iptables匹配string

string匹配帮助信息如下。其中模式匹配算法可指定bm（Boyer-Moore）或者kmp（Knuth-Pratt-Morris）。选项icase表示在匹配时忽略大小写。

# iptables -m string -h

string match options:
--from                       Offset to start searching from
--to                         Offset to stop searching
--algo                       Algorithm
--icase                      Ignore case (default: 0)
[!] --string string          Match a string in a packet
[!] --hex-string string      Match a hex string in a packet

配置如下策略，匹配网址www.shb.cas.cn，这个http服务的网址，内容没有加密。

# iptables -A OUTPUT -p tcp --dport 80 -m string --algo bm --string 'www.shb.cas.cn' -j LOG
# 
# iptables -L -n -v
Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    2   382 LOG        tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:80 
	STRING match  "www.shb.cas.cn" ALGO name bm TO 65535 LOG flags 0 level 4

执行如下的测试，可以在内核日志文件中看到访问记录。

# wget http://www.shb.cas.cn/index.html
#
# tcpdump -i ens33 -n -vvv port 80
13:43:39.373004 IP (tos 0x0, ttl 64, id 48705, offset 0, flags [DF], proto TCP (6), length 191)
     192.168.0.4.55318 > 159.226.242.44.80: Flags [P.], cksum 0x536d (incorrect -> 0x4469), seq 1:152, ack 1, win 502, length 151: HTTP, length: 151
        GET /index.html HTTP/1.1
        User-Agent: Wget/1.20.3 (linux-gnu)
        Accept: *
    if (conf->from_offset > conf->to_offset)
        return -EINVAL;
    if (conf->algo[XT_STRING_MAX_ALGO_NAME_SIZE - 1] != '')
        return -EINVAL;
    if (conf->patlen > XT_STRING_MAX_PATTERN_SIZE)
        return -EINVAL;
    if (conf->u.v1.flags & ~(XT_STRING_FLAG_IGNORECASE | XT_STRING_FLAG_INVERT))
        return -EINVAL;
    if (conf->u.v1.flags & XT_STRING_FLAG_IGNORECASE)
        flags |= TS_IGNORECASE;
    ts_conf = textsearch_prepare(conf->algo, conf->pattern, conf->patlen, GFP_KERNEL, flags);
    if (IS_ERR(ts_conf))
        return PTR_ERR(ts_conf);

    conf->config = ts_conf;

匹配判断函数如下，调用函数skb_find_text返回报文的匹配结果。

static bool
string_mt(const struct sk_buff *skb, struct xt_action_param *par)
{
    const struct xt_string_info *conf = par->matchinfo;
    bool invert;

    invert = conf->u.v1.flags & XT_STRING_FLAG_INVERT;

    return (skb_find_text((struct sk_buff *)skb, conf->from_offset,
                 conf->to_offset, conf->config)
                 != UINT_MAX) ^ invert;

内核版本 5.10