Skip to content

N
nexdpi
Commit 60ee64dd authored by Franco (nextime) Lanza's avatar Franco (nextime) Lanza
Browse files
Options

A bit o priorities reorder

parent 55e3eb1a
Hide whitespace changes
Inline Side-by-side
Showing with 42 additions and 36 deletions
dpi
View file @ 60ee64dd
...@@ -187,7 +187,7 @@ class NexDPI(): ...@@ -187,7 +187,7 @@ class NexDPI():
sername = aname.split(".")[-1:][0] sername = aname.split(".")[-1:][0]
ipv=flow.ip_version ipv=flow.ip_version
log.debug("RECEIVED: "+cname+" "+aname+" "+sername) log.debug("RECEIVED: "+cname+" "+aname+" "+sername+"\n\n"+str(flow))
if [aname, cname] in list(Ignore): if [aname, cname] in list(Ignore):
log.debug("IGNORED: "+self.fullname) log.debug("IGNORED: "+self.fullname)
...@@ -200,7 +200,7 @@ class NexDPI(): ...@@ -200,7 +200,7 @@ class NexDPI():
else: else:
ipset_list = appd['ipset'] ipset_list = appd['ipset']
if not aname.startswith(tuple(appd['nostart'])): if not aname.startswith(tuple(appd['nostart'])):
managed=True managed=ipset_list+" Apps"
sh("ipset test "+ipset_list+" "+triplet+" >/dev/null 2>&1 || ipset add "+ipset_list+" "+triplet+" timeout "+appd['timeout']+" > /dev/null 2>&1") sh("ipset test "+ipset_list+" "+triplet+" >/dev/null 2>&1 || ipset add "+ipset_list+" "+triplet+" timeout "+appd['timeout']+" > /dev/null 2>&1")
log.info("ADD: "+ipset_list+" "+triplet+" "+self.fullname) log.info("ADD: "+ipset_list+" "+triplet+" "+self.fullname)
if aname.startswith(tuple(appd['knowstarts'])): if aname.startswith(tuple(appd['knowstarts'])):
...@@ -212,7 +212,7 @@ class NexDPI(): ...@@ -212,7 +212,7 @@ class NexDPI():
else: else:
ipset_list = Cats[cname]['ipset'] ipset_list = Cats[cname]['ipset']
if not aname.startswith(tuple(Cats[cname]['nostart'])) and not sername in list(Cats[cname]['noapps']): if not aname.startswith(tuple(Cats[cname]['nostart'])) and not sername in list(Cats[cname]['noapps']):
managed=True managed=ipset_list+" Cats"
sh("ipset add "+ipset_list+" "+triplet+" timeout "+Cats[cname]['timeout']+" --exist > /dev/null 2>&1") sh("ipset add "+ipset_list+" "+triplet+" timeout "+Cats[cname]['timeout']+" --exist > /dev/null 2>&1")
log.info("ADD: "+ipset_list+" "+triplet+" "+self.fullname) log.info("ADD: "+ipset_list+" "+triplet+" "+self.fullname)
if sername in list(Cats[cname]['knownapps']): if sername in list(Cats[cname]['knownapps']):
...@@ -229,7 +229,7 @@ class NexDPI(): ...@@ -229,7 +229,7 @@ class NexDPI():
if managed: if managed:
log.warning("MANAGED_UNKNOWN: "+self.fullname) log.warning("MANAGED_UNKNOWN: "+self.fullname)
f = open("/tmp/dpi.managed.unknown", "a") f = open("/tmp/dpi.managed.unknown", "a")
f.write(aname+" "+cname+"\n") f.write(aname+" "+cname+" "+managed+"\n")
f.close() f.close()
UnknownMatch.append(self.fullname) UnknownMatch.append(self.fullname)
......
shaping
View file @ 60ee64dd
...@@ -241,63 +241,69 @@ ApplyShaping() { ...@@ -241,63 +241,69 @@ ApplyShaping() {
$TCLASS 1:1 classid 1:50 htb rate ${MAXREDUCEDRATE}mbit ceil ${REALRATE}mbit prio 1 $TCLASS 1:1 classid 1:50 htb rate ${MAXREDUCEDRATE}mbit ceil ${REALRATE}mbit prio 1
$TDISC 1:50 fq_codel $TDISC 1:50 fq_codel
$TFILTER 1: protocol ip prio 4 basic match "ipset(social_extip $OUTDIR)" flowid 1:40 # Prioritis are important! The first that match is the winning one.
$TFILTER 1: protocol ip prio 3 basic match "ipset(social_ip $INTDIR)" flowid 1:40
$TFILTER 1: protocol ip prio 2 basic match "ipset(social_triplet $OUTDIR,$OUTDIR,$INTDIR)" flowid 1:40
$TFILTER 1: protocol ip prio 1 handle ${IPSETS["social"]} fw flowid 1:40 $TFILTER 1: protocol ip prio 1 handle ${IPSETS["social"]} fw flowid 1:40
$TFILTER 1: protocol ipv6 prio 8 basic match "ipset(social_extip6 $OUTDIR)" flowid 1:40 $TFILTER 1: protocol ip prio 2 basic match "ipset(social_ip $INTDIR)" flowid 1:40
$TFILTER 1: protocol ipv6 prio 7 basic match "ipset(social_ip6 $INTDIR)" flowid 1:40 $TFILTER 1: protocol ip prio 3 basic match "ipset(social_extip $OUTDIR)" flowid 1:40
$TFILTER 1: protocol ipv6 prio 6 basic match "ipset(social_triplet6 $OUTDIR,$OUTDIR,$INTDIR)" flowid 1:40 $TFILTER 1: protocol ip prio 4 basic match "ipset(social_triplet $OUTDIR,$OUTDIR,$INTDIR)" flowid 1:40
$TFILTER 1: protocol ipv6 prio 5 handle ${IPSETS["social"]} fw flowid 1:40 $TFILTER 1: protocol ipv6 prio 5 handle ${IPSETS["social"]} fw flowid 1:40
$TFILTER 1: protocol ipv6 prio 6 basic match "ipset(social_ip6 $INTDIR)" flowid 1:40
$TFILTER 1: protocol ipv6 prio 7 basic match "ipset(social_extip6 $OUTDIR)" flowid 1:40
$TFILTER 1: protocol ipv6 prio 8 basic match "ipset(social_triplet6 $OUTDIR,$OUTDIR,$INTDIR)" flowid 1:40
$TFILTER 1: protocol ip prio 4 basic match "ipset(kids_extip $OUTDIR)" flowid 1:43
$TFILTER 1: protocol ip prio 3 basic match "ipset(kids_ip $INTDIR)" flowid 1:30
$TFILTER 1: protocol ip prio 2 basic match "ipset(kids_triplet $OUTDIR,$OUTDIR,$INTDIR)" flowid 1:30
$TFILTER 1: protocol ip prio 1 handle ${IPSETS["kids"]} fw flowid 1:30 $TFILTER 1: protocol ip prio 1 handle ${IPSETS["kids"]} fw flowid 1:30
$TFILTER 1: protocol ipv6 prio 8 basic match "ipset(kids_extip6 $OUTDIR)" flowid 1:43 $TFILTER 1: protocol ip prio 2 basic match "ipset(kids_ip $INTDIR)" flowid 1:30
$TFILTER 1: protocol ipv6 prio 7 basic match "ipset(kids_ip6 $INTDIR)" flowid 1:30 $TFILTER 1: protocol ip prio 3 basic match "ipset(kids_extip $OUTDIR)" flowid 1:43
$TFILTER 1: protocol ipv6 prio 6 basic match "ipset(kids_triplet6 $OUTDIR,$OUTDIR,$INTDIR)" flowid 1:30 $TFILTER 1: protocol ip prio 4 basic match "ipset(kids_triplet $OUTDIR,$OUTDIR,$INTDIR)" flowid 1:30
$TFILTER 1: protocol ipv6 prio 5 handle ${IPSETS["kids"]} fw flowid 1:30 $TFILTER 1: protocol ipv6 prio 5 handle ${IPSETS["kids"]} fw flowid 1:30
$TFILTER 1: protocol ipv6 prio 6 basic match "ipset(kids_ip6 $INTDIR)" flowid 1:30
$TFILTER 1: protocol ipv6 prio 7 basic match "ipset(kids_extip6 $OUTDIR)" flowid 1:43
$TFILTER 1: protocol ipv6 prio 8 basic match "ipset(kids_triplet6 $OUTDIR,$OUTDIR,$INTDIR)" flowid 1:30
$TFILTER 1: protocol ip prio 4 basic match "ipset(system_extip $OUTDIR)" flowid 1:20
$TFILTER 1: protocol ip prio 3 basic match "ipset(system_ip $INTDIR)" flowid 1:20
$TFILTER 1: protocol ip prio 2 basic match "ipset(system_triplet $OUTDIR,$OUTDIR,$INTDIR)" flowid 1:20
$TFILTER 1: protocol ip prio 1 handle ${IPSETS["system"]} fw flowid 1:20 $TFILTER 1: protocol ip prio 1 handle ${IPSETS["system"]} fw flowid 1:20
$TFILTER 1: protocol ipv6 prio 8 basic match "ipset(system_extip6 $OUTDIR)" flowid 1:20 $TFILTER 1: protocol ip prio 2 basic match "ipset(system_ip $INTDIR)" flowid 1:20
$TFILTER 1: protocol ipv6 prio 7 basic match "ipset(system_ip6 $INTDIR)" flowid 1:20 $TFILTER 1: protocol ip prio 3 basic match "ipset(system_extip $OUTDIR)" flowid 1:20
$TFILTER 1: protocol ipv6 prio 6 basic match "ipset(system_triplet6 $OUTDIR,$OUTDIR,$INTDIR)" flowid 1:20 $TFILTER 1: protocol ip prio 4 basic match "ipset(system_triplet $OUTDIR,$OUTDIR,$INTDIR)" flowid 1:20
$TFILTER 1: protocol ipv6 prio 5 handle ${IPSETS["system"]} fw flowid 1:20 $TFILTER 1: protocol ipv6 prio 5 handle ${IPSETS["system"]} fw flowid 1:20
$TFILTER 1: protocol ipv6 prio 6 basic match "ipset(system_ip6 $INTDIR)" flowid 1:20
$TFILTER 1: protocol ipv6 prio 7 basic match "ipset(system_extip6 $OUTDIR)" flowid 1:20
$TFILTER 1: protocol ipv6 prio 8 basic match "ipset(system_triplet6 $OUTDIR,$OUTDIR,$INTDIR)" flowid 1:20
$TFILTER 1: protocol ip prio 4 basic match "ipset(full_extip $OUTDIR)" flowid 1:50
$TFILTER 1: protocol ip prio 3 basic match "ipset(full_ip $INTDIR)" flowid 1:50
$TFILTER 1: protocol ip prio 2 basic match "ipset(full_triplet $OUTDIR,$OUTDIR,$INTDIR)" flowid 1:50
$TFILTER 1: protocol ip prio 1 handle ${IPSETS["full"]} fw flowid 1:50 $TFILTER 1: protocol ip prio 1 handle ${IPSETS["full"]} fw flowid 1:50
$TFILTER 1: protocol ipv6 prio 8 basic match "ipset(full_extip6 $OUTDIR)" flowid 1:50 $TFILTER 1: protocol ip prio 2 basic match "ipset(full_ip $INTDIR)" flowid 1:50
$TFILTER 1: protocol ipv6 prio 7 basic match "ipset(full_ip6 $INTDIR)" flowid 1:50 $TFILTER 1: protocol ip prio 3 basic match "ipset(full_extip $OUTDIR)" flowid 1:50
$TFILTER 1: protocol ipv6 prio 6 basic match "ipset(full_triplet6 $OUTDIR,$OUTDIR,$INTDIR)" flowid 1:50 $TFILTER 1: protocol ip prio 2 basic match "ipset(full_triplet $OUTDIR,$OUTDIR,$INTDIR)" flowid 1:50
$TFILTER 1: protocol ipv6 prio 5 handle ${IPSETS["full"]} fw flowid 1:50 $TFILTER 1: protocol ipv6 prio 5 handle ${IPSETS["full"]} fw flowid 1:50
$TFILTER 1: protocol ipv6 prio 6 basic match "ipset(full_ip6 $INTDIR)" flowid 1:50
$TFILTER 1: protocol ipv6 prio 7 basic match "ipset(full_extip6 $OUTDIR)" flowid 1:50
$TFILTER 1: protocol ipv6 prio 8 basic match "ipset(full_triplet6 $OUTDIR,$OUTDIR,$INTDIR)" flowid 1:50
$TFILTER 1: protocol ip prio 4 basic match "ipset(streaming_extip $OUTDIR)" flowid 11:12
$TFILTER 1: protocol ip prio 3 basic match "ipset(streaming_ip $INTDIR)" flowid 11:12
$TFILTER 1: protocol ip prio 2 basic match "ipset(streaming_triplet $OUTDIR,$OUTDIR,$INTDIR)" flowid 11:12
$TFILTER 1: protocol ip prio 1 handle ${IPSETS["streaming"]} fw flowid 11:12 $TFILTER 1: protocol ip prio 1 handle ${IPSETS["streaming"]} fw flowid 11:12
$TFILTER 1: protocol ipv6 prio 8 basic match "ipset(streaming_extip6 $OUTDIR)" flowid 11:12 $TFILTER 1: protocol ip prio 2 basic match "ipset(streaming_ip $INTDIR)" flowid 11:12
$TFILTER 1: protocol ipv6 prio 7 basic match "ipset(streaming_ip6 $INTDIR)" flowid 11:12 $TFILTER 1: protocol ip prio 3 basic match "ipset(streaming_extip $OUTDIR)" flowid 11:12
$TFILTER 1: protocol ipv6 prio 6 basic match "ipset(streaming_triplet6 $OUTDIR,$OUTDIR,$INTDIR)" flowid 11:12 $TFILTER 1: protocol ip prio 4 basic match "ipset(streaming_triplet $OUTDIR,$OUTDIR,$INTDIR)" flowid 11:12
$TFILTER 1: protocol ipv6 prio 5 handle ${IPSETS["streaming"]} fw flowid 11:12 $TFILTER 1: protocol ipv6 prio 5 handle ${IPSETS["streaming"]} fw flowid 11:12
$TFILTER 1: protocol ipv6 prio 6 basic match "ipset(streaming_ip6 $INTDIR)" flowid 11:12
$TFILTER 1: protocol ipv6 prio 7 basic match "ipset(streaming_extip6 $OUTDIR)" flowid 11:12
$TFILTER 1: protocol ipv6 prio 8 basic match "ipset(streaming_triplet6 $OUTDIR,$OUTDIR,$INTDIR)" flowid 11:12
if [ x"$DIRECTION" == x"up" ] ; then if [ x"$DIRECTION" == x"up" ] ; then
if $NAT ; then if $NAT ; then
for IPS in $IPSETS_NAMES ; do for IPS in $IPSETS_NAMES ; do
# The order of the rules is important.
# We don't want to add a RETURN statement after match, so, the last match will be the
# winning one.
iptmark -m set --match-set ${IPS}_ip $INTDIR -j MARK --set-mark ${IPSETS[$IPS]}
iptmark -m set --match-set ${IPS}_triplet $OUTDIR,$OUTDIR,$INTDIR -j MARK --set-mark ${IPSETS[$IPS]} iptmark -m set --match-set ${IPS}_triplet $OUTDIR,$OUTDIR,$INTDIR -j MARK --set-mark ${IPSETS[$IPS]}
iptmark -m set --match-set ${IPS}_extip $OUTDIR -j MARK --set-mark ${IPSETS[$IPS]} iptmark -m set --match-set ${IPS}_extip $OUTDIR -j MARK --set-mark ${IPSETS[$IPS]}
iptmark -m set --match-set ${IPS}_ip $INTDIR -j MARK --set-mark ${IPSETS[$IPS]}
ip6mark -m set --match-set ${IPS}_ip6 $INTDIR -j MARK --set-mark ${IPSETS[$IPS]} ip6mark -m set --match-set ${IPS}_ip6 $INTDIR -j MARK --set-mark ${IPSETS[$IPS]}
ip6mark -m set --match-set ${IPS}_triplet6 $OUTDIR,$OUTDIR,$INTDIR -j MARK --set-mark ${IPSETS[$IPS]}
ip6mark -m set --match-set ${IPS}_extip6 $OUTDIR -j MARK --set-mark ${IPSETS[$IPS]} ip6mark -m set --match-set ${IPS}_extip6 $OUTDIR -j MARK --set-mark ${IPSETS[$IPS]}
ip6mark -m set --match-set ${IPS}_triplet6 $OUTDIR,$OUTDIR,$INTDIR -j MARK --set-mark ${IPSETS[$IPS]}
done done
fi fi
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment