Home | History | Annotate | Line # | Download | only in net
pf_osfp.c revision 1.7
      1 /*	$NetBSD: pf_osfp.c,v 1.7 2007/12/11 11:08:21 lukem Exp $	*/
      2 /*	$OpenBSD: pf_osfp.c,v 1.10 2004/04/09 19:30:41 frantzen Exp $ */
      3 
      4 /*
      5  * Copyright (c) 2003 Mike Frantzen <frantzen (at) w4g.org>
      6  *
      7  * Permission to use, copy, modify, and distribute this software for any
      8  * purpose with or without fee is hereby granted, provided that the above
      9  * copyright notice and this permission notice appear in all copies.
     10  *
     11  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
     12  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
     13  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
     14  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
     15  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
     16  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
     17  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
     18  *
     19  */
     20 
     21 #include <sys/cdefs.h>
     22 __KERNEL_RCSID(0, "$NetBSD: pf_osfp.c,v 1.7 2007/12/11 11:08:21 lukem Exp $");
     23 
     24 #ifdef _KERNEL_OPT
     25 #include "opt_inet.h"
     26 #endif
     27 
     28 #include <sys/param.h>
     29 #include <sys/socket.h>
     30 #ifdef _KERNEL
     31 # include <sys/systm.h>
     32 #endif /* _KERNEL */
     33 #include <sys/mbuf.h>
     34 
     35 #include <netinet/in.h>
     36 #include <netinet/in_systm.h>
     37 #include <netinet/ip.h>
     38 #include <netinet/tcp.h>
     39 
     40 #include <net/if.h>
     41 #include <net/pfvar.h>
     42 
     43 #ifdef INET6
     44 #include <netinet/ip6.h>
     45 #endif /* INET6 */
     46 
     47 
     48 #ifdef _KERNEL
     49 # define DPFPRINTF(format, x...)		\
     50 	if (pf_status.debug >= PF_DEBUG_NOISY)	\
     51 		printf(format , ##x)
     52 typedef struct pool pool_t;
     53 
     54 #else
     55 /* Userland equivalents so we can lend code to tcpdump et al. */
     56 
     57 # include <arpa/inet.h>
     58 # include <errno.h>
     59 # include <stdio.h>
     60 # include <stdlib.h>
     61 # include <string.h>
     62 # define pool_t			int
     63 # define pool_get(pool, flags)	malloc(*(pool))
     64 # define pool_put(pool, item)	free(item)
     65 # define pool_init(pool, size, a, ao, f, m, p)	(*(pool)) = (size)
     66 
     67 # ifdef PFDEBUG
     68 #  include <sys/stdarg.h>
     69 #  define DPFPRINTF(format, x...)	fprintf(stderr, format , ##x)
     70 # else
     71 #  define DPFPRINTF(format, x...)	((void)0)
     72 # endif /* PFDEBUG */
     73 #endif /* _KERNEL */
     74 
     75 
     76 SLIST_HEAD(pf_osfp_list, pf_os_fingerprint) pf_osfp_list;
     77 pool_t pf_osfp_entry_pl;
     78 pool_t pf_osfp_pl;
     79 
     80 struct pf_os_fingerprint	*pf_osfp_find(struct pf_osfp_list *,
     81 				    struct pf_os_fingerprint *, u_int8_t);
     82 struct pf_os_fingerprint	*pf_osfp_find_exact(struct pf_osfp_list *,
     83 				    struct pf_os_fingerprint *);
     84 void				 pf_osfp_insert(struct pf_osfp_list *,
     85 				    struct pf_os_fingerprint *);
     86 
     87 
     88 #ifdef _KERNEL
     89 /*
     90  * Passively fingerprint the OS of the host (IPv4 TCP SYN packets only)
     91  * Returns the list of possible OSes.
     92  */
     93 struct pf_osfp_enlist *
     94 pf_osfp_fingerprint(struct pf_pdesc *pd, struct mbuf *m, int off,
     95     const struct tcphdr *tcp)
     96 {
     97 	struct ip *ip;
     98 	char hdr[60];
     99 
    100 	/* XXX don't have a fingerprint database for IPv6 :-( */
    101 	if (pd->af != PF_INET || pd->proto != IPPROTO_TCP || (tcp->th_off << 2)
    102 	    < sizeof(*tcp))
    103 		return (NULL);
    104 
    105 	ip = mtod(m, struct ip *);
    106 	if (!pf_pull_hdr(m, off, hdr, tcp->th_off << 2, NULL, NULL, pd->af))
    107 		return (NULL);
    108 
    109 	return (pf_osfp_fingerprint_hdr(ip, (struct tcphdr *)hdr));
    110 }
    111 #endif /* _KERNEL */
    112 
    113 struct pf_osfp_enlist *
    114 pf_osfp_fingerprint_hdr(const struct ip *ip, const struct tcphdr *tcp)
    115 {
    116 	struct pf_os_fingerprint fp, *fpresult;
    117 	int cnt, optlen = 0;
    118 	const u_int8_t *optp;
    119 
    120 	if ((tcp->th_flags & (TH_SYN|TH_ACK)) != TH_SYN || (ip->ip_off &
    121 	    htons(IP_OFFMASK)))
    122 		return (NULL);
    123 
    124 	memset(&fp, 0, sizeof(fp));
    125 
    126 	fp.fp_psize = ntohs(ip->ip_len);
    127 	fp.fp_ttl = ip->ip_ttl;
    128 	if (ip->ip_off & htons(IP_DF))
    129 		fp.fp_flags |= PF_OSFP_DF;
    130 	fp.fp_wsize = ntohs(tcp->th_win);
    131 
    132 
    133 	cnt = (tcp->th_off << 2) - sizeof(*tcp);
    134 	optp = (const u_int8_t *)((const char *)tcp + sizeof(*tcp));
    135 	for (; cnt > 0; cnt -= optlen, optp += optlen) {
    136 		if (*optp == TCPOPT_EOL)
    137 			break;
    138 
    139 		fp.fp_optcnt++;
    140 		if (*optp == TCPOPT_NOP) {
    141 			fp.fp_tcpopts = (fp.fp_tcpopts << PF_OSFP_TCPOPT_BITS) |
    142 			    PF_OSFP_TCPOPT_NOP;
    143 			optlen = 1;
    144 		} else {
    145 			if (cnt < 2)
    146 				return (NULL);
    147 			optlen = optp[1];
    148 			if (optlen > cnt || optlen < 2)
    149 				return (NULL);
    150 			switch (*optp) {
    151 			case TCPOPT_MAXSEG:
    152 				if (optlen >= TCPOLEN_MAXSEG)
    153 					memcpy(&fp.fp_mss, &optp[2],
    154 					    sizeof(fp.fp_mss));
    155 				fp.fp_tcpopts = (fp.fp_tcpopts <<
    156 				    PF_OSFP_TCPOPT_BITS) | PF_OSFP_TCPOPT_MSS;
    157 				NTOHS(fp.fp_mss);
    158 				break;
    159 			case TCPOPT_WINDOW:
    160 				if (optlen >= TCPOLEN_WINDOW)
    161 					memcpy(&fp.fp_wscale, &optp[2],
    162 					    sizeof(fp.fp_wscale));
    163 				NTOHS(fp.fp_wscale);
    164 				fp.fp_tcpopts = (fp.fp_tcpopts <<
    165 				    PF_OSFP_TCPOPT_BITS) |
    166 				    PF_OSFP_TCPOPT_WSCALE;
    167 				break;
    168 			case TCPOPT_SACK_PERMITTED:
    169 				fp.fp_tcpopts = (fp.fp_tcpopts <<
    170 				    PF_OSFP_TCPOPT_BITS) | PF_OSFP_TCPOPT_SACK;
    171 				break;
    172 			case TCPOPT_TIMESTAMP:
    173 				if (optlen >= TCPOLEN_TIMESTAMP) {
    174 					u_int32_t ts;
    175 					memcpy(&ts, &optp[2], sizeof(ts));
    176 					if (ts == 0)
    177 						fp.fp_flags |= PF_OSFP_TS0;
    178 
    179 				}
    180 				fp.fp_tcpopts = (fp.fp_tcpopts <<
    181 				    PF_OSFP_TCPOPT_BITS) | PF_OSFP_TCPOPT_TS;
    182 				break;
    183 			default:
    184 				return (NULL);
    185 			}
    186 		}
    187 		optlen = MAX(optlen, 1);	/* paranoia */
    188 	}
    189 
    190 	DPFPRINTF("fingerprinted %s:%d  %d:%d:%d:%d:%llx (%d) "
    191 	    "(TS=%s,M=%s%d,W=%s%d)\n",
    192 	    inet_ntoa(ip->ip_src), ntohs(tcp->th_sport),
    193 	    fp.fp_wsize, fp.fp_ttl, (fp.fp_flags & PF_OSFP_DF) != 0,
    194 	    fp.fp_psize, (long long int)fp.fp_tcpopts, fp.fp_optcnt,
    195 	    (fp.fp_flags & PF_OSFP_TS0) ? "0" : "",
    196 	    (fp.fp_flags & PF_OSFP_MSS_MOD) ? "%" :
    197 	    (fp.fp_flags & PF_OSFP_MSS_DC) ? "*" : "",
    198 	    fp.fp_mss,
    199 	    (fp.fp_flags & PF_OSFP_WSCALE_MOD) ? "%" :
    200 	    (fp.fp_flags & PF_OSFP_WSCALE_DC) ? "*" : "",
    201 	    fp.fp_wscale);
    202 
    203 	if ((fpresult = pf_osfp_find(&pf_osfp_list, &fp,
    204 	    PF_OSFP_MAXTTL_OFFSET)))
    205 		return (&fpresult->fp_oses);
    206 	return (NULL);
    207 }
    208 
    209 /* Match a fingerprint ID against a list of OSes */
    210 int
    211 pf_osfp_match(struct pf_osfp_enlist *list, pf_osfp_t os)
    212 {
    213 	struct pf_osfp_entry *entry;
    214 	int os_class, os_version, os_subtype;
    215 	int en_class, en_version, en_subtype;
    216 
    217 	if (os == PF_OSFP_ANY)
    218 		return (1);
    219 	if (list == NULL) {
    220 		DPFPRINTF("osfp no match against %x\n", os);
    221 		return (os == PF_OSFP_UNKNOWN);
    222 	}
    223 	PF_OSFP_UNPACK(os, os_class, os_version, os_subtype);
    224 	SLIST_FOREACH(entry, list, fp_entry) {
    225 		PF_OSFP_UNPACK(entry->fp_os, en_class, en_version, en_subtype);
    226 		if ((os_class == PF_OSFP_ANY || en_class == os_class) &&
    227 		    (os_version == PF_OSFP_ANY || en_version == os_version) &&
    228 		    (os_subtype == PF_OSFP_ANY || en_subtype == os_subtype)) {
    229 			DPFPRINTF("osfp matched %s %s %s  %x==%x\n",
    230 			    entry->fp_class_nm, entry->fp_version_nm,
    231 			    entry->fp_subtype_nm, os, entry->fp_os);
    232 			return (1);
    233 		}
    234 	}
    235 	DPFPRINTF("fingerprint 0x%x didn't match\n", os);
    236 	return (0);
    237 }
    238 
    239 /* Initialize the OS fingerprint system */
    240 void
    241 pf_osfp_initialize(void)
    242 {
    243 #ifdef __NetBSD__
    244 	pool_init(&pf_osfp_entry_pl, sizeof(struct pf_osfp_entry), 0, 0, 0,
    245 	    "pfosfpen", &pool_allocator_nointr, IPL_NONE);
    246 	pool_init(&pf_osfp_pl, sizeof(struct pf_os_fingerprint), 0, 0, 0,
    247 	    "pfosfp", &pool_allocator_nointr, IPL_NONE);
    248 #else
    249 	pool_init(&pf_osfp_entry_pl, sizeof(struct pf_osfp_entry), 0, 0, 0,
    250 	    "pfosfpen", &pool_allocator_nointr);
    251 	pool_init(&pf_osfp_pl, sizeof(struct pf_os_fingerprint), 0, 0, 0,
    252 	    "pfosfp", &pool_allocator_nointr);
    253 #endif
    254 	SLIST_INIT(&pf_osfp_list);
    255 }
    256 
    257 #ifdef _LKM
    258 void
    259 pf_osfp_destroy(void)
    260 {
    261 	pf_osfp_flush();
    262 
    263 	pool_destroy(&pf_osfp_pl);
    264 	pool_destroy(&pf_osfp_entry_pl);
    265 }
    266 #endif
    267 
    268 /* Flush the fingerprint list */
    269 void
    270 pf_osfp_flush(void)
    271 {
    272 	struct pf_os_fingerprint *fp;
    273 	struct pf_osfp_entry *entry;
    274 
    275 	while ((fp = SLIST_FIRST(&pf_osfp_list))) {
    276 		SLIST_REMOVE_HEAD(&pf_osfp_list, fp_next);
    277 		while ((entry = SLIST_FIRST(&fp->fp_oses))) {
    278 			SLIST_REMOVE_HEAD(&fp->fp_oses, fp_entry);
    279 			pool_put(&pf_osfp_entry_pl, entry);
    280 		}
    281 		pool_put(&pf_osfp_pl, fp);
    282 	}
    283 }
    284 
    285 
    286 /* Add a fingerprint */
    287 int
    288 pf_osfp_add(struct pf_osfp_ioctl *fpioc)
    289 {
    290 	struct pf_os_fingerprint *fp, fpadd;
    291 	struct pf_osfp_entry *entry;
    292 
    293 	memset(&fpadd, 0, sizeof(fpadd));
    294 	fpadd.fp_tcpopts = fpioc->fp_tcpopts;
    295 	fpadd.fp_wsize = fpioc->fp_wsize;
    296 	fpadd.fp_psize = fpioc->fp_psize;
    297 	fpadd.fp_mss = fpioc->fp_mss;
    298 	fpadd.fp_flags = fpioc->fp_flags;
    299 	fpadd.fp_optcnt = fpioc->fp_optcnt;
    300 	fpadd.fp_wscale = fpioc->fp_wscale;
    301 	fpadd.fp_ttl = fpioc->fp_ttl;
    302 
    303 	DPFPRINTF("adding osfp %s %s %s = %s%d:%d:%d:%s%d:0x%llx %d "
    304 	    "(TS=%s,M=%s%d,W=%s%d) %x\n",
    305 	    fpioc->fp_os.fp_class_nm, fpioc->fp_os.fp_version_nm,
    306 	    fpioc->fp_os.fp_subtype_nm,
    307 	    (fpadd.fp_flags & PF_OSFP_WSIZE_MOD) ? "%" :
    308 	    (fpadd.fp_flags & PF_OSFP_WSIZE_MSS) ? "S" :
    309 	    (fpadd.fp_flags & PF_OSFP_WSIZE_MTU) ? "T" :
    310 	    (fpadd.fp_flags & PF_OSFP_WSIZE_DC) ? "*" : "",
    311 	    fpadd.fp_wsize,
    312 	    fpadd.fp_ttl,
    313 	    (fpadd.fp_flags & PF_OSFP_DF) ? 1 : 0,
    314 	    (fpadd.fp_flags & PF_OSFP_PSIZE_MOD) ? "%" :
    315 	    (fpadd.fp_flags & PF_OSFP_PSIZE_DC) ? "*" : "",
    316 	    fpadd.fp_psize,
    317 	    (long long int)fpadd.fp_tcpopts, fpadd.fp_optcnt,
    318 	    (fpadd.fp_flags & PF_OSFP_TS0) ? "0" : "",
    319 	    (fpadd.fp_flags & PF_OSFP_MSS_MOD) ? "%" :
    320 	    (fpadd.fp_flags & PF_OSFP_MSS_DC) ? "*" : "",
    321 	    fpadd.fp_mss,
    322 	    (fpadd.fp_flags & PF_OSFP_WSCALE_MOD) ? "%" :
    323 	    (fpadd.fp_flags & PF_OSFP_WSCALE_DC) ? "*" : "",
    324 	    fpadd.fp_wscale,
    325 	    fpioc->fp_os.fp_os);
    326 
    327 
    328 	if ((fp = pf_osfp_find_exact(&pf_osfp_list, &fpadd))) {
    329 		 SLIST_FOREACH(entry, &fp->fp_oses, fp_entry) {
    330 			if (PF_OSFP_ENTRY_EQ(entry, &fpioc->fp_os))
    331 				return (EEXIST);
    332 		}
    333 		if ((entry = pool_get(&pf_osfp_entry_pl, PR_NOWAIT)) == NULL)
    334 			return (ENOMEM);
    335 	} else {
    336 		if ((fp = pool_get(&pf_osfp_pl, PR_NOWAIT)) == NULL)
    337 			return (ENOMEM);
    338 		memset(fp, 0, sizeof(*fp));
    339 		fp->fp_tcpopts = fpioc->fp_tcpopts;
    340 		fp->fp_wsize = fpioc->fp_wsize;
    341 		fp->fp_psize = fpioc->fp_psize;
    342 		fp->fp_mss = fpioc->fp_mss;
    343 		fp->fp_flags = fpioc->fp_flags;
    344 		fp->fp_optcnt = fpioc->fp_optcnt;
    345 		fp->fp_wscale = fpioc->fp_wscale;
    346 		fp->fp_ttl = fpioc->fp_ttl;
    347 		SLIST_INIT(&fp->fp_oses);
    348 		if ((entry = pool_get(&pf_osfp_entry_pl, PR_NOWAIT)) == NULL) {
    349 			pool_put(&pf_osfp_pl, fp);
    350 			return (ENOMEM);
    351 		}
    352 		pf_osfp_insert(&pf_osfp_list, fp);
    353 	}
    354 	memcpy(entry, &fpioc->fp_os, sizeof(*entry));
    355 
    356 	/* Make sure the strings are NUL terminated */
    357 	entry->fp_class_nm[sizeof(entry->fp_class_nm)-1] = '\0';
    358 	entry->fp_version_nm[sizeof(entry->fp_version_nm)-1] = '\0';
    359 	entry->fp_subtype_nm[sizeof(entry->fp_subtype_nm)-1] = '\0';
    360 
    361 	SLIST_INSERT_HEAD(&fp->fp_oses, entry, fp_entry);
    362 
    363 #ifdef PFDEBUG
    364 	if ((fp = pf_osfp_validate()))
    365 		printf("Invalid fingerprint list\n");
    366 #endif /* PFDEBUG */
    367 	return (0);
    368 }
    369 
    370 
    371 /* Find a fingerprint in the list */
    372 struct pf_os_fingerprint *
    373 pf_osfp_find(struct pf_osfp_list *list, struct pf_os_fingerprint *find,
    374     u_int8_t ttldiff)
    375 {
    376 	struct pf_os_fingerprint *f;
    377 
    378 #define MATCH_INT(_MOD, _DC, _field)					\
    379 	if ((f->fp_flags & _DC) == 0) {					\
    380 		if ((f->fp_flags & _MOD) == 0) {			\
    381 			if (f->_field != find->_field)			\
    382 				continue;				\
    383 		} else {						\
    384 			if (f->_field == 0 || find->_field % f->_field)	\
    385 				continue;				\
    386 		}							\
    387 	}
    388 
    389 	SLIST_FOREACH(f, list, fp_next) {
    390 		if (f->fp_tcpopts != find->fp_tcpopts ||
    391 		    f->fp_optcnt != find->fp_optcnt ||
    392 		    f->fp_ttl < find->fp_ttl ||
    393 		    f->fp_ttl - find->fp_ttl > ttldiff ||
    394 		    (f->fp_flags & (PF_OSFP_DF|PF_OSFP_TS0)) !=
    395 		    (find->fp_flags & (PF_OSFP_DF|PF_OSFP_TS0)))
    396 			continue;
    397 
    398 		MATCH_INT(PF_OSFP_PSIZE_MOD, PF_OSFP_PSIZE_DC, fp_psize)
    399 		MATCH_INT(PF_OSFP_MSS_MOD, PF_OSFP_MSS_DC, fp_mss)
    400 		MATCH_INT(PF_OSFP_WSCALE_MOD, PF_OSFP_WSCALE_DC, fp_wscale)
    401 		if ((f->fp_flags & PF_OSFP_WSIZE_DC) == 0) {
    402 			if (f->fp_flags & PF_OSFP_WSIZE_MSS) {
    403 				if (find->fp_mss == 0)
    404 					continue;
    405 
    406 /* Some "smart" NAT devices and DSL routers will tweak the MSS size and
    407  * will set it to whatever is suitable for the link type.
    408  */
    409 #define SMART_MSS	1460
    410 				if ((find->fp_wsize % find->fp_mss ||
    411 				    find->fp_wsize / find->fp_mss !=
    412 				    f->fp_wsize) &&
    413 				    (find->fp_wsize % SMART_MSS ||
    414 				    find->fp_wsize / SMART_MSS !=
    415 				    f->fp_wsize))
    416 					continue;
    417 			} else if (f->fp_flags & PF_OSFP_WSIZE_MTU) {
    418 				if (find->fp_mss == 0)
    419 					continue;
    420 
    421 #define MTUOFF	(sizeof(struct ip) + sizeof(struct tcphdr))
    422 #define SMART_MTU	(SMART_MSS + MTUOFF)
    423 				if ((find->fp_wsize % (find->fp_mss + MTUOFF) ||
    424 				    find->fp_wsize / (find->fp_mss + MTUOFF) !=
    425 				    f->fp_wsize) &&
    426 				    (find->fp_wsize % SMART_MTU ||
    427 				    find->fp_wsize / SMART_MTU !=
    428 				    f->fp_wsize))
    429 					continue;
    430 			} else if (f->fp_flags & PF_OSFP_WSIZE_MOD) {
    431 				if (f->fp_wsize == 0 || find->fp_wsize %
    432 				    f->fp_wsize)
    433 					continue;
    434 			} else {
    435 				if (f->fp_wsize != find->fp_wsize)
    436 					continue;
    437 			}
    438 		}
    439 		return (f);
    440 	}
    441 
    442 	return (NULL);
    443 }
    444 
    445 /* Find an exact fingerprint in the list */
    446 struct pf_os_fingerprint *
    447 pf_osfp_find_exact(struct pf_osfp_list *list, struct pf_os_fingerprint *find)
    448 {
    449 	struct pf_os_fingerprint *f;
    450 
    451 	SLIST_FOREACH(f, list, fp_next) {
    452 		if (f->fp_tcpopts == find->fp_tcpopts &&
    453 		    f->fp_wsize == find->fp_wsize &&
    454 		    f->fp_psize == find->fp_psize &&
    455 		    f->fp_mss == find->fp_mss &&
    456 		    f->fp_flags == find->fp_flags &&
    457 		    f->fp_optcnt == find->fp_optcnt &&
    458 		    f->fp_wscale == find->fp_wscale &&
    459 		    f->fp_ttl == find->fp_ttl)
    460 			return (f);
    461 	}
    462 
    463 	return (NULL);
    464 }
    465 
    466 /* Insert a fingerprint into the list */
    467 void
    468 pf_osfp_insert(struct pf_osfp_list *list, struct pf_os_fingerprint *ins)
    469 {
    470 	struct pf_os_fingerprint *f, *prev = NULL;
    471 
    472 	/* XXX need to go semi tree based.  can key on tcp options */
    473 
    474 	SLIST_FOREACH(f, list, fp_next)
    475 		prev = f;
    476 	if (prev)
    477 		SLIST_INSERT_AFTER(prev, ins, fp_next);
    478 	else
    479 		SLIST_INSERT_HEAD(list, ins, fp_next);
    480 }
    481 
    482 /* Fill a fingerprint by its number (from an ioctl) */
    483 int
    484 pf_osfp_get(struct pf_osfp_ioctl *fpioc)
    485 {
    486 	struct pf_os_fingerprint *fp;
    487 	struct pf_osfp_entry *entry;
    488 	int num = fpioc->fp_getnum;
    489 	int i = 0;
    490 
    491 
    492 	memset(fpioc, 0, sizeof(*fpioc));
    493 	SLIST_FOREACH(fp, &pf_osfp_list, fp_next) {
    494 		SLIST_FOREACH(entry, &fp->fp_oses, fp_entry) {
    495 			if (i++ == num) {
    496 				fpioc->fp_mss = fp->fp_mss;
    497 				fpioc->fp_wsize = fp->fp_wsize;
    498 				fpioc->fp_flags = fp->fp_flags;
    499 				fpioc->fp_psize = fp->fp_psize;
    500 				fpioc->fp_ttl = fp->fp_ttl;
    501 				fpioc->fp_wscale = fp->fp_wscale;
    502 				fpioc->fp_getnum = num;
    503 				memcpy(&fpioc->fp_os, entry,
    504 				    sizeof(fpioc->fp_os));
    505 				return (0);
    506 			}
    507 		}
    508 	}
    509 
    510 	return (EBUSY);
    511 }
    512 
    513 
    514 /* Validate that each signature is reachable */
    515 struct pf_os_fingerprint *
    516 pf_osfp_validate(void)
    517 {
    518 	struct pf_os_fingerprint *f, *f2, find;
    519 
    520 	SLIST_FOREACH(f, &pf_osfp_list, fp_next) {
    521 		memcpy(&find, f, sizeof(find));
    522 
    523 		/* We do a few MSS/th_win percolations to make things unique */
    524 		if (find.fp_mss == 0)
    525 			find.fp_mss = 128;
    526 		if (f->fp_flags & PF_OSFP_WSIZE_MSS)
    527 			find.fp_wsize *= find.fp_mss, 1;
    528 		else if (f->fp_flags & PF_OSFP_WSIZE_MTU)
    529 			find.fp_wsize *= (find.fp_mss + 40);
    530 		else if (f->fp_flags & PF_OSFP_WSIZE_MOD)
    531 			find.fp_wsize *= 2;
    532 		if (f != (f2 = pf_osfp_find(&pf_osfp_list, &find, 0))) {
    533 			if (f2)
    534 				printf("Found \"%s %s %s\" instead of "
    535 				    "\"%s %s %s\"\n",
    536 				    SLIST_FIRST(&f2->fp_oses)->fp_class_nm,
    537 				    SLIST_FIRST(&f2->fp_oses)->fp_version_nm,
    538 				    SLIST_FIRST(&f2->fp_oses)->fp_subtype_nm,
    539 				    SLIST_FIRST(&f->fp_oses)->fp_class_nm,
    540 				    SLIST_FIRST(&f->fp_oses)->fp_version_nm,
    541 				    SLIST_FIRST(&f->fp_oses)->fp_subtype_nm);
    542 			else
    543 				printf("Couldn't find \"%s %s %s\"\n",
    544 				    SLIST_FIRST(&f->fp_oses)->fp_class_nm,
    545 				    SLIST_FIRST(&f->fp_oses)->fp_version_nm,
    546 				    SLIST_FIRST(&f->fp_oses)->fp_subtype_nm);
    547 			return (f);
    548 		}
    549 	}
    550 	return (NULL);
    551 }
    552