pf_osfp.c revision 1.3.2.2
1 1.3.2.2 skrll /* $NetBSD: pf_osfp.c,v 1.3.2.2 2004/08/03 10:52:23 skrll Exp $ */ 2 1.3.2.2 skrll /* $OpenBSD: pf_osfp.c,v 1.9 2004/01/04 20:08:42 pvalchev Exp $ */ 3 1.3.2.2 skrll 4 1.3.2.2 skrll /* 5 1.3.2.2 skrll * Copyright (c) 2003 Mike Frantzen <frantzen (at) w4g.org> 6 1.3.2.2 skrll * 7 1.3.2.2 skrll * Permission to use, copy, modify, and distribute this software for any 8 1.3.2.2 skrll * purpose with or without fee is hereby granted, provided that the above 9 1.3.2.2 skrll * copyright notice and this permission notice appear in all copies. 10 1.3.2.2 skrll * 11 1.3.2.2 skrll * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 12 1.3.2.2 skrll * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 13 1.3.2.2 skrll * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 14 1.3.2.2 skrll * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 15 1.3.2.2 skrll * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 16 1.3.2.2 skrll * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 17 1.3.2.2 skrll * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 18 1.3.2.2 skrll * 19 1.3.2.2 skrll */ 20 1.3.2.2 skrll 21 1.3.2.2 skrll #ifdef _KERNEL_OPT 22 1.3.2.2 skrll #include "opt_inet.h" 23 1.3.2.2 skrll #endif 24 1.3.2.2 skrll 25 1.3.2.2 skrll #include <sys/param.h> 26 1.3.2.2 skrll #include <sys/socket.h> 27 1.3.2.2 skrll #ifdef _KERNEL 28 1.3.2.2 skrll # include <sys/systm.h> 29 1.3.2.2 skrll #endif /* _KERNEL */ 30 1.3.2.2 skrll #include <sys/mbuf.h> 31 1.3.2.2 skrll 32 1.3.2.2 skrll #include <netinet/in.h> 33 1.3.2.2 skrll #include <netinet/in_systm.h> 34 1.3.2.2 skrll #include <netinet/ip.h> 35 1.3.2.2 skrll #include <netinet/tcp.h> 36 1.3.2.2 skrll 37 1.3.2.2 skrll #include <net/if.h> 38 1.3.2.2 skrll #include <net/pfvar.h> 39 1.3.2.2 skrll 40 1.3.2.2 skrll #ifdef INET6 41 1.3.2.2 skrll #include <netinet/ip6.h> 42 1.3.2.2 skrll #endif /* INET6 */ 43 1.3.2.2 skrll 44 1.3.2.2 skrll 45 1.3.2.2 skrll #ifdef _KERNEL 46 1.3.2.2 skrll # define DPFPRINTF(format, x...) \ 47 1.3.2.2 skrll if (pf_status.debug >= PF_DEBUG_NOISY) \ 48 1.3.2.2 skrll printf(format , ##x) 49 1.3.2.2 skrll typedef struct pool pool_t; 50 1.3.2.2 skrll 51 1.3.2.2 skrll #else 52 1.3.2.2 skrll /* Userland equivalents so we can lend code to tcpdump et al. */ 53 1.3.2.2 skrll 54 1.3.2.2 skrll # include <arpa/inet.h> 55 1.3.2.2 skrll # include <errno.h> 56 1.3.2.2 skrll # include <stdio.h> 57 1.3.2.2 skrll # include <stdlib.h> 58 1.3.2.2 skrll # include <string.h> 59 1.3.2.2 skrll # define pool_t int 60 1.3.2.2 skrll # define pool_get(pool, flags) malloc(*(pool)) 61 1.3.2.2 skrll # define pool_put(pool, item) free(item) 62 1.3.2.2 skrll # define pool_init(pool, size, a, ao, f, m, p) (*(pool)) = (size) 63 1.3.2.2 skrll 64 1.3.2.2 skrll # ifdef PFDEBUG 65 1.3.2.2 skrll # include <sys/stdarg.h> 66 1.3.2.2 skrll # define DPFPRINTF(format, x...) fprintf(stderr, format , ##x) 67 1.3.2.2 skrll # else 68 1.3.2.2 skrll # define DPFPRINTF(format, x...) ((void)0) 69 1.3.2.2 skrll # endif /* PFDEBUG */ 70 1.3.2.2 skrll #endif /* _KERNEL */ 71 1.3.2.2 skrll 72 1.3.2.2 skrll 73 1.3.2.2 skrll SLIST_HEAD(pf_osfp_list, pf_os_fingerprint) pf_osfp_list; 74 1.3.2.2 skrll pool_t pf_osfp_entry_pl; 75 1.3.2.2 skrll pool_t pf_osfp_pl; 76 1.3.2.2 skrll 77 1.3.2.2 skrll struct pf_os_fingerprint *pf_osfp_find(struct pf_osfp_list *, 78 1.3.2.2 skrll struct pf_os_fingerprint *, u_int8_t); 79 1.3.2.2 skrll struct pf_os_fingerprint *pf_osfp_find_exact(struct pf_osfp_list *, 80 1.3.2.2 skrll struct pf_os_fingerprint *); 81 1.3.2.2 skrll void pf_osfp_insert(struct pf_osfp_list *, 82 1.3.2.2 skrll struct pf_os_fingerprint *); 83 1.3.2.2 skrll 84 1.3.2.2 skrll 85 1.3.2.2 skrll #ifdef _KERNEL 86 1.3.2.2 skrll /* 87 1.3.2.2 skrll * Passively fingerprint the OS of the host (IPv4 TCP SYN packets only) 88 1.3.2.2 skrll * Returns the list of possible OSes. 89 1.3.2.2 skrll */ 90 1.3.2.2 skrll struct pf_osfp_enlist * 91 1.3.2.2 skrll pf_osfp_fingerprint(struct pf_pdesc *pd, struct mbuf *m, int off, 92 1.3.2.2 skrll const struct tcphdr *tcp) 93 1.3.2.2 skrll { 94 1.3.2.2 skrll struct ip *ip; 95 1.3.2.2 skrll char hdr[60]; 96 1.3.2.2 skrll 97 1.3.2.2 skrll /* XXX don't have a fingerprint database for IPv6 :-( */ 98 1.3.2.2 skrll if (pd->af != PF_INET || pd->proto != IPPROTO_TCP || (tcp->th_off << 2) 99 1.3.2.2 skrll < sizeof(*tcp)) 100 1.3.2.2 skrll return (NULL); 101 1.3.2.2 skrll 102 1.3.2.2 skrll ip = mtod(m, struct ip *); 103 1.3.2.2 skrll if (!pf_pull_hdr(m, off, hdr, tcp->th_off << 2, NULL, NULL, pd->af)) 104 1.3.2.2 skrll return (NULL); 105 1.3.2.2 skrll 106 1.3.2.2 skrll return (pf_osfp_fingerprint_hdr(ip, (struct tcphdr *)hdr)); 107 1.3.2.2 skrll } 108 1.3.2.2 skrll #endif /* _KERNEL */ 109 1.3.2.2 skrll 110 1.3.2.2 skrll struct pf_osfp_enlist * 111 1.3.2.2 skrll pf_osfp_fingerprint_hdr(const struct ip *ip, const struct tcphdr *tcp) 112 1.3.2.2 skrll { 113 1.3.2.2 skrll struct pf_os_fingerprint fp, *fpresult; 114 1.3.2.2 skrll int cnt, optlen = 0; 115 1.3.2.2 skrll const u_int8_t *optp; 116 1.3.2.2 skrll 117 1.3.2.2 skrll if ((tcp->th_flags & (TH_SYN|TH_ACK)) != TH_SYN || (ip->ip_off & 118 1.3.2.2 skrll htons(IP_OFFMASK))) 119 1.3.2.2 skrll return (NULL); 120 1.3.2.2 skrll 121 1.3.2.2 skrll memset(&fp, 0, sizeof(fp)); 122 1.3.2.2 skrll 123 1.3.2.2 skrll fp.fp_psize = ntohs(ip->ip_len); 124 1.3.2.2 skrll fp.fp_ttl = ip->ip_ttl; 125 1.3.2.2 skrll if (ip->ip_off & htons(IP_DF)) 126 1.3.2.2 skrll fp.fp_flags |= PF_OSFP_DF; 127 1.3.2.2 skrll fp.fp_wsize = ntohs(tcp->th_win); 128 1.3.2.2 skrll 129 1.3.2.2 skrll 130 1.3.2.2 skrll cnt = (tcp->th_off << 2) - sizeof(*tcp); 131 1.3.2.2 skrll optp = (const u_int8_t *)((const char *)tcp + sizeof(*tcp)); 132 1.3.2.2 skrll for (; cnt > 0; cnt -= optlen, optp += optlen) { 133 1.3.2.2 skrll if (*optp == TCPOPT_EOL) 134 1.3.2.2 skrll break; 135 1.3.2.2 skrll 136 1.3.2.2 skrll fp.fp_optcnt++; 137 1.3.2.2 skrll if (*optp == TCPOPT_NOP) { 138 1.3.2.2 skrll fp.fp_tcpopts = (fp.fp_tcpopts << PF_OSFP_TCPOPT_BITS) | 139 1.3.2.2 skrll PF_OSFP_TCPOPT_NOP; 140 1.3.2.2 skrll optlen = 1; 141 1.3.2.2 skrll } else { 142 1.3.2.2 skrll if (cnt < 2) 143 1.3.2.2 skrll return (NULL); 144 1.3.2.2 skrll optlen = optp[1]; 145 1.3.2.2 skrll if (optlen > cnt || optlen < 2) 146 1.3.2.2 skrll return (NULL); 147 1.3.2.2 skrll switch (*optp) { 148 1.3.2.2 skrll case TCPOPT_MAXSEG: 149 1.3.2.2 skrll if (optlen >= TCPOLEN_MAXSEG) 150 1.3.2.2 skrll memcpy(&fp.fp_mss, &optp[2], 151 1.3.2.2 skrll sizeof(fp.fp_mss)); 152 1.3.2.2 skrll fp.fp_tcpopts = (fp.fp_tcpopts << 153 1.3.2.2 skrll PF_OSFP_TCPOPT_BITS) | PF_OSFP_TCPOPT_MSS; 154 1.3.2.2 skrll NTOHS(fp.fp_mss); 155 1.3.2.2 skrll break; 156 1.3.2.2 skrll case TCPOPT_WINDOW: 157 1.3.2.2 skrll if (optlen >= TCPOLEN_WINDOW) 158 1.3.2.2 skrll memcpy(&fp.fp_wscale, &optp[2], 159 1.3.2.2 skrll sizeof(fp.fp_wscale)); 160 1.3.2.2 skrll NTOHS(fp.fp_wscale); 161 1.3.2.2 skrll fp.fp_tcpopts = (fp.fp_tcpopts << 162 1.3.2.2 skrll PF_OSFP_TCPOPT_BITS) | 163 1.3.2.2 skrll PF_OSFP_TCPOPT_WSCALE; 164 1.3.2.2 skrll break; 165 1.3.2.2 skrll case TCPOPT_SACK_PERMITTED: 166 1.3.2.2 skrll fp.fp_tcpopts = (fp.fp_tcpopts << 167 1.3.2.2 skrll PF_OSFP_TCPOPT_BITS) | PF_OSFP_TCPOPT_SACK; 168 1.3.2.2 skrll break; 169 1.3.2.2 skrll case TCPOPT_TIMESTAMP: 170 1.3.2.2 skrll if (optlen >= TCPOLEN_TIMESTAMP) { 171 1.3.2.2 skrll u_int32_t ts; 172 1.3.2.2 skrll memcpy(&ts, &optp[2], sizeof(ts)); 173 1.3.2.2 skrll if (ts == 0) 174 1.3.2.2 skrll fp.fp_flags |= PF_OSFP_TS0; 175 1.3.2.2 skrll 176 1.3.2.2 skrll } 177 1.3.2.2 skrll fp.fp_tcpopts = (fp.fp_tcpopts << 178 1.3.2.2 skrll PF_OSFP_TCPOPT_BITS) | PF_OSFP_TCPOPT_TS; 179 1.3.2.2 skrll break; 180 1.3.2.2 skrll default: 181 1.3.2.2 skrll return (NULL); 182 1.3.2.2 skrll } 183 1.3.2.2 skrll } 184 1.3.2.2 skrll optlen = MAX(optlen, 1); /* paranoia */ 185 1.3.2.2 skrll } 186 1.3.2.2 skrll 187 1.3.2.2 skrll DPFPRINTF("fingerprinted %s:%d %d:%d:%d:%d:%llx (%d) " 188 1.3.2.2 skrll "(TS=%s,M=%s%d,W=%s%d)\n", 189 1.3.2.2 skrll inet_ntoa(ip->ip_src), ntohs(tcp->th_sport), 190 1.3.2.2 skrll fp.fp_wsize, fp.fp_ttl, (fp.fp_flags & PF_OSFP_DF) != 0, 191 1.3.2.2 skrll fp.fp_psize, (long long int)fp.fp_tcpopts, fp.fp_optcnt, 192 1.3.2.2 skrll (fp.fp_flags & PF_OSFP_TS0) ? "0" : "", 193 1.3.2.2 skrll (fp.fp_flags & PF_OSFP_MSS_MOD) ? "%" : 194 1.3.2.2 skrll (fp.fp_flags & PF_OSFP_MSS_DC) ? "*" : "", 195 1.3.2.2 skrll fp.fp_mss, 196 1.3.2.2 skrll (fp.fp_flags & PF_OSFP_WSCALE_MOD) ? "%" : 197 1.3.2.2 skrll (fp.fp_flags & PF_OSFP_WSCALE_DC) ? "*" : "", 198 1.3.2.2 skrll fp.fp_wscale); 199 1.3.2.2 skrll 200 1.3.2.2 skrll if ((fpresult = pf_osfp_find(&pf_osfp_list, &fp, 201 1.3.2.2 skrll PF_OSFP_MAXTTL_OFFSET))) 202 1.3.2.2 skrll return (&fpresult->fp_oses); 203 1.3.2.2 skrll return (NULL); 204 1.3.2.2 skrll } 205 1.3.2.2 skrll 206 1.3.2.2 skrll /* Match a fingerprint ID against a list of OSes */ 207 1.3.2.2 skrll int 208 1.3.2.2 skrll pf_osfp_match(struct pf_osfp_enlist *list, pf_osfp_t os) 209 1.3.2.2 skrll { 210 1.3.2.2 skrll struct pf_osfp_entry *entry; 211 1.3.2.2 skrll int os_class, os_version, os_subtype; 212 1.3.2.2 skrll int en_class, en_version, en_subtype; 213 1.3.2.2 skrll 214 1.3.2.2 skrll if (os == PF_OSFP_ANY) 215 1.3.2.2 skrll return (1); 216 1.3.2.2 skrll if (list == NULL) { 217 1.3.2.2 skrll DPFPRINTF("osfp no match against %x\n", os); 218 1.3.2.2 skrll return (os == PF_OSFP_UNKNOWN); 219 1.3.2.2 skrll } 220 1.3.2.2 skrll PF_OSFP_UNPACK(os, os_class, os_version, os_subtype); 221 1.3.2.2 skrll SLIST_FOREACH(entry, list, fp_entry) { 222 1.3.2.2 skrll PF_OSFP_UNPACK(entry->fp_os, en_class, en_version, en_subtype); 223 1.3.2.2 skrll if ((os_class == PF_OSFP_ANY || en_class == os_class) && 224 1.3.2.2 skrll (os_version == PF_OSFP_ANY || en_version == os_version) && 225 1.3.2.2 skrll (os_subtype == PF_OSFP_ANY || en_subtype == os_subtype)) { 226 1.3.2.2 skrll DPFPRINTF("osfp matched %s %s %s %x==%x\n", 227 1.3.2.2 skrll entry->fp_class_nm, entry->fp_version_nm, 228 1.3.2.2 skrll entry->fp_subtype_nm, os, entry->fp_os); 229 1.3.2.2 skrll return (1); 230 1.3.2.2 skrll } 231 1.3.2.2 skrll } 232 1.3.2.2 skrll DPFPRINTF("fingerprint 0x%x didn't match\n", os); 233 1.3.2.2 skrll return (0); 234 1.3.2.2 skrll } 235 1.3.2.2 skrll 236 1.3.2.2 skrll /* Initialize the OS fingerprint system */ 237 1.3.2.2 skrll void 238 1.3.2.2 skrll pf_osfp_initialize(void) 239 1.3.2.2 skrll { 240 1.3.2.2 skrll pool_init(&pf_osfp_entry_pl, sizeof(struct pf_osfp_entry), 0, 0, 0, 241 1.3.2.2 skrll "pfosfpen", NULL); 242 1.3.2.2 skrll pool_init(&pf_osfp_pl, sizeof(struct pf_os_fingerprint), 0, 0, 0, 243 1.3.2.2 skrll "pfosfp", NULL); 244 1.3.2.2 skrll SLIST_INIT(&pf_osfp_list); 245 1.3.2.2 skrll } 246 1.3.2.2 skrll 247 1.3.2.2 skrll #ifdef _LKM 248 1.3.2.2 skrll void 249 1.3.2.2 skrll pf_osfp_destroy(void) 250 1.3.2.2 skrll { 251 1.3.2.2 skrll pf_osfp_flush(); 252 1.3.2.2 skrll 253 1.3.2.2 skrll pool_destroy(&pf_osfp_pl); 254 1.3.2.2 skrll pool_destroy(&pf_osfp_entry_pl); 255 1.3.2.2 skrll } 256 1.3.2.2 skrll #endif 257 1.3.2.2 skrll 258 1.3.2.2 skrll /* Flush the fingerprint list */ 259 1.3.2.2 skrll void 260 1.3.2.2 skrll pf_osfp_flush(void) 261 1.3.2.2 skrll { 262 1.3.2.2 skrll struct pf_os_fingerprint *fp; 263 1.3.2.2 skrll struct pf_osfp_entry *entry; 264 1.3.2.2 skrll 265 1.3.2.2 skrll while ((fp = SLIST_FIRST(&pf_osfp_list))) { 266 1.3.2.2 skrll SLIST_REMOVE_HEAD(&pf_osfp_list, fp_next); 267 1.3.2.2 skrll while ((entry = SLIST_FIRST(&fp->fp_oses))) { 268 1.3.2.2 skrll SLIST_REMOVE_HEAD(&fp->fp_oses, fp_entry); 269 1.3.2.2 skrll pool_put(&pf_osfp_entry_pl, entry); 270 1.3.2.2 skrll } 271 1.3.2.2 skrll pool_put(&pf_osfp_pl, fp); 272 1.3.2.2 skrll } 273 1.3.2.2 skrll } 274 1.3.2.2 skrll 275 1.3.2.2 skrll 276 1.3.2.2 skrll /* Add a fingerprint */ 277 1.3.2.2 skrll int 278 1.3.2.2 skrll pf_osfp_add(struct pf_osfp_ioctl *fpioc) 279 1.3.2.2 skrll { 280 1.3.2.2 skrll struct pf_os_fingerprint *fp, fpadd; 281 1.3.2.2 skrll struct pf_osfp_entry *entry; 282 1.3.2.2 skrll 283 1.3.2.2 skrll memset(&fpadd, 0, sizeof(fpadd)); 284 1.3.2.2 skrll fpadd.fp_tcpopts = fpioc->fp_tcpopts; 285 1.3.2.2 skrll fpadd.fp_wsize = fpioc->fp_wsize; 286 1.3.2.2 skrll fpadd.fp_psize = fpioc->fp_psize; 287 1.3.2.2 skrll fpadd.fp_mss = fpioc->fp_mss; 288 1.3.2.2 skrll fpadd.fp_flags = fpioc->fp_flags; 289 1.3.2.2 skrll fpadd.fp_optcnt = fpioc->fp_optcnt; 290 1.3.2.2 skrll fpadd.fp_wscale = fpioc->fp_wscale; 291 1.3.2.2 skrll fpadd.fp_ttl = fpioc->fp_ttl; 292 1.3.2.2 skrll 293 1.3.2.2 skrll DPFPRINTF("adding osfp %s %s %s = %s%d:%d:%d:%s%d:0x%llx %d " 294 1.3.2.2 skrll "(TS=%s,M=%s%d,W=%s%d) %x\n", 295 1.3.2.2 skrll fpioc->fp_os.fp_class_nm, fpioc->fp_os.fp_version_nm, 296 1.3.2.2 skrll fpioc->fp_os.fp_subtype_nm, 297 1.3.2.2 skrll (fpadd.fp_flags & PF_OSFP_WSIZE_MOD) ? "%" : 298 1.3.2.2 skrll (fpadd.fp_flags & PF_OSFP_WSIZE_MSS) ? "S" : 299 1.3.2.2 skrll (fpadd.fp_flags & PF_OSFP_WSIZE_MTU) ? "T" : 300 1.3.2.2 skrll (fpadd.fp_flags & PF_OSFP_WSIZE_DC) ? "*" : "", 301 1.3.2.2 skrll fpadd.fp_wsize, 302 1.3.2.2 skrll fpadd.fp_ttl, 303 1.3.2.2 skrll (fpadd.fp_flags & PF_OSFP_DF) ? 1 : 0, 304 1.3.2.2 skrll (fpadd.fp_flags & PF_OSFP_PSIZE_MOD) ? "%" : 305 1.3.2.2 skrll (fpadd.fp_flags & PF_OSFP_PSIZE_DC) ? "*" : "", 306 1.3.2.2 skrll fpadd.fp_psize, 307 1.3.2.2 skrll (long long int)fpadd.fp_tcpopts, fpadd.fp_optcnt, 308 1.3.2.2 skrll (fpadd.fp_flags & PF_OSFP_TS0) ? "0" : "", 309 1.3.2.2 skrll (fpadd.fp_flags & PF_OSFP_MSS_MOD) ? "%" : 310 1.3.2.2 skrll (fpadd.fp_flags & PF_OSFP_MSS_DC) ? "*" : "", 311 1.3.2.2 skrll fpadd.fp_mss, 312 1.3.2.2 skrll (fpadd.fp_flags & PF_OSFP_WSCALE_MOD) ? "%" : 313 1.3.2.2 skrll (fpadd.fp_flags & PF_OSFP_WSCALE_DC) ? "*" : "", 314 1.3.2.2 skrll fpadd.fp_wscale, 315 1.3.2.2 skrll fpioc->fp_os.fp_os); 316 1.3.2.2 skrll 317 1.3.2.2 skrll 318 1.3.2.2 skrll if ((fp = pf_osfp_find_exact(&pf_osfp_list, &fpadd))) { 319 1.3.2.2 skrll SLIST_FOREACH(entry, &fp->fp_oses, fp_entry) { 320 1.3.2.2 skrll if (PF_OSFP_ENTRY_EQ(entry, &fpioc->fp_os)) 321 1.3.2.2 skrll return (EEXIST); 322 1.3.2.2 skrll } 323 1.3.2.2 skrll if ((entry = pool_get(&pf_osfp_entry_pl, PR_NOWAIT)) == NULL) 324 1.3.2.2 skrll return (ENOMEM); 325 1.3.2.2 skrll } else { 326 1.3.2.2 skrll if ((fp = pool_get(&pf_osfp_pl, PR_NOWAIT)) == NULL) 327 1.3.2.2 skrll return (ENOMEM); 328 1.3.2.2 skrll memset(fp, 0, sizeof(*fp)); 329 1.3.2.2 skrll fp->fp_tcpopts = fpioc->fp_tcpopts; 330 1.3.2.2 skrll fp->fp_wsize = fpioc->fp_wsize; 331 1.3.2.2 skrll fp->fp_psize = fpioc->fp_psize; 332 1.3.2.2 skrll fp->fp_mss = fpioc->fp_mss; 333 1.3.2.2 skrll fp->fp_flags = fpioc->fp_flags; 334 1.3.2.2 skrll fp->fp_optcnt = fpioc->fp_optcnt; 335 1.3.2.2 skrll fp->fp_wscale = fpioc->fp_wscale; 336 1.3.2.2 skrll fp->fp_ttl = fpioc->fp_ttl; 337 1.3.2.2 skrll SLIST_INIT(&fp->fp_oses); 338 1.3.2.2 skrll if ((entry = pool_get(&pf_osfp_entry_pl, PR_NOWAIT)) == NULL) { 339 1.3.2.2 skrll pool_put(&pf_osfp_pl, fp); 340 1.3.2.2 skrll return (ENOMEM); 341 1.3.2.2 skrll } 342 1.3.2.2 skrll pf_osfp_insert(&pf_osfp_list, fp); 343 1.3.2.2 skrll } 344 1.3.2.2 skrll memcpy(entry, &fpioc->fp_os, sizeof(*entry)); 345 1.3.2.2 skrll 346 1.3.2.2 skrll /* Make sure the strings are NUL terminated */ 347 1.3.2.2 skrll entry->fp_class_nm[sizeof(entry->fp_class_nm)-1] = '\0'; 348 1.3.2.2 skrll entry->fp_version_nm[sizeof(entry->fp_version_nm)-1] = '\0'; 349 1.3.2.2 skrll entry->fp_subtype_nm[sizeof(entry->fp_subtype_nm)-1] = '\0'; 350 1.3.2.2 skrll 351 1.3.2.2 skrll SLIST_INSERT_HEAD(&fp->fp_oses, entry, fp_entry); 352 1.3.2.2 skrll 353 1.3.2.2 skrll #ifdef PFDEBUG 354 1.3.2.2 skrll if ((fp = pf_osfp_validate())) 355 1.3.2.2 skrll printf("Invalid fingerprint list\n"); 356 1.3.2.2 skrll #endif /* PFDEBUG */ 357 1.3.2.2 skrll return (0); 358 1.3.2.2 skrll } 359 1.3.2.2 skrll 360 1.3.2.2 skrll 361 1.3.2.2 skrll /* Find a fingerprint in the list */ 362 1.3.2.2 skrll struct pf_os_fingerprint * 363 1.3.2.2 skrll pf_osfp_find(struct pf_osfp_list *list, struct pf_os_fingerprint *find, 364 1.3.2.2 skrll u_int8_t ttldiff) 365 1.3.2.2 skrll { 366 1.3.2.2 skrll struct pf_os_fingerprint *f; 367 1.3.2.2 skrll 368 1.3.2.2 skrll #define MATCH_INT(_MOD, _DC, _field) \ 369 1.3.2.2 skrll if ((f->fp_flags & _DC) == 0) { \ 370 1.3.2.2 skrll if ((f->fp_flags & _MOD) == 0) { \ 371 1.3.2.2 skrll if (f->_field != find->_field) \ 372 1.3.2.2 skrll continue; \ 373 1.3.2.2 skrll } else { \ 374 1.3.2.2 skrll if (f->_field == 0 || find->_field % f->_field) \ 375 1.3.2.2 skrll continue; \ 376 1.3.2.2 skrll } \ 377 1.3.2.2 skrll } 378 1.3.2.2 skrll 379 1.3.2.2 skrll SLIST_FOREACH(f, list, fp_next) { 380 1.3.2.2 skrll if (f->fp_tcpopts != find->fp_tcpopts || 381 1.3.2.2 skrll f->fp_optcnt != find->fp_optcnt || 382 1.3.2.2 skrll f->fp_ttl < find->fp_ttl || 383 1.3.2.2 skrll f->fp_ttl - find->fp_ttl > ttldiff || 384 1.3.2.2 skrll (f->fp_flags & (PF_OSFP_DF|PF_OSFP_TS0)) != 385 1.3.2.2 skrll (find->fp_flags & (PF_OSFP_DF|PF_OSFP_TS0))) 386 1.3.2.2 skrll continue; 387 1.3.2.2 skrll 388 1.3.2.2 skrll MATCH_INT(PF_OSFP_PSIZE_MOD, PF_OSFP_PSIZE_DC, fp_psize) 389 1.3.2.2 skrll MATCH_INT(PF_OSFP_MSS_MOD, PF_OSFP_MSS_DC, fp_mss) 390 1.3.2.2 skrll MATCH_INT(PF_OSFP_WSCALE_MOD, PF_OSFP_WSCALE_DC, fp_wscale) 391 1.3.2.2 skrll if ((f->fp_flags & PF_OSFP_WSIZE_DC) == 0) { 392 1.3.2.2 skrll if (f->fp_flags & PF_OSFP_WSIZE_MSS) { 393 1.3.2.2 skrll if (find->fp_mss == 0) 394 1.3.2.2 skrll continue; 395 1.3.2.2 skrll 396 1.3.2.2 skrll /* Some "smart" NAT devices and DSL routers will tweak the MSS size and 397 1.3.2.2 skrll * will set it to whatever is suitable for the link type. 398 1.3.2.2 skrll */ 399 1.3.2.2 skrll #define SMART_MSS 1460 400 1.3.2.2 skrll if ((find->fp_wsize % find->fp_mss || 401 1.3.2.2 skrll find->fp_wsize / find->fp_mss != 402 1.3.2.2 skrll f->fp_wsize) && 403 1.3.2.2 skrll (find->fp_wsize % SMART_MSS || 404 1.3.2.2 skrll find->fp_wsize / SMART_MSS != 405 1.3.2.2 skrll f->fp_wsize)) 406 1.3.2.2 skrll continue; 407 1.3.2.2 skrll } else if (f->fp_flags & PF_OSFP_WSIZE_MTU) { 408 1.3.2.2 skrll if (find->fp_mss == 0) 409 1.3.2.2 skrll continue; 410 1.3.2.2 skrll 411 1.3.2.2 skrll #define MTUOFF (sizeof(struct ip) + sizeof(struct tcphdr)) 412 1.3.2.2 skrll #define SMART_MTU (SMART_MSS + MTUOFF) 413 1.3.2.2 skrll if ((find->fp_wsize % (find->fp_mss + MTUOFF) || 414 1.3.2.2 skrll find->fp_wsize / (find->fp_mss + MTUOFF) != 415 1.3.2.2 skrll f->fp_wsize) && 416 1.3.2.2 skrll (find->fp_wsize % SMART_MTU || 417 1.3.2.2 skrll find->fp_wsize / SMART_MTU != 418 1.3.2.2 skrll f->fp_wsize)) 419 1.3.2.2 skrll continue; 420 1.3.2.2 skrll } else if (f->fp_flags & PF_OSFP_WSIZE_MOD) { 421 1.3.2.2 skrll if (f->fp_wsize == 0 || find->fp_wsize % 422 1.3.2.2 skrll f->fp_wsize) 423 1.3.2.2 skrll continue; 424 1.3.2.2 skrll } else { 425 1.3.2.2 skrll if (f->fp_wsize != find->fp_wsize) 426 1.3.2.2 skrll continue; 427 1.3.2.2 skrll } 428 1.3.2.2 skrll } 429 1.3.2.2 skrll return (f); 430 1.3.2.2 skrll } 431 1.3.2.2 skrll 432 1.3.2.2 skrll return (NULL); 433 1.3.2.2 skrll } 434 1.3.2.2 skrll 435 1.3.2.2 skrll /* Find an exact fingerprint in the list */ 436 1.3.2.2 skrll struct pf_os_fingerprint * 437 1.3.2.2 skrll pf_osfp_find_exact(struct pf_osfp_list *list, struct pf_os_fingerprint *find) 438 1.3.2.2 skrll { 439 1.3.2.2 skrll struct pf_os_fingerprint *f; 440 1.3.2.2 skrll 441 1.3.2.2 skrll SLIST_FOREACH(f, list, fp_next) { 442 1.3.2.2 skrll if (f->fp_tcpopts == find->fp_tcpopts && 443 1.3.2.2 skrll f->fp_wsize == find->fp_wsize && 444 1.3.2.2 skrll f->fp_psize == find->fp_psize && 445 1.3.2.2 skrll f->fp_mss == find->fp_mss && 446 1.3.2.2 skrll f->fp_flags == find->fp_flags && 447 1.3.2.2 skrll f->fp_optcnt == find->fp_optcnt && 448 1.3.2.2 skrll f->fp_wscale == find->fp_wscale && 449 1.3.2.2 skrll f->fp_ttl == find->fp_ttl) 450 1.3.2.2 skrll return (f); 451 1.3.2.2 skrll } 452 1.3.2.2 skrll 453 1.3.2.2 skrll return (NULL); 454 1.3.2.2 skrll } 455 1.3.2.2 skrll 456 1.3.2.2 skrll /* Insert a fingerprint into the list */ 457 1.3.2.2 skrll void 458 1.3.2.2 skrll pf_osfp_insert(struct pf_osfp_list *list, struct pf_os_fingerprint *ins) 459 1.3.2.2 skrll { 460 1.3.2.2 skrll struct pf_os_fingerprint *f, *prev = NULL; 461 1.3.2.2 skrll 462 1.3.2.2 skrll /* XXX need to go semi tree based. can key on tcp options */ 463 1.3.2.2 skrll 464 1.3.2.2 skrll SLIST_FOREACH(f, list, fp_next) 465 1.3.2.2 skrll prev = f; 466 1.3.2.2 skrll if (prev) 467 1.3.2.2 skrll SLIST_INSERT_AFTER(prev, ins, fp_next); 468 1.3.2.2 skrll else 469 1.3.2.2 skrll SLIST_INSERT_HEAD(list, ins, fp_next); 470 1.3.2.2 skrll } 471 1.3.2.2 skrll 472 1.3.2.2 skrll /* Fill a fingerprint by its number (from an ioctl) */ 473 1.3.2.2 skrll int 474 1.3.2.2 skrll pf_osfp_get(struct pf_osfp_ioctl *fpioc) 475 1.3.2.2 skrll { 476 1.3.2.2 skrll struct pf_os_fingerprint *fp; 477 1.3.2.2 skrll struct pf_osfp_entry *entry; 478 1.3.2.2 skrll int num = fpioc->fp_getnum; 479 1.3.2.2 skrll int i = 0; 480 1.3.2.2 skrll 481 1.3.2.2 skrll 482 1.3.2.2 skrll memset(fpioc, 0, sizeof(*fpioc)); 483 1.3.2.2 skrll SLIST_FOREACH(fp, &pf_osfp_list, fp_next) { 484 1.3.2.2 skrll SLIST_FOREACH(entry, &fp->fp_oses, fp_entry) { 485 1.3.2.2 skrll if (i++ == num) { 486 1.3.2.2 skrll fpioc->fp_mss = fp->fp_mss; 487 1.3.2.2 skrll fpioc->fp_wsize = fp->fp_wsize; 488 1.3.2.2 skrll fpioc->fp_flags = fp->fp_flags; 489 1.3.2.2 skrll fpioc->fp_psize = fp->fp_psize; 490 1.3.2.2 skrll fpioc->fp_ttl = fp->fp_ttl; 491 1.3.2.2 skrll fpioc->fp_wscale = fp->fp_wscale; 492 1.3.2.2 skrll fpioc->fp_getnum = num; 493 1.3.2.2 skrll memcpy(&fpioc->fp_os, entry, 494 1.3.2.2 skrll sizeof(fpioc->fp_os)); 495 1.3.2.2 skrll return (0); 496 1.3.2.2 skrll } 497 1.3.2.2 skrll } 498 1.3.2.2 skrll } 499 1.3.2.2 skrll 500 1.3.2.2 skrll return (EBUSY); 501 1.3.2.2 skrll } 502 1.3.2.2 skrll 503 1.3.2.2 skrll 504 1.3.2.2 skrll /* Validate that each signature is reachable */ 505 1.3.2.2 skrll struct pf_os_fingerprint * 506 1.3.2.2 skrll pf_osfp_validate(void) 507 1.3.2.2 skrll { 508 1.3.2.2 skrll struct pf_os_fingerprint *f, *f2, find; 509 1.3.2.2 skrll 510 1.3.2.2 skrll SLIST_FOREACH(f, &pf_osfp_list, fp_next) { 511 1.3.2.2 skrll memcpy(&find, f, sizeof(find)); 512 1.3.2.2 skrll 513 1.3.2.2 skrll /* We do a few MSS/th_win percolations to make things unique */ 514 1.3.2.2 skrll if (find.fp_mss == 0) 515 1.3.2.2 skrll find.fp_mss = 128; 516 1.3.2.2 skrll if (f->fp_flags & PF_OSFP_WSIZE_MSS) 517 1.3.2.2 skrll find.fp_wsize *= find.fp_mss, 1; 518 1.3.2.2 skrll else if (f->fp_flags & PF_OSFP_WSIZE_MTU) 519 1.3.2.2 skrll find.fp_wsize *= (find.fp_mss + 40); 520 1.3.2.2 skrll else if (f->fp_flags & PF_OSFP_WSIZE_MOD) 521 1.3.2.2 skrll find.fp_wsize *= 2; 522 1.3.2.2 skrll if (f != (f2 = pf_osfp_find(&pf_osfp_list, &find, 0))) { 523 1.3.2.2 skrll if (f2) 524 1.3.2.2 skrll printf("Found \"%s %s %s\" instead of " 525 1.3.2.2 skrll "\"%s %s %s\"\n", 526 1.3.2.2 skrll SLIST_FIRST(&f2->fp_oses)->fp_class_nm, 527 1.3.2.2 skrll SLIST_FIRST(&f2->fp_oses)->fp_version_nm, 528 1.3.2.2 skrll SLIST_FIRST(&f2->fp_oses)->fp_subtype_nm, 529 1.3.2.2 skrll SLIST_FIRST(&f->fp_oses)->fp_class_nm, 530 1.3.2.2 skrll SLIST_FIRST(&f->fp_oses)->fp_version_nm, 531 1.3.2.2 skrll SLIST_FIRST(&f->fp_oses)->fp_subtype_nm); 532 1.3.2.2 skrll else 533 1.3.2.2 skrll printf("Couldn't find \"%s %s %s\"\n", 534 1.3.2.2 skrll SLIST_FIRST(&f->fp_oses)->fp_class_nm, 535 1.3.2.2 skrll SLIST_FIRST(&f->fp_oses)->fp_version_nm, 536 1.3.2.2 skrll SLIST_FIRST(&f->fp_oses)->fp_subtype_nm); 537 1.3.2.2 skrll return (f); 538 1.3.2.2 skrll } 539 1.3.2.2 skrll } 540 1.3.2.2 skrll return (NULL); 541 1.3.2.2 skrll } 542
Indexes created Sun Oct 19 02:09:48 GMT 2025