1 #if defined(MODVERSIONS)
2 #include <linux/modversions.h>
4 #include <linux/module.h>
5 #include <linux/netfilter_ipv4/ip_tables.h>
6 #include <linux/version.h>
7 //#include <linux/netfilter_ipv4/ipt_ipp2p.h>
12 #define get_u8(X,O) (*(__u8 *)(X + O))
13 #define get_u16(X,O) (*(__u16 *)(X + O))
14 #define get_u32(X,O) (*(__u32 *)(X + O))
16 MODULE_AUTHOR("Eicke Friedrich/Klaus Degner <ipp2p@ipp2p.org>");
17 MODULE_DESCRIPTION("An extension to iptables to identify P2P traffic.");
18 MODULE_LICENSE("GPL");
21 /*Search for UDP eDonkey/eMule/Kad commands*/
23 udp_search_edk (unsigned char *haystack
, int packet_len
)
25 unsigned char *t
= haystack
;
33 /* client -> server status request */
35 if (packet_len
== 14) return ((IPP2P_EDK
* 100) + 50);
37 /* server -> client status request */
38 case 0x97: if (packet_len
== 42) return ((IPP2P_EDK
* 100) + 51);
40 /* server description request */
41 /* e3 2a ff f0 .. | size == 6 */
42 case 0xa2: if ( (packet_len
== 14) && ( get_u16(t
,2) == __constant_htons(0xfff0) ) ) return ((IPP2P_EDK
* 100) + 52);
44 /* server description response */
45 /* e3 a3 ff f0 .. | size > 40 && size < 200 */
46 //case 0xa3: return ((IPP2P_EDK * 100) + 53);
48 case 0x9a: if (packet_len
==26) return ((IPP2P_EDK
* 100) + 54);
51 case 0x92: if (packet_len
==18) return ((IPP2P_EDK
* 100) + 55);
60 /* e4 20 .. | size == 43 */
61 case 0x20: if ((packet_len
== 43) && (t
[2] != 0x00) && (t
[34] != 0x00)) return ((IPP2P_EDK
* 100) + 60);
63 /* e4 00 .. 00 | size == 35 ? */
64 case 0x00: if ((packet_len
== 35) && (t
[26] == 0x00)) return ((IPP2P_EDK
* 100) + 61);
66 /* e4 10 .. 00 | size == 35 ? */
67 case 0x10: if ((packet_len
== 35) && (t
[26] == 0x00)) return ((IPP2P_EDK
* 100) + 62);
69 /* e4 18 .. 00 | size == 35 ? */
70 case 0x18: if ((packet_len
== 35) && (t
[26] == 0x00)) return ((IPP2P_EDK
* 100) + 63);
72 /* e4 52 .. | size = 44 */
73 case 0x52: if (packet_len
== 44 ) return ((IPP2P_EDK
* 100) + 64);
75 /* e4 58 .. | size == 6 */
76 case 0x58: if (packet_len
== 14 ) return ((IPP2P_EDK
* 100) + 65);
78 /* e4 59 .. | size == 2 */
79 case 0x59: if (packet_len
== 10 )return ((IPP2P_EDK
* 100) + 66);
81 /* e4 28 .. | packet_len == 52,77,102,127... */
82 case 0x28: if (((packet_len
-52) % 25) == 0) return ((IPP2P_EDK
* 100) + 67);
84 /* e4 50 xx xx | size == 4 */
85 case 0x50: if (packet_len
== 12) return ((IPP2P_EDK
* 100) + 68);
87 /* e4 40 xx xx | size == 48 */
88 case 0x40: if (packet_len
== 56) return ((IPP2P_EDK
* 100) + 69);
93 } /* end of switch (t[0]) */
98 /*Search for UDP Gnutella commands*/
100 udp_search_gnu (unsigned char *haystack
, int packet_len
)
102 unsigned char *t
= haystack
;
105 if (memcmp(t
, "GND", 3) == 0) return ((IPP2P_GNU
* 100) + 51);
106 if (memcmp(t
, "GNUTELLA ", 9) == 0) return ((IPP2P_GNU
* 100) + 52);
111 /*Search for UDP KaZaA commands*/
113 udp_search_kazaa (unsigned char *haystack
, int packet_len
)
115 unsigned char *t
= haystack
;
117 if (t
[packet_len
-1] == 0x00){
118 t
+= (packet_len
- 6);
119 if (memcmp(t
, "KaZaA", 5) == 0) return (IPP2P_KAZAA
* 100 +50);
123 }/*udp_search_kazaa*/
125 /*Search for UDP DirectConnect commands*/
127 udp_search_directconnect (unsigned char *haystack
, int packet_len
)
129 unsigned char *t
= haystack
;
130 if ((*(t
+ 8) == 0x24) && (*(t
+ packet_len
- 1) == 0x7c)) {
132 if (memcmp(t
, "SR ", 3) == 0) return ((IPP2P_DC
* 100) + 60);
133 if (memcmp(t
, "Ping ", 5) == 0) return ((IPP2P_DC
* 100) + 61);
136 }/*udp_search_directconnect*/
140 /*Search for UDP BitTorrent commands*/
142 udp_search_bit (unsigned char *haystack
, int packet_len
)
147 /* ^ 00 00 04 17 27 10 19 80 */
148 if ((ntohl(get_u32(haystack
, 8)) == 0x00000417) && (ntohl(get_u32(haystack
, 12)) == 0x27101980))
149 return (IPP2P_BIT
* 100 + 50);
152 if (get_u32(haystack
, 16) == __constant_htonl(0x00000400) && get_u32(haystack
, 36) == __constant_htonl(0x00000104))
153 return (IPP2P_BIT
* 100 + 51);
154 if (get_u32(haystack
, 16) == __constant_htonl(0x00000400))
155 return (IPP2P_BIT
* 100 + 61);
158 if (get_u32(haystack
, 16) == __constant_htonl(0x00000404) && get_u32(haystack
, 36) == __constant_htonl(0x00000104))
159 return (IPP2P_BIT
* 100 + 52);
160 if (get_u32(haystack
, 16) == __constant_htonl(0x00000404))
161 return (IPP2P_BIT
* 100 + 62);
164 if (get_u32(haystack
, 16) == __constant_htonl(0x00000406) && get_u32(haystack
, 36) == __constant_htonl(0x00000104))
165 return (IPP2P_BIT
* 100 + 53);
166 if (get_u32(haystack
, 16) == __constant_htonl(0x00000406))
167 return (IPP2P_BIT
* 100 + 63);
170 if (get_u32(haystack
, 8) == __constant_htonl(0x00000405))
171 return (IPP2P_BIT
* 100 + 54);
174 if ((get_u32(haystack
, 8) == __constant_htonl(0x00000401)))
175 return (IPP2P_BIT
* 100 + 55);
178 if (get_u32(haystack
,8) == __constant_htonl(0x00000827) &&
179 get_u32(haystack
,12) == __constant_htonl(0x37502950))
180 return (IPP2P_BIT
* 100 + 80);
183 /* this packet does not have a constant size */
184 if (packet_len
>= 40 && get_u32(haystack
, 16) == __constant_htonl(0x00000402) && get_u32(haystack
, 36) == __constant_htonl(0x00000104))
185 return (IPP2P_BIT
* 100 + 56);
189 /* some extra-bitcomet rules:
190 * "d1:" [a|r] "d2:id20:"
192 if (packet_len
> 30 && get_u8(haystack
, 8) == 'd' && get_u8(haystack
, 9) == '1' && get_u8(haystack
, 10) == ':' )
194 if (get_u8(haystack
, 11) == 'a' || get_u8(haystack
, 11) == 'r')
196 if (memcmp(haystack
+12,"d2:id20:",8)==0)
197 return (IPP2P_BIT
* 100 + 57);
203 /* packetlen must be bigger than 40 */
204 /* first 4 bytes are zero */
205 if (packet_len
> 40 && get_u32(haystack
, 8) == 0x00000000)
207 /* first rule: 00 00 00 00 01 00 00 xx xx xx xx 00 00 00 00*/
208 if (get_u32(haystack
, 12) == 0x00000000 &&
209 get_u32(haystack
, 16) == 0x00010000 &&
210 get_u32(haystack
, 24) == 0x00000000 )
211 return (IPP2P_BIT
* 100 + 71);
213 /* 00 01 00 00 0d 00 00 xx xx xx xx 00 00 00 00*/
214 if (get_u32(haystack
, 12) == 0x00000001 &&
215 get_u32(haystack
, 16) == 0x000d0000 &&
216 get_u32(haystack
, 24) == 0x00000000 )
217 return (IPP2P_BIT
* 100 + 71);
228 /*Search for Ares commands*/
229 //#define IPP2P_DEBUG_ARES
231 search_ares (const unsigned char *payload
, const u16 plen
)
232 //int search_ares (unsigned char *haystack, int packet_len, int head_len)
234 // const unsigned char *t = haystack + head_len;
236 /* all ares packets start with */
237 if (payload
[1] == 0 && (plen
- payload
[0]) == 3)
243 if ( plen
== 6 && payload
[5] == 0x05 ) return ((IPP2P_ARES
* 100) + 1);
246 /* ares search, min 3 chars --> 14 bytes
247 * lets define a search can be up to 30 chars --> max 34 bytes
249 if ( plen
>= 14 && plen
<= 34 ) return ((IPP2P_ARES
* 100) + 1);
251 #ifdef IPP2P_DEBUG_ARES
253 printk(KERN_DEBUG
"Unknown Ares command %x recognized, len: %u \n", (unsigned int) payload
[2],plen
);
254 #endif /* IPP2P_DEBUG_ARES */
259 /* found connect packet: 03 00 5a 04 03 05 */
260 /* new version ares 1.8: 03 00 5a xx xx 05 */
261 if ((plen
) == 6){ /* possible connect command*/
262 if ((payload
[0] == 0x03) && (payload
[1] == 0x00) && (payload
[2] == 0x5a) && (payload
[5] == 0x05))
263 return ((IPP2P_ARES
* 100) + 1);
265 if ((plen
) == 60){ /* possible download command*/
266 if ((payload
[59] == 0x0a) && (payload
[58] == 0x0a)){
267 if (memcmp(t
, "PUSH SHA1:", 10) == 0) /* found download command */
268 return ((IPP2P_ARES
* 100) + 2);
276 /*Search for SoulSeek commands*/
278 search_soul (const unsigned char *payload
, const u16 plen
)
280 //#define IPP2P_DEBUG_SOUL
281 /* match: xx xx xx xx | xx = sizeof(payload) - 4 */
282 if (get_u32(payload
, 0) == (plen
- 4)){
283 const __u32 m
=get_u32(payload
, 4);
284 /* match 00 yy yy 00, yy can be everything */
285 if ( get_u8(payload
, 4) == 0x00 && get_u8(payload
, 7) == 0x00 )
287 #ifdef IPP2P_DEBUG_SOUL
288 printk(KERN_DEBUG
"0: Soulseek command 0x%x recognized\n",get_u32(payload
, 4));
289 #endif /* IPP2P_DEBUG_SOUL */
290 return ((IPP2P_SOUL
* 100) + 1);
293 /* next match: 01 yy 00 00 | yy can be everything */
294 if ( get_u8(payload
, 4) == 0x01 && get_u16(payload
, 6) == 0x0000 )
296 #ifdef IPP2P_DEBUG_SOUL
297 printk(KERN_DEBUG
"1: Soulseek command 0x%x recognized\n",get_u16(payload
, 4));
298 #endif /* IPP2P_DEBUG_SOUL */
299 return ((IPP2P_SOUL
* 100) + 2);
302 /* other soulseek commandos are: 1-5,7,9,13-18,22,23,26,28,35-37,40-46,50,51,60,62-69,91,92,1001 */
303 /* try to do this in an intelligent way */
304 /* get all small commandos */
319 #ifdef IPP2P_DEBUG_SOUL
320 printk(KERN_DEBUG
"2: Soulseek command 0x%x recognized\n",get_u16(payload
, 4));
321 #endif /* IPP2P_DEBUG_SOUL */
322 return ((IPP2P_SOUL
* 100) + 3);
327 #ifdef IPP2P_DEBUG_SOUL
328 printk(KERN_DEBUG
"3: Soulseek command 0x%x recognized\n",get_u16(payload
, 4));
329 #endif /* IPP2P_DEBUG_SOUL */
330 return ((IPP2P_SOUL
* 100) + 4);
332 if (m
> 12 && m
< 19 )
334 #ifdef IPP2P_DEBUG_SOUL
335 printk(KERN_DEBUG
"4: Soulseek command 0x%x recognized\n",get_u16(payload
, 4));
336 #endif /* IPP2P_DEBUG_SOUL */
337 return ((IPP2P_SOUL
* 100) + 5);
340 if (m
> 34 && m
< 38 )
342 #ifdef IPP2P_DEBUG_SOUL
343 printk(KERN_DEBUG
"5: Soulseek command 0x%x recognized\n",get_u16(payload
, 4));
344 #endif /* IPP2P_DEBUG_SOUL */
345 return ((IPP2P_SOUL
* 100) + 6);
348 if (m
> 39 && m
< 47 )
350 #ifdef IPP2P_DEBUG_SOUL
351 printk(KERN_DEBUG
"6: Soulseek command 0x%x recognized\n",get_u16(payload
, 4));
352 #endif /* IPP2P_DEBUG_SOUL */
353 return ((IPP2P_SOUL
* 100) + 7);
356 if (m
> 61 && m
< 70 )
358 #ifdef IPP2P_DEBUG_SOUL
359 printk(KERN_DEBUG
"7: Soulseek command 0x%x recognized\n",get_u16(payload
, 4));
360 #endif /* IPP2P_DEBUG_SOUL */
361 return ((IPP2P_SOUL
* 100) + 8);
364 #ifdef IPP2P_DEBUG_SOUL
365 printk(KERN_DEBUG
"unknown SOULSEEK command: 0x%x, first 16 bit: 0x%x, first 8 bit: 0x%x ,soulseek ???\n",get_u32(payload
, 4),get_u16(payload
, 4) >> 16,get_u8(payload
, 4) >> 24);
366 #endif /* IPP2P_DEBUG_SOUL */
369 /* match 14 00 00 00 01 yy 00 00 00 STRING(YY) 01 00 00 00 00 46|50 00 00 00 00 */
370 /* without size at the beginning !!! */
371 if ( get_u32(payload
, 0) == 0x14 && get_u8(payload
, 4) == 0x01 )
373 __u32 y
=get_u32(payload
, 5);
374 /* we need 19 chars + string */
375 if ( (y
+ 19) <= (plen
) )
377 const unsigned char *w
=payload
+9+y
;
378 if (get_u32(w
, 0) == 0x01 && ( get_u16(w
, 4) == 0x4600 || get_u16(w
, 4) == 0x5000) && get_u32(w
, 6) == 0x00);
379 #ifdef IPP2P_DEBUG_SOUL
380 printk(KERN_DEBUG
"Soulssek special client command recognized\n");
381 #endif /* IPP2P_DEBUG_SOUL */
382 return ((IPP2P_SOUL
* 100) + 9);
389 /*Search for WinMX commands*/
391 search_winmx (const unsigned char *payload
, const u16 plen
)
393 //#define IPP2P_DEBUG_WINMX
394 if (((plen
) == 4) && (memcmp(payload
, "SEND", 4) == 0)) return ((IPP2P_WINMX
* 100) + 1);
395 if (((plen
) == 3) && (memcmp(payload
, "GET", 3) == 0)) return ((IPP2P_WINMX
* 100) + 2);
396 //if (packet_len < (head_len + 10)) return 0;
397 if (plen
< 10) return 0;
399 if ((memcmp(payload
, "SEND", 4) == 0) || (memcmp(payload
, "GET", 3) == 0)){
401 const u16 end
=plen
-2;
405 if (payload
[c
]== 0x20 && payload
[c
+1] == 0x22)
409 if (count
>=2) return ((IPP2P_WINMX
* 100) + 3);
415 if ( plen
== 149 && payload
[0] == '8' )
417 #ifdef IPP2P_DEBUG_WINMX
418 printk(KERN_INFO
"maybe WinMX\n");
420 if (get_u32(payload
,17) == 0 && get_u32(payload
,21) == 0 && get_u32(payload
,25) == 0 &&
421 // get_u32(payload,33) == __constant_htonl(0x71182b1a) && get_u32(payload,37) == __constant_htonl(0x05050000) &&
422 // get_u32(payload,133) == __constant_htonl(0x31097edf) && get_u32(payload,145) == __constant_htonl(0xdcb8f792))
423 get_u16(payload
,39) == 0 && get_u16(payload
,135) == __constant_htons(0x7edf) && get_u16(payload
,147) == __constant_htons(0xf792))
426 #ifdef IPP2P_DEBUG_WINMX
427 printk(KERN_INFO
"got WinMX\n");
429 return ((IPP2P_WINMX
* 100) + 4);
436 /*Search for appleJuice commands*/
438 search_apple (const unsigned char *payload
, const u16 plen
)
440 if ( (plen
> 7) && (payload
[6] == 0x0d) && (payload
[7] == 0x0a) && (memcmp(payload
, "ajprot", 6) == 0)) return (IPP2P_APPLE
* 100);
446 /*Search for BitTorrent commands*/
448 search_bittorrent (const unsigned char *payload
, const u16 plen
)
452 /* test for match 0x13+"BitTorrent protocol" */
453 if (payload
[0] == 0x13)
455 if (memcmp(payload
+1, "BitTorrent protocol", 19) == 0) return (IPP2P_BIT
* 100);
458 /* get tracker commandos, all starts with GET /
459 * then it can follow: scrape| announce
460 * and then ?hash_info=
462 if (memcmp(payload
,"GET /",5) == 0)
465 if ( memcmp(payload
+5,"scrape?info_hash=",17)==0 ) return (IPP2P_BIT
* 100 + 1);
466 /* message announce */
467 if ( memcmp(payload
+5,"announce?info_hash=",19)==0 ) return (IPP2P_BIT
* 100 + 2);
472 /* bitcomet encryptes the first packet, so we have to detect another
473 * one later in the flow */
474 /* first try failed, too many missdetections */
475 //if ( size == 5 && get_u32(t,0) == __constant_htonl(1) && t[4] < 3) return (IPP2P_BIT * 100 + 3);
477 /* second try: block request packets */
478 if ( plen
== 17 && get_u32(payload
,0) == __constant_htonl(0x0d) && payload
[4] == 0x06 && get_u32(payload
,13) == __constant_htonl(0x4000) ) return (IPP2P_BIT
* 100 + 3);
486 /*check for Kazaa get command*/
488 search_kazaa (const unsigned char *payload
, const u16 plen
)
491 if ((payload
[plen
-2] == 0x0d) && (payload
[plen
-1] == 0x0a) && memcmp(payload
, "GET /.hash=", 11) == 0)
492 return (IPP2P_DATA_KAZAA
* 100);
498 /*check for gnutella get command*/
500 search_gnu (const unsigned char *payload
, const u16 plen
)
502 if ((payload
[plen
-2] == 0x0d) && (payload
[plen
-1] == 0x0a))
504 if (memcmp(payload
, "GET /get/", 9) == 0) return ((IPP2P_DATA_GNU
* 100) + 1);
505 if (memcmp(payload
, "GET /uri-res/", 13) == 0) return ((IPP2P_DATA_GNU
* 100) + 2);
511 /*check for gnutella get commands and other typical data*/
513 search_all_gnu (const unsigned char *payload
, const u16 plen
)
516 if ((payload
[plen
-2] == 0x0d) && (payload
[plen
-1] == 0x0a))
519 if (memcmp(payload
, "GNUTELLA CONNECT/", 17) == 0) return ((IPP2P_GNU
* 100) + 1);
520 if (memcmp(payload
, "GNUTELLA/", 9) == 0) return ((IPP2P_GNU
* 100) + 2);
523 if ((memcmp(payload
, "GET /get/", 9) == 0) || (memcmp(payload
, "GET /uri-res/", 13) == 0))
526 const u16 end
=plen
-22;
528 if ( payload
[c
] == 0x0a && payload
[c
+1] == 0x0d && ((memcmp(&payload
[c
+2], "X-Gnutella-", 11) == 0) || (memcmp(&payload
[c
+2], "X-Queue:", 8) == 0)))
529 return ((IPP2P_GNU
* 100) + 3);
538 /*check for KaZaA download commands and other typical data*/
540 search_all_kazaa (const unsigned char *payload
, const u16 plen
)
542 if ((payload
[plen
-2] == 0x0d) && (payload
[plen
-1] == 0x0a))
545 if (memcmp(payload
, "GIVE ", 5) == 0) return ((IPP2P_KAZAA
* 100) + 1);
547 if (memcmp(payload
, "GET /", 5) == 0) {
549 const u16 end
=plen
-22;
551 if ( payload
[c
] == 0x0a && payload
[c
+1] == 0x0d && ((memcmp(&payload
[c
+2], "X-Kazaa-Username: ", 18) == 0) || (memcmp(&payload
[c
+2], "User-Agent: PeerEnabler/", 24) == 0)))
552 return ((IPP2P_KAZAA
* 100) + 2);
560 /*fast check for edonkey file segment transfer command*/
562 search_edk (const unsigned char *payload
, const u16 plen
)
564 if (payload
[0] != 0xe3)
567 if (payload
[5] == 0x47)
568 return (IPP2P_DATA_EDK
* 100);
576 /*intensive but slower search for some edonkey packets including size-check*/
578 search_all_edk (const unsigned char *payload
, const u16 plen
)
580 if (payload
[0] != 0xe3)
584 const u16 cmd
= get_u16(payload
, 1);
585 if (cmd
== (plen
- 5)) {
586 switch (payload
[5]) {
587 case 0x01: return ((IPP2P_EDK
* 100) + 1); /*Client: hello or Server:hello*/
588 case 0x4c: return ((IPP2P_EDK
* 100) + 9); /*Client: Hello-Answer*/
596 /*fast check for Direct Connect send command*/
598 search_dc (const unsigned char *payload
, const u16 plen
)
601 if (payload
[0] != 0x24 )
604 if (memcmp(&payload
[1], "Send|", 5) == 0)
605 return (IPP2P_DATA_DC
* 100);
613 /*intensive but slower check for all direct connect packets*/
615 search_all_dc (const unsigned char *payload
, const u16 plen
)
617 // unsigned char *t = haystack;
619 if (payload
[0] == 0x24 && payload
[plen
-1] == 0x7c)
621 const unsigned char *t
=&payload
[1];
622 /* Client-Hub-Protocol */
623 if (memcmp(t
, "Lock ", 5) == 0) return ((IPP2P_DC
* 100) + 1);
624 /* Client-Client-Protocol, some are already recognized by client-hub (like lock) */
625 if (memcmp(t
, "MyNick ", 7) == 0) return ((IPP2P_DC
* 100) + 38);
632 search_mute (const unsigned char *payload
, const u16 plen
)
634 if ( plen
== 209 || plen
== 345 || plen
== 473 || plen
== 609 || plen
== 1121 )
636 //printk(KERN_DEBUG "size hit: %u",size);
637 if (memcmp(payload
,"PublicKey: ",11) == 0 )
639 return ((IPP2P_MUTE
* 100) + 0);
641 /* if (memcmp(t+size-14,"\x0aEndPublicKey\x0a",14) == 0)
643 printk(KERN_DEBUG "end pubic key hit: %u",size);
654 search_xdcc (const unsigned char *payload
, const u16 plen
)
656 /* search in small packets only */
657 if (plen
> 20 && plen
< 200 && payload
[plen
-1] == 0x0a && payload
[plen
-2] == 0x0d && memcmp(payload
,"PRIVMSG ",8) == 0)
661 const u16 end
=plen
- 13;
663 /* is seems to be a irc private massage, chedck for xdcc command */
666 if (payload
[x
] == ':')
668 if ( memcmp(&payload
[x
+1],"xdcc send #",11) == 0 )
669 return ((IPP2P_XDCC
* 100) + 0);
677 /* search for waste */
678 int search_waste(const unsigned char *payload
, const u16 plen
)
680 if ( plen
>= 8 && memcmp(payload
,"GET.sha1:",9) == 0)
681 return ((IPP2P_WASTE
* 100) + 0);
689 __u8 short_hand
; /*for fucntions included in short hands*/
691 int (*function_name
) (const unsigned char *, const u16
);
693 {IPP2P_EDK
,SHORT_HAND_IPP2P
,20, &search_all_edk
},
694 // {IPP2P_DATA_KAZAA,SHORT_HAND_DATA,200, &search_kazaa},
695 // {IPP2P_DATA_EDK,SHORT_HAND_DATA,60, &search_edk},
696 // {IPP2P_DATA_DC,SHORT_HAND_DATA,26, &search_dc},
697 {IPP2P_DC
,SHORT_HAND_IPP2P
,5, search_all_dc
},
698 // {IPP2P_DATA_GNU,SHORT_HAND_DATA,40, &search_gnu},
699 {IPP2P_GNU
,SHORT_HAND_IPP2P
,5, &search_all_gnu
},
700 {IPP2P_KAZAA
,SHORT_HAND_IPP2P
,5, &search_all_kazaa
},
701 {IPP2P_BIT
,SHORT_HAND_IPP2P
,20, &search_bittorrent
},
702 {IPP2P_APPLE
,SHORT_HAND_IPP2P
,5, &search_apple
},
703 {IPP2P_SOUL
,SHORT_HAND_IPP2P
,5, &search_soul
},
704 {IPP2P_WINMX
,SHORT_HAND_IPP2P
,2, &search_winmx
},
705 {IPP2P_ARES
,SHORT_HAND_IPP2P
,5, &search_ares
},
706 {IPP2P_MUTE
,SHORT_HAND_NONE
,200, &search_mute
},
707 {IPP2P_WASTE
,SHORT_HAND_NONE
,5, &search_waste
},
708 {IPP2P_XDCC
,SHORT_HAND_NONE
,5, &search_xdcc
},
715 __u8 short_hand
; /*for fucntions included in short hands*/
717 int (*function_name
) (unsigned char *, int);
719 {IPP2P_KAZAA
,SHORT_HAND_IPP2P
,14, &udp_search_kazaa
},
720 {IPP2P_BIT
,SHORT_HAND_IPP2P
,23, &udp_search_bit
},
721 {IPP2P_GNU
,SHORT_HAND_IPP2P
,11, &udp_search_gnu
},
722 {IPP2P_EDK
,SHORT_HAND_IPP2P
,9, &udp_search_edk
},
723 {IPP2P_DC
,SHORT_HAND_IPP2P
,12, &udp_search_directconnect
},
729 match(const struct sk_buff
*skb
,
730 const struct net_device
*in
,
731 const struct net_device
*out
,
732 #if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,17)
733 const struct xt_match
*mymatch
,
734 const void *matchinfo
,
736 unsigned int myprotoff
,
738 const void *matchinfo
,
742 #if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,0)
749 const struct ipt_p2p_info
*info
= matchinfo
;
750 unsigned char *haystack
;
751 struct iphdr
*ip
= skb
->nh
.iph
;
752 int p2p_result
= 0, i
= 0;
754 int hlen
= ntohs(ip
->tot_len
)-(ip
->ihl
*4); /*hlen = packet-data length*/
756 /*must not be a fragment*/
758 if (info
->debug
) printk("IPP2P.match: offset found %i \n",offset
);
762 /*make sure that skb is linear*/
763 if(skb_is_nonlinear(skb
)){
764 if (info
->debug
) printk("IPP2P.match: nonlinear skb found\n");
769 haystack
=(char *)ip
+(ip
->ihl
*4); /*haystack = packet data*/
771 switch (ip
->protocol
){
772 case IPPROTO_TCP
: /*what to do with a TCP packet*/
774 struct tcphdr
*tcph
= (void *) ip
+ ip
->ihl
* 4;
776 if (tcph
->fin
) return 0; /*if FIN bit is set bail out*/
777 if (tcph
->syn
) return 0; /*if SYN bit is set bail out*/
778 if (tcph
->rst
) return 0; /*if RST bit is set bail out*/
780 haystack
+= tcph
->doff
* 4; /*get TCP-Header-Size*/
781 hlen
-= tcph
->doff
* 4;
782 while (matchlist
[i
].command
) {
783 if ((((info
->cmd
& matchlist
[i
].command
) == matchlist
[i
].command
) ||
784 ((info
->cmd
& matchlist
[i
].short_hand
) == matchlist
[i
].short_hand
)) &&
785 (hlen
> matchlist
[i
].packet_len
)) {
786 p2p_result
= matchlist
[i
].function_name(haystack
, hlen
);
789 if (info
->debug
) printk("IPP2P.debug:TCP-match: %i from: %u.%u.%u.%u:%i to: %u.%u.%u.%u:%i Length: %i\n",
790 p2p_result
, NIPQUAD(ip
->saddr
),ntohs(tcph
->source
), NIPQUAD(ip
->daddr
),ntohs(tcph
->dest
),hlen
);
799 case IPPROTO_UDP
: /*what to do with an UDP packet*/
801 struct udphdr
*udph
= (void *) ip
+ ip
->ihl
* 4;
803 while (udp_list
[i
].command
){
804 if ((((info
->cmd
& udp_list
[i
].command
) == udp_list
[i
].command
) ||
805 ((info
->cmd
& udp_list
[i
].short_hand
) == udp_list
[i
].short_hand
)) &&
806 (hlen
> udp_list
[i
].packet_len
)) {
807 p2p_result
= udp_list
[i
].function_name(haystack
, hlen
);
809 if (info
->debug
) printk("IPP2P.debug:UDP-match: %i from: %u.%u.%u.%u:%i to: %u.%u.%u.%u:%i Length: %i\n",
810 p2p_result
, NIPQUAD(ip
->saddr
),ntohs(udph
->source
), NIPQUAD(ip
->daddr
),ntohs(udph
->dest
),hlen
);
826 checkentry(const char *tablename
,
827 #if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,17)
829 const struct xt_match
*mymatch
,
831 const struct ipt_ip
*ip
,
834 unsigned int matchsize
,
835 unsigned int hook_mask
)
837 /* Must specify -p tcp */
838 /* if (ip->proto != IPPROTO_TCP || (ip->invflags & IPT_INV_PROTO)) {
839 * printk("ipp2p: Only works on TCP packets, use -p tcp\n");
846 // TODO: find out what this structure is for (scheme taken
847 // from kernel sources)
848 // content seems to have a length of 8 bytes
849 // (at least on my x86 machine)
850 struct ipp2p_match_info
{
851 long int dunno_what_this_is_for
;
852 long int i_also_dunno_what_this_is_for
;
855 static struct ipt_match ipp2p_match
= {
856 #if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,0)
864 #if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,0)) && (LINUX_VERSION_CODE < KERNEL_VERSION(2,6,17))
867 .checkentry
= &checkentry
,
869 #elif LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,17)
873 .matchsize
= sizeof(struct ipp2p_match_info
),
874 .checkentry
= &checkentry
,
880 static int __init
init(void)
882 printk(KERN_INFO
"IPP2P v%s loading\n", IPP2P_VERSION
);
883 return ipt_register_match(&ipp2p_match
);
886 static void __exit
fini(void)
888 ipt_unregister_match(&ipp2p_match
);
889 printk(KERN_INFO
"IPP2P v%s unloaded\n", IPP2P_VERSION
);