string match on 2.6 kernel

PATCH In review Anatoly Pugachev 2 participants 2 messages Apr 6, 2005 netfilter

Share & tools

Anatoly Pugachev

author

2005-04-06 15:16 UTC #0 lore raw

PATCH 1/1 string match on 2.6 kernel

This kernel-2.6 patch is over cvs version of patch-o-matic, i'm used patch-o- matic-ng-20050316. Since i'm not a kernel programmer, this patch isn't SMP clean - noticed this in string/linux-2.6/info.
'diff -ru string/linux string/linux-2.6' for my changes over original sources. Someone please fix my lameness.

I've tested it over my linux 2.6.10 kernel and it "works for me".

PS: maybe smp_num_cpus = num_booting_cpus() can help?

Signature · 1 line

Anatoly Pugachev

string/help +3 -0

diff -ruN patch-o-matic-ng-20050316/string/help pom/string/help
@@ -4,3 +4,6 @@
 
 THIS PATCH DOES NOT WORK WITH KERNEL 2.4.9 !!!
 
+ Doesn't work with SMP kernel 2.6.x
+
+Usage example:

+# iptables -A INPUT -m string --string 'cmd.exe' -j QUEUE +

string/info +0 -1

diff -ruN patch-o-matic-ng-20050316/string/info pom/string/info
@@ -2,4 +2,3 @@
 Author: Emmanuel Roger <[email protected]>
 Status: Working, not with kernel 2.4.9
 Repository: extra
-Requires: linux < 2.6.0

string/linux-2.6/include/linux/netfilter_ipv4/ipt_string.h +21 -0

diff -ruN patch-o-matic-ng-20050316/string/linux-2.6/include/linux/netfilter_ipv4/ipt_string.h pom/string/linux-2.6/include/linux/netfilter_ipv4/ipt_string.h
@@ -0,0 +1,21 @@
+#ifndef _IPT_STRING_H
+#define _IPT_STRING_H
+
+/* *** PERFORMANCE TWEAK ***
+ * Packet size and search string threshold,
+ * above which sublinear searches is used. */
+#define IPT_STRING_HAYSTACK_THRESH	100
+#define IPT_STRING_NEEDLE_THRESH	20
+
+#define BM_MAX_NLEN 256
+#define BM_MAX_HLEN 1024
+
+typedef char *(*proc_ipt_search) (char *, char *, int, int);
+
+struct ipt_string_info {
+    char string[BM_MAX_NLEN];
+    u_int16_t invert;
+    u_int16_t len;
+};
+
+#endif /* _IPT_STRING_H */

string/linux-2.6/net/ipv4/netfilter/ipt_string.c +223 -0

223 lines not on this page · raw message

string/linux-2.6/net/ipv4/netfilter/Kconfig.ladd +9 -0

diff -ruN patch-o-matic-ng-20050316/string/linux-2.6/net/ipv4/netfilter/Kconfig.ladd pom/string/linux-2.6/net/ipv4/netfilter/Kconfig.ladd
@@ -0,0 +1,9 @@
+config IP_NF_MATCH_STRING
+	tristate  'String match support'
+	depends on IP_NF_IPTABLES
+	help
+	  String matching alows you to match packets which contain a
+	  specified string of characters.
+	
+	  If you want to compile it as a module, say M here and read
+	  Documentation/modules.txt.  If unsure, say `N'.

string/linux-2.6/net/ipv4/netfilter/Makefile.ladd +2 -0

diff -ruN patch-o-matic-ng-20050316/string/linux-2.6/net/ipv4/netfilter/Makefile.ladd pom/string/linux-2.6/net/ipv4/netfilter/Makefile.ladd
@@ -0,0 +1,2 @@
+obj-$(CONFIG_IP_NF_MATCH_HELPER) += ipt_helper.o
+obj-$(CONFIG_IP_NF_MATCH_STRING) += ipt_string.o

Pablo Neira

2005-04-06 18:12 UTC #1 lore raw

Hi,

Quoted 3 lines · Anatoly Pugachev

This kernel-2.6 patch is over cvs version of patch-o-matic, i'm used patch-o- matic-ng-20050316. Since i'm not a kernel programmer, this patch isn't SMP clean - noticed this in string/linux-2.6/info.

Current string matching support in pom-ng has several problems:

o Boyer-Moore shifts are calculated every time a packets hits the match, this is not necessary. This increases the constants hidden in the O-big notation.
o As you pointed out, it's neither SMP nor preemptible safe. Per-cpu stuff is not the way to do this.

I've got a brand new infrastructure for string matching that I posted during xmas. As soon as I get some spare time I'll be back on it.

--
Pablo