URL过滤器(1)

5126阅读　0评论2011-11-08　lthyxy
分类：LINUX

  1. /*

  3. 其中 * 表示0或者多个小写字母，? 代表1个字母。
  4. 原理就是:挂一个钩子函数去 NF_INET_LOCAL_OUT
  5. 然后分析数据包,如果是TCP/IP包,而且端口是80,而且是80端口(也就是http协议)
  6. 如果是GET方法就把里面的URL提取出来,看是否跟要过滤的匹配.
  7. 要过滤则直接丢弃这个包.
  8. 进一步工作:
  9.   用bitmap过滤.
  10.   如果匹配不是丢弃这个包而是发回一个RST包.
  11. */

  13. #include <linux/module.h>
  14. #include <linux/moduleparam.h>
  15. #include <linux/kernel.h>
  16. #include <linux/skbuff.h>
  17. #include <linux/ip.h>
  18. #include <linux/tcp.h>
  19. #include <net/tcp.h>
  20. #include <net/udp.h>
  21. #include <linux/netfilter.h>
  22. #include <linux/netfilter_ipv4.h>
  23. #include <net/sock.h>
  24. #include <net/netfilter/nf_nat.h>
  25. #include <net/netfilter/nf_nat_helper.h>
  26. #include <net/netfilter/nf_nat_rule.h>
  27. #include <net/netfilter/nf_conntrack.h>
  28. #include <net/netfilter/nf_conntrack_helper.h>
  29. #include <net/netfilter/nf_conntrack_expect.h>

  31. MODULE_LICENSE("GPL");
  32. MODULE_AUTHOR("liutengfei ");
  33. MODULE_DESCRIPTION("URLFilter");
  34. MODULE_VERSION("1.0");
  35. bool f[51][51];
  36. char now[50];

  38. bool url_filter(char *ok)
  39. {
  40.   int ii,i,j,k,lp,ls;
  41.   char *p,*s;//p是带*,?的
  42.   char a[3][50] = {
  43.                   "",
  44.                   "*baidu*",
  45.                   "ww?.google.cn"
  46.                   /*
  47.                    这里放入你想过滤的东西
  48.                   */
  49.                  };
  50.   for (ii = 0;; ++ii){
  51.     if (ok[ii] == 'H' && ok[ii+1] == 'o' && ok[ii+2] == 's'
  52.         && ok[ii+3] == 't' && ok[ii+4] == ':'){
  53.        k = 0;
  54.        ii += 6;
  55.        
  56.        while(ok[ii] != '\r' && ok[ii+1] != '\n')
  57.          now[k++] = ok[ii++];
  58.        now[k] = '\0';
  59.        ls = strlen(now);
  60.        for (k = 0; k < 3; ++k){//全部都尝试一次
  61.           
  62.          memset(f,false,sizeof(f));
  63.          f[0][0] = true;
  64.          lp = strlen(a[k]);
  65.          p = a[k];
  66.          s = now;
  67.          
  68.         for (i = 1 ; i <= lp ; i++){
  69.           for (j = 0 ;j <= ls ; j++){
  70.                 if (p[i-1] == '*')
  71.                     f[i][j] = j? (f[i-1][j] | f[i][j-1]) : f[i-1][j];
  72.                 else if (j){
  73.                             if (p[i-1] == '?') f[i][j] = f[i-1][j-1];
  74.                             else f[i][j] = f[i-1][j-1] & (p[i-1] == s[j-1]);
  75.                 }
  76.           }
  77.         }
  78.         
  79.         if (f[lp][ls])
  80.             return true;
  81.        }
  82.        
  83.      return false;
  84.     }
  85.   }
  86.   
  87.   return false;
  88. }

  90. unsigned int check_link_address(unsigned int hooknum, struct sk_buff *skb,
  91.         const struct net_device *in, const struct net_device *out, int(*okfn)(
  92.                 struct sk_buff *))
  93. {
  94.     char * payload = NULL;
  95.     const struct iphdr *iph = NULL;
  96.     struct tcphdr *tcph = NULL;
  97.     __be16 dport;
  98.     int len;
  99.     
  100.     iph = ip_hdr(skb);
  101.     
  102.     if (iph->protocol == IPPROTO_TCP) {
  103.       
  104.         tcph = tcp_hdr(skb);
  105.         dport = tcph->dest;
  106.         len = tcph->doff*4 + iph->ihl*4;
  107.         
  108.         if (likely(ntohs(dport) != 80))
  109.             return NF_ACCEPT;
  110.             
  111.         if (0 != skb_linearize(skb))
  112.             return NF_ACCEPT;
  113.             
  114.         payload = (void *) skb->data + len;//+len后直接到GET
  115.         if (0 == strncmp(payload, "GET", 3)) {
  116.             if (url_filter(payload)){
  117.                 return NF_DROP;
  118.             }
  119.         }
  120.    }
  121.    
  122.   return NF_ACCEPT;
  123. }

  125. static struct nf_hook_ops http_hooks =
  126. {
  127.         .pf = NFPROTO_IPV4,
  128.         .priority = NF_IP_PRI_MANGLE,
  129.         .hooknum = NF_INET_LOCAL_OUT,
  130.         .hook = check_link_address,
  131.         .owner = THIS_MODULE,
  132. };

  134. static int __init url_init(void)
  135. {
  136.     nf_register_hook(&http_hooks);
  137.     return 0;
  138. }

  140. static void __exit url_cleanup(void)
  141. {
  142.     nf_unregister_hook(&http_hooks);
  143. }

  145. module_init(url_init);
  146. module_exit(url_cleanup);
上一篇：struct sk_buff在内核2.6.24版本以后的扩展变化
下一篇：hbase框架介绍