp, &len); 670 if (NULL == tmp->pattern) 671 { 672 L7_PRINTK_DEBUG_1("layer7: out of memory in compile_and_cache, bailing. 3\n"); 673 if (net_ratelimit()) 674 L7_PRINTK_DEBUG_1(KERN_ERR "layer7: out of memory in compile_and_cache, bailing.\n"); 675 kfree(tmp->regex_string); 676 kfree(tmp); 677 return NULL; 678 } 679 680 strcpy(tmp->regex_string, g_exp); 681 tmp->next = NULL; 682 tmp->proto_enum = g_all_proto[i].proto_enum; 683 tmp->proto_name = g_all_proto[i].proto_name; 684 685#ifdef L7_DEBUG_ON 686 L7_PRINTK_DEBUG_2("regexp: %s\n", tmp->proto_name); 687 L7_PRINTK_DEBUG_2("tmp->pattern->regstart: %d\n", tmp->pattern->regstart); 688 L7_PRINTK_DEBUG_2("tmp->pattern->reganch: %d\n", tmp->pattern->reganch); 689 if (tmp->pattern->regmust != NULL) 690 L7_PRINTK_DEBUG_2("tmp->pattern->regmust: %s\n", tmp->pattern->regmust); 691 L7_PRINTK_DEBUG_2("tmp->pattern->regmlen: %d\n", tmp->pattern->regmlen); 692 L7_PRINTK_DEBUG_2("tmp->pattern->program[0]: %d\n", tmp->pattern->program[0]); 693#endif/* end of #ifdef L7_DEBUG_ON */ 694 if (NULL == node) 695 { 696 node = tmp; 697 first_pattern_cache = tmp; 698 } 699 else 700 { 701 node->next = tmp; 702 node = tmp; 703 } 704 } 705 706 return 1; 707} 708 709void free_all_pattern(void) 710{ 711 s_pattern_cache *node = first_pattern_cache; 712 s_pattern_cache *tmp; 713 714 while (node != NULL) 715 { 716 if (node->regex_string != NULL) 717 kfree(node->regex_string); 718 if (node->pattern != NULL) 719 kfree(node->pattern); 720 721 tmp = node; 722 node = node->next; 723 kfree(tmp); 724 } 725} 726 727 728 729static int __init init(void) 730{ 731 int ret = 0; 732 733#ifdef CONFIG_NETFILTER 734 ret = nf_register_hook(&l7_filter_prerouting_ops); 735 if (ret < 0) { 736 printk("<0>Error registering l7 filter prerouting.\n"); 737 nf_unregister_hook(&l7_filter_prerouting_ops); 738 return ret; 739 } 740 ret = nf_register_hook(&l7_filter_postrouting_ops); 741 if (ret < 0) { 742 printk("<0>Error registering l7 filter postrouting.\n"); 743 return ret; 744 } 745#else /* CONFIG_NETFILTER */ 746 acosL7Filter_register_hook(l7_filter_main); 747#endif /* CONFIG_NETFILTER */ 748 749 load_all_pattern(); 750 751 load_apps_priority(); 752 753 return ret; 754} 755 756static void __exit fini(void) 757{ 758#ifdef CONFIG_NETFILTER 759 nf_unregister_hook(&l7_filter_prerouting_ops); 760 nf_unregister_hook(&l7_filter_postrouting_ops); 761#else 762 acosL7Filter_register_hook(NULL); 763#endif /* CONFIG_NETFILTER */ 764 765 free_all_pattern(); 766} 767 768module_init(init); 769module_exit(fini); 770 771EXPORT_SYMBOL(l7_filter_main); 772