]>
git.ipfire.org Git - people/pmueller/ipfire-2.x.git/blob - src/ipp2p/ipt_ipp2p.c
1 #if defined(MODVERSIONS)
2 #include <linux/modversions.h>
4 #include <linux/module.h>
5 #include <linux/version.h>
7 #if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,21)
8 # include <linux/netfilter/x_tables.h>
9 # define ipt_register_match xt_register_match
10 # define ipt_unregister_match xt_unregister_match
11 # define ipt_match xt_match
13 # include <linux/netfilter_ipv4/ip_tables.h>
14 //#include <linux/netfilter_ipv4/ipt_ipp2p.h>
15 #endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,21) */
17 #include "ipt_ipp2p.h"
21 #define get_u8(X,O) (*(__u8 *)(X + O))
22 #define get_u16(X,O) (*(__u16 *)(X + O))
23 #define get_u32(X,O) (*(__u32 *)(X + O))
25 MODULE_AUTHOR("Eicke Friedrich/Klaus Degner <ipp2p@ipp2p.org>");
26 MODULE_DESCRIPTION("An extension to iptables to identify P2P traffic.");
27 MODULE_LICENSE("GPL");
30 /*Search for UDP eDonkey/eMule/Kad commands*/
32 udp_search_edk (unsigned char *haystack
, int packet_len
)
34 unsigned char *t
= haystack
;
42 /* client -> server status request */
44 if (packet_len
== 14) return ((IPP2P_EDK
* 100) + 50);
46 /* server -> client status request */
47 case 0x97: if (packet_len
== 42) return ((IPP2P_EDK
* 100) + 51);
49 /* server description request */
50 /* e3 2a ff f0 .. | size == 6 */
51 case 0xa2: if ( (packet_len
== 14) && ( get_u16(t
,2) == __constant_htons(0xfff0) ) ) return ((IPP2P_EDK
* 100) + 52);
53 /* server description response */
54 /* e3 a3 ff f0 .. | size > 40 && size < 200 */
55 //case 0xa3: return ((IPP2P_EDK * 100) + 53);
57 case 0x9a: if (packet_len
==26) return ((IPP2P_EDK
* 100) + 54);
60 case 0x92: if (packet_len
==18) return ((IPP2P_EDK
* 100) + 55);
69 /* e4 20 .. | size == 43 */
70 case 0x20: if ((packet_len
== 43) && (t
[2] != 0x00) && (t
[34] != 0x00)) return ((IPP2P_EDK
* 100) + 60);
72 /* e4 00 .. 00 | size == 35 ? */
73 case 0x00: if ((packet_len
== 35) && (t
[26] == 0x00)) return ((IPP2P_EDK
* 100) + 61);
75 /* e4 10 .. 00 | size == 35 ? */
76 case 0x10: if ((packet_len
== 35) && (t
[26] == 0x00)) return ((IPP2P_EDK
* 100) + 62);
78 /* e4 18 .. 00 | size == 35 ? */
79 case 0x18: if ((packet_len
== 35) && (t
[26] == 0x00)) return ((IPP2P_EDK
* 100) + 63);
81 /* e4 52 .. | size = 44 */
82 case 0x52: if (packet_len
== 44 ) return ((IPP2P_EDK
* 100) + 64);
84 /* e4 58 .. | size == 6 */
85 case 0x58: if (packet_len
== 14 ) return ((IPP2P_EDK
* 100) + 65);
87 /* e4 59 .. | size == 2 */
88 case 0x59: if (packet_len
== 10 )return ((IPP2P_EDK
* 100) + 66);
90 /* e4 28 .. | packet_len == 52,77,102,127... */
91 case 0x28: if (((packet_len
-52) % 25) == 0) return ((IPP2P_EDK
* 100) + 67);
93 /* e4 50 xx xx | size == 4 */
94 case 0x50: if (packet_len
== 12) return ((IPP2P_EDK
* 100) + 68);
96 /* e4 40 xx xx | size == 48 */
97 case 0x40: if (packet_len
== 56) return ((IPP2P_EDK
* 100) + 69);
102 } /* end of switch (t[0]) */
107 /*Search for UDP Gnutella commands*/
109 udp_search_gnu (unsigned char *haystack
, int packet_len
)
111 unsigned char *t
= haystack
;
114 if (memcmp(t
, "GND", 3) == 0) return ((IPP2P_GNU
* 100) + 51);
115 if (memcmp(t
, "GNUTELLA ", 9) == 0) return ((IPP2P_GNU
* 100) + 52);
120 /*Search for UDP KaZaA commands*/
122 udp_search_kazaa (unsigned char *haystack
, int packet_len
)
124 unsigned char *t
= haystack
;
126 if (t
[packet_len
-1] == 0x00){
127 t
+= (packet_len
- 6);
128 if (memcmp(t
, "KaZaA", 5) == 0) return (IPP2P_KAZAA
* 100 +50);
132 }/*udp_search_kazaa*/
134 /*Search for UDP DirectConnect commands*/
136 udp_search_directconnect (unsigned char *haystack
, int packet_len
)
138 unsigned char *t
= haystack
;
139 if ((*(t
+ 8) == 0x24) && (*(t
+ packet_len
- 1) == 0x7c)) {
141 if (memcmp(t
, "SR ", 3) == 0) return ((IPP2P_DC
* 100) + 60);
142 if (memcmp(t
, "Ping ", 5) == 0) return ((IPP2P_DC
* 100) + 61);
145 }/*udp_search_directconnect*/
149 /*Search for UDP BitTorrent commands*/
151 udp_search_bit (unsigned char *haystack
, int packet_len
)
156 /* ^ 00 00 04 17 27 10 19 80 */
157 if ((ntohl(get_u32(haystack
, 8)) == 0x00000417) && (ntohl(get_u32(haystack
, 12)) == 0x27101980))
158 return (IPP2P_BIT
* 100 + 50);
161 if (get_u32(haystack
, 16) == __constant_htonl(0x00000400) && get_u32(haystack
, 36) == __constant_htonl(0x00000104))
162 return (IPP2P_BIT
* 100 + 51);
163 if (get_u32(haystack
, 16) == __constant_htonl(0x00000400))
164 return (IPP2P_BIT
* 100 + 61);
167 if (get_u32(haystack
, 16) == __constant_htonl(0x00000404) && get_u32(haystack
, 36) == __constant_htonl(0x00000104))
168 return (IPP2P_BIT
* 100 + 52);
169 if (get_u32(haystack
, 16) == __constant_htonl(0x00000404))
170 return (IPP2P_BIT
* 100 + 62);
173 if (get_u32(haystack
, 16) == __constant_htonl(0x00000406) && get_u32(haystack
, 36) == __constant_htonl(0x00000104))
174 return (IPP2P_BIT
* 100 + 53);
175 if (get_u32(haystack
, 16) == __constant_htonl(0x00000406))
176 return (IPP2P_BIT
* 100 + 63);
179 if (get_u32(haystack
, 8) == __constant_htonl(0x00000405))
180 return (IPP2P_BIT
* 100 + 54);
183 if ((get_u32(haystack
, 8) == __constant_htonl(0x00000401)))
184 return (IPP2P_BIT
* 100 + 55);
187 if (get_u32(haystack
,8) == __constant_htonl(0x00000827) &&
188 get_u32(haystack
,12) == __constant_htonl(0x37502950))
189 return (IPP2P_BIT
* 100 + 80);
192 /* this packet does not have a constant size */
193 if (packet_len
>= 40 && get_u32(haystack
, 16) == __constant_htonl(0x00000402) && get_u32(haystack
, 36) == __constant_htonl(0x00000104))
194 return (IPP2P_BIT
* 100 + 56);
198 /* some extra-bitcomet rules:
199 * "d1:" [a|r] "d2:id20:"
201 if (packet_len
> 30 && get_u8(haystack
, 8) == 'd' && get_u8(haystack
, 9) == '1' && get_u8(haystack
, 10) == ':' )
203 if (get_u8(haystack
, 11) == 'a' || get_u8(haystack
, 11) == 'r')
205 if (memcmp(haystack
+12,"d2:id20:",8)==0)
206 return (IPP2P_BIT
* 100 + 57);
212 /* packetlen must be bigger than 40 */
213 /* first 4 bytes are zero */
214 if (packet_len
> 40 && get_u32(haystack
, 8) == 0x00000000)
216 /* first rule: 00 00 00 00 01 00 00 xx xx xx xx 00 00 00 00*/
217 if (get_u32(haystack
, 12) == 0x00000000 &&
218 get_u32(haystack
, 16) == 0x00010000 &&
219 get_u32(haystack
, 24) == 0x00000000 )
220 return (IPP2P_BIT
* 100 + 71);
222 /* 00 01 00 00 0d 00 00 xx xx xx xx 00 00 00 00*/
223 if (get_u32(haystack
, 12) == 0x00000001 &&
224 get_u32(haystack
, 16) == 0x000d0000 &&
225 get_u32(haystack
, 24) == 0x00000000 )
226 return (IPP2P_BIT
* 100 + 71);
237 /*Search for Ares commands*/
238 //#define IPP2P_DEBUG_ARES
240 search_ares (const unsigned char *payload
, const u16 plen
)
241 //int search_ares (unsigned char *haystack, int packet_len, int head_len)
243 // const unsigned char *t = haystack + head_len;
245 /* all ares packets start with */
246 if (payload
[1] == 0 && (plen
- payload
[0]) == 3)
252 if ( plen
== 6 && payload
[5] == 0x05 ) return ((IPP2P_ARES
* 100) + 1);
255 /* ares search, min 3 chars --> 14 bytes
256 * lets define a search can be up to 30 chars --> max 34 bytes
258 if ( plen
>= 14 && plen
<= 34 ) return ((IPP2P_ARES
* 100) + 1);
260 #ifdef IPP2P_DEBUG_ARES
262 printk(KERN_DEBUG
"Unknown Ares command %x recognized, len: %u \n", (unsigned int) payload
[2],plen
);
263 #endif /* IPP2P_DEBUG_ARES */
268 /* found connect packet: 03 00 5a 04 03 05 */
269 /* new version ares 1.8: 03 00 5a xx xx 05 */
270 if ((plen
) == 6){ /* possible connect command*/
271 if ((payload
[0] == 0x03) && (payload
[1] == 0x00) && (payload
[2] == 0x5a) && (payload
[5] == 0x05))
272 return ((IPP2P_ARES
* 100) + 1);
274 if ((plen
) == 60){ /* possible download command*/
275 if ((payload
[59] == 0x0a) && (payload
[58] == 0x0a)){
276 if (memcmp(t
, "PUSH SHA1:", 10) == 0) /* found download command */
277 return ((IPP2P_ARES
* 100) + 2);
285 /*Search for SoulSeek commands*/
287 search_soul (const unsigned char *payload
, const u16 plen
)
289 //#define IPP2P_DEBUG_SOUL
290 /* match: xx xx xx xx | xx = sizeof(payload) - 4 */
291 if (get_u32(payload
, 0) == (plen
- 4)){
292 const __u32 m
=get_u32(payload
, 4);
293 /* match 00 yy yy 00, yy can be everything */
294 if ( get_u8(payload
, 4) == 0x00 && get_u8(payload
, 7) == 0x00 )
296 #ifdef IPP2P_DEBUG_SOUL
297 printk(KERN_DEBUG
"0: Soulseek command 0x%x recognized\n",get_u32(payload
, 4));
298 #endif /* IPP2P_DEBUG_SOUL */
299 return ((IPP2P_SOUL
* 100) + 1);
302 /* next match: 01 yy 00 00 | yy can be everything */
303 if ( get_u8(payload
, 4) == 0x01 && get_u16(payload
, 6) == 0x0000 )
305 #ifdef IPP2P_DEBUG_SOUL
306 printk(KERN_DEBUG
"1: Soulseek command 0x%x recognized\n",get_u16(payload
, 4));
307 #endif /* IPP2P_DEBUG_SOUL */
308 return ((IPP2P_SOUL
* 100) + 2);
311 /* other soulseek commandos are: 1-5,7,9,13-18,22,23,26,28,35-37,40-46,50,51,60,62-69,91,92,1001 */
312 /* try to do this in an intelligent way */
313 /* get all small commandos */
328 #ifdef IPP2P_DEBUG_SOUL
329 printk(KERN_DEBUG
"2: Soulseek command 0x%x recognized\n",get_u16(payload
, 4));
330 #endif /* IPP2P_DEBUG_SOUL */
331 return ((IPP2P_SOUL
* 100) + 3);
336 #ifdef IPP2P_DEBUG_SOUL
337 printk(KERN_DEBUG
"3: Soulseek command 0x%x recognized\n",get_u16(payload
, 4));
338 #endif /* IPP2P_DEBUG_SOUL */
339 return ((IPP2P_SOUL
* 100) + 4);
341 if (m
> 12 && m
< 19 )
343 #ifdef IPP2P_DEBUG_SOUL
344 printk(KERN_DEBUG
"4: Soulseek command 0x%x recognized\n",get_u16(payload
, 4));
345 #endif /* IPP2P_DEBUG_SOUL */
346 return ((IPP2P_SOUL
* 100) + 5);
349 if (m
> 34 && m
< 38 )
351 #ifdef IPP2P_DEBUG_SOUL
352 printk(KERN_DEBUG
"5: Soulseek command 0x%x recognized\n",get_u16(payload
, 4));
353 #endif /* IPP2P_DEBUG_SOUL */
354 return ((IPP2P_SOUL
* 100) + 6);
357 if (m
> 39 && m
< 47 )
359 #ifdef IPP2P_DEBUG_SOUL
360 printk(KERN_DEBUG
"6: Soulseek command 0x%x recognized\n",get_u16(payload
, 4));
361 #endif /* IPP2P_DEBUG_SOUL */
362 return ((IPP2P_SOUL
* 100) + 7);
365 if (m
> 61 && m
< 70 )
367 #ifdef IPP2P_DEBUG_SOUL
368 printk(KERN_DEBUG
"7: Soulseek command 0x%x recognized\n",get_u16(payload
, 4));
369 #endif /* IPP2P_DEBUG_SOUL */
370 return ((IPP2P_SOUL
* 100) + 8);
373 #ifdef IPP2P_DEBUG_SOUL
374 printk(KERN_DEBUG
"unknown SOULSEEK command: 0x%x, first 16 bit: 0x%x, first 8 bit: 0x%x ,soulseek ???\n",get_u32(payload
, 4),get_u16(payload
, 4) >> 16,get_u8(payload
, 4) >> 24);
375 #endif /* IPP2P_DEBUG_SOUL */
378 /* match 14 00 00 00 01 yy 00 00 00 STRING(YY) 01 00 00 00 00 46|50 00 00 00 00 */
379 /* without size at the beginning !!! */
380 if ( get_u32(payload
, 0) == 0x14 && get_u8(payload
, 4) == 0x01 )
382 __u32 y
=get_u32(payload
, 5);
383 /* we need 19 chars + string */
384 if ( (y
+ 19) <= (plen
) )
386 const unsigned char *w
=payload
+9+y
;
387 if (get_u32(w
, 0) == 0x01 && ( get_u16(w
, 4) == 0x4600 || get_u16(w
, 4) == 0x5000) && get_u32(w
, 6) == 0x00);
388 #ifdef IPP2P_DEBUG_SOUL
389 printk(KERN_DEBUG
"Soulssek special client command recognized\n");
390 #endif /* IPP2P_DEBUG_SOUL */
391 return ((IPP2P_SOUL
* 100) + 9);
398 /*Search for WinMX commands*/
400 search_winmx (const unsigned char *payload
, const u16 plen
)
402 //#define IPP2P_DEBUG_WINMX
403 if (((plen
) == 4) && (memcmp(payload
, "SEND", 4) == 0)) return ((IPP2P_WINMX
* 100) + 1);
404 if (((plen
) == 3) && (memcmp(payload
, "GET", 3) == 0)) return ((IPP2P_WINMX
* 100) + 2);
405 //if (packet_len < (head_len + 10)) return 0;
406 if (plen
< 10) return 0;
408 if ((memcmp(payload
, "SEND", 4) == 0) || (memcmp(payload
, "GET", 3) == 0)){
410 const u16 end
=plen
-2;
414 if (payload
[c
]== 0x20 && payload
[c
+1] == 0x22)
418 if (count
>=2) return ((IPP2P_WINMX
* 100) + 3);
424 if ( plen
== 149 && payload
[0] == '8' )
426 #ifdef IPP2P_DEBUG_WINMX
427 printk(KERN_INFO
"maybe WinMX\n");
429 if (get_u32(payload
,17) == 0 && get_u32(payload
,21) == 0 && get_u32(payload
,25) == 0 &&
430 // get_u32(payload,33) == __constant_htonl(0x71182b1a) && get_u32(payload,37) == __constant_htonl(0x05050000) &&
431 // get_u32(payload,133) == __constant_htonl(0x31097edf) && get_u32(payload,145) == __constant_htonl(0xdcb8f792))
432 get_u16(payload
,39) == 0 && get_u16(payload
,135) == __constant_htons(0x7edf) && get_u16(payload
,147) == __constant_htons(0xf792))
435 #ifdef IPP2P_DEBUG_WINMX
436 printk(KERN_INFO
"got WinMX\n");
438 return ((IPP2P_WINMX
* 100) + 4);
445 /*Search for appleJuice commands*/
447 search_apple (const unsigned char *payload
, const u16 plen
)
449 if ( (plen
> 7) && (payload
[6] == 0x0d) && (payload
[7] == 0x0a) && (memcmp(payload
, "ajprot", 6) == 0)) return (IPP2P_APPLE
* 100);
455 /*Search for BitTorrent commands*/
457 search_bittorrent (const unsigned char *payload
, const u16 plen
)
461 /* test for match 0x13+"BitTorrent protocol" */
462 if (payload
[0] == 0x13)
464 if (memcmp(payload
+1, "BitTorrent protocol", 19) == 0) return (IPP2P_BIT
* 100);
467 /* get tracker commandos, all starts with GET /
468 * then it can follow: scrape| announce
469 * and then ?hash_info=
471 if (memcmp(payload
,"GET /",5) == 0)
474 if ( memcmp(payload
+5,"scrape?info_hash=",17)==0 ) return (IPP2P_BIT
* 100 + 1);
475 /* message announce */
476 if ( memcmp(payload
+5,"announce?info_hash=",19)==0 ) return (IPP2P_BIT
* 100 + 2);
481 /* bitcomet encryptes the first packet, so we have to detect another
482 * one later in the flow */
483 /* first try failed, too many missdetections */
484 //if ( size == 5 && get_u32(t,0) == __constant_htonl(1) && t[4] < 3) return (IPP2P_BIT * 100 + 3);
486 /* second try: block request packets */
487 if ( plen
== 17 && get_u32(payload
,0) == __constant_htonl(0x0d) && payload
[4] == 0x06 && get_u32(payload
,13) == __constant_htonl(0x4000) ) return (IPP2P_BIT
* 100 + 3);
495 /*check for Kazaa get command*/
497 search_kazaa (const unsigned char *payload
, const u16 plen
)
500 if ((payload
[plen
-2] == 0x0d) && (payload
[plen
-1] == 0x0a) && memcmp(payload
, "GET /.hash=", 11) == 0)
501 return (IPP2P_DATA_KAZAA
* 100);
507 /*check for gnutella get command*/
509 search_gnu (const unsigned char *payload
, const u16 plen
)
511 if ((payload
[plen
-2] == 0x0d) && (payload
[plen
-1] == 0x0a))
513 if (memcmp(payload
, "GET /get/", 9) == 0) return ((IPP2P_DATA_GNU
* 100) + 1);
514 if (memcmp(payload
, "GET /uri-res/", 13) == 0) return ((IPP2P_DATA_GNU
* 100) + 2);
520 /*check for gnutella get commands and other typical data*/
522 search_all_gnu (const unsigned char *payload
, const u16 plen
)
525 if ((payload
[plen
-2] == 0x0d) && (payload
[plen
-1] == 0x0a))
528 if (memcmp(payload
, "GNUTELLA CONNECT/", 17) == 0) return ((IPP2P_GNU
* 100) + 1);
529 if (memcmp(payload
, "GNUTELLA/", 9) == 0) return ((IPP2P_GNU
* 100) + 2);
532 if ((memcmp(payload
, "GET /get/", 9) == 0) || (memcmp(payload
, "GET /uri-res/", 13) == 0))
535 const u16 end
=plen
-22;
537 if ( payload
[c
] == 0x0a && payload
[c
+1] == 0x0d && ((memcmp(&payload
[c
+2], "X-Gnutella-", 11) == 0) || (memcmp(&payload
[c
+2], "X-Queue:", 8) == 0)))
538 return ((IPP2P_GNU
* 100) + 3);
547 /*check for KaZaA download commands and other typical data*/
549 search_all_kazaa (const unsigned char *payload
, const u16 plen
)
551 if ((payload
[plen
-2] == 0x0d) && (payload
[plen
-1] == 0x0a))
554 if (memcmp(payload
, "GIVE ", 5) == 0) return ((IPP2P_KAZAA
* 100) + 1);
556 if (memcmp(payload
, "GET /", 5) == 0) {
558 const u16 end
=plen
-22;
560 if ( payload
[c
] == 0x0a && payload
[c
+1] == 0x0d && ((memcmp(&payload
[c
+2], "X-Kazaa-Username: ", 18) == 0) || (memcmp(&payload
[c
+2], "User-Agent: PeerEnabler/", 24) == 0)))
561 return ((IPP2P_KAZAA
* 100) + 2);
569 /*fast check for edonkey file segment transfer command*/
571 search_edk (const unsigned char *payload
, const u16 plen
)
573 if (payload
[0] != 0xe3)
576 if (payload
[5] == 0x47)
577 return (IPP2P_DATA_EDK
* 100);
585 /*intensive but slower search for some edonkey packets including size-check*/
587 search_all_edk (const unsigned char *payload
, const u16 plen
)
589 if (payload
[0] != 0xe3)
593 const u16 cmd
= get_u16(payload
, 1);
594 if (cmd
== (plen
- 5)) {
595 switch (payload
[5]) {
596 case 0x01: return ((IPP2P_EDK
* 100) + 1); /*Client: hello or Server:hello*/
597 case 0x4c: return ((IPP2P_EDK
* 100) + 9); /*Client: Hello-Answer*/
605 /*fast check for Direct Connect send command*/
607 search_dc (const unsigned char *payload
, const u16 plen
)
610 if (payload
[0] != 0x24 )
613 if (memcmp(&payload
[1], "Send|", 5) == 0)
614 return (IPP2P_DATA_DC
* 100);
622 /*intensive but slower check for all direct connect packets*/
624 search_all_dc (const unsigned char *payload
, const u16 plen
)
626 // unsigned char *t = haystack;
628 if (payload
[0] == 0x24 && payload
[plen
-1] == 0x7c)
630 const unsigned char *t
=&payload
[1];
631 /* Client-Hub-Protocol */
632 if (memcmp(t
, "Lock ", 5) == 0) return ((IPP2P_DC
* 100) + 1);
633 /* Client-Client-Protocol, some are already recognized by client-hub (like lock) */
634 if (memcmp(t
, "MyNick ", 7) == 0) return ((IPP2P_DC
* 100) + 38);
641 search_mute (const unsigned char *payload
, const u16 plen
)
643 if ( plen
== 209 || plen
== 345 || plen
== 473 || plen
== 609 || plen
== 1121 )
645 //printk(KERN_DEBUG "size hit: %u",size);
646 if (memcmp(payload
,"PublicKey: ",11) == 0 )
648 return ((IPP2P_MUTE
* 100) + 0);
650 /* if (memcmp(t+size-14,"\x0aEndPublicKey\x0a",14) == 0)
652 printk(KERN_DEBUG "end pubic key hit: %u",size);
663 search_xdcc (const unsigned char *payload
, const u16 plen
)
665 /* search in small packets only */
666 if (plen
> 20 && plen
< 200 && payload
[plen
-1] == 0x0a && payload
[plen
-2] == 0x0d && memcmp(payload
,"PRIVMSG ",8) == 0)
670 const u16 end
=plen
- 13;
672 /* is seems to be a irc private massage, chedck for xdcc command */
675 if (payload
[x
] == ':')
677 if ( memcmp(&payload
[x
+1],"xdcc send #",11) == 0 )
678 return ((IPP2P_XDCC
* 100) + 0);
686 /* search for waste */
687 int search_waste(const unsigned char *payload
, const u16 plen
)
689 if ( plen
>= 8 && memcmp(payload
,"GET.sha1:",9) == 0)
690 return ((IPP2P_WASTE
* 100) + 0);
698 __u8 short_hand
; /*for fucntions included in short hands*/
700 int (*function_name
) (const unsigned char *, const u16
);
702 {IPP2P_EDK
,SHORT_HAND_IPP2P
,20, &search_all_edk
},
703 // {IPP2P_DATA_KAZAA,SHORT_HAND_DATA,200, &search_kazaa},
704 // {IPP2P_DATA_EDK,SHORT_HAND_DATA,60, &search_edk},
705 // {IPP2P_DATA_DC,SHORT_HAND_DATA,26, &search_dc},
706 {IPP2P_DC
,SHORT_HAND_IPP2P
,5, search_all_dc
},
707 // {IPP2P_DATA_GNU,SHORT_HAND_DATA,40, &search_gnu},
708 {IPP2P_GNU
,SHORT_HAND_IPP2P
,5, &search_all_gnu
},
709 {IPP2P_KAZAA
,SHORT_HAND_IPP2P
,5, &search_all_kazaa
},
710 {IPP2P_BIT
,SHORT_HAND_IPP2P
,20, &search_bittorrent
},
711 {IPP2P_APPLE
,SHORT_HAND_IPP2P
,5, &search_apple
},
712 {IPP2P_SOUL
,SHORT_HAND_IPP2P
,5, &search_soul
},
713 {IPP2P_WINMX
,SHORT_HAND_IPP2P
,2, &search_winmx
},
714 {IPP2P_ARES
,SHORT_HAND_IPP2P
,5, &search_ares
},
715 {IPP2P_MUTE
,SHORT_HAND_NONE
,200, &search_mute
},
716 {IPP2P_WASTE
,SHORT_HAND_NONE
,5, &search_waste
},
717 {IPP2P_XDCC
,SHORT_HAND_NONE
,5, &search_xdcc
},
724 __u8 short_hand
; /*for fucntions included in short hands*/
726 int (*function_name
) (unsigned char *, int);
728 {IPP2P_KAZAA
,SHORT_HAND_IPP2P
,14, &udp_search_kazaa
},
729 {IPP2P_BIT
,SHORT_HAND_IPP2P
,23, &udp_search_bit
},
730 {IPP2P_GNU
,SHORT_HAND_IPP2P
,11, &udp_search_gnu
},
731 {IPP2P_EDK
,SHORT_HAND_IPP2P
,9, &udp_search_edk
},
732 {IPP2P_DC
,SHORT_HAND_IPP2P
,12, &udp_search_directconnect
},
737 #if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,22)
742 match(const struct sk_buff
*skb
,
743 const struct net_device
*in
,
744 const struct net_device
*out
,
745 #if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,17)
746 const struct xt_match
*mymatch
,
747 const void *matchinfo
,
749 unsigned int myprotoff
,
751 const void *matchinfo
,
755 #if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,0)
760 #if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,22)
766 const struct ipt_p2p_info
*info
= matchinfo
;
767 unsigned char *haystack
;
768 #if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,22)
769 struct iphdr
*ip
= ip_hdr(skb
);
771 struct iphdr
*ip
= skb
->nh
.iph
;
773 int p2p_result
= 0, i
= 0;
775 int hlen
= ntohs(ip
->tot_len
)-(ip
->ihl
*4); /*hlen = packet-data length*/
777 /*must not be a fragment*/
779 if (info
->debug
) printk("IPP2P.match: offset found %i \n",offset
);
783 /*make sure that skb is linear*/
784 if(skb_is_nonlinear(skb
)){
785 if (info
->debug
) printk("IPP2P.match: nonlinear skb found\n");
790 haystack
=(char *)ip
+(ip
->ihl
*4); /*haystack = packet data*/
792 switch (ip
->protocol
){
793 case IPPROTO_TCP
: /*what to do with a TCP packet*/
795 struct tcphdr
*tcph
= (void *) ip
+ ip
->ihl
* 4;
797 if (tcph
->fin
) return 0; /*if FIN bit is set bail out*/
798 if (tcph
->syn
) return 0; /*if SYN bit is set bail out*/
799 if (tcph
->rst
) return 0; /*if RST bit is set bail out*/
801 haystack
+= tcph
->doff
* 4; /*get TCP-Header-Size*/
802 hlen
-= tcph
->doff
* 4;
803 while (matchlist
[i
].command
) {
804 if ((((info
->cmd
& matchlist
[i
].command
) == matchlist
[i
].command
) ||
805 ((info
->cmd
& matchlist
[i
].short_hand
) == matchlist
[i
].short_hand
)) &&
806 (hlen
> matchlist
[i
].packet_len
)) {
807 p2p_result
= matchlist
[i
].function_name(haystack
, hlen
);
810 if (info
->debug
) printk("IPP2P.debug:TCP-match: %i from: %u.%u.%u.%u:%i to: %u.%u.%u.%u:%i Length: %i\n",
811 p2p_result
, NIPQUAD(ip
->saddr
),ntohs(tcph
->source
), NIPQUAD(ip
->daddr
),ntohs(tcph
->dest
),hlen
);
820 case IPPROTO_UDP
: /*what to do with an UDP packet*/
822 struct udphdr
*udph
= (void *) ip
+ ip
->ihl
* 4;
824 while (udp_list
[i
].command
){
825 if ((((info
->cmd
& udp_list
[i
].command
) == udp_list
[i
].command
) ||
826 ((info
->cmd
& udp_list
[i
].short_hand
) == udp_list
[i
].short_hand
)) &&
827 (hlen
> udp_list
[i
].packet_len
)) {
828 p2p_result
= udp_list
[i
].function_name(haystack
, hlen
);
830 if (info
->debug
) printk("IPP2P.debug:UDP-match: %i from: %u.%u.%u.%u:%i to: %u.%u.%u.%u:%i Length: %i\n",
831 p2p_result
, NIPQUAD(ip
->saddr
),ntohs(udph
->source
), NIPQUAD(ip
->daddr
),ntohs(udph
->dest
),hlen
);
846 #if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,22)
851 checkentry(const char *tablename
,
852 #if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,17)
854 const struct xt_match
*mymatch
,
856 const struct ipt_ip
*ip
,
859 #if LINUX_VERSION_CODE <= KERNEL_VERSION(2,6,18)
860 unsigned int matchsize
,
862 unsigned int hook_mask
)
864 /* Must specify -p tcp */
865 /* if (ip->proto != IPPROTO_TCP || (ip->invflags & IPT_INV_PROTO)) {
866 * printk("ipp2p: Only works on TCP packets, use -p tcp\n");
873 static struct ipt_match ipp2p_match
= {
874 #if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,0)
881 #elif LINUX_VERSION_CODE < KERNEL_VERSION(2,6,17)
884 .checkentry
= &checkentry
,
886 #else /* LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,17) */
890 .matchsize
= XT_ALIGN(sizeof(struct ipt_p2p_info
)),
891 .checkentry
= &checkentry
,
897 static int __init
init(void)
899 printk(KERN_INFO
"IPP2P v%s loading\n", IPP2P_VERSION
);
900 return ipt_register_match(&ipp2p_match
);
903 static void __exit
fini(void)
905 ipt_unregister_match(&ipp2p_match
);
906 printk(KERN_INFO
"IPP2P v%s unloaded\n", IPP2P_VERSION
);