1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
|
This module matches a given string by using some pattern matching strategy. It requires a linux kernel >= 2.6.14.
.TP
\fB\-\-algo\fP {\fBbm\fP|\fBkmp\fP}
Select the pattern matching strategy. (bm = Boyer-Moore, kmp = Knuth-Pratt-Morris)
.TP
\fB\-\-from\fP \fIoffset\fP
Set the offset from which it starts looking for any matching. If not passed, default is 0.
.TP
\fB\-\-to\fP \fIoffset\fP
Set the offset up to which should be scanned. If the pattern does not start
within this offset, it is not considered a match.
If not passed, default is the packet size.
A second function of this parameter is instructing the kernel how much data
from the packet should be provided. With non-linear skbuffs (e.g. due to
fragmentation), a pattern extending past this offset may not be found. Also see
the related note below about Boyer-Moore algorithm in these cases.
.TP
[\fB!\fP] \fB\-\-string\fP \fIpattern\fP
Matches the given pattern.
.TP
[\fB!\fP] \fB\-\-hex\-string\fP \fIpattern\fP
Matches the given pattern in hex notation.
.TP
\fB\-\-icase\fP
Ignore case when searching.
.TP
Examples:
.IP
# The string pattern can be used for simple text characters.
.br
iptables \-A INPUT \-p tcp \-\-dport 80 \-m string \-\-algo bm \-\-string 'GET /index.html' \-j LOG
.IP
# The hex string pattern can be used for non-printable characters, like |0D 0A| or |0D0A|.
.br
iptables \-p udp \-\-dport 53 \-m string \-\-algo bm \-\-from 40 \-\-to 57 \-\-hex\-string '|03|www|09|netfilter|03|org|00|'
.P
Note: Since Boyer-Moore (BM) performs searches for matches from right to left and
the kernel may store a packet in multiple discontiguous blocks, it's possible
that a match could be spread over multiple blocks, in which case this algorithm
won't find it.
.P
If you wish to ensure that such thing won't ever happen, use the
Knuth-Pratt-Morris (KMP) algorithm instead. In conclusion, choose the proper
string search algorithm depending on your use-case.
.P
For example, if you're using the module for filtering, NIDS or any similar
security-focused purpose, then choose KMP. On the other hand, if you really care
about performance \(em for example, you're classifying packets to apply Quality
of Service (QoS) policies \(em and you don't mind about missing possible matches
spread over multiple fragments, then choose BM.
|
