natflow: wechat_iplist collection

ptpt52 · Dec 27, 2024 · 73a68bf · 73a68bf
1 parent 3db7c6a
commit 73a68bf
Showing 1 changed file with 9 additions and 0 deletions.
diff --git a/natflow_urllogger.c b/natflow_urllogger.c
@@ -998,6 +998,10 @@ static unsigned int natflow_urllogger_hook_v1(void *priv,
 			url->host_len = urlinfo_copy_host_tolower(url->data, host, host_len);
 			if (prev_skb) consume_skb(prev_skb);
 			url->data[host_len] = 0;
+			if (strstr(url->data, "qq.com") || strstr(url->data, "servicewechat.com")) {
+				IP_SET_add_dst_ip(state, in, out, skb, "wechat_iplist");
+				NATFLOW_INFO("(CPO)" DEBUG_TCP_FMT ": add to wechat_iplist\n", DEBUG_TCP_ARG(iph,l4));
+			}
 			url->data_len = host_len + 1;
 			if (urllogger_store_tuple_type == 0) {
 				/* 0: dir0-src dir0-dst */
@@ -1087,6 +1091,11 @@ static unsigned int natflow_urllogger_hook_v1(void *priv,
 					goto out;
 				INIT_LIST_HEAD(&url->list);
 				url->host_len = urlinfo_copy_host_tolower(url->data, host, host_len);
+				url->data[host_len] = 0;
+				if (strstr(url->data, "qq.com") || strstr(url->data, "servicewechat.com")) {
+					IP_SET_add_dst_ip(state, in, out, skb, "wechat_iplist");
+					NATFLOW_INFO("(CPO)" DEBUG_TCP_FMT ": add to wechat_iplist\n", DEBUG_TCP_ARG(iph,l4));
+				}
 				memcpy(url->data + host_len, uri, uri_len);
 				url->data[host_len + uri_len] = 0;
 				url->data_len = host_len + uri_len + 1;