10 #include <linux/netfilter_ipv4/ipt_ipp2p.h>
12 #ifndef XTABLES_VERSION
13 #define XTABLES_VERSION IPTABLES_VERSION
17 #define xtables_match iptables_match
18 #define xtables_register_match register_match
25 "IPP2P v%s options:\n"
26 " --ipp2p Grab all known p2p packets\n"
27 " --edk [TCP&UDP] All known eDonkey/eMule/Overnet packets\n"
28 " --dc [TCP] All known Direct Connect packets\n"
29 " --kazaa [TCP&UDP] All known KaZaA packets\n"
30 " --gnu [TCP&UDP] All known Gnutella packets\n"
31 " --bit [TCP&UDP] All known BitTorrent packets\n"
32 " --apple [TCP] All known AppleJuice packets\n"
33 " --winmx [TCP] All known WinMX\n"
34 " --soul [TCP] All known SoulSeek\n"
35 " --ares [TCP] All known Ares\n\n"
36 " EXPERIMENTAL protocols (please send feedback to: ipp2p@ipp2p.org) :\n"
37 " --mute [TCP] All known Mute packets\n"
38 " --waste [TCP] All known Waste packets\n"
39 " --xdcc [TCP] All known XDCC packets (only xdcc login)\n\n"
40 " DEBUG SUPPPORT, use only if you know why\n"
41 " --debug Generate kernel debug output, THIS WILL SLOW DOWN THE FILTER\n"
42 "\nNote that the follwing options will have the same meaning:\n"
43 " '--ipp2p' is equal to '--edk --dc --kazaa --gnu --bit --apple --winmx --soul --ares'\n"
44 "\nIPP2P was intended for TCP only. Due to increasing usage of UDP we needed to change this.\n"
45 "You can now use -p udp to search UDP packets only or without -p switch to search UDP and TCP packets.\n"
46 "\nSee README included with this package for more details or visit http://www.ipp2p.org\n"
48 " iptables -A FORWARD -m ipp2p --ipp2p -j MARK --set-mark 0x01\n"
49 " iptables -A FORWARD -p udp -m ipp2p --kazaa --bit -j DROP\n"
50 " iptables -A FORWARD -p tcp -m ipp2p --edk --soul -j DROP\n\n"
54 static struct option opts
[] = {
55 { "ipp2p", 0, 0, '1' },
59 { "kazaa", 0, 0, 'a' },
61 { "apple", 0, 0, 'c' },
62 { "soul", 0, 0, 'd' },
63 { "winmx", 0, 0, 'e' },
64 { "ares", 0, 0, 'f' },
65 { "mute", 0, 0, 'g' },
66 { "waste", 0, 0, 'h' },
67 { "xdcc", 0, 0, 'i' },
68 { "debug", 0, 0, 'j' },
75 init(struct xt_entry_match
*m
)
77 init(struct ipt_entry_match
*m
, unsigned int *nfcache
)
80 struct ipt_p2p_info
*info
= (struct ipt_p2p_info
*)m
->data
;
83 *nfcache
|= NFC_UNKNOWN
;
86 /*init the module with default values*/
94 parse(int c
, char **argv
, int invert
, unsigned int *flags
,
96 const void *entry
, struct xt_entry_match
**match
)
98 const struct ipt_entry
*entry
, unsigned int *nfcache
, struct ipt_entry_match
**match
)
101 struct ipt_p2p_info
*info
= (struct ipt_p2p_info
*)(*match
)->data
;
104 case '1': /*cmd: ipp2p*/
105 if ((*flags
& SHORT_HAND_IPP2P
) == SHORT_HAND_IPP2P
)
106 exit_error(PARAMETER_PROBLEM
,
107 "ipp2p: `--ipp2p' may only be "
110 /* if ((*flags & SHORT_HAND_DATA) == SHORT_HAND_DATA)
111 exit_error(PARAMETER_PROBLEM,
112 "ipp2p: `--ipp2p-data' may only be "
117 exit_error(PARAMETER_PROBLEM
,
118 "ipp2p: `--ipp2p' may only be "
120 if (invert
) exit_error(PARAMETER_PROBLEM
, "ipp2p: invert [!] is not allowed!");
121 *flags
+= SHORT_HAND_IPP2P
;
125 case '2': /*cmd: edk*/
126 if ((*flags
& IPP2P_EDK
) == IPP2P_EDK
)
127 exit_error(PARAMETER_PROBLEM
,
128 "ipp2p: `--edk' may only be "
130 if ((*flags
& SHORT_HAND_IPP2P
) == SHORT_HAND_IPP2P
)
131 exit_error(PARAMETER_PROBLEM
,
132 "ipp2p: `--ipp2p' may only be "
134 /* if ((*flags & SHORT_HAND_DATA) == SHORT_HAND_DATA)
135 exit_error(PARAMETER_PROBLEM,
136 "ipp2p: `--ipp2p-data' may only be "
137 "specified alone!");*/
138 if ((*flags
& IPP2P_DATA_EDK
) == IPP2P_DATA_EDK
)
139 exit_error(PARAMETER_PROBLEM
,
140 "ipp2p: use `--edk' OR `--edk-data' but not both of them!");
141 if (invert
) exit_error(PARAMETER_PROBLEM
, "ipp2p: invert [!] is not allowed!");
147 case '7': /*cmd: dc*/
148 if ((*flags
& IPP2P_DC
) == IPP2P_DC
)
149 exit_error(PARAMETER_PROBLEM
,
150 "ipp2p: `--dc' may only be "
152 if ((*flags
& SHORT_HAND_IPP2P
) == SHORT_HAND_IPP2P
)
153 exit_error(PARAMETER_PROBLEM
,
154 "ipp2p: `--ipp2p' may only be "
156 /* if ((*flags & SHORT_HAND_DATA) == SHORT_HAND_DATA)
157 exit_error(PARAMETER_PROBLEM,
158 "ipp2p: `--ipp2p-data' may only be "
159 "specified alone!");*/
160 if ((*flags
& IPP2P_DATA_DC
) == IPP2P_DATA_DC
)
161 exit_error(PARAMETER_PROBLEM
,
162 "ipp2p: use `--dc' OR `--dc-data' but not both of them!");
163 if (invert
) exit_error(PARAMETER_PROBLEM
, "ipp2p: invert [!] is not allowed!");
169 case '9': /*cmd: gnu*/
170 if ((*flags
& IPP2P_GNU
) == IPP2P_GNU
)
171 exit_error(PARAMETER_PROBLEM
,
172 "ipp2p: `--gnu' may only be "
174 /* if ((*flags & SHORT_HAND_DATA) == SHORT_HAND_DATA)
175 exit_error(PARAMETER_PROBLEM,
176 "ipp2p: `--ipp2p-data' may only be "
177 "specified alone!");*/
178 if ((*flags
& SHORT_HAND_IPP2P
) == SHORT_HAND_IPP2P
)
179 exit_error(PARAMETER_PROBLEM
,
180 "ipp2p: `--ipp2p' may only be "
182 if ((*flags
& IPP2P_DATA_GNU
) == IPP2P_DATA_GNU
)
183 exit_error(PARAMETER_PROBLEM
,
184 "ipp2p: use `--gnu' OR `--gnu-data' but not both of them!");
185 if (invert
) exit_error(PARAMETER_PROBLEM
, "ipp2p: invert [!] is not allowed!");
190 case 'a': /*cmd: kazaa*/
191 if ((*flags
& IPP2P_KAZAA
) == IPP2P_KAZAA
)
192 exit_error(PARAMETER_PROBLEM
,
193 "ipp2p: `--kazaa' may only be "
195 /* if ((*flags & SHORT_HAND_DATA) == SHORT_HAND_DATA)
196 exit_error(PARAMETER_PROBLEM,
197 "ipp2p: `--ipp2p-data' may only be "
198 "specified alone!");*/
199 if ((*flags
& SHORT_HAND_IPP2P
) == SHORT_HAND_IPP2P
)
200 exit_error(PARAMETER_PROBLEM
,
201 "ipp2p: `--ipp2p' may only be "
203 if ((*flags
& IPP2P_DATA_KAZAA
) == IPP2P_DATA_KAZAA
)
204 exit_error(PARAMETER_PROBLEM
,
205 "ipp2p: use `--kazaa' OR `--kazaa-data' but not both of them!");
206 if (invert
) exit_error(PARAMETER_PROBLEM
, "ipp2p: invert [!] is not allowed!");
207 *flags
+= IPP2P_KAZAA
;
211 case 'b': /*cmd: bit*/
212 if ((*flags
& IPP2P_BIT
) == IPP2P_BIT
)
213 exit_error(PARAMETER_PROBLEM
,
214 "ipp2p: `--bit' may only be "
216 if ((*flags
& SHORT_HAND_IPP2P
) == SHORT_HAND_IPP2P
)
217 exit_error(PARAMETER_PROBLEM
,
218 "ipp2p: `--ipp2p' may only be "
220 if (invert
) exit_error(PARAMETER_PROBLEM
, "ipp2p: invert [!] is not allowed!");
225 case 'c': /*cmd: apple*/
226 if ((*flags
& IPP2P_APPLE
) == IPP2P_APPLE
)
227 exit_error(PARAMETER_PROBLEM
,
228 "ipp2p: `--apple' may only be "
230 if ((*flags
& SHORT_HAND_IPP2P
) == SHORT_HAND_IPP2P
)
231 exit_error(PARAMETER_PROBLEM
,
232 "ipp2p: `--ipp2p' may only be "
234 if (invert
) exit_error(PARAMETER_PROBLEM
, "ipp2p: invert [!] is not allowed!");
235 *flags
+= IPP2P_APPLE
;
240 case 'd': /*cmd: soul*/
241 if ((*flags
& IPP2P_SOUL
) == IPP2P_SOUL
)
242 exit_error(PARAMETER_PROBLEM
,
243 "ipp2p: `--soul' may only be "
245 if ((*flags
& SHORT_HAND_IPP2P
) == SHORT_HAND_IPP2P
)
246 exit_error(PARAMETER_PROBLEM
,
247 "ipp2p: `--ipp2p' may only be "
249 if (invert
) exit_error(PARAMETER_PROBLEM
, "ipp2p: invert [!] is not allowed!");
250 *flags
+= IPP2P_SOUL
;
255 case 'e': /*cmd: winmx*/
256 if ((*flags
& IPP2P_WINMX
) == IPP2P_WINMX
)
257 exit_error(PARAMETER_PROBLEM
,
258 "ipp2p: `--winmx' may only be "
260 if ((*flags
& SHORT_HAND_IPP2P
) == SHORT_HAND_IPP2P
)
261 exit_error(PARAMETER_PROBLEM
,
262 "ipp2p: `--ipp2p' may only be "
264 if (invert
) exit_error(PARAMETER_PROBLEM
, "ipp2p: invert [!] is not allowed!");
265 *flags
+= IPP2P_WINMX
;
269 case 'f': /*cmd: ares*/
270 if ((*flags
& IPP2P_ARES
) == IPP2P_ARES
)
271 exit_error(PARAMETER_PROBLEM
,
272 "ipp2p: `--ares' may only be "
274 if ((*flags
& SHORT_HAND_IPP2P
) == SHORT_HAND_IPP2P
)
275 exit_error(PARAMETER_PROBLEM
,
276 "ipp2p: `--ipp2p' may only be "
278 if (invert
) exit_error(PARAMETER_PROBLEM
, "ipp2p: invert [!] is not allowed!");
279 *flags
+= IPP2P_ARES
;
283 case 'g': /*cmd: mute*/
284 if ((*flags
& IPP2P_MUTE
) == IPP2P_MUTE
)
285 exit_error(PARAMETER_PROBLEM
,
286 "ipp2p: `--mute' may only be "
288 if (invert
) exit_error(PARAMETER_PROBLEM
, "ipp2p: invert [!] is not allowed!");
289 *flags
+= IPP2P_MUTE
;
292 case 'h': /*cmd: waste*/
293 if ((*flags
& IPP2P_WASTE
) == IPP2P_WASTE
)
294 exit_error(PARAMETER_PROBLEM
,
295 "ipp2p: `--waste' may only be "
297 if (invert
) exit_error(PARAMETER_PROBLEM
, "ipp2p: invert [!] is not allowed!");
298 *flags
+= IPP2P_WASTE
;
301 case 'i': /*cmd: xdcc*/
302 if ((*flags
& IPP2P_XDCC
) == IPP2P_XDCC
)
303 exit_error(PARAMETER_PROBLEM
,
304 "ipp2p: `--ares' may only be "
306 if (invert
) exit_error(PARAMETER_PROBLEM
, "ipp2p: invert [!] is not allowed!");
307 *flags
+= IPP2P_XDCC
;
311 case 'j': /*cmd: debug*/
312 if (invert
) exit_error(PARAMETER_PROBLEM
, "ipp2p: invert [!] is not allowed!");
317 // exit_error(PARAMETER_PROBLEM,
318 // "\nipp2p-parameter problem: for ipp2p usage type: iptables -m ipp2p --help\n");
326 final_check(unsigned int flags
)
329 exit_error(PARAMETER_PROBLEM
,
330 "\nipp2p-parameter problem: for ipp2p usage type: iptables -m ipp2p --help\n");
335 print(const void *ip
,
336 const struct xt_entry_match
*match
,
338 print(const struct ipt_ip
*ip
,
339 const struct ipt_entry_match
*match
,
343 struct ipt_p2p_info
*info
= (struct ipt_p2p_info
*)match
->data
;
345 printf("ipp2p v%s", IPP2P_VERSION
);
346 if ((info
->cmd
& SHORT_HAND_IPP2P
) == SHORT_HAND_IPP2P
) printf(" --ipp2p");
347 // if ((info->cmd & SHORT_HAND_DATA) == SHORT_HAND_DATA) printf(" --ipp2p-data");
348 if ((info
->cmd
& IPP2P_KAZAA
) == IPP2P_KAZAA
) printf(" --kazaa");
349 // if ((info->cmd & IPP2P_DATA_KAZAA) == IPP2P_DATA_KAZAA) printf(" --kazaa-data");
350 // if ((info->cmd & IPP2P_DATA_GNU) == IPP2P_DATA_GNU) printf(" --gnu-data");
351 if ((info
->cmd
& IPP2P_GNU
) == IPP2P_GNU
) printf(" --gnu");
352 if ((info
->cmd
& IPP2P_EDK
) == IPP2P_EDK
) printf(" --edk");
353 // if ((info->cmd & IPP2P_DATA_EDK) == IPP2P_DATA_EDK) printf(" --edk-data");
354 // if ((info->cmd & IPP2P_DATA_DC) == IPP2P_DATA_DC) printf(" --dc-data");
355 if ((info
->cmd
& IPP2P_DC
) == IPP2P_DC
) printf(" --dc");
356 if ((info
->cmd
& IPP2P_BIT
) == IPP2P_BIT
) printf(" --bit");
357 if ((info
->cmd
& IPP2P_APPLE
) == IPP2P_APPLE
) printf(" --apple");
358 if ((info
->cmd
& IPP2P_SOUL
) == IPP2P_SOUL
) printf(" --soul");
359 if ((info
->cmd
& IPP2P_WINMX
) == IPP2P_WINMX
) printf(" --winmx");
360 if ((info
->cmd
& IPP2P_ARES
) == IPP2P_ARES
) printf(" --ares");
361 if ((info
->cmd
& IPP2P_MUTE
) == IPP2P_MUTE
) printf(" --mute");
362 if ((info
->cmd
& IPP2P_WASTE
) == IPP2P_WASTE
) printf(" --waste");
363 if ((info
->cmd
& IPP2P_XDCC
) == IPP2P_XDCC
) printf(" --xdcc");
364 if (info
->debug
!= 0) printf(" --debug");
371 const struct xt_entry_match
*match
)
373 save(const struct ipt_ip
*ip
,
374 const struct ipt_entry_match
*match
)
377 struct ipt_p2p_info
*info
= (struct ipt_p2p_info
*)match
->data
;
379 if ((info
->cmd
& SHORT_HAND_IPP2P
) == SHORT_HAND_IPP2P
) printf("--ipp2p ");
380 // if ((info->cmd & SHORT_HAND_DATA) == SHORT_HAND_DATA) printf("--ipp2p-data ");
381 if ((info
->cmd
& IPP2P_KAZAA
) == IPP2P_KAZAA
) printf("--kazaa ");
382 // if ((info->cmd & IPP2P_DATA_KAZAA) == IPP2P_DATA_KAZAA) printf("--kazaa-data ");
383 // if ((info->cmd & IPP2P_DATA_GNU) == IPP2P_DATA_GNU) printf("--gnu-data ");
384 if ((info
->cmd
& IPP2P_GNU
) == IPP2P_GNU
) printf("--gnu ");
385 if ((info
->cmd
& IPP2P_EDK
) == IPP2P_EDK
) printf("--edk ");
386 // if ((info->cmd & IPP2P_DATA_EDK) == IPP2P_DATA_EDK) printf("--edk-data ");
387 // if ((info->cmd & IPP2P_DATA_DC) == IPP2P_DATA_DC) printf("--dc-data ");
388 if ((info
->cmd
& IPP2P_DC
) == IPP2P_DC
) printf("--dc ");
389 if ((info
->cmd
& IPP2P_BIT
) == IPP2P_BIT
) printf("--bit ");
390 if ((info
->cmd
& IPP2P_APPLE
) == IPP2P_APPLE
) printf("--apple ");
391 if ((info
->cmd
& IPP2P_SOUL
) == IPP2P_SOUL
) printf("--soul ");
392 if ((info
->cmd
& IPP2P_WINMX
) == IPP2P_WINMX
) printf("--winmx ");
393 if ((info
->cmd
& IPP2P_ARES
) == IPP2P_ARES
) printf("--ares ");
394 if ((info
->cmd
& IPP2P_MUTE
) == IPP2P_MUTE
) printf(" --mute");
395 if ((info
->cmd
& IPP2P_WASTE
) == IPP2P_WASTE
) printf(" --waste");
396 if ((info
->cmd
& IPP2P_XDCC
) == IPP2P_XDCC
) printf(" --xdcc");
397 if (info
->debug
!= 0) printf("--debug ");
402 struct xtables_match ipp2p
=
406 .version
= XTABLES_VERSION
,
407 .size
= IPT_ALIGN(sizeof(struct ipt_p2p_info
)),
408 .userspacesize
= IPT_ALIGN(sizeof(struct ipt_p2p_info
)),
412 .final_check
= &final_check
,
422 xtables_register_match(&ipp2p
);