release/src-rt/linux/linux-2.6/net/ipv4/netfilter/ipt_ipp2p.c

   1 #if defined(MODVERSIONS)
   2 #include <linux/modversions.h>
   3 #endif
   4 #include <linux/module.h>
   5 #include <linux/version.h>
   6 #include <net/netfilter/nf_conntrack_core.h>
   7 #if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,21)
   8 #       include <linux/netfilter/x_tables.h>
   9 #       define ipt_register_match xt_register_match
  10 #       define ipt_unregister_match xt_unregister_match
  11 #       define ipt_match xt_match
  12 #else
  13 #       include <linux/netfilter_ipv4/ip_tables.h>
  14 //#include <linux/netfilter_ipv4/ipt_ipp2p.h>
  15 #endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,21) */
  16
  17 #include <linux/netfilter_ipv4/ipt_ipp2p.h>
  18 #include <net/tcp.h>
  19 #include <net/udp.h>
  20
  21 #define get_u8(X,O)  (*(__u8 *)(X + O))
  22 #define get_u16(X,O)  (*(__u16 *)(X + O))
  23 #define get_u32(X,O)  (*(__u32 *)(X + O))
  24 #define TOTAL_PACKETS conntrack->counters[IP_CT_DIR_ORIGINAL].packets + \
  25                       conntrack->counters[IP_CT_DIR_REPLY].packets
  26
  27 MODULE_AUTHOR("Lei Liu <liulei@syiae.edu.cn>");
  28 MODULE_DESCRIPTION("An extension to iptables to identify P2P traffic. Base on ipp2p.org");
  29 MODULE_LICENSE("GPL");
  30
  31 static int match_packets = 15;
  32 module_param(match_packets, int, 0);
  33 MODULE_PARM_DESC(match_packets, "Numbers of packets for per conntrack to match");
  34
  35 /*Search for UDP eDonkey/eMule/Kad commands*/
  36 int
  37 udp_search_edk (unsigned char *t, int packet_len)
  38 {
  39         /* Vagaa */
  40         if(packet_len == 4 && get_u32(t,0) == __constant_htonl(0xff0a0000)) return (IPP2P_EDK * 100 + 42);
  41         if(packet_len == 8 && get_u16(t,0) == __constant_htons(0xff0a) && get_u16(t,4) == __constant_htons(0x0c02)) return (IPP2P_EDK * 100 + 47);
  42         if(memcmp(t+12,"POST / HTTP/1.1",15) == 0 && memcmp(t+29,"Host: vagaa.com",15) == 0 && memcmp(t+46,"VAGAA-OPERATION:",16) == 0) return (IPP2P_EDK * 100 + 48);
  43         switch (*t) {
  44                 case 0xf1:
  45                 {       if ( get_u16(t,3) == __constant_htons(0x0000) )
  46                         {
  47                                 /* Search Result */
  48                                 if(packet_len == 22 && *(t+1) == 0x11) return (IPP2P_EDK * 100 + 40);
  49                                 if(packet_len == 32 && *(t+1) == 0x00) return (IPP2P_EDK * 100 + 41);
  50                                 /* Identify Reply */
  51                                 if(packet_len == 26 && *(t+1) == 0x15) return (IPP2P_EDK * 100 + 43);
  52                                 /* Identify Ack */
  53                                 if(packet_len == 27 && *(t+1) == 0x16) return (IPP2P_EDK * 100 + 44);
  54                                 if(packet_len == 6 && *(t+1) == 0x01) return (IPP2P_EDK * 100 + 45);
  55                                 if(packet_len == 144 && *(t+1) == 0x8b) return (IPP2P_EDK * 100 + 46);
  56                         }
  57                         break;
  58                 }
  59                 case 0xe3:
  60                 {       /*edonkey*/
  61                         switch (*(t+1))
  62                         {
  63                                 /* client -> server status request */
  64                                 case 0x96:
  65                                         if (packet_len > 5) return ((IPP2P_EDK * 100) + 50);
  66                                         break;
  67                                 /* server -> client status request */
  68                                 case 0x97: if (packet_len > 33) return ((IPP2P_EDK * 100) + 51);
  69                                         break;
  70                                                 /* server description request */
  71                                                 /* e3 2a ff f0 .. | size == 6 */
  72                                 case 0xa2: if ( (packet_len > 5) && ( get_u16(t,2) == __constant_htons(0xfff0) ) ) return ((IPP2P_EDK * 100) + 52);
  73                                         break;
  74                                                 /* server description response */
  75                                                 /* e3 a3 ff f0 ..  | size > 40 && size < 200 */
  76                                 //case 0xa3: return ((IPP2P_EDK * 100) + 53);
  77                                 //      break;
  78                                 case 0x9a: if (packet_len > 17) return ((IPP2P_EDK * 100) + 54);
  79                                         break;
  80                                 case 0x9b: if (packet_len > 24) return ((IPP2P_EDK * 100) + 56);
  81                                         break;
  82                                 case 0x92: if (packet_len > 9) return ((IPP2P_EDK * 100) + 55);
  83                                         break;
  84                         }
  85                         break;
  86                 }
  87                 case 0xe4:
  88                 {
  89                         switch (*(t+1))
  90                         {
  91                                 case 0x01: if (packet_len == 2) return ((IPP2P_EDK * 100) + 70);
  92                                         break;
  93                                         /* e4 19 .. Firewall Connection ACK */
  94                                 case 0x19: if (packet_len > 21 ) return ((IPP2P_EDK * 100) + 71);
  95                                         break;
  96                                         /* e4 20 .. | size == 43 */
  97                                 case 0x20: if ((packet_len > 33) && (*(t+2) != 0x00) && (*(t+33) != 0x00)) return ((IPP2P_EDK * 100) + 60);
  98                                         break;
  99                                 case 0x21: if ((packet_len > 33) && (*(t+2) != 0x00) && (*(t+33) != 0x00)) return ((IPP2P_EDK * 100) + 60);
 100                                         break;
 101                                         /* e4 00 .. 00 | size == 35 ? */
 102                                 case 0x00: if ((packet_len > 26) && (*(t+26) == 0x00)) return ((IPP2P_EDK * 100) + 61);
 103                                         break;
 104                                         /* e4 10 .. 00 | size == 35 ? Search Info */
 105                                 case 0x10: if ((packet_len > 26) && (*(t+26) == 0x00)) return ((IPP2P_EDK * 100) + 62);
 106                                         break;
 107                                         /* e4 11 .. Search Result */
 108                                 case 0x11: if ((packet_len > 26) && (*(t+26) == 0x00)) return ((IPP2P_EDK * 100) + 62);
 109                                         break;
 110                                         /* e4 18 .. 00 | size == 35 ? */
 111                                 case 0x18: if ((packet_len > 26) && (*(t+26) == 0x00)) return ((IPP2P_EDK * 100) + 63);
 112                                         break;
 113                                         /* e4 52 .. | size = 44 */
 114                                 case 0x52: if (packet_len > 35 ) return ((IPP2P_EDK * 100) + 64);
 115                                         break;
 116                                         /* e4 58 .. | size == 6 */
 117                                 case 0x58: if (packet_len > 5 ) return ((IPP2P_EDK * 100) + 65);
 118                                         break;
 119                                         /* e4 59 .. | size == 2 */
 120                                 case 0x59: if (packet_len > 1 )return ((IPP2P_EDK * 100) + 66);
 121                                         break;
 122                                         /* e4 28 .. | packet_len == 52,77,102,127... */
 123                                 case 0x28: if (((packet_len-44) % 25) == 0) return ((IPP2P_EDK * 100) + 67);
 124                                         break;
 125                                 case 0x29: if (((packet_len-44) % 25) == 0) return ((IPP2P_EDK * 100) + 67);
 126                                         break;
 127                                         /* e4 50 xx xx | size == 4 */
 128                                 case 0x50: if (packet_len > 3) return ((IPP2P_EDK * 100) + 68);
 129                                         break;
 130                                         /* e4 40 xx xx | size == 48 */
 131                                 case 0x40: if (packet_len > 47) return ((IPP2P_EDK * 100) + 69);
 132                                         break;
 133                         }
 134                         break;
 135                 }
 136         } /* end of switch (*t) */
 137     return 0;
 138 }/*udp_search_edk*/
 139
 140
 141 /*Search for UDP Gnutella commands*/
 142 int
 143 udp_search_gnu (unsigned char *t, int packet_len)
 144 {
 145     if (memcmp(t, "GND", 3) == 0) return ((IPP2P_GNU * 100) + 51);
 146     if (memcmp(t, "GNUTELLA ", 9) == 0) return ((IPP2P_GNU * 100) + 52);
 147     return 0;
 148 }/*udp_search_gnu*/
 149
 150
 151 /*Search for UDP KaZaA commands*/
 152 int
 153 udp_search_kazaa (unsigned char *t, int packet_len)
 154 {
 155     if (*(t+packet_len-1) == 0x00){
 156         if (memcmp((t+packet_len-6), "KaZaA", 5) == 0) return (IPP2P_KAZAA * 100 +50);
 157     }
 158
 159     return 0;
 160 }/*udp_search_kazaa*/
 161
 162 /*Search for UDP DirectConnect commands*/
 163 int
 164 udp_search_directconnect (unsigned char *t, int packet_len)
 165 {
 166     if ((*t == 0x24) && (*(t+packet_len-1) == 0x7c)) {
 167         if (memcmp(t, "SR ", 3) == 0)   return ((IPP2P_DC * 100) + 60);
 168         if (memcmp(t, "Ping ", 5) == 0) return ((IPP2P_DC * 100) + 61);
 169     }
 170     return 0;
 171 }/*udp_search_directconnect*/
 172
 173
 174
 175 /*Search for UDP BitTorrent commands*/
 176 int
 177 udp_search_bit (unsigned char *t, int packet_len)
 178 {
 179         switch(packet_len)
 180         {
 181                 case 16:
 182                         /* ^ 00 00 04 17 27 10 19 80 */
 183                         if ((ntohl(get_u32(t, 0)) == 0x00000417) && (ntohl(get_u32(t, 4)) == 0x27101980))
 184                                 return (IPP2P_BIT * 100 + 50);
 185                         break;
 186                 case 36:
 187                         if (get_u32(t, 8) == __constant_htonl(0x00000400) && get_u32(t, 28) == __constant_htonl(0x00000104))
 188                                 return (IPP2P_BIT * 100 + 51);
 189                         if (get_u32(t, 8) == __constant_htonl(0x00000400))
 190                                 return (IPP2P_BIT * 100 + 61);
 191                         break;
 192                 case 57:
 193                         if (get_u32(t, 8) == __constant_htonl(0x00000404) && get_u32(t, 28) == __constant_htonl(0x00000104))
 194                                 return (IPP2P_BIT * 100 + 52);
 195                         if (get_u32(t, 8) == __constant_htonl(0x00000404))
 196                                 return (IPP2P_BIT * 100 + 62);
 197                         break;
 198                 case 59:
 199                         if (get_u32(t, 8) == __constant_htonl(0x00000406) && get_u32(t, 28) == __constant_htonl(0x00000104))
 200                                 return (IPP2P_BIT * 100 + 53);
 201                         if (get_u32(t, 8) == __constant_htonl(0x00000406))
 202                                 return (IPP2P_BIT * 100 + 63);
 203                         break;
 204                 case 203:
 205                         if (get_u32(t, 0) == __constant_htonl(0x00000405))
 206                                 return (IPP2P_BIT * 100 + 54);
 207                         break;
 208                 case 21:
 209                         if ((get_u32(t, 0) == __constant_htonl(0x00000401)))
 210                                 return (IPP2P_BIT * 100 + 55);
 211                         break;
 212                 case 44:
 213                         if (get_u32(t,0)  == __constant_htonl(0x00000827) &&
 214                         get_u32(t,4) == __constant_htonl(0x37502950))
 215                                 return (IPP2P_BIT * 100 + 80);
 216                         break;
 217                 default:
 218                         /* this packet does not have a constant size */
 219                         if (packet_len >= 32 && get_u32(t, 8) == __constant_htonl(0x00000402) && get_u32(t, 28) == __constant_htonl(0x00000104))
 220                                 return (IPP2P_BIT * 100 + 56);
 221                         break;
 222         }
 223
 224         /* some extra-bitcomet rules:
 225         * "d1:" [a|r] "d2:id20:"
 226         */
 227         if (packet_len > 22 && get_u8(t, 0) == 'd' && get_u8(t, 1) == '1' && get_u8(t, 2) == ':' )
 228         {
 229                 if (get_u8(t, 3) == 'a' || get_u8(t, 3) == 'r')
 230                 {
 231                         if (memcmp(t+4,"d2:id20:",8)==0)
 232                                 return (IPP2P_BIT * 100 + 57);
 233                 }
 234         }
 235
 236 #if 0
 237         /* bitlord rules */
 238         /* packetlen must be bigger than 40 */
 239         /* first 4 bytes are zero */
 240         if (packet_len > 40 && get_u32(t, 8) == 0x00000000)
 241         {
 242                 /* first rule: 00 00 00 00 01 00 00 xx xx xx xx 00 00 00 00*/
 243                 if (get_u32(t, 12) == 0x00000000 &&
 244                     get_u32(t, 16) == 0x00010000 &&
 245                     get_u32(t, 24) == 0x00000000 )
 246                         return (IPP2P_BIT * 100 + 71);
 247
 248                 /* 00 01 00 00 0d 00 00 xx xx xx xx 00 00 00 00*/
 249                 if (get_u32(t, 12) == 0x00000001 &&
 250                     get_u32(t, 16) == 0x000d0000 &&
 251                     get_u32(t, 24) == 0x00000000 )
 252                         return (IPP2P_BIT * 100 + 71);
 253
 254
 255         }
 256 #endif
 257
 258     return 0;
 259 }/*udp_search_bit*/
 260
 261
 262
 263 /*Search for Ares commands*/
 264 //#define IPP2P_DEBUG_ARES
 265 int
 266 search_ares (const unsigned char *payload, const u16 plen)
 267 //int search_ares (unsigned char *haystack, int packet_len, int head_len)
 268 {
 269 //      const unsigned char *t = haystack + head_len;
 270
 271         /* all ares packets start with  */
 272         if (*(payload+1) == 0 && (plen - *payload) == 3)
 273         {
 274                 switch (*(payload+2))
 275                 {
 276                         case 0x5a:
 277                                 /* ares connect */
 278                                 if ( plen == 6 && *(payload+5) == 0x05 ) return ((IPP2P_ARES * 100) + 1);
 279                                 break;
 280                         case 0x09:
 281                                 /* ares search, min 3 chars --> 14 bytes
 282                                  * lets define a search can be up to 30 chars --> max 34 bytes
 283                                  */
 284                                 if ( plen >= 14 && plen <= 34 ) return ((IPP2P_ARES * 100) + 1);
 285                                 break;
 286 #ifdef IPP2P_DEBUG_ARES
 287                         default:
 288                         printk(KERN_DEBUG "Unknown Ares command %x recognized, len: %u \n", (unsigned int) *(payload+2),plen);
 289 #endif /* IPP2P_DEBUG_ARES */
 290                 }
 291         }
 292
 293 #if 0
 294         /* found connect packet: 03 00 5a 04 03 05 */
 295         /* new version ares 1.8: 03 00 5a xx xx 05 */
 296     if ((plen) == 6){   /* possible connect command*/
 297         if ((payload[0] == 0x03) && (payload[1] == 0x00) && (payload[2] == 0x5a) && (payload[5] == 0x05))
 298             return ((IPP2P_ARES * 100) + 1);
 299     }
 300     if ((plen) == 60){  /* possible download command*/
 301         if ((payload[59] == 0x0a) && (payload[58] == 0x0a)){
 302             if (memcmp(t, "PUSH SHA1:", 10) == 0) /* found download command */
 303                 return ((IPP2P_ARES * 100) + 2);
 304         }
 305     }
 306 #endif
 307
 308     return 0;
 309 } /*search_ares*/
 310
 311 /*Search for SoulSeek commands*/
 312 int
 313 search_soul (const unsigned char *payload, const u16 plen)
 314 {
 315 //#define IPP2P_DEBUG_SOUL
 316     /* match: xx xx xx xx | xx = sizeof(payload) - 4 */
 317     if (get_u32(payload, 0) == (plen - 4)){
 318         const __u32 m = get_u32(payload, 4);
 319         /* match 00 yy yy 00, yy can be everything */
 320         if ( get_u8(payload, 4) == 0x00 && get_u8(payload, 7) == 0x00 )
 321         {
 322 #ifdef IPP2P_DEBUG_SOUL
 323         printk(KERN_DEBUG "0: Soulseek command 0x%x recognized\n",get_u32(payload, 4));
 324 #endif /* IPP2P_DEBUG_SOUL */
 325                 return ((IPP2P_SOUL * 100) + 1);
 326         }
 327
 328         /* next match: 01 yy 00 00 | yy can be everything */
 329         if ( get_u8(payload, 4) == 0x01 && get_u16(payload, 6) == 0x0000 )
 330         {
 331 #ifdef IPP2P_DEBUG_SOUL
 332         printk(KERN_DEBUG "1: Soulseek command 0x%x recognized\n",get_u16(payload, 4));
 333 #endif /* IPP2P_DEBUG_SOUL */
 334                 return ((IPP2P_SOUL * 100) + 2);
 335         }
 336
 337         /* other soulseek commandos are: 1-5,7,9,13-18,22,23,26,28,35-37,40-46,50,51,60,62-69,91,92,1001 */
 338         /* try to do this in an intelligent way */
 339         /* get all small commandos */
 340         switch(m)
 341         {
 342                 case 7:
 343                 case 9:
 344                 case 22:
 345                 case 23:
 346                 case 26:
 347                 case 28:
 348                 case 50:
 349                 case 51:
 350                 case 60:
 351                 case 91:
 352                 case 92:
 353                 case 1001:
 354 #ifdef IPP2P_DEBUG_SOUL
 355                 printk(KERN_DEBUG "2: Soulseek command 0x%x recognized\n",get_u16(payload, 4));
 356 #endif /* IPP2P_DEBUG_SOUL */
 357                 return ((IPP2P_SOUL * 100) + 3);
 358         }
 359
 360         if (m > 0 && m < 6 )
 361         {
 362 #ifdef IPP2P_DEBUG_SOUL
 363                 printk(KERN_DEBUG "3: Soulseek command 0x%x recognized\n",get_u16(payload, 4));
 364 #endif /* IPP2P_DEBUG_SOUL */
 365                 return ((IPP2P_SOUL * 100) + 4);
 366         }
 367         if (m > 12 && m < 19 )
 368         {
 369 #ifdef IPP2P_DEBUG_SOUL
 370                 printk(KERN_DEBUG "4: Soulseek command 0x%x recognized\n",get_u16(payload, 4));
 371 #endif /* IPP2P_DEBUG_SOUL */
 372                 return ((IPP2P_SOUL * 100) + 5);
 373         }
 374
 375         if (m > 34 && m < 38 )
 376         {
 377 #ifdef IPP2P_DEBUG_SOUL
 378                 printk(KERN_DEBUG "5: Soulseek command 0x%x recognized\n",get_u16(payload, 4));
 379 #endif /* IPP2P_DEBUG_SOUL */
 380                 return ((IPP2P_SOUL * 100) + 6);
 381         }
 382
 383         if (m > 39 && m < 47 )
 384         {
 385 #ifdef IPP2P_DEBUG_SOUL
 386                 printk(KERN_DEBUG "6: Soulseek command 0x%x recognized\n",get_u16(payload, 4));
 387 #endif /* IPP2P_DEBUG_SOUL */
 388                 return ((IPP2P_SOUL * 100) + 7);
 389         }
 390
 391         if (m > 61 && m < 70 )
 392         {
 393 #ifdef IPP2P_DEBUG_SOUL
 394                 printk(KERN_DEBUG "7: Soulseek command 0x%x recognized\n",get_u16(payload, 4));
 395 #endif /* IPP2P_DEBUG_SOUL */
 396                 return ((IPP2P_SOUL * 100) + 8);
 397         }
 398
 399 #ifdef IPP2P_DEBUG_SOUL
 400         printk(KERN_DEBUG "unknown SOULSEEK command: 0x%x, first 16 bit: 0x%x, first 8 bit: 0x%x ,soulseek ???\n",get_u32(payload, 4),get_u16(payload, 4) >> 16,get_u8(payload, 4) >> 24);
 401 #endif /* IPP2P_DEBUG_SOUL */
 402     }
 403
 404         /* match 14 00 00 00 01 yy 00 00 00 STRING(YY) 01 00 00 00 00 46|50 00 00 00 00 */
 405         /* without size at the beginning !!! */
 406         if ( get_u32(payload, 0) == 0x14 && get_u8(payload, 4) == 0x01 )
 407         {
 408                 __u32 y = get_u32(payload, 5);
 409                 /* we need 19 chars + string */
 410                 if ( (y + 19) <= (plen) )
 411                 {
 412                         const unsigned char *w=payload+9+y;
 413                         if (get_u32(w, 0) == 0x01 && ( get_u16(w, 4) == 0x4600 || get_u16(w, 4) == 0x5000) && get_u32(w, 6) == 0x00);
 414 #ifdef IPP2P_DEBUG_SOUL
 415                         printk(KERN_DEBUG "Soulssek special client command recognized\n");
 416 #endif /* IPP2P_DEBUG_SOUL */
 417                         return ((IPP2P_SOUL * 100) + 9);
 418                 }
 419         }
 420     return 0;
 421 }
 422
 423
 424 /*Search for WinMX commands*/
 425 int
 426 search_winmx (const unsigned char *payload, const u16 plen)
 427 {
 428 //#define IPP2P_DEBUG_WINMX
 429     if ((plen == 4) && (memcmp(payload, "SEND", 4) == 0))  return ((IPP2P_WINMX * 100) + 1);
 430     if ((plen == 3) && (memcmp(payload, "GET", 3) == 0))  return ((IPP2P_WINMX * 100) + 2);
 431     //if (packet_len < (head_len + 10)) return 0;
 432     if (plen < 10) return 0;
 433
 434     if ((memcmp(payload, "SEND", 4) == 0) || (memcmp(payload, "GET", 3) == 0)){
 435         u16 c = 4;
 436         const u16 end = plen-2;
 437         u8 count = 0;
 438         while (c < end)
 439         {
 440                 if (*(payload+c)== 0x20 && *(payload+c+1) == 0x22)
 441                 {
 442                         c++;
 443                         count++;
 444                         if (count >= 2) return ((IPP2P_WINMX * 100) + 3);
 445                 }
 446                 c++;
 447         }
 448     }
 449
 450     if ( plen == 149 && *payload == '8' )
 451     {
 452 #ifdef IPP2P_DEBUG_WINMX
 453         printk(KERN_INFO "maybe WinMX\n");
 454 #endif
 455         if (get_u32(payload,17) == 0 && get_u32(payload,21) == 0 && get_u32(payload,25) == 0 &&
 456 //          get_u32(payload,33) == __constant_htonl(0x71182b1a) && get_u32(payload,37) == __constant_htonl(0x05050000) &&
 457 //          get_u32(payload,133) == __constant_htonl(0x31097edf) && get_u32(payload,145) == __constant_htonl(0xdcb8f792))
 458             get_u16(payload,39) == 0 && get_u16(payload,135) == __constant_htons(0x7edf) && get_u16(payload,147) == __constant_htons(0xf792))
 459
 460         {
 461 #ifdef IPP2P_DEBUG_WINMX
 462                 printk(KERN_INFO "got WinMX\n");
 463 #endif
 464                 return ((IPP2P_WINMX * 100) + 4);
 465         }
 466     }
 467     return 0;
 468 } /*search_winmx*/
 469
 470
 471 /*Search for appleJuice commands*/
 472 int
 473 search_apple (const unsigned char *payload, const u16 plen)
 474 {
 475     if ( (plen > 7) && get_u16(payload,6) == __constant_htons(0x0d0a) && (memcmp(payload, "ajprot", 6) == 0))  return (IPP2P_APPLE * 100);
 476
 477     return 0;
 478 }
 479
 480
 481 /*Search for BitTorrent commands*/
 482 int
 483 search_bittorrent (const unsigned char *payload, const u16 plen)
 484 {
 485     if (plen > 20)
 486     {
 487         /* test for match 0x13+"BitTorrent protocol" */
 488         if (*payload == 0x13)
 489         {
 490                 if (memcmp(payload+1, "BitTorrent protocol", 19) == 0) return (IPP2P_BIT * 100);
 491         }
 492
 493         /* get tracker commandos, all starts with GET /
 494         * then it can follow: scrape| announce
 495         * and then ?hash_info=
 496         */
 497         if (memcmp(payload,"GET /",5) == 0)
 498         {
 499                 /* message scrape */
 500                 if ( memcmp(payload+5,"scrape?info_hash=",17)==0 ) return (IPP2P_BIT * 100 + 1);
 501                 /* message announce */
 502                 if ( memcmp(payload+5,"announce",8)==0 ) return (IPP2P_BIT * 100 + 2);
 503                 if ( memcmp(payload+5,"?info_hash=",11)==0 ) return (IPP2P_BIT * 100 + 3);
 504                 if ( memcmp(payload+5,"data?fid=",9)==0 ) return (IPP2P_BIT * 100 + 5);
 505         }
 506     }
 507     else
 508     {
 509         /* bitcomet encryptes the first packet, so we have to detect another
 510          * one later in the flow */
 511          /* first try failed, too many missdetections */
 512         //if ( size == 5 && get_u32(t,0) == __constant_htonl(1) && t[4] < 3) return (IPP2P_BIT * 100 + 3);
 513
 514         /* second try: block request packets */
 515         if ( plen == 17 && get_u32(payload,0) == __constant_htonl(0x0d) && *(payload+4) == 0x06 && get_u32(payload,13) == __constant_htonl(0x4000) ) return (IPP2P_BIT * 100 + 4);
 516     }
 517
 518     return 0;
 519 }
 520
 521 /* check for xunlei */
 522 int
 523 search_xunlei (const unsigned char *payload, const u16 plen)
 524 {
 525         if ( memcmp(payload,"POST / HTTP/1.1",15) ==0 )
 526         {
 527                 unsigned char *t = strstr((payload+93), "Connection: Keep-Alive"); //min length of Connection
 528                 if (t)
 529                 {
 530                         t += 26;
 531                         if ( (*t < 0x40) && (*(t+1) == 0x00) && get_u16(t,2) == __constant_htons(0x0000) && get_u16(t,5) == __constant_htons(0x0000) && (*(t+7) == 0x00) && (*(t+8) == (payload+plen-t-12)) ) return (IPP2P_XUNLEI *100 + 1);
 532                 }
 533         }
 534         //QQ cyclone
 535         if ( plen < 400 )
 536         {
 537                 if ( get_u16(payload,0) == __constant_htons(0x0200) && ( *(payload+3) == 0x01 || *(payload+3) == 0x00 ) && *(payload+5) == 0x00 && ( *(payload+6) == 0x01 || *(payload+6) == 0x77 ) && get_u16(payload,21) == __constant_htons(0x0038) ) return (IPP2P_XUNLEI *100 + 2);
 538         }
 539         return 0;
 540 }
 541
 542 int
 543 udp_search_xunlei (unsigned char *t, int packet_len)
 544 {
 545         /* baidu xiaba */
 546         if (packet_len == 24 && get_u32(t,0) == __constant_htonl(0x01000101) && get_u32(t,4) == __constant_htonl(0xfefffeff) && get_u32(t,8) == __constant_htonl(0x00)) return (IPP2P_XUNLEI * 100 + 11);
 547         if (packet_len == 38 && get_u32(t,0) == __constant_htonl(0x010011a0) && get_u32(t,4) == __constant_htonl(0xfefffeff) && get_u32(t,8) == __constant_htonl(0x00)) return (IPP2P_XUNLEI * 100 + 12);
 548         return 0;
 549 }
 550 /* check for PPLive & PPStream */
 551 int
 552 search_pp (const unsigned char *payload, const u16 plen)
 553 {
 554         /* message pplive */
 555         if ( memcmp(payload,"GET /zh-cn/xml/default.xml",26)==0 ) return (IPP2P_PP *100 + 1 );
 556         /* message PPStream */
 557         if ( memcmp(payload,"PSProtocol",10)==0 ) return (IPP2P_PP * 100 + 2);
 558         /* message PPLive */
 559         if (get_u16(payload,0) == __constant_htons(0xe903) && get_u32(payload,4) == __constant_htonl(0x98ab0102)) return (IPP2P_PP * 100 + 3);
 560         if (get_u16(payload,4) == __constant_htons(0xe903) && get_u32(payload,8) == __constant_htonl(0x98ab0102)) return (IPP2P_PP * 100 + 4);
 561         /* message UUSee */
 562         if (((*payload + *(payload+1) * 256) == (plen-4) || ((*payload + *(payload+1) * 256) < (plen-4) && *payload + *(payload+1) * 256 + *(payload + *payload + *(payload+1) * 256 + 4) + *(payload + *payload + *(payload+1) * 256 + 5) * 256 + 8 == plen )) && get_u16(payload,2) == __constant_htons(0x0000)) {
 563         if (*(payload+18) == 0x68 && *(payload+20) == 0x74 && *(payload+22) == 0x74 && *(payload+24) == 0x70 && *(payload+26)==0x3a && *(payload+28) == 0x2f && *(payload+30) == 0x2f) return 0;
 564         return (IPP2P_PP * 100 + 5);
 565         }
 566         /* QQLive */
 567         if ( (plen < 150) && (*payload == 0xfe) && (*(payload+1) == *(payload+4)) && get_u16(payload,2) == __constant_htons(0x0000) ) return (IPP2P_PP * 100 + 6);
 568         /* feidian */
 569         if ( (plen == 4 && get_u32(payload,0) == __constant_htonl(0x291c3201)) || (plen == 61 && get_u32(payload,0) == __constant_htonl(0x291c3201) && get_u32(payload,4) == __constant_htonl(0x39000000))) return (IPP2P_PP * 100 + 7);
 570         /* POCO */
 571         if ( (*payload + *(payload+1)*256) == plen && get_u16(payload,2) == __constant_htons(0x0000) && (*(payload+4) + *(payload+5)) == (plen - 13) && get_u16(payload,6) == __constant_htons(0x0000)) return (IPP2P_PP * 100 + 8);
 572         /* QVOD */
 573         if(memcmp((payload + 1),"QVOD protocol",13) == 0) return (IPP2P_PP * 100 + 9);
 574         return 0;
 575 }
 576
 577 /* check for PPLive & PPStream UDP pkg */
 578 int
 579 udp_search_pp (unsigned char *t, int packet_len)
 580 {
 581     if (get_u16(t,0) == __constant_htons(0xe903) && get_u32(t,4) == __constant_htonl(0x98ab0102)) return (IPP2P_PP * 100 + 11);
 582     if ( (memcmp(t+8,"[bsinfo]",8) ==0) && (*(t+16) == 0x0d) && (*(t+17) == 0x0a) && (memcmp(t+18,"mf=",3) ==0) ) return (IPP2P_PP * 100 + 12);
 583     if ( (packet_len == 22 || packet_len == 8) && get_u16(t,0) == __constant_htons(0x0909) && (*(t+2) == 0x08 || *(t+2) == 0x09) && ((*(t+3) == 0x00) || (*(t+3) == 0x01)) ) return (IPP2P_PP * 100 + 13);
 584     if ( packet_len == (*t+4) && get_u32(t,1) == __constant_htonl(0x00430000)) return (IPP2P_PP * 100 + 15 );
 585     /* QQLive */
 586     if ( (packet_len < 150) && (*t == 0xfe) && (*(t+1) == *(t+4)) && get_u16(t,2) == __constant_htons(0x0000) ) return (IPP2P_PP * 100 + 14);
 587     /* feidian */
 588     if ( (packet_len == 112 || packet_len == 116) && get_u32(t,0) == __constant_htonl(0x1c1c3201) && (get_u16(t,4) == __constant_htons(0x0b00) || get_u16(t,4) == __constant_htons(0x0c00))) return (IPP2P_PP * 100 + 16);
 589     /* POCO */
 590     if (packet_len == 6 && get_u16(t,0) == __constant_htons(0x8095) && (get_u16(t,2) == __constant_htons(0x0462) || get_u16(t,2) == __constant_htons(0x0565)) ) return (IPP2P_PP * 100 + 17);
 591     if (packet_len == 22 && get_u16(t,0) == __constant_htons(0x8094) && (get_u16(t,2) == __constant_htons(0x0429) || get_u16(t,4) == __constant_htons(0x0429)) ) return (IPP2P_PP * 100 + 18);
 592     /* QVOD */
 593     if (packet_len == ntohl(get_u32(t,0)) && memcmp((t + 14),"QVOD protocol",13) == 0) return (IPP2P_PP * 100 + 19);
 594     return 0;
 595 }
 596
 597 /*check for gnutella get commands and other typical data*/
 598 int
 599 search_all_gnu (const unsigned char *payload, const u16 plen)
 600 {
 601
 602     if (get_u16(payload,(plen-2)) == __constant_htons(0x0d0a))
 603     {
 604
 605         if (memcmp(payload, "GNUTELLA CONNECT/", 17) == 0) return ((IPP2P_GNU * 100) + 1);
 606         if (memcmp(payload, "GNUTELLA/", 9) == 0) return ((IPP2P_GNU * 100) + 2);
 607
 608
 609         if ((memcmp(payload, "GET /get/", 9) == 0) || (memcmp(payload, "GET /uri-res/", 13) == 0))
 610         {
 611                 u16 c = 8;
 612                 const u16 end = plen-22;
 613                 while (c < end) {
 614                         if ( get_u16(payload,c) == __constant_htons(0x0a0d) && ((memcmp((payload+c+2), "X-Gnutella-", 11) == 0) || (memcmp((payload+c+2), "X-Queue:", 8) == 0)))
 615                                 return ((IPP2P_GNU * 100) + 3);
 616                         c++;
 617                 }
 618         }
 619     }
 620     return 0;
 621 }
 622
 623 /*check for KaZaA download commands and other typical data*/
 624 int
 625 search_all_kazaa (const unsigned char *payload, const u16 plen)
 626 {
 627     if (get_u16(payload,(plen-2)) == __constant_htons(0x0d0a))
 628     {
 629
 630         if (memcmp(payload, "GIVE ", 5) == 0) return ((IPP2P_KAZAA * 100) + 1);
 631
 632         if (memcmp(payload, "GET /", 5) == 0) {
 633                 u16 c = 8;
 634                 const u16 end=plen-22;
 635                 while (c < end) {
 636                         if ( get_u16(payload,c) == __constant_htons(0x0a0d) && ((memcmp((payload+c+2), "X-Kazaa-Username: ", 18) == 0) || (memcmp((payload+c+2), "User-Agent: PeerEnabler/", 24) == 0)))
 637                                 return ((IPP2P_KAZAA * 100) + 2);
 638                         c++;
 639                 }
 640         }
 641     }
 642     return 0;
 643 }
 644
 645 /*intensive but slower search for some edonkey packets including size-check*/
 646 int
 647 search_all_edk (const unsigned char *payload, const u16 plen)
 648 {
 649     if (memcmp(payload, "POST / HTTP/1.1", 15) == 0 && memcmp(payload+17, "Host: vagaa.com", 15) == 0 && memcmp(payload+34, "VAGAA-OPERATION: ", 17) == 0) return (IPP2P_EDK * 100 + 10);
 650     if (*payload != 0xe3)
 651         return 0;
 652     else {
 653         //t += head_len;
 654         const u16 cmd = get_u16(payload, 1);
 655         if (cmd == (plen - 5)) {
 656             switch (*(payload+5)) {
 657                 case 0x01: return ((IPP2P_EDK * 100) + 1);      /*Client: hello or Server:hello*/
 658                 break;
 659                 case 0x47: return ((IPP2P_EDK * 100) + 2);      /*fast check for edonkey file segment transfer command*/
 660                 break;
 661                 case 0x4c: return ((IPP2P_EDK * 100) + 9);      /*Client: Hello-Answer*/
 662                 break;
 663             }
 664         }
 665         return 0;
 666      }
 667 }
 668
 669 /*intensive but slower check for all direct connect packets*/
 670 int
 671 search_all_dc (const unsigned char *payload, const u16 plen)
 672 {
 673 //    unsigned char *t = haystack;
 674
 675     if (*payload == 0x24 && *(payload+plen-1) == 0x7c)
 676     {
 677         const unsigned char *t = payload+1;
 678                 /* Client-Hub-Protocol */
 679         if (memcmp(t, "Lock ", 5) == 0)                 return ((IPP2P_DC * 100) + 1);
 680         /*fast check for Direct Connect send command*/
 681         if (memcmp(t, "Send|", 5) == 0)                 return ((IPP2P_DC * 100) + 5);
 682         /* Client-Client-Protocol, some are already recognized by client-hub (like lock) */
 683         if (memcmp(t, "MyNick ", 7) == 0)               return ((IPP2P_DC * 100) + 38);
 684     }
 685     return 0;
 686 }
 687
 688 /*check for mute*/
 689 int
 690 search_mute (const unsigned char *payload, const u16 plen)
 691 {
 692         if ( plen == 209 || plen == 345 || plen == 473 || plen == 609 || plen == 1121 )
 693         {
 694                 //printk(KERN_DEBUG "size hit: %u",size);
 695                 if (memcmp(payload,"PublicKey: ",11) == 0 )
 696                 {
 697                         return ((IPP2P_MUTE * 100) + 0);
 698
 699 /*                      if (memcmp(t+size-14,"\x0aEndPublicKey\x0a",14) == 0)
 700                         {
 701                                 printk(KERN_DEBUG "end pubic key hit: %u",size);
 702
 703                         }*/
 704                 }
 705         }
 706         return 0;
 707 }
 708
 709
 710 /* check for xdcc */
 711 int
 712 search_xdcc (const unsigned char *payload, const u16 plen)
 713 {
 714         /* search in small packets only */
 715         if (plen > 20 && plen < 200 && get_u16(payload,(plen-2)) == __constant_htons(0x0d0a) && memcmp(payload,"PRIVMSG ",8) == 0)
 716         {
 717
 718                 u16 x=10;
 719                 const u16 end = plen - 13;
 720
 721                 /* is seems to be a irc private massage, chedck for xdcc command */
 722                 while (x < end)
 723                 {
 724                         if (*(payload+x) == ':')
 725                         {
 726                                 if ( memcmp((payload+x+1),"xdcc send #",11) == 0 )
 727                                         return ((IPP2P_XDCC * 100) + 0);
 728                         }
 729                         x++;
 730                 }
 731         }
 732         return 0;
 733 }
 734
 735 /* search for waste */
 736 int search_waste(const unsigned char *payload, const u16 plen)
 737 {
 738         if ( plen >= 8 && memcmp(payload,"GET.sha1:",9) == 0)
 739                 return ((IPP2P_WASTE * 100) + 0);
 740
 741         return 0;
 742 }
 743
 744
 745 static struct {
 746     int command;
 747     __u8 short_hand;                    /*for fucntions included in short hands*/
 748     int packet_len;
 749     int (*function_name) (const unsigned char *, const u16);
 750 } matchlist[] = {
 751     {IPP2P_EDK,SHORT_HAND_IPP2P,20, &search_all_edk},
 752     {IPP2P_DC,SHORT_HAND_IPP2P,5, &search_all_dc},
 753     {IPP2P_GNU,SHORT_HAND_IPP2P,5, &search_all_gnu},
 754     {IPP2P_KAZAA,SHORT_HAND_IPP2P,5, &search_all_kazaa},
 755     {IPP2P_BIT,SHORT_HAND_IPP2P,20, &search_bittorrent},
 756     {IPP2P_PP,SHORT_HAND_IPP2P,3, &search_pp},
 757     {IPP2P_APPLE,SHORT_HAND_IPP2P,5, &search_apple},
 758     {IPP2P_SOUL,SHORT_HAND_IPP2P,5, &search_soul},
 759     {IPP2P_WINMX,SHORT_HAND_IPP2P,2, &search_winmx},
 760     {IPP2P_ARES,SHORT_HAND_IPP2P,5, &search_ares},
 761     {IPP2P_MUTE,SHORT_HAND_NONE,200, &search_mute},
 762     {IPP2P_WASTE,SHORT_HAND_NONE,5, &search_waste},
 763     {IPP2P_XDCC,SHORT_HAND_NONE,5, &search_xdcc},
 764     {IPP2P_XUNLEI,SHORT_HAND_NONE,100,&search_xunlei},
 765     {0,0,0,NULL}
 766 };
 767
 768
 769 static struct {
 770     int command;
 771     __u8 short_hand;                    /*for fucntions included in short hands*/
 772     int packet_len;
 773     int (*function_name) (unsigned char *, int);
 774 } udp_list[] = {
 775     {IPP2P_KAZAA,SHORT_HAND_IPP2P,6, &udp_search_kazaa},
 776     {IPP2P_BIT,SHORT_HAND_IPP2P,15, &udp_search_bit},
 777     {IPP2P_PP,SHORT_HAND_IPP2P,3, &udp_search_pp},
 778     {IPP2P_GNU,SHORT_HAND_IPP2P,3, &udp_search_gnu},
 779     {IPP2P_EDK,SHORT_HAND_IPP2P,1, &udp_search_edk},
 780     {IPP2P_DC,SHORT_HAND_IPP2P,4, &udp_search_directconnect},
 781     {IPP2P_XUNLEI,SHORT_HAND_NONE,5,&udp_search_xunlei},
 782     {0,0,0,NULL}
 783 };
 784
 785 #if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,23)
 786 static bool
 787 #else
 788 static int
 789 #endif
 790 match(const struct sk_buff *skb,
 791       const struct net_device *in,
 792       const struct net_device *out,
 793 #if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,17)
 794       const struct xt_match  *mymatch,
 795       const void *matchinfo,
 796       int offset,
 797       unsigned int myprotoff,
 798 #else
 799       const void *matchinfo,
 800       int offset,
 801 #endif
 802
 803 #if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,0)
 804       const void *hdr,
 805       u_int16_t datalen,
 806 #endif
 807 #if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,23)
 808       bool *hotdrop)
 809 #else
 810       int *hotdrop)
 811 #endif
 812 {
 813     const struct ipt_p2p_info *info = matchinfo;
 814     unsigned char  *haystack;
 815     enum ip_conntrack_info ctinfo;
 816     struct nf_conn *conntrack;
 817 #if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,22)
 818     struct iphdr *ip = ip_hdr(skb);
 819 #else
 820     struct iphdr *ip = skb->nh.iph;
 821 #endif
 822     int p2p_result = 0, i = 0;
 823 //    int head_len;
 824     int hlen = ntohs(ip->tot_len)-(ip->ihl*4);  /*hlen = packet-data length*/
 825
 826     /*must not be a fragment*/
 827     if (offset) {
 828         if (info->debug) printk("IPP2P.match: offset found %i \n",offset);
 829         return 0;
 830     }
 831     /*make sure that skb is linear*/
 832     if(skb_is_nonlinear(skb)){
 833         if (info->debug) printk("IPP2P.match: nonlinear skb found\n");
 834         return 0;
 835     }
 836     if(!(conntrack = nf_ct_get(skb, &ctinfo))) {
 837         if (info->debug) printk("IPP2P.match: couldn't get conntrack\n");
 838         return 0;
 839     }
 840
 841     if(TOTAL_PACKETS == 1)
 842         conntrack->ipp2p = 0;
 843
 844     if(conntrack->ipp2p)
 845         return conntrack->ipp2p;
 846
 847     if((TOTAL_PACKETS > match_packets) && !conntrack->ipp2p)
 848         return 0;
 849
 850 //    else
 851 //      printk("IPP2P: conntrack %d packets\n",TOTAL_PACKETS);
 852     haystack=(char *)ip+(ip->ihl*4);            /*haystack = packet data*/
 853     switch (ip->protocol){
 854         case IPPROTO_TCP:               /*what to do with a TCP packet*/
 855         {
 856             struct tcphdr *tcph = (void *) ip + ip->ihl * 4;
 857
 858             if (tcph->fin) return 0;  /*if FIN bit is set bail out*/
 859             if (tcph->syn) return 0;  /*if SYN bit is set bail out*/
 860             if (tcph->rst) return 0;  /*if RST bit is set bail out*/
 861
 862             haystack += tcph->doff * 4; /*get TCP-Header-Size*/
 863             hlen -= tcph->doff * 4;
 864             while (matchlist[i].command) {
 865                 if ((((info->cmd & matchlist[i].command) == matchlist[i].command) ||
 866                     ((info->cmd & matchlist[i].short_hand) == matchlist[i].short_hand)) &&
 867                     (hlen > matchlist[i].packet_len)) {
 868                             p2p_result = matchlist[i].function_name(haystack, hlen);
 869                             if (p2p_result)
 870                             {
 871                                 if (info->debug) printk("IPP2P.debug:TCP-match: %i from: %u.%u.%u.%u:%i to: %u.%u.%u.%u:%i Length: %i\n",
 872                                     p2p_result, NIPQUAD(ip->saddr),ntohs(tcph->source), NIPQUAD(ip->daddr),ntohs(tcph->dest),hlen);
 873                                 return p2p_result;
 874                             }
 875                 }
 876             i++;
 877             }
 878             conntrack->ipp2p = p2p_result;
 879             return p2p_result;
 880         }
 881
 882         case IPPROTO_UDP:               /*what to do with an UDP packet*/
 883         {
 884             struct udphdr *udph = (void *) ip + ip->ihl * 4;
 885             haystack += 8;
 886             hlen -= 8;
 887             while (udp_list[i].command){
 888                 if ((((info->cmd & udp_list[i].command) == udp_list[i].command) ||
 889                     ((info->cmd & udp_list[i].short_hand) == udp_list[i].short_hand)) &&
 890                     (hlen > udp_list[i].packet_len)) {
 891                             p2p_result = udp_list[i].function_name(haystack, hlen);
 892                             if (p2p_result){
 893                                 if (info->debug) printk("IPP2P.debug:UDP-match: %i from: %u.%u.%u.%u:%i to: %u.%u.%u.%u:%i Length: %i\n",
 894                                     p2p_result, NIPQUAD(ip->saddr),ntohs(udph->source), NIPQUAD(ip->daddr),ntohs(udph->dest),hlen);
 895                                 return p2p_result;
 896                             }
 897                 }
 898             i++;
 899             }
 900             conntrack->ipp2p = p2p_result;
 901             return p2p_result;
 902         }
 903
 904         default: return 0;
 905     }
 906 }
 907
 908
 909 #if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,23)
 910 static bool
 911 #else
 912 static int
 913 #endif
 914 checkentry(const char *tablename,
 915 #if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,17)
 916            const void *ip,
 917            const struct xt_match *mymatch,
 918 #else
 919            const struct ipt_ip *ip,
 920 #endif
 921            void *matchinfo,
 922 #if LINUX_VERSION_CODE <= KERNEL_VERSION(2,6,18)
 923            unsigned int matchsize,
 924 #endif
 925            unsigned int hook_mask)
 926 {
 927         /* Must specify -p tcp */
 928 /*    if (ip->proto != IPPROTO_TCP || (ip->invflags & IPT_INV_PROTO)) {
 929  *      printk("ipp2p: Only works on TCP packets, use -p tcp\n");
 930  *      return 0;
 931  *    }*/
 932         return 1;
 933 }
 934
 935
 936 static struct ipt_match ipp2p_match = {
 937 #if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,0)
 938         { NULL, NULL },
 939         "ipp2p",
 940         &match,
 941         &checkentry,
 942         NULL,
 943         THIS_MODULE
 944 #elif LINUX_VERSION_CODE < KERNEL_VERSION(2,6,17)
 945         .name           = "ipp2p",
 946         .match          = &match,
 947         .checkentry     = &checkentry,
 948         .me             = THIS_MODULE,
 949 #else /* LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,17) */
 950         .name           = "ipp2p",
 951         .match          = &match,
 952         .family         = AF_INET,
 953         .matchsize      = XT_ALIGN(sizeof(struct ipt_p2p_info)),
 954         .checkentry     = &checkentry,
 955         .me             = THIS_MODULE,
 956 #endif
 957 };
 958
 959
 960 static int __init init(void)
 961 {
 962     need_conntrack();
 963     printk(KERN_INFO "IPP2P v%s loading, with %d packets to match\n", IPP2P_VERSION, match_packets);
 964     return ipt_register_match(&ipp2p_match);
 965 }
 966
 967 static void __exit fini(void)
 968 {
 969     ipt_unregister_match(&ipp2p_match);
 970     printk(KERN_INFO "IPP2P v%s unloaded\n", IPP2P_VERSION);
 971 }
 972
 973 module_init(init);
 974 module_exit(fini);
 975
 976