target/linux/generic-2.6/patches/110-ipp2p_0.8.1rc1.patch

   1 diff -urN linux-2.6.21.1.old/include/linux/netfilter_ipv4/ipt_ipp2p.h linux-2.6.21.1.dev/include/linux/netfilter_ipv4/ipt_ipp2p.h
   2 --- linux-2.6.21.1.old/include/linux/netfilter_ipv4/ipt_ipp2p.h 1970-01-01 01:00:00.000000000 +0100
   3 +++ linux-2.6.21.1.dev/include/linux/netfilter_ipv4/ipt_ipp2p.h 2007-05-26 20:21:54.586864296 +0200
   4 @@ -0,0 +1,31 @@
   5 +#ifndef __IPT_IPP2P_H
   6 +#define __IPT_IPP2P_H
   7 +#define IPP2P_VERSION "0.8.1_rc1"
   8 +
   9 +struct ipt_p2p_info {
  10 +    int cmd;
  11 +    int debug;
  12 +};
  13 +
  14 +#endif //__IPT_IPP2P_H
  15 +
  16 +#define SHORT_HAND_IPP2P       1 /* --ipp2p switch*/
  17 +//#define SHORT_HAND_DATA              4 /* --ipp2p-data switch*/
  18 +#define SHORT_HAND_NONE                5 /* no short hand*/
  19 +
  20 +#define IPP2P_EDK              (1 << 1)
  21 +#define IPP2P_DATA_KAZAA       (1 << 2)
  22 +#define IPP2P_DATA_EDK         (1 << 3)
  23 +#define IPP2P_DATA_DC          (1 << 4)
  24 +#define IPP2P_DC               (1 << 5)
  25 +#define IPP2P_DATA_GNU         (1 << 6)
  26 +#define IPP2P_GNU              (1 << 7)
  27 +#define IPP2P_KAZAA            (1 << 8)
  28 +#define IPP2P_BIT              (1 << 9)
  29 +#define IPP2P_APPLE            (1 << 10)
  30 +#define IPP2P_SOUL             (1 << 11)
  31 +#define IPP2P_WINMX            (1 << 12)
  32 +#define IPP2P_ARES             (1 << 13)
  33 +#define IPP2P_MUTE             (1 << 14)
  34 +#define IPP2P_WASTE            (1 << 15)
  35 +#define IPP2P_XDCC             (1 << 16)
  36 diff -urN linux-2.6.21.1.old/net/ipv4/netfilter/ipt_ipp2p.c linux-2.6.21.1.dev/net/ipv4/netfilter/ipt_ipp2p.c
  37 --- linux-2.6.21.1.old/net/ipv4/netfilter/ipt_ipp2p.c   1970-01-01 01:00:00.000000000 +0100
  38 +++ linux-2.6.21.1.dev/net/ipv4/netfilter/ipt_ipp2p.c   2007-05-26 20:21:54.587864144 +0200
  39 @@ -0,0 +1,881 @@
  40 +#if defined(MODVERSIONS)
  41 +#include <linux/modversions.h>
  42 +#endif
  43 +#include <linux/module.h>
  44 +#include <linux/netfilter_ipv4/ip_tables.h>
  45 +#include <linux/version.h>
  46 +#include <linux/netfilter_ipv4/ipt_ipp2p.h>
  47 +#include <net/tcp.h>
  48 +#include <net/udp.h>
  49 +
  50 +#define get_u8(X,O)  (*(__u8 *)(X + O))
  51 +#define get_u16(X,O)  (*(__u16 *)(X + O))
  52 +#define get_u32(X,O)  (*(__u32 *)(X + O))
  53 +
  54 +MODULE_AUTHOR("Eicke Friedrich/Klaus Degner <ipp2p@ipp2p.org>");
  55 +MODULE_DESCRIPTION("An extension to iptables to identify P2P traffic.");
  56 +MODULE_LICENSE("GPL");
  57 +
  58 +
  59 +/*Search for UDP eDonkey/eMule/Kad commands*/
  60 +int
  61 +udp_search_edk (unsigned char *haystack, int packet_len)
  62 +{
  63 +    unsigned char *t = haystack;
  64 +    t += 8;
  65 +
  66 +       switch (t[0]) {
  67 +               case 0xe3:
  68 +               {       /*edonkey*/
  69 +                       switch (t[1])
  70 +                       {
  71 +                               /* client -> server status request */
  72 +                               case 0x96:
  73 +                                       if (packet_len == 14) return ((IPP2P_EDK * 100) + 50);
  74 +                                       break;
  75 +                               /* server -> client status request */
  76 +                               case 0x97: if (packet_len == 42) return ((IPP2P_EDK * 100) + 51);
  77 +                                       break;
  78 +                                               /* server description request */
  79 +                                               /* e3 2a ff f0 .. | size == 6 */
  80 +                               case 0xa2: if ( (packet_len == 14) && ( get_u16(t,2) == __constant_htons(0xfff0) ) ) return ((IPP2P_EDK * 100) + 52);
  81 +                                       break;
  82 +                                               /* server description response */
  83 +                                               /* e3 a3 ff f0 ..  | size > 40 && size < 200 */
  84 +                               //case 0xa3: return ((IPP2P_EDK * 100) + 53);
  85 +                               //      break;
  86 +                               case 0x9a: if (packet_len==26) return ((IPP2P_EDK * 100) + 54);
  87 +                                       break;
  88 +
  89 +                               case 0x92: if (packet_len==18) return ((IPP2P_EDK * 100) + 55);
  90 +                                       break;
  91 +                       }
  92 +                       break;
  93 +               }
  94 +               case 0xe4:
  95 +               {
  96 +                       switch (t[1])
  97 +                       {
  98 +                                               /* e4 20 .. | size == 43 */
  99 +                               case 0x20: if ((packet_len == 43) && (t[2] != 0x00) && (t[34] != 0x00)) return ((IPP2P_EDK * 100) + 60);
 100 +                                       break;
 101 +                                               /* e4 00 .. 00 | size == 35 ? */
 102 +                               case 0x00: if ((packet_len == 35) && (t[26] == 0x00)) return ((IPP2P_EDK * 100) + 61);
 103 +                                       break;
 104 +                                               /* e4 10 .. 00 | size == 35 ? */
 105 +                               case 0x10: if ((packet_len == 35) && (t[26] == 0x00)) return ((IPP2P_EDK * 100) + 62);
 106 +                                       break;
 107 +                                               /* e4 18 .. 00 | size == 35 ? */
 108 +                               case 0x18: if ((packet_len == 35) && (t[26] == 0x00)) return ((IPP2P_EDK * 100) + 63);
 109 +                                       break;
 110 +                                               /* e4 52 .. | size = 44 */
 111 +                               case 0x52: if (packet_len == 44 ) return ((IPP2P_EDK * 100) + 64);
 112 +                                       break;
 113 +                                               /* e4 58 .. | size == 6 */
 114 +                               case 0x58: if (packet_len == 14 ) return ((IPP2P_EDK * 100) + 65);
 115 +                                       break;
 116 +                                               /* e4 59 .. | size == 2 */
 117 +                               case 0x59: if (packet_len == 10 )return ((IPP2P_EDK * 100) + 66);
 118 +                                       break;
 119 +                                       /* e4 28 .. | packet_len == 52,77,102,127... */
 120 +                               case 0x28: if (((packet_len-52) % 25) == 0) return ((IPP2P_EDK * 100) + 67);
 121 +                                       break;
 122 +                                       /* e4 50 xx xx | size == 4 */
 123 +                               case 0x50: if (packet_len == 12) return ((IPP2P_EDK * 100) + 68);
 124 +                                       break;
 125 +                                       /* e4 40 xx xx | size == 48 */
 126 +                               case 0x40: if (packet_len == 56) return ((IPP2P_EDK * 100) + 69);
 127 +                                       break;
 128 +                       }
 129 +                       break;
 130 +               }
 131 +       } /* end of switch (t[0]) */
 132 +    return 0;
 133 +}/*udp_search_edk*/
 134 +
 135 +
 136 +/*Search for UDP Gnutella commands*/
 137 +int
 138 +udp_search_gnu (unsigned char *haystack, int packet_len)
 139 +{
 140 +    unsigned char *t = haystack;
 141 +    t += 8;
 142 +
 143 +    if (memcmp(t, "GND", 3) == 0) return ((IPP2P_GNU * 100) + 51);
 144 +    if (memcmp(t, "GNUTELLA ", 9) == 0) return ((IPP2P_GNU * 100) + 52);
 145 +    return 0;
 146 +}/*udp_search_gnu*/
 147 +
 148 +
 149 +/*Search for UDP KaZaA commands*/
 150 +int
 151 +udp_search_kazaa (unsigned char *haystack, int packet_len)
 152 +{
 153 +    unsigned char *t = haystack;
 154 +
 155 +    if (t[packet_len-1] == 0x00){
 156 +       t += (packet_len - 6);
 157 +       if (memcmp(t, "KaZaA", 5) == 0) return (IPP2P_KAZAA * 100 +50);
 158 +    }
 159 +
 160 +    return 0;
 161 +}/*udp_search_kazaa*/
 162 +
 163 +/*Search for UDP DirectConnect commands*/
 164 +int
 165 +udp_search_directconnect (unsigned char *haystack, int packet_len)
 166 +{
 167 +    unsigned char *t = haystack;
 168 +    if ((*(t + 8) == 0x24) && (*(t + packet_len - 1) == 0x7c)) {
 169 +       t+=8;
 170 +       if (memcmp(t, "SR ", 3) == 0)                   return ((IPP2P_DC * 100) + 60);
 171 +       if (memcmp(t, "Ping ", 5) == 0)                 return ((IPP2P_DC * 100) + 61);
 172 +    }
 173 +    return 0;
 174 +}/*udp_search_directconnect*/
 175 +
 176 +
 177 +
 178 +/*Search for UDP BitTorrent commands*/
 179 +int
 180 +udp_search_bit (unsigned char *haystack, int packet_len)
 181 +{
 182 +       switch(packet_len)
 183 +       {
 184 +               case 24:
 185 +                       /* ^ 00 00 04 17 27 10 19 80 */
 186 +                       if ((ntohl(get_u32(haystack, 8)) == 0x00000417) && (ntohl(get_u32(haystack, 12)) == 0x27101980))
 187 +                               return (IPP2P_BIT * 100 + 50);
 188 +                       break;
 189 +               case 44:
 190 +                       if (get_u32(haystack, 16) == __constant_htonl(0x00000400) && get_u32(haystack, 36) == __constant_htonl(0x00000104))
 191 +                               return (IPP2P_BIT * 100 + 51);
 192 +                       if (get_u32(haystack, 16) == __constant_htonl(0x00000400))
 193 +                               return (IPP2P_BIT * 100 + 61);
 194 +                       break;
 195 +               case 65:
 196 +                       if (get_u32(haystack, 16) == __constant_htonl(0x00000404) && get_u32(haystack, 36) == __constant_htonl(0x00000104))
 197 +                               return (IPP2P_BIT * 100 + 52);
 198 +                       if (get_u32(haystack, 16) == __constant_htonl(0x00000404))
 199 +                               return (IPP2P_BIT * 100 + 62);
 200 +                       break;
 201 +               case 67:
 202 +                       if (get_u32(haystack, 16) == __constant_htonl(0x00000406) && get_u32(haystack, 36) == __constant_htonl(0x00000104))
 203 +                               return (IPP2P_BIT * 100 + 53);
 204 +                       if (get_u32(haystack, 16) == __constant_htonl(0x00000406))
 205 +                               return (IPP2P_BIT * 100 + 63);
 206 +                       break;
 207 +               case 211:
 208 +                       if (get_u32(haystack, 8) == __constant_htonl(0x00000405))
 209 +                               return (IPP2P_BIT * 100 + 54);
 210 +                       break;
 211 +               case 29:
 212 +                       if ((get_u32(haystack, 8) == __constant_htonl(0x00000401)))
 213 +                               return (IPP2P_BIT * 100 + 55);
 214 +                       break;
 215 +               case 52:
 216 +                       if (get_u32(haystack,8)  == __constant_htonl(0x00000827) &&
 217 +                       get_u32(haystack,12) == __constant_htonl(0x37502950))
 218 +                               return (IPP2P_BIT * 100 + 80);
 219 +                       break;
 220 +               default:
 221 +                       /* this packet does not have a constant size */
 222 +                       if (packet_len >= 40 && get_u32(haystack, 16) == __constant_htonl(0x00000402) && get_u32(haystack, 36) == __constant_htonl(0x00000104))
 223 +                               return (IPP2P_BIT * 100 + 56);
 224 +                       break;
 225 +       }
 226 +
 227 +       /* some extra-bitcomet rules:
 228 +       * "d1:" [a|r] "d2:id20:"
 229 +       */
 230 +       if (packet_len > 30 && get_u8(haystack, 8) == 'd' && get_u8(haystack, 9) == '1' && get_u8(haystack, 10) == ':' )
 231 +       {
 232 +               if (get_u8(haystack, 11) == 'a' || get_u8(haystack, 11) == 'r')
 233 +               {
 234 +                       if (memcmp(haystack+12,"d2:id20:",8)==0)
 235 +                               return (IPP2P_BIT * 100 + 57);
 236 +               }
 237 +       }
 238 +
 239 +#if 0
 240 +       /* bitlord rules */
 241 +       /* packetlen must be bigger than 40 */
 242 +       /* first 4 bytes are zero */
 243 +       if (packet_len > 40 && get_u32(haystack, 8) == 0x00000000)
 244 +       {
 245 +               /* first rule: 00 00 00 00 01 00 00 xx xx xx xx 00 00 00 00*/
 246 +               if (get_u32(haystack, 12) == 0x00000000 &&
 247 +                   get_u32(haystack, 16) == 0x00010000 &&
 248 +                   get_u32(haystack, 24) == 0x00000000 )
 249 +                       return (IPP2P_BIT * 100 + 71);
 250 +
 251 +               /* 00 01 00 00 0d 00 00 xx xx xx xx 00 00 00 00*/
 252 +               if (get_u32(haystack, 12) == 0x00000001 &&
 253 +                   get_u32(haystack, 16) == 0x000d0000 &&
 254 +                   get_u32(haystack, 24) == 0x00000000 )
 255 +                       return (IPP2P_BIT * 100 + 71);
 256 +
 257 +
 258 +       }
 259 +#endif
 260 +
 261 +    return 0;
 262 +}/*udp_search_bit*/
 263 +
 264 +
 265 +
 266 +/*Search for Ares commands*/
 267 +//#define IPP2P_DEBUG_ARES
 268 +int
 269 +search_ares (const unsigned char *payload, const u16 plen)
 270 +//int search_ares (unsigned char *haystack, int packet_len, int head_len)
 271 +{
 272 +//     const unsigned char *t = haystack + head_len;
 273 +
 274 +       /* all ares packets start with  */
 275 +       if (payload[1] == 0 && (plen - payload[0]) == 3)
 276 +       {
 277 +               switch (payload[2])
 278 +               {
 279 +                       case 0x5a:
 280 +                               /* ares connect */
 281 +                               if ( plen == 6 && payload[5] == 0x05 ) return ((IPP2P_ARES * 100) + 1);
 282 +                               break;
 283 +                       case 0x09:
 284 +                               /* ares search, min 3 chars --> 14 bytes
 285 +                                * lets define a search can be up to 30 chars --> max 34 bytes
 286 +                                */
 287 +                               if ( plen >= 14 && plen <= 34 ) return ((IPP2P_ARES * 100) + 1);
 288 +                               break;
 289 +#ifdef IPP2P_DEBUG_ARES
 290 +                       default:
 291 +                       printk(KERN_DEBUG "Unknown Ares command %x recognized, len: %u \n", (unsigned int) payload[2],plen);
 292 +#endif /* IPP2P_DEBUG_ARES */
 293 +               }
 294 +       }
 295 +
 296 +#if 0
 297 +       /* found connect packet: 03 00 5a 04 03 05 */
 298 +       /* new version ares 1.8: 03 00 5a xx xx 05 */
 299 +    if ((plen) == 6){  /* possible connect command*/
 300 +       if ((payload[0] == 0x03) && (payload[1] == 0x00) && (payload[2] == 0x5a) && (payload[5] == 0x05))
 301 +           return ((IPP2P_ARES * 100) + 1);
 302 +    }
 303 +    if ((plen) == 60){ /* possible download command*/
 304 +       if ((payload[59] == 0x0a) && (payload[58] == 0x0a)){
 305 +           if (memcmp(t, "PUSH SHA1:", 10) == 0) /* found download command */
 306 +               return ((IPP2P_ARES * 100) + 2);
 307 +       }
 308 +    }
 309 +#endif
 310 +
 311 +    return 0;
 312 +} /*search_ares*/
 313 +
 314 +/*Search for SoulSeek commands*/
 315 +int
 316 +search_soul (const unsigned char *payload, const u16 plen)
 317 +{
 318 +//#define IPP2P_DEBUG_SOUL
 319 +    /* match: xx xx xx xx | xx = sizeof(payload) - 4 */
 320 +    if (get_u32(payload, 0) == (plen - 4)){
 321 +       const __u32 m=get_u32(payload, 4);
 322 +       /* match 00 yy yy 00, yy can be everything */
 323 +        if ( get_u8(payload, 4) == 0x00 && get_u8(payload, 7) == 0x00 )
 324 +       {
 325 +#ifdef IPP2P_DEBUG_SOUL
 326 +       printk(KERN_DEBUG "0: Soulseek command 0x%x recognized\n",get_u32(payload, 4));
 327 +#endif /* IPP2P_DEBUG_SOUL */
 328 +               return ((IPP2P_SOUL * 100) + 1);
 329 +       }
 330 +
 331 +        /* next match: 01 yy 00 00 | yy can be everything */
 332 +        if ( get_u8(payload, 4) == 0x01 && get_u16(payload, 6) == 0x0000 )
 333 +       {
 334 +#ifdef IPP2P_DEBUG_SOUL
 335 +       printk(KERN_DEBUG "1: Soulseek command 0x%x recognized\n",get_u16(payload, 4));
 336 +#endif /* IPP2P_DEBUG_SOUL */
 337 +               return ((IPP2P_SOUL * 100) + 2);
 338 +       }
 339 +
 340 +       /* other soulseek commandos are: 1-5,7,9,13-18,22,23,26,28,35-37,40-46,50,51,60,62-69,91,92,1001 */
 341 +       /* try to do this in an intelligent way */
 342 +       /* get all small commandos */
 343 +       switch(m)
 344 +       {
 345 +               case 7:
 346 +               case 9:
 347 +               case 22:
 348 +               case 23:
 349 +               case 26:
 350 +               case 28:
 351 +               case 50:
 352 +               case 51:
 353 +               case 60:
 354 +               case 91:
 355 +               case 92:
 356 +               case 1001:
 357 +#ifdef IPP2P_DEBUG_SOUL
 358 +               printk(KERN_DEBUG "2: Soulseek command 0x%x recognized\n",get_u16(payload, 4));
 359 +#endif /* IPP2P_DEBUG_SOUL */
 360 +               return ((IPP2P_SOUL * 100) + 3);
 361 +       }
 362 +
 363 +       if (m > 0 && m < 6 )
 364 +       {
 365 +#ifdef IPP2P_DEBUG_SOUL
 366 +               printk(KERN_DEBUG "3: Soulseek command 0x%x recognized\n",get_u16(payload, 4));
 367 +#endif /* IPP2P_DEBUG_SOUL */
 368 +               return ((IPP2P_SOUL * 100) + 4);
 369 +       }
 370 +       if (m > 12 && m < 19 )
 371 +       {
 372 +#ifdef IPP2P_DEBUG_SOUL
 373 +               printk(KERN_DEBUG "4: Soulseek command 0x%x recognized\n",get_u16(payload, 4));
 374 +#endif /* IPP2P_DEBUG_SOUL */
 375 +               return ((IPP2P_SOUL * 100) + 5);
 376 +       }
 377 +
 378 +       if (m > 34 && m < 38 )
 379 +       {
 380 +#ifdef IPP2P_DEBUG_SOUL
 381 +               printk(KERN_DEBUG "5: Soulseek command 0x%x recognized\n",get_u16(payload, 4));
 382 +#endif /* IPP2P_DEBUG_SOUL */
 383 +               return ((IPP2P_SOUL * 100) + 6);
 384 +       }
 385 +
 386 +       if (m > 39 && m < 47 )
 387 +       {
 388 +#ifdef IPP2P_DEBUG_SOUL
 389 +               printk(KERN_DEBUG "6: Soulseek command 0x%x recognized\n",get_u16(payload, 4));
 390 +#endif /* IPP2P_DEBUG_SOUL */
 391 +               return ((IPP2P_SOUL * 100) + 7);
 392 +       }
 393 +
 394 +       if (m > 61 && m < 70 )
 395 +       {
 396 +#ifdef IPP2P_DEBUG_SOUL
 397 +               printk(KERN_DEBUG "7: Soulseek command 0x%x recognized\n",get_u16(payload, 4));
 398 +#endif /* IPP2P_DEBUG_SOUL */
 399 +               return ((IPP2P_SOUL * 100) + 8);
 400 +       }
 401 +
 402 +#ifdef IPP2P_DEBUG_SOUL
 403 +       printk(KERN_DEBUG "unknown SOULSEEK command: 0x%x, first 16 bit: 0x%x, first 8 bit: 0x%x ,soulseek ???\n",get_u32(payload, 4),get_u16(payload, 4) >> 16,get_u8(payload, 4) >> 24);
 404 +#endif /* IPP2P_DEBUG_SOUL */
 405 +    }
 406 +
 407 +       /* match 14 00 00 00 01 yy 00 00 00 STRING(YY) 01 00 00 00 00 46|50 00 00 00 00 */
 408 +       /* without size at the beginning !!! */
 409 +       if ( get_u32(payload, 0) == 0x14 && get_u8(payload, 4) == 0x01 )
 410 +       {
 411 +               __u32 y=get_u32(payload, 5);
 412 +               /* we need 19 chars + string */
 413 +               if ( (y + 19) <= (plen) )
 414 +               {
 415 +                       const unsigned char *w=payload+9+y;
 416 +                       if (get_u32(w, 0) == 0x01 && ( get_u16(w, 4) == 0x4600 || get_u16(w, 4) == 0x5000) && get_u32(w, 6) == 0x00);
 417 +#ifdef IPP2P_DEBUG_SOUL
 418 +                       printk(KERN_DEBUG "Soulssek special client command recognized\n");
 419 +#endif /* IPP2P_DEBUG_SOUL */
 420 +                       return ((IPP2P_SOUL * 100) + 9);
 421 +               }
 422 +       }
 423 +    return 0;
 424 +}
 425 +
 426 +
 427 +/*Search for WinMX commands*/
 428 +int
 429 +search_winmx (const unsigned char *payload, const u16 plen)
 430 +{
 431 +//#define IPP2P_DEBUG_WINMX
 432 +    if (((plen) == 4) && (memcmp(payload, "SEND", 4) == 0))  return ((IPP2P_WINMX * 100) + 1);
 433 +    if (((plen) == 3) && (memcmp(payload, "GET", 3) == 0))  return ((IPP2P_WINMX * 100) + 2);
 434 +    //if (packet_len < (head_len + 10)) return 0;
 435 +    if (plen < 10) return 0;
 436 +
 437 +    if ((memcmp(payload, "SEND", 4) == 0) || (memcmp(payload, "GET", 3) == 0)){
 438 +        u16 c=4;
 439 +        const u16 end=plen-2;
 440 +        u8 count=0;
 441 +        while (c < end)
 442 +        {
 443 +               if (payload[c]== 0x20 && payload[c+1] == 0x22)
 444 +               {
 445 +                       c++;
 446 +                       count++;
 447 +                       if (count>=2) return ((IPP2P_WINMX * 100) + 3);
 448 +               }
 449 +               c++;
 450 +        }
 451 +    }
 452 +
 453 +    if ( plen == 149 && payload[0] == '8' )
 454 +    {
 455 +#ifdef IPP2P_DEBUG_WINMX
 456 +       printk(KERN_INFO "maybe WinMX\n");
 457 +#endif
 458 +       if (get_u32(payload,17) == 0 && get_u32(payload,21) == 0 && get_u32(payload,25) == 0 &&
 459 +//         get_u32(payload,33) == __constant_htonl(0x71182b1a) && get_u32(payload,37) == __constant_htonl(0x05050000) &&
 460 +//         get_u32(payload,133) == __constant_htonl(0x31097edf) && get_u32(payload,145) == __constant_htonl(0xdcb8f792))
 461 +           get_u16(payload,39) == 0 && get_u16(payload,135) == __constant_htons(0x7edf) && get_u16(payload,147) == __constant_htons(0xf792))
 462 +
 463 +       {
 464 +#ifdef IPP2P_DEBUG_WINMX
 465 +               printk(KERN_INFO "got WinMX\n");
 466 +#endif
 467 +               return ((IPP2P_WINMX * 100) + 4);
 468 +       }
 469 +    }
 470 +    return 0;
 471 +} /*search_winmx*/
 472 +
 473 +
 474 +/*Search for appleJuice commands*/
 475 +int
 476 +search_apple (const unsigned char *payload, const u16 plen)
 477 +{
 478 +    if ( (plen > 7) && (payload[6] == 0x0d) && (payload[7] == 0x0a) && (memcmp(payload, "ajprot", 6) == 0))  return (IPP2P_APPLE * 100);
 479 +
 480 +    return 0;
 481 +}
 482 +
 483 +
 484 +/*Search for BitTorrent commands*/
 485 +int
 486 +search_bittorrent (const unsigned char *payload, const u16 plen)
 487 +{
 488 +    if (plen > 20)
 489 +    {
 490 +       /* test for match 0x13+"BitTorrent protocol" */
 491 +       if (payload[0] == 0x13)
 492 +       {
 493 +               if (memcmp(payload+1, "BitTorrent protocol", 19) == 0) return (IPP2P_BIT * 100);
 494 +       }
 495 +
 496 +       /* get tracker commandos, all starts with GET /
 497 +       * then it can follow: scrape| announce
 498 +       * and then ?hash_info=
 499 +       */
 500 +       if (memcmp(payload,"GET /",5) == 0)
 501 +       {
 502 +               /* message scrape */
 503 +               if ( memcmp(payload+5,"scrape?info_hash=",17)==0 ) return (IPP2P_BIT * 100 + 1);
 504 +               /* message announce */
 505 +               if ( memcmp(payload+5,"announce?info_hash=",19)==0 ) return (IPP2P_BIT * 100 + 2);
 506 +       }
 507 +    }
 508 +    else
 509 +    {
 510 +       /* bitcomet encryptes the first packet, so we have to detect another
 511 +        * one later in the flow */
 512 +        /* first try failed, too many missdetections */
 513 +       //if ( size == 5 && get_u32(t,0) == __constant_htonl(1) && t[4] < 3) return (IPP2P_BIT * 100 + 3);
 514 +
 515 +       /* second try: block request packets */
 516 +       if ( plen == 17 && get_u32(payload,0) == __constant_htonl(0x0d) && payload[4] == 0x06 && get_u32(payload,13) == __constant_htonl(0x4000) ) return (IPP2P_BIT * 100 + 3);
 517 +    }
 518 +
 519 +    return 0;
 520 +}
 521 +
 522 +
 523 +
 524 +/*check for Kazaa get command*/
 525 +int
 526 +search_kazaa (const unsigned char *payload, const u16 plen)
 527 +
 528 +{
 529 +    if ((payload[plen-2] == 0x0d) && (payload[plen-1] == 0x0a) && memcmp(payload, "GET /.hash=", 11) == 0)
 530 +       return (IPP2P_DATA_KAZAA * 100);
 531 +
 532 +    return 0;
 533 +}
 534 +
 535 +
 536 +/*check for gnutella get command*/
 537 +int
 538 +search_gnu (const unsigned char *payload, const u16 plen)
 539 +{
 540 +    if ((payload[plen-2] == 0x0d) && (payload[plen-1] == 0x0a))
 541 +    {
 542 +       if (memcmp(payload, "GET /get/", 9) == 0)       return ((IPP2P_DATA_GNU * 100) + 1);
 543 +       if (memcmp(payload, "GET /uri-res/", 13) == 0) return ((IPP2P_DATA_GNU * 100) + 2);
 544 +    }
 545 +    return 0;
 546 +}
 547 +
 548 +
 549 +/*check for gnutella get commands and other typical data*/
 550 +int
 551 +search_all_gnu (const unsigned char *payload, const u16 plen)
 552 +{
 553 +
 554 +    if ((payload[plen-2] == 0x0d) && (payload[plen-1] == 0x0a))
 555 +    {
 556 +
 557 +       if (memcmp(payload, "GNUTELLA CONNECT/", 17) == 0) return ((IPP2P_GNU * 100) + 1);
 558 +       if (memcmp(payload, "GNUTELLA/", 9) == 0) return ((IPP2P_GNU * 100) + 2);
 559 +
 560 +
 561 +       if ((memcmp(payload, "GET /get/", 9) == 0) || (memcmp(payload, "GET /uri-res/", 13) == 0))
 562 +       {
 563 +               u16 c=8;
 564 +               const u16 end=plen-22;
 565 +               while (c < end) {
 566 +                       if ( payload[c] == 0x0a && payload[c+1] == 0x0d && ((memcmp(&payload[c+2], "X-Gnutella-", 11) == 0) || (memcmp(&payload[c+2], "X-Queue:", 8) == 0)))
 567 +                               return ((IPP2P_GNU * 100) + 3);
 568 +                       c++;
 569 +               }
 570 +       }
 571 +    }
 572 +    return 0;
 573 +}
 574 +
 575 +
 576 +/*check for KaZaA download commands and other typical data*/
 577 +int
 578 +search_all_kazaa (const unsigned char *payload, const u16 plen)
 579 +{
 580 +    if ((payload[plen-2] == 0x0d) && (payload[plen-1] == 0x0a))
 581 +    {
 582 +
 583 +       if (memcmp(payload, "GIVE ", 5) == 0) return ((IPP2P_KAZAA * 100) + 1);
 584 +
 585 +       if (memcmp(payload, "GET /", 5) == 0) {
 586 +               u16 c = 8;
 587 +               const u16 end=plen-22;
 588 +               while (c < end) {
 589 +                       if ( payload[c] == 0x0a && payload[c+1] == 0x0d && ((memcmp(&payload[c+2], "X-Kazaa-Username: ", 18) == 0) || (memcmp(&payload[c+2], "User-Agent: PeerEnabler/", 24) == 0)))
 590 +                               return ((IPP2P_KAZAA * 100) + 2);
 591 +                       c++;
 592 +               }
 593 +       }
 594 +    }
 595 +    return 0;
 596 +}
 597 +
 598 +/*fast check for edonkey file segment transfer command*/
 599 +int
 600 +search_edk (const unsigned char *payload, const u16 plen)
 601 +{
 602 +    if (payload[0] != 0xe3)
 603 +       return 0;
 604 +    else {
 605 +       if (payload[5] == 0x47)
 606 +           return (IPP2P_DATA_EDK * 100);
 607 +       else
 608 +           return 0;
 609 +    }
 610 +}
 611 +
 612 +
 613 +
 614 +/*intensive but slower search for some edonkey packets including size-check*/
 615 +int
 616 +search_all_edk (const unsigned char *payload, const u16 plen)
 617 +{
 618 +    if (payload[0] != 0xe3)
 619 +       return 0;
 620 +    else {
 621 +       //t += head_len;
 622 +       const u16 cmd = get_u16(payload, 1);
 623 +       if (cmd == (plen - 5)) {
 624 +           switch (payload[5]) {
 625 +               case 0x01: return ((IPP2P_EDK * 100) + 1);      /*Client: hello or Server:hello*/
 626 +               case 0x4c: return ((IPP2P_EDK * 100) + 9);      /*Client: Hello-Answer*/
 627 +           }
 628 +       }
 629 +       return 0;
 630 +     }
 631 +}
 632 +
 633 +
 634 +/*fast check for Direct Connect send command*/
 635 +int
 636 +search_dc (const unsigned char *payload, const u16 plen)
 637 +{
 638 +
 639 +    if (payload[0] != 0x24 )
 640 +       return 0;
 641 +    else {
 642 +       if (memcmp(&payload[1], "Send|", 5) == 0)
 643 +           return (IPP2P_DATA_DC * 100);
 644 +       else
 645 +           return 0;
 646 +    }
 647 +
 648 +}
 649 +
 650 +
 651 +/*intensive but slower check for all direct connect packets*/
 652 +int
 653 +search_all_dc (const unsigned char *payload, const u16 plen)
 654 +{
 655 +//    unsigned char *t = haystack;
 656 +
 657 +    if (payload[0] == 0x24 && payload[plen-1] == 0x7c)
 658 +    {
 659 +       const unsigned char *t=&payload[1];
 660 +               /* Client-Hub-Protocol */
 661 +       if (memcmp(t, "Lock ", 5) == 0)                 return ((IPP2P_DC * 100) + 1);
 662 +       /* Client-Client-Protocol, some are already recognized by client-hub (like lock) */
 663 +       if (memcmp(t, "MyNick ", 7) == 0)               return ((IPP2P_DC * 100) + 38);
 664 +    }
 665 +    return 0;
 666 +}
 667 +
 668 +/*check for mute*/
 669 +int
 670 +search_mute (const unsigned char *payload, const u16 plen)
 671 +{
 672 +       if ( plen == 209 || plen == 345 || plen == 473 || plen == 609 || plen == 1121 )
 673 +       {
 674 +               //printk(KERN_DEBUG "size hit: %u",size);
 675 +               if (memcmp(payload,"PublicKey: ",11) == 0 )
 676 +               {
 677 +                       return ((IPP2P_MUTE * 100) + 0);
 678 +
 679 +/*                     if (memcmp(t+size-14,"\x0aEndPublicKey\x0a",14) == 0)
 680 +                       {
 681 +                               printk(KERN_DEBUG "end pubic key hit: %u",size);
 682 +
 683 +                       }*/
 684 +               }
 685 +       }
 686 +       return 0;
 687 +}
 688 +
 689 +
 690 +/* check for xdcc */
 691 +int
 692 +search_xdcc (const unsigned char *payload, const u16 plen)
 693 +{
 694 +       /* search in small packets only */
 695 +       if (plen > 20 && plen < 200 && payload[plen-1] == 0x0a && payload[plen-2] == 0x0d && memcmp(payload,"PRIVMSG ",8) == 0)
 696 +       {
 697 +
 698 +               u16 x=10;
 699 +               const u16 end=plen - 13;
 700 +
 701 +               /* is seems to be a irc private massage, chedck for xdcc command */
 702 +               while (x < end)
 703 +               {
 704 +                       if (payload[x] == ':')
 705 +                       {
 706 +                               if ( memcmp(&payload[x+1],"xdcc send #",11) == 0 )
 707 +                                       return ((IPP2P_XDCC * 100) + 0);
 708 +                       }
 709 +                       x++;
 710 +               }
 711 +       }
 712 +       return 0;
 713 +}
 714 +
 715 +/* search for waste */
 716 +int search_waste(const unsigned char *payload, const u16 plen)
 717 +{
 718 +       if ( plen >= 8 && memcmp(payload,"GET.sha1:",9) == 0)
 719 +               return ((IPP2P_WASTE * 100) + 0);
 720 +
 721 +       return 0;
 722 +}
 723 +
 724 +
 725 +static struct {
 726 +    int command;
 727 +    __u8 short_hand;                   /*for fucntions included in short hands*/
 728 +    int packet_len;
 729 +    int (*function_name) (const unsigned char *, const u16);
 730 +} matchlist[] = {
 731 +    {IPP2P_EDK,SHORT_HAND_IPP2P,20, &search_all_edk},
 732 +//    {IPP2P_DATA_KAZAA,SHORT_HAND_DATA,200, &search_kazaa},
 733 +//    {IPP2P_DATA_EDK,SHORT_HAND_DATA,60, &search_edk},
 734 +//    {IPP2P_DATA_DC,SHORT_HAND_DATA,26, &search_dc},
 735 +    {IPP2P_DC,SHORT_HAND_IPP2P,5, search_all_dc},
 736 +//    {IPP2P_DATA_GNU,SHORT_HAND_DATA,40, &search_gnu},
 737 +    {IPP2P_GNU,SHORT_HAND_IPP2P,5, &search_all_gnu},
 738 +    {IPP2P_KAZAA,SHORT_HAND_IPP2P,5, &search_all_kazaa},
 739 +    {IPP2P_BIT,SHORT_HAND_IPP2P,20, &search_bittorrent},
 740 +    {IPP2P_APPLE,SHORT_HAND_IPP2P,5, &search_apple},
 741 +    {IPP2P_SOUL,SHORT_HAND_IPP2P,5, &search_soul},
 742 +    {IPP2P_WINMX,SHORT_HAND_IPP2P,2, &search_winmx},
 743 +    {IPP2P_ARES,SHORT_HAND_IPP2P,5, &search_ares},
 744 +    {IPP2P_MUTE,SHORT_HAND_NONE,200, &search_mute},
 745 +    {IPP2P_WASTE,SHORT_HAND_NONE,5, &search_waste},
 746 +    {IPP2P_XDCC,SHORT_HAND_NONE,5, &search_xdcc},
 747 +    {0,0,0,NULL}
 748 +};
 749 +
 750 +
 751 +static struct {
 752 +    int command;
 753 +    __u8 short_hand;                   /*for fucntions included in short hands*/
 754 +    int packet_len;
 755 +    int (*function_name) (unsigned char *, int);
 756 +} udp_list[] = {
 757 +    {IPP2P_KAZAA,SHORT_HAND_IPP2P,14, &udp_search_kazaa},
 758 +    {IPP2P_BIT,SHORT_HAND_IPP2P,23, &udp_search_bit},
 759 +    {IPP2P_GNU,SHORT_HAND_IPP2P,11, &udp_search_gnu},
 760 +    {IPP2P_EDK,SHORT_HAND_IPP2P,9, &udp_search_edk},
 761 +    {IPP2P_DC,SHORT_HAND_IPP2P,12, &udp_search_directconnect},
 762 +    {0,0,0,NULL}
 763 +};
 764 +
 765 +
 766 +static int
 767 +match(const struct sk_buff *skb,
 768 +      const struct net_device *in,
 769 +      const struct net_device *out,
 770 +#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,18)
 771 +      const struct xt_match *match,
 772 +#endif
 773 +      const void *matchinfo,
 774 +      int offset,
 775 +#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,18)
 776 +      unsigned int protoff,
 777 +#elif LINUX_VERSION_CODE < KERNEL_VERSION(2,6,0)
 778 +      const void *hdr,
 779 +      u_int16_t datalen,
 780 +#endif
 781 +      int *hotdrop)
 782 +{
 783 +    const struct ipt_p2p_info *info = matchinfo;
 784 +    unsigned char  *haystack;
 785 +    struct iphdr *ip = skb->nh.iph;
 786 +    int p2p_result = 0, i = 0;
 787 +//    int head_len;
 788 +    int hlen = ntohs(ip->tot_len)-(ip->ihl*4); /*hlen = packet-data length*/
 789 +
 790 +    /*must not be a fragment*/
 791 +    if (offset) {
 792 +       if (info->debug) printk("IPP2P.match: offset found %i \n",offset);
 793 +       return 0;
 794 +    }
 795 +
 796 +    /*make sure that skb is linear*/
 797 +    if(skb_is_nonlinear(skb)){
 798 +       if (info->debug) printk("IPP2P.match: nonlinear skb found\n");
 799 +       return 0;
 800 +    }
 801 +
 802 +
 803 +    haystack=(char *)ip+(ip->ihl*4);           /*haystack = packet data*/
 804 +
 805 +    switch (ip->protocol){
 806 +       case IPPROTO_TCP:               /*what to do with a TCP packet*/
 807 +       {
 808 +           struct tcphdr *tcph = (void *) ip + ip->ihl * 4;
 809 +
 810 +           if (tcph->fin) return 0;  /*if FIN bit is set bail out*/
 811 +           if (tcph->syn) return 0;  /*if SYN bit is set bail out*/
 812 +           if (tcph->rst) return 0;  /*if RST bit is set bail out*/
 813 +
 814 +           haystack += tcph->doff * 4; /*get TCP-Header-Size*/
 815 +           hlen -= tcph->doff * 4;
 816 +           while (matchlist[i].command) {
 817 +               if ((((info->cmd & matchlist[i].command) == matchlist[i].command) ||
 818 +                   ((info->cmd & matchlist[i].short_hand) == matchlist[i].short_hand)) &&
 819 +                   (hlen > matchlist[i].packet_len)) {
 820 +                           p2p_result = matchlist[i].function_name(haystack, hlen);
 821 +                           if (p2p_result)
 822 +                           {
 823 +                               if (info->debug) printk("IPP2P.debug:TCP-match: %i from: %u.%u.%u.%u:%i to: %u.%u.%u.%u:%i Length: %i\n",
 824 +                                   p2p_result, NIPQUAD(ip->saddr),ntohs(tcph->source), NIPQUAD(ip->daddr),ntohs(tcph->dest),hlen);
 825 +                               return p2p_result;
 826 +                           }
 827 +               }
 828 +           i++;
 829 +           }
 830 +           return p2p_result;
 831 +       }
 832 +
 833 +       case IPPROTO_UDP:               /*what to do with an UDP packet*/
 834 +       {
 835 +           struct udphdr *udph = (void *) ip + ip->ihl * 4;
 836 +
 837 +           while (udp_list[i].command){
 838 +               if ((((info->cmd & udp_list[i].command) == udp_list[i].command) ||
 839 +                   ((info->cmd & udp_list[i].short_hand) == udp_list[i].short_hand)) &&
 840 +                   (hlen > udp_list[i].packet_len)) {
 841 +                           p2p_result = udp_list[i].function_name(haystack, hlen);
 842 +                           if (p2p_result){
 843 +                               if (info->debug) printk("IPP2P.debug:UDP-match: %i from: %u.%u.%u.%u:%i to: %u.%u.%u.%u:%i Length: %i\n",
 844 +                                   p2p_result, NIPQUAD(ip->saddr),ntohs(udph->source), NIPQUAD(ip->daddr),ntohs(udph->dest),hlen);
 845 +                               return p2p_result;
 846 +                           }
 847 +               }
 848 +           i++;
 849 +           }
 850 +           return p2p_result;
 851 +       }
 852 +
 853 +       default: return 0;
 854 +    }
 855 +}
 856 +
 857 +
 858 +
 859 +static int
 860 +checkentry(const char *tablename,
 861 +#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,18)
 862 +           const void *ip,
 863 +           const struct xt_match *match,
 864 +#else
 865 +            const struct ipt_ip *ip,
 866 +#endif
 867 +           void *matchinfo,
 868 +#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,19)
 869 +           unsigned int matchsize,
 870 +#endif
 871 +           unsigned int hook_mask)
 872 +{
 873 +        /* Must specify -p tcp */
 874 +/*    if (ip->proto != IPPROTO_TCP || (ip->invflags & IPT_INV_PROTO)) {
 875 + *     printk("ipp2p: Only works on TCP packets, use -p tcp\n");
 876 + *     return 0;
 877 + *    }*/
 878 +    return 1;
 879 +}
 880 +
 881 +
 882 +
 883 +
 884 +static struct ipt_match ipp2p_match = {
 885 +#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,0)
 886 +       { NULL, NULL },
 887 +       "ipp2p",
 888 +       &match,
 889 +       &checkentry,
 890 +       NULL,
 891 +       THIS_MODULE
 892 +#endif
 893 +#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,0)
 894 +       .name           = "ipp2p",
 895 +       .match          = &match,
 896 +#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,18)
 897 +       .matchsize      = sizeof(struct ipt_p2p_info),
 898 +#endif
 899 +       .checkentry     = &checkentry,
 900 +       .me             = THIS_MODULE,
 901 +#endif
 902 +};
 903 +
 904 +
 905 +static int __init init(void)
 906 +{
 907 +    printk(KERN_INFO "IPP2P v%s loading\n", IPP2P_VERSION);
 908 +    return xt_register_match(&ipp2p_match);
 909 +}
 910 +
 911 +static void __exit fini(void)
 912 +{
 913 +    xt_unregister_match(&ipp2p_match);
 914 +    printk(KERN_INFO "IPP2P v%s unloaded\n", IPP2P_VERSION);
 915 +}
 916 +
 917 +module_init(init);
 918 +module_exit(fini);
 919 +
 920 +
 921 diff -urN linux-2.6.21.1.old/net/ipv4/netfilter/Kconfig linux-2.6.21.1.dev/net/ipv4/netfilter/Kconfig
 922 --- linux-2.6.21.1.old/net/ipv4/netfilter/Kconfig       2007-05-26 20:17:47.626407992 +0200
 923 +++ linux-2.6.21.1.dev/net/ipv4/netfilter/Kconfig       2007-05-26 20:21:54.587864144 +0200
 924 @@ -263,6 +263,12 @@
 925         help
 926           Say Y to get lots of debugging output.
 927
 928 +config IP_NF_MATCH_IPP2P
 929 +       tristate "IPP2P"
 930 +       depends on IP_NF_IPTABLES
 931 +       help
 932 +         Module for matching traffic of various Peer-to-Peer applications
 933 +
 934  config IP_NF_MATCH_TOS
 935         tristate "TOS match support"
 936         depends on IP_NF_IPTABLES
 937 diff -urN linux-2.6.21.1.old/net/ipv4/netfilter/Makefile linux-2.6.21.1.dev/net/ipv4/netfilter/Makefile
 938 --- linux-2.6.21.1.old/net/ipv4/netfilter/Makefile      2007-05-26 20:17:47.638406168 +0200
 939 +++ linux-2.6.21.1.dev/net/ipv4/netfilter/Makefile      2007-05-26 20:21:54.588863992 +0200
 940 @@ -91,7 +91,7 @@
 941  obj-$(CONFIG_IP_NF_MATCH_AH) += ipt_ah.o
 942  obj-$(CONFIG_IP_NF_MATCH_TTL) += ipt_ttl.o
 943  obj-$(CONFIG_IP_NF_MATCH_ADDRTYPE) += ipt_addrtype.o
 944 -
 945 +obj-$(CONFIG_IP_NF_MATCH_IPP2P) += ipt_ipp2p.o
 946  obj-$(CONFIG_IP_NF_MATCH_LAYER7) += ipt_layer7.o
 947
 948  # targets