1 | #include <rtems/freebsd/machine/rtems-bsd-config.h> |
---|
2 | |
---|
3 | /* $OpenBSD: pf_osfp.c,v 1.12 2006/12/13 18:14:10 itojun Exp $ */ |
---|
4 | |
---|
5 | /* |
---|
6 | * Copyright (c) 2003 Mike Frantzen <frantzen@w4g.org> |
---|
7 | * |
---|
8 | * Permission to use, copy, modify, and distribute this software for any |
---|
9 | * purpose with or without fee is hereby granted, provided that the above |
---|
10 | * copyright notice and this permission notice appear in all copies. |
---|
11 | * |
---|
12 | * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES |
---|
13 | * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF |
---|
14 | * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR |
---|
15 | * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES |
---|
16 | * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN |
---|
17 | * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF |
---|
18 | * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. |
---|
19 | * |
---|
20 | */ |
---|
21 | |
---|
22 | #ifdef __FreeBSD__ |
---|
23 | #include <rtems/freebsd/sys/cdefs.h> |
---|
24 | __FBSDID("$FreeBSD$"); |
---|
25 | #endif |
---|
26 | |
---|
27 | #include <rtems/freebsd/sys/param.h> |
---|
28 | #include <rtems/freebsd/sys/socket.h> |
---|
29 | #ifdef _KERNEL |
---|
30 | # include <rtems/freebsd/sys/systm.h> |
---|
31 | #endif /* _KERNEL */ |
---|
32 | #include <rtems/freebsd/sys/mbuf.h> |
---|
33 | |
---|
34 | #include <rtems/freebsd/netinet/in.h> |
---|
35 | #include <rtems/freebsd/netinet/in_systm.h> |
---|
36 | #include <rtems/freebsd/netinet/ip.h> |
---|
37 | #include <rtems/freebsd/netinet/tcp.h> |
---|
38 | |
---|
39 | #include <rtems/freebsd/net/if.h> |
---|
40 | #include <rtems/freebsd/net/pfvar.h> |
---|
41 | |
---|
42 | #include <rtems/freebsd/netinet/ip6.h> |
---|
43 | #ifdef _KERNEL |
---|
44 | #include <rtems/freebsd/netinet6/in6_var.h> |
---|
45 | #endif |
---|
46 | |
---|
47 | #ifdef _KERNEL |
---|
48 | # define DPFPRINTF(format, x...) \ |
---|
49 | if (pf_status.debug >= PF_DEBUG_NOISY) \ |
---|
50 | printf(format , ##x) |
---|
51 | #ifdef __FreeBSD__ |
---|
52 | typedef uma_zone_t pool_t; |
---|
53 | #else |
---|
54 | typedef struct pool pool_t; |
---|
55 | #endif |
---|
56 | |
---|
57 | #else |
---|
58 | /* Userland equivalents so we can lend code to tcpdump et al. */ |
---|
59 | |
---|
60 | # include <rtems/freebsd/arpa/inet.h> |
---|
61 | # include <rtems/freebsd/errno.h> |
---|
62 | # include <rtems/freebsd/stdio.h> |
---|
63 | # include <rtems/freebsd/stdlib.h> |
---|
64 | # include <rtems/freebsd/string.h> |
---|
65 | # include <rtems/freebsd/netdb.h> |
---|
66 | # define pool_t int |
---|
67 | # define pool_get(pool, flags) malloc(*(pool)) |
---|
68 | # define pool_put(pool, item) free(item) |
---|
69 | # define pool_init(pool, size, a, ao, f, m, p) (*(pool)) = (size) |
---|
70 | |
---|
71 | # ifdef __FreeBSD__ |
---|
72 | # define NTOHS(x) (x) = ntohs((u_int16_t)(x)) |
---|
73 | # endif |
---|
74 | |
---|
75 | # ifdef PFDEBUG |
---|
76 | # include <rtems/freebsd/sys/stdarg.h> |
---|
77 | # define DPFPRINTF(format, x...) fprintf(stderr, format , ##x) |
---|
78 | # else |
---|
79 | # define DPFPRINTF(format, x...) ((void)0) |
---|
80 | # endif /* PFDEBUG */ |
---|
81 | #endif /* _KERNEL */ |
---|
82 | |
---|
83 | |
---|
84 | SLIST_HEAD(pf_osfp_list, pf_os_fingerprint) pf_osfp_list; |
---|
85 | pool_t pf_osfp_entry_pl; |
---|
86 | pool_t pf_osfp_pl; |
---|
87 | |
---|
88 | struct pf_os_fingerprint *pf_osfp_find(struct pf_osfp_list *, |
---|
89 | struct pf_os_fingerprint *, u_int8_t); |
---|
90 | struct pf_os_fingerprint *pf_osfp_find_exact(struct pf_osfp_list *, |
---|
91 | struct pf_os_fingerprint *); |
---|
92 | void pf_osfp_insert(struct pf_osfp_list *, |
---|
93 | struct pf_os_fingerprint *); |
---|
94 | |
---|
95 | |
---|
96 | #ifdef _KERNEL |
---|
97 | /* |
---|
98 | * Passively fingerprint the OS of the host (IPv4 TCP SYN packets only) |
---|
99 | * Returns the list of possible OSes. |
---|
100 | */ |
---|
101 | struct pf_osfp_enlist * |
---|
102 | pf_osfp_fingerprint(struct pf_pdesc *pd, struct mbuf *m, int off, |
---|
103 | const struct tcphdr *tcp) |
---|
104 | { |
---|
105 | struct ip *ip; |
---|
106 | struct ip6_hdr *ip6; |
---|
107 | char hdr[60]; |
---|
108 | |
---|
109 | if ((pd->af != PF_INET && pd->af != PF_INET6) || |
---|
110 | pd->proto != IPPROTO_TCP || (tcp->th_off << 2) < sizeof(*tcp)) |
---|
111 | return (NULL); |
---|
112 | |
---|
113 | if (pd->af == PF_INET) { |
---|
114 | ip = mtod(m, struct ip *); |
---|
115 | ip6 = (struct ip6_hdr *)NULL; |
---|
116 | } else { |
---|
117 | ip = (struct ip *)NULL; |
---|
118 | ip6 = mtod(m, struct ip6_hdr *); |
---|
119 | } |
---|
120 | if (!pf_pull_hdr(m, off, hdr, tcp->th_off << 2, NULL, NULL, |
---|
121 | pd->af)) return (NULL); |
---|
122 | |
---|
123 | return (pf_osfp_fingerprint_hdr(ip, ip6, (struct tcphdr *)hdr)); |
---|
124 | } |
---|
125 | #endif /* _KERNEL */ |
---|
126 | |
---|
127 | struct pf_osfp_enlist * |
---|
128 | pf_osfp_fingerprint_hdr(const struct ip *ip, const struct ip6_hdr *ip6, const struct tcphdr *tcp) |
---|
129 | { |
---|
130 | struct pf_os_fingerprint fp, *fpresult; |
---|
131 | int cnt, optlen = 0; |
---|
132 | const u_int8_t *optp; |
---|
133 | #ifdef _KERNEL |
---|
134 | char srcname[128]; |
---|
135 | #else |
---|
136 | char srcname[NI_MAXHOST]; |
---|
137 | #endif |
---|
138 | #ifdef __rtems__ |
---|
139 | #ifdef INET6 |
---|
140 | char ip6buf[INET6_ADDRSTRLEN]; |
---|
141 | #endif //INET6 |
---|
142 | #endif //__rtems__ |
---|
143 | |
---|
144 | if ((tcp->th_flags & (TH_SYN|TH_ACK)) != TH_SYN) |
---|
145 | return (NULL); |
---|
146 | if (ip) { |
---|
147 | if ((ip->ip_off & htons(IP_OFFMASK)) != 0) |
---|
148 | return (NULL); |
---|
149 | } |
---|
150 | |
---|
151 | memset(&fp, 0, sizeof(fp)); |
---|
152 | |
---|
153 | if (ip) { |
---|
154 | #ifndef _KERNEL |
---|
155 | struct sockaddr_in sin; |
---|
156 | #endif |
---|
157 | |
---|
158 | fp.fp_psize = ntohs(ip->ip_len); |
---|
159 | fp.fp_ttl = ip->ip_ttl; |
---|
160 | if (ip->ip_off & htons(IP_DF)) |
---|
161 | fp.fp_flags |= PF_OSFP_DF; |
---|
162 | #ifdef _KERNEL |
---|
163 | strlcpy(srcname, inet_ntoa(ip->ip_src), sizeof(srcname)); |
---|
164 | #else |
---|
165 | memset(&sin, 0, sizeof(sin)); |
---|
166 | sin.sin_family = AF_INET; |
---|
167 | sin.sin_len = sizeof(struct sockaddr_in); |
---|
168 | sin.sin_addr = ip->ip_src; |
---|
169 | (void)getnameinfo((struct sockaddr *)&sin, |
---|
170 | sizeof(struct sockaddr_in), srcname, sizeof(srcname), |
---|
171 | NULL, 0, NI_NUMERICHOST); |
---|
172 | #endif |
---|
173 | } |
---|
174 | #ifdef INET6 |
---|
175 | else if (ip6) { |
---|
176 | #ifndef _KERNEL |
---|
177 | struct sockaddr_in6 sin6; |
---|
178 | #endif |
---|
179 | |
---|
180 | /* jumbo payload? */ |
---|
181 | fp.fp_psize = sizeof(struct ip6_hdr) + ntohs(ip6->ip6_plen); |
---|
182 | fp.fp_ttl = ip6->ip6_hlim; |
---|
183 | fp.fp_flags |= PF_OSFP_DF; |
---|
184 | fp.fp_flags |= PF_OSFP_INET6; |
---|
185 | #ifdef _KERNEL |
---|
186 | #ifndef __rtems__ |
---|
187 | strlcpy(srcname, ip6_sprintf((struct in6_addr *)&ip6->ip6_src), |
---|
188 | sizeof(srcname)); |
---|
189 | #else |
---|
190 | strlcpy(srcname, ip6_sprintf(&ip6buf, (struct in6_addr *)&ip6->ip6_src), |
---|
191 | sizeof(srcname)); |
---|
192 | #endif |
---|
193 | #else |
---|
194 | memset(&sin6, 0, sizeof(sin6)); |
---|
195 | sin6.sin6_family = AF_INET6; |
---|
196 | sin6.sin6_len = sizeof(struct sockaddr_in6); |
---|
197 | sin6.sin6_addr = ip6->ip6_src; |
---|
198 | (void)getnameinfo((struct sockaddr *)&sin6, |
---|
199 | sizeof(struct sockaddr_in6), srcname, sizeof(srcname), |
---|
200 | NULL, 0, NI_NUMERICHOST); |
---|
201 | #endif |
---|
202 | } |
---|
203 | #endif |
---|
204 | else |
---|
205 | return (NULL); |
---|
206 | fp.fp_wsize = ntohs(tcp->th_win); |
---|
207 | |
---|
208 | |
---|
209 | cnt = (tcp->th_off << 2) - sizeof(*tcp); |
---|
210 | optp = (const u_int8_t *)((const char *)tcp + sizeof(*tcp)); |
---|
211 | for (; cnt > 0; cnt -= optlen, optp += optlen) { |
---|
212 | if (*optp == TCPOPT_EOL) |
---|
213 | break; |
---|
214 | |
---|
215 | fp.fp_optcnt++; |
---|
216 | if (*optp == TCPOPT_NOP) { |
---|
217 | fp.fp_tcpopts = (fp.fp_tcpopts << PF_OSFP_TCPOPT_BITS) | |
---|
218 | PF_OSFP_TCPOPT_NOP; |
---|
219 | optlen = 1; |
---|
220 | } else { |
---|
221 | if (cnt < 2) |
---|
222 | return (NULL); |
---|
223 | optlen = optp[1]; |
---|
224 | if (optlen > cnt || optlen < 2) |
---|
225 | return (NULL); |
---|
226 | switch (*optp) { |
---|
227 | case TCPOPT_MAXSEG: |
---|
228 | if (optlen >= TCPOLEN_MAXSEG) |
---|
229 | memcpy(&fp.fp_mss, &optp[2], |
---|
230 | sizeof(fp.fp_mss)); |
---|
231 | fp.fp_tcpopts = (fp.fp_tcpopts << |
---|
232 | PF_OSFP_TCPOPT_BITS) | PF_OSFP_TCPOPT_MSS; |
---|
233 | NTOHS(fp.fp_mss); |
---|
234 | break; |
---|
235 | case TCPOPT_WINDOW: |
---|
236 | if (optlen >= TCPOLEN_WINDOW) |
---|
237 | memcpy(&fp.fp_wscale, &optp[2], |
---|
238 | sizeof(fp.fp_wscale)); |
---|
239 | NTOHS(fp.fp_wscale); |
---|
240 | fp.fp_tcpopts = (fp.fp_tcpopts << |
---|
241 | PF_OSFP_TCPOPT_BITS) | |
---|
242 | PF_OSFP_TCPOPT_WSCALE; |
---|
243 | break; |
---|
244 | case TCPOPT_SACK_PERMITTED: |
---|
245 | fp.fp_tcpopts = (fp.fp_tcpopts << |
---|
246 | PF_OSFP_TCPOPT_BITS) | PF_OSFP_TCPOPT_SACK; |
---|
247 | break; |
---|
248 | case TCPOPT_TIMESTAMP: |
---|
249 | if (optlen >= TCPOLEN_TIMESTAMP) { |
---|
250 | u_int32_t ts; |
---|
251 | memcpy(&ts, &optp[2], sizeof(ts)); |
---|
252 | if (ts == 0) |
---|
253 | fp.fp_flags |= PF_OSFP_TS0; |
---|
254 | |
---|
255 | } |
---|
256 | fp.fp_tcpopts = (fp.fp_tcpopts << |
---|
257 | PF_OSFP_TCPOPT_BITS) | PF_OSFP_TCPOPT_TS; |
---|
258 | break; |
---|
259 | default: |
---|
260 | return (NULL); |
---|
261 | } |
---|
262 | } |
---|
263 | optlen = MAX(optlen, 1); /* paranoia */ |
---|
264 | } |
---|
265 | |
---|
266 | DPFPRINTF("fingerprinted %s:%d %d:%d:%d:%d:%llx (%d) " |
---|
267 | "(TS=%s,M=%s%d,W=%s%d)\n", |
---|
268 | srcname, ntohs(tcp->th_sport), |
---|
269 | fp.fp_wsize, fp.fp_ttl, (fp.fp_flags & PF_OSFP_DF) != 0, |
---|
270 | fp.fp_psize, (long long int)fp.fp_tcpopts, fp.fp_optcnt, |
---|
271 | (fp.fp_flags & PF_OSFP_TS0) ? "0" : "", |
---|
272 | (fp.fp_flags & PF_OSFP_MSS_MOD) ? "%" : |
---|
273 | (fp.fp_flags & PF_OSFP_MSS_DC) ? "*" : "", |
---|
274 | fp.fp_mss, |
---|
275 | (fp.fp_flags & PF_OSFP_WSCALE_MOD) ? "%" : |
---|
276 | (fp.fp_flags & PF_OSFP_WSCALE_DC) ? "*" : "", |
---|
277 | fp.fp_wscale); |
---|
278 | |
---|
279 | if ((fpresult = pf_osfp_find(&pf_osfp_list, &fp, |
---|
280 | PF_OSFP_MAXTTL_OFFSET))) |
---|
281 | return (&fpresult->fp_oses); |
---|
282 | return (NULL); |
---|
283 | } |
---|
284 | |
---|
285 | /* Match a fingerprint ID against a list of OSes */ |
---|
286 | int |
---|
287 | pf_osfp_match(struct pf_osfp_enlist *list, pf_osfp_t os) |
---|
288 | { |
---|
289 | struct pf_osfp_entry *entry; |
---|
290 | int os_class, os_version, os_subtype; |
---|
291 | int en_class, en_version, en_subtype; |
---|
292 | |
---|
293 | if (os == PF_OSFP_ANY) |
---|
294 | return (1); |
---|
295 | if (list == NULL) { |
---|
296 | DPFPRINTF("osfp no match against %x\n", os); |
---|
297 | return (os == PF_OSFP_UNKNOWN); |
---|
298 | } |
---|
299 | PF_OSFP_UNPACK(os, os_class, os_version, os_subtype); |
---|
300 | SLIST_FOREACH(entry, list, fp_entry) { |
---|
301 | PF_OSFP_UNPACK(entry->fp_os, en_class, en_version, en_subtype); |
---|
302 | if ((os_class == PF_OSFP_ANY || en_class == os_class) && |
---|
303 | (os_version == PF_OSFP_ANY || en_version == os_version) && |
---|
304 | (os_subtype == PF_OSFP_ANY || en_subtype == os_subtype)) { |
---|
305 | DPFPRINTF("osfp matched %s %s %s %x==%x\n", |
---|
306 | entry->fp_class_nm, entry->fp_version_nm, |
---|
307 | entry->fp_subtype_nm, os, entry->fp_os); |
---|
308 | return (1); |
---|
309 | } |
---|
310 | } |
---|
311 | DPFPRINTF("fingerprint 0x%x didn't match\n", os); |
---|
312 | return (0); |
---|
313 | } |
---|
314 | |
---|
315 | /* Initialize the OS fingerprint system */ |
---|
316 | #ifdef __FreeBSD__ |
---|
317 | int |
---|
318 | #else |
---|
319 | void |
---|
320 | #endif |
---|
321 | pf_osfp_initialize(void) |
---|
322 | { |
---|
323 | #if defined(__FreeBSD__) && defined(_KERNEL) |
---|
324 | int error = ENOMEM; |
---|
325 | |
---|
326 | do { |
---|
327 | pf_osfp_entry_pl = pf_osfp_pl = NULL; |
---|
328 | UMA_CREATE(pf_osfp_entry_pl, struct pf_osfp_entry, "pfospfen"); |
---|
329 | UMA_CREATE(pf_osfp_pl, struct pf_os_fingerprint, "pfosfp"); |
---|
330 | error = 0; |
---|
331 | } while(0); |
---|
332 | #else |
---|
333 | pool_init(&pf_osfp_entry_pl, sizeof(struct pf_osfp_entry), 0, 0, 0, |
---|
334 | "pfosfpen", &pool_allocator_nointr); |
---|
335 | pool_init(&pf_osfp_pl, sizeof(struct pf_os_fingerprint), 0, 0, 0, |
---|
336 | "pfosfp", &pool_allocator_nointr); |
---|
337 | #endif |
---|
338 | SLIST_INIT(&pf_osfp_list); |
---|
339 | #ifdef __FreeBSD__ |
---|
340 | #ifdef _KERNEL |
---|
341 | return (error); |
---|
342 | #else |
---|
343 | return (0); |
---|
344 | #endif |
---|
345 | #endif |
---|
346 | } |
---|
347 | |
---|
348 | #if defined(__FreeBSD__) && (_KERNEL) |
---|
349 | void |
---|
350 | pf_osfp_cleanup(void) |
---|
351 | { |
---|
352 | UMA_DESTROY(pf_osfp_entry_pl); |
---|
353 | UMA_DESTROY(pf_osfp_pl); |
---|
354 | } |
---|
355 | #endif |
---|
356 | |
---|
357 | /* Flush the fingerprint list */ |
---|
358 | void |
---|
359 | pf_osfp_flush(void) |
---|
360 | { |
---|
361 | struct pf_os_fingerprint *fp; |
---|
362 | struct pf_osfp_entry *entry; |
---|
363 | |
---|
364 | while ((fp = SLIST_FIRST(&pf_osfp_list))) { |
---|
365 | SLIST_REMOVE_HEAD(&pf_osfp_list, fp_next); |
---|
366 | while ((entry = SLIST_FIRST(&fp->fp_oses))) { |
---|
367 | SLIST_REMOVE_HEAD(&fp->fp_oses, fp_entry); |
---|
368 | pool_put(&pf_osfp_entry_pl, entry); |
---|
369 | } |
---|
370 | pool_put(&pf_osfp_pl, fp); |
---|
371 | } |
---|
372 | } |
---|
373 | |
---|
374 | |
---|
375 | /* Add a fingerprint */ |
---|
376 | int |
---|
377 | pf_osfp_add(struct pf_osfp_ioctl *fpioc) |
---|
378 | { |
---|
379 | struct pf_os_fingerprint *fp, fpadd; |
---|
380 | struct pf_osfp_entry *entry; |
---|
381 | |
---|
382 | memset(&fpadd, 0, sizeof(fpadd)); |
---|
383 | fpadd.fp_tcpopts = fpioc->fp_tcpopts; |
---|
384 | fpadd.fp_wsize = fpioc->fp_wsize; |
---|
385 | fpadd.fp_psize = fpioc->fp_psize; |
---|
386 | fpadd.fp_mss = fpioc->fp_mss; |
---|
387 | fpadd.fp_flags = fpioc->fp_flags; |
---|
388 | fpadd.fp_optcnt = fpioc->fp_optcnt; |
---|
389 | fpadd.fp_wscale = fpioc->fp_wscale; |
---|
390 | fpadd.fp_ttl = fpioc->fp_ttl; |
---|
391 | |
---|
392 | DPFPRINTF("adding osfp %s %s %s = %s%d:%d:%d:%s%d:0x%llx %d " |
---|
393 | "(TS=%s,M=%s%d,W=%s%d) %x\n", |
---|
394 | fpioc->fp_os.fp_class_nm, fpioc->fp_os.fp_version_nm, |
---|
395 | fpioc->fp_os.fp_subtype_nm, |
---|
396 | (fpadd.fp_flags & PF_OSFP_WSIZE_MOD) ? "%" : |
---|
397 | (fpadd.fp_flags & PF_OSFP_WSIZE_MSS) ? "S" : |
---|
398 | (fpadd.fp_flags & PF_OSFP_WSIZE_MTU) ? "T" : |
---|
399 | (fpadd.fp_flags & PF_OSFP_WSIZE_DC) ? "*" : "", |
---|
400 | fpadd.fp_wsize, |
---|
401 | fpadd.fp_ttl, |
---|
402 | (fpadd.fp_flags & PF_OSFP_DF) ? 1 : 0, |
---|
403 | (fpadd.fp_flags & PF_OSFP_PSIZE_MOD) ? "%" : |
---|
404 | (fpadd.fp_flags & PF_OSFP_PSIZE_DC) ? "*" : "", |
---|
405 | fpadd.fp_psize, |
---|
406 | (long long int)fpadd.fp_tcpopts, fpadd.fp_optcnt, |
---|
407 | (fpadd.fp_flags & PF_OSFP_TS0) ? "0" : "", |
---|
408 | (fpadd.fp_flags & PF_OSFP_MSS_MOD) ? "%" : |
---|
409 | (fpadd.fp_flags & PF_OSFP_MSS_DC) ? "*" : "", |
---|
410 | fpadd.fp_mss, |
---|
411 | (fpadd.fp_flags & PF_OSFP_WSCALE_MOD) ? "%" : |
---|
412 | (fpadd.fp_flags & PF_OSFP_WSCALE_DC) ? "*" : "", |
---|
413 | fpadd.fp_wscale, |
---|
414 | fpioc->fp_os.fp_os); |
---|
415 | |
---|
416 | |
---|
417 | if ((fp = pf_osfp_find_exact(&pf_osfp_list, &fpadd))) { |
---|
418 | SLIST_FOREACH(entry, &fp->fp_oses, fp_entry) { |
---|
419 | if (PF_OSFP_ENTRY_EQ(entry, &fpioc->fp_os)) |
---|
420 | return (EEXIST); |
---|
421 | } |
---|
422 | if ((entry = pool_get(&pf_osfp_entry_pl, PR_NOWAIT)) == NULL) |
---|
423 | return (ENOMEM); |
---|
424 | } else { |
---|
425 | if ((fp = pool_get(&pf_osfp_pl, PR_NOWAIT)) == NULL) |
---|
426 | return (ENOMEM); |
---|
427 | memset(fp, 0, sizeof(*fp)); |
---|
428 | fp->fp_tcpopts = fpioc->fp_tcpopts; |
---|
429 | fp->fp_wsize = fpioc->fp_wsize; |
---|
430 | fp->fp_psize = fpioc->fp_psize; |
---|
431 | fp->fp_mss = fpioc->fp_mss; |
---|
432 | fp->fp_flags = fpioc->fp_flags; |
---|
433 | fp->fp_optcnt = fpioc->fp_optcnt; |
---|
434 | fp->fp_wscale = fpioc->fp_wscale; |
---|
435 | fp->fp_ttl = fpioc->fp_ttl; |
---|
436 | SLIST_INIT(&fp->fp_oses); |
---|
437 | if ((entry = pool_get(&pf_osfp_entry_pl, PR_NOWAIT)) == NULL) { |
---|
438 | pool_put(&pf_osfp_pl, fp); |
---|
439 | return (ENOMEM); |
---|
440 | } |
---|
441 | pf_osfp_insert(&pf_osfp_list, fp); |
---|
442 | } |
---|
443 | memcpy(entry, &fpioc->fp_os, sizeof(*entry)); |
---|
444 | |
---|
445 | /* Make sure the strings are NUL terminated */ |
---|
446 | entry->fp_class_nm[sizeof(entry->fp_class_nm)-1] = '\0'; |
---|
447 | entry->fp_version_nm[sizeof(entry->fp_version_nm)-1] = '\0'; |
---|
448 | entry->fp_subtype_nm[sizeof(entry->fp_subtype_nm)-1] = '\0'; |
---|
449 | |
---|
450 | SLIST_INSERT_HEAD(&fp->fp_oses, entry, fp_entry); |
---|
451 | |
---|
452 | #ifdef PFDEBUG |
---|
453 | if ((fp = pf_osfp_validate())) |
---|
454 | printf("Invalid fingerprint list\n"); |
---|
455 | #endif /* PFDEBUG */ |
---|
456 | return (0); |
---|
457 | } |
---|
458 | |
---|
459 | |
---|
460 | /* Find a fingerprint in the list */ |
---|
461 | struct pf_os_fingerprint * |
---|
462 | pf_osfp_find(struct pf_osfp_list *list, struct pf_os_fingerprint *find, |
---|
463 | u_int8_t ttldiff) |
---|
464 | { |
---|
465 | struct pf_os_fingerprint *f; |
---|
466 | |
---|
467 | #define MATCH_INT(_MOD, _DC, _field) \ |
---|
468 | if ((f->fp_flags & _DC) == 0) { \ |
---|
469 | if ((f->fp_flags & _MOD) == 0) { \ |
---|
470 | if (f->_field != find->_field) \ |
---|
471 | continue; \ |
---|
472 | } else { \ |
---|
473 | if (f->_field == 0 || find->_field % f->_field) \ |
---|
474 | continue; \ |
---|
475 | } \ |
---|
476 | } |
---|
477 | |
---|
478 | SLIST_FOREACH(f, list, fp_next) { |
---|
479 | if (f->fp_tcpopts != find->fp_tcpopts || |
---|
480 | f->fp_optcnt != find->fp_optcnt || |
---|
481 | f->fp_ttl < find->fp_ttl || |
---|
482 | f->fp_ttl - find->fp_ttl > ttldiff || |
---|
483 | (f->fp_flags & (PF_OSFP_DF|PF_OSFP_TS0)) != |
---|
484 | (find->fp_flags & (PF_OSFP_DF|PF_OSFP_TS0))) |
---|
485 | continue; |
---|
486 | |
---|
487 | MATCH_INT(PF_OSFP_PSIZE_MOD, PF_OSFP_PSIZE_DC, fp_psize) |
---|
488 | MATCH_INT(PF_OSFP_MSS_MOD, PF_OSFP_MSS_DC, fp_mss) |
---|
489 | MATCH_INT(PF_OSFP_WSCALE_MOD, PF_OSFP_WSCALE_DC, fp_wscale) |
---|
490 | if ((f->fp_flags & PF_OSFP_WSIZE_DC) == 0) { |
---|
491 | if (f->fp_flags & PF_OSFP_WSIZE_MSS) { |
---|
492 | if (find->fp_mss == 0) |
---|
493 | continue; |
---|
494 | |
---|
495 | /* Some "smart" NAT devices and DSL routers will tweak the MSS size and |
---|
496 | * will set it to whatever is suitable for the link type. |
---|
497 | */ |
---|
498 | #define SMART_MSS 1460 |
---|
499 | if ((find->fp_wsize % find->fp_mss || |
---|
500 | find->fp_wsize / find->fp_mss != |
---|
501 | f->fp_wsize) && |
---|
502 | (find->fp_wsize % SMART_MSS || |
---|
503 | find->fp_wsize / SMART_MSS != |
---|
504 | f->fp_wsize)) |
---|
505 | continue; |
---|
506 | } else if (f->fp_flags & PF_OSFP_WSIZE_MTU) { |
---|
507 | if (find->fp_mss == 0) |
---|
508 | continue; |
---|
509 | |
---|
510 | #define MTUOFF (sizeof(struct ip) + sizeof(struct tcphdr)) |
---|
511 | #define SMART_MTU (SMART_MSS + MTUOFF) |
---|
512 | if ((find->fp_wsize % (find->fp_mss + MTUOFF) || |
---|
513 | find->fp_wsize / (find->fp_mss + MTUOFF) != |
---|
514 | f->fp_wsize) && |
---|
515 | (find->fp_wsize % SMART_MTU || |
---|
516 | find->fp_wsize / SMART_MTU != |
---|
517 | f->fp_wsize)) |
---|
518 | continue; |
---|
519 | } else if (f->fp_flags & PF_OSFP_WSIZE_MOD) { |
---|
520 | if (f->fp_wsize == 0 || find->fp_wsize % |
---|
521 | f->fp_wsize) |
---|
522 | continue; |
---|
523 | } else { |
---|
524 | if (f->fp_wsize != find->fp_wsize) |
---|
525 | continue; |
---|
526 | } |
---|
527 | } |
---|
528 | return (f); |
---|
529 | } |
---|
530 | |
---|
531 | return (NULL); |
---|
532 | } |
---|
533 | |
---|
534 | /* Find an exact fingerprint in the list */ |
---|
535 | struct pf_os_fingerprint * |
---|
536 | pf_osfp_find_exact(struct pf_osfp_list *list, struct pf_os_fingerprint *find) |
---|
537 | { |
---|
538 | struct pf_os_fingerprint *f; |
---|
539 | |
---|
540 | SLIST_FOREACH(f, list, fp_next) { |
---|
541 | if (f->fp_tcpopts == find->fp_tcpopts && |
---|
542 | f->fp_wsize == find->fp_wsize && |
---|
543 | f->fp_psize == find->fp_psize && |
---|
544 | f->fp_mss == find->fp_mss && |
---|
545 | f->fp_flags == find->fp_flags && |
---|
546 | f->fp_optcnt == find->fp_optcnt && |
---|
547 | f->fp_wscale == find->fp_wscale && |
---|
548 | f->fp_ttl == find->fp_ttl) |
---|
549 | return (f); |
---|
550 | } |
---|
551 | |
---|
552 | return (NULL); |
---|
553 | } |
---|
554 | |
---|
555 | /* Insert a fingerprint into the list */ |
---|
556 | void |
---|
557 | pf_osfp_insert(struct pf_osfp_list *list, struct pf_os_fingerprint *ins) |
---|
558 | { |
---|
559 | struct pf_os_fingerprint *f, *prev = NULL; |
---|
560 | |
---|
561 | /* XXX need to go semi tree based. can key on tcp options */ |
---|
562 | |
---|
563 | SLIST_FOREACH(f, list, fp_next) |
---|
564 | prev = f; |
---|
565 | if (prev) |
---|
566 | SLIST_INSERT_AFTER(prev, ins, fp_next); |
---|
567 | else |
---|
568 | SLIST_INSERT_HEAD(list, ins, fp_next); |
---|
569 | } |
---|
570 | |
---|
571 | /* Fill a fingerprint by its number (from an ioctl) */ |
---|
572 | int |
---|
573 | pf_osfp_get(struct pf_osfp_ioctl *fpioc) |
---|
574 | { |
---|
575 | struct pf_os_fingerprint *fp; |
---|
576 | struct pf_osfp_entry *entry; |
---|
577 | int num = fpioc->fp_getnum; |
---|
578 | int i = 0; |
---|
579 | |
---|
580 | |
---|
581 | memset(fpioc, 0, sizeof(*fpioc)); |
---|
582 | SLIST_FOREACH(fp, &pf_osfp_list, fp_next) { |
---|
583 | SLIST_FOREACH(entry, &fp->fp_oses, fp_entry) { |
---|
584 | if (i++ == num) { |
---|
585 | fpioc->fp_mss = fp->fp_mss; |
---|
586 | fpioc->fp_wsize = fp->fp_wsize; |
---|
587 | fpioc->fp_flags = fp->fp_flags; |
---|
588 | fpioc->fp_psize = fp->fp_psize; |
---|
589 | fpioc->fp_ttl = fp->fp_ttl; |
---|
590 | fpioc->fp_wscale = fp->fp_wscale; |
---|
591 | fpioc->fp_getnum = num; |
---|
592 | memcpy(&fpioc->fp_os, entry, |
---|
593 | sizeof(fpioc->fp_os)); |
---|
594 | return (0); |
---|
595 | } |
---|
596 | } |
---|
597 | } |
---|
598 | |
---|
599 | return (EBUSY); |
---|
600 | } |
---|
601 | |
---|
602 | |
---|
603 | /* Validate that each signature is reachable */ |
---|
604 | struct pf_os_fingerprint * |
---|
605 | pf_osfp_validate(void) |
---|
606 | { |
---|
607 | struct pf_os_fingerprint *f, *f2, find; |
---|
608 | |
---|
609 | SLIST_FOREACH(f, &pf_osfp_list, fp_next) { |
---|
610 | memcpy(&find, f, sizeof(find)); |
---|
611 | |
---|
612 | /* We do a few MSS/th_win percolations to make things unique */ |
---|
613 | if (find.fp_mss == 0) |
---|
614 | find.fp_mss = 128; |
---|
615 | if (f->fp_flags & PF_OSFP_WSIZE_MSS) |
---|
616 | find.fp_wsize *= find.fp_mss, 1; |
---|
617 | else if (f->fp_flags & PF_OSFP_WSIZE_MTU) |
---|
618 | find.fp_wsize *= (find.fp_mss + 40); |
---|
619 | else if (f->fp_flags & PF_OSFP_WSIZE_MOD) |
---|
620 | find.fp_wsize *= 2; |
---|
621 | if (f != (f2 = pf_osfp_find(&pf_osfp_list, &find, 0))) { |
---|
622 | if (f2) |
---|
623 | printf("Found \"%s %s %s\" instead of " |
---|
624 | "\"%s %s %s\"\n", |
---|
625 | SLIST_FIRST(&f2->fp_oses)->fp_class_nm, |
---|
626 | SLIST_FIRST(&f2->fp_oses)->fp_version_nm, |
---|
627 | SLIST_FIRST(&f2->fp_oses)->fp_subtype_nm, |
---|
628 | SLIST_FIRST(&f->fp_oses)->fp_class_nm, |
---|
629 | SLIST_FIRST(&f->fp_oses)->fp_version_nm, |
---|
630 | SLIST_FIRST(&f->fp_oses)->fp_subtype_nm); |
---|
631 | else |
---|
632 | printf("Couldn't find \"%s %s %s\"\n", |
---|
633 | SLIST_FIRST(&f->fp_oses)->fp_class_nm, |
---|
634 | SLIST_FIRST(&f->fp_oses)->fp_version_nm, |
---|
635 | SLIST_FIRST(&f->fp_oses)->fp_subtype_nm); |
---|
636 | return (f); |
---|
637 | } |
---|
638 | } |
---|
639 | return (NULL); |
---|
640 | } |
---|