xtables-addons: ipp2p: bittorrent commands patch

xtables-addons: ipp2p: bittorrent commands patch

[Tomasz Tomkowiak]

[-- Attachment #1: Type: text/plain, Size: 1776 bytes --]

Hello guys,

After testing I decide to write my patch to bittorrent
GET commands from xt_ipp2p.c because old procedure is
useless for modified and/or private trackers. teh new
works fine but maybe someone can rewrite it to better C
(yeah, im C/C++ n00b ;)
btw. info_hash may be 3rd argument, passkey (private trackers)
may be 1st argument (or not) etc. etc. so we need to search.


---
--- xtables-addons-1.22.old/extensions/xt_ipp2p.c       2010-01-22 20:14:37.000000000 +0100
+++ xtables-addons-1.22/extensions/xt_ipp2p.c   2010-01-26 06:05:47.000000000 +0100
@@ -505,19 +505,18 @@
  if (payload[0] == 0x13)
    if (memcmp(payload + 1, "BitTorrent protocol", 19) == 0)
      return IPP2P_BIT * 100;
-
    /*
-    * get tracker commandos, all starts with GET /
-    * then it can follow: scrape| announce
-    * and then ?hash_info=
+    * any tracker command starts with GET / then *may be* some file on web server
+    * (eg. announce.php or dupa.pl or whatever.cgi or NOTHING for tracker on root dir)
+    * but *must have* one (or more) of strings listed below (true for scrape and announce)
     */
    if (memcmp(payload, "GET /", 5) == 0) {
-     /* message scrape */
-     if (memcmp(payload + 5, "scrape?info_hash=", 17) == 0)
-       return IPP2P_BIT * 100 + 1;
-     /* message announce */
-     if (memcmp(payload + 5, "announce?info_hash=", 19) == 0)
-       return IPP2P_BIT * 100 + 2;
+     if(strstr(payload, "info_hash=") != NULL)
+       return IPP2P_BIT * 100 + 1;
+     if(strstr(payload, "peer_id=") != NULL)
+       return IPP2P_BIT * 100 + 2;
+     if(strstr(payload, "passkey=") != NULL)
+       return IPP2P_BIT * 100 + 4;
    }
  } else {
    /* bitcomet encryptes the first packet, so we have to detect another
---

-- 
Tomasz 'BloodMan' Tomkowiak

[-- Attachment #2: xt_ipp2p.patch --]
[-- Type: application/octet-stream, Size: 1318 bytes --]

--- xtables-addons-1.22.old/extensions/xt_ipp2p.c	2010-01-22 20:14:37.000000000 +0100
+++ xtables-addons-1.22/extensions/xt_ipp2p.c	2010-01-26 06:05:47.000000000 +0100
@@ -505,19 +505,18 @@
 		if (payload[0] == 0x13)
 			if (memcmp(payload + 1, "BitTorrent protocol", 19) == 0)
 				return IPP2P_BIT * 100;
-
 		/*
-		 * get tracker commandos, all starts with GET /
-		 * then it can follow: scrape| announce
-		 * and then ?hash_info=
+		 * any tracker command starts with GET / then *may be* some file on web server
+		 * (eg. announce.php or dupa.pl or whatever.cgi or NOTHING for tracker on root dir)
+		 * but *must have* one (or more) of strings listed below (true for scrape and announce)
 		 */
 		if (memcmp(payload, "GET /", 5) == 0) {
-			/* message scrape */
-			if (memcmp(payload + 5, "scrape?info_hash=", 17) == 0)
-				return IPP2P_BIT * 100 + 1;
-			/* message announce */
-			if (memcmp(payload + 5, "announce?info_hash=", 19) == 0)
-				return IPP2P_BIT * 100 + 2;
+			if(strstr(payload, "info_hash=") != NULL)
+			    return IPP2P_BIT * 100 + 1;
+			if(strstr(payload, "peer_id=") != NULL)
+			    return IPP2P_BIT * 100 + 2;
+			if(strstr(payload, "passkey=") != NULL)
+			    return IPP2P_BIT * 100 + 4;
 		}
 	} else {
 	    	/* bitcomet encryptes the first packet, so we have to detect another

Re: xtables-addons: ipp2p: bittorrent commands patch

[Jan Engelhardt]

On Sunday 2010-02-21 22:08, Jan Engelhardt wrote:
>On Tuesday 2010-01-26 06:16, Tomasz Tomkowiak wrote:
>>
>>After testing I decide to write my patch to bittorrent
>>GET commands from xt_ipp2p.c because old procedure is
>>useless for modified and/or private trackers. teh new
>>works fine but maybe someone can rewrite it to better C
>>(yeah, im C/C++ n00b ;)
>>btw. info_hash may be 3rd argument, passkey (private trackers)
>>may be 1st argument (or not) etc. etc. so we need to search.

Hm. This patch needs improvement. We cannot use strstr, because
there may not be a NUL byte in the packet.

Re: xtables-addons: ipp2p: bittorrent commands patch

[Jan Engelhardt]

On Wednesday 2010-02-24 00:40, Jan Engelhardt wrote:
>On Sunday 2010-02-21 22:08, Jan Engelhardt wrote:
>>On Tuesday 2010-01-26 06:16, Tomasz Tomkowiak wrote:
>>>
>>>After testing I decide to write my patch to bittorrent
>>>GET commands from xt_ipp2p.c because old procedure is
>>>useless for modified and/or private trackers. teh new
>>>works fine but maybe someone can rewrite it to better C
>>>(yeah, im C/C++ n00b ;)
>>>btw. info_hash may be 3rd argument, passkey (private trackers)
>>>may be 1st argument (or not) etc. etc. so we need to search.
>
>Hm. This patch needs improvement. We cannot use strstr, because
>there may not be a NUL byte in the packet.

Now applied with the proper call (memmem, not strstr).

xtables-addons: ipp2p: bittorrent commands patch

[bloodman]

[-- Attachment #1: Type: text/plain, Size: 1775 bytes --]

Hello guys,

After testing I decide to write my patch to bittorrent
GET commands from xt_ipp2p.c because old procedure is
useless for modified and/or private trackers. teh new
works fine but maybe someone can rewrite it to better C
(yeah, im C/C++ n00b ;)
btw. info_hash may be 3rd argument, passkey (private trackers)
may be 1st argument (or not) etc. etc. so we need to search.


---
--- xtables-addons-1.22.old/extensions/xt_ipp2p.c       2010-01-22 20:14:37.000000000 +0100
+++ xtables-addons-1.22/extensions/xt_ipp2p.c   2010-01-26 06:05:47.000000000 +0100
@@ -505,19 +505,18 @@
  if (payload[0] == 0x13)
    if (memcmp(payload + 1, "BitTorrent protocol", 19) == 0)
      return IPP2P_BIT * 100;
-
    /*
-    * get tracker commandos, all starts with GET /
-    * then it can follow: scrape| announce
-    * and then ?hash_info=
+    * any tracker command starts with GET / then *may be* some file on web server
+    * (eg. announce.php or dupa.pl or whatever.cgi or NOTHING for tracker on root dir)
+    * but *must have* one (or more) of strings listed below (true for scrape and announce)
     */
    if (memcmp(payload, "GET /", 5) == 0) {
-     /* message scrape */
-     if (memcmp(payload + 5, "scrape?info_hash=", 17) == 0)
-       return IPP2P_BIT * 100 + 1;
-     /* message announce */
-     if (memcmp(payload + 5, "announce?info_hash=", 19) == 0)
-       return IPP2P_BIT * 100 + 2;
+     if(strstr(payload, "info_hash=") != NULL)
+       return IPP2P_BIT * 100 + 1;
+     if(strstr(payload, "peer_id=") != NULL)
+       return IPP2P_BIT * 100 + 2;
+     if(strstr(payload, "passkey=") != NULL)
+       return IPP2P_BIT * 100 + 4;
    }
  } else {
    /* bitcomet encryptes the first packet, so we have to detect another
---

-- 
Tomasz 'BloodMan' Tomkowiak

[-- Attachment #2: xt_ipp2p.patch --]
[-- Type: APPLICATION/OCTET-STREAM, Size: 1318 bytes --]

--- xtables-addons-1.22.old/extensions/xt_ipp2p.c	2010-01-22 20:14:37.000000000 +0100
+++ xtables-addons-1.22/extensions/xt_ipp2p.c	2010-01-26 06:05:47.000000000 +0100
@@ -505,19 +505,18 @@
 		if (payload[0] == 0x13)
 			if (memcmp(payload + 1, "BitTorrent protocol", 19) == 0)
 				return IPP2P_BIT * 100;
-
 		/*
-		 * get tracker commandos, all starts with GET /
-		 * then it can follow: scrape| announce
-		 * and then ?hash_info=
+		 * any tracker command starts with GET / then *may be* some file on web server
+		 * (eg. announce.php or dupa.pl or whatever.cgi or NOTHING for tracker on root dir)
+		 * but *must have* one (or more) of strings listed below (true for scrape and announce)
 		 */
 		if (memcmp(payload, "GET /", 5) == 0) {
-			/* message scrape */
-			if (memcmp(payload + 5, "scrape?info_hash=", 17) == 0)
-				return IPP2P_BIT * 100 + 1;
-			/* message announce */
-			if (memcmp(payload + 5, "announce?info_hash=", 19) == 0)
-				return IPP2P_BIT * 100 + 2;
+			if(strstr(payload, "info_hash=") != NULL)
+			    return IPP2P_BIT * 100 + 1;
+			if(strstr(payload, "peer_id=") != NULL)
+			    return IPP2P_BIT * 100 + 2;
+			if(strstr(payload, "passkey=") != NULL)
+			    return IPP2P_BIT * 100 + 4;
 		}
 	} else {
 	    	/* bitcomet encryptes the first packet, so we have to detect another