1 #if defined(MODVERSIONS)
2 #include <linux/modversions.h>
4 #include <linux/module.h>
5 #include <linux/version.h>
6 #include <net/netfilter/nf_conntrack_core.h>
7 #if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,21)
8 # include <linux/netfilter/x_tables.h>
9 # define ipt_register_match xt_register_match
10 # define ipt_unregister_match xt_unregister_match
11 # define ipt_match xt_match
13 # include <linux/netfilter_ipv4/ip_tables.h>
14 //#include <linux/netfilter_ipv4/ipt_ipp2p.h>
15 #endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,21) */
17 #include <linux/netfilter_ipv4/ipt_ipp2p.h>
21 #define get_u8(X,O) (*(__u8 *)(X + O))
22 #define get_u16(X,O) (*(__u16 *)(X + O))
23 #define get_u32(X,O) (*(__u32 *)(X + O))
24 #define TOTAL_PACKETS conntrack->counters[IP_CT_DIR_ORIGINAL].packets + \
25 conntrack->counters[IP_CT_DIR_REPLY].packets
27 MODULE_AUTHOR("Lei Liu <liulei@syiae.edu.cn>");
28 MODULE_DESCRIPTION("An extension to iptables to identify P2P traffic. Base on ipp2p.org");
29 MODULE_LICENSE("GPL");
31 static int match_packets
= 15;
32 module_param(match_packets
, int, 0);
33 MODULE_PARM_DESC(match_packets
, "Numbers of packets for per conntrack to match");
35 /*Search for UDP eDonkey/eMule/Kad commands*/
37 udp_search_edk (unsigned char *t
, int packet_len
)
40 if(packet_len
== 4 && get_u32(t
,0) == __constant_htonl(0xff0a0000)) return (IPP2P_EDK
* 100 + 42);
41 if(packet_len
== 8 && get_u16(t
,0) == __constant_htons(0xff0a) && get_u16(t
,4) == __constant_htons(0x0c02)) return (IPP2P_EDK
* 100 + 47);
42 if(memcmp(t
+12,"POST / HTTP/1.1",15) == 0 && memcmp(t
+29,"Host: vagaa.com",15) == 0 && memcmp(t
+46,"VAGAA-OPERATION:",16) == 0) return (IPP2P_EDK
* 100 + 48);
45 { if ( get_u16(t
,3) == __constant_htons(0x0000) )
48 if(packet_len
== 22 && *(t
+1) == 0x11) return (IPP2P_EDK
* 100 + 40);
49 if(packet_len
== 32 && *(t
+1) == 0x00) return (IPP2P_EDK
* 100 + 41);
51 if(packet_len
== 26 && *(t
+1) == 0x15) return (IPP2P_EDK
* 100 + 43);
53 if(packet_len
== 27 && *(t
+1) == 0x16) return (IPP2P_EDK
* 100 + 44);
54 if(packet_len
== 6 && *(t
+1) == 0x01) return (IPP2P_EDK
* 100 + 45);
55 if(packet_len
== 144 && *(t
+1) == 0x8b) return (IPP2P_EDK
* 100 + 46);
63 /* client -> server status request */
65 if (packet_len
> 5) return ((IPP2P_EDK
* 100) + 50);
67 /* server -> client status request */
68 case 0x97: if (packet_len
> 33) return ((IPP2P_EDK
* 100) + 51);
70 /* server description request */
71 /* e3 2a ff f0 .. | size == 6 */
72 case 0xa2: if ( (packet_len
> 5) && ( get_u16(t
,2) == __constant_htons(0xfff0) ) ) return ((IPP2P_EDK
* 100) + 52);
74 /* server description response */
75 /* e3 a3 ff f0 .. | size > 40 && size < 200 */
76 //case 0xa3: return ((IPP2P_EDK * 100) + 53);
78 case 0x9a: if (packet_len
> 17) return ((IPP2P_EDK
* 100) + 54);
80 case 0x9b: if (packet_len
> 24) return ((IPP2P_EDK
* 100) + 56);
82 case 0x92: if (packet_len
> 9) return ((IPP2P_EDK
* 100) + 55);
91 case 0x01: if (packet_len
== 2) return ((IPP2P_EDK
* 100) + 70);
93 /* e4 19 .. Firewall Connection ACK */
94 case 0x19: if (packet_len
> 21 ) return ((IPP2P_EDK
* 100) + 71);
96 /* e4 20 .. | size == 43 */
97 case 0x20: if ((packet_len
> 33) && (*(t
+2) != 0x00) && (*(t
+33) != 0x00)) return ((IPP2P_EDK
* 100) + 60);
99 case 0x21: if ((packet_len
> 33) && (*(t
+2) != 0x00) && (*(t
+33) != 0x00)) return ((IPP2P_EDK
* 100) + 60);
101 /* e4 00 .. 00 | size == 35 ? */
102 case 0x00: if ((packet_len
> 26) && (*(t
+26) == 0x00)) return ((IPP2P_EDK
* 100) + 61);
104 /* e4 10 .. 00 | size == 35 ? Search Info */
105 case 0x10: if ((packet_len
> 26) && (*(t
+26) == 0x00)) return ((IPP2P_EDK
* 100) + 62);
107 /* e4 11 .. Search Result */
108 case 0x11: if ((packet_len
> 26) && (*(t
+26) == 0x00)) return ((IPP2P_EDK
* 100) + 62);
110 /* e4 18 .. 00 | size == 35 ? */
111 case 0x18: if ((packet_len
> 26) && (*(t
+26) == 0x00)) return ((IPP2P_EDK
* 100) + 63);
113 /* e4 52 .. | size = 44 */
114 case 0x52: if (packet_len
> 35 ) return ((IPP2P_EDK
* 100) + 64);
116 /* e4 58 .. | size == 6 */
117 case 0x58: if (packet_len
> 5 ) return ((IPP2P_EDK
* 100) + 65);
119 /* e4 59 .. | size == 2 */
120 case 0x59: if (packet_len
> 1 )return ((IPP2P_EDK
* 100) + 66);
122 /* e4 28 .. | packet_len == 52,77,102,127... */
123 case 0x28: if (((packet_len
-44) % 25) == 0) return ((IPP2P_EDK
* 100) + 67);
125 case 0x29: if (((packet_len
-44) % 25) == 0) return ((IPP2P_EDK
* 100) + 67);
127 /* e4 50 xx xx | size == 4 */
128 case 0x50: if (packet_len
> 3) return ((IPP2P_EDK
* 100) + 68);
130 /* e4 40 xx xx | size == 48 */
131 case 0x40: if (packet_len
> 47) return ((IPP2P_EDK
* 100) + 69);
136 } /* end of switch (*t) */
141 /*Search for UDP Gnutella commands*/
143 udp_search_gnu (unsigned char *t
, int packet_len
)
145 if (memcmp(t
, "GND", 3) == 0) return ((IPP2P_GNU
* 100) + 51);
146 if (memcmp(t
, "GNUTELLA ", 9) == 0) return ((IPP2P_GNU
* 100) + 52);
151 /*Search for UDP KaZaA commands*/
153 udp_search_kazaa (unsigned char *t
, int packet_len
)
155 if (*(t
+packet_len
-1) == 0x00){
156 if (memcmp((t
+packet_len
-6), "KaZaA", 5) == 0) return (IPP2P_KAZAA
* 100 +50);
160 }/*udp_search_kazaa*/
162 /*Search for UDP DirectConnect commands*/
164 udp_search_directconnect (unsigned char *t
, int packet_len
)
166 if ((*t
== 0x24) && (*(t
+packet_len
-1) == 0x7c)) {
167 if (memcmp(t
, "SR ", 3) == 0) return ((IPP2P_DC
* 100) + 60);
168 if (memcmp(t
, "Ping ", 5) == 0) return ((IPP2P_DC
* 100) + 61);
171 }/*udp_search_directconnect*/
175 /*Search for UDP BitTorrent commands*/
177 udp_search_bit (unsigned char *t
, int packet_len
)
182 /* ^ 00 00 04 17 27 10 19 80 */
183 if ((ntohl(get_u32(t
, 0)) == 0x00000417) && (ntohl(get_u32(t
, 4)) == 0x27101980))
184 return (IPP2P_BIT
* 100 + 50);
187 if (get_u32(t
, 8) == __constant_htonl(0x00000400) && get_u32(t
, 28) == __constant_htonl(0x00000104))
188 return (IPP2P_BIT
* 100 + 51);
189 if (get_u32(t
, 8) == __constant_htonl(0x00000400))
190 return (IPP2P_BIT
* 100 + 61);
193 if (get_u32(t
, 8) == __constant_htonl(0x00000404) && get_u32(t
, 28) == __constant_htonl(0x00000104))
194 return (IPP2P_BIT
* 100 + 52);
195 if (get_u32(t
, 8) == __constant_htonl(0x00000404))
196 return (IPP2P_BIT
* 100 + 62);
199 if (get_u32(t
, 8) == __constant_htonl(0x00000406) && get_u32(t
, 28) == __constant_htonl(0x00000104))
200 return (IPP2P_BIT
* 100 + 53);
201 if (get_u32(t
, 8) == __constant_htonl(0x00000406))
202 return (IPP2P_BIT
* 100 + 63);
205 if (get_u32(t
, 0) == __constant_htonl(0x00000405))
206 return (IPP2P_BIT
* 100 + 54);
209 if ((get_u32(t
, 0) == __constant_htonl(0x00000401)))
210 return (IPP2P_BIT
* 100 + 55);
213 if (get_u32(t
,0) == __constant_htonl(0x00000827) &&
214 get_u32(t
,4) == __constant_htonl(0x37502950))
215 return (IPP2P_BIT
* 100 + 80);
218 /* this packet does not have a constant size */
219 if (packet_len
>= 32 && get_u32(t
, 8) == __constant_htonl(0x00000402) && get_u32(t
, 28) == __constant_htonl(0x00000104))
220 return (IPP2P_BIT
* 100 + 56);
224 /* some extra-bitcomet rules:
225 * "d1:" [a|r] "d2:id20:"
227 if (packet_len
> 22 && get_u8(t
, 0) == 'd' && get_u8(t
, 1) == '1' && get_u8(t
, 2) == ':' )
229 if (get_u8(t
, 3) == 'a' || get_u8(t
, 3) == 'r')
231 if (memcmp(t
+4,"d2:id20:",8)==0)
232 return (IPP2P_BIT
* 100 + 57);
238 /* packetlen must be bigger than 40 */
239 /* first 4 bytes are zero */
240 if (packet_len
> 40 && get_u32(t
, 8) == 0x00000000)
242 /* first rule: 00 00 00 00 01 00 00 xx xx xx xx 00 00 00 00*/
243 if (get_u32(t
, 12) == 0x00000000 &&
244 get_u32(t
, 16) == 0x00010000 &&
245 get_u32(t
, 24) == 0x00000000 )
246 return (IPP2P_BIT
* 100 + 71);
248 /* 00 01 00 00 0d 00 00 xx xx xx xx 00 00 00 00*/
249 if (get_u32(t
, 12) == 0x00000001 &&
250 get_u32(t
, 16) == 0x000d0000 &&
251 get_u32(t
, 24) == 0x00000000 )
252 return (IPP2P_BIT
* 100 + 71);
263 /*Search for Ares commands*/
264 //#define IPP2P_DEBUG_ARES
266 search_ares (const unsigned char *payload
, const u16 plen
)
267 //int search_ares (unsigned char *haystack, int packet_len, int head_len)
269 // const unsigned char *t = haystack + head_len;
271 /* all ares packets start with */
272 if (*(payload
+1) == 0 && (plen
- *payload
) == 3)
274 switch (*(payload
+2))
278 if ( plen
== 6 && *(payload
+5) == 0x05 ) return ((IPP2P_ARES
* 100) + 1);
281 /* ares search, min 3 chars --> 14 bytes
282 * lets define a search can be up to 30 chars --> max 34 bytes
284 if ( plen
>= 14 && plen
<= 34 ) return ((IPP2P_ARES
* 100) + 1);
286 #ifdef IPP2P_DEBUG_ARES
288 printk(KERN_DEBUG
"Unknown Ares command %x recognized, len: %u \n", (unsigned int) *(payload
+2),plen
);
289 #endif /* IPP2P_DEBUG_ARES */
294 /* found connect packet: 03 00 5a 04 03 05 */
295 /* new version ares 1.8: 03 00 5a xx xx 05 */
296 if ((plen
) == 6){ /* possible connect command*/
297 if ((payload
[0] == 0x03) && (payload
[1] == 0x00) && (payload
[2] == 0x5a) && (payload
[5] == 0x05))
298 return ((IPP2P_ARES
* 100) + 1);
300 if ((plen
) == 60){ /* possible download command*/
301 if ((payload
[59] == 0x0a) && (payload
[58] == 0x0a)){
302 if (memcmp(t
, "PUSH SHA1:", 10) == 0) /* found download command */
303 return ((IPP2P_ARES
* 100) + 2);
311 /*Search for SoulSeek commands*/
313 search_soul (const unsigned char *payload
, const u16 plen
)
315 //#define IPP2P_DEBUG_SOUL
316 /* match: xx xx xx xx | xx = sizeof(payload) - 4 */
317 if (get_u32(payload
, 0) == (plen
- 4)){
318 const __u32 m
= get_u32(payload
, 4);
319 /* match 00 yy yy 00, yy can be everything */
320 if ( get_u8(payload
, 4) == 0x00 && get_u8(payload
, 7) == 0x00 )
322 #ifdef IPP2P_DEBUG_SOUL
323 printk(KERN_DEBUG
"0: Soulseek command 0x%x recognized\n",get_u32(payload
, 4));
324 #endif /* IPP2P_DEBUG_SOUL */
325 return ((IPP2P_SOUL
* 100) + 1);
328 /* next match: 01 yy 00 00 | yy can be everything */
329 if ( get_u8(payload
, 4) == 0x01 && get_u16(payload
, 6) == 0x0000 )
331 #ifdef IPP2P_DEBUG_SOUL
332 printk(KERN_DEBUG
"1: Soulseek command 0x%x recognized\n",get_u16(payload
, 4));
333 #endif /* IPP2P_DEBUG_SOUL */
334 return ((IPP2P_SOUL
* 100) + 2);
337 /* other soulseek commandos are: 1-5,7,9,13-18,22,23,26,28,35-37,40-46,50,51,60,62-69,91,92,1001 */
338 /* try to do this in an intelligent way */
339 /* get all small commandos */
354 #ifdef IPP2P_DEBUG_SOUL
355 printk(KERN_DEBUG
"2: Soulseek command 0x%x recognized\n",get_u16(payload
, 4));
356 #endif /* IPP2P_DEBUG_SOUL */
357 return ((IPP2P_SOUL
* 100) + 3);
362 #ifdef IPP2P_DEBUG_SOUL
363 printk(KERN_DEBUG
"3: Soulseek command 0x%x recognized\n",get_u16(payload
, 4));
364 #endif /* IPP2P_DEBUG_SOUL */
365 return ((IPP2P_SOUL
* 100) + 4);
367 if (m
> 12 && m
< 19 )
369 #ifdef IPP2P_DEBUG_SOUL
370 printk(KERN_DEBUG
"4: Soulseek command 0x%x recognized\n",get_u16(payload
, 4));
371 #endif /* IPP2P_DEBUG_SOUL */
372 return ((IPP2P_SOUL
* 100) + 5);
375 if (m
> 34 && m
< 38 )
377 #ifdef IPP2P_DEBUG_SOUL
378 printk(KERN_DEBUG
"5: Soulseek command 0x%x recognized\n",get_u16(payload
, 4));
379 #endif /* IPP2P_DEBUG_SOUL */
380 return ((IPP2P_SOUL
* 100) + 6);
383 if (m
> 39 && m
< 47 )
385 #ifdef IPP2P_DEBUG_SOUL
386 printk(KERN_DEBUG
"6: Soulseek command 0x%x recognized\n",get_u16(payload
, 4));
387 #endif /* IPP2P_DEBUG_SOUL */
388 return ((IPP2P_SOUL
* 100) + 7);
391 if (m
> 61 && m
< 70 )
393 #ifdef IPP2P_DEBUG_SOUL
394 printk(KERN_DEBUG
"7: Soulseek command 0x%x recognized\n",get_u16(payload
, 4));
395 #endif /* IPP2P_DEBUG_SOUL */
396 return ((IPP2P_SOUL
* 100) + 8);
399 #ifdef IPP2P_DEBUG_SOUL
400 printk(KERN_DEBUG
"unknown SOULSEEK command: 0x%x, first 16 bit: 0x%x, first 8 bit: 0x%x ,soulseek ???\n",get_u32(payload
, 4),get_u16(payload
, 4) >> 16,get_u8(payload
, 4) >> 24);
401 #endif /* IPP2P_DEBUG_SOUL */
404 /* match 14 00 00 00 01 yy 00 00 00 STRING(YY) 01 00 00 00 00 46|50 00 00 00 00 */
405 /* without size at the beginning !!! */
406 if ( get_u32(payload
, 0) == 0x14 && get_u8(payload
, 4) == 0x01 )
408 __u32 y
= get_u32(payload
, 5);
409 /* we need 19 chars + string */
410 if ( (y
+ 19) <= (plen
) )
412 const unsigned char *w
=payload
+9+y
;
413 if (get_u32(w
, 0) == 0x01 && ( get_u16(w
, 4) == 0x4600 || get_u16(w
, 4) == 0x5000) && get_u32(w
, 6) == 0x00);
414 #ifdef IPP2P_DEBUG_SOUL
415 printk(KERN_DEBUG
"Soulssek special client command recognized\n");
416 #endif /* IPP2P_DEBUG_SOUL */
417 return ((IPP2P_SOUL
* 100) + 9);
424 /*Search for WinMX commands*/
426 search_winmx (const unsigned char *payload
, const u16 plen
)
428 //#define IPP2P_DEBUG_WINMX
429 if ((plen
== 4) && (memcmp(payload
, "SEND", 4) == 0)) return ((IPP2P_WINMX
* 100) + 1);
430 if ((plen
== 3) && (memcmp(payload
, "GET", 3) == 0)) return ((IPP2P_WINMX
* 100) + 2);
431 //if (packet_len < (head_len + 10)) return 0;
432 if (plen
< 10) return 0;
434 if ((memcmp(payload
, "SEND", 4) == 0) || (memcmp(payload
, "GET", 3) == 0)){
436 const u16 end
= plen
-2;
440 if (*(payload
+c
)== 0x20 && *(payload
+c
+1) == 0x22)
444 if (count
>= 2) return ((IPP2P_WINMX
* 100) + 3);
450 if ( plen
== 149 && *payload
== '8' )
452 #ifdef IPP2P_DEBUG_WINMX
453 printk(KERN_INFO
"maybe WinMX\n");
455 if (get_u32(payload
,17) == 0 && get_u32(payload
,21) == 0 && get_u32(payload
,25) == 0 &&
456 // get_u32(payload,33) == __constant_htonl(0x71182b1a) && get_u32(payload,37) == __constant_htonl(0x05050000) &&
457 // get_u32(payload,133) == __constant_htonl(0x31097edf) && get_u32(payload,145) == __constant_htonl(0xdcb8f792))
458 get_u16(payload
,39) == 0 && get_u16(payload
,135) == __constant_htons(0x7edf) && get_u16(payload
,147) == __constant_htons(0xf792))
461 #ifdef IPP2P_DEBUG_WINMX
462 printk(KERN_INFO
"got WinMX\n");
464 return ((IPP2P_WINMX
* 100) + 4);
471 /*Search for appleJuice commands*/
473 search_apple (const unsigned char *payload
, const u16 plen
)
475 if ( (plen
> 7) && get_u16(payload
,6) == __constant_htons(0x0d0a) && (memcmp(payload
, "ajprot", 6) == 0)) return (IPP2P_APPLE
* 100);
481 /*Search for BitTorrent commands*/
483 search_bittorrent (const unsigned char *payload
, const u16 plen
)
487 /* test for match 0x13+"BitTorrent protocol" */
488 if (*payload
== 0x13)
490 if (memcmp(payload
+1, "BitTorrent protocol", 19) == 0) return (IPP2P_BIT
* 100);
493 /* get tracker commandos, all starts with GET /
494 * then it can follow: scrape| announce
495 * and then ?hash_info=
497 if (memcmp(payload
,"GET /",5) == 0)
500 if ( memcmp(payload
+5,"scrape?info_hash=",17)==0 ) return (IPP2P_BIT
* 100 + 1);
501 /* message announce */
502 if ( memcmp(payload
+5,"announce",8)==0 ) return (IPP2P_BIT
* 100 + 2);
503 if ( memcmp(payload
+5,"?info_hash=",11)==0 ) return (IPP2P_BIT
* 100 + 3);
504 if ( memcmp(payload
+5,"data?fid=",9)==0 ) return (IPP2P_BIT
* 100 + 5);
509 /* bitcomet encryptes the first packet, so we have to detect another
510 * one later in the flow */
511 /* first try failed, too many missdetections */
512 //if ( size == 5 && get_u32(t,0) == __constant_htonl(1) && t[4] < 3) return (IPP2P_BIT * 100 + 3);
514 /* second try: block request packets */
515 if ( plen
== 17 && get_u32(payload
,0) == __constant_htonl(0x0d) && *(payload
+4) == 0x06 && get_u32(payload
,13) == __constant_htonl(0x4000) ) return (IPP2P_BIT
* 100 + 4);
521 /* check for xunlei */
523 search_xunlei (const unsigned char *payload
, const u16 plen
)
525 if ( memcmp(payload
,"POST / HTTP/1.1",15) ==0 )
527 unsigned char *t
= strstr((payload
+93), "Connection: Keep-Alive"); //min length of Connection
531 if ( (*t
< 0x40) && (*(t
+1) == 0x00) && get_u16(t
,2) == __constant_htons(0x0000) && get_u16(t
,5) == __constant_htons(0x0000) && (*(t
+7) == 0x00) && (*(t
+8) == (payload
+plen
-t
-12)) ) return (IPP2P_XUNLEI
*100 + 1);
537 if ( get_u16(payload
,0) == __constant_htons(0x0200) && ( *(payload
+3) == 0x01 || *(payload
+3) == 0x00 ) && *(payload
+5) == 0x00 && ( *(payload
+6) == 0x01 || *(payload
+6) == 0x77 ) && get_u16(payload
,21) == __constant_htons(0x0038) ) return (IPP2P_XUNLEI
*100 + 2);
543 udp_search_xunlei (unsigned char *t
, int packet_len
)
546 if (packet_len
== 24 && get_u32(t
,0) == __constant_htonl(0x01000101) && get_u32(t
,4) == __constant_htonl(0xfefffeff) && get_u32(t
,8) == __constant_htonl(0x00)) return (IPP2P_XUNLEI
* 100 + 11);
547 if (packet_len
== 38 && get_u32(t
,0) == __constant_htonl(0x010011a0) && get_u32(t
,4) == __constant_htonl(0xfefffeff) && get_u32(t
,8) == __constant_htonl(0x00)) return (IPP2P_XUNLEI
* 100 + 12);
550 /* check for PPLive & PPStream */
552 search_pp (const unsigned char *payload
, const u16 plen
)
555 if ( memcmp(payload
,"GET /zh-cn/xml/default.xml",26)==0 ) return (IPP2P_PP
*100 + 1 );
556 /* message PPStream */
557 if ( memcmp(payload
,"PSProtocol",10)==0 ) return (IPP2P_PP
* 100 + 2);
559 if (get_u16(payload
,0) == __constant_htons(0xe903) && get_u32(payload
,4) == __constant_htonl(0x98ab0102)) return (IPP2P_PP
* 100 + 3);
560 if (get_u16(payload
,4) == __constant_htons(0xe903) && get_u32(payload
,8) == __constant_htonl(0x98ab0102)) return (IPP2P_PP
* 100 + 4);
562 if (((*payload
+ *(payload
+1) * 256) == (plen
-4) || ((*payload
+ *(payload
+1) * 256) < (plen
-4) && *payload
+ *(payload
+1) * 256 + *(payload
+ *payload
+ *(payload
+1) * 256 + 4) + *(payload
+ *payload
+ *(payload
+1) * 256 + 5) * 256 + 8 == plen
)) && get_u16(payload
,2) == __constant_htons(0x0000)) {
563 if (*(payload
+18) == 0x68 && *(payload
+20) == 0x74 && *(payload
+22) == 0x74 && *(payload
+24) == 0x70 && *(payload
+26)==0x3a && *(payload
+28) == 0x2f && *(payload
+30) == 0x2f) return 0;
564 return (IPP2P_PP
* 100 + 5);
567 if ( (plen
< 150) && (*payload
== 0xfe) && (*(payload
+1) == *(payload
+4)) && get_u16(payload
,2) == __constant_htons(0x0000) ) return (IPP2P_PP
* 100 + 6);
569 if ( (plen
== 4 && get_u32(payload
,0) == __constant_htonl(0x291c3201)) || (plen
== 61 && get_u32(payload
,0) == __constant_htonl(0x291c3201) && get_u32(payload
,4) == __constant_htonl(0x39000000))) return (IPP2P_PP
* 100 + 7);
571 if ( (*payload
+ *(payload
+1)*256) == plen
&& get_u16(payload
,2) == __constant_htons(0x0000) && (*(payload
+4) + *(payload
+5)) == (plen
- 13) && get_u16(payload
,6) == __constant_htons(0x0000)) return (IPP2P_PP
* 100 + 8);
573 if(memcmp((payload
+ 1),"QVOD protocol",13) == 0) return (IPP2P_PP
* 100 + 9);
577 /* check for PPLive & PPStream UDP pkg */
579 udp_search_pp (unsigned char *t
, int packet_len
)
581 if (get_u16(t
,0) == __constant_htons(0xe903) && get_u32(t
,4) == __constant_htonl(0x98ab0102)) return (IPP2P_PP
* 100 + 11);
582 if ( (memcmp(t
+8,"[bsinfo]",8) ==0) && (*(t
+16) == 0x0d) && (*(t
+17) == 0x0a) && (memcmp(t
+18,"mf=",3) ==0) ) return (IPP2P_PP
* 100 + 12);
583 if ( (packet_len
== 22 || packet_len
== 8) && get_u16(t
,0) == __constant_htons(0x0909) && (*(t
+2) == 0x08 || *(t
+2) == 0x09) && ((*(t
+3) == 0x00) || (*(t
+3) == 0x01)) ) return (IPP2P_PP
* 100 + 13);
584 if ( packet_len
== (*t
+4) && get_u32(t
,1) == __constant_htonl(0x00430000)) return (IPP2P_PP
* 100 + 15 );
586 if ( (packet_len
< 150) && (*t
== 0xfe) && (*(t
+1) == *(t
+4)) && get_u16(t
,2) == __constant_htons(0x0000) ) return (IPP2P_PP
* 100 + 14);
588 if ( (packet_len
== 112 || packet_len
== 116) && get_u32(t
,0) == __constant_htonl(0x1c1c3201) && (get_u16(t
,4) == __constant_htons(0x0b00) || get_u16(t
,4) == __constant_htons(0x0c00))) return (IPP2P_PP
* 100 + 16);
590 if (packet_len
== 6 && get_u16(t
,0) == __constant_htons(0x8095) && (get_u16(t
,2) == __constant_htons(0x0462) || get_u16(t
,2) == __constant_htons(0x0565)) ) return (IPP2P_PP
* 100 + 17);
591 if (packet_len
== 22 && get_u16(t
,0) == __constant_htons(0x8094) && (get_u16(t
,2) == __constant_htons(0x0429) || get_u16(t
,4) == __constant_htons(0x0429)) ) return (IPP2P_PP
* 100 + 18);
593 if (packet_len
== ntohl(get_u32(t
,0)) && memcmp((t
+ 14),"QVOD protocol",13) == 0) return (IPP2P_PP
* 100 + 19);
597 /*check for gnutella get commands and other typical data*/
599 search_all_gnu (const unsigned char *payload
, const u16 plen
)
602 if (get_u16(payload
,(plen
-2)) == __constant_htons(0x0d0a))
605 if (memcmp(payload
, "GNUTELLA CONNECT/", 17) == 0) return ((IPP2P_GNU
* 100) + 1);
606 if (memcmp(payload
, "GNUTELLA/", 9) == 0) return ((IPP2P_GNU
* 100) + 2);
609 if ((memcmp(payload
, "GET /get/", 9) == 0) || (memcmp(payload
, "GET /uri-res/", 13) == 0))
612 const u16 end
= plen
-22;
614 if ( get_u16(payload
,c
) == __constant_htons(0x0a0d) && ((memcmp((payload
+c
+2), "X-Gnutella-", 11) == 0) || (memcmp((payload
+c
+2), "X-Queue:", 8) == 0)))
615 return ((IPP2P_GNU
* 100) + 3);
623 /*check for KaZaA download commands and other typical data*/
625 search_all_kazaa (const unsigned char *payload
, const u16 plen
)
627 if (get_u16(payload
,(plen
-2)) == __constant_htons(0x0d0a))
630 if (memcmp(payload
, "GIVE ", 5) == 0) return ((IPP2P_KAZAA
* 100) + 1);
632 if (memcmp(payload
, "GET /", 5) == 0) {
634 const u16 end
=plen
-22;
636 if ( get_u16(payload
,c
) == __constant_htons(0x0a0d) && ((memcmp((payload
+c
+2), "X-Kazaa-Username: ", 18) == 0) || (memcmp((payload
+c
+2), "User-Agent: PeerEnabler/", 24) == 0)))
637 return ((IPP2P_KAZAA
* 100) + 2);
645 /*intensive but slower search for some edonkey packets including size-check*/
647 search_all_edk (const unsigned char *payload
, const u16 plen
)
649 if (memcmp(payload
, "POST / HTTP/1.1", 15) == 0 && memcmp(payload
+17, "Host: vagaa.com", 15) == 0 && memcmp(payload
+34, "VAGAA-OPERATION: ", 17) == 0) return (IPP2P_EDK
* 100 + 10);
650 if (*payload
!= 0xe3)
654 const u16 cmd
= get_u16(payload
, 1);
655 if (cmd
== (plen
- 5)) {
656 switch (*(payload
+5)) {
657 case 0x01: return ((IPP2P_EDK
* 100) + 1); /*Client: hello or Server:hello*/
659 case 0x47: return ((IPP2P_EDK
* 100) + 2); /*fast check for edonkey file segment transfer command*/
661 case 0x4c: return ((IPP2P_EDK
* 100) + 9); /*Client: Hello-Answer*/
669 /*intensive but slower check for all direct connect packets*/
671 search_all_dc (const unsigned char *payload
, const u16 plen
)
673 // unsigned char *t = haystack;
675 if (*payload
== 0x24 && *(payload
+plen
-1) == 0x7c)
677 const unsigned char *t
= payload
+1;
678 /* Client-Hub-Protocol */
679 if (memcmp(t
, "Lock ", 5) == 0) return ((IPP2P_DC
* 100) + 1);
680 /*fast check for Direct Connect send command*/
681 if (memcmp(t
, "Send|", 5) == 0) return ((IPP2P_DC
* 100) + 5);
682 /* Client-Client-Protocol, some are already recognized by client-hub (like lock) */
683 if (memcmp(t
, "MyNick ", 7) == 0) return ((IPP2P_DC
* 100) + 38);
690 search_mute (const unsigned char *payload
, const u16 plen
)
692 if ( plen
== 209 || plen
== 345 || plen
== 473 || plen
== 609 || plen
== 1121 )
694 //printk(KERN_DEBUG "size hit: %u",size);
695 if (memcmp(payload
,"PublicKey: ",11) == 0 )
697 return ((IPP2P_MUTE
* 100) + 0);
699 /* if (memcmp(t+size-14,"\x0aEndPublicKey\x0a",14) == 0)
701 printk(KERN_DEBUG "end pubic key hit: %u",size);
712 search_xdcc (const unsigned char *payload
, const u16 plen
)
714 /* search in small packets only */
715 if (plen
> 20 && plen
< 200 && get_u16(payload
,(plen
-2)) == __constant_htons(0x0d0a) && memcmp(payload
,"PRIVMSG ",8) == 0)
719 const u16 end
= plen
- 13;
721 /* is seems to be a irc private massage, chedck for xdcc command */
724 if (*(payload
+x
) == ':')
726 if ( memcmp((payload
+x
+1),"xdcc send #",11) == 0 )
727 return ((IPP2P_XDCC
* 100) + 0);
735 /* search for waste */
736 int search_waste(const unsigned char *payload
, const u16 plen
)
738 if ( plen
>= 8 && memcmp(payload
,"GET.sha1:",9) == 0)
739 return ((IPP2P_WASTE
* 100) + 0);
747 __u8 short_hand
; /*for fucntions included in short hands*/
749 int (*function_name
) (const unsigned char *, const u16
);
751 {IPP2P_EDK
,SHORT_HAND_IPP2P
,20, &search_all_edk
},
752 {IPP2P_DC
,SHORT_HAND_IPP2P
,5, &search_all_dc
},
753 {IPP2P_GNU
,SHORT_HAND_IPP2P
,5, &search_all_gnu
},
754 {IPP2P_KAZAA
,SHORT_HAND_IPP2P
,5, &search_all_kazaa
},
755 {IPP2P_BIT
,SHORT_HAND_IPP2P
,20, &search_bittorrent
},
756 {IPP2P_PP
,SHORT_HAND_IPP2P
,3, &search_pp
},
757 {IPP2P_APPLE
,SHORT_HAND_IPP2P
,5, &search_apple
},
758 {IPP2P_SOUL
,SHORT_HAND_IPP2P
,5, &search_soul
},
759 {IPP2P_WINMX
,SHORT_HAND_IPP2P
,2, &search_winmx
},
760 {IPP2P_ARES
,SHORT_HAND_IPP2P
,5, &search_ares
},
761 {IPP2P_MUTE
,SHORT_HAND_NONE
,200, &search_mute
},
762 {IPP2P_WASTE
,SHORT_HAND_NONE
,5, &search_waste
},
763 {IPP2P_XDCC
,SHORT_HAND_NONE
,5, &search_xdcc
},
764 {IPP2P_XUNLEI
,SHORT_HAND_NONE
,100,&search_xunlei
},
771 __u8 short_hand
; /*for fucntions included in short hands*/
773 int (*function_name
) (unsigned char *, int);
775 {IPP2P_KAZAA
,SHORT_HAND_IPP2P
,6, &udp_search_kazaa
},
776 {IPP2P_BIT
,SHORT_HAND_IPP2P
,15, &udp_search_bit
},
777 {IPP2P_PP
,SHORT_HAND_IPP2P
,3, &udp_search_pp
},
778 {IPP2P_GNU
,SHORT_HAND_IPP2P
,3, &udp_search_gnu
},
779 {IPP2P_EDK
,SHORT_HAND_IPP2P
,1, &udp_search_edk
},
780 {IPP2P_DC
,SHORT_HAND_IPP2P
,4, &udp_search_directconnect
},
781 {IPP2P_XUNLEI
,SHORT_HAND_NONE
,5,&udp_search_xunlei
},
785 #if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,23)
790 match(const struct sk_buff
*skb
,
791 const struct net_device
*in
,
792 const struct net_device
*out
,
793 #if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,17)
794 const struct xt_match
*mymatch
,
795 const void *matchinfo
,
797 unsigned int myprotoff
,
799 const void *matchinfo
,
803 #if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,0)
807 #if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,23)
813 const struct ipt_p2p_info
*info
= matchinfo
;
814 unsigned char *haystack
;
815 enum ip_conntrack_info ctinfo
;
816 struct nf_conn
*conntrack
;
817 #if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,22)
818 struct iphdr
*ip
= ip_hdr(skb
);
820 struct iphdr
*ip
= skb
->nh
.iph
;
822 int p2p_result
= 0, i
= 0;
824 int hlen
= ntohs(ip
->tot_len
)-(ip
->ihl
*4); /*hlen = packet-data length*/
826 /*must not be a fragment*/
828 if (info
->debug
) printk("IPP2P.match: offset found %i \n",offset
);
831 /*make sure that skb is linear*/
832 if(skb_is_nonlinear(skb
)){
833 if (info
->debug
) printk("IPP2P.match: nonlinear skb found\n");
836 if(!(conntrack
= nf_ct_get(skb
, &ctinfo
))) {
837 if (info
->debug
) printk("IPP2P.match: couldn't get conntrack\n");
841 if(TOTAL_PACKETS
== 1)
842 conntrack
->ipp2p
= 0;
845 return conntrack
->ipp2p
;
847 if((TOTAL_PACKETS
> match_packets
) && !conntrack
->ipp2p
)
851 // printk("IPP2P: conntrack %d packets\n",TOTAL_PACKETS);
852 haystack
=(char *)ip
+(ip
->ihl
*4); /*haystack = packet data*/
853 switch (ip
->protocol
){
854 case IPPROTO_TCP
: /*what to do with a TCP packet*/
856 struct tcphdr
*tcph
= (void *) ip
+ ip
->ihl
* 4;
858 if (tcph
->fin
) return 0; /*if FIN bit is set bail out*/
859 if (tcph
->syn
) return 0; /*if SYN bit is set bail out*/
860 if (tcph
->rst
) return 0; /*if RST bit is set bail out*/
862 haystack
+= tcph
->doff
* 4; /*get TCP-Header-Size*/
863 hlen
-= tcph
->doff
* 4;
864 while (matchlist
[i
].command
) {
865 if ((((info
->cmd
& matchlist
[i
].command
) == matchlist
[i
].command
) ||
866 ((info
->cmd
& matchlist
[i
].short_hand
) == matchlist
[i
].short_hand
)) &&
867 (hlen
> matchlist
[i
].packet_len
)) {
868 p2p_result
= matchlist
[i
].function_name(haystack
, hlen
);
871 if (info
->debug
) printk("IPP2P.debug:TCP-match: %i from: %u.%u.%u.%u:%i to: %u.%u.%u.%u:%i Length: %i\n",
872 p2p_result
, NIPQUAD(ip
->saddr
),ntohs(tcph
->source
), NIPQUAD(ip
->daddr
),ntohs(tcph
->dest
),hlen
);
878 conntrack
->ipp2p
= p2p_result
;
882 case IPPROTO_UDP
: /*what to do with an UDP packet*/
884 struct udphdr
*udph
= (void *) ip
+ ip
->ihl
* 4;
887 while (udp_list
[i
].command
){
888 if ((((info
->cmd
& udp_list
[i
].command
) == udp_list
[i
].command
) ||
889 ((info
->cmd
& udp_list
[i
].short_hand
) == udp_list
[i
].short_hand
)) &&
890 (hlen
> udp_list
[i
].packet_len
)) {
891 p2p_result
= udp_list
[i
].function_name(haystack
, hlen
);
893 if (info
->debug
) printk("IPP2P.debug:UDP-match: %i from: %u.%u.%u.%u:%i to: %u.%u.%u.%u:%i Length: %i\n",
894 p2p_result
, NIPQUAD(ip
->saddr
),ntohs(udph
->source
), NIPQUAD(ip
->daddr
),ntohs(udph
->dest
),hlen
);
900 conntrack
->ipp2p
= p2p_result
;
909 #if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,23)
914 checkentry(const char *tablename
,
915 #if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,17)
917 const struct xt_match
*mymatch
,
919 const struct ipt_ip
*ip
,
922 #if LINUX_VERSION_CODE <= KERNEL_VERSION(2,6,18)
923 unsigned int matchsize
,
925 unsigned int hook_mask
)
927 /* Must specify -p tcp */
928 /* if (ip->proto != IPPROTO_TCP || (ip->invflags & IPT_INV_PROTO)) {
929 * printk("ipp2p: Only works on TCP packets, use -p tcp\n");
936 static struct ipt_match ipp2p_match
= {
937 #if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,0)
944 #elif LINUX_VERSION_CODE < KERNEL_VERSION(2,6,17)
947 .checkentry
= &checkentry
,
949 #else /* LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,17) */
953 .matchsize
= XT_ALIGN(sizeof(struct ipt_p2p_info
)),
954 .checkentry
= &checkentry
,
960 static int __init
init(void)
963 printk(KERN_INFO
"IPP2P v%s loading, with %d packets to match\n", IPP2P_VERSION
, match_packets
);
964 return ipt_register_match(&ipp2p_match
);
967 static void __exit
fini(void)
969 ipt_unregister_match(&ipp2p_match
);
970 printk(KERN_INFO
"IPP2P v%s unloaded\n", IPP2P_VERSION
);