string matching in kernel 2.6

string matching in kernel 2.6

[muhaimin]

I found netfilter in kernel 2.6 doesnt support packet 
string-matching.How do i make it works in kernel 2.6?

-- 
Muhaimin Dzulfakar
Security Engineer
Extol Corporation (M) Sdn Bhd

Re: string matching in kernel 2.6

[Ming-Ching Tiew]

From: "muhaimin" <muhaimin.dzulfakar@extol.com.my>


> 
> I found netfilter in kernel 2.6 doesnt support packet 
> string-matching.How do i make it works in kernel 2.6?
> 

I think it suffers the same problem with the ipt_random patch, 
so you could just create a patch yourself by duplicating what's 
in the 2.4 patch and change the info file accordingly.

Cheers.

Re: string matching in kernel 2.6

[Ming-Ching Tiew]

From: "Ming-Ching Tiew" <mingching.tiew@redtone.com>

> 
> From: "muhaimin" <muhaimin.dzulfakar@extol.com.my>
> 
> > I found netfilter in kernel 2.6 doesnt support packet 
> > string-matching.How do i make it works in kernel 2.6?
> > 
> 
> I think it suffers the same problem with the ipt_random patch, 
> so you could just create a patch yourself by duplicating what's 
> in the 2.4 patch and change the info file accordingly.
> 

You could also use this patch instead :-

https://lists.netfilter.org/pipermail/netfilter-devel/2004-December/017892.html

Re: string matching in kernel 2.6

[Jan Engelhardt]

>> > I found netfilter in kernel 2.6 doesnt support packet 
>> > string-matching.How do i make it works in kernel 2.6?
>> 
>> I think it suffers the same problem with the ipt_random patch, 
>> so you could just create a patch yourself by duplicating what's 
>> in the 2.4 patch and change the info file accordingly.
>> 
>
>You could also use this patch instead :-
>https://lists.netfilter.org/pipermail/netfilter-devel/2004-December/017892.html
[ipt_string]


If neither works, you can try abusing ipt_layer7 ;-)
See http://l7-filter.sf.net/



Jan Engelhardt
-- 

Re: string matching in kernel 2.6

[Ming-Ching Tiew]

From: "Jan Engelhardt" <jengelh@linux01.gwdg.de>
> 
> If neither works, you can try abusing ipt_layer7 ;-)
> See http://l7-filter.sf.net/
> 

Not sure if you want to use an electric saw to cut the bread.

Cheers.

Re: string matching in kernel 2.6

[Jan Engelhardt]

>> If neither works, you can try abusing ipt_layer7 ;-)
>> See http://l7-filter.sf.net/
>
>Not sure if you want to use an electric saw to cut the bread.

If you don't have anything else, this is the best temporary solution.


Jan Engelhardt
-- 

Re: string matching in kernel 2.6

[Jozsef Kadlecsik]

On Thu, 21 Jul 2005, Ming-Ching Tiew wrote:

> > From: "muhaimin" <muhaimin.dzulfakar@extol.com.my>
> >
> > > I found netfilter in kernel 2.6 doesnt support packet
> > > string-matching.How do i make it works in kernel 2.6?
>
> You could also use this patch instead :-
>
> https://lists.netfilter.org/pipermail/netfilter-devel/2004-December/017892.html

That patch is not complete because it does not handle non-linear packets.

Best regards,
Jozsef
-
E-mail  : kadlec@blackhole.kfki.hu, kadlec@sunserv.kfki.hu
PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt
Address : KFKI Research Institute for Particle and Nuclear Physics
          H-1525 Budapest 114, POB. 49, Hungary

Re: string matching in kernel 2.6

[Ming-Ching Tiew]

From: "Jozsef Kadlecsik" <kadlec@blackhole.kfki.hu>
> >
> > You could also use this patch instead :-
> >
> > https://lists.netfilter.org/pipermail/netfilter-devel/2004-December/017892.html
> 
> That patch is not complete because it does not handle non-linear packets.
> 

But it is almost identical source as the 2.4 version, meaning the 2.4 version 
is also not able to handle the so called non-linear packets then ?

Cheers

Re: string matching in kernel 2.6

[Jozsef Kadlecsik]

On Thu, 21 Jul 2005, Ming-Ching Tiew wrote:

> > > https://lists.netfilter.org/pipermail/netfilter-devel/2004-December/017892.html
> >
> > That patch is not complete because it does not handle non-linear packets.
>
> But it is almost identical source as the 2.4 version, meaning the 2.4 version
> is also not able to handle the so called non-linear packets then ?

No, the 2.4 version of the module is fine in the 2.4 tree. However the
internal packet handling in the IP stack changed between 2.4 and 2.6. This
is the reason why modules need porting. Just copying the files and
adjusting the function arguments are not enough.

Best regards,
Jozsef
-
E-mail  : kadlec@blackhole.kfki.hu, kadlec@sunserv.kfki.hu
PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt
Address : KFKI Research Institute for Particle and Nuclear Physics
          H-1525 Budapest 114, POB. 49, Hungary

Re: string matching in kernel 2.6

[Ming-Ching Tiew]

> 
> From: "Jan Engelhardt" <jengelh@linux01.gwdg.de>
> > 
> > If neither works, you can try abusing ipt_layer7 ;-)
> > See http://l7-filter.sf.net/
> > 
> 

I had a quick look at the source of ipt_layer7, it's linearising 
the skb so that the pattern can be matched. For ipp2p, it simply 
skip the non-linear skb (and it has been accepted into pom-ng).

So I think it should be quite easy if one wants to also handle 
the non-linear case, ie just linearise the skb. Not efficient, but
it should work. Right ?

Cheers.

Re: string matching in kernel 2.6

[Jan Engelhardt]

>> > If neither works, you can try abusing ipt_layer7 ;-)
>> > See http://l7-filter.sf.net/
>
>I had a quick look at the source of ipt_layer7, it's linearising 
>the skb so that the pattern can be matched. For ipp2p, it simply 

A right, yes, it linearizes, but only for the first 2048 bytes (the default 
buffer size). But anyway, what if in these first 2048 bytes two rules would 
match? You'd anyway get nonpredictable results.


Jan Engelhardt
--