package/linux/kernel-patches/304-netfilter-ipp2p-0.7.4

   1 diff -urN linux-2.4.29.old/include/linux/netfilter_ipv4/ipt_ipp2p.h linux-2.4.29/include/linux/netfilter_ipv4/ipt_ipp2p.h
   2 --- linux-2.4.29.old/include/linux/netfilter_ipv4/ipt_ipp2p.h   1970-01-01 01:00:00.000000000 +0100
   3 +++ linux-2.4.29/include/linux/netfilter_ipv4/ipt_ipp2p.h       2005-03-12 00:44:17.000000000 +0100
   4 @@ -0,0 +1,29 @@
   5 +#ifndef __IPT_IPP2P_H
   6 +#define __IPT_IPP2P_H
   7 +#define IPP2P_VERSION "0.7.4"
   8 +
   9 +struct ipt_p2p_info {
  10 +    int cmd;
  11 +    int debug;
  12 +};
  13 +
  14 +#endif //__IPT_IPP2P_H
  15 +
  16 +#define SHORT_HAND_IPP2P       1 /* --ipp2p switch*/
  17 +#define SHORT_HAND_DATA                4 /* --ipp2p-data switch*/
  18 +#define SHORT_HAND_NONE                5 /* no short hand*/
  19 +
  20 +#define IPP2P_EDK              2
  21 +#define IPP2P_DATA_KAZAA       8
  22 +#define IPP2P_DATA_EDK         16
  23 +#define IPP2P_DATA_DC          32
  24 +#define IPP2P_DC               64
  25 +#define IPP2P_DATA_GNU         128
  26 +#define IPP2P_GNU              256
  27 +#define IPP2P_KAZAA            512
  28 +#define IPP2P_BIT              1024
  29 +#define IPP2P_APPLE            2048
  30 +#define IPP2P_SOUL             4096
  31 +#define IPP2P_WINMX            8192
  32 +#define IPP2P_ARES             16384
  33 +
  34 diff -urN linux-2.4.29.old/net/ipv4/netfilter/Config.in linux-2.4.29/net/ipv4/netfilter/Config.in
  35 --- linux-2.4.29.old/net/ipv4/netfilter/Config.in       2005-03-12 00:40:38.000000000 +0100
  36 +++ linux-2.4.29/net/ipv4/netfilter/Config.in   2005-03-12 00:42:57.000000000 +0100
  37 @@ -26,6 +26,7 @@
  38    dep_tristate '  TOS match support' CONFIG_IP_NF_MATCH_TOS $CONFIG_IP_NF_IPTABLES
  39    dep_tristate '  recent match support' CONFIG_IP_NF_MATCH_RECENT $CONFIG_IP_NF_IPTABLES
  40    dep_tristate '  ECN match support' CONFIG_IP_NF_MATCH_ECN $CONFIG_IP_NF_IPTABLES
  41 +  dep_tristate '  peer to peer traffic match support' CONFIG_IP_NF_MATCH_IPP2P $CONFIG_IP_NF_IPTABLES
  42
  43    dep_tristate '  DSCP match support' CONFIG_IP_NF_MATCH_DSCP $CONFIG_IP_NF_IPTABLES
  44
  45 diff -urN linux-2.4.29.old/net/ipv4/netfilter/ipt_ipp2p.c linux-2.4.29/net/ipv4/netfilter/ipt_ipp2p.c
  46 --- linux-2.4.29.old/net/ipv4/netfilter/ipt_ipp2p.c     1970-01-01 01:00:00.000000000 +0100
  47 +++ linux-2.4.29/net/ipv4/netfilter/ipt_ipp2p.c 2005-03-12 00:44:02.000000000 +0100
  48 @@ -0,0 +1,661 @@
  49 +#if defined(MODVERSIONS)
  50 +#include <linux/modversions.h>
  51 +#endif
  52 +#include <linux/module.h>
  53 +#include <linux/netfilter_ipv4/ip_tables.h>
  54 +#include <linux/version.h>
  55 +#include <linux/netfilter_ipv4/ipt_ipp2p.h>
  56 +//#include "ipt_ipp2p.h"
  57 +#include <net/tcp.h>
  58 +#include <net/udp.h>
  59 +
  60 +#define get_u8(X,O)  (*(__u8 *)(X + O))
  61 +#define get_u16(X,O)  (*(__u16 *)(X + O))
  62 +#define get_u32(X,O)  (*(__u32 *)(X + O))
  63 +
  64 +MODULE_AUTHOR("Eicke Friedrich <ipp2p@ipp2p.org>");
  65 +MODULE_DESCRIPTION("An extension to iptables to identify P2P traffic.");
  66 +MODULE_LICENSE("GPL");
  67 +
  68 +
  69 +/*Search for UDP eDonkey/eMule/Kad commands*/
  70 +int
  71 +udp_search_edk (unsigned char *haystack, int packet_len)
  72 +{
  73 +    unsigned char *t = haystack;
  74 +    t += 8;
  75 +
  76 +    switch (t[0]) {
  77 +    case 0xe3: {       /*edonkey*/
  78 +       switch (t[1]) {
  79 +                       /* e3 9a + 16Bytes Hash | size == 26 */
  80 +       case 0x9a: if (packet_len == 26) return ((IPP2P_EDK * 100) + 1);
  81 +                       /* e3 96 xx yy zz kk | size == 14 | server status request */
  82 +       case 0x96: if (packet_len == 14) return ((IPP2P_EDK * 100) + 2);
  83 +                       /* e3 a2 | size == 10 or 14 <-- recheck*/
  84 +       }
  85 +    }
  86 +
  87 +    case 0xc5: {       /*emule*/
  88 +       switch (t[1]) {
  89 +                       /* c5 91 xx yy | size == 12 (8+4) | xx != 0x00  -- xx yy queue rating */
  90 +       case 0x91: if ((packet_len == 12) && (t[2] != 0x00)) return ((IPP2P_EDK * 100) + 3);
  91 +                       /* c5 90 xx ..  yy | size == 26 (8+2+16) | xx .. yy == hash  -- file ping */
  92 +       case 0x90: if ((packet_len == 26) && (t[2] != 0x00)) return ((IPP2P_EDK * 100) + 4);
  93 +                       /* c5 92 | size == 10 (8+2) -- file not found */
  94 +       case 0x92: if (packet_len == 10) return ((IPP2P_EDK * 100) + 5);
  95 +                       /* c5 93 | size == 10 (8+2) -- queue full */
  96 +       case 0x93: if (packet_len == 10) return ((IPP2P_EDK * 100) + 6);
  97 +       }
  98 +    }
  99 +
 100 +    case 0xe4: {       /*kad*/
 101 +       switch (t[1]) {
 102 +                       /* e4 50 | size == 12 */
 103 +           case 0x50: if (packet_len == 12) return ((IPP2P_EDK * 100) + 7);
 104 +                       /* e4 58 | size == 14 */
 105 +           case 0x58: if ((packet_len == 14) && (t[2] != 0x00)) return ((IPP2P_EDK * 100) + 8);
 106 +                       /* e4 59 | size == 10 */
 107 +           case 0x59: if (packet_len == 10) return ((IPP2P_EDK * 100) + 9);
 108 +                       /* e4 30 .. | t[18] == 0x01 | size > 26 | --> search */
 109 +           case 0x30: if ((packet_len > 26) && (t[18] == 0x01)) return ((IPP2P_EDK * 100) + 10);
 110 +                       /* e4 28 .. 00 | t[68] == 0x00 | size > 76 */
 111 +           case 0x28: if ((packet_len > 76) && (t[68] == 0x00)) return ((IPP2P_EDK * 100) + 11);
 112 +                       /* e4 20 .. | size == 43 */
 113 +           case 0x20: if ((packet_len == 43) && (t[2] != 0x00) && (t[34] != 0x00)) return ((IPP2P_EDK * 100) + 12);
 114 +                       /* e4 00 .. 00 | size == 35 ? */
 115 +           case 0x00: if ((packet_len == 35) && (t[26] == 0x00)) return ((IPP2P_EDK * 100) + 13);
 116 +                       /* e4 10 .. 00 | size == 35 ? */
 117 +           case 0x10: if ((packet_len == 35) && (t[26] == 0x00)) return ((IPP2P_EDK * 100) + 14);
 118 +                       /* e4 18 .. 00 | size == 35 ? */
 119 +           case 0x18: if ((packet_len == 35) && (t[26] == 0x00)) return ((IPP2P_EDK * 100) + 15);
 120 +                       /* e4 40 .. | t[18] == 0x01 | t[19] == 0x00 | size > 40 */
 121 +           case 0x40: if ((packet_len > 40) && (t[18] == 0x01) && (t[19] == 0x00)) return ((IPP2P_EDK * 100) + 16);
 122 +       }
 123 +    }
 124 +
 125 +    default: return 0;
 126 +    } /* end of switch (t[0]) */
 127 +}/*udp_search_edk*/
 128 +
 129 +
 130 +/*Search for UDP Gnutella commands*/
 131 +int
 132 +udp_search_gnu (unsigned char *haystack, int packet_len)
 133 +{
 134 +    unsigned char *t = haystack;
 135 +    t += 8;
 136 +
 137 +    if (memcmp(t, "GND", 3) == 0) return ((IPP2P_GNU * 100) + 1);
 138 +    if (memcmp(t, "GNUTELLA ", 9) == 0) return ((IPP2P_GNU * 100) + 2);
 139 +    return 0;
 140 +}/*udp_search_gnu*/
 141 +
 142 +
 143 +/*Search for UDP KaZaA commands*/
 144 +int
 145 +udp_search_kazaa (unsigned char *haystack, int packet_len)
 146 +{
 147 +    unsigned char *t = haystack;
 148 +
 149 +    if (t[packet_len-1] == 0x00){
 150 +       t += (packet_len - 6);
 151 +       if (memcmp(t, "KaZaA", 5) == 0) return (IPP2P_KAZAA * 100);
 152 +    }
 153 +    return 0;
 154 +}/*udp_search_kazaa*/
 155 +
 156 +
 157 +/*Search for UDP BitTorrent commands*/
 158 +int
 159 +udp_search_bit (unsigned char *haystack, int packet_len)
 160 +{
 161 +    unsigned char *t = haystack;
 162 +
 163 +    /* packet_len has to be 24 */
 164 +    if (packet_len != 24) return 0;
 165 +
 166 +    t += 8;
 167 +
 168 +    /* ^ 00 00 04 17 27 10 19 80 */
 169 +    if ((ntohl(get_u32(t, 0)) == 0x00000417) && (ntohl(get_u32(t, 4)) == 0x27101980)) return (IPP2P_BIT * 100);
 170 +
 171 +    return 0;
 172 +}/*udp_search_bit*/
 173 +
 174 +
 175 +
 176 +/*Search for Ares commands*/
 177 +int
 178 +search_ares (unsigned char *haystack, int packet_len, int head_len)
 179 +{
 180 +    unsigned char *t = haystack;
 181 +    t += head_len;
 182 +
 183 +    if ((packet_len - head_len) == 6){ /* possible connect command*/
 184 +       if ((t[0] == 0x03) && (t[1] == 0x00) && (t[2] == 0x5a) && (t[3] == 0x04) && (t[4] == 0x03) && (t[5] == 0x05))
 185 +           return ((IPP2P_ARES * 100) + 1);                    /* found connect packet: 03 00 5a 04 03 05 */
 186 +    }
 187 +    if ((packet_len - head_len) == 60){        /* possible download command*/
 188 +       if ((t[59] == 0x0a) && (t[58] == 0x0a)){
 189 +           if (memcmp(t, "PUSH SHA1:", 10) == 0) /* found download command */
 190 +               return ((IPP2P_ARES * 100) + 2);
 191 +       }
 192 +    }
 193 +    return 0;
 194 +} /*search_ares*/
 195 +
 196 +
 197 +/*Search for SoulSeek commands*/
 198 +int
 199 +search_soul (unsigned char *haystack, int packet_len, int head_len)
 200 +{
 201 +    unsigned char *t = haystack;
 202 +    t += head_len;
 203 +
 204 +    if (get_u16(t, 0) == (packet_len - head_len - 4)){
 205 +           /* xx xx 00 00 yy zz 00 00 .. | xx = sizeof(payload) - 4 */
 206 +       if ((get_u16(t,2) == 0x0000) &&(t[4] != 0x00) && (get_u16(t,6) == 0x0000))
 207 +           return ((IPP2P_SOUL * 100) + 1);
 208 +    } else {
 209 +           /* 00 00 00 00 00 00 00 00 + sizeof(payload) == 8*/
 210 +       if (((packet_len - head_len) == 8) && (get_u32(t, 0) == 0x00000000) && (get_u32(t, 4) == 0x00000000))
 211 +           return ((IPP2P_SOUL * 100) + 2);
 212 +    }
 213 +
 214 +    /* 01 xx 00 00 00 yy .. zz 00 00 00 .. | xx == sizeof(nick) | yy .. zz == nick */
 215 +    if ((t[0] == 0x01) && (t[2] == 0x00) && (get_u16(t,3) == 0x0000) && ((packet_len - head_len) > ((get_u8(t,1))+6)) &&
 216 +       (t[(get_u8(t,1))+4] != 0x00) && (t[(get_u8(t,1))+5] == 0x01) && (t[(get_u8(t,1))+6] == 0x00))
 217 +           return ((IPP2P_SOUL * 100) + 3);
 218 +    return 0;
 219 +}
 220 +
 221 +
 222 +/*Search for WinMX commands*/
 223 +int
 224 +search_winmx (unsigned char *haystack, int packet_len, int head_len)
 225 +{
 226 +    unsigned char *t = haystack;
 227 +    int c;
 228 +    t += head_len;
 229 +
 230 +    if (((packet_len - head_len) == 4) && (memcmp(t, "SEND", 4) == 0))  return ((IPP2P_WINMX * 100) + 1);
 231 +    if (((packet_len - head_len) == 3) && (memcmp(t, "GET", 3) == 0))  return ((IPP2P_WINMX * 100) + 2);
 232 +    if (packet_len < (head_len + 10)) return 0;
 233 +
 234 +    if ((memcmp(t, "SEND", 4) == 0) || (memcmp(t, "GET", 3) == 0)){
 235 +        c = head_len + 4;
 236 +       t += 4;
 237 +       while (c < packet_len - 5) {
 238 +           if ((t[0] == 0x20) && (t[1] == 0x22)){
 239 +               c += 2;
 240 +               t += 2;
 241 +               while (c < packet_len - 2) {
 242 +                   if ((t[0] == 0x22) && (t[1] == 0x20)) return ((IPP2P_WINMX * 100) + 3);
 243 +                   t++;
 244 +                   c++;
 245 +               }
 246 +           }
 247 +           t++;
 248 +           c++;
 249 +       }
 250 +    }
 251 +    return 0;
 252 +} /*search_winmx*/
 253 +
 254 +
 255 +/*Search for appleJuice commands*/
 256 +int
 257 +search_apple (unsigned char *haystack, int packet_len, int head_len)
 258 +{
 259 +    unsigned char *t = haystack;
 260 +    t += head_len;
 261 +
 262 +    if ((memcmp(t, "ajprot", 6) == 0) && (t[6] == 0x0d) && (t[7] == 0x0a))  return (IPP2P_APPLE * 100);
 263 +
 264 +    return 0;
 265 +}
 266 +
 267 +
 268 +/*Search for BitTorrent commands*/
 269 +int
 270 +search_bittorrent (unsigned char *haystack, int packet_len, int head_len)
 271 +{
 272 +
 273 +    unsigned char *t = haystack;
 274 +    if (*(haystack+head_len) != 0x13) return 0; /*Bail out of first byte != 0x13*/
 275 +
 276 +    t += head_len + 1;
 277 +
 278 +    if (memcmp(t, "BitTorrent protocol", 19) == 0) return (IPP2P_BIT * 100);
 279 +    return 0;
 280 +}
 281 +
 282 +
 283 +
 284 +/*check for Kazaa get command*/
 285 +int
 286 +search_kazaa (unsigned char *haystack, int packet_len, int head_len)
 287 +{
 288 +    unsigned char *t = haystack;
 289 +
 290 +    if (!((*(haystack + packet_len - 2) == 0x0d) && (*(haystack + packet_len - 1) == 0x0a))) return 0;
 291 +
 292 +    t += head_len;
 293 +    if (memcmp(t, "GET /.hash=", 11) == 0)
 294 +       return (IPP2P_DATA_KAZAA * 100);
 295 +    else
 296 +       return 0;
 297 +}
 298 +
 299 +
 300 +/*check for gnutella get command*/
 301 +int
 302 +search_gnu (unsigned char *haystack, int packet_len, int head_len)
 303 +{
 304 +    unsigned char *t = haystack;
 305 +
 306 +    if (!((*(haystack + packet_len - 2) == 0x0d) && (*(haystack + packet_len - 1) == 0x0a))) return 0;
 307 +
 308 +    t += head_len;
 309 +    if (memcmp(t, "GET /get/", 9) == 0)        return ((IPP2P_DATA_GNU * 100) + 1);
 310 +    if (memcmp(t, "GET /uri-res/", 13) == 0) return ((IPP2P_DATA_GNU * 100) + 2);
 311 +
 312 +    return 0;
 313 +}
 314 +
 315 +
 316 +/*check for gnutella get commands and other typical data*/
 317 +int
 318 +search_all_gnu (unsigned char *haystack, int packet_len, int head_len)
 319 +{
 320 +    unsigned char *t = haystack;
 321 +    int c;
 322 +
 323 +    if (!((*(haystack + packet_len - 2) == 0x0d) && (*(haystack + packet_len - 1) == 0x0a))) return 0;
 324 +
 325 +    t += head_len;
 326 +
 327 +    if (memcmp(t, "GNUTELLA CONNECT/", 17) == 0) return ((IPP2P_GNU * 100) + 1);
 328 +    if (memcmp(t, "GNUTELLA/", 9) == 0) return ((IPP2P_GNU * 100) + 2);
 329 +
 330 +    if ((memcmp(t, "GET /get/", 9) == 0) || (memcmp(t, "GET /uri-res/", 13) == 0))
 331 +    {
 332 +        c = head_len + 8;
 333 +       t += 8;
 334 +       while (c < packet_len - 22) {
 335 +           if ((t[0] == 0x0d) && (t[1] == 0x0a)) {
 336 +                   t += 2;
 337 +                   c += 2;
 338 +                   if ((memcmp(t, "X-Gnutella-", 11) == 0) || (memcmp(t, "X-Queue:", 8) == 0)) return ((IPP2P_GNU * 100) + 3);
 339 +           } else {
 340 +               t++;
 341 +               c++;
 342 +           }
 343 +       }
 344 +    }
 345 +    return 0;
 346 +}
 347 +
 348 +
 349 +/*check for KaZaA download commands and other typical data*/
 350 +int
 351 +search_all_kazaa (unsigned char *haystack, int packet_len, int head_len)
 352 +{
 353 +    unsigned char *t = haystack;
 354 +    int c;
 355 +
 356 +    if (!((*(haystack + packet_len - 2) == 0x0d) && (*(haystack + packet_len - 1) == 0x0a))) return 0;
 357 +
 358 +    t += head_len;
 359 +    if (memcmp(t, "GIVE ", 5) == 0) return ((IPP2P_KAZAA * 100) + 1);
 360 +
 361 +    if (memcmp(t, "GET /", 5) == 0) {
 362 +        c = head_len + 8;
 363 +       t += 8;
 364 +       while (c < packet_len - 22) {
 365 +           if ((t[0] == 0x0d) && (t[1] == 0x0a)) {
 366 +                   t += 2;
 367 +                   c += 2;
 368 +                   if ( memcmp(t, "X-Kazaa-Username: ", 18) == 0 ) return ((IPP2P_KAZAA * 100) + 2);
 369 +                   if ( memcmp(t, "User-Agent: PeerEnabler/", 24) == 0 ) return ((IPP2P_KAZAA * 100) + 3);
 370 +           } else {
 371 +               t++;
 372 +               c++;
 373 +           }
 374 +       }
 375 +    }
 376 +
 377 +    return 0;
 378 +}
 379 +
 380 +/*fast check for edonkey file segment transfer command*/
 381 +int
 382 +search_edk (unsigned char *haystack, int packet_len, int head_len)
 383 +{
 384 +    if (*(haystack+head_len) != 0xe3)
 385 +       return 0;
 386 +    else {
 387 +       if (*(haystack+head_len+5) == 0x47)
 388 +           return (IPP2P_DATA_EDK * 100);
 389 +       else
 390 +           return 0;
 391 +    }
 392 +}
 393 +
 394 +
 395 +
 396 +/*intensive but slower search for some edonkey packets including size-check*/
 397 +int
 398 +search_all_edk (unsigned char *haystack, int packet_len, int head_len)
 399 +{
 400 +    unsigned char *t = haystack;
 401 +    int cmd;
 402 +
 403 +    if (*(haystack+head_len) == 0xd4) {
 404 +       t += head_len;
 405 +       cmd = get_u16(t, 1);
 406 +       if (cmd == (packet_len - head_len - 5)) {
 407 +           switch (t[5]) {
 408 +               case 0x82: return ((IPP2P_EDK * 100) + 42);
 409 +               case 0x15: return ((IPP2P_EDK * 100) + 43);
 410 +               default: return 0;
 411 +           }
 412 +       }
 413 +       return 0;
 414 +    }
 415 +
 416 +
 417 +    if (*(haystack+head_len) == 0xc5) {        /*search for additional eMule packets*/
 418 +       t += head_len;
 419 +       cmd = get_u16(t, 1);
 420 +
 421 +       if (cmd == (packet_len - head_len - 5)) {
 422 +           switch (t[5]) {
 423 +               case 0x01: return ((IPP2P_EDK * 100) + 30);
 424 +               case 0x02: return ((IPP2P_EDK * 100) + 31);
 425 +               case 0x60: return ((IPP2P_EDK * 100) + 32);
 426 +               case 0x81: return ((IPP2P_EDK * 100) + 33);
 427 +               case 0x82: return ((IPP2P_EDK * 100) + 34);
 428 +               case 0x85: return ((IPP2P_EDK * 100) + 35);
 429 +               case 0x86: return ((IPP2P_EDK * 100) + 36);
 430 +               case 0x87: return ((IPP2P_EDK * 100) + 37);
 431 +               case 0x40: return ((IPP2P_EDK * 100) + 38);
 432 +               case 0x92: return ((IPP2P_EDK * 100) + 39);
 433 +               case 0x93: return ((IPP2P_EDK * 100) + 40);
 434 +               case 0x12: return ((IPP2P_EDK * 100) + 41);
 435 +               default: return 0;
 436 +           }
 437 +       }
 438 +
 439 +       return 0;
 440 +    }
 441 +
 442 +
 443 +    if (*(haystack+head_len) != 0xe3)
 444 +       return 0;
 445 +    else {
 446 +       t += head_len;
 447 +       cmd = get_u16(t, 1);
 448 +       if (cmd == (packet_len - head_len - 5)) {
 449 +           switch (t[5]) {
 450 +               case 0x01: return ((IPP2P_EDK * 100) + 1);      /*Client: hello or Server:hello*/
 451 +               case 0x50: return ((IPP2P_EDK * 100) + 2);      /*Client: file status*/
 452 +               case 0x16: return ((IPP2P_EDK * 100) + 3);      /*Client: search*/
 453 +               case 0x58: return ((IPP2P_EDK * 100) + 4);      /*Client: file request*/
 454 +               case 0x48: return ((IPP2P_EDK * 100) + 5);      /*???*/
 455 +               case 0x54: return ((IPP2P_EDK * 100) + 6);      /*???*/
 456 +               case 0x47: return ((IPP2P_EDK * 100) + 7);      /*Client: file segment request*/
 457 +               case 0x46: return ((IPP2P_EDK * 100) + 8);      /*Client: download segment*/
 458 +               case 0x4c: return ((IPP2P_EDK * 100) + 9);      /*Client: Hello-Answer*/
 459 +               case 0x4f: return ((IPP2P_EDK * 100) + 10);     /*Client: file status request*/
 460 +               case 0x59: return ((IPP2P_EDK * 100) + 11);     /*Client: file request answer*/
 461 +               case 0x65: return ((IPP2P_EDK * 100) + 12);     /*Client: ???*/
 462 +               case 0x66: return ((IPP2P_EDK * 100) + 13);     /*Client: ???*/
 463 +               case 0x51: return ((IPP2P_EDK * 100) + 14);     /*Client: ???*/
 464 +               case 0x52: return ((IPP2P_EDK * 100) + 15);     /*Client: ???*/
 465 +               case 0x4d: return ((IPP2P_EDK * 100) + 16);     /*Client: ???*/
 466 +               case 0x5c: return ((IPP2P_EDK * 100) + 17);     /*Client: ???*/
 467 +               case 0x38: return ((IPP2P_EDK * 100) + 18);     /*Client: ???*/
 468 +               case 0x69: return ((IPP2P_EDK * 100) + 19);     /*Client: ???*/
 469 +               case 0x19: return ((IPP2P_EDK * 100) + 20);     /*Client: ???*/
 470 +               case 0x42: return ((IPP2P_EDK * 100) + 21);     /*Client: ???*/
 471 +               case 0x34: return ((IPP2P_EDK * 100) + 22);     /*Client: ???*/
 472 +               case 0x94: return ((IPP2P_EDK * 100) + 23);     /*Client: ???*/
 473 +               case 0x1c: return ((IPP2P_EDK * 100) + 24);     /*Client: ???*/
 474 +               case 0x6a: return ((IPP2P_EDK * 100) + 25);     /*Client: ???*/
 475 +               default: return 0;
 476 +           }
 477 +       } else {
 478 +           if (cmd > packet_len - head_len - 5) {
 479 +               if ((t[3] == 0x00) && (t[4] == 0x00)) {
 480 +                   if (t[5] == 0x01) return ((IPP2P_EDK * 100) + 26);
 481 +                   if (t[5] == 0x4c) return ((IPP2P_EDK * 100) + 27);
 482 +               }
 483 +               return 0;
 484 +
 485 +           }   /*non edk packet*/
 486 +           if (t[cmd+5] == 0xe3) return ((IPP2P_EDK * 100) + 28);/*found another edk-command*/
 487 +           if (t[cmd+5] == 0xc5) return ((IPP2P_EDK * 100) + 29);/*found an emule-command*/
 488 +           return 0;
 489 +       }
 490 +    }
 491 +}
 492 +
 493 +
 494 +/*fast check for Direct Connect send command*/
 495 +int
 496 +search_dc (unsigned char *haystack, int packet_len, int head_len)
 497 +{
 498 +    unsigned char *t = haystack;
 499 +
 500 +    if (*(haystack+head_len) != 0x24 )
 501 +       return 0;
 502 +    else {
 503 +       t += head_len + 1;
 504 +        if (memcmp(t, "Send|", 5) == 0)
 505 +           return (IPP2P_DATA_DC * 100);
 506 +       else
 507 +           return 0;
 508 +    }
 509 +
 510 +}
 511 +
 512 +
 513 +/*intensive but slower check for all direct connect packets*/
 514 +int
 515 +search_all_dc (unsigned char *haystack, int packet_len, int head_len)
 516 +{
 517 +    unsigned char *t = haystack;
 518 +
 519 +    if ((*(haystack + head_len) == 0x24) && (*(haystack + packet_len - 1) == 0x7c)) {
 520 +       t += head_len + 1;
 521 +       if (memcmp(t, "Lock ", 5) == 0)  return ((IPP2P_DC * 100) + 1); /*hub: hello*/
 522 +       if (memcmp(t, "Key ", 4) == 0)   return ((IPP2P_DC * 100) + 2); /*client: hello*/
 523 +       if (memcmp(t, "Hello ", 6) == 0) return ((IPP2P_DC * 100) + 3); /*hub:connected*/
 524 +       if (memcmp(t, "MyNick ", 7) == 0) return ((IPP2P_DC * 100) + 4); /*client-client: hello*/
 525 +       if (memcmp(t, "Search ", 7) == 0) return ((IPP2P_DC * 100) + 5); /*client: search*/
 526 +       if (memcmp(t, "Send", 4) == 0)   return ((IPP2P_DC * 100) + 6); /*client: start download*/
 527 +       return 0;
 528 +    } else
 529 +       return 0;
 530 +}
 531 +
 532 +
 533 +static struct {
 534 +    int command;
 535 +    __u8 short_hand;                   /*for fucntions included in short hands*/
 536 +    int packet_len;
 537 +    int (*function_name) (unsigned char *, int, int);
 538 +} matchlist[] = {
 539 +    {IPP2P_EDK,SHORT_HAND_IPP2P,40, &search_all_edk},
 540 +    {IPP2P_DATA_KAZAA,SHORT_HAND_DATA,200, &search_kazaa},
 541 +    {IPP2P_DATA_EDK,SHORT_HAND_DATA,60, &search_edk},
 542 +    {IPP2P_DATA_DC,SHORT_HAND_DATA,26, &search_dc},
 543 +    {IPP2P_DC,SHORT_HAND_IPP2P,25, search_all_dc},
 544 +    {IPP2P_DATA_GNU,SHORT_HAND_DATA,40, &search_gnu},
 545 +    {IPP2P_GNU,SHORT_HAND_IPP2P,35, &search_all_gnu},
 546 +    {IPP2P_KAZAA,SHORT_HAND_IPP2P,35, &search_all_kazaa},
 547 +    {IPP2P_BIT,SHORT_HAND_NONE,40, &search_bittorrent},
 548 +    {IPP2P_APPLE,SHORT_HAND_NONE,20, &search_apple},
 549 +    {IPP2P_SOUL,SHORT_HAND_NONE,25, &search_soul},
 550 +    {IPP2P_WINMX,SHORT_HAND_NONE,20, &search_winmx},
 551 +    {IPP2P_ARES,SHORT_HAND_NONE,25, &search_ares},
 552 +    {0,0,0,NULL}
 553 +};
 554 +
 555 +
 556 +static struct {
 557 +    int command;
 558 +    __u8 short_hand;                   /*for fucntions included in short hands*/
 559 +    int packet_len;
 560 +    int (*function_name) (unsigned char *, int);
 561 +} udp_list[] = {
 562 +    {IPP2P_KAZAA,SHORT_HAND_IPP2P,14, &udp_search_kazaa},
 563 +    {IPP2P_BIT,SHORT_HAND_NONE,23, &udp_search_bit},
 564 +    {IPP2P_GNU,SHORT_HAND_IPP2P,11, &udp_search_gnu},
 565 +    {IPP2P_EDK,SHORT_HAND_IPP2P,9, &udp_search_edk},
 566 +    {0,0,0,NULL}
 567 +};
 568 +
 569 +
 570 +static int
 571 +match(const struct sk_buff *skb,
 572 +      const struct net_device *in,
 573 +      const struct net_device *out,
 574 +      const void *matchinfo,
 575 +      int offset,
 576 +
 577 +#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,0)
 578 +      const void *hdr,
 579 +      u_int16_t datalen,
 580 +#endif
 581 +
 582 +      int *hotdrop)
 583 +{
 584 +    const struct ipt_p2p_info *info = matchinfo;
 585 +    unsigned char  *haystack;
 586 +    struct iphdr *ip = skb->nh.iph;
 587 +    int p2p_result = 0, i = 0;
 588 +    int head_len;
 589 +    int hlen = ntohs(ip->tot_len)-(ip->ihl*4); /*hlen = packet-data length*/
 590 +
 591 +    /*must not be a fragment*/
 592 +    if (offset) {
 593 +       if (info->debug) printk("IPP2P.match: offset found %i \n",offset);
 594 +       return 0;
 595 +    }
 596 +
 597 +    /*make sure that skb is linear*/
 598 +    if(skb_is_nonlinear(skb)){
 599 +       if (info->debug) printk("IPP2P.match: nonlinear skb found\n");
 600 +       return 0;
 601 +    }
 602 +
 603 +
 604 +    haystack=(char *)ip+(ip->ihl*4);           /*haystack = packet data*/
 605 +
 606 +    switch (ip->protocol){
 607 +       case IPPROTO_TCP:               /*what to do with a TCP packet*/
 608 +       {
 609 +           struct tcphdr *tcph = (void *) ip + ip->ihl * 4;
 610 +
 611 +           if (tcph->fin) return 0;  /*if FIN bit is set bail out*/
 612 +           if (tcph->syn) return 0;  /*if SYN bit is set bail out*/
 613 +           if (tcph->rst) return 0;  /*if RST bit is set bail out*/
 614 +           head_len = tcph->doff * 4; /*get TCP-Header-Size*/
 615 +           while (matchlist[i].command) {
 616 +               if ((((info->cmd & matchlist[i].command) == matchlist[i].command) ||
 617 +                   ((info->cmd & matchlist[i].short_hand) == matchlist[i].short_hand)) &&
 618 +                   (hlen > matchlist[i].packet_len)) {
 619 +                           p2p_result = matchlist[i].function_name(haystack, hlen, head_len);
 620 +                           if (p2p_result)
 621 +                           {
 622 +                               if (info->debug) printk("IPP2P.debug:TCP-match: %i from: %u.%u.%u.%u:%i to: %u.%u.%u.%u:%i Length: %i\n",
 623 +                                   p2p_result, NIPQUAD(ip->saddr),ntohs(tcph->source), NIPQUAD(ip->daddr),ntohs(tcph->dest),hlen);
 624 +                               return p2p_result;
 625 +                           }
 626 +               }
 627 +           i++;
 628 +           }
 629 +           return p2p_result;
 630 +       }
 631 +
 632 +       case IPPROTO_UDP:               /*what to do with an UDP packet*/
 633 +       {
 634 +           struct udphdr *udph = (void *) ip + ip->ihl * 4;
 635 +
 636 +           while (udp_list[i].command){
 637 +               if ((((info->cmd & udp_list[i].command) == udp_list[i].command) ||
 638 +                   ((info->cmd & udp_list[i].short_hand) == udp_list[i].short_hand)) &&
 639 +                   (hlen > udp_list[i].packet_len)) {
 640 +                           p2p_result = udp_list[i].function_name(haystack, hlen);
 641 +                           if (p2p_result){
 642 +                               if (info->debug) printk("IPP2P.debug:UDP-match: %i from: %u.%u.%u.%u:%i to: %u.%u.%u.%u:%i Length: %i\n",
 643 +                                   p2p_result, NIPQUAD(ip->saddr),ntohs(udph->source), NIPQUAD(ip->daddr),ntohs(udph->dest),hlen);
 644 +                               return p2p_result;
 645 +                           }
 646 +               }
 647 +           i++;
 648 +           }
 649 +           return p2p_result;
 650 +       }
 651 +
 652 +       default: return 0;
 653 +    }
 654 +}
 655 +
 656 +
 657 +
 658 +static int
 659 +checkentry(const char *tablename,
 660 +            const struct ipt_ip *ip,
 661 +           void *matchinfo,
 662 +           unsigned int matchsize,
 663 +           unsigned int hook_mask)
 664 +{
 665 +        /* Must specify -p tcp */
 666 +/*    if (ip->proto != IPPROTO_TCP || (ip->invflags & IPT_INV_PROTO)) {
 667 + *     printk("ipp2p: Only works on TCP packets, use -p tcp\n");
 668 + *     return 0;
 669 + *    }*/
 670 +    return 1;
 671 +}
 672 +
 673 +
 674 +
 675 +
 676 +static struct ipt_match ipp2p_match = {
 677 +#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,0)
 678 +       { NULL, NULL },
 679 +       "ipp2p",
 680 +       &match,
 681 +       &checkentry,
 682 +       NULL,
 683 +       THIS_MODULE
 684 +#endif
 685 +#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,0)
 686 +       .name           = "ipp2p",
 687 +       .match          = &match,
 688 +       .checkentry     = &checkentry,
 689 +       .me             = THIS_MODULE,
 690 +#endif
 691 +};
 692 +
 693 +
 694 +static int __init init(void)
 695 +{
 696 +    printk(KERN_INFO "IPP2P v%s loading\n", IPP2P_VERSION);
 697 +    return ipt_register_match(&ipp2p_match);
 698 +}
 699 +
 700 +static void __exit fini(void)
 701 +{
 702 +    ipt_unregister_match(&ipp2p_match);
 703 +    printk(KERN_INFO "IPP2P v%s unloaded\n", IPP2P_VERSION);
 704 +}
 705 +
 706 +module_init(init);
 707 +module_exit(fini);
 708 +
 709 +
 710 diff -urN linux-2.4.29.old/net/ipv4/netfilter/Makefile linux-2.4.29/net/ipv4/netfilter/Makefile
 711 --- linux-2.4.29.old/net/ipv4/netfilter/Makefile        2005-03-12 00:40:38.000000000 +0100
 712 +++ linux-2.4.29/net/ipv4/netfilter/Makefile    2005-03-12 00:42:57.000000000 +0100
 713 @@ -67,6 +67,7 @@
 714  obj-$(CONFIG_IP_NF_MATCH_LIMIT) += ipt_limit.o
 715  obj-$(CONFIG_IP_NF_MATCH_MARK) += ipt_mark.o
 716  obj-$(CONFIG_IP_NF_MATCH_MAC) += ipt_mac.o
 717 +obj-$(CONFIG_IP_NF_MATCH_IPP2P) += ipt_ipp2p.o
 718
 719  obj-$(CONFIG_IP_NF_MATCH_PKTTYPE) += ipt_pkttype.o
 720  obj-$(CONFIG_IP_NF_MATCH_MULTIPORT) += ipt_multiport.o