]> git.ipfire.org Git - thirdparty/xtables-addons.git/blame - extensions/xt_ipp2p.c
projects / thirdparty / xtables-addons.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
ipp2p: remove compat and obsolete code
[thirdparty/xtables-addons.git] / extensions / xt_ipp2p.c
CommitLineData
44d6f47a
JE		 1#include <linux/module.h>
2#include <linux/version.h>
3#include <linux/netfilter_ipv4/ip_tables.h>
4#include <net/tcp.h>
5#include <net/udp.h>
6#include "xt_ipp2p.h"
7#include "compat_xtables.h"
8
9#define get_u8(X,O) (*(__u8 *)(X + O))
10#define get_u16(X,O) (*(__u16 *)(X + O))
11#define get_u32(X,O) (*(__u32 *)(X + O))
12
13MODULE_AUTHOR("Eicke Friedrich/Klaus Degner <ipp2p@ipp2p.org>");
14MODULE_DESCRIPTION("An extension to iptables to identify P2P traffic.");
15MODULE_LICENSE("GPL");
16
44d6f47a
JE		 17/*Search for UDP eDonkey/eMule/Kad commands*/
18int
19udp_search_edk (unsigned char *haystack, int packet_len)
20{
21 unsigned char *t = haystack;
22 t += 8;
23
24 switch (t[0]) {
25 case 0xe3:
26 { /*edonkey*/
27 switch (t[1])
28 {
29 /* client -> server status request */
30 case 0x96:
31 if (packet_len == 14) return ((IPP2P_EDK * 100) + 50);
32 break;
33 /* server -> client status request */
34 case 0x97: if (packet_len == 42) return ((IPP2P_EDK * 100) + 51);
35 break;
36 /* server description request */
37 /* e3 2a ff f0 .. | size == 6 */
38 case 0xa2: if ( (packet_len == 14) && ( get_u16(t,2) == __constant_htons(0xfff0) ) ) return ((IPP2P_EDK * 100) + 52);
39 break;
40 /* server description response */
41 /* e3 a3 ff f0 .. | size > 40 && size < 200 */
42 //case 0xa3: return ((IPP2P_EDK * 100) + 53);
43 // break;
44 case 0x9a: if (packet_len==26) return ((IPP2P_EDK * 100) + 54);
45 break;
46
47 case 0x92: if (packet_len==18) return ((IPP2P_EDK * 100) + 55);
48 break;
49 }
50 break;
51 }
52 case 0xe4:
53 {
54 switch (t[1])
55 {
56 /* e4 20 .. | size == 43 */
57 case 0x20: if ((packet_len == 43) && (t[2] != 0x00) && (t[34] != 0x00)) return ((IPP2P_EDK * 100) + 60);
58 break;
59 /* e4 00 .. 00 | size == 35 ? */
60 case 0x00: if ((packet_len == 35) && (t[26] == 0x00)) return ((IPP2P_EDK * 100) + 61);
61 break;
62 /* e4 10 .. 00 | size == 35 ? */
63 case 0x10: if ((packet_len == 35) && (t[26] == 0x00)) return ((IPP2P_EDK * 100) + 62);
64 break;
65 /* e4 18 .. 00 | size == 35 ? */
66 case 0x18: if ((packet_len == 35) && (t[26] == 0x00)) return ((IPP2P_EDK * 100) + 63);
67 break;
68 /* e4 52 .. | size = 44 */
69 case 0x52: if (packet_len == 44 ) return ((IPP2P_EDK * 100) + 64);
70 break;
71 /* e4 58 .. | size == 6 */
72 case 0x58: if (packet_len == 14 ) return ((IPP2P_EDK * 100) + 65);
73 break;
74 /* e4 59 .. | size == 2 */
75 case 0x59: if (packet_len == 10 )return ((IPP2P_EDK * 100) + 66);
76 break;
77 /* e4 28 .. | packet_len == 52,77,102,127... */
78 case 0x28: if (((packet_len-52) % 25) == 0) return ((IPP2P_EDK * 100) + 67);
79 break;
80 /* e4 50 xx xx | size == 4 */
81 case 0x50: if (packet_len == 12) return ((IPP2P_EDK * 100) + 68);
82 break;
83 /* e4 40 xx xx | size == 48 */
84 case 0x40: if (packet_len == 56) return ((IPP2P_EDK * 100) + 69);
85 break;
86 }
87 break;
88 }
89 } /* end of switch (t[0]) */
90 return 0;
91}/*udp_search_edk*/
92
44d6f47a
JE		 93/*Search for UDP Gnutella commands*/
94int
95udp_search_gnu (unsigned char *haystack, int packet_len)
96{
97 unsigned char *t = haystack;
98 t += 8;
99
100 if (memcmp(t, "GND", 3) == 0) return ((IPP2P_GNU * 100) + 51);
101 if (memcmp(t, "GNUTELLA ", 9) == 0) return ((IPP2P_GNU * 100) + 52);
102 return 0;
103}/*udp_search_gnu*/
104
44d6f47a
JE		 105/*Search for UDP KaZaA commands*/
106int
107udp_search_kazaa (unsigned char *haystack, int packet_len)
108{
109 unsigned char *t = haystack;
110
111 if (t[packet_len-1] == 0x00){
112 t += (packet_len - 6);
113 if (memcmp(t, "KaZaA", 5) == 0) return (IPP2P_KAZAA * 100 +50);
114 }
115
116 return 0;
117}/*udp_search_kazaa*/
118
119/*Search for UDP DirectConnect commands*/
120int
121udp_search_directconnect (unsigned char *haystack, int packet_len)
122{
123 unsigned char *t = haystack;
124 if ((*(t + 8) == 0x24) && (*(t + packet_len - 1) == 0x7c)) {
125 t+=8;
126 if (memcmp(t, "SR ", 3) == 0) return ((IPP2P_DC * 100) + 60);
127 if (memcmp(t, "Ping ", 5) == 0) return ((IPP2P_DC * 100) + 61);
128 }
129 return 0;
130}/*udp_search_directconnect*/
131
44d6f47a
JE		 132/*Search for UDP BitTorrent commands*/
133int
134udp_search_bit (unsigned char *haystack, int packet_len)
135{
136 switch(packet_len)
137 {
138 case 24:
139 /* ^ 00 00 04 17 27 10 19 80 */
140 if ((ntohl(get_u32(haystack, 8)) == 0x00000417) && (ntohl(get_u32(haystack, 12)) == 0x27101980))
141 return (IPP2P_BIT * 100 + 50);
142 break;
143 case 44:
144 if (get_u32(haystack, 16) == __constant_htonl(0x00000400) && get_u32(haystack, 36) == __constant_htonl(0x00000104))
145 return (IPP2P_BIT * 100 + 51);
146 if (get_u32(haystack, 16) == __constant_htonl(0x00000400))
147 return (IPP2P_BIT * 100 + 61);
148 break;
149 case 65:
150 if (get_u32(haystack, 16) == __constant_htonl(0x00000404) && get_u32(haystack, 36) == __constant_htonl(0x00000104))
151 return (IPP2P_BIT * 100 + 52);
152 if (get_u32(haystack, 16) == __constant_htonl(0x00000404))
153 return (IPP2P_BIT * 100 + 62);
154 break;
155 case 67:
156 if (get_u32(haystack, 16) == __constant_htonl(0x00000406) && get_u32(haystack, 36) == __constant_htonl(0x00000104))
157 return (IPP2P_BIT * 100 + 53);
158 if (get_u32(haystack, 16) == __constant_htonl(0x00000406))
159 return (IPP2P_BIT * 100 + 63);
160 break;
161 case 211:
162 if (get_u32(haystack, 8) == __constant_htonl(0x00000405))
163 return (IPP2P_BIT * 100 + 54);
164 break;
165 case 29:
166 if ((get_u32(haystack, 8) == __constant_htonl(0x00000401)))
167 return (IPP2P_BIT * 100 + 55);
168 break;
169 case 52:
170 if (get_u32(haystack,8) == __constant_htonl(0x00000827) &&
171 get_u32(haystack,12) == __constant_htonl(0x37502950))
172 return (IPP2P_BIT * 100 + 80);
173 break;
174 default:
175 /* this packet does not have a constant size */
176 if (packet_len >= 40 && get_u32(haystack, 16) == __constant_htonl(0x00000402) && get_u32(haystack, 36) == __constant_htonl(0x00000104))
177 return (IPP2P_BIT * 100 + 56);
178 break;
179 }
180
181 /* some extra-bitcomet rules:
182 * "d1:" [a|r] "d2:id20:"
183 */
184 if (packet_len > 30 && get_u8(haystack, 8) == 'd' && get_u8(haystack, 9) == '1' && get_u8(haystack, 10) == ':' )
185 {
186 if (get_u8(haystack, 11) == 'a' || get_u8(haystack, 11) == 'r')
187 {
188 if (memcmp(haystack+12,"d2:id20:",8)==0)
189 return (IPP2P_BIT * 100 + 57);
190 }
191 }
192
193#if 0
194 /* bitlord rules */
195 /* packetlen must be bigger than 40 */
196 /* first 4 bytes are zero */
197 if (packet_len > 40 && get_u32(haystack, 8) == 0x00000000)
198 {
199 /* first rule: 00 00 00 00 01 00 00 xx xx xx xx 00 00 00 00*/
200 if (get_u32(haystack, 12) == 0x00000000 &&
201 get_u32(haystack, 16) == 0x00010000 &&
202 get_u32(haystack, 24) == 0x00000000 )
203 return (IPP2P_BIT * 100 + 71);
204
205 /* 00 01 00 00 0d 00 00 xx xx xx xx 00 00 00 00*/
206 if (get_u32(haystack, 12) == 0x00000001 &&
207 get_u32(haystack, 16) == 0x000d0000 &&
208 get_u32(haystack, 24) == 0x00000000 )
209 return (IPP2P_BIT * 100 + 71);
44d6f47a
JE		 210 }
211#endif
212
213 return 0;
214}/*udp_search_bit*/
215
44d6f47a
JE		 216/*Search for Ares commands*/
217//#define IPP2P_DEBUG_ARES
218int
219search_ares (const unsigned char *payload, const u16 plen)
44d6f47a 220{
44d6f47a
JE		 221 /* all ares packets start with */
222 if (payload[1] == 0 && (plen - payload[0]) == 3)
223 {
224 switch (payload[2])
225 {
226 case 0x5a:
227 /* ares connect */
228 if ( plen == 6 && payload[5] == 0x05 ) return ((IPP2P_ARES * 100) + 1);
229 break;
230 case 0x09:
231 /* ares search, min 3 chars --> 14 bytes
232 * lets define a search can be up to 30 chars --> max 34 bytes
233 */
234 if ( plen >= 14 && plen <= 34 ) return ((IPP2P_ARES * 100) + 1);
235 break;
236#ifdef IPP2P_DEBUG_ARES
237 default:
238 printk(KERN_DEBUG "Unknown Ares command %x recognized, len: %u \n", (unsigned int) payload[2],plen);
239#endif /* IPP2P_DEBUG_ARES */
240 }
241 }
242
243#if 0
244 /* found connect packet: 03 00 5a 04 03 05 */
245 /* new version ares 1.8: 03 00 5a xx xx 05 */
246 if ((plen) == 6){ /* possible connect command*/
247 if ((payload[0] == 0x03) && (payload[1] == 0x00) && (payload[2] == 0x5a) && (payload[5] == 0x05))
248 return ((IPP2P_ARES * 100) + 1);
249 }
250 if ((plen) == 60){ /* possible download command*/
251 if ((payload[59] == 0x0a) && (payload[58] == 0x0a)){
252 if (memcmp(t, "PUSH SHA1:", 10) == 0) /* found download command */
253 return ((IPP2P_ARES * 100) + 2);
254 }
255 }
256#endif
257
258 return 0;
259} /*search_ares*/
260
261/*Search for SoulSeek commands*/
262int
263search_soul (const unsigned char *payload, const u16 plen)
264{
265//#define IPP2P_DEBUG_SOUL
266 /* match: xx xx xx xx | xx = sizeof(payload) - 4 */
267 if (get_u32(payload, 0) == (plen - 4)){
268 const __u32 m=get_u32(payload, 4);
269 /* match 00 yy yy 00, yy can be everything */
270 if ( get_u8(payload, 4) == 0x00 && get_u8(payload, 7) == 0x00 )
271 {
272#ifdef IPP2P_DEBUG_SOUL
273 printk(KERN_DEBUG "0: Soulseek command 0x%x recognized\n",get_u32(payload, 4));
274#endif /* IPP2P_DEBUG_SOUL */
275 return ((IPP2P_SOUL * 100) + 1);
276 }
277
278 /* next match: 01 yy 00 00 | yy can be everything */
279 if ( get_u8(payload, 4) == 0x01 && get_u16(payload, 6) == 0x0000 )
280 {
281#ifdef IPP2P_DEBUG_SOUL
282 printk(KERN_DEBUG "1: Soulseek command 0x%x recognized\n",get_u16(payload, 4));
283#endif /* IPP2P_DEBUG_SOUL */
284 return ((IPP2P_SOUL * 100) + 2);
285 }
286
287 /* other soulseek commandos are: 1-5,7,9,13-18,22,23,26,28,35-37,40-46,50,51,60,62-69,91,92,1001 */
288 /* try to do this in an intelligent way */
289 /* get all small commandos */
290 switch(m)
291 {
292 case 7:
293 case 9:
294 case 22:
295 case 23:
296 case 26:
297 case 28:
298 case 50:
299 case 51:
300 case 60:
301 case 91:
302 case 92:
303 case 1001:
304#ifdef IPP2P_DEBUG_SOUL
305 printk(KERN_DEBUG "2: Soulseek command 0x%x recognized\n",get_u16(payload, 4));
306#endif /* IPP2P_DEBUG_SOUL */
307 return ((IPP2P_SOUL * 100) + 3);
308 }
309
310 if (m > 0 && m < 6 )
311 {
312#ifdef IPP2P_DEBUG_SOUL
313 printk(KERN_DEBUG "3: Soulseek command 0x%x recognized\n",get_u16(payload, 4));
314#endif /* IPP2P_DEBUG_SOUL */
315 return ((IPP2P_SOUL * 100) + 4);
316 }
317 if (m > 12 && m < 19 )
318 {
319#ifdef IPP2P_DEBUG_SOUL
320 printk(KERN_DEBUG "4: Soulseek command 0x%x recognized\n",get_u16(payload, 4));
321#endif /* IPP2P_DEBUG_SOUL */
322 return ((IPP2P_SOUL * 100) + 5);
323 }
324
325 if (m > 34 && m < 38 )
326 {
327#ifdef IPP2P_DEBUG_SOUL
328 printk(KERN_DEBUG "5: Soulseek command 0x%x recognized\n",get_u16(payload, 4));
329#endif /* IPP2P_DEBUG_SOUL */
330 return ((IPP2P_SOUL * 100) + 6);
331 }
332
333 if (m > 39 && m < 47 )
334 {
335#ifdef IPP2P_DEBUG_SOUL
336 printk(KERN_DEBUG "6: Soulseek command 0x%x recognized\n",get_u16(payload, 4));
337#endif /* IPP2P_DEBUG_SOUL */
338 return ((IPP2P_SOUL * 100) + 7);
339 }
340
341 if (m > 61 && m < 70 )
342 {
343#ifdef IPP2P_DEBUG_SOUL
344 printk(KERN_DEBUG "7: Soulseek command 0x%x recognized\n",get_u16(payload, 4));
345#endif /* IPP2P_DEBUG_SOUL */
346 return ((IPP2P_SOUL * 100) + 8);
347 }
348
349#ifdef IPP2P_DEBUG_SOUL
350 printk(KERN_DEBUG "unknown SOULSEEK command: 0x%x, first 16 bit: 0x%x, first 8 bit: 0x%x ,soulseek ???\n",get_u32(payload, 4),get_u16(payload, 4) >> 16,get_u8(payload, 4) >> 24);
351#endif /* IPP2P_DEBUG_SOUL */
352 }
353
354 /* match 14 00 00 00 01 yy 00 00 00 STRING(YY) 01 00 00 00 00 46|50 00 00 00 00 */
355 /* without size at the beginning !!! */
356 if ( get_u32(payload, 0) == 0x14 && get_u8(payload, 4) == 0x01 )
357 {
358 __u32 y=get_u32(payload, 5);
359 /* we need 19 chars + string */
360 if ( (y + 19) <= (plen) )
361 {
362 const unsigned char *w=payload+9+y;
363 if (get_u32(w, 0) == 0x01 && ( get_u16(w, 4) == 0x4600 || get_u16(w, 4) == 0x5000) && get_u32(w, 6) == 0x00);
364#ifdef IPP2P_DEBUG_SOUL
365 printk(KERN_DEBUG "Soulssek special client command recognized\n");
366#endif /* IPP2P_DEBUG_SOUL */
367 return ((IPP2P_SOUL * 100) + 9);
368 }
369 }
370 return 0;
371}
372
373
374/*Search for WinMX commands*/
375int
376search_winmx (const unsigned char *payload, const u16 plen)
377{
378//#define IPP2P_DEBUG_WINMX
379 if (((plen) == 4) && (memcmp(payload, "SEND", 4) == 0)) return ((IPP2P_WINMX * 100) + 1);
380 if (((plen) == 3) && (memcmp(payload, "GET", 3) == 0)) return ((IPP2P_WINMX * 100) + 2);
381 //if (packet_len < (head_len + 10)) return 0;
382 if (plen < 10) return 0;
383
384 if ((memcmp(payload, "SEND", 4) == 0) || (memcmp(payload, "GET", 3) == 0)){
385 u16 c=4;
386 const u16 end=plen-2;
387 u8 count=0;
388 while (c < end)
389 {
390 if (payload[c]== 0x20 && payload[c+1] == 0x22)
391 {
392 c++;
393 count++;
394 if (count>=2) return ((IPP2P_WINMX * 100) + 3);
395 }
396 c++;
397 }
398 }
399
400 if ( plen == 149 && payload[0] == '8' )
401 {
402#ifdef IPP2P_DEBUG_WINMX
403 printk(KERN_INFO "maybe WinMX\n");
404#endif
405 if (get_u32(payload,17) == 0 && get_u32(payload,21) == 0 && get_u32(payload,25) == 0 &&
406// get_u32(payload,33) == __constant_htonl(0x71182b1a) && get_u32(payload,37) == __constant_htonl(0x05050000) &&
407// get_u32(payload,133) == __constant_htonl(0x31097edf) && get_u32(payload,145) == __constant_htonl(0xdcb8f792))
408 get_u16(payload,39) == 0 && get_u16(payload,135) == __constant_htons(0x7edf) && get_u16(payload,147) == __constant_htons(0xf792))
409
410 {
411#ifdef IPP2P_DEBUG_WINMX
412 printk(KERN_INFO "got WinMX\n");
413#endif
414 return ((IPP2P_WINMX * 100) + 4);
415 }
416 }
417 return 0;
418} /*search_winmx*/
419
44d6f47a
JE		 420/*Search for appleJuice commands*/
421int
422search_apple (const unsigned char *payload, const u16 plen)
423{
424 if ( (plen > 7) && (payload[6] == 0x0d) && (payload[7] == 0x0a) && (memcmp(payload, "ajprot", 6) == 0)) return (IPP2P_APPLE * 100);
425
426 return 0;
427}
428
44d6f47a
JE		 429/*Search for BitTorrent commands*/
430int
431search_bittorrent (const unsigned char *payload, const u16 plen)
432{
433 if (plen > 20)
434 {
435 /* test for match 0x13+"BitTorrent protocol" */
436 if (payload[0] == 0x13)
437 {
438 if (memcmp(payload+1, "BitTorrent protocol", 19) == 0) return (IPP2P_BIT * 100);
439 }
440
441 /* get tracker commandos, all starts with GET /
442 * then it can follow: scrape| announce
443 * and then ?hash_info=
444 */
445 if (memcmp(payload,"GET /",5) == 0)
446 {
447 /* message scrape */
448 if ( memcmp(payload+5,"scrape?info_hash=",17)==0 ) return (IPP2P_BIT * 100 + 1);
449 /* message announce */
450 if ( memcmp(payload+5,"announce?info_hash=",19)==0 ) return (IPP2P_BIT * 100 + 2);
451 }
452 }
453 else
454 {
455 /* bitcomet encryptes the first packet, so we have to detect another
456 * one later in the flow */
457 /* first try failed, too many missdetections */
458 //if ( size == 5 && get_u32(t,0) == __constant_htonl(1) && t[4] < 3) return (IPP2P_BIT * 100 + 3);
459
460 /* second try: block request packets */
461 if ( plen == 17 && get_u32(payload,0) == __constant_htonl(0x0d) && payload[4] == 0x06 && get_u32(payload,13) == __constant_htonl(0x4000) ) return (IPP2P_BIT * 100 + 3);
462 }
463
464 return 0;
465}
466
44d6f47a
JE		 467/*check for Kazaa get command*/
468int
469search_kazaa (const unsigned char *payload, const u16 plen)
44d6f47a
JE		 470{
471 if ((payload[plen-2] == 0x0d) && (payload[plen-1] == 0x0a) && memcmp(payload, "GET /.hash=", 11) == 0)
472 return (IPP2P_DATA_KAZAA * 100);
473
474 return 0;
475}
476
44d6f47a
JE		 477/*check for gnutella get command*/
478int
479search_gnu (const unsigned char *payload, const u16 plen)
480{
481 if ((payload[plen-2] == 0x0d) && (payload[plen-1] == 0x0a))
482 {
483 if (memcmp(payload, "GET /get/", 9) == 0) return ((IPP2P_DATA_GNU * 100) + 1);
484 if (memcmp(payload, "GET /uri-res/", 13) == 0) return ((IPP2P_DATA_GNU * 100) + 2);
485 }
486 return 0;
487}
488
44d6f47a
JE		 489/*check for gnutella get commands and other typical data*/
490int
491search_all_gnu (const unsigned char *payload, const u16 plen)
492{
44d6f47a
JE		 493 if ((payload[plen-2] == 0x0d) && (payload[plen-1] == 0x0a))
494 {
44d6f47a
JE		 495 if (memcmp(payload, "GNUTELLA CONNECT/", 17) == 0) return ((IPP2P_GNU * 100) + 1);
496 if (memcmp(payload, "GNUTELLA/", 9) == 0) return ((IPP2P_GNU * 100) + 2);
497
44d6f47a
JE		 498 if ((memcmp(payload, "GET /get/", 9) == 0) || (memcmp(payload, "GET /uri-res/", 13) == 0))
499 {
500 u16 c=8;
501 const u16 end=plen-22;
502 while (c < end) {
503 if ( payload[c] == 0x0a && payload[c+1] == 0x0d && ((memcmp(&payload[c+2], "X-Gnutella-", 11) == 0) || (memcmp(&payload[c+2], "X-Queue:", 8) == 0)))
504 return ((IPP2P_GNU * 100) + 3);
505 c++;
506 }
507 }
508 }
509 return 0;
510}
511
44d6f47a
JE		 512/*check for KaZaA download commands and other typical data*/
513int
514search_all_kazaa (const unsigned char *payload, const u16 plen)
515{
516 if ((payload[plen-2] == 0x0d) && (payload[plen-1] == 0x0a))
517 {
518
519 if (memcmp(payload, "GIVE ", 5) == 0) return ((IPP2P_KAZAA * 100) + 1);
520
521 if (memcmp(payload, "GET /", 5) == 0) {
522 u16 c = 8;
523 const u16 end=plen-22;
524 while (c < end) {
525 if ( payload[c] == 0x0a && payload[c+1] == 0x0d && ((memcmp(&payload[c+2], "X-Kazaa-Username: ", 18) == 0) || (memcmp(&payload[c+2], "User-Agent: PeerEnabler/", 24) == 0)))
526 return ((IPP2P_KAZAA * 100) + 2);
527 c++;
528 }
529 }
530 }
531 return 0;
532}
533
534/*fast check for edonkey file segment transfer command*/
535int
536search_edk (const unsigned char *payload, const u16 plen)
537{
538 if (payload[0] != 0xe3)
539 return 0;
540 else {
541 if (payload[5] == 0x47)
542 return (IPP2P_DATA_EDK * 100);
543 else
544 return 0;
545 }
546}
547
44d6f47a
JE		 548/*intensive but slower search for some edonkey packets including size-check*/
549int
550search_all_edk (const unsigned char *payload, const u16 plen)
551{
552 if (payload[0] != 0xe3)
553 return 0;
554 else {
555 //t += head_len;
556 const u16 cmd = get_u16(payload, 1);
557 if (cmd == (plen - 5)) {
558 switch (payload[5]) {
559 case 0x01: return ((IPP2P_EDK * 100) + 1); /*Client: hello or Server:hello*/
560 case 0x4c: return ((IPP2P_EDK * 100) + 9); /*Client: Hello-Answer*/
561 }
562 }
563 return 0;
564 }
565}
566
44d6f47a
JE		 567/*fast check for Direct Connect send command*/
568int
569search_dc (const unsigned char *payload, const u16 plen)
570{
571
572 if (payload[0] != 0x24 )
573 return 0;
574 else {
575 if (memcmp(&payload[1], "Send|", 5) == 0)
576 return (IPP2P_DATA_DC * 100);
577 else
578 return 0;
579 }
580
581}
582
44d6f47a
JE		 583/*intensive but slower check for all direct connect packets*/
584int
585search_all_dc (const unsigned char *payload, const u16 plen)
586{
44d6f47a
JE		 587 if (payload[0] == 0x24 && payload[plen-1] == 0x7c)
588 {
589 const unsigned char *t=&payload[1];
590 /* Client-Hub-Protocol */
591 if (memcmp(t, "Lock ", 5) == 0) return ((IPP2P_DC * 100) + 1);
592 /* Client-Client-Protocol, some are already recognized by client-hub (like lock) */
593 if (memcmp(t, "MyNick ", 7) == 0) return ((IPP2P_DC * 100) + 38);
594 }
595 return 0;
596}
597
598/*check for mute*/
599int
600search_mute (const unsigned char *payload, const u16 plen)
601{
602 if ( plen == 209 || plen == 345 || plen == 473 || plen == 609 || plen == 1121 )
603 {
604 //printk(KERN_DEBUG "size hit: %u",size);
605 if (memcmp(payload,"PublicKey: ",11) == 0 )
606 {
607 return ((IPP2P_MUTE * 100) + 0);
608
609/* if (memcmp(t+size-14,"\x0aEndPublicKey\x0a",14) == 0)
610 {
611 printk(KERN_DEBUG "end pubic key hit: %u",size);
612
613 }*/
614 }
615 }
616 return 0;
617}
618
619
620/* check for xdcc */
621int
622search_xdcc (const unsigned char *payload, const u16 plen)
623{
624 /* search in small packets only */
625 if (plen > 20 && plen < 200 && payload[plen-1] == 0x0a && payload[plen-2] == 0x0d && memcmp(payload,"PRIVMSG ",8) == 0)
626 {
44d6f47a
JE		 627 u16 x=10;
628 const u16 end=plen - 13;
629
630 /* is seems to be a irc private massage, chedck for xdcc command */
631 while (x < end)
632 {
633 if (payload[x] == ':')
634 {
635 if ( memcmp(&payload[x+1],"xdcc send #",11) == 0 )
636 return ((IPP2P_XDCC * 100) + 0);
637 }
638 x++;
639 }
640 }
641 return 0;
642}
643
644/* search for waste */
645int search_waste(const unsigned char *payload, const u16 plen)
646{
647 if ( plen >= 8 && memcmp(payload,"GET.sha1:",9) == 0)
648 return ((IPP2P_WASTE * 100) + 0);
649
650 return 0;
651}
652
44d6f47a
JE		 653static struct {
654 int command;
655 __u8 short_hand; /*for fucntions included in short hands*/
656 int packet_len;
657 int (*function_name) (const unsigned char *, const u16);
658} matchlist[] = {
659 {IPP2P_EDK,SHORT_HAND_IPP2P,20, &search_all_edk},
660// {IPP2P_DATA_KAZAA,SHORT_HAND_DATA,200, &search_kazaa},
661// {IPP2P_DATA_EDK,SHORT_HAND_DATA,60, &search_edk},
662// {IPP2P_DATA_DC,SHORT_HAND_DATA,26, &search_dc},
663 {IPP2P_DC,SHORT_HAND_IPP2P,5, search_all_dc},
664// {IPP2P_DATA_GNU,SHORT_HAND_DATA,40, &search_gnu},
665 {IPP2P_GNU,SHORT_HAND_IPP2P,5, &search_all_gnu},
666 {IPP2P_KAZAA,SHORT_HAND_IPP2P,5, &search_all_kazaa},
667 {IPP2P_BIT,SHORT_HAND_IPP2P,20, &search_bittorrent},
668 {IPP2P_APPLE,SHORT_HAND_IPP2P,5, &search_apple},
669 {IPP2P_SOUL,SHORT_HAND_IPP2P,5, &search_soul},
670 {IPP2P_WINMX,SHORT_HAND_IPP2P,2, &search_winmx},
671 {IPP2P_ARES,SHORT_HAND_IPP2P,5, &search_ares},
672 {IPP2P_MUTE,SHORT_HAND_NONE,200, &search_mute},
673 {IPP2P_WASTE,SHORT_HAND_NONE,5, &search_waste},
674 {IPP2P_XDCC,SHORT_HAND_NONE,5, &search_xdcc},
675 {0,0,0,NULL}
676};
677
44d6f47a
JE		 678static struct {
679 int command;
680 __u8 short_hand; /*for fucntions included in short hands*/
681 int packet_len;
682 int (*function_name) (unsigned char *, int);
683} udp_list[] = {
684 {IPP2P_KAZAA,SHORT_HAND_IPP2P,14, &udp_search_kazaa},
685 {IPP2P_BIT,SHORT_HAND_IPP2P,23, &udp_search_bit},
686 {IPP2P_GNU,SHORT_HAND_IPP2P,11, &udp_search_gnu},
687 {IPP2P_EDK,SHORT_HAND_IPP2P,9, &udp_search_edk},
688 {IPP2P_DC,SHORT_HAND_IPP2P,12, &udp_search_directconnect},
689 {0,0,0,NULL}
690};
691
44d6f47a
JE		 692static int
693match(const struct sk_buff *skb,
694 const struct net_device *in,
695 const struct net_device *out,
44d6f47a 696 const struct xt_match *match,
44d6f47a
JE		 697 const void *matchinfo,
698 int offset,
44d6f47a 699 unsigned int protoff,
44d6f47a
JE		 700 int *hotdrop)
701{
702 const struct ipt_p2p_info *info = matchinfo;
703 unsigned char *haystack;
44d6f47a 704 struct iphdr *ip = ip_hdr(skb);
44d6f47a 705 int p2p_result = 0, i = 0;
44d6f47a
JE		 706 int hlen = ntohs(ip->tot_len)-(ip->ihl*4); /*hlen = packet-data length*/
707
708 /*must not be a fragment*/
709 if (offset) {
710 if (info->debug) printk("IPP2P.match: offset found %i \n",offset);
711 return 0;
712 }
713
714 /*make sure that skb is linear*/
715 if(skb_is_nonlinear(skb)){
716 if (info->debug) printk("IPP2P.match: nonlinear skb found\n");
717 return 0;
718 }
719
44d6f47a
JE		 720 haystack=(char *)ip+(ip->ihl*4); /*haystack = packet data*/
721
722 switch (ip->protocol){
723 case IPPROTO_TCP: /*what to do with a TCP packet*/
724 {
725 struct tcphdr *tcph = (void *) ip + ip->ihl * 4;
726
727 if (tcph->fin) return 0; /*if FIN bit is set bail out*/
728 if (tcph->syn) return 0; /*if SYN bit is set bail out*/
729 if (tcph->rst) return 0; /*if RST bit is set bail out*/
730
731 haystack += tcph->doff * 4; /*get TCP-Header-Size*/
732 hlen -= tcph->doff * 4;
733 while (matchlist[i].command) {
734 if ((((info->cmd & matchlist[i].command) == matchlist[i].command) ||
735 ((info->cmd & matchlist[i].short_hand) == matchlist[i].short_hand)) &&
736 (hlen > matchlist[i].packet_len)) {
737 p2p_result = matchlist[i].function_name(haystack, hlen);
738 if (p2p_result)
739 {
740 if (info->debug) printk("IPP2P.debug:TCP-match: %i from: %u.%u.%u.%u:%i to: %u.%u.%u.%u:%i Length: %i\n",
741 p2p_result, NIPQUAD(ip->saddr),ntohs(tcph->source), NIPQUAD(ip->daddr),ntohs(tcph->dest),hlen);
742 return p2p_result;
743 }
744 }
745 i++;
746 }
747 return p2p_result;
748 }
749
750 case IPPROTO_UDP: /*what to do with an UDP packet*/
751 {
752 struct udphdr *udph = (void *) ip + ip->ihl * 4;
753
754 while (udp_list[i].command){
755 if ((((info->cmd & udp_list[i].command) == udp_list[i].command) ||
756 ((info->cmd & udp_list[i].short_hand) == udp_list[i].short_hand)) &&
757 (hlen > udp_list[i].packet_len)) {
758 p2p_result = udp_list[i].function_name(haystack, hlen);
759 if (p2p_result){
760 if (info->debug) printk("IPP2P.debug:UDP-match: %i from: %u.%u.%u.%u:%i to: %u.%u.%u.%u:%i Length: %i\n",
761 p2p_result, NIPQUAD(ip->saddr),ntohs(udph->source), NIPQUAD(ip->daddr),ntohs(udph->dest),hlen);
762 return p2p_result;
763 }
764 }
765 i++;
766 }
767 return p2p_result;
768 }
769
770 default: return 0;
771 }
772}
773
44d6f47a 774static struct xt_match ipp2p_match = {
44d6f47a 775 .name = "ipp2p",
44d6f47a 776 .family = AF_INET,
44d6f47a 777 .match = &match,
44d6f47a 778 .matchsize = sizeof(struct ipt_p2p_info),
44d6f47a 779 .me = THIS_MODULE,
44d6f47a
JE		 780};
781
44d6f47a
JE		 782static int __init init(void)
783{
44d6f47a 784 return xt_register_match(&ipp2p_match);
44d6f47a
JE		 785}
786
787static void __exit fini(void)
788{
44d6f47a 789 xt_unregister_match(&ipp2p_match);
44d6f47a
JE		 790}
791
792module_init(init);
793module_exit(fini);
Mirror of git://git.inai.de/xtables-addons