266 lines
7.2 KiB
C
Executable File
266 lines
7.2 KiB
C
Executable File
#include "../api/conntrack_api.h"
|
||
|
||
/*
|
||
说明: 测试前提:
|
||
1、之前必须有相应的流经过,而且链接跟踪必须没有老化,否则
|
||
根据五元组是获取不到ct的,获取不到ct,就无法设置ct里的aid
|
||
比如tcp,比如在调用之前要先建立三次握手,只要状态为ESTABLISHED
|
||
则ct不会老化.
|
||
2、根据五元组获取到ct之后,必须有相应的流经过，才会找到
|
||
对应的ct,才能将之前设置的aid查找出来.
|
||
测试步骤
|
||
1、加载conntrack_api.ko
|
||
2、建立tcp三次握手,看状态为ESTABLISHED
|
||
3、test中的设置aid的函数dpi_set_aid_test_tcp放在init中
|
||
在加载模块的时候只运行一次,get_aid_test放在netfilter的钩子
|
||
中,因为这个在将来业务模块调用时会由报文触发
|
||
4、加载test.ko(此处的test为在init函数中只设置一次aid,所以
|
||
如果未设置tcp三次握手，也就是说没有在链接跟踪中记录到
|
||
这个五元组对应的流,则test找不到ct,设置aid失败;
|
||
如果dpi_set_aid_test_tcp放在netfilter的钩子中,由报文触发,
|
||
则加载test.ko和链接跟踪创建的时序就无所谓了)
|
||
|
||
keypoint: 流触发建立链接跟踪和test的加载顺序,如果设置aid
|
||
放在init,只设置一次,那么执行顺序很重要;如果设置aid在netfilter
|
||
钩子中,由报文触发,又不断有这个流经过,则执行顺序无所谓,因为只
|
||
要找到有一次,设置进去就可以了
|
||
|
||
测试的时候可以写个tcp程序,server端一直循环recv,不close fd,
|
||
client端也不close fd,等待终端输入调用send;三次握手创建ct,后续
|
||
查询靠send触发.
|
||
|
||
TCP报文记录链接跟踪的前提是建立三次握手成功,如果单方面打流是
|
||
不行的.但是UDP可以单方面打流来创建ct.
|
||
输入:无
|
||
输出:无
|
||
返回值: 0或-1
|
||
*/
|
||
|
||
|
||
enum test_proto_type{
|
||
TEST_PROTO_TCP,
|
||
TEST_PROTO_UDP,
|
||
};
|
||
|
||
/**********************************************************
|
||
* 函数功能:测试获取应用aid,挂在netfilter的hook上
|
||
* 输入:void *, struct sk_buff *, const struct nf_hook_state *
|
||
* 输出: 无
|
||
* 返回值: 无
|
||
**********************************************************/
|
||
static unsigned int get_aid_test(void *priv, struct sk_buff *skb, const struct nf_hook_state *state)
|
||
{
|
||
int ret;
|
||
uint16_t aid;
|
||
printk(KERN_INFO"[test]: test get app_id\n");
|
||
ret = cmhi_get_conntrack_u16(skb, &aid, APP_ID);
|
||
if(ret == CMHI_EXT_ERR){
|
||
printk(KERN_INFO"[test]: get app_id failed\n");
|
||
goto out;
|
||
}
|
||
printk(KERN_INFO"[test]: get app_id: %d successed\n", aid);
|
||
goto out;
|
||
|
||
out:
|
||
return NF_ACCEPT;
|
||
|
||
}
|
||
|
||
/**********************************************************
|
||
* 函数功能:测试根据TCP的DPI五元组获取链接跟踪指针ct
|
||
* 输入: 无
|
||
* 输出: 无
|
||
* 返回值: 0或-1
|
||
**********************************************************/
|
||
int dpi_get_ct_test_tcp(void)
|
||
{
|
||
int ret;
|
||
struct nf_conn *ct;
|
||
struct dpi_tuple dpi_tuple;
|
||
dpi_tuple.sip = htonl(0xc0a840bc);//192.168.64.188
|
||
dpi_tuple.dip = htonl(0xc0a840c2);//192.168.64.194
|
||
dpi_tuple.protonum = IPPROTO_TCP;
|
||
dpi_tuple.sport = htons(179);
|
||
dpi_tuple.dport = htons(10020);
|
||
printk(KERN_INFO"[Test-tcp]dpi_tuple sip=%u, dip=%u, proto=%d, sport=%du, dport=%du\n",
|
||
dpi_tuple.sip, dpi_tuple.dip, dpi_tuple.protonum, dpi_tuple.sport, dpi_tuple.dport);
|
||
ct = get_conntrack_from_tuple(&dpi_tuple);
|
||
if(!ct){
|
||
printk(KERN_ERR"[Test-tcp]get ct failed!!\n");
|
||
ret = CMHI_EXT_ERR;
|
||
}
|
||
else {
|
||
printk(KERN_INFO"[Test-tcp]Find it!!\n");
|
||
ret = CMHI_EXT_OK;
|
||
|
||
}
|
||
goto out;
|
||
|
||
out:
|
||
return ret;
|
||
|
||
}
|
||
|
||
/**********************************************************
|
||
* 函数功能:测试根据UDP的DPI五元组获取链接跟踪指针ct
|
||
* 输入: 无
|
||
* 输出: 无
|
||
* 返回值: 0或-1
|
||
**********************************************************/
|
||
|
||
int dpi_get_ct_test_udp(void)
|
||
{
|
||
int ret;
|
||
struct nf_conn *ct;
|
||
struct dpi_tuple dpi_tuple;
|
||
dpi_tuple.sip = htonl(0xc0a840c7);//192.168.64.199
|
||
dpi_tuple.dip = htonl(0xc0a840c2);//192.168.64.194
|
||
dpi_tuple.protonum = IPPROTO_UDP;
|
||
dpi_tuple.sport = htons(7);
|
||
dpi_tuple.dport = htons(520);
|
||
printk(KERN_INFO"[Test-udp]dpi_tuple sip=%x, dip=%x, proto=%d, sport=%x, dport=%x\n",
|
||
dpi_tuple.sip, dpi_tuple.dip, dpi_tuple.protonum, dpi_tuple.sport, dpi_tuple.dport);
|
||
ct = get_conntrack_from_tuple(&dpi_tuple);
|
||
if(!ct){
|
||
printk(KERN_ERR"[Test-udp]get ct failed!!\n");
|
||
ret = CMHI_EXT_ERR;
|
||
}
|
||
else {
|
||
printk(KERN_INFO"[Test-udp]Find it!!\n");
|
||
ret = CMHI_EXT_OK;
|
||
|
||
}
|
||
goto out;
|
||
|
||
out:
|
||
return ret;
|
||
|
||
}
|
||
|
||
/**********************************************************
|
||
* 函数功能:测试根据TCP的DPI五元组设置链接跟踪ct里的aid
|
||
* 输入: 无
|
||
* 输出: 无
|
||
* 返回值: 0或-1
|
||
**********************************************************/
|
||
int dpi_set_aid_test_tcp(void)
|
||
{
|
||
int ret;
|
||
// uint16_t aid;
|
||
struct dpi dpi;
|
||
dpi.tuple.sip = htonl(0xc0a840bc);//192.168.64.188
|
||
dpi.tuple.dip = htonl(0xc0a840c2);//192.168.64.194
|
||
dpi.tuple.protonum = IPPROTO_TCP;
|
||
dpi.tuple.sport = htons(179);
|
||
dpi.tuple.dport = htons(10020);
|
||
dpi.aid = 3;
|
||
printk(KERN_INFO"[Test]dpi_tuple sip=%x, dip=%x, proto=%d, sport=%du, dport=%du,aid=%d\n",
|
||
dpi.tuple.sip, dpi.tuple.dip, dpi.tuple.protonum, dpi.tuple.sport, dpi.tuple.dport, dpi.aid);
|
||
ret = set_aid_by_dpi_tuple(&dpi);
|
||
if(CMHI_EXT_OK != ret){
|
||
printk(KERN_ERR"[Test]set_aid_by_dpi_tuple failed.\n");
|
||
return CMHI_EXT_ERR;
|
||
}
|
||
return CMHI_EXT_OK;
|
||
}
|
||
|
||
/**********************************************************
|
||
* 函数功能:测试根据UDP的DPI五元组设置链接跟踪ct里的aid
|
||
* 输入: 无
|
||
* 输出: 无
|
||
* 返回值: 0或-1
|
||
**********************************************************/
|
||
int dpi_set_aid_test_udp(void)
|
||
{
|
||
int ret;
|
||
// uint16_t aid;
|
||
struct dpi dpi;
|
||
dpi.tuple.sip = htonl(0xc0a840c7);//192.168.64.199
|
||
dpi.tuple.dip = htonl(0xc0a840c2);//192.168.64.194
|
||
dpi.tuple.protonum = IPPROTO_UDP;
|
||
dpi.tuple.sport = htons(7);
|
||
dpi.tuple.dport = htons(520);
|
||
dpi.aid = 5;
|
||
printk(KERN_INFO"[Test]dpi_set_aid_test_udp: dpi_tuple sip=%x, dip=%x, proto=%d, sport=%d, dport=%d,aid=%d\n",
|
||
dpi.tuple.sip, dpi.tuple.dip, dpi.tuple.protonum, dpi.tuple.sport, dpi.tuple.dport, dpi.aid);
|
||
ret = set_aid_by_dpi_tuple(&dpi);
|
||
if(CMHI_EXT_OK != ret){
|
||
printk(KERN_ERR"[Test]dpi_set_aid_test_udp: set_aid_by_dpi_tuple failed.\n");
|
||
return CMHI_EXT_ERR;
|
||
}
|
||
return CMHI_EXT_OK;
|
||
}
|
||
|
||
|
||
/**********************************************************
|
||
* 函数功能:测试根据协议类型是TCP还是UDP来调用TCP或UDP的设置
|
||
* aid的函数
|
||
* 输入: 协议类型enum test_proto_type
|
||
* 输出: 无
|
||
* 返回值: 无
|
||
**********************************************************/
|
||
void dpi_set_aid_test(enum test_proto_type type)
|
||
{
|
||
if(TEST_PROTO_TCP == type){
|
||
dpi_set_aid_test_tcp();
|
||
}
|
||
else if(TEST_PROTO_UDP == type){
|
||
dpi_set_aid_test_udp();
|
||
}
|
||
|
||
return;
|
||
}
|
||
|
||
/**********************************************************
|
||
* 函数功能:测试根据协议类型是TCP还是UDP来调用TCP或UDP的获取
|
||
* 链接跟踪指针ct
|
||
* 输入: 协议类型enum test_proto_type
|
||
* 输出: 无
|
||
* 返回值: 无
|
||
**********************************************************/
|
||
void dpi_get_ct_test(enum test_proto_type type)
|
||
{
|
||
if(TEST_PROTO_TCP == type){
|
||
dpi_get_ct_test_tcp();
|
||
}
|
||
else if(TEST_PROTO_UDP == type){
|
||
dpi_get_ct_test_udp();
|
||
}
|
||
|
||
return;
|
||
}
|
||
|
||
static struct nf_hook_ops nfho[] __read_mostly = {
|
||
//{
|
||
//.hook = (nf_hookfn *)demoB,
|
||
//.hooknum = NF_INET_PRE_ROUTING,
|
||
//.pf = NFPROTO_IPV4,
|
||
//.priority = (NF_IP_PRI_FILTER-1),
|
||
//},
|
||
{
|
||
.hook = (nf_hookfn *)get_aid_test,
|
||
.hooknum = NF_INET_PRE_ROUTING,
|
||
.pf = NFPROTO_IPV4,
|
||
.priority = NF_IP_PRI_FILTER,
|
||
},
|
||
};
|
||
|
||
static int __init test_init(void)
|
||
{
|
||
dpi_set_aid_test(TEST_PROTO_TCP);
|
||
nf_register_net_hooks(&init_net, nfho, ARRAY_SIZE(nfho));
|
||
printk(KERN_INFO"[Test] Module_init\n");
|
||
return 0;
|
||
}
|
||
|
||
static void __exit test_clean(void)
|
||
{
|
||
nf_unregister_net_hooks(&init_net, nfho, ARRAY_SIZE(nfho));
|
||
printk(KERN_INFO"[Test]Module_clean\n");
|
||
return;
|
||
}
|
||
|
||
module_init(test_init);
|
||
module_exit(test_clean);
|
||
MODULE_LICENSE("GPL");
|