1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
|
This module matches a given string by using some pattern matching strategy. It requires a linux kernel >= 2.6.14.
.TP
\fB\-\-algo\fP {\fBbm\fP|\fBkmp\fP}
Select the pattern matching strategy. (bm = Boyer-Moore, kmp = Knuth-Pratt-Morris)
.TP
\fB\-\-from\fP \fIoffset\fP
Set the offset from which it starts looking for any matching. If not passed, default is 0.
.TP
\fB\-\-to\fP \fIoffset\fP
Set the offset up to which should be scanned. That is, byte \fIoffset\fP
(counting from 0) is the last one that is scanned and the maximum position of
\fIpattern\fP's last character.
If not passed, default is the packet size.
.TP
[\fB!\fP] \fB\-\-string\fP \fIpattern\fP
Matches the given pattern.
.TP
[\fB!\fP] \fB\-\-hex\-string\fP \fIpattern\fP
Matches the given pattern in hex notation.
.TP
\fB\-\-icase\fP
Ignore case when searching.
.TP
Examples:
.IP
# The string pattern can be used for simple text characters.
.br
iptables \-A INPUT \-p tcp \-\-dport 80 \-m string \-\-algo bm \-\-string 'GET /index.html' \-j LOG
.IP
# The hex string pattern can be used for non-printable characters, like |0D 0A| or |0D0A|.
.br
iptables \-p udp \-\-dport 53 \-m string \-\-algo bm \-\-from 40 \-\-to 57 \-\-hex\-string '|03|www|09|netfilter|03|org|00|'
.P
Note: Since Boyer-Moore (BM) performs searches for matches from right to left and
the kernel may store a packet in multiple discontiguous blocks, it's possible
that a match could be spread over multiple blocks, in which case this algorithm
won't find it.
.P
If you wish to ensure that such thing won't ever happen, use the
Knuth-Pratt-Morris (KMP) algorithm instead. In conclusion, choose the proper
string search algorithm depending on your use-case.
.P
For example, if you're using the module for filtering, NIDS or any similar
security-focused purpose, then choose KMP. On the other hand, if you really care
about performance \(em for example, you're classifying packets to apply Quality
of Service (QoS) policies \(em and you don't mind about missing possible matches
spread over multiple fragments, then choose BM.
|
