1 | /* |
2 | * Copyright (c) 2007-2011 Apple Inc. All rights reserved. |
3 | * |
4 | * @APPLE_OSREFERENCE_LICENSE_HEADER_START@ |
5 | * |
6 | * This file contains Original Code and/or Modifications of Original Code |
7 | * as defined in and that are subject to the Apple Public Source License |
8 | * Version 2.0 (the 'License'). You may not use this file except in |
9 | * compliance with the License. The rights granted to you under the License |
10 | * may not be used to create, or enable the creation or redistribution of, |
11 | * unlawful or unlicensed copies of an Apple operating system, or to |
12 | * circumvent, violate, or enable the circumvention or violation of, any |
13 | * terms of an Apple operating system software license agreement. |
14 | * |
15 | * Please obtain a copy of the License at |
16 | * http://www.opensource.apple.com/apsl/ and read it before using this file. |
17 | * |
18 | * The Original Code and all software distributed under the License are |
19 | * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER |
20 | * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, |
21 | * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, |
22 | * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. |
23 | * Please see the License for the specific language governing rights and |
24 | * limitations under the License. |
25 | * |
26 | * @APPLE_OSREFERENCE_LICENSE_HEADER_END@ |
27 | */ |
28 | |
29 | /* $apfw: pf_osfp.c,v 1.4 2008/08/27 00:01:32 jhw Exp $ */ |
30 | /* $OpenBSD: pf_osfp.c,v 1.12 2006/12/13 18:14:10 itojun Exp $ */ |
31 | |
32 | /* |
33 | * Copyright (c) 2003 Mike Frantzen <frantzen@w4g.org> |
34 | * |
35 | * Permission to use, copy, modify, and distribute this software for any |
36 | * purpose with or without fee is hereby granted, provided that the above |
37 | * copyright notice and this permission notice appear in all copies. |
38 | * |
39 | * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES |
40 | * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF |
41 | * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR |
42 | * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES |
43 | * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN |
44 | * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF |
45 | * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. |
46 | * |
47 | */ |
48 | |
49 | #include <machine/endian.h> |
50 | #include <sys/param.h> |
51 | #include <sys/socket.h> |
52 | #include <sys/systm.h> |
53 | #include <sys/mbuf.h> |
54 | |
55 | #include <netinet/in.h> |
56 | #include <netinet/in_systm.h> |
57 | #include <netinet/ip.h> |
58 | #include <netinet/tcp.h> |
59 | #include <netinet/tcp_fsm.h> |
60 | |
61 | #include <net/if.h> |
62 | #include <net/pfvar.h> |
63 | |
64 | #if INET6 |
65 | #include <netinet/ip6.h> |
66 | #include <netinet6/in6_var.h> |
67 | #endif /* INET6 */ |
68 | |
69 | #define DPFPRINTF(format, x...) \ |
70 | if (pf_status.debug >= PF_DEBUG_NOISY) \ |
71 | printf(format, ##x) |
72 | |
73 | static SLIST_HEAD(pf_osfp_list, pf_os_fingerprint) pf_osfp_list; |
74 | static struct pool pf_osfp_entry_pl; |
75 | static struct pool pf_osfp_pl; |
76 | |
77 | static struct pf_os_fingerprint *pf_osfp_find(struct pf_osfp_list *, |
78 | struct pf_os_fingerprint *, u_int8_t); |
79 | static struct pf_os_fingerprint *pf_osfp_find_exact(struct pf_osfp_list *, |
80 | struct pf_os_fingerprint *); |
81 | static void pf_osfp_insert(struct pf_osfp_list *, struct pf_os_fingerprint *); |
82 | |
83 | |
84 | /* |
85 | * Passively fingerprint the OS of the host (IPv4 TCP SYN packets only) |
86 | * Returns the list of possible OSes. |
87 | */ |
88 | struct pf_osfp_enlist * |
89 | pf_osfp_fingerprint(struct pf_pdesc *pd, pbuf_t *pbuf, int off, |
90 | const struct tcphdr *tcp) |
91 | { |
92 | struct ip *ip; |
93 | struct ip6_hdr *ip6; |
94 | char hdr[60]; |
95 | |
96 | if ((pd->af != PF_INET && pd->af != PF_INET6) || |
97 | pd->proto != IPPROTO_TCP || |
98 | (tcp->th_off << 2) < (int)sizeof (*tcp)) |
99 | return (NULL); |
100 | |
101 | if (pd->af == PF_INET) { |
102 | ip = pbuf->pb_data; |
103 | ip6 = (struct ip6_hdr *)NULL; |
104 | } else { |
105 | ip = (struct ip *)NULL; |
106 | ip6 = pbuf->pb_data; |
107 | } |
108 | if (!pf_pull_hdr(pbuf, off, hdr, tcp->th_off << 2, NULL, NULL, |
109 | pd->af)) |
110 | return (NULL); |
111 | |
112 | return (pf_osfp_fingerprint_hdr(ip, ip6, (struct tcphdr *)(void *)hdr)); |
113 | } |
114 | |
115 | struct pf_osfp_enlist * |
116 | pf_osfp_fingerprint_hdr(const struct ip *ip, const struct ip6_hdr *ip6, |
117 | const struct tcphdr *tcp) |
118 | { |
119 | #if !INET6 |
120 | #pragma unused(ip6) |
121 | #endif /* !INET6 */ |
122 | struct pf_os_fingerprint fp, *fpresult; |
123 | int cnt, optlen = 0; |
124 | const u_int8_t *optp; |
125 | char srcname[128]; |
126 | |
127 | if ((tcp->th_flags & (TH_SYN|TH_ACK)) != TH_SYN) |
128 | return (NULL); |
129 | if (ip) { |
130 | if ((ip->ip_off & htons(IP_OFFMASK)) != 0) |
131 | return (NULL); |
132 | } |
133 | |
134 | memset(&fp, 0, sizeof (fp)); |
135 | |
136 | if (ip) { |
137 | fp.fp_psize = ntohs(ip->ip_len); |
138 | fp.fp_ttl = ip->ip_ttl; |
139 | if (ip->ip_off & htons(IP_DF)) |
140 | fp.fp_flags |= PF_OSFP_DF; |
141 | (void) inet_ntop(AF_INET, &ip->ip_src, srcname, |
142 | (socklen_t)sizeof (srcname)); |
143 | } |
144 | #if INET6 |
145 | else if (ip6) { |
146 | /* jumbo payload? */ |
147 | fp.fp_psize = sizeof (struct ip6_hdr) + ntohs(ip6->ip6_plen); |
148 | fp.fp_ttl = ip6->ip6_hlim; |
149 | fp.fp_flags |= PF_OSFP_DF; |
150 | fp.fp_flags |= PF_OSFP_INET6; |
151 | (void) inet_ntop(AF_INET6, &ip6->ip6_src, srcname, |
152 | (socklen_t)sizeof (srcname)); |
153 | } |
154 | #endif |
155 | else |
156 | return (NULL); |
157 | fp.fp_wsize = ntohs(tcp->th_win); |
158 | |
159 | |
160 | cnt = (tcp->th_off << 2) - sizeof (*tcp); |
161 | optp = (const u_int8_t *)((const char *)tcp + sizeof (*tcp)); |
162 | for (; cnt > 0; cnt -= optlen, optp += optlen) { |
163 | if (*optp == TCPOPT_EOL) |
164 | break; |
165 | |
166 | fp.fp_optcnt++; |
167 | if (*optp == TCPOPT_NOP) { |
168 | fp.fp_tcpopts = (fp.fp_tcpopts << PF_OSFP_TCPOPT_BITS) | |
169 | PF_OSFP_TCPOPT_NOP; |
170 | optlen = 1; |
171 | } else { |
172 | if (cnt < 2) |
173 | return (NULL); |
174 | optlen = optp[1]; |
175 | if (optlen > cnt || optlen < 2) |
176 | return (NULL); |
177 | switch (*optp) { |
178 | case TCPOPT_MAXSEG: |
179 | if (optlen >= TCPOLEN_MAXSEG) |
180 | memcpy(&fp.fp_mss, &optp[2], |
181 | sizeof (fp.fp_mss)); |
182 | fp.fp_tcpopts = (fp.fp_tcpopts << |
183 | PF_OSFP_TCPOPT_BITS) | PF_OSFP_TCPOPT_MSS; |
184 | #if BYTE_ORDER != BIG_ENDIAN |
185 | NTOHS(fp.fp_mss); |
186 | #endif |
187 | break; |
188 | case TCPOPT_WINDOW: |
189 | if (optlen >= TCPOLEN_WINDOW) |
190 | memcpy(&fp.fp_wscale, &optp[2], |
191 | sizeof (fp.fp_wscale)); |
192 | #if BYTE_ORDER != BIG_ENDIAN |
193 | NTOHS(fp.fp_wscale); |
194 | #endif |
195 | fp.fp_tcpopts = (fp.fp_tcpopts << |
196 | PF_OSFP_TCPOPT_BITS) | |
197 | PF_OSFP_TCPOPT_WSCALE; |
198 | break; |
199 | case TCPOPT_SACK_PERMITTED: |
200 | fp.fp_tcpopts = (fp.fp_tcpopts << |
201 | PF_OSFP_TCPOPT_BITS) | PF_OSFP_TCPOPT_SACK; |
202 | break; |
203 | case TCPOPT_TIMESTAMP: |
204 | if (optlen >= TCPOLEN_TIMESTAMP) { |
205 | u_int32_t ts; |
206 | memcpy(&ts, &optp[2], sizeof (ts)); |
207 | if (ts == 0) |
208 | fp.fp_flags |= PF_OSFP_TS0; |
209 | |
210 | } |
211 | fp.fp_tcpopts = (fp.fp_tcpopts << |
212 | PF_OSFP_TCPOPT_BITS) | PF_OSFP_TCPOPT_TS; |
213 | break; |
214 | default: |
215 | return (NULL); |
216 | } |
217 | } |
218 | optlen = MAX(optlen, 1); /* paranoia */ |
219 | } |
220 | |
221 | DPFPRINTF("fingerprinted %s:%d %d:%d:%d:%d:%llx (%d) " |
222 | "(TS=%s,M=%s%d,W=%s%d)\n" , |
223 | srcname, ntohs(tcp->th_sport), |
224 | fp.fp_wsize, fp.fp_ttl, (fp.fp_flags & PF_OSFP_DF) != 0, |
225 | fp.fp_psize, (long long int)fp.fp_tcpopts, fp.fp_optcnt, |
226 | (fp.fp_flags & PF_OSFP_TS0) ? "0" : "" , |
227 | (fp.fp_flags & PF_OSFP_MSS_MOD) ? "%" : |
228 | (fp.fp_flags & PF_OSFP_MSS_DC) ? "*" : "" , |
229 | fp.fp_mss, |
230 | (fp.fp_flags & PF_OSFP_WSCALE_MOD) ? "%" : |
231 | (fp.fp_flags & PF_OSFP_WSCALE_DC) ? "*" : "" , |
232 | fp.fp_wscale); |
233 | |
234 | if ((fpresult = pf_osfp_find(&pf_osfp_list, &fp, |
235 | PF_OSFP_MAXTTL_OFFSET))) |
236 | return (&fpresult->fp_oses); |
237 | return (NULL); |
238 | } |
239 | |
240 | /* Match a fingerprint ID against a list of OSes */ |
241 | int |
242 | pf_osfp_match(struct pf_osfp_enlist *list, pf_osfp_t os) |
243 | { |
244 | struct pf_osfp_entry *entry; |
245 | int os_class, os_version, os_subtype; |
246 | int en_class, en_version, en_subtype; |
247 | |
248 | if (os == PF_OSFP_ANY) |
249 | return (1); |
250 | if (list == NULL) { |
251 | DPFPRINTF("osfp no match against %x\n" , os); |
252 | return (os == PF_OSFP_UNKNOWN); |
253 | } |
254 | PF_OSFP_UNPACK(os, os_class, os_version, os_subtype); |
255 | SLIST_FOREACH(entry, list, fp_entry) { |
256 | PF_OSFP_UNPACK(entry->fp_os, en_class, en_version, en_subtype); |
257 | if ((os_class == PF_OSFP_ANY || en_class == os_class) && |
258 | (os_version == PF_OSFP_ANY || en_version == os_version) && |
259 | (os_subtype == PF_OSFP_ANY || en_subtype == os_subtype)) { |
260 | DPFPRINTF("osfp matched %s %s %s %x==%x\n" , |
261 | entry->fp_class_nm, entry->fp_version_nm, |
262 | entry->fp_subtype_nm, os, entry->fp_os); |
263 | return (1); |
264 | } |
265 | } |
266 | DPFPRINTF("fingerprint 0x%x didn't match\n" , os); |
267 | return (0); |
268 | } |
269 | |
270 | /* Initialize the OS fingerprint system */ |
271 | void |
272 | pf_osfp_initialize(void) |
273 | { |
274 | pool_init(&pf_osfp_entry_pl, sizeof (struct pf_osfp_entry), 0, 0, 0, |
275 | "pfosfpen" , NULL); |
276 | pool_init(&pf_osfp_pl, sizeof (struct pf_os_fingerprint), 0, 0, 0, |
277 | "pfosfp" , NULL); |
278 | SLIST_INIT(&pf_osfp_list); |
279 | } |
280 | |
281 | #if 0 |
282 | void |
283 | pf_osfp_destroy(void) |
284 | { |
285 | pf_osfp_flush(); |
286 | |
287 | pool_destroy(&pf_osfp_pl); |
288 | pool_destroy(&pf_osfp_entry_pl); |
289 | } |
290 | #endif |
291 | |
292 | /* Flush the fingerprint list */ |
293 | void |
294 | pf_osfp_flush(void) |
295 | { |
296 | struct pf_os_fingerprint *fp; |
297 | struct pf_osfp_entry *entry; |
298 | |
299 | while ((fp = SLIST_FIRST(&pf_osfp_list))) { |
300 | SLIST_REMOVE_HEAD(&pf_osfp_list, fp_next); |
301 | while ((entry = SLIST_FIRST(&fp->fp_oses))) { |
302 | SLIST_REMOVE_HEAD(&fp->fp_oses, fp_entry); |
303 | pool_put(&pf_osfp_entry_pl, entry); |
304 | } |
305 | pool_put(&pf_osfp_pl, fp); |
306 | } |
307 | } |
308 | |
309 | |
310 | /* Add a fingerprint */ |
311 | int |
312 | pf_osfp_add(struct pf_osfp_ioctl *fpioc) |
313 | { |
314 | struct pf_os_fingerprint *fp, fpadd; |
315 | struct pf_osfp_entry *entry, *uentry; |
316 | |
317 | memset(&fpadd, 0, sizeof (fpadd)); |
318 | fpadd.fp_tcpopts = fpioc->fp_tcpopts; |
319 | fpadd.fp_wsize = fpioc->fp_wsize; |
320 | fpadd.fp_psize = fpioc->fp_psize; |
321 | fpadd.fp_mss = fpioc->fp_mss; |
322 | fpadd.fp_flags = fpioc->fp_flags; |
323 | fpadd.fp_optcnt = fpioc->fp_optcnt; |
324 | fpadd.fp_wscale = fpioc->fp_wscale; |
325 | fpadd.fp_ttl = fpioc->fp_ttl; |
326 | |
327 | uentry = &fpioc->fp_os; |
328 | uentry->fp_entry.sle_next = NULL; |
329 | uentry->fp_class_nm[sizeof (uentry->fp_class_nm) - 1] = '\0'; |
330 | uentry->fp_version_nm[sizeof (uentry->fp_version_nm) - 1] = '\0'; |
331 | uentry->fp_subtype_nm[sizeof (uentry->fp_subtype_nm) - 1] = '\0'; |
332 | |
333 | DPFPRINTF("adding osfp %s %s %s = %s%d:%d:%d:%s%d:0x%llx %d " |
334 | "(TS=%s,M=%s%d,W=%s%d) %x\n" , |
335 | fpioc->fp_os.fp_class_nm, fpioc->fp_os.fp_version_nm, |
336 | fpioc->fp_os.fp_subtype_nm, |
337 | (fpadd.fp_flags & PF_OSFP_WSIZE_MOD) ? "%" : |
338 | (fpadd.fp_flags & PF_OSFP_WSIZE_MSS) ? "S" : |
339 | (fpadd.fp_flags & PF_OSFP_WSIZE_MTU) ? "T" : |
340 | (fpadd.fp_flags & PF_OSFP_WSIZE_DC) ? "*" : "" , |
341 | fpadd.fp_wsize, |
342 | fpadd.fp_ttl, |
343 | (fpadd.fp_flags & PF_OSFP_DF) ? 1 : 0, |
344 | (fpadd.fp_flags & PF_OSFP_PSIZE_MOD) ? "%" : |
345 | (fpadd.fp_flags & PF_OSFP_PSIZE_DC) ? "*" : "" , |
346 | fpadd.fp_psize, |
347 | (long long int)fpadd.fp_tcpopts, fpadd.fp_optcnt, |
348 | (fpadd.fp_flags & PF_OSFP_TS0) ? "0" : "" , |
349 | (fpadd.fp_flags & PF_OSFP_MSS_MOD) ? "%" : |
350 | (fpadd.fp_flags & PF_OSFP_MSS_DC) ? "*" : "" , |
351 | fpadd.fp_mss, |
352 | (fpadd.fp_flags & PF_OSFP_WSCALE_MOD) ? "%" : |
353 | (fpadd.fp_flags & PF_OSFP_WSCALE_DC) ? "*" : "" , |
354 | fpadd.fp_wscale, |
355 | fpioc->fp_os.fp_os); |
356 | |
357 | |
358 | if ((fp = pf_osfp_find_exact(&pf_osfp_list, &fpadd))) { |
359 | SLIST_FOREACH(entry, &fp->fp_oses, fp_entry) { |
360 | if (PF_OSFP_ENTRY_EQ(entry, &fpioc->fp_os)) |
361 | return (EEXIST); |
362 | } |
363 | if ((entry = pool_get(&pf_osfp_entry_pl, PR_WAITOK)) == NULL) |
364 | return (ENOMEM); |
365 | } else { |
366 | if ((fp = pool_get(&pf_osfp_pl, PR_WAITOK)) == NULL) |
367 | return (ENOMEM); |
368 | memset(fp, 0, sizeof (*fp)); |
369 | fp->fp_tcpopts = fpioc->fp_tcpopts; |
370 | fp->fp_wsize = fpioc->fp_wsize; |
371 | fp->fp_psize = fpioc->fp_psize; |
372 | fp->fp_mss = fpioc->fp_mss; |
373 | fp->fp_flags = fpioc->fp_flags; |
374 | fp->fp_optcnt = fpioc->fp_optcnt; |
375 | fp->fp_wscale = fpioc->fp_wscale; |
376 | fp->fp_ttl = fpioc->fp_ttl; |
377 | SLIST_INIT(&fp->fp_oses); |
378 | if ((entry = pool_get(&pf_osfp_entry_pl, PR_WAITOK)) == NULL) { |
379 | pool_put(&pf_osfp_pl, fp); |
380 | return (ENOMEM); |
381 | } |
382 | pf_osfp_insert(&pf_osfp_list, fp); |
383 | } |
384 | memcpy(entry, &fpioc->fp_os, sizeof (*entry)); |
385 | |
386 | /* Make sure the strings are NUL terminated */ |
387 | entry->fp_class_nm[sizeof (entry->fp_class_nm)-1] = '\0'; |
388 | entry->fp_version_nm[sizeof (entry->fp_version_nm)-1] = '\0'; |
389 | entry->fp_subtype_nm[sizeof (entry->fp_subtype_nm)-1] = '\0'; |
390 | |
391 | SLIST_INSERT_HEAD(&fp->fp_oses, entry, fp_entry); |
392 | |
393 | #ifdef PFDEBUG |
394 | if ((fp = pf_osfp_validate())) |
395 | printf("Invalid fingerprint list\n" ); |
396 | #endif /* PFDEBUG */ |
397 | return (0); |
398 | } |
399 | |
400 | |
401 | /* Find a fingerprint in the list */ |
402 | struct pf_os_fingerprint * |
403 | pf_osfp_find(struct pf_osfp_list *list, struct pf_os_fingerprint *find, |
404 | u_int8_t ttldiff) |
405 | { |
406 | struct pf_os_fingerprint *f; |
407 | |
408 | #define MATCH_INT(_MOD, _DC, _field) \ |
409 | if ((f->fp_flags & _DC) == 0) { \ |
410 | if ((f->fp_flags & _MOD) == 0) { \ |
411 | if (f->_field != find->_field) \ |
412 | continue; \ |
413 | } else { \ |
414 | if (f->_field == 0 || find->_field % f->_field) \ |
415 | continue; \ |
416 | } \ |
417 | } |
418 | |
419 | SLIST_FOREACH(f, list, fp_next) { |
420 | if (f->fp_tcpopts != find->fp_tcpopts || |
421 | f->fp_optcnt != find->fp_optcnt || |
422 | f->fp_ttl < find->fp_ttl || |
423 | f->fp_ttl - find->fp_ttl > ttldiff || |
424 | (f->fp_flags & (PF_OSFP_DF|PF_OSFP_TS0)) != |
425 | (find->fp_flags & (PF_OSFP_DF|PF_OSFP_TS0))) |
426 | continue; |
427 | |
428 | MATCH_INT(PF_OSFP_PSIZE_MOD, PF_OSFP_PSIZE_DC, fp_psize) |
429 | MATCH_INT(PF_OSFP_MSS_MOD, PF_OSFP_MSS_DC, fp_mss) |
430 | MATCH_INT(PF_OSFP_WSCALE_MOD, PF_OSFP_WSCALE_DC, fp_wscale) |
431 | if ((f->fp_flags & PF_OSFP_WSIZE_DC) == 0) { |
432 | if (f->fp_flags & PF_OSFP_WSIZE_MSS) { |
433 | if (find->fp_mss == 0) |
434 | continue; |
435 | |
436 | /* |
437 | * Some "smart" NAT devices and DSL routers will tweak the MSS size and |
438 | * will set it to whatever is suitable for the link type. |
439 | */ |
440 | #define SMART_MSS 1460 |
441 | if ((find->fp_wsize % find->fp_mss || |
442 | find->fp_wsize / find->fp_mss != |
443 | f->fp_wsize) && |
444 | (find->fp_wsize % SMART_MSS || |
445 | find->fp_wsize / SMART_MSS != |
446 | f->fp_wsize)) |
447 | continue; |
448 | } else if (f->fp_flags & PF_OSFP_WSIZE_MTU) { |
449 | if (find->fp_mss == 0) |
450 | continue; |
451 | |
452 | #define MTUOFF (sizeof (struct ip) + sizeof (struct tcphdr)) |
453 | #define SMART_MTU (SMART_MSS + MTUOFF) |
454 | if ((find->fp_wsize % (find->fp_mss + MTUOFF) || |
455 | find->fp_wsize / (find->fp_mss + MTUOFF) != |
456 | f->fp_wsize) && |
457 | (find->fp_wsize % SMART_MTU || |
458 | find->fp_wsize / SMART_MTU != |
459 | f->fp_wsize)) |
460 | continue; |
461 | } else if (f->fp_flags & PF_OSFP_WSIZE_MOD) { |
462 | if (f->fp_wsize == 0 || find->fp_wsize % |
463 | f->fp_wsize) |
464 | continue; |
465 | } else { |
466 | if (f->fp_wsize != find->fp_wsize) |
467 | continue; |
468 | } |
469 | } |
470 | return (f); |
471 | } |
472 | |
473 | return (NULL); |
474 | } |
475 | |
476 | /* Find an exact fingerprint in the list */ |
477 | struct pf_os_fingerprint * |
478 | pf_osfp_find_exact(struct pf_osfp_list *list, struct pf_os_fingerprint *find) |
479 | { |
480 | struct pf_os_fingerprint *f; |
481 | |
482 | SLIST_FOREACH(f, list, fp_next) { |
483 | if (f->fp_tcpopts == find->fp_tcpopts && |
484 | f->fp_wsize == find->fp_wsize && |
485 | f->fp_psize == find->fp_psize && |
486 | f->fp_mss == find->fp_mss && |
487 | f->fp_flags == find->fp_flags && |
488 | f->fp_optcnt == find->fp_optcnt && |
489 | f->fp_wscale == find->fp_wscale && |
490 | f->fp_ttl == find->fp_ttl) |
491 | return (f); |
492 | } |
493 | |
494 | return (NULL); |
495 | } |
496 | |
497 | /* Insert a fingerprint into the list */ |
498 | void |
499 | pf_osfp_insert(struct pf_osfp_list *list, struct pf_os_fingerprint *ins) |
500 | { |
501 | struct pf_os_fingerprint *f, *prev = NULL; |
502 | |
503 | /* XXX need to go semi tree based. can key on tcp options */ |
504 | |
505 | SLIST_FOREACH(f, list, fp_next) |
506 | prev = f; |
507 | if (prev) |
508 | SLIST_INSERT_AFTER(prev, ins, fp_next); |
509 | else |
510 | SLIST_INSERT_HEAD(list, ins, fp_next); |
511 | } |
512 | |
513 | /* Fill a fingerprint by its number (from an ioctl) */ |
514 | int |
515 | pf_osfp_get(struct pf_osfp_ioctl *fpioc) |
516 | { |
517 | struct pf_os_fingerprint *fp; |
518 | struct pf_osfp_entry *entry; |
519 | int num = fpioc->fp_getnum; |
520 | int i = 0; |
521 | |
522 | |
523 | memset(fpioc, 0, sizeof (*fpioc)); |
524 | SLIST_FOREACH(fp, &pf_osfp_list, fp_next) { |
525 | SLIST_FOREACH(entry, &fp->fp_oses, fp_entry) { |
526 | if (i++ == num) { |
527 | fpioc->fp_mss = fp->fp_mss; |
528 | fpioc->fp_wsize = fp->fp_wsize; |
529 | fpioc->fp_flags = fp->fp_flags; |
530 | fpioc->fp_psize = fp->fp_psize; |
531 | fpioc->fp_ttl = fp->fp_ttl; |
532 | fpioc->fp_wscale = fp->fp_wscale; |
533 | fpioc->fp_getnum = num; |
534 | memcpy(&fpioc->fp_os, entry, |
535 | sizeof (fpioc->fp_os)); |
536 | fpioc->fp_os.fp_entry.sle_next = NULL; |
537 | return (0); |
538 | } |
539 | } |
540 | } |
541 | |
542 | return (EBUSY); |
543 | } |
544 | |
545 | |
546 | /* Validate that each signature is reachable */ |
547 | struct pf_os_fingerprint * |
548 | pf_osfp_validate(void) |
549 | { |
550 | struct pf_os_fingerprint *f, *f2, find; |
551 | |
552 | SLIST_FOREACH(f, &pf_osfp_list, fp_next) { |
553 | memcpy(&find, f, sizeof (find)); |
554 | |
555 | /* We do a few MSS/th_win percolations to make things unique */ |
556 | if (find.fp_mss == 0) |
557 | find.fp_mss = 128; |
558 | if (f->fp_flags & PF_OSFP_WSIZE_MSS) |
559 | find.fp_wsize *= find.fp_mss; |
560 | else if (f->fp_flags & PF_OSFP_WSIZE_MTU) |
561 | find.fp_wsize *= (find.fp_mss + 40); |
562 | else if (f->fp_flags & PF_OSFP_WSIZE_MOD) |
563 | find.fp_wsize *= 2; |
564 | if (f != (f2 = pf_osfp_find(&pf_osfp_list, &find, 0))) { |
565 | if (f2) |
566 | printf("Found \"%s %s %s\" instead of " |
567 | "\"%s %s %s\"\n" , |
568 | SLIST_FIRST(&f2->fp_oses)->fp_class_nm, |
569 | SLIST_FIRST(&f2->fp_oses)->fp_version_nm, |
570 | SLIST_FIRST(&f2->fp_oses)->fp_subtype_nm, |
571 | SLIST_FIRST(&f->fp_oses)->fp_class_nm, |
572 | SLIST_FIRST(&f->fp_oses)->fp_version_nm, |
573 | SLIST_FIRST(&f->fp_oses)->fp_subtype_nm); |
574 | else |
575 | printf("Couldn't find \"%s %s %s\"\n" , |
576 | SLIST_FIRST(&f->fp_oses)->fp_class_nm, |
577 | SLIST_FIRST(&f->fp_oses)->fp_version_nm, |
578 | SLIST_FIRST(&f->fp_oses)->fp_subtype_nm); |
579 | return (f); |
580 | } |
581 | } |
582 | return (NULL); |
583 | } |
584 | |