1 /* $OpenBSD: pf_osfp.c,v 1.15 2008/06/14 02:22:13 henning Exp $ */
4 * Copyright (c) 2003 Mike Frantzen <frantzen@w4g.org>
6 * Permission to use, copy, modify, and distribute this software for any
7 * purpose with or without fee is hereby granted, provided that the above
8 * copyright notice and this permission notice appear in all copies.
10 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
20 #include <sys/param.h>
21 #include <sys/socket.h>
23 #include <sys/systm.h>
27 #include <netinet/in.h>
28 #include <netinet/in_systm.h>
29 #include <netinet/ip.h>
30 #include <netinet/tcp.h>
33 #include <net/pf/pfvar.h>
35 #include <netinet/ip6.h>
37 #include <netinet6/in6_var.h>
42 # define DPFPRINTF(format, x...) \
43 if (pf_status.debug >= PF_DEBUG_NOISY) \
47 /* Userland equivalents so we can lend code to tcpdump et al. */
49 # include <arpa/inet.h>
57 # include <sys/stdarg.h>
58 # define DPFPRINTF(format, x...) fprintf(stderr, format , ##x)
60 # define DPFPRINTF(format, x...) ((void)0)
64 static MALLOC_DEFINE(M_PFOSFPENTRYPL
, "pfospfen", "pf OS finger printing pool list");
65 static MALLOC_DEFINE(M_PFOSFPPL
, "pfosfp", "pf OS finger printing pool list");
67 SLIST_HEAD(pf_osfp_list
, pf_os_fingerprint
) pf_osfp_list
;
69 struct pf_os_fingerprint
*pf_osfp_find(struct pf_osfp_list
*,
70 struct pf_os_fingerprint
*, u_int8_t
);
71 struct pf_os_fingerprint
*pf_osfp_find_exact(struct pf_osfp_list
*,
72 struct pf_os_fingerprint
*);
73 void pf_osfp_insert(struct pf_osfp_list
*,
74 struct pf_os_fingerprint
*);
79 * Passively fingerprint the OS of the host (IPv4 TCP SYN packets only)
80 * Returns the list of possible OSes.
82 struct pf_osfp_enlist
*
83 pf_osfp_fingerprint(struct pf_pdesc
*pd
, struct mbuf
*m
, int off
,
84 const struct tcphdr
*tcp
)
90 if ((pd
->af
!= PF_INET
&& pd
->af
!= PF_INET6
) ||
91 pd
->proto
!= IPPROTO_TCP
|| (tcp
->th_off
<< 2) < sizeof(*tcp
))
94 if (pd
->af
== PF_INET
) {
95 ip
= mtod(m
, struct ip
*);
99 ip6
= mtod(m
, struct ip6_hdr
*);
101 if (!pf_pull_hdr(m
, off
, hdr
, tcp
->th_off
<< 2, NULL
, NULL
,
102 pd
->af
)) return (NULL
);
104 return (pf_osfp_fingerprint_hdr(ip
, ip6
, (struct tcphdr
*)hdr
));
108 struct pf_osfp_enlist
*
109 pf_osfp_fingerprint_hdr(const struct ip
*ip
, const struct ip6_hdr
*ip6
, const struct tcphdr
*tcp
)
111 struct pf_os_fingerprint fp
, *fpresult
;
113 const u_int8_t
*optp
;
117 char srcname
[NI_MAXHOST
];
120 if ((tcp
->th_flags
& (TH_SYN
|TH_ACK
)) != TH_SYN
)
123 if ((ip
->ip_off
& IP_OFFMASK
) != 0)
127 memset(&fp
, 0, sizeof(fp
));
131 struct sockaddr_in sin
;
134 fp
.fp_psize
= ip
->ip_len
;
135 fp
.fp_ttl
= ip
->ip_ttl
;
136 if (ip
->ip_off
& IP_DF
)
137 fp
.fp_flags
|= PF_OSFP_DF
;
139 kinet_ntoa(ip
->ip_src
, srcname
);
141 memset(&sin
, 0, sizeof(sin
));
142 sin
.sin_family
= AF_INET
;
143 sin
.sin_len
= sizeof(struct sockaddr_in
);
144 sin
.sin_addr
= ip
->ip_src
;
145 (void)getnameinfo((struct sockaddr
*)&sin
,
146 sizeof(struct sockaddr_in
), srcname
, sizeof(srcname
),
147 NULL
, 0, NI_NUMERICHOST
);
153 struct sockaddr_in6 sin6
;
157 fp
.fp_psize
= sizeof(struct ip6_hdr
) + ntohs(ip6
->ip6_plen
);
158 fp
.fp_ttl
= ip6
->ip6_hlim
;
159 fp
.fp_flags
|= PF_OSFP_DF
;
160 fp
.fp_flags
|= PF_OSFP_INET6
;
162 strlcpy(srcname
, ip6_sprintf((struct in6_addr
*)&ip6
->ip6_src
),
165 memset(&sin6
, 0, sizeof(sin6
));
166 sin6
.sin6_family
= AF_INET6
;
167 sin6
.sin6_len
= sizeof(struct sockaddr_in6
);
168 sin6
.sin6_addr
= ip6
->ip6_src
;
169 (void)getnameinfo((struct sockaddr
*)&sin6
,
170 sizeof(struct sockaddr_in6
), srcname
, sizeof(srcname
),
171 NULL
, 0, NI_NUMERICHOST
);
177 fp
.fp_wsize
= ntohs(tcp
->th_win
);
180 cnt
= (tcp
->th_off
<< 2) - sizeof(*tcp
);
181 optp
= (const u_int8_t
*)((const char *)tcp
+ sizeof(*tcp
));
182 for (; cnt
> 0; cnt
-= optlen
, optp
+= optlen
) {
183 if (*optp
== TCPOPT_EOL
)
187 if (*optp
== TCPOPT_NOP
) {
188 fp
.fp_tcpopts
= (fp
.fp_tcpopts
<< PF_OSFP_TCPOPT_BITS
) |
195 if (optlen
> cnt
|| optlen
< 2)
199 if (optlen
>= TCPOLEN_MAXSEG
)
200 memcpy(&fp
.fp_mss
, &optp
[2],
202 fp
.fp_tcpopts
= (fp
.fp_tcpopts
<<
203 PF_OSFP_TCPOPT_BITS
) | PF_OSFP_TCPOPT_MSS
;
204 fp
.fp_mss
= ntohs(fp
.fp_mss
);
207 if (optlen
>= TCPOLEN_WINDOW
)
208 memcpy(&fp
.fp_wscale
, &optp
[2],
209 sizeof(fp
.fp_wscale
));
210 fp
.fp_tcpopts
= (fp
.fp_tcpopts
<<
211 PF_OSFP_TCPOPT_BITS
) |
212 PF_OSFP_TCPOPT_WSCALE
;
214 case TCPOPT_SACK_PERMITTED
:
215 fp
.fp_tcpopts
= (fp
.fp_tcpopts
<<
216 PF_OSFP_TCPOPT_BITS
) | PF_OSFP_TCPOPT_SACK
;
218 case TCPOPT_TIMESTAMP
:
219 if (optlen
>= TCPOLEN_TIMESTAMP
) {
221 memcpy(&ts
, &optp
[2], sizeof(ts
));
223 fp
.fp_flags
|= PF_OSFP_TS0
;
226 fp
.fp_tcpopts
= (fp
.fp_tcpopts
<<
227 PF_OSFP_TCPOPT_BITS
) | PF_OSFP_TCPOPT_TS
;
233 optlen
= MAX(optlen
, 1); /* paranoia */
236 DPFPRINTF("fingerprinted %s:%d %d:%d:%d:%d:%llx (%d) "
237 "(TS=%s,M=%s%d,W=%s%d)\n",
238 srcname
, ntohs(tcp
->th_sport
),
239 fp
.fp_wsize
, fp
.fp_ttl
, (fp
.fp_flags
& PF_OSFP_DF
) != 0,
240 fp
.fp_psize
, (long long int)fp
.fp_tcpopts
, fp
.fp_optcnt
,
241 (fp
.fp_flags
& PF_OSFP_TS0
) ? "0" : "",
242 (fp
.fp_flags
& PF_OSFP_MSS_MOD
) ? "%" :
243 (fp
.fp_flags
& PF_OSFP_MSS_DC
) ? "*" : "",
245 (fp
.fp_flags
& PF_OSFP_WSCALE_MOD
) ? "%" :
246 (fp
.fp_flags
& PF_OSFP_WSCALE_DC
) ? "*" : "",
249 if ((fpresult
= pf_osfp_find(&pf_osfp_list
, &fp
,
250 PF_OSFP_MAXTTL_OFFSET
)))
251 return (&fpresult
->fp_oses
);
255 /* Match a fingerprint ID against a list of OSes */
257 pf_osfp_match(struct pf_osfp_enlist
*list
, pf_osfp_t os
)
259 struct pf_osfp_entry
*entry
;
260 int os_class
, os_version
, os_subtype
;
261 int en_class
, en_version
, en_subtype
;
263 if (os
== PF_OSFP_ANY
)
266 DPFPRINTF("osfp no match against %x\n", os
);
267 return (os
== PF_OSFP_UNKNOWN
);
269 PF_OSFP_UNPACK(os
, os_class
, os_version
, os_subtype
);
270 SLIST_FOREACH(entry
, list
, fp_entry
) {
271 PF_OSFP_UNPACK(entry
->fp_os
, en_class
, en_version
, en_subtype
);
272 if ((os_class
== PF_OSFP_ANY
|| en_class
== os_class
) &&
273 (os_version
== PF_OSFP_ANY
|| en_version
== os_version
) &&
274 (os_subtype
== PF_OSFP_ANY
|| en_subtype
== os_subtype
)) {
275 DPFPRINTF("osfp matched %s %s %s %x==%x\n",
276 entry
->fp_class_nm
, entry
->fp_version_nm
,
277 entry
->fp_subtype_nm
, os
, entry
->fp_os
);
281 DPFPRINTF("fingerprint 0x%x didn't match\n", os
);
285 /* Initialize the OS fingerprint system */
287 pf_osfp_initialize(void)
289 SLIST_INIT(&pf_osfp_list
);
292 /* Flush the fingerprint list */
296 struct pf_os_fingerprint
*fp
;
297 struct pf_osfp_entry
*entry
;
299 while ((fp
= SLIST_FIRST(&pf_osfp_list
))) {
300 SLIST_REMOVE_HEAD(&pf_osfp_list
, fp_next
);
301 while ((entry
= SLIST_FIRST(&fp
->fp_oses
))) {
302 SLIST_REMOVE_HEAD(&fp
->fp_oses
, fp_entry
);
303 kfree(entry
, M_PFOSFPENTRYPL
);
305 kfree(fp
, M_PFOSFPPL
);
310 /* Add a fingerprint */
312 pf_osfp_add(struct pf_osfp_ioctl
*fpioc
)
314 struct pf_os_fingerprint
*fp
, fpadd
;
315 struct pf_osfp_entry
*entry
;
317 memset(&fpadd
, 0, sizeof(fpadd
));
318 fpadd
.fp_tcpopts
= fpioc
->fp_tcpopts
;
319 fpadd
.fp_wsize
= fpioc
->fp_wsize
;
320 fpadd
.fp_psize
= fpioc
->fp_psize
;
321 fpadd
.fp_mss
= fpioc
->fp_mss
;
322 fpadd
.fp_flags
= fpioc
->fp_flags
;
323 fpadd
.fp_optcnt
= fpioc
->fp_optcnt
;
324 fpadd
.fp_wscale
= fpioc
->fp_wscale
;
325 fpadd
.fp_ttl
= fpioc
->fp_ttl
;
327 #if 0 /* XXX RYAN wants to fix logging */
328 DPFPRINTF("adding osfp %s %s %s = %s%d:%d:%d:%s%d:0x%llx %d "
329 "(TS=%s,M=%s%d,W=%s%d) %x\n",
330 fpioc
->fp_os
.fp_class_nm
, fpioc
->fp_os
.fp_version_nm
,
331 fpioc
->fp_os
.fp_subtype_nm
,
332 (fpadd
.fp_flags
& PF_OSFP_WSIZE_MOD
) ? "%" :
333 (fpadd
.fp_flags
& PF_OSFP_WSIZE_MSS
) ? "S" :
334 (fpadd
.fp_flags
& PF_OSFP_WSIZE_MTU
) ? "T" :
335 (fpadd
.fp_flags
& PF_OSFP_WSIZE_DC
) ? "*" : "",
338 (fpadd
.fp_flags
& PF_OSFP_DF
) ? 1 : 0,
339 (fpadd
.fp_flags
& PF_OSFP_PSIZE_MOD
) ? "%" :
340 (fpadd
.fp_flags
& PF_OSFP_PSIZE_DC
) ? "*" : "",
342 (long long int)fpadd
.fp_tcpopts
, fpadd
.fp_optcnt
,
343 (fpadd
.fp_flags
& PF_OSFP_TS0
) ? "0" : "",
344 (fpadd
.fp_flags
& PF_OSFP_MSS_MOD
) ? "%" :
345 (fpadd
.fp_flags
& PF_OSFP_MSS_DC
) ? "*" : "",
347 (fpadd
.fp_flags
& PF_OSFP_WSCALE_MOD
) ? "%" :
348 (fpadd
.fp_flags
& PF_OSFP_WSCALE_DC
) ? "*" : "",
353 if ((fp
= pf_osfp_find_exact(&pf_osfp_list
, &fpadd
))) {
354 SLIST_FOREACH(entry
, &fp
->fp_oses
, fp_entry
) {
355 if (PF_OSFP_ENTRY_EQ(entry
, &fpioc
->fp_os
))
358 if ((entry
= kmalloc(sizeof(struct pf_osfp_entry
),
359 M_PFOSFPENTRYPL
, M_WAITOK
|M_NULLOK
)) == NULL
)
362 if ((fp
= kmalloc(sizeof(struct pf_os_fingerprint
),
363 M_PFOSFPPL
, M_WAITOK
|M_NULLOK
)) == NULL
)
365 memset(fp
, 0, sizeof(*fp
));
366 fp
->fp_tcpopts
= fpioc
->fp_tcpopts
;
367 fp
->fp_wsize
= fpioc
->fp_wsize
;
368 fp
->fp_psize
= fpioc
->fp_psize
;
369 fp
->fp_mss
= fpioc
->fp_mss
;
370 fp
->fp_flags
= fpioc
->fp_flags
;
371 fp
->fp_optcnt
= fpioc
->fp_optcnt
;
372 fp
->fp_wscale
= fpioc
->fp_wscale
;
373 fp
->fp_ttl
= fpioc
->fp_ttl
;
374 SLIST_INIT(&fp
->fp_oses
);
375 if ((entry
= kmalloc(sizeof(struct pf_osfp_entry
),
376 M_PFOSFPENTRYPL
, M_WAITOK
|M_NULLOK
)) == NULL
) {
377 kfree(fp
, M_PFOSFPPL
);
380 pf_osfp_insert(&pf_osfp_list
, fp
);
382 memcpy(entry
, &fpioc
->fp_os
, sizeof(*entry
));
384 /* Make sure the strings are NUL terminated */
385 entry
->fp_class_nm
[sizeof(entry
->fp_class_nm
)-1] = '\0';
386 entry
->fp_version_nm
[sizeof(entry
->fp_version_nm
)-1] = '\0';
387 entry
->fp_subtype_nm
[sizeof(entry
->fp_subtype_nm
)-1] = '\0';
389 SLIST_INSERT_HEAD(&fp
->fp_oses
, entry
, fp_entry
);
392 if ((fp
= pf_osfp_validate()))
393 kprintf("Invalid fingerprint list\n");
399 /* Find a fingerprint in the list */
400 struct pf_os_fingerprint
*
401 pf_osfp_find(struct pf_osfp_list
*list
, struct pf_os_fingerprint
*find
,
404 struct pf_os_fingerprint
*f
;
406 #define MATCH_INT(_MOD, _DC, _field) \
407 if ((f->fp_flags & _DC) == 0) { \
408 if ((f->fp_flags & _MOD) == 0) { \
409 if (f->_field != find->_field) \
412 if (f->_field == 0 || find->_field % f->_field) \
417 SLIST_FOREACH(f
, list
, fp_next
) {
418 if (f
->fp_tcpopts
!= find
->fp_tcpopts
||
419 f
->fp_optcnt
!= find
->fp_optcnt
||
420 f
->fp_ttl
< find
->fp_ttl
||
421 f
->fp_ttl
- find
->fp_ttl
> ttldiff
||
422 (f
->fp_flags
& (PF_OSFP_DF
|PF_OSFP_TS0
)) !=
423 (find
->fp_flags
& (PF_OSFP_DF
|PF_OSFP_TS0
)))
426 MATCH_INT(PF_OSFP_PSIZE_MOD
, PF_OSFP_PSIZE_DC
, fp_psize
)
427 MATCH_INT(PF_OSFP_MSS_MOD
, PF_OSFP_MSS_DC
, fp_mss
)
428 MATCH_INT(PF_OSFP_WSCALE_MOD
, PF_OSFP_WSCALE_DC
, fp_wscale
)
429 if ((f
->fp_flags
& PF_OSFP_WSIZE_DC
) == 0) {
430 if (f
->fp_flags
& PF_OSFP_WSIZE_MSS
) {
431 if (find
->fp_mss
== 0)
434 /* Some "smart" NAT devices and DSL routers will tweak the MSS size and
435 * will set it to whatever is suitable for the link type.
437 #define SMART_MSS 1460
438 if ((find
->fp_wsize
% find
->fp_mss
||
439 find
->fp_wsize
/ find
->fp_mss
!=
441 (find
->fp_wsize
% SMART_MSS
||
442 find
->fp_wsize
/ SMART_MSS
!=
445 } else if (f
->fp_flags
& PF_OSFP_WSIZE_MTU
) {
446 if (find
->fp_mss
== 0)
449 #define MTUOFF (sizeof(struct ip) + sizeof(struct tcphdr))
450 #define SMART_MTU (SMART_MSS + MTUOFF)
451 if ((find
->fp_wsize
% (find
->fp_mss
+ MTUOFF
) ||
452 find
->fp_wsize
/ (find
->fp_mss
+ MTUOFF
) !=
454 (find
->fp_wsize
% SMART_MTU
||
455 find
->fp_wsize
/ SMART_MTU
!=
458 } else if (f
->fp_flags
& PF_OSFP_WSIZE_MOD
) {
459 if (f
->fp_wsize
== 0 || find
->fp_wsize
%
463 if (f
->fp_wsize
!= find
->fp_wsize
)
473 /* Find an exact fingerprint in the list */
474 struct pf_os_fingerprint
*
475 pf_osfp_find_exact(struct pf_osfp_list
*list
, struct pf_os_fingerprint
*find
)
477 struct pf_os_fingerprint
*f
;
479 SLIST_FOREACH(f
, list
, fp_next
) {
480 if (f
->fp_tcpopts
== find
->fp_tcpopts
&&
481 f
->fp_wsize
== find
->fp_wsize
&&
482 f
->fp_psize
== find
->fp_psize
&&
483 f
->fp_mss
== find
->fp_mss
&&
484 f
->fp_flags
== find
->fp_flags
&&
485 f
->fp_optcnt
== find
->fp_optcnt
&&
486 f
->fp_wscale
== find
->fp_wscale
&&
487 f
->fp_ttl
== find
->fp_ttl
)
494 /* Insert a fingerprint into the list */
496 pf_osfp_insert(struct pf_osfp_list
*list
, struct pf_os_fingerprint
*ins
)
498 struct pf_os_fingerprint
*f
, *prev
= NULL
;
500 /* XXX need to go semi tree based. can key on tcp options */
502 SLIST_FOREACH(f
, list
, fp_next
)
505 SLIST_INSERT_AFTER(prev
, ins
, fp_next
);
507 SLIST_INSERT_HEAD(list
, ins
, fp_next
);
510 /* Fill a fingerprint by its number (from an ioctl) */
512 pf_osfp_get(struct pf_osfp_ioctl
*fpioc
)
514 struct pf_os_fingerprint
*fp
;
515 struct pf_osfp_entry
*entry
;
516 int num
= fpioc
->fp_getnum
;
520 memset(fpioc
, 0, sizeof(*fpioc
));
521 SLIST_FOREACH(fp
, &pf_osfp_list
, fp_next
) {
522 SLIST_FOREACH(entry
, &fp
->fp_oses
, fp_entry
) {
524 fpioc
->fp_mss
= fp
->fp_mss
;
525 fpioc
->fp_wsize
= fp
->fp_wsize
;
526 fpioc
->fp_flags
= fp
->fp_flags
;
527 fpioc
->fp_psize
= fp
->fp_psize
;
528 fpioc
->fp_ttl
= fp
->fp_ttl
;
529 fpioc
->fp_wscale
= fp
->fp_wscale
;
530 fpioc
->fp_getnum
= num
;
531 memcpy(&fpioc
->fp_os
, entry
,
532 sizeof(fpioc
->fp_os
));
542 /* Validate that each signature is reachable */
543 struct pf_os_fingerprint
*
544 pf_osfp_validate(void)
546 struct pf_os_fingerprint
*f
, *f2
, find
;
548 SLIST_FOREACH(f
, &pf_osfp_list
, fp_next
) {
549 memcpy(&find
, f
, sizeof(find
));
551 /* We do a few MSS/th_win percolations to make things unique */
552 if (find
.fp_mss
== 0)
554 if (f
->fp_flags
& PF_OSFP_WSIZE_MSS
)
555 find
.fp_wsize
*= find
.fp_mss
;
556 else if (f
->fp_flags
& PF_OSFP_WSIZE_MTU
)
557 find
.fp_wsize
*= (find
.fp_mss
+ 40);
558 else if (f
->fp_flags
& PF_OSFP_WSIZE_MOD
)
560 if (f
!= (f2
= pf_osfp_find(&pf_osfp_list
, &find
, 0))) {
562 kprintf("Found \"%s %s %s\" instead of "
564 SLIST_FIRST(&f2
->fp_oses
)->fp_class_nm
,
565 SLIST_FIRST(&f2
->fp_oses
)->fp_version_nm
,
566 SLIST_FIRST(&f2
->fp_oses
)->fp_subtype_nm
,
567 SLIST_FIRST(&f
->fp_oses
)->fp_class_nm
,
568 SLIST_FIRST(&f
->fp_oses
)->fp_version_nm
,
569 SLIST_FIRST(&f
->fp_oses
)->fp_subtype_nm
);
571 kprintf("Couldn't find \"%s %s %s\"\n",
572 SLIST_FIRST(&f
->fp_oses
)->fp_class_nm
,
573 SLIST_FIRST(&f
->fp_oses
)->fp_version_nm
,
574 SLIST_FIRST(&f
->fp_oses
)->fp_subtype_nm
);