target/linux/generic-2.4/patches/601-netfilter_ipp2p_0.8.1rc1.patch

   1 --- /dev/null
   2 +++ b/include/linux/netfilter_ipv4/ipt_ipp2p.h
   3 @@ -0,0 +1,31 @@
   4 +#ifndef __IPT_IPP2P_H
   5 +#define __IPT_IPP2P_H
   6 +#define IPP2P_VERSION "0.8.1_rc1"
   7 +
   8 +struct ipt_p2p_info {
   9 +    int cmd;
  10 +    int debug;
  11 +};
  12 +
  13 +#endif //__IPT_IPP2P_H
  14 +
  15 +#define SHORT_HAND_IPP2P       1 /* --ipp2p switch*/
  16 +//#define SHORT_HAND_DATA              4 /* --ipp2p-data switch*/
  17 +#define SHORT_HAND_NONE                5 /* no short hand*/
  18 +
  19 +#define IPP2P_EDK              (1 << 1)
  20 +#define IPP2P_DATA_KAZAA       (1 << 2)
  21 +#define IPP2P_DATA_EDK         (1 << 3)
  22 +#define IPP2P_DATA_DC          (1 << 4)
  23 +#define IPP2P_DC               (1 << 5)
  24 +#define IPP2P_DATA_GNU         (1 << 6)
  25 +#define IPP2P_GNU              (1 << 7)
  26 +#define IPP2P_KAZAA            (1 << 8)
  27 +#define IPP2P_BIT              (1 << 9)
  28 +#define IPP2P_APPLE            (1 << 10)
  29 +#define IPP2P_SOUL             (1 << 11)
  30 +#define IPP2P_WINMX            (1 << 12)
  31 +#define IPP2P_ARES             (1 << 13)
  32 +#define IPP2P_MUTE             (1 << 14)
  33 +#define IPP2P_WASTE            (1 << 15)
  34 +#define IPP2P_XDCC             (1 << 16)
  35 --- a/net/ipv4/netfilter/Config.in
  36 +++ b/net/ipv4/netfilter/Config.in
  37 @@ -26,6 +26,7 @@ if [ "$CONFIG_IP_NF_IPTABLES" != "n" ];
  38    dep_tristate '  TOS match support' CONFIG_IP_NF_MATCH_TOS $CONFIG_IP_NF_IPTABLES
  39    dep_tristate '  recent match support' CONFIG_IP_NF_MATCH_RECENT $CONFIG_IP_NF_IPTABLES
  40    dep_tristate '  ECN match support' CONFIG_IP_NF_MATCH_ECN $CONFIG_IP_NF_IPTABLES
  41 +  dep_tristate '  peer to peer traffic match support' CONFIG_IP_NF_MATCH_IPP2P $CONFIG_IP_NF_IPTABLES
  42
  43    dep_tristate '  DSCP match support' CONFIG_IP_NF_MATCH_DSCP $CONFIG_IP_NF_IPTABLES
  44
  45 --- a/net/ipv4/netfilter/Makefile
  46 +++ b/net/ipv4/netfilter/Makefile
  47 @@ -67,6 +67,7 @@ obj-$(CONFIG_IP_NF_MATCH_HELPER) += ipt_
  48  obj-$(CONFIG_IP_NF_MATCH_LIMIT) += ipt_limit.o
  49  obj-$(CONFIG_IP_NF_MATCH_MARK) += ipt_mark.o
  50  obj-$(CONFIG_IP_NF_MATCH_MAC) += ipt_mac.o
  51 +obj-$(CONFIG_IP_NF_MATCH_IPP2P) += ipt_ipp2p.o
  52
  53  obj-$(CONFIG_IP_NF_MATCH_PKTTYPE) += ipt_pkttype.o
  54  obj-$(CONFIG_IP_NF_MATCH_MULTIPORT) += ipt_multiport.o
  55 --- /dev/null
  56 +++ b/net/ipv4/netfilter/ipt_ipp2p.c
  57 @@ -0,0 +1,868 @@
  58 +#if defined(MODVERSIONS)
  59 +#include <linux/modversions.h>
  60 +#endif
  61 +#include <linux/module.h>
  62 +#include <linux/netfilter_ipv4/ip_tables.h>
  63 +#include <linux/version.h>
  64 +#include <linux/netfilter_ipv4/ipt_ipp2p.h>
  65 +#include <net/tcp.h>
  66 +#include <net/udp.h>
  67 +
  68 +#define get_u8(X,O)  (*(__u8 *)(X + O))
  69 +#define get_u16(X,O)  (*(__u16 *)(X + O))
  70 +#define get_u32(X,O)  (*(__u32 *)(X + O))
  71 +
  72 +MODULE_AUTHOR("Eicke Friedrich/Klaus Degner <ipp2p@ipp2p.org>");
  73 +MODULE_DESCRIPTION("An extension to iptables to identify P2P traffic.");
  74 +MODULE_LICENSE("GPL");
  75 +
  76 +
  77 +/*Search for UDP eDonkey/eMule/Kad commands*/
  78 +int
  79 +udp_search_edk (unsigned char *haystack, int packet_len)
  80 +{
  81 +    unsigned char *t = haystack;
  82 +    t += 8;
  83 +
  84 +       switch (t[0]) {
  85 +               case 0xe3:
  86 +               {       /*edonkey*/
  87 +                       switch (t[1])
  88 +                       {
  89 +                               /* client -> server status request */
  90 +                               case 0x96:
  91 +                                       if (packet_len == 14) return ((IPP2P_EDK * 100) + 50);
  92 +                                       break;
  93 +                               /* server -> client status request */
  94 +                               case 0x97: if (packet_len == 42) return ((IPP2P_EDK * 100) + 51);
  95 +                                       break;
  96 +                                               /* server description request */
  97 +                                               /* e3 2a ff f0 .. | size == 6 */
  98 +                               case 0xa2: if ( (packet_len == 14) && ( get_u16(t,2) == __constant_htons(0xfff0) ) ) return ((IPP2P_EDK * 100) + 52);
  99 +                                       break;
 100 +                                               /* server description response */
 101 +                                               /* e3 a3 ff f0 ..  | size > 40 && size < 200 */
 102 +                               //case 0xa3: return ((IPP2P_EDK * 100) + 53);
 103 +                               //      break;
 104 +                               case 0x9a: if (packet_len==26) return ((IPP2P_EDK * 100) + 54);
 105 +                                       break;
 106 +
 107 +                               case 0x92: if (packet_len==18) return ((IPP2P_EDK * 100) + 55);
 108 +                                       break;
 109 +                       }
 110 +                       break;
 111 +               }
 112 +               case 0xe4:
 113 +               {
 114 +                       switch (t[1])
 115 +                       {
 116 +                                               /* e4 20 .. | size == 43 */
 117 +                               case 0x20: if ((packet_len == 43) && (t[2] != 0x00) && (t[34] != 0x00)) return ((IPP2P_EDK * 100) + 60);
 118 +                                       break;
 119 +                                               /* e4 00 .. 00 | size == 35 ? */
 120 +                               case 0x00: if ((packet_len == 35) && (t[26] == 0x00)) return ((IPP2P_EDK * 100) + 61);
 121 +                                       break;
 122 +                                               /* e4 10 .. 00 | size == 35 ? */
 123 +                               case 0x10: if ((packet_len == 35) && (t[26] == 0x00)) return ((IPP2P_EDK * 100) + 62);
 124 +                                       break;
 125 +                                               /* e4 18 .. 00 | size == 35 ? */
 126 +                               case 0x18: if ((packet_len == 35) && (t[26] == 0x00)) return ((IPP2P_EDK * 100) + 63);
 127 +                                       break;
 128 +                                               /* e4 52 .. | size = 44 */
 129 +                               case 0x52: if (packet_len == 44 ) return ((IPP2P_EDK * 100) + 64);
 130 +                                       break;
 131 +                                               /* e4 58 .. | size == 6 */
 132 +                               case 0x58: if (packet_len == 14 ) return ((IPP2P_EDK * 100) + 65);
 133 +                                       break;
 134 +                                               /* e4 59 .. | size == 2 */
 135 +                               case 0x59: if (packet_len == 10 )return ((IPP2P_EDK * 100) + 66);
 136 +                                       break;
 137 +                                       /* e4 28 .. | packet_len == 52,77,102,127... */
 138 +                               case 0x28: if (((packet_len-52) % 25) == 0) return ((IPP2P_EDK * 100) + 67);
 139 +                                       break;
 140 +                                       /* e4 50 xx xx | size == 4 */
 141 +                               case 0x50: if (packet_len == 12) return ((IPP2P_EDK * 100) + 68);
 142 +                                       break;
 143 +                                       /* e4 40 xx xx | size == 48 */
 144 +                               case 0x40: if (packet_len == 56) return ((IPP2P_EDK * 100) + 69);
 145 +                                       break;
 146 +                       }
 147 +                       break;
 148 +               }
 149 +       } /* end of switch (t[0]) */
 150 +    return 0;
 151 +}/*udp_search_edk*/
 152 +
 153 +
 154 +/*Search for UDP Gnutella commands*/
 155 +int
 156 +udp_search_gnu (unsigned char *haystack, int packet_len)
 157 +{
 158 +    unsigned char *t = haystack;
 159 +    t += 8;
 160 +
 161 +    if (memcmp(t, "GND", 3) == 0) return ((IPP2P_GNU * 100) + 51);
 162 +    if (memcmp(t, "GNUTELLA ", 9) == 0) return ((IPP2P_GNU * 100) + 52);
 163 +    return 0;
 164 +}/*udp_search_gnu*/
 165 +
 166 +
 167 +/*Search for UDP KaZaA commands*/
 168 +int
 169 +udp_search_kazaa (unsigned char *haystack, int packet_len)
 170 +{
 171 +    unsigned char *t = haystack;
 172 +
 173 +    if (t[packet_len-1] == 0x00){
 174 +       t += (packet_len - 6);
 175 +       if (memcmp(t, "KaZaA", 5) == 0) return (IPP2P_KAZAA * 100 +50);
 176 +    }
 177 +
 178 +    return 0;
 179 +}/*udp_search_kazaa*/
 180 +
 181 +/*Search for UDP DirectConnect commands*/
 182 +int
 183 +udp_search_directconnect (unsigned char *haystack, int packet_len)
 184 +{
 185 +    unsigned char *t = haystack;
 186 +    if ((*(t + 8) == 0x24) && (*(t + packet_len - 1) == 0x7c)) {
 187 +       t+=8;
 188 +       if (memcmp(t, "SR ", 3) == 0)                   return ((IPP2P_DC * 100) + 60);
 189 +       if (memcmp(t, "Ping ", 5) == 0)                 return ((IPP2P_DC * 100) + 61);
 190 +    }
 191 +    return 0;
 192 +}/*udp_search_directconnect*/
 193 +
 194 +
 195 +
 196 +/*Search for UDP BitTorrent commands*/
 197 +int
 198 +udp_search_bit (unsigned char *haystack, int packet_len)
 199 +{
 200 +       switch(packet_len)
 201 +       {
 202 +               case 24:
 203 +                       /* ^ 00 00 04 17 27 10 19 80 */
 204 +                       if ((ntohl(get_u32(haystack, 8)) == 0x00000417) && (ntohl(get_u32(haystack, 12)) == 0x27101980))
 205 +                               return (IPP2P_BIT * 100 + 50);
 206 +                       break;
 207 +               case 44:
 208 +                       if (get_u32(haystack, 16) == __constant_htonl(0x00000400) && get_u32(haystack, 36) == __constant_htonl(0x00000104))
 209 +                               return (IPP2P_BIT * 100 + 51);
 210 +                       if (get_u32(haystack, 16) == __constant_htonl(0x00000400))
 211 +                               return (IPP2P_BIT * 100 + 61);
 212 +                       break;
 213 +               case 65:
 214 +                       if (get_u32(haystack, 16) == __constant_htonl(0x00000404) && get_u32(haystack, 36) == __constant_htonl(0x00000104))
 215 +                               return (IPP2P_BIT * 100 + 52);
 216 +                       if (get_u32(haystack, 16) == __constant_htonl(0x00000404))
 217 +                               return (IPP2P_BIT * 100 + 62);
 218 +                       break;
 219 +               case 67:
 220 +                       if (get_u32(haystack, 16) == __constant_htonl(0x00000406) && get_u32(haystack, 36) == __constant_htonl(0x00000104))
 221 +                               return (IPP2P_BIT * 100 + 53);
 222 +                       if (get_u32(haystack, 16) == __constant_htonl(0x00000406))
 223 +                               return (IPP2P_BIT * 100 + 63);
 224 +                       break;
 225 +               case 211:
 226 +                       if (get_u32(haystack, 8) == __constant_htonl(0x00000405))
 227 +                               return (IPP2P_BIT * 100 + 54);
 228 +                       break;
 229 +               case 29:
 230 +                       if ((get_u32(haystack, 8) == __constant_htonl(0x00000401)))
 231 +                               return (IPP2P_BIT * 100 + 55);
 232 +                       break;
 233 +               case 52:
 234 +                       if (get_u32(haystack,8)  == __constant_htonl(0x00000827) &&
 235 +                       get_u32(haystack,12) == __constant_htonl(0x37502950))
 236 +                               return (IPP2P_BIT * 100 + 80);
 237 +                       break;
 238 +               default:
 239 +                       /* this packet does not have a constant size */
 240 +                       if (packet_len >= 40 && get_u32(haystack, 16) == __constant_htonl(0x00000402) && get_u32(haystack, 36) == __constant_htonl(0x00000104))
 241 +                               return (IPP2P_BIT * 100 + 56);
 242 +                       break;
 243 +       }
 244 +
 245 +       /* some extra-bitcomet rules:
 246 +       * "d1:" [a|r] "d2:id20:"
 247 +       */
 248 +       if (packet_len > 30 && get_u8(haystack, 8) == 'd' && get_u8(haystack, 9) == '1' && get_u8(haystack, 10) == ':' )
 249 +       {
 250 +               if (get_u8(haystack, 11) == 'a' || get_u8(haystack, 11) == 'r')
 251 +               {
 252 +                       if (memcmp(haystack+12,"d2:id20:",8)==0)
 253 +                               return (IPP2P_BIT * 100 + 57);
 254 +               }
 255 +       }
 256 +
 257 +#if 0
 258 +       /* bitlord rules */
 259 +       /* packetlen must be bigger than 40 */
 260 +       /* first 4 bytes are zero */
 261 +       if (packet_len > 40 && get_u32(haystack, 8) == 0x00000000)
 262 +       {
 263 +               /* first rule: 00 00 00 00 01 00 00 xx xx xx xx 00 00 00 00*/
 264 +               if (get_u32(haystack, 12) == 0x00000000 &&
 265 +                   get_u32(haystack, 16) == 0x00010000 &&
 266 +                   get_u32(haystack, 24) == 0x00000000 )
 267 +                       return (IPP2P_BIT * 100 + 71);
 268 +
 269 +               /* 00 01 00 00 0d 00 00 xx xx xx xx 00 00 00 00*/
 270 +               if (get_u32(haystack, 12) == 0x00000001 &&
 271 +                   get_u32(haystack, 16) == 0x000d0000 &&
 272 +                   get_u32(haystack, 24) == 0x00000000 )
 273 +                       return (IPP2P_BIT * 100 + 71);
 274 +
 275 +
 276 +       }
 277 +#endif
 278 +
 279 +    return 0;
 280 +}/*udp_search_bit*/
 281 +
 282 +
 283 +
 284 +/*Search for Ares commands*/
 285 +//#define IPP2P_DEBUG_ARES
 286 +int
 287 +search_ares (const unsigned char *payload, const u16 plen)
 288 +//int search_ares (unsigned char *haystack, int packet_len, int head_len)
 289 +{
 290 +//     const unsigned char *t = haystack + head_len;
 291 +
 292 +       /* all ares packets start with  */
 293 +       if (payload[1] == 0 && (plen - payload[0]) == 3)
 294 +       {
 295 +               switch (payload[2])
 296 +               {
 297 +                       case 0x5a:
 298 +                               /* ares connect */
 299 +                               if ( plen == 6 && payload[5] == 0x05 ) return ((IPP2P_ARES * 100) + 1);
 300 +                               break;
 301 +                       case 0x09:
 302 +                               /* ares search, min 3 chars --> 14 bytes
 303 +                                * lets define a search can be up to 30 chars --> max 34 bytes
 304 +                                */
 305 +                               if ( plen >= 14 && plen <= 34 ) return ((IPP2P_ARES * 100) + 1);
 306 +                               break;
 307 +#ifdef IPP2P_DEBUG_ARES
 308 +                       default:
 309 +                       printk(KERN_DEBUG "Unknown Ares command %x recognized, len: %u \n", (unsigned int) payload[2],plen);
 310 +#endif /* IPP2P_DEBUG_ARES */
 311 +               }
 312 +       }
 313 +
 314 +#if 0
 315 +       /* found connect packet: 03 00 5a 04 03 05 */
 316 +       /* new version ares 1.8: 03 00 5a xx xx 05 */
 317 +    if ((plen) == 6){  /* possible connect command*/
 318 +       if ((payload[0] == 0x03) && (payload[1] == 0x00) && (payload[2] == 0x5a) && (payload[5] == 0x05))
 319 +           return ((IPP2P_ARES * 100) + 1);
 320 +    }
 321 +    if ((plen) == 60){ /* possible download command*/
 322 +       if ((payload[59] == 0x0a) && (payload[58] == 0x0a)){
 323 +           if (memcmp(t, "PUSH SHA1:", 10) == 0) /* found download command */
 324 +               return ((IPP2P_ARES * 100) + 2);
 325 +       }
 326 +    }
 327 +#endif
 328 +
 329 +    return 0;
 330 +} /*search_ares*/
 331 +
 332 +/*Search for SoulSeek commands*/
 333 +int
 334 +search_soul (const unsigned char *payload, const u16 plen)
 335 +{
 336 +//#define IPP2P_DEBUG_SOUL
 337 +    /* match: xx xx xx xx | xx = sizeof(payload) - 4 */
 338 +    if (get_u32(payload, 0) == (plen - 4)){
 339 +       const __u32 m=get_u32(payload, 4);
 340 +       /* match 00 yy yy 00, yy can be everything */
 341 +        if ( get_u8(payload, 4) == 0x00 && get_u8(payload, 7) == 0x00 )
 342 +       {
 343 +#ifdef IPP2P_DEBUG_SOUL
 344 +       printk(KERN_DEBUG "0: Soulseek command 0x%x recognized\n",get_u32(payload, 4));
 345 +#endif /* IPP2P_DEBUG_SOUL */
 346 +               return ((IPP2P_SOUL * 100) + 1);
 347 +       }
 348 +
 349 +        /* next match: 01 yy 00 00 | yy can be everything */
 350 +        if ( get_u8(payload, 4) == 0x01 && get_u16(payload, 6) == 0x0000 )
 351 +       {
 352 +#ifdef IPP2P_DEBUG_SOUL
 353 +       printk(KERN_DEBUG "1: Soulseek command 0x%x recognized\n",get_u16(payload, 4));
 354 +#endif /* IPP2P_DEBUG_SOUL */
 355 +               return ((IPP2P_SOUL * 100) + 2);
 356 +       }
 357 +
 358 +       /* other soulseek commandos are: 1-5,7,9,13-18,22,23,26,28,35-37,40-46,50,51,60,62-69,91,92,1001 */
 359 +       /* try to do this in an intelligent way */
 360 +       /* get all small commandos */
 361 +       switch(m)
 362 +       {
 363 +               case 7:
 364 +               case 9:
 365 +               case 22:
 366 +               case 23:
 367 +               case 26:
 368 +               case 28:
 369 +               case 50:
 370 +               case 51:
 371 +               case 60:
 372 +               case 91:
 373 +               case 92:
 374 +               case 1001:
 375 +#ifdef IPP2P_DEBUG_SOUL
 376 +               printk(KERN_DEBUG "2: Soulseek command 0x%x recognized\n",get_u16(payload, 4));
 377 +#endif /* IPP2P_DEBUG_SOUL */
 378 +               return ((IPP2P_SOUL * 100) + 3);
 379 +       }
 380 +
 381 +       if (m > 0 && m < 6 )
 382 +       {
 383 +#ifdef IPP2P_DEBUG_SOUL
 384 +               printk(KERN_DEBUG "3: Soulseek command 0x%x recognized\n",get_u16(payload, 4));
 385 +#endif /* IPP2P_DEBUG_SOUL */
 386 +               return ((IPP2P_SOUL * 100) + 4);
 387 +       }
 388 +       if (m > 12 && m < 19 )
 389 +       {
 390 +#ifdef IPP2P_DEBUG_SOUL
 391 +               printk(KERN_DEBUG "4: Soulseek command 0x%x recognized\n",get_u16(payload, 4));
 392 +#endif /* IPP2P_DEBUG_SOUL */
 393 +               return ((IPP2P_SOUL * 100) + 5);
 394 +       }
 395 +
 396 +       if (m > 34 && m < 38 )
 397 +       {
 398 +#ifdef IPP2P_DEBUG_SOUL
 399 +               printk(KERN_DEBUG "5: Soulseek command 0x%x recognized\n",get_u16(payload, 4));
 400 +#endif /* IPP2P_DEBUG_SOUL */
 401 +               return ((IPP2P_SOUL * 100) + 6);
 402 +       }
 403 +
 404 +       if (m > 39 && m < 47 )
 405 +       {
 406 +#ifdef IPP2P_DEBUG_SOUL
 407 +               printk(KERN_DEBUG "6: Soulseek command 0x%x recognized\n",get_u16(payload, 4));
 408 +#endif /* IPP2P_DEBUG_SOUL */
 409 +               return ((IPP2P_SOUL * 100) + 7);
 410 +       }
 411 +
 412 +       if (m > 61 && m < 70 )
 413 +       {
 414 +#ifdef IPP2P_DEBUG_SOUL
 415 +               printk(KERN_DEBUG "7: Soulseek command 0x%x recognized\n",get_u16(payload, 4));
 416 +#endif /* IPP2P_DEBUG_SOUL */
 417 +               return ((IPP2P_SOUL * 100) + 8);
 418 +       }
 419 +
 420 +#ifdef IPP2P_DEBUG_SOUL
 421 +       printk(KERN_DEBUG "unknown SOULSEEK command: 0x%x, first 16 bit: 0x%x, first 8 bit: 0x%x ,soulseek ???\n",get_u32(payload, 4),get_u16(payload, 4) >> 16,get_u8(payload, 4) >> 24);
 422 +#endif /* IPP2P_DEBUG_SOUL */
 423 +    }
 424 +
 425 +       /* match 14 00 00 00 01 yy 00 00 00 STRING(YY) 01 00 00 00 00 46|50 00 00 00 00 */
 426 +       /* without size at the beginning !!! */
 427 +       if ( get_u32(payload, 0) == 0x14 && get_u8(payload, 4) == 0x01 )
 428 +       {
 429 +               __u32 y=get_u32(payload, 5);
 430 +               /* we need 19 chars + string */
 431 +               if ( (y + 19) <= (plen) )
 432 +               {
 433 +                       const unsigned char *w=payload+9+y;
 434 +                       if (get_u32(w, 0) == 0x01 && ( get_u16(w, 4) == 0x4600 || get_u16(w, 4) == 0x5000) && get_u32(w, 6) == 0x00);
 435 +#ifdef IPP2P_DEBUG_SOUL
 436 +                       printk(KERN_DEBUG "Soulssek special client command recognized\n");
 437 +#endif /* IPP2P_DEBUG_SOUL */
 438 +                       return ((IPP2P_SOUL * 100) + 9);
 439 +               }
 440 +       }
 441 +    return 0;
 442 +}
 443 +
 444 +
 445 +/*Search for WinMX commands*/
 446 +int
 447 +search_winmx (const unsigned char *payload, const u16 plen)
 448 +{
 449 +//#define IPP2P_DEBUG_WINMX
 450 +    if (((plen) == 4) && (memcmp(payload, "SEND", 4) == 0))  return ((IPP2P_WINMX * 100) + 1);
 451 +    if (((plen) == 3) && (memcmp(payload, "GET", 3) == 0))  return ((IPP2P_WINMX * 100) + 2);
 452 +    //if (packet_len < (head_len + 10)) return 0;
 453 +    if (plen < 10) return 0;
 454 +
 455 +    if ((memcmp(payload, "SEND", 4) == 0) || (memcmp(payload, "GET", 3) == 0)){
 456 +        u16 c=4;
 457 +        const u16 end=plen-2;
 458 +        u8 count=0;
 459 +        while (c < end)
 460 +        {
 461 +               if (payload[c]== 0x20 && payload[c+1] == 0x22)
 462 +               {
 463 +                       c++;
 464 +                       count++;
 465 +                       if (count>=2) return ((IPP2P_WINMX * 100) + 3);
 466 +               }
 467 +               c++;
 468 +        }
 469 +    }
 470 +
 471 +    if ( plen == 149 && payload[0] == '8' )
 472 +    {
 473 +#ifdef IPP2P_DEBUG_WINMX
 474 +       printk(KERN_INFO "maybe WinMX\n");
 475 +#endif
 476 +       if (get_u32(payload,17) == 0 && get_u32(payload,21) == 0 && get_u32(payload,25) == 0 &&
 477 +//         get_u32(payload,33) == __constant_htonl(0x71182b1a) && get_u32(payload,37) == __constant_htonl(0x05050000) &&
 478 +//         get_u32(payload,133) == __constant_htonl(0x31097edf) && get_u32(payload,145) == __constant_htonl(0xdcb8f792))
 479 +           get_u16(payload,39) == 0 && get_u16(payload,135) == __constant_htons(0x7edf) && get_u16(payload,147) == __constant_htons(0xf792))
 480 +
 481 +       {
 482 +#ifdef IPP2P_DEBUG_WINMX
 483 +               printk(KERN_INFO "got WinMX\n");
 484 +#endif
 485 +               return ((IPP2P_WINMX * 100) + 4);
 486 +       }
 487 +    }
 488 +    return 0;
 489 +} /*search_winmx*/
 490 +
 491 +
 492 +/*Search for appleJuice commands*/
 493 +int
 494 +search_apple (const unsigned char *payload, const u16 plen)
 495 +{
 496 +    if ( (plen > 7) && (payload[6] == 0x0d) && (payload[7] == 0x0a) && (memcmp(payload, "ajprot", 6) == 0))  return (IPP2P_APPLE * 100);
 497 +
 498 +    return 0;
 499 +}
 500 +
 501 +
 502 +/*Search for BitTorrent commands*/
 503 +int
 504 +search_bittorrent (const unsigned char *payload, const u16 plen)
 505 +{
 506 +    if (plen > 20)
 507 +    {
 508 +       /* test for match 0x13+"BitTorrent protocol" */
 509 +       if (payload[0] == 0x13)
 510 +       {
 511 +               if (memcmp(payload+1, "BitTorrent protocol", 19) == 0) return (IPP2P_BIT * 100);
 512 +       }
 513 +
 514 +       /* get tracker commandos, all starts with GET /
 515 +       * then it can follow: scrape| announce
 516 +       * and then ?hash_info=
 517 +       */
 518 +       if (memcmp(payload,"GET /",5) == 0)
 519 +       {
 520 +               /* message scrape */
 521 +               if ( memcmp(payload+5,"scrape?info_hash=",17)==0 ) return (IPP2P_BIT * 100 + 1);
 522 +               /* message announce */
 523 +               if ( memcmp(payload+5,"announce?info_hash=",19)==0 ) return (IPP2P_BIT * 100 + 2);
 524 +       }
 525 +    }
 526 +    else
 527 +    {
 528 +       /* bitcomet encryptes the first packet, so we have to detect another
 529 +        * one later in the flow */
 530 +        /* first try failed, too many missdetections */
 531 +       //if ( size == 5 && get_u32(t,0) == __constant_htonl(1) && t[4] < 3) return (IPP2P_BIT * 100 + 3);
 532 +
 533 +       /* second try: block request packets */
 534 +       if ( plen == 17 && get_u32(payload,0) == __constant_htonl(0x0d) && payload[4] == 0x06 && get_u32(payload,13) == __constant_htonl(0x4000) ) return (IPP2P_BIT * 100 + 3);
 535 +    }
 536 +
 537 +    return 0;
 538 +}
 539 +
 540 +
 541 +
 542 +/*check for Kazaa get command*/
 543 +int
 544 +search_kazaa (const unsigned char *payload, const u16 plen)
 545 +
 546 +{
 547 +    if ((payload[plen-2] == 0x0d) && (payload[plen-1] == 0x0a) && memcmp(payload, "GET /.hash=", 11) == 0)
 548 +       return (IPP2P_DATA_KAZAA * 100);
 549 +
 550 +    return 0;
 551 +}
 552 +
 553 +
 554 +/*check for gnutella get command*/
 555 +int
 556 +search_gnu (const unsigned char *payload, const u16 plen)
 557 +{
 558 +    if ((payload[plen-2] == 0x0d) && (payload[plen-1] == 0x0a))
 559 +    {
 560 +       if (memcmp(payload, "GET /get/", 9) == 0)       return ((IPP2P_DATA_GNU * 100) + 1);
 561 +       if (memcmp(payload, "GET /uri-res/", 13) == 0) return ((IPP2P_DATA_GNU * 100) + 2);
 562 +    }
 563 +    return 0;
 564 +}
 565 +
 566 +
 567 +/*check for gnutella get commands and other typical data*/
 568 +int
 569 +search_all_gnu (const unsigned char *payload, const u16 plen)
 570 +{
 571 +
 572 +    if ((payload[plen-2] == 0x0d) && (payload[plen-1] == 0x0a))
 573 +    {
 574 +
 575 +       if (memcmp(payload, "GNUTELLA CONNECT/", 17) == 0) return ((IPP2P_GNU * 100) + 1);
 576 +       if (memcmp(payload, "GNUTELLA/", 9) == 0) return ((IPP2P_GNU * 100) + 2);
 577 +
 578 +
 579 +       if ((memcmp(payload, "GET /get/", 9) == 0) || (memcmp(payload, "GET /uri-res/", 13) == 0))
 580 +       {
 581 +               u16 c=8;
 582 +               const u16 end=plen-22;
 583 +               while (c < end) {
 584 +                       if ( payload[c] == 0x0a && payload[c+1] == 0x0d && ((memcmp(&payload[c+2], "X-Gnutella-", 11) == 0) || (memcmp(&payload[c+2], "X-Queue:", 8) == 0)))
 585 +                               return ((IPP2P_GNU * 100) + 3);
 586 +                       c++;
 587 +               }
 588 +       }
 589 +    }
 590 +    return 0;
 591 +}
 592 +
 593 +
 594 +/*check for KaZaA download commands and other typical data*/
 595 +int
 596 +search_all_kazaa (const unsigned char *payload, const u16 plen)
 597 +{
 598 +    if ((payload[plen-2] == 0x0d) && (payload[plen-1] == 0x0a))
 599 +    {
 600 +
 601 +       if (memcmp(payload, "GIVE ", 5) == 0) return ((IPP2P_KAZAA * 100) + 1);
 602 +
 603 +       if (memcmp(payload, "GET /", 5) == 0) {
 604 +               u16 c = 8;
 605 +               const u16 end=plen-22;
 606 +               while (c < end) {
 607 +                       if ( payload[c] == 0x0a && payload[c+1] == 0x0d && ((memcmp(&payload[c+2], "X-Kazaa-Username: ", 18) == 0) || (memcmp(&payload[c+2], "User-Agent: PeerEnabler/", 24) == 0)))
 608 +                               return ((IPP2P_KAZAA * 100) + 2);
 609 +                       c++;
 610 +               }
 611 +       }
 612 +    }
 613 +    return 0;
 614 +}
 615 +
 616 +/*fast check for edonkey file segment transfer command*/
 617 +int
 618 +search_edk (const unsigned char *payload, const u16 plen)
 619 +{
 620 +    if (payload[0] != 0xe3)
 621 +       return 0;
 622 +    else {
 623 +       if (payload[5] == 0x47)
 624 +           return (IPP2P_DATA_EDK * 100);
 625 +       else
 626 +           return 0;
 627 +    }
 628 +}
 629 +
 630 +
 631 +
 632 +/*intensive but slower search for some edonkey packets including size-check*/
 633 +int
 634 +search_all_edk (const unsigned char *payload, const u16 plen)
 635 +{
 636 +    if (payload[0] != 0xe3)
 637 +       return 0;
 638 +    else {
 639 +       //t += head_len;
 640 +       const u16 cmd = get_u16(payload, 1);
 641 +       if (cmd == (plen - 5)) {
 642 +           switch (payload[5]) {
 643 +               case 0x01: return ((IPP2P_EDK * 100) + 1);      /*Client: hello or Server:hello*/
 644 +               case 0x4c: return ((IPP2P_EDK * 100) + 9);      /*Client: Hello-Answer*/
 645 +           }
 646 +       }
 647 +       return 0;
 648 +     }
 649 +}
 650 +
 651 +
 652 +/*fast check for Direct Connect send command*/
 653 +int
 654 +search_dc (const unsigned char *payload, const u16 plen)
 655 +{
 656 +
 657 +    if (payload[0] != 0x24 )
 658 +       return 0;
 659 +    else {
 660 +       if (memcmp(&payload[1], "Send|", 5) == 0)
 661 +           return (IPP2P_DATA_DC * 100);
 662 +       else
 663 +           return 0;
 664 +    }
 665 +
 666 +}
 667 +
 668 +
 669 +/*intensive but slower check for all direct connect packets*/
 670 +int
 671 +search_all_dc (const unsigned char *payload, const u16 plen)
 672 +{
 673 +//    unsigned char *t = haystack;
 674 +
 675 +    if (payload[0] == 0x24 && payload[plen-1] == 0x7c)
 676 +    {
 677 +       const unsigned char *t=&payload[1];
 678 +               /* Client-Hub-Protocol */
 679 +       if (memcmp(t, "Lock ", 5) == 0)                 return ((IPP2P_DC * 100) + 1);
 680 +       /* Client-Client-Protocol, some are already recognized by client-hub (like lock) */
 681 +       if (memcmp(t, "MyNick ", 7) == 0)               return ((IPP2P_DC * 100) + 38);
 682 +    }
 683 +    return 0;
 684 +}
 685 +
 686 +/*check for mute*/
 687 +int
 688 +search_mute (const unsigned char *payload, const u16 plen)
 689 +{
 690 +       if ( plen == 209 || plen == 345 || plen == 473 || plen == 609 || plen == 1121 )
 691 +       {
 692 +               //printk(KERN_DEBUG "size hit: %u",size);
 693 +               if (memcmp(payload,"PublicKey: ",11) == 0 )
 694 +               {
 695 +                       return ((IPP2P_MUTE * 100) + 0);
 696 +
 697 +/*                     if (memcmp(t+size-14,"\x0aEndPublicKey\x0a",14) == 0)
 698 +                       {
 699 +                               printk(KERN_DEBUG "end pubic key hit: %u",size);
 700 +
 701 +                       }*/
 702 +               }
 703 +       }
 704 +       return 0;
 705 +}
 706 +
 707 +
 708 +/* check for xdcc */
 709 +int
 710 +search_xdcc (const unsigned char *payload, const u16 plen)
 711 +{
 712 +       /* search in small packets only */
 713 +       if (plen > 20 && plen < 200 && payload[plen-1] == 0x0a && payload[plen-2] == 0x0d && memcmp(payload,"PRIVMSG ",8) == 0)
 714 +       {
 715 +
 716 +               u16 x=10;
 717 +               const u16 end=plen - 13;
 718 +
 719 +               /* is seems to be a irc private massage, chedck for xdcc command */
 720 +               while (x < end)
 721 +               {
 722 +                       if (payload[x] == ':')
 723 +                       {
 724 +                               if ( memcmp(&payload[x+1],"xdcc send #",11) == 0 )
 725 +                                       return ((IPP2P_XDCC * 100) + 0);
 726 +                       }
 727 +                       x++;
 728 +               }
 729 +       }
 730 +       return 0;
 731 +}
 732 +
 733 +/* search for waste */
 734 +int search_waste(const unsigned char *payload, const u16 plen)
 735 +{
 736 +       if ( plen >= 8 && memcmp(payload,"GET.sha1:",9) == 0)
 737 +               return ((IPP2P_WASTE * 100) + 0);
 738 +
 739 +       return 0;
 740 +}
 741 +
 742 +
 743 +static struct {
 744 +    int command;
 745 +    __u8 short_hand;                   /*for fucntions included in short hands*/
 746 +    int packet_len;
 747 +    int (*function_name) (const unsigned char *, const u16);
 748 +} matchlist[] = {
 749 +    {IPP2P_EDK,SHORT_HAND_IPP2P,20, &search_all_edk},
 750 +//    {IPP2P_DATA_KAZAA,SHORT_HAND_DATA,200, &search_kazaa},
 751 +//    {IPP2P_DATA_EDK,SHORT_HAND_DATA,60, &search_edk},
 752 +//    {IPP2P_DATA_DC,SHORT_HAND_DATA,26, &search_dc},
 753 +    {IPP2P_DC,SHORT_HAND_IPP2P,5, search_all_dc},
 754 +//    {IPP2P_DATA_GNU,SHORT_HAND_DATA,40, &search_gnu},
 755 +    {IPP2P_GNU,SHORT_HAND_IPP2P,5, &search_all_gnu},
 756 +    {IPP2P_KAZAA,SHORT_HAND_IPP2P,5, &search_all_kazaa},
 757 +    {IPP2P_BIT,SHORT_HAND_IPP2P,20, &search_bittorrent},
 758 +    {IPP2P_APPLE,SHORT_HAND_IPP2P,5, &search_apple},
 759 +    {IPP2P_SOUL,SHORT_HAND_IPP2P,5, &search_soul},
 760 +    {IPP2P_WINMX,SHORT_HAND_IPP2P,2, &search_winmx},
 761 +    {IPP2P_ARES,SHORT_HAND_IPP2P,5, &search_ares},
 762 +    {IPP2P_MUTE,SHORT_HAND_NONE,200, &search_mute},
 763 +    {IPP2P_WASTE,SHORT_HAND_NONE,5, &search_waste},
 764 +    {IPP2P_XDCC,SHORT_HAND_NONE,5, &search_xdcc},
 765 +    {0,0,0,NULL}
 766 +};
 767 +
 768 +
 769 +static struct {
 770 +    int command;
 771 +    __u8 short_hand;                   /*for fucntions included in short hands*/
 772 +    int packet_len;
 773 +    int (*function_name) (unsigned char *, int);
 774 +} udp_list[] = {
 775 +    {IPP2P_KAZAA,SHORT_HAND_IPP2P,14, &udp_search_kazaa},
 776 +    {IPP2P_BIT,SHORT_HAND_IPP2P,23, &udp_search_bit},
 777 +    {IPP2P_GNU,SHORT_HAND_IPP2P,11, &udp_search_gnu},
 778 +    {IPP2P_EDK,SHORT_HAND_IPP2P,9, &udp_search_edk},
 779 +    {IPP2P_DC,SHORT_HAND_IPP2P,12, &udp_search_directconnect},
 780 +    {0,0,0,NULL}
 781 +};
 782 +
 783 +
 784 +static int
 785 +match(const struct sk_buff *skb,
 786 +      const struct net_device *in,
 787 +      const struct net_device *out,
 788 +      const void *matchinfo,
 789 +      int offset,
 790 +
 791 +#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,0)
 792 +      const void *hdr,
 793 +      u_int16_t datalen,
 794 +#endif
 795 +
 796 +      int *hotdrop)
 797 +{
 798 +    const struct ipt_p2p_info *info = matchinfo;
 799 +    unsigned char  *haystack;
 800 +    struct iphdr *ip = skb->nh.iph;
 801 +    int p2p_result = 0, i = 0;
 802 +//    int head_len;
 803 +    int hlen = ntohs(ip->tot_len)-(ip->ihl*4); /*hlen = packet-data length*/
 804 +
 805 +    /*must not be a fragment*/
 806 +    if (offset) {
 807 +       if (info->debug) printk("IPP2P.match: offset found %i \n",offset);
 808 +       return 0;
 809 +    }
 810 +
 811 +    /*make sure that skb is linear*/
 812 +    if(skb_is_nonlinear(skb)){
 813 +       if (info->debug) printk("IPP2P.match: nonlinear skb found\n");
 814 +       return 0;
 815 +    }
 816 +
 817 +
 818 +    haystack=(char *)ip+(ip->ihl*4);           /*haystack = packet data*/
 819 +
 820 +    switch (ip->protocol){
 821 +       case IPPROTO_TCP:               /*what to do with a TCP packet*/
 822 +       {
 823 +           struct tcphdr *tcph = (void *) ip + ip->ihl * 4;
 824 +
 825 +           if (tcph->fin) return 0;  /*if FIN bit is set bail out*/
 826 +           if (tcph->syn) return 0;  /*if SYN bit is set bail out*/
 827 +           if (tcph->rst) return 0;  /*if RST bit is set bail out*/
 828 +
 829 +           haystack += tcph->doff * 4; /*get TCP-Header-Size*/
 830 +           hlen -= tcph->doff * 4;
 831 +           while (matchlist[i].command) {
 832 +               if ((((info->cmd & matchlist[i].command) == matchlist[i].command) ||
 833 +                   ((info->cmd & matchlist[i].short_hand) == matchlist[i].short_hand)) &&
 834 +                   (hlen > matchlist[i].packet_len)) {
 835 +                           p2p_result = matchlist[i].function_name(haystack, hlen);
 836 +                           if (p2p_result)
 837 +                           {
 838 +                               if (info->debug) printk("IPP2P.debug:TCP-match: %i from: %u.%u.%u.%u:%i to: %u.%u.%u.%u:%i Length: %i\n",
 839 +                                   p2p_result, NIPQUAD(ip->saddr),ntohs(tcph->source), NIPQUAD(ip->daddr),ntohs(tcph->dest),hlen);
 840 +                               return p2p_result;
 841 +                           }
 842 +               }
 843 +           i++;
 844 +           }
 845 +           return p2p_result;
 846 +       }
 847 +
 848 +       case IPPROTO_UDP:               /*what to do with an UDP packet*/
 849 +       {
 850 +           struct udphdr *udph = (void *) ip + ip->ihl * 4;
 851 +
 852 +           while (udp_list[i].command){
 853 +               if ((((info->cmd & udp_list[i].command) == udp_list[i].command) ||
 854 +                   ((info->cmd & udp_list[i].short_hand) == udp_list[i].short_hand)) &&
 855 +                   (hlen > udp_list[i].packet_len)) {
 856 +                           p2p_result = udp_list[i].function_name(haystack, hlen);
 857 +                           if (p2p_result){
 858 +                               if (info->debug) printk("IPP2P.debug:UDP-match: %i from: %u.%u.%u.%u:%i to: %u.%u.%u.%u:%i Length: %i\n",
 859 +                                   p2p_result, NIPQUAD(ip->saddr),ntohs(udph->source), NIPQUAD(ip->daddr),ntohs(udph->dest),hlen);
 860 +                               return p2p_result;
 861 +                           }
 862 +               }
 863 +           i++;
 864 +           }
 865 +           return p2p_result;
 866 +       }
 867 +
 868 +       default: return 0;
 869 +    }
 870 +}
 871 +
 872 +
 873 +
 874 +static int
 875 +checkentry(const char *tablename,
 876 +            const struct ipt_ip *ip,
 877 +           void *matchinfo,
 878 +           unsigned int matchsize,
 879 +           unsigned int hook_mask)
 880 +{
 881 +        /* Must specify -p tcp */
 882 +/*    if (ip->proto != IPPROTO_TCP || (ip->invflags & IPT_INV_PROTO)) {
 883 + *     printk("ipp2p: Only works on TCP packets, use -p tcp\n");
 884 + *     return 0;
 885 + *    }*/
 886 +    return 1;
 887 +}
 888 +
 889 +
 890 +
 891 +
 892 +static struct ipt_match ipp2p_match = {
 893 +#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,0)
 894 +       { NULL, NULL },
 895 +       "ipp2p",
 896 +       &match,
 897 +       &checkentry,
 898 +       NULL,
 899 +       THIS_MODULE
 900 +#endif
 901 +#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,0)
 902 +       .name           = "ipp2p",
 903 +       .match          = &match,
 904 +       .checkentry     = &checkentry,
 905 +       .me             = THIS_MODULE,
 906 +#endif
 907 +};
 908 +
 909 +
 910 +static int __init init(void)
 911 +{
 912 +    printk(KERN_INFO "IPP2P v%s loading\n", IPP2P_VERSION);
 913 +    return ipt_register_match(&ipp2p_match);
 914 +}
 915 +
 916 +static void __exit fini(void)
 917 +{
 918 +    ipt_unregister_match(&ipp2p_match);
 919 +    printk(KERN_INFO "IPP2P v%s unloaded\n", IPP2P_VERSION);
 920 +}
 921 +
 922 +module_init(init);
 923 +module_exit(fini);
 924 +
 925 +