Files
geedge-jira/attachment/57600/cdn_tunnel_finder.lua
2025-09-14 22:00:20 +00:00

45 lines
1.9 KiB
Lua

local payload=APP.data --APP.data
local payload_len=string.len(payload)
if (payload_len < 80) then
return false
end
if (APP.context.packet_sum == nil) then
APP.context.packet_sum = 1
else
APP.context.packet_sum = APP.context.packet_sum + 1
end
if (APP.context.packet_sum > 50) then
APP.detach_me()
return false
end
if(APP.context.heartbeat_candidates == nil) then
APP.context.heartbeat_candidates = {}
end
if(APP.context.possible_heartbeat_C2S_flag == nil) then
APP.context.possible_heartbeat_C2S_flag=0
end
if(APP.context.possible_heartbeat_C2S_payload_size == nil) then
APP.context.possible_heartbeat_C2S_payload_size=0
end
if (APP.get_payload_direction() == 1 and payload_len < 400 and payload_len > 150 and APP.context.possible_heartbeat_C2S_flag == 0) then
APP.context.possible_heartbeat_C2S_payload_size = payload_len
APP.context.possible_heartbeat_C2S_flag = 1
end
if (APP.get_payload_direction() == 1 and payload_len < 400 and payload_len > 150 and APP.context.possible_heartbeat_C2S_flag == 1) then
APP.context.possible_heartbeat_C2S_payload_size = payload_len
end
if (APP.get_payload_direction() == 2 and payload_len < 400 and payload_len > 80 and APP.context.possible_heartbeat_C2S_flag == 1) then
local possible_heartbeat = '+' .. APP.context.possible_heartbeat_C2S_payload_size .. '-' .. payload_len
local count = APP.context.heartbeat_candidates[possible_heartbeat] or 0
if count > 3 then
APP.log_info("heartbeat find:", possible_heartbeat)
APP.append_extra_info("heartbeat find:", possible_heartbeat)
APP.detach_me()
return true
else
APP.context.heartbeat_candidates[possible_heartbeat] = count + 1
APP.context.possible_heartbeat_C2S_flag = 0
APP.context.possible_heartbeat_C2S_payload_size = 0
end
end
return false