1/* -------------------------------------------------------------------------------------------------------------- 2 * FILE NAME l7_filter_main.c (for Linux Platform) 3 * DATE 10/25/2007 4 * AUTHOR/S Max Ding 5 * Description Layer 7 filter 6 * -------------------------------------------------------------------------------------------------------------- 7 */ 8 9//MODULE_AUTHOR("Matthew Strait <quadong@users.sf.net>, Ethan Sommer <sommere@users.sf.net>"); 10//MODULE_LICENSE("GPL"); 11//MODULE_DESCRIPTION("application layer match module"); 12 13/*******include start*******/ 14#ifdef __LINUX__ 15#include <linux/module.h> 16#include <linux/if.h> 17#include <linux/types.h> 18#include <linux/in.h> 19#include <linux/ip.h> 20#include <linux/skbuff.h> 21#include <linux/acosnatfw.h> 22#include <linux/netdevice.h> 23#include <linux/inetdevice.h> 24#include <linux/mm.h> 25 26#ifdef CONFIG_NETFILTER 27#include <linux/netfilter.h> 28#include <linux/netfilter_ipv4.h> 29#endif /* CONFIG_NETFILTER */ 30 31#endif /* __LINUX__ */ 32 33/*#define L7_DEBUG_ON */ 34 35#include "regexp/regexp.c" 36#include "l7_filter_main.h" 37 38/*******define start*******/ 39#ifdef L7_DEBUG_ON 40#define L7_DEBUG_PRI_0 0x00000000 41#define L7_DEBUG_PRI_1 0x00000001 42#define L7_DEBUG_PRI_2 0x00000002 43#define L7_DEBUG_PRI_3 0x00000004 44#define L7_DEBUG_PRI_4 0x00000008 45#define L7_DEBUG_PRI_5 0x00000010 46#define L7_DEBUG_PRI_6 0x00000020 47#define L7_DEBUG_PRI_7 0x00000040 48#define L7_DEBUG_PRI_a 0xffffffff 49#define L7_PRINTK_DEBUG printk 50#define L7_PRINTK_DEBUG_1 if (debug_pri & L7_DEBUG_PRI_1) printk 51#define L7_PRINTK_DEBUG_2 if (debug_pri & L7_DEBUG_PRI_2) printk 52#define L7_PRINTK_DEBUG_3 if (debug_pri & L7_DEBUG_PRI_3) printk 53#define L7_PRINTK_DEBUG_4 if (debug_pri & L7_DEBUG_PRI_4) printk 54#define L7_PRINTK_DEBUG_5 if (debug_pri & L7_DEBUG_PRI_5) printk 55#define L7_PRINTK_DEBUG_6 if (debug_pri & L7_DEBUG_PRI_6) printk 56#define L7_PRINTK_DEBUG_7 if (debug_pri & L7_DEBUG_PRI_7) printk 57 58#else/* else for #ifdef L7_DEBUG_ON */ 59 60#define L7_PRINTK_DEBUG printk 61#define L7_PRINTK_DEBUG_1 printk 62#define L7_PRINTK_DEBUG_2 printk 63#define L7_PRINTK_DEBUG_3 printk 64#define L7_PRINTK_DEBUG_4 printk 65#define L7_PRINTK_DEBUG_5 printk 66#define L7_PRINTK_DEBUG_6 printk 67#define L7_PRINTK_DEBUG_7 printk 68#endif/* end for #ifdef L7_DEBUG_ON */ 69 70/*******global and static variables start*******/ 71#ifdef L7_DEBUG_ON 72static int debug_pri = 0x00000001; 73MODULE_PARM(debug_pri, "i"); 74#endif 75 76/* Number of packets whose data we look at. */ 77static int num_packets = 20; 78 79static char tolower(char c); 80 81/* head of the link list of patterns */ 82static s_pattern_cache * first_pattern_cache = NULL; 83 84#ifdef CONFIG_NETFILTER 85int l7_filter_main(struct sk_buff *skb, int iDirection); 86static unsigned int l7_filter_hook(unsigned int hook, 87 struct sk_buff **skb, 88 const struct net_device *in, 89 const struct net_device *out, 90 int (*okfn)(struct sk_buff *)) 91{ 92 int dir; 93 94 if (hook == NF_IP_PRE_ROUTING) 95 dir = 0; 96 else if (hook == NF_IP_POST_ROUTING) 97 dir = 1; 98 else 99 return NF_ACCEPT; 100 101 local_bh_disable(); 102 l7_filter_main(*skb, dir); 103 local_bh_enable(); 104 105 return NF_ACCEPT; 106} 107 108static struct nf_hook_ops l7_filter_prerouting_ops = { 109#ifdef AG_LINUX_26 110 .owner = THIS_MODULE, 111#else 112 .list = {NULL, NULL}, 113#endif /* AG_LINUX_26 */ 114 .hook = l7_filter_hook, 115 .pf = PF_INET, 116 .hooknum = NF_IP_PRE_ROUTING, 117 .priority = NF_IP_PRI_LAST, 118}; 119static struct nf_hook_ops l7_filter_postrouting_ops = { 120#ifdef AG_LINUX_26 121 .owner = THIS_MODULE, 122#else 123 .list = {NULL, NULL}, 124#endif /* AG_LINUX_26 */ 125 .hook = l7_filter_hook, 126 .pf = PF_INET, 127 .hooknum = NF_IP_POST_ROUTING, 128 .priority = NF_IP_PRI_LAST, 129}; 130#endif /* CONFIG_NETFILTER */ 131 132/* Hard code for all expression of protocol. It's better to read them from *.pat files. */ 133static s_proto_regexp g_all_proto[] = 134{ 135 {"bittorrent", L7_ENUM_BITTORRENT, 0, "^(\\x13bittorrent protocol|azver\\x01$|get /scrape\\?info_hash=)|d1:ad2:id20:|\\x08'7P\\)[RP]"}, 136 {"fasttrack", L7_ENUM_FASTTRACK, 0, "^get (/.download/[ -~]*|/.supernode[ -~]|/.status[ -~]|/.network[ -~]*|/.files|/.hash=[0-9a-f]*/[ -~]*) http/1.1|user-agent: kazaa|x-kazaa(-username|-network|-ip|-supernodeip|-xferid|-xferuid|tag)|^give [0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]?[0-9]?[0-9]?"}, 137 {"edonkey", L7_ENUM_EDONKEY, 0, "^[\\xc5\\xd4\\xe3-\\xe5].?.?.?.?([\\x01\\x02\\x05\\x14\\x15\\x16\\x18\\x19\\x1a\\x1b\\x1c\\x20\\x21\\x32\\x33\\x34\\x35\\x36\\x38\\x40\\x41\\x42\\x43\\x46\\x47\\x48\\x49\\x4a\\x4b\\x4c\\x4d\\x4e\\x4f\\x50\\x51\\x52\\x53\\x54\\x55\\x56\\x57\\x58[\\x60\\x81\\x82\\x90\\x91\\x93\\x96\\x97\\x98\\x99\\x9a\\x9b\\x9c\\x9e\\xa0\\xa1\\xa2\\xa3\\xa4]|\\x59................?[ -~]|\\x96....$)"}, 138 {"gnutella", L7_ENUM_GNUTELLA, 0, "^(gnd[\\x01\\x02]?.?.?\\x01|gnutella connect/[012]\\.[0-9]\\x0d\\x0a|get /uri-res/n2r\\?urn:sha1:|get /.*user-agent: (gtk-gnutella|bearshare|mactella|gnucleus|gnotella|limewire|imesh)|get /.*content-type: application/x-gnutella-packets|giv [0-9]*:[0-9a-f]*/|queue [0-9a-f]* [1-9][0-9]?[0-9]?\\.[1-9][0-9]?[0-9]?\\.[1-9][0-9]?[0-9]?\\.[1-9][0-9]?[0-9]?:[1-9][0-9]?[0-9]?[0-9]?|gnutella.*content-type: application/x-gnutella|...................?lime)"}, 139 {"skypetoskype", L7_ENUM_SKYPETOSKYPE, 0, "^..\\x02............."}, 140 {"skypeout", L7_ENUM_SKYPEOUT, 0, "^(\\x01.?.?.?.?.?.?.?.?\\x01|\\x02.?.?.?.?.?.?.?.?\\x02|\\x03.?.?.?.?.?.?.?.?\\x03|\\x04.?.?.?.?.?.?.?.?\\x04|\\x05.?.?.?.?.?.?.?.?\\x05|\\x06.?.?.?.?.?.?.?.?\\x06|\\x07.?.?.?.?.?.?.?.?\\x07|\\x08.?.?.?.?.?.?.?.?\\x08|\\x09.?.?.?.?.?.?.?.?\\x09|\\x0a.?.?.?.?.?.?.?.?\\x0a|\\x0b.?.?.?.?.?.?.?.?\\x0b|\\x0c.?.?.?.?.?.?.?.?\\x0c|\\x0d.?.?.?.?.?.?.?.?\\x0d|\\x0e.?.?.?.?.?.?.?.?\\x0e|\\x0f.?.?.?.?.?.?.?.?\\x0f|\\x10.?.?.?.?.?.?.?.?\\x10|\\x11.?.?.?.?.?.?.?.?\\x11|\\x12.?.?.?.?.?.?.?.?\\x12\ 141|\\x13.?.?.?.?.?.?.?.?\\x13|\\x14.?.?.?.?.?.?.?.?\\x14|\\x15.?.?.?.?.?.?.?.?\\x15|\\x16.?.?.?.?.?.?.?.?\\x16|\\x17.?.?.?.?.?.?.?.?\\x17|\\x18.?.?.?.?.?.?.?.?\\x18|\\x19.?.?.?.?.?.?.?.?\\x19|\\x1a.?.?.?.?.?.?.?.?\\x1a|\\x1b.?.?.?.?.?.?.?.?\\x1b|\\x1c.?.?.?.?.?.?.?.?\\x1c|\\x1d.?.?.?.?.?.?.?.?\\x1d|\\x1e.?.?.?.?.?.?.?.?\\x1e|\\x1f.?.?.?.?.?.?.?.?\\x1f|\\x20.?.?.?.?.?.?.?.?\\x20|\\x21.?.?.?.?.?.?.?.?\\x21|\\x22.?.?.?.?.?.?.?.?\\x22|\\x23.?.?.?.?.?.?.?.?\\x23|\\$.?.?.?.?.?.?.?.?\\$|\\x25.?.?.?.?.?.?.?.?\\x25\ 142|\\x26.?.?.?.?.?.?.?.?\\x26|\\x27.?.?.?.?.?.?.?.?\\x27|\\(.?.?.?.?.?.?.?.?\\(|\\).?.?.?.?.?.?.?.?\\)|\\*.?.?.?.?.?.?.?.?\\*|\\+.?.?.?.?.?.?.?.?\\+|\\x2c.?.?.?.?.?.?.?.?\\x2c|\\x2d.?.?.?.?.?.?.?.?\\x2d|\\..?.?.?.?.?.?.?.?\\.|\\x2f.?.?.?.?.?.?.?.?\\x2f|\\x30.?.?.?.?.?.?.?.?\\x30|\\x31.?.?.?.?.?.?.?.?\\x31|\\x32.?.?.?.?.?.?.?.?\\x32|\\x33.?.?.?.?.?.?.?.?\\x33|\\x34.?.?.?.?.?.?.?.?\\x34|\\x35.?.?.?.?.?.?.?.?\\x35|\\x36.?.?.?.?.?.?.?.?\\x36|\\x37.?.?.?.?.?.?.?.?\\x37|\\x38.?.?.?.?.?.?.?.?\\x38\ 143|\\x39.?.?.?.?.?.?.?.?\\x39|\\x3a.?.?.?.?.?.?.?.?\\x3a|\\x3b.?.?.?.?.?.?.?.?\\x3b|\\x3c.?.?.?.?.?.?.?.?\\x3c|\\x3d.?.?.?.?.?.?.?.?\\x3d|\\x3e.?.?.?.?.?.?.?.?\\x3e|\\?.?.?.?.?.?.?.?.?\\?|\\x40.?.?.?.?.?.?.?.?\\x40|\\x41.?.?.?.?.?.?.?.?\\x41|\\x42.?.?.?.?.?.?.?.?\\x42|\\x43.?.?.?.?.?.?.?.?\\x43|\\x44.?.?.?.?.?.?.?.?\\x44|\\x45.?.?.?.?.?.?.?.?\\x45|\\x46.?.?.?.?.?.?.?.?\\x46|\\x47.?.?.?.?.?.?.?.?\\x47|\\x48.?.?.?.?.?.?.?.?\\x48|\\x49.?.?.?.?.?.?.?.?\\x49|\\x4a.?.?.?.?.?.?.?.?\\x4a|\\x4b.?.?.?.?.?.?.?.?\\x4b\ 144|\\x4c.?.?.?.?.?.?.?.?\\x4c|\\x4d.?.?.?.?.?.?.?.?\\x4d|\\x4e.?.?.?.?.?.?.?.?\\x4e|\\x4f.?.?.?.?.?.?.?.?\\x4f|\\x50.?.?.?.?.?.?.?.?\\x50|\\x51.?.?.?.?.?.?.?.?\\x51|\\x52.?.?.?.?.?.?.?.?\\x52|\\x53.?.?.?.?.?.?.?.?\\x53|\\x54.?.?.?.?.?.?.?.?\\x54|\\x55.?.?.?.?.?.?.?.?\\x55|\\x56.?.?.?.?.?.?.?.?\\x56|\\x57.?.?.?.?.?.?.?.?\\x57|\\x58.?.?.?.?.?.?.?.?\\x58|\\x59.?.?.?.?.?.?.?.?\\x59|\\x5a.?.?.?.?.?.?.?.?\\x5a|\\[.?.?.?.?.?.?.?.?\\[|\\\\.?.?.?.?.?.?.?.?\\\\|\\].?.?.?.?.?.?.?.?\\]|\\^.?.?.?.?.?.?.?.?\\^\ 145|\\x5f.?.?.?.?.?.?.?.?\\x5f|\\x60.?.?.?.?.?.?.?.?\\x60|\\x61.?.?.?.?.?.?.?.?\\x61|\\x62.?.?.?.?.?.?.?.?\\x62|\\x63.?.?.?.?.?.?.?.?\\x63|\\x64.?.?.?.?.?.?.?.?\\x64|\\x65.?.?.?.?.?.?.?.?\\x65|\\x66.?.?.?.?.?.?.?.?\\x66|\\x67.?.?.?.?.?.?.?.?\\x67|\\x68.?.?.?.?.?.?.?.?\\x68|\\x69.?.?.?.?.?.?.?.?\\x69|\\x6a.?.?.?.?.?.?.?.?\\x6a|\\x6b.?.?.?.?.?.?.?.?\\x6b|\\x6c.?.?.?.?.?.?.?.?\\x6c|\\x6d.?.?.?.?.?.?.?.?\\x6d|\\x6e.?.?.?.?.?.?.?.?\\x6e|\\x6f.?.?.?.?.?.?.?.?\\x6f|\\x70.?.?.?.?.?.?.?.?\\x70|\\x71.?.?.?.?.?.?.?.?\\x71\ 146|\\x72.?.?.?.?.?.?.?.?\\x72|\\x73.?.?.?.?.?.?.?.?\\x73|\\x74.?.?.?.?.?.?.?.?\\x74|\\x75.?.?.?.?.?.?.?.?\\x75|\\x76.?.?.?.?.?.?.?.?\\x76|\\x77.?.?.?.?.?.?.?.?\\x77|\\x78.?.?.?.?.?.?.?.?\\x78|\\x79.?.?.?.?.?.?.?.?\\x79|\\x7a.?.?.?.?.?.?.?.?\\x7a|\\{.?.?.?.?.?.?.?.?\\{|\\|.?.?.?.?.?.?.?.?\\||\\}.?.?.?.?.?.?.?.?\\}|\\x7e.?.?.?.?.?.?.?.?\\x7e|\\x7f.?.?.?.?.?.?.?.?\\x7f|\\x80.?.?.?.?.?.?.?.?\\x80|\\x81.?.?.?.?.?.?.?.?\\x81|\\x82.?.?.?.?.?.?.?.?\\x82|\\x83.?.?.?.?.?.?.?.?\\x83|\\x84.?.?.?.?.?.?.?.?\\x84|\\x85.?.?.?.?.?.?.?.?\\x85\ 147|\\x86.?.?.?.?.?.?.?.?\\x86|\\x87.?.?.?.?.?.?.?.?\\x87|\\x88.?.?.?.?.?.?.?.?\\x88|\\x89.?.?.?.?.?.?.?.?\\x89|\\x8a.?.?.?.?.?.?.?.?\\x8a|\\x8b.?.?.?.?.?.?.?.?\\x8b|\\x8c.?.?.?.?.?.?.?.?\\x8c|\\x8d.?.?.?.?.?.?.?.?\\x8d|\\x8e.?.?.?.?.?.?.?.?\\x8e|\\x8f.?.?.?.?.?.?.?.?\\x8f|\\x90.?.?.?.?.?.?.?.?\\x90|\\x91.?.?.?.?.?.?.?.?\\x91|\\x92.?.?.?.?.?.?.?.?\\x92|\\x93.?.?.?.?.?.?.?.?\\x93|\\x94.?.?.?.?.?.?.?.?\\x94|\\x95.?.?.?.?.?.?.?.?\\x95|\\x96.?.?.?.?.?.?.?.?\\x96|\\x97.?.?.?.?.?.?.?.?\\x97|\\x98.?.?.?.?.?.?.?.?\\x98|\\x99.?.?.?.?.?.?.?.?\\x99\ 148|\\x9a.?.?.?.?.?.?.?.?\\x9a|\\x9b.?.?.?.?.?.?.?.?\\x9b|\\x9c.?.?.?.?.?.?.?.?\\x9c|\\x9d.?.?.?.?.?.?.?.?\\x9d|\\x9e.?.?.?.?.?.?.?.?\\x9e|\\x9f.?.?.?.?.?.?.?.?\\x9f|\\xa0.?.?.?.?.?.?.?.?\\xa0|\\xa1.?.?.?.?.?.?.?.?\\xa1|\\xa2.?.?.?.?.?.?.?.?\\xa2|\\xa3.?.?.?.?.?.?.?.?\\xa3|\\xa4.?.?.?.?.?.?.?.?\\xa4|\\xa5.?.?.?.?.?.?.?.?\\xa5|\\xa6.?.?.?.?.?.?.?.?\\xa6|\\xa7.?.?.?.?.?.?.?.?\\xa7|\\xa8.?.?.?.?.?.?.?.?\\xa8|\\xa9.?.?.?.?.?.?.?.?\\xa9|\\xaa.?.?.?.?.?.?.?.?\\xaa|\\xab.?.?.?.?.?.?.?.?\\xab|\\xac.?.?.?.?.?.?.?.?\\xac|\\xad.?.?.?.?.?.?.?.?\\xad\ 149|\\xae.?.?.?.?.?.?.?.?\\xae|\\xaf.?.?.?.?.?.?.?.?\\xaf|\\xb0.?.?.?.?.?.?.?.?\\xb0|\\xb1.?.?.?.?.?.?.?.?\\xb1|\\xb2.?.?.?.?.?.?.?.?\\xb2|\\xb3.?.?.?.?.?.?.?.?\\xb3|\\xb4.?.?.?.?.?.?.?.?\\xb4|\\xb5.?.?.?.?.?.?.?.?\\xb5|\\xb6.?.?.?.?.?.?.?.?\\xb6|\\xb7.?.?.?.?.?.?.?.?\\xb7|\\xb8.?.?.?.?.?.?.?.?\\xb8|\\xb9.?.?.?.?.?.?.?.?\\xb9|\\xba.?.?.?.?.?.?.?.?\\xba|\\xbb.?.?.?.?.?.?.?.?\\xbb|\\xbc.?.?.?.?.?.?.?.?\\xbc|\\xbd.?.?.?.?.?.?.?.?\\xbd|\\xbe.?.?.?.?.?.?.?.?\\xbe|\\xbf.?.?.?.?.?.?.?.?\\xbf|\\xc0.?.?.?.?.?.?.?.?\\xc0|\\xc1.?.?.?.?.?.?.?.?\\xc1\ 150|\\xc2.?.?.?.?.?.?.?.?\\xc2|\\xc3.?.?.?.?.?.?.?.?\\xc3|\\xc4.?.?.?.?.?.?.?.?\\xc4|\\xc5.?.?.?.?.?.?.?.?\\xc5|\\xc6.?.?.?.?.?.?.?.?\\xc6|\\xc7.?.?.?.?.?.?.?.?\\xc7|\\xc8.?.?.?.?.?.?.?.?\\xc8|\\xc9.?.?.?.?.?.?.?.?\\xc9|\\xca.?.?.?.?.?.?.?.?\\xca|\\xcb.?.?.?.?.?.?.?.?\\xcb|\\xcc.?.?.?.?.?.?.?.?\\xcc|\\xcd.?.?.?.?.?.?.?.?\\xcd|\\xce.?.?.?.?.?.?.?.?\\xce|\\xcf.?.?.?.?.?.?.?.?\\xcf|\\xd0.?.?.?.?.?.?.?.?\\xd0|\\xd1.?.?.?.?.?.?.?.?\\xd1|\\xd2.?.?.?.?.?.?.?.?\\xd2|\\xd3.?.?.?.?.?.?.?.?\\xd3|\\xd4.?.?.?.?.?.?.?.?\\xd4|\\xd5.?.?.?.?.?.?.?.?\\xd5\ 151|\\xd6.?.?.?.?.?.?.?.?\\xd6|\\xd7.?.?.?.?.?.?.?.?\\xd7|\\xd8.?.?.?.?.?.?.?.?\\xd8|\\xd9.?.?.?.?.?.?.?.?\\xd9|\\xda.?.?.?.?.?.?.?.?\\xda|\\xdb.?.?.?.?.?.?.?.?\\xdb|\\xdc.?.?.?.?.?.?.?.?\\xdc|\\xdd.?.?.?.?.?.?.?.?\\xdd|\\xde.?.?.?.?.?.?.?.?\\xde|\\xdf.?.?.?.?.?.?.?.?\\xdf|\\xe0.?.?.?.?.?.?.?.?\\xe0|\\xe1.?.?.?.?.?.?.?.?\\xe1|\\xe2.?.?.?.?.?.?.?.?\\xe2|\\xe3.?.?.?.?.?.?.?.?\\xe3|\\xe4.?.?.?.?.?.?.?.?\\xe4|\\xe5.?.?.?.?.?.?.?.?\\xe5|\\xe6.?.?.?.?.?.?.?.?\\xe6|\\xe7.?.?.?.?.?.?.?.?\\xe7|\\xe8.?.?.?.?.?.?.?.?\\xe8|\\xe9.?.?.?.?.?.?.?.?\\xe9\ 152|\\xea.?.?.?.?.?.?.?.?\\xea|\\xeb.?.?.?.?.?.?.?.?\\xeb|\\xec.?.?.?.?.?.?.?.?\\xec|\\xed.?.?.?.?.?.?.?.?\\xed|\\xee.?.?.?.?.?.?.?.?\\xee|\\xef.?.?.?.?.?.?.?.?\\xef|\\xf0.?.?.?.?.?.?.?.?\\xf0|\\xf1.?.?.?.?.?.?.?.?\\xf1|\\xf2.?.?.?.?.?.?.?.?\\xf2|\\xf3.?.?.?.?.?.?.?.?\\xf3|\\xf4.?.?.?.?.?.?.?.?\\xf4|\\xf5.?.?.?.?.?.?.?.?\\xf5|\\xf6.?.?.?.?.?.?.?.?\\xf6|\\xf7.?.?.?.?.?.?.?.?\\xf7|\\xf8.?.?.?.?.?.?.?.?\\xf8|\\xf9.?.?.?.?.?.?.?.?\\xf9|\\xfa.?.?.?.?.?.?.?.?\\xfa|\\xfb.?.?.?.?.?.?.?.?\\xfb|\\xfc.?.?.?.?.?.?.?.?\\xfc|\\xfd.?.?.?.?.?.?.?.?\\xfd\ 153|\\xfe.?.?.?.?.?.?.?.?\\xfe|\\xff.?.?.?.?.?.?.?.?\\xff)"}, 154 {"netgeareva", L7_ENUM_NETGEAREVA, 0, "^...\\x53\\x4a\\x61\\x6d"}, /*foxconn add by pingod, 07/12/2008*/ 155 //{"ftp", 7, 0, "^220[\\x09-\\x0d -~]*ftp"}, 156 //{"http", 8, 0, "http/(0\\.9|1\\.0|1\\.1) [1-5][0-9][0-9] [\\x09-\\x0d -~]*(connection:|content-type:|content-length:|date:)|post [\\x09-\\x0d -~]* http/[01]\\.[019]"}, 157 //{"msnmessenger", 9, 0, "ver [0-9]+ msnp[1-9][0-9]? [\\x09-\\x0d -~]*cvr0\\x0d\\x0a$|usr 1 [!-~]+ [0-9. ]+\\x0d\\x0a$|ans 1 [!-~]+ [0-9. ]+\\x0d\\x0a$"}, 158 //{"xunlei", 10, 0, "^[()]...?.?.?(reg|get|query)"}, 159 //{"ares", 11, 0, "^\\x03[]Z].?.?\\x05$"}, 160}; 161 162/* temporary buffer for pre-processing expression data */ 163static char g_exp[APP_DATA_BUF_MAX_LEN]; 164 165/* temporary buffer for converting app data into lowercase */ 166static char g_app_data[APP_DATA_BUF_MAX_LEN]; 167 168#ifdef L7_DEBUG_ON 169static int all_packet_in = 0; 170static int all_packet_out = 0; 171static int packet_has_pri_in = 0; 172static int packet_has_pri_out = 0; 173#endif 174 175 176/* Foxconn added start pling 11/08/2007 */ 177#define QOS_PRIORITY_HIGHEST 3 178#define QOS_PRIORITY_HIGH 2 179#define QOS_PRIORITY_NORMAL 1 180#define QOS_PRIORITY_LOW 0 181#define QOS_PRIORITY_UNSPECIFIED -1 182 183static int qos_l7_apps_priority[L7_ENUM_TOTAL + 1]; 184extern char qos_l7_appls[1024]; 185 186static void load_apps_priority(void) 187{ 188/* char qos_l7_appls[1024];*/ 189 char *temp; 190 int apps, priority, i; 191 192 /* Set default apps priority */ 193 for (i=0; i<=L7_ENUM_TOTAL; i++) 194 qos_l7_apps_priority[i] = QOS_PRIORITY_UNSPECIFIED; 195 196/* strcpy(qos_l7_appls, nvram_safe_get("qos_l7_apps")); weal */ 197 198 temp = strtok(qos_l7_appls, " "); 199 while (temp) 200 { 201 sscanf(temp, "%d:%d", &apps, &priority); 202 203 /* Do Sanity check */ 204 if (apps >= 1 && apps <= L7_ENUM_TOTAL && 205 priority >= QOS_PRIORITY_LOW && priority <= QOS_PRIORITY_HIGHEST) 206 { 207 qos_l7_apps_priority[apps] = priority; 208 } 209 210 temp = strtok(NULL, " "); 211 } 212} 213 214#define QOS_DSCP_VALUE_HIGHEST (0x38 << 2) 215#define QOS_DSCP_VALUE_HIGH (0x28 << 2) 216#define QOS_DSCP_VALUE_NORMAL (0x0 << 2) 217#define QOS_DSCP_VALUE_LOW (0x10 << 2) 218 219unsigned char prio_to_dscp(unsigned char prio) 220{ 221 if (prio == QOS_PRIORITY_HIGHEST) 222 return QOS_DSCP_VALUE_HIGHEST; 223 else 224 if (prio == QOS_PRIORITY_HIGH) 225 return QOS_DSCP_VALUE_HIGH; 226 else 227 if (prio == QOS_PRIORITY_LOW) 228 return QOS_DSCP_VALUE_LOW; 229 else 230 return QOS_DSCP_VALUE_NORMAL; 231} 232 233UINT16 CalcChecksum(unsigned char *pbData, int iLength) 234{ 235 int nLeft = iLength % 2; /* this addr has odd byte? */ 236 UINT16 wChecksum; 237 int iIndex; 238 UINT32 dwSum = 0; 239 240 for (iIndex=0; iIndex < iLength-1; iIndex+=2) 241 { 242 dwSum += (pbData[iIndex] << 8) | (pbData[iIndex+1]); 243 } 244 245 if (nLeft != 0) 246 dwSum += (pbData[iLength-1] << 8); 247 248 249 dwSum = (dwSum >> 16) + (dwSum & 0xffff); /* add hi 16 to low 16 */ 250 dwSum += (dwSum >> 16); /* add carry */ 251 wChecksum = ~dwSum; /* truncate to 16 bits */ 252 return (wChecksum); 253 254} 255 256static int modify_dscp(struct sk_buff *skb, int apps) 257{ 258 int pkt_prio; 259 int l7_prio; 260 int i; 261 262 pkt_prio = skb->cb[sizeof(skb->cb) - 3]; 263 l7_prio = qos_l7_apps_priority[apps]; 264 265 //printk("#### Got L7apps %d, orig prio %d, l7 prio %d\n", apps, pkt_prio, l7_prio); 266 267 if (l7_prio > pkt_prio) 268 { 269 unsigned char *ipHdr; 270 unsigned int ipHdrLen; 271 UINT16 csum; 272 273#if 0 274 printk("skb->data: "); 275 276 for (i=0; i<20; i++) 277 printk("%02X ", (unsigned char)skb->data[i]); 278 printk("\n"); 279#endif 280 /* Get start of IP header & TCP header */ 281 ipHdr = &(skb->data[0]); 282 ipHdrLen = (ipHdr[0] & 0x0F) * 4; 283 284 /* Modify the DSCP value */ 285 ipHdr[1] = prio_to_dscp(l7_prio); 286 287 /* Recompute TCP checksum */ 288 ipHdr[10] = 0; 289 ipHdr[11] = 0; 290 csum = CalcChecksum(ipHdr, ipHdrLen); 291 ipHdr[10] = (csum & 0xFF00) >> 8; 292 ipHdr[11] = (csum & 0xFF); 293 294 // printk("!!!!!! Promote L7apps %d prio from %d to %d\n", apps, pkt_prio, l7_prio); 295 } 296 return 0; 297 298} 299/* Foxconn added end pling 11/08/2007 */ 300 301/*******function start*******/ 302 303unsigned char layer7_scan_all(struct sk_buff *skb, char *app_data, int appdatalen) 304{ 305 s_pattern_cache *node = first_pattern_cache; 306 int str_len = 0; 307 int i = 0; 308 309#ifdef L7_DEBUG_ON 310 L7_PRINTK_DEBUG_3("layer7_scan_all start\n"); 311#endif 312 313 str_len = ((sizeof(g_app_data)-1) > appdatalen) ? appdatalen : (sizeof(g_app_data)-1); 314 for (i=0; i<str_len; i++) 315 g_app_data[i] = tolower(app_data[i]); 316 g_app_data[i] = 0; 317 318 while (node != NULL) 319 { 320 if (regexec(node->pattern, g_app_data)) 321 { 322#ifdef L7_DEBUG_ON 323 L7_PRINTK_DEBUG_7("layer7 filter match: expression: %s\n", node->regex_string); 324 L7_PRINTK_DEBUG_1("layer7 filter match: protocol: %s\n", node->proto_name); 325#endif 326 return node->proto_enum; 327 } 328 329 node = node->next; 330 } 331 return 0;//dismatch 332} 333/* Returns offset the into the skb->data that the application data starts */ 334static int app_data_offset(const struct sk_buff *skb) 335{ 336 /* In case we are ported somewhere (ebtables?) where skb->nh.iph 337 isn't set, this can be gotten from 4*(skb->data[0] & 0x0f) as well. */ 338#ifdef LINUX26 339 int ip_hl = 4 * ip_hdr(skb)->ihl; 340#else /* LINUX26 */ 341 int ip_hl = 4*skb->nh.iph->ihl; 342#endif 343 344#ifdef LINUX26 345 if ( ip_hdr(skb)->protocol == IPPROTO_TCP ) 346#else /* LINUX26 */ 347 if ( skb->nh.iph->protocol == IPPROTO_TCP ) 348#endif /* LINUX26 */ 349 { 350 /* 12 == offset into TCP header for the header length field. 351 Can't get this with skb->h.th->doff because the tcphdr 352 struct doesn't get set when routing (this is confirmed to be 353 true in Netfilter as well as QoS.) */ 354 int tcp_hl = 4*(skb->data[ip_hl + 12] >> 4); 355 356 return ip_hl + tcp_hl; 357 } 358#ifdef LINUX26 359 else if ( ip_hdr(skb)->protocol == IPPROTO_UDP ) 360#else /* LINUX26 */ 361 else if ( skb->nh.iph->protocol == IPPROTO_UDP ) 362#endif /* LINUX26 */ 363 { 364 return ip_hl + 8; /* UDP header is always 8 bytes */ 365 } 366#ifdef LINUX26 367 else if ( ip_hdr(skb)->protocol == IPPROTO_ICMP ) 368#else /* LINUX26 */ 369 else if ( skb->nh.iph->protocol == IPPROTO_ICMP ) 370#endif /* LINUX26 */ 371 { 372 return ip_hl + 8; /* ICMP header is 8 bytes */ 373 } 374 else 375 { 376 if (net_ratelimit()) 377 L7_PRINTK_DEBUG_3(KERN_ERR "layer7: tried to handle unknown protocol!\n"); 378 return ip_hl + 8; /* something reasonable */ 379 } 380} 381 382int l7_filter_main(struct sk_buff *skb, int iDirection) 383{ 384 unsigned char *app_data; 385 unsigned int appdatalen; 386 T_ConnEntry *pConn; 387 unsigned char proto_enum = 0; 388 int iModifyType = 0; 389#ifdef L7_DEBUG_ON 390 int i = 0; 391 int iLen = sizeof(g_all_proto)/sizeof(g_all_proto[0]); 392#endif 393 394#ifdef L7_DEBUG_ON 395 L7_PRINTK_DEBUG_2("l7_filter_main start skb: %x, all_in out: %d %d, has_pri_in out: %d %d, in or out: %d\n", 396 skb, all_packet_in, all_packet_out, packet_has_pri_in, packet_has_pri_out, iDirection); 397 if (0 == ((all_packet_out+all_packet_in)&0xff))//print per 256 packets 398 L7_PRINTK_DEBUG_1("l7_filter_main start per 256, skb: %x, all_in out: %d %d, has_pri_in out: %d %d, in or out: %d\n", 399 skb, all_packet_in, all_packet_out, packet_has_pri_in, packet_has_pri_out, iDirection); 400 if (0 == ((all_packet_out+all_packet_in)&0x03ff))//list identified packets status of every proto per 1024 packets 401 { 402 L7_PRINTK_DEBUG_1("*********************** start ************************\n"); 403 L7_PRINTK_DEBUG_1("l7_filter_main per 1024, all_out: %d, has_pri_out: %d\n", 404 all_packet_out, packet_has_pri_out); 405 for (i=0; i<iLen; i++) 406 L7_PRINTK_DEBUG_1("Proto %s identified %d packets\n", g_all_proto[i].proto_name, g_all_proto[i].proto_packet_count); 407 L7_PRINTK_DEBUG_1("************************ end *************************\n"); 408 } 409 if (iDirection) 410 all_packet_out++; 411 else 412 all_packet_in++; 413#endif 414 415 if (NULL == skb) 416 return L7_ERROR; 417 418 skb->cb[sizeof(skb->cb)-4] = L7_ENUM_INIT;//initial value: -1(0xff) 419 420#ifdef LINUX26 421 pConn = FindConnByHash(ip_hdr(skb), &iModifyType, iDirection); 422#else /* LINUX26 */ 423 pConn = FindConnByHash(skb->nh.iph, &iModifyType, iDirection); 424#endif /* LINUX26 */ 425 426 if (NULL == pConn) 427 { 428#ifdef L7_DEBUG_ON 429 if (iDirection) 430 L7_PRINTK_DEBUG_2("l7_filter_main FindConnByHash fail.\n"); 431#endif 432 return L7_SUCCESS; 433 } 434 435#ifdef L7_DEBUG_ON 436 L7_PRINTK_DEBUG_3("l7_filter_main pConn: %x, pConn->packet_count: %d\n", pConn, pConn->packet_count); 437#endif 438 if (pConn->proto_enum != 0) 439 { 440 if (iDirection) 441 { 442#ifdef L7_DEBUG_ON 443 packet_has_pri_out++; 444 g_all_proto[pConn->proto_enum-1].proto_packet_count++; 445#endif 446 skb->cb[sizeof(skb->cb)-4] = pConn->proto_enum; 447 if (skb->cb[sizeof(skb->cb)-5]) 448 modify_dscp(skb, pConn->proto_enum); 449 } 450#ifdef L7_DEBUG_ON 451 else 452 packet_has_pri_in++; 453 L7_PRINTK_DEBUG_3("l7_filter_main pConn->proto_enum: %d\n", pConn->proto_enum); 454#endif 455 return L7_SUCCESS; 456 } 457 458 if (pConn->packet_count > num_packets) 459 { 460#ifdef L7_DEBUG_ON 461 L7_PRINTK_DEBUG_3("too many packets, l7_filter_main pConn->packet_count: %d\n", pConn->packet_count); 462#endif 463 if (iDirection) 464 { 465 skb->cb[sizeof(skb->cb)-4] = pConn->proto_enum; 466 if (skb->cb[sizeof(skb->cb)-5]) 467 modify_dscp(skb, pConn->proto_enum); 468 } 469 470 return L7_SUCCESS; 471 } 472 pConn->packet_count++; 473 474 if (skb_is_nonlinear(skb)) 475 { 476#ifdef LINUX26 477 if (skb_linearize(skb) != 0) 478#else /* LINUX26 */ 479 if (skb_linearize(skb, GFP_ATOMIC) != 0) 480#endif /* LINUX26 */ 481 { 482 if (net_ratelimit()) 483 L7_PRINTK_DEBUG_1(KERN_ERR "layer7: failed to linearize packet, bailing.\n"); 484 return L7_SUCCESS; 485 } 486 } 487 488 /* now that the skb is linearized, it's safe to set these. */ 489 app_data = skb->data + app_data_offset(skb); 490 appdatalen = skb->tail - app_data; 491 492 proto_enum = layer7_scan_all(skb, app_data, appdatalen); 493 494 if (proto_enum == L7_ENUM_NETGEAREVA) 495 { 496 if ((pConn->bProtocol != UDP_PROTOCOL) 497 || ((pConn->bNatType != AG_PORT_FORWARDING) 498 && ((ntohs(pConn->wDestPort) < EVA_PORT_START) || (ntohs(pConn->wDestPort) > EVA_PORT_END))) 499 || ((pConn->bNatType == AG_PORT_FORWARDING) 500 && ((ntohs(pConn->wSourcePort) < EVA_PORT_START) || (ntohs(pConn->wSourcePort) > EVA_PORT_END)))) 501 { 502 proto_enum = 0; 503 } 504 } 505 506 if (proto_enum != 0) 507 { 508#ifdef L7_DEBUG_ON 509 L7_PRINTK_DEBUG_1("l7_filter_main identify the conn %x, in %dth packet.\n", pConn, pConn->packet_count); 510#endif 511 if (iDirection) 512 { 513#ifdef L7_DEBUG_ON 514 packet_has_pri_out++; 515 g_all_proto[proto_enum-1].proto_packet_count++; 516#endif 517 skb->cb[sizeof(skb->cb)-4] = proto_enum; 518 if (skb->cb[sizeof(skb->cb)-5]) 519 modify_dscp(skb, pConn->proto_enum); 520 } 521#ifdef L7_DEBUG_ON 522 else 523 packet_has_pri_in++; 524#endif 525 pConn->proto_enum = proto_enum; 526 return L7_SUCCESS; 527 } 528 return L7_SUCCESS; 529} 530 531static int isxdigit(char c) 532{ 533 if ((c >= '0' && c <= '9') 534 || (c >= 'a' && c <= 'f') 535 || (c >= 'A' && c <= 'F')) 536 return 1; 537 else 538 return 0; 539} 540 541static char tolower(char c) 542{ 543 if (c >= 'A' && c <= 'Z') 544 c += 0x20; 545 return c; 546} 547 548static int hex2dec(char c) 549{ 550 switch (c) 551 { 552 case '0' ... '9': 553 return c - '0'; 554 case 'a' ... 'f': 555 return c - 'a' + 10; 556 case 'A' ... 'F': 557 return c - 'A' + 10; 558 default: 559#ifdef L7_DEBUG_ON 560 L7_PRINTK_DEBUG_2("hex2dec: bad value!\n"); 561#endif 562 return 0; 563 } 564} 565 566int pre_process(char *str_out, char *str_in, int str_out_len) 567{ 568 char *result = str_out; 569 char *s = str_in; 570 int sindex = 0, rindex = 0; 571 572 while ( sindex < strlen(s) && (rindex + 1 < str_out_len)) 573 { 574 if ( sindex + 3 < strlen(s) && 575 s[sindex] == '\\' && s[sindex+1] == 'x' && 576 isxdigit(s[sindex + 2]) && isxdigit(s[sindex + 3]) ) 577 { 578 /* carefully remember to call tolower here... */ 579 result[rindex] = tolower( hex2dec(s[sindex + 2])*16 + 580 hex2dec(s[sindex + 3] ) ); 581 582 switch ( result[rindex] ) 583 { 584 case 0x24: 585 case 0x28: 586 case 0x29: 587 case 0x2a: 588 case 0x2b: 589 case 0x2e: 590 case 0x3f: 591 case 0x5b: 592 case 0x5c: 593 case 0x5d: 594 case 0x5e: 595 case 0x7c: 596#ifdef L7_DEBUG_ON 597 L7_PRINTK_DEBUG_1("Warning: layer7 regexp contains a control character, %c, in hex (\\x%c%c).\n" 598 "I recommend that you write this as %c or \\%c, depending on what you meant.\n", 599 result[rindex], s[sindex + 2], s[sindex + 3], result[rindex], result[rindex]); 600#endif 601 break; 602 case 0x00: 603#ifdef L7_DEBUG_ON 604 L7_PRINTK_DEBUG_1("Warning: null (\\x00) in layer7 regexp. A null terminates the regexp string!\n"); 605#endif 606 break; 607 default: 608 break; 609 } 610 611 sindex += 3; /* 4 total */ 612 } 613 else 614 result[rindex] = tolower(s[sindex]); 615 616 sindex++; 617 rindex++; 618 } 619 result[rindex] = '\0'; 620 621 if (rindex > 0) 622 return 0; 623 else 624 return 1; 625} 626 627int load_all_pattern(void) 628{ 629 /* establish the link list of patterns*/ 630 s_pattern_cache * node = first_pattern_cache; 631 s_pattern_cache * tmp; 632 unsigned int len; 633 unsigned int num_proto = sizeof(g_all_proto)/sizeof(s_proto_regexp); 634 int i = 0; 635 636#ifdef L7_DEBUG_ON 637 L7_PRINTK_DEBUG_1("l7 filter, load_all_pattern start, num_proto: %d\n", num_proto); 638#endif 639 640 for (i=0; i<num_proto; i++) 641 { 642#ifdef L7_DEBUG_ON 643 L7_PRINTK_DEBUG_2("load_all_pattern for loop: %d, proto_regexp: %s,\n sizeof(s_pattern_cache): %d.\n", 644 i, g_all_proto[i].proto_regexp, sizeof(s_pattern_cache)); 645#endif 646 if (0 != pre_process(g_exp, g_all_proto[i].proto_regexp, sizeof(g_exp))) 647 continue; 648 649 /* Be paranoid about running out of memory to avoid list corruption. */ 650 tmp = kmalloc(sizeof(s_pattern_cache), GFP_ATOMIC); 651 if (!tmp) 652 { 653 L7_PRINTK_DEBUG_1("layer7: out of memory in compile_and_cache, bailing. 1\n"); 654 if (net_ratelimit()) 655 L7_PRINTK_DEBUG_1(KERN_ERR "layer7: out of memory in compile_and_cache, bailing.\n"); 656 return NULL; 657 } 658 659 tmp->regex_string = kmalloc(strlen(g_exp) + 1, GFP_ATOMIC); 660 if (NULL == tmp->regex_string) 661 { 662 L7_PRINTK_DEBUG_1("layer7: out of memory in compile_and_cache, bailing. 2\n"); 663 if (net_ratelimit()) 664 L7_PRINTK_DEBUG_1(KERN_ERR "layer7: out of memory in compile_and_cache, bailing.\n"); 665 kfree(tmp); 666 return NULL; 667 } 668 669 tmp->pattern = regcomp(g_exp, &len); 670 if (NULL == tmp->pattern) 671 { 672 L7_PRINTK_DEBUG_1("layer7: out of memory in compile_and_cache, bailing. 3\n"); 673 if (net_ratelimit()) 674 L7_PRINTK_DEBUG_1(KERN_ERR "layer7: out of memory in compile_and_cache, bailing.\n"); 675 kfree(tmp->regex_string); 676 kfree(tmp); 677 return NULL; 678 } 679 680 strcpy(tmp->regex_string, g_exp); 681 tmp->next = NULL; 682 tmp->proto_enum = g_all_proto[i].proto_enum; 683 tmp->proto_name = g_all_proto[i].proto_name; 684 685#ifdef L7_DEBUG_ON 686 L7_PRINTK_DEBUG_2("regexp: %s\n", tmp->proto_name); 687 L7_PRINTK_DEBUG_2("tmp->pattern->regstart: %d\n", tmp->pattern->regstart); 688 L7_PRINTK_DEBUG_2("tmp->pattern->reganch: %d\n", tmp->pattern->reganch); 689 if (tmp->pattern->regmust != NULL) 690 L7_PRINTK_DEBUG_2("tmp->pattern->regmust: %s\n", tmp->pattern->regmust); 691 L7_PRINTK_DEBUG_2("tmp->pattern->regmlen: %d\n", tmp->pattern->regmlen); 692 L7_PRINTK_DEBUG_2("tmp->pattern->program[0]: %d\n", tmp->pattern->program[0]); 693#endif/* end of #ifdef L7_DEBUG_ON */ 694 if (NULL == node) 695 { 696 node = tmp; 697 first_pattern_cache = tmp; 698 } 699 else 700 { 701 node->next = tmp; 702 node = tmp; 703 } 704 } 705 706 return 1; 707} 708 709void free_all_pattern(void) 710{ 711 s_pattern_cache *node = first_pattern_cache; 712 s_pattern_cache *tmp; 713 714 while (node != NULL) 715 { 716 if (node->regex_string != NULL) 717 kfree(node->regex_string); 718 if (node->pattern != NULL) 719 kfree(node->pattern); 720 721 tmp = node; 722 node = node->next; 723 kfree(tmp); 724 } 725} 726 727static int __init init(void) 728{ 729 int ret = 0; 730 731#ifdef CONFIG_NETFILTER 732 ret = nf_register_hook(&l7_filter_prerouting_ops); 733 if (ret < 0) { 734 printk("<0>Error registering l7 filter prerouting.\n"); 735 nf_unregister_hook(&l7_filter_prerouting_ops); 736 return ret; 737 } 738 ret = nf_register_hook(&l7_filter_postrouting_ops); 739 if (ret < 0) { 740 printk("<0>Error registering l7 filter postrouting.\n"); 741 return ret; 742 } 743#else /* CONFIG_NETFILTER */ 744 acosL7Filter_register_hook(l7_filter_main); 745#endif /* CONFIG_NETFILTER */ 746 747 load_all_pattern(); 748 749 load_apps_priority(); /* Foxconn added pling 11/08/2007 */ 750 751 return ret; 752} 753 754static void __exit fini(void) 755{ 756#ifdef CONFIG_NETFILTER 757 nf_unregister_hook(&l7_filter_prerouting_ops); 758 nf_unregister_hook(&l7_filter_postrouting_ops); 759#else 760 acosL7Filter_register_hook(NULL); 761#endif /* CONFIG_NETFILTER */ 762 763 free_all_pattern(); 764} 765 766module_init(init); 767module_exit(fini); 768 769EXPORT_SYMBOL(l7_filter_main); 770