Post

Replies

Boosts

Views

Activity

Reply to NEFilterDataProvider filterDataVerdictWithFilterInbound issue
why do all flows droped ? I want each flow can be filter by handleInboundDataFromFlow or handleOutboundDataFromFlow, but sometimes , handleInboundDataFromFlow and handleOutboundDataFromFlow did not called , the following codes will cause all flows droped, why ? - (NEFilterDataVerdict *)handleInboundDataFromFlow:(NEFilterFlow *)flow readBytesStartOffset:(NSUInteger)offset readBytes:(NSData *)readBytes { DDLogDebug(@"method '%s' invoked for flow: %@ ", __PRETTY_FUNCTION__, flow.identifier.UUIDString); //DDLogDebug(@"handleInboundDataFromFlow: %lu", [readBytes length]); NSMutableDictionary *extraInfo = [NSMutableDictionary dictionary]; if ([self isUDPProtocol: flow]) { //so far, we only support UDP dns NSDictionary *dnsInfo = [DNSPacketParseHelper parsePacket: readBytes]; if (dnsInfo) { extraInfo[@"dns"] = dnsInfo; DDLogDebug(@"DNS packet parsed: %@", dnsInfo); } } else if ([self isTCPProtocol: flow]) { //so far, we only support http, not support https NSDictionary *httpInfo = [HttpPacketParseHelper extractHTTPFieldsFromTCPData: readBytes isOutboundPacket: YES]; if (httpInfo && httpInfo.allKeys.count > 0) { extraInfo[@"http"] = httpInfo; DDLogDebug(@"Http packet parsed: %@", httpInfo); } } return [self handlePacket:flow withExtraInfo: extraInfo]; } - (NEFilterDataVerdict *)handleOutboundDataFromFlow:(NEFilterFlow *)flow readBytesStartOffset:(NSUInteger)offset readBytes:(NSData *)readBytes { DDLogDebug(@"method '%s' invoked for flow: %@ ", __PRETTY_FUNCTION__, flow.identifier.UUIDString); //DDLogDebug(@"handleOutboundDataFromFlow: %lu", [readBytes length]); NSMutableDictionary *extraInfo = [NSMutableDictionary dictionary]; if ([self isUDPProtocol: flow]) { //so far, we only support UDP dns NSDictionary *dnsInfo = [DNSPacketParseHelper parsePacket: readBytes]; if (dnsInfo) { extraInfo[@"dns"] = dnsInfo; DDLogDebug(@"DNS packet parsed: %@", dnsInfo); } } else if ([self isTCPProtocol: flow]) { //so far, we only support http, not support https NSDictionary *httpInfo = [HttpPacketParseHelper extractHTTPFieldsFromTCPData: readBytes isOutboundPacket: YES]; if (httpInfo && httpInfo.allKeys.count > 0) { extraInfo[@"http"] = httpInfo; DDLogDebug(@"Http packet parsed: %@", httpInfo); } } return [self handlePacket:flow withExtraInfo: extraInfo]; } - (NEFilterDataVerdict *)handleInboundDataCompleteForFlow:(NEFilterFlow *)flow { DDLogDebug(@"method '%s' invoked for flow: %@ ", __PRETTY_FUNCTION__, flow.identifier.UUIDString); return [NEFilterDataVerdict allowVerdict]; } - (NEFilterDataVerdict *)handleOutboundDataCompleteForFlow:(NEFilterFlow *)flow { DDLogDebug(@"method '%s' invoked for flow: %@ ", __PRETTY_FUNCTION__, flow.identifier.UUIDString); return [NEFilterDataVerdict allowVerdict]; }
Nov ’23
Reply to NEFilterDataProvider filterDataVerdictWithFilterInbound issue
- (NEFilterNewFlowVerdict *)handleNewFlow:(NEFilterFlow *)flow { DDLogDebug(@"method '%s' invoked for flow: %@ ", __PRETTY_FUNCTION__, flow.identifier.UUIDString); int PEEKSIZE = 512; NEFilterNewFlowVerdict *flowVerdict = [NEFilterNewFlowVerdict filterDataVerdictWithFilterInbound:YES peekInboundBytes:PEEKSIZE filterOutbound:YES peekOutboundBytes:PEEKSIZE]; return flowVerdict; } handleOutboundDataFromFlow and handleInboundDataCompleteForFlow will not be called when PEEKSIZE == 0 ? all flows will be drop ?
Nov ’23