1 /* $FreeBSD: src/sys/contrib/pf/net/pf_osfp.c,v 1.4 2004/06/16 23:24:00 mlaier Exp $ */
2 /* $OpenBSD: pf_osfp.c,v 1.9 2004/01/04 20:08:42 pvalchev Exp $ */
3 /* $DragonFly: src/sys/net/pf/pf_osfp.c,v 1.2 2006/12/22 23:44:57 swildner Exp $ */
6 * Copyright (c) 2004 The DragonFly Project. All rights reserved.
8 * Copyright (c) 2003 Mike Frantzen <frantzen@w4g.org>
10 * Permission to use, copy, modify, and distribute this software for any
11 * purpose with or without fee is hereby granted, provided that the above
12 * copyright notice and this permission notice appear in all copies.
14 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
15 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
16 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
17 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
18 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
19 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
20 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
24 #include <sys/param.h>
25 #include <sys/socket.h>
27 # include <sys/systm.h>
28 # include <vm/vm_zone.h>
32 #include <netinet/in.h>
33 #include <netinet/in_systm.h>
34 #include <netinet/ip.h>
35 #include <netinet/tcp.h>
38 #include <net/pf/pfvar.h>
41 #include <netinet/ip6.h>
46 # define DPFPRINTF(format, x...) \
47 if (pf_status.debug >= PF_DEBUG_NOISY) \
49 typedef vm_zone_t pool_t
;
52 /* Userland equivalents so we can lend code to tcpdump et al. */
54 # include <arpa/inet.h>
60 # define pool_get(pool, flags) malloc(*(pool))
61 # define pool_put(pool, item) free(item)
62 # define pool_init(pool, size, a, ao, f, m, p) (*(pool)) = (size)
65 # include <sys/stdarg.h>
66 # define DPFPRINTF(format, x...) fprintf(stderr, format , ##x)
68 # define DPFPRINTF(format, x...) ((void)0)
73 SLIST_HEAD(pf_osfp_list
, pf_os_fingerprint
) pf_osfp_list
;
74 pool_t pf_osfp_entry_pl
;
77 struct pf_os_fingerprint
*pf_osfp_find(struct pf_osfp_list
*,
78 struct pf_os_fingerprint
*, u_int8_t
);
79 struct pf_os_fingerprint
*pf_osfp_find_exact(struct pf_osfp_list
*,
80 struct pf_os_fingerprint
*);
81 void pf_osfp_insert(struct pf_osfp_list
*,
82 struct pf_os_fingerprint
*);
87 * Passively fingerprint the OS of the host (IPv4 TCP SYN packets only)
88 * Returns the list of possible OSes.
90 struct pf_osfp_enlist
*
91 pf_osfp_fingerprint(struct pf_pdesc
*pd
, struct mbuf
*m
, int off
,
92 const struct tcphdr
*tcp
)
97 /* XXX don't have a fingerprint database for IPv6 :-( */
98 if (pd
->af
!= PF_INET
|| pd
->proto
!= IPPROTO_TCP
|| (tcp
->th_off
<< 2)
102 ip
= mtod(m
, struct ip
*);
103 if (!pf_pull_hdr(m
, off
, hdr
, tcp
->th_off
<< 2, NULL
, NULL
, pd
->af
))
106 return (pf_osfp_fingerprint_hdr(ip
, (struct tcphdr
*)hdr
));
110 struct pf_osfp_enlist
*
111 pf_osfp_fingerprint_hdr(const struct ip
*ip
, const struct tcphdr
*tcp
)
113 struct pf_os_fingerprint fp
, *fpresult
;
115 const u_int8_t
*optp
;
117 if ((tcp
->th_flags
& (TH_SYN
|TH_ACK
)) != TH_SYN
|| (ip
->ip_off
&
121 memset(&fp
, 0, sizeof(fp
));
123 fp
.fp_psize
= ip
->ip_len
;
124 fp
.fp_ttl
= ip
->ip_ttl
;
125 if (ip
->ip_off
& IP_DF
)
126 fp
.fp_flags
|= PF_OSFP_DF
;
127 fp
.fp_wsize
= ntohs(tcp
->th_win
);
130 cnt
= (tcp
->th_off
<< 2) - sizeof(*tcp
);
131 optp
= (const u_int8_t
*)((const char *)tcp
+ sizeof(*tcp
));
132 for (; cnt
> 0; cnt
-= optlen
, optp
+= optlen
) {
133 if (*optp
== TCPOPT_EOL
)
137 if (*optp
== TCPOPT_NOP
) {
138 fp
.fp_tcpopts
= (fp
.fp_tcpopts
<< PF_OSFP_TCPOPT_BITS
) |
145 if (optlen
> cnt
|| optlen
< 2)
149 if (optlen
>= TCPOLEN_MAXSEG
)
150 memcpy(&fp
.fp_mss
, &optp
[2],
152 fp
.fp_tcpopts
= (fp
.fp_tcpopts
<<
153 PF_OSFP_TCPOPT_BITS
) | PF_OSFP_TCPOPT_MSS
;
154 fp
.fp_mss
= ntohs(fp
.fp_mss
);
157 if (optlen
>= TCPOLEN_WINDOW
)
158 memcpy(&fp
.fp_wscale
, &optp
[2],
159 sizeof(fp
.fp_wscale
));
160 fp
.fp_wscale
= ntohs(fp
.fp_wscale
);
161 fp
.fp_tcpopts
= (fp
.fp_tcpopts
<<
162 PF_OSFP_TCPOPT_BITS
) |
163 PF_OSFP_TCPOPT_WSCALE
;
165 case TCPOPT_SACK_PERMITTED
:
166 fp
.fp_tcpopts
= (fp
.fp_tcpopts
<<
167 PF_OSFP_TCPOPT_BITS
) | PF_OSFP_TCPOPT_SACK
;
169 case TCPOPT_TIMESTAMP
:
170 if (optlen
>= TCPOLEN_TIMESTAMP
) {
172 memcpy(&ts
, &optp
[2], sizeof(ts
));
174 fp
.fp_flags
|= PF_OSFP_TS0
;
177 fp
.fp_tcpopts
= (fp
.fp_tcpopts
<<
178 PF_OSFP_TCPOPT_BITS
) | PF_OSFP_TCPOPT_TS
;
184 optlen
= MAX(optlen
, 1); /* paranoia */
187 DPFPRINTF("fingerprinted %s:%d %d:%d:%d:%d:%llx (%d) "
188 "(TS=%s,M=%s%d,W=%s%d)\n",
189 inet_ntoa(ip
->ip_src
), ntohs(tcp
->th_sport
),
190 fp
.fp_wsize
, fp
.fp_ttl
, (fp
.fp_flags
& PF_OSFP_DF
) != 0,
191 fp
.fp_psize
, (long long int)fp
.fp_tcpopts
, fp
.fp_optcnt
,
192 (fp
.fp_flags
& PF_OSFP_TS0
) ? "0" : "",
193 (fp
.fp_flags
& PF_OSFP_MSS_MOD
) ? "%" :
194 (fp
.fp_flags
& PF_OSFP_MSS_DC
) ? "*" : "",
196 (fp
.fp_flags
& PF_OSFP_WSCALE_MOD
) ? "%" :
197 (fp
.fp_flags
& PF_OSFP_WSCALE_DC
) ? "*" : "",
200 if ((fpresult
= pf_osfp_find(&pf_osfp_list
, &fp
,
201 PF_OSFP_MAXTTL_OFFSET
)))
202 return (&fpresult
->fp_oses
);
206 /* Match a fingerprint ID against a list of OSes */
208 pf_osfp_match(struct pf_osfp_enlist
*list
, pf_osfp_t os
)
210 struct pf_osfp_entry
*entry
;
211 int os_class
, os_version
, os_subtype
;
212 int en_class
, en_version
, en_subtype
;
214 if (os
== PF_OSFP_ANY
)
217 DPFPRINTF("osfp no match against %x\n", os
);
218 return (os
== PF_OSFP_UNKNOWN
);
220 PF_OSFP_UNPACK(os
, os_class
, os_version
, os_subtype
);
221 SLIST_FOREACH(entry
, list
, fp_entry
) {
222 PF_OSFP_UNPACK(entry
->fp_os
, en_class
, en_version
, en_subtype
);
223 if ((os_class
== PF_OSFP_ANY
|| en_class
== os_class
) &&
224 (os_version
== PF_OSFP_ANY
|| en_version
== os_version
) &&
225 (os_subtype
== PF_OSFP_ANY
|| en_subtype
== os_subtype
)) {
226 DPFPRINTF("osfp matched %s %s %s %x==%x\n",
227 entry
->fp_class_nm
, entry
->fp_version_nm
,
228 entry
->fp_subtype_nm
, os
, entry
->fp_os
);
232 DPFPRINTF("fingerprint 0x%x didn't match\n", os
);
236 /* Initialize the OS fingerprint system */
238 pf_osfp_initialize(void)
245 pf_osfp_entry_pl
= pf_osfp_pl
= NULL
;
246 ZONE_CREATE(pf_osfp_entry_pl
, struct pf_osfp_entry
, "pfospfen");
247 ZONE_CREATE(pf_osfp_pl
, struct pf_os_fingerprint
, "pfosfp");
251 pool_init(&pf_osfp_entry_pl
, sizeof(struct pf_osfp_entry
), 0, 0, 0,
253 pool_init(&pf_osfp_pl
, sizeof(struct pf_os_fingerprint
), 0, 0, 0,
256 SLIST_INIT(&pf_osfp_list
);
263 pf_osfp_cleanup(void)
265 ZONE_DESTROY(pf_osfp_entry_pl
);
266 ZONE_DESTROY(pf_osfp_pl
);
270 /* Flush the fingerprint list */
274 struct pf_os_fingerprint
*fp
;
275 struct pf_osfp_entry
*entry
;
277 while ((fp
= SLIST_FIRST(&pf_osfp_list
))) {
278 SLIST_REMOVE_HEAD(&pf_osfp_list
, fp_next
);
279 while ((entry
= SLIST_FIRST(&fp
->fp_oses
))) {
280 SLIST_REMOVE_HEAD(&fp
->fp_oses
, fp_entry
);
281 pool_put(&pf_osfp_entry_pl
, entry
);
283 pool_put(&pf_osfp_pl
, fp
);
288 /* Add a fingerprint */
290 pf_osfp_add(struct pf_osfp_ioctl
*fpioc
)
292 struct pf_os_fingerprint
*fp
, fpadd
;
293 struct pf_osfp_entry
*entry
;
295 memset(&fpadd
, 0, sizeof(fpadd
));
296 fpadd
.fp_tcpopts
= fpioc
->fp_tcpopts
;
297 fpadd
.fp_wsize
= fpioc
->fp_wsize
;
298 fpadd
.fp_psize
= fpioc
->fp_psize
;
299 fpadd
.fp_mss
= fpioc
->fp_mss
;
300 fpadd
.fp_flags
= fpioc
->fp_flags
;
301 fpadd
.fp_optcnt
= fpioc
->fp_optcnt
;
302 fpadd
.fp_wscale
= fpioc
->fp_wscale
;
303 fpadd
.fp_ttl
= fpioc
->fp_ttl
;
305 DPFPRINTF("adding osfp %s %s %s = %s%d:%d:%d:%s%d:0x%llx %d "
306 "(TS=%s,M=%s%d,W=%s%d) %x\n",
307 fpioc
->fp_os
.fp_class_nm
, fpioc
->fp_os
.fp_version_nm
,
308 fpioc
->fp_os
.fp_subtype_nm
,
309 (fpadd
.fp_flags
& PF_OSFP_WSIZE_MOD
) ? "%" :
310 (fpadd
.fp_flags
& PF_OSFP_WSIZE_MSS
) ? "S" :
311 (fpadd
.fp_flags
& PF_OSFP_WSIZE_MTU
) ? "T" :
312 (fpadd
.fp_flags
& PF_OSFP_WSIZE_DC
) ? "*" : "",
315 (fpadd
.fp_flags
& PF_OSFP_DF
) ? 1 : 0,
316 (fpadd
.fp_flags
& PF_OSFP_PSIZE_MOD
) ? "%" :
317 (fpadd
.fp_flags
& PF_OSFP_PSIZE_DC
) ? "*" : "",
319 (long long int)fpadd
.fp_tcpopts
, fpadd
.fp_optcnt
,
320 (fpadd
.fp_flags
& PF_OSFP_TS0
) ? "0" : "",
321 (fpadd
.fp_flags
& PF_OSFP_MSS_MOD
) ? "%" :
322 (fpadd
.fp_flags
& PF_OSFP_MSS_DC
) ? "*" : "",
324 (fpadd
.fp_flags
& PF_OSFP_WSCALE_MOD
) ? "%" :
325 (fpadd
.fp_flags
& PF_OSFP_WSCALE_DC
) ? "*" : "",
330 if ((fp
= pf_osfp_find_exact(&pf_osfp_list
, &fpadd
))) {
331 SLIST_FOREACH(entry
, &fp
->fp_oses
, fp_entry
) {
332 if (PF_OSFP_ENTRY_EQ(entry
, &fpioc
->fp_os
))
335 if ((entry
= pool_get(&pf_osfp_entry_pl
, PR_NOWAIT
)) == NULL
)
338 if ((fp
= pool_get(&pf_osfp_pl
, PR_NOWAIT
)) == NULL
)
340 memset(fp
, 0, sizeof(*fp
));
341 fp
->fp_tcpopts
= fpioc
->fp_tcpopts
;
342 fp
->fp_wsize
= fpioc
->fp_wsize
;
343 fp
->fp_psize
= fpioc
->fp_psize
;
344 fp
->fp_mss
= fpioc
->fp_mss
;
345 fp
->fp_flags
= fpioc
->fp_flags
;
346 fp
->fp_optcnt
= fpioc
->fp_optcnt
;
347 fp
->fp_wscale
= fpioc
->fp_wscale
;
348 fp
->fp_ttl
= fpioc
->fp_ttl
;
349 SLIST_INIT(&fp
->fp_oses
);
350 if ((entry
= pool_get(&pf_osfp_entry_pl
, PR_NOWAIT
)) == NULL
) {
351 pool_put(&pf_osfp_pl
, fp
);
354 pf_osfp_insert(&pf_osfp_list
, fp
);
356 memcpy(entry
, &fpioc
->fp_os
, sizeof(*entry
));
358 /* Make sure the strings are NUL terminated */
359 entry
->fp_class_nm
[sizeof(entry
->fp_class_nm
)-1] = '\0';
360 entry
->fp_version_nm
[sizeof(entry
->fp_version_nm
)-1] = '\0';
361 entry
->fp_subtype_nm
[sizeof(entry
->fp_subtype_nm
)-1] = '\0';
363 SLIST_INSERT_HEAD(&fp
->fp_oses
, entry
, fp_entry
);
366 if ((fp
= pf_osfp_validate()))
367 kprintf("Invalid fingerprint list\n");
373 /* Find a fingerprint in the list */
374 struct pf_os_fingerprint
*
375 pf_osfp_find(struct pf_osfp_list
*list
, struct pf_os_fingerprint
*find
,
378 struct pf_os_fingerprint
*f
;
380 #define MATCH_INT(_MOD, _DC, _field) \
381 if ((f->fp_flags & _DC) == 0) { \
382 if ((f->fp_flags & _MOD) == 0) { \
383 if (f->_field != find->_field) \
386 if (f->_field == 0 || find->_field % f->_field) \
391 SLIST_FOREACH(f
, list
, fp_next
) {
392 if (f
->fp_tcpopts
!= find
->fp_tcpopts
||
393 f
->fp_optcnt
!= find
->fp_optcnt
||
394 f
->fp_ttl
< find
->fp_ttl
||
395 f
->fp_ttl
- find
->fp_ttl
> ttldiff
||
396 (f
->fp_flags
& (PF_OSFP_DF
|PF_OSFP_TS0
)) !=
397 (find
->fp_flags
& (PF_OSFP_DF
|PF_OSFP_TS0
)))
400 MATCH_INT(PF_OSFP_PSIZE_MOD
, PF_OSFP_PSIZE_DC
, fp_psize
)
401 MATCH_INT(PF_OSFP_MSS_MOD
, PF_OSFP_MSS_DC
, fp_mss
)
402 MATCH_INT(PF_OSFP_WSCALE_MOD
, PF_OSFP_WSCALE_DC
, fp_wscale
)
403 if ((f
->fp_flags
& PF_OSFP_WSIZE_DC
) == 0) {
404 if (f
->fp_flags
& PF_OSFP_WSIZE_MSS
) {
405 if (find
->fp_mss
== 0)
408 /* Some "smart" NAT devices and DSL routers will tweak the MSS size and
409 * will set it to whatever is suitable for the link type.
411 #define SMART_MSS 1460
412 if ((find
->fp_wsize
% find
->fp_mss
||
413 find
->fp_wsize
/ find
->fp_mss
!=
415 (find
->fp_wsize
% SMART_MSS
||
416 find
->fp_wsize
/ SMART_MSS
!=
419 } else if (f
->fp_flags
& PF_OSFP_WSIZE_MTU
) {
420 if (find
->fp_mss
== 0)
423 #define MTUOFF (sizeof(struct ip) + sizeof(struct tcphdr))
424 #define SMART_MTU (SMART_MSS + MTUOFF)
425 if ((find
->fp_wsize
% (find
->fp_mss
+ MTUOFF
) ||
426 find
->fp_wsize
/ (find
->fp_mss
+ MTUOFF
) !=
428 (find
->fp_wsize
% SMART_MTU
||
429 find
->fp_wsize
/ SMART_MTU
!=
432 } else if (f
->fp_flags
& PF_OSFP_WSIZE_MOD
) {
433 if (f
->fp_wsize
== 0 || find
->fp_wsize
%
437 if (f
->fp_wsize
!= find
->fp_wsize
)
447 /* Find an exact fingerprint in the list */
448 struct pf_os_fingerprint
*
449 pf_osfp_find_exact(struct pf_osfp_list
*list
, struct pf_os_fingerprint
*find
)
451 struct pf_os_fingerprint
*f
;
453 SLIST_FOREACH(f
, list
, fp_next
) {
454 if (f
->fp_tcpopts
== find
->fp_tcpopts
&&
455 f
->fp_wsize
== find
->fp_wsize
&&
456 f
->fp_psize
== find
->fp_psize
&&
457 f
->fp_mss
== find
->fp_mss
&&
458 f
->fp_flags
== find
->fp_flags
&&
459 f
->fp_optcnt
== find
->fp_optcnt
&&
460 f
->fp_wscale
== find
->fp_wscale
&&
461 f
->fp_ttl
== find
->fp_ttl
)
468 /* Insert a fingerprint into the list */
470 pf_osfp_insert(struct pf_osfp_list
*list
, struct pf_os_fingerprint
*ins
)
472 struct pf_os_fingerprint
*f
, *prev
= NULL
;
474 /* XXX need to go semi tree based. can key on tcp options */
476 SLIST_FOREACH(f
, list
, fp_next
)
479 SLIST_INSERT_AFTER(prev
, ins
, fp_next
);
481 SLIST_INSERT_HEAD(list
, ins
, fp_next
);
484 /* Fill a fingerprint by its number (from an ioctl) */
486 pf_osfp_get(struct pf_osfp_ioctl
*fpioc
)
488 struct pf_os_fingerprint
*fp
;
489 struct pf_osfp_entry
*entry
;
490 int num
= fpioc
->fp_getnum
;
494 memset(fpioc
, 0, sizeof(*fpioc
));
495 SLIST_FOREACH(fp
, &pf_osfp_list
, fp_next
) {
496 SLIST_FOREACH(entry
, &fp
->fp_oses
, fp_entry
) {
498 fpioc
->fp_mss
= fp
->fp_mss
;
499 fpioc
->fp_wsize
= fp
->fp_wsize
;
500 fpioc
->fp_flags
= fp
->fp_flags
;
501 fpioc
->fp_psize
= fp
->fp_psize
;
502 fpioc
->fp_ttl
= fp
->fp_ttl
;
503 fpioc
->fp_wscale
= fp
->fp_wscale
;
504 fpioc
->fp_getnum
= num
;
505 memcpy(&fpioc
->fp_os
, entry
,
506 sizeof(fpioc
->fp_os
));
516 /* Validate that each signature is reachable */
517 struct pf_os_fingerprint
*
518 pf_osfp_validate(void)
520 struct pf_os_fingerprint
*f
, *f2
, find
;
522 SLIST_FOREACH(f
, &pf_osfp_list
, fp_next
) {
523 memcpy(&find
, f
, sizeof(find
));
525 /* We do a few MSS/th_win percolations to make things unique */
526 if (find
.fp_mss
== 0)
528 if (f
->fp_flags
& PF_OSFP_WSIZE_MSS
)
529 find
.fp_wsize
*= find
.fp_mss
, 1;
530 else if (f
->fp_flags
& PF_OSFP_WSIZE_MTU
)
531 find
.fp_wsize
*= (find
.fp_mss
+ 40);
532 else if (f
->fp_flags
& PF_OSFP_WSIZE_MOD
)
534 if (f
!= (f2
= pf_osfp_find(&pf_osfp_list
, &find
, 0))) {
536 kprintf("Found \"%s %s %s\" instead of "
538 SLIST_FIRST(&f2
->fp_oses
)->fp_class_nm
,
539 SLIST_FIRST(&f2
->fp_oses
)->fp_version_nm
,
540 SLIST_FIRST(&f2
->fp_oses
)->fp_subtype_nm
,
541 SLIST_FIRST(&f
->fp_oses
)->fp_class_nm
,
542 SLIST_FIRST(&f
->fp_oses
)->fp_version_nm
,
543 SLIST_FIRST(&f
->fp_oses
)->fp_subtype_nm
);
545 kprintf("Couldn't find \"%s %s %s\"\n",
546 SLIST_FIRST(&f
->fp_oses
)->fp_class_nm
,
547 SLIST_FIRST(&f
->fp_oses
)->fp_version_nm
,
548 SLIST_FIRST(&f
->fp_oses
)->fp_subtype_nm
);