[apple/xnu.git] / bsd / net / pf_osfp.c

/*
 * Copyright (c) 2007-2011 Apple Inc. All rights reserved.
 *
 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
 *
 * This file contains Original Code and/or Modifications of Original Code
 * as defined in and that are subject to the Apple Public Source License
 * Version 2.0 (the 'License'). You may not use this file except in
 * compliance with the License. The rights granted to you under the License
 * may not be used to create, or enable the creation or redistribution of,
 * unlawful or unlicensed copies of an Apple operating system, or to
 * circumvent, violate, or enable the circumvention or violation of, any
 * terms of an Apple operating system software license agreement.
 *
 * Please obtain a copy of the License at
 * http://www.opensource.apple.com/apsl/ and read it before using this file.
 *
 * The Original Code and all software distributed under the License are
 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
 * Please see the License for the specific language governing rights and
 * limitations under the License.
 *
 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
 */

/*	$apfw: pf_osfp.c,v 1.4 2008/08/27 00:01:32 jhw Exp $ */
/*	$OpenBSD: pf_osfp.c,v 1.12 2006/12/13 18:14:10 itojun Exp $ */

/*
 * Copyright (c) 2003 Mike Frantzen <frantzen@w4g.org>
 *
 * Permission to use, copy, modify, and distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
 * copyright notice and this permission notice appear in all copies.
 *
 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 *
 */

#include <machine/endian.h>
#include <sys/param.h>
#include <sys/socket.h>
#include <sys/systm.h>
#include <sys/mbuf.h>

#include <netinet/in.h>
#include <netinet/in_systm.h>
#include <netinet/ip.h>
#include <netinet/tcp.h>
#include <netinet/tcp_fsm.h>

#include <net/if.h>
#include <net/pfvar.h>

#if INET6
#include <netinet/ip6.h>
#include <netinet6/in6_var.h>
#endif /* INET6 */

#define DPFPRINTF(format, x...)                 \
	if (pf_status.debug >= PF_DEBUG_NOISY)  \
	        printf(format, ##x)

static SLIST_HEAD(pf_osfp_list, pf_os_fingerprint) pf_osfp_list;
static struct pool pf_osfp_entry_pl;
static struct pool pf_osfp_pl;

static struct pf_os_fingerprint *pf_osfp_find(struct pf_osfp_list *,
    struct pf_os_fingerprint *, u_int8_t);
static struct pf_os_fingerprint *pf_osfp_find_exact(struct pf_osfp_list *,
    struct pf_os_fingerprint *);
static void pf_osfp_insert(struct pf_osfp_list *, struct pf_os_fingerprint *);


/*
 * Passively fingerprint the OS of the host (IPv4 TCP SYN packets only)
 * Returns the list of possible OSes.
 */
struct pf_osfp_enlist *
pf_osfp_fingerprint(struct pf_pdesc *pd, pbuf_t *pbuf, int off,
    const struct tcphdr *tcp)
{
	struct ip *ip;
	struct ip6_hdr *ip6;
	char hdr[60];

	if ((pd->af != PF_INET && pd->af != PF_INET6) ||
	    pd->proto != IPPROTO_TCP ||
	    (tcp->th_off << 2) < (int)sizeof(*tcp)) {
		return NULL;
	}

	if (pd->af == PF_INET) {
		ip = pbuf->pb_data;
		ip6 = (struct ip6_hdr *)NULL;
	} else {
		ip = (struct ip *)NULL;
		ip6 = pbuf->pb_data;
	}
	if (!pf_pull_hdr(pbuf, off, hdr, tcp->th_off << 2, NULL, NULL,
	        pd->af)) {
		return NULL;
	}

	return pf_osfp_fingerprint_hdr(ip, ip6, (struct tcphdr *)(void *)hdr);
}

struct pf_osfp_enlist *
pf_osfp_fingerprint_hdr(const struct ip *ip, const struct ip6_hdr *ip6,
    const struct tcphdr *tcp)
{
#if !INET6
#pragma unused(ip6)
#endif /* !INET6 */
	struct pf_os_fingerprint fp, *fpresult;
	int cnt, optlen = 0;
	const u_int8_t *optp;
	char srcname[128];

	if ((tcp->th_flags & (TH_SYN | TH_ACK)) != TH_SYN) {
		return NULL;
	}
	if (ip) {
		if ((ip->ip_off & htons(IP_OFFMASK)) != 0) {
			return NULL;
		}
	}

	memset(&fp, 0, sizeof(fp));

	if (ip) {
		fp.fp_psize = ntohs(ip->ip_len);
		fp.fp_ttl = ip->ip_ttl;
		if (ip->ip_off & htons(IP_DF)) {
			fp.fp_flags |= PF_OSFP_DF;
		}
		(void) inet_ntop(AF_INET, &ip->ip_src, srcname,
		    (socklen_t)sizeof(srcname));
	}
#if INET6
	else if (ip6) {
		/* jumbo payload? */
		fp.fp_psize = sizeof(struct ip6_hdr) + ntohs(ip6->ip6_plen);
		fp.fp_ttl = ip6->ip6_hlim;
		fp.fp_flags |= PF_OSFP_DF;
		fp.fp_flags |= PF_OSFP_INET6;
		(void) inet_ntop(AF_INET6, &ip6->ip6_src, srcname,
		    (socklen_t)sizeof(srcname));
	}
#endif
	else {
		return NULL;
	}
	fp.fp_wsize = ntohs(tcp->th_win);


	cnt = (tcp->th_off << 2) - sizeof(*tcp);
	optp = (const u_int8_t *)((const char *)tcp + sizeof(*tcp));
	for (; cnt > 0; cnt -= optlen, optp += optlen) {
		if (*optp == TCPOPT_EOL) {
			break;
		}

		fp.fp_optcnt++;
		if (*optp == TCPOPT_NOP) {
			fp.fp_tcpopts = (fp.fp_tcpopts << PF_OSFP_TCPOPT_BITS) |
			    PF_OSFP_TCPOPT_NOP;
			optlen = 1;
		} else {
			if (cnt < 2) {
				return NULL;
			}
			optlen = optp[1];
			if (optlen > cnt || optlen < 2) {
				return NULL;
			}
			switch (*optp) {
			case TCPOPT_MAXSEG:
				if (optlen >= TCPOLEN_MAXSEG) {
					memcpy(&fp.fp_mss, &optp[2],
					    sizeof(fp.fp_mss));
				}
				fp.fp_tcpopts = (fp.fp_tcpopts <<
				        PF_OSFP_TCPOPT_BITS) | PF_OSFP_TCPOPT_MSS;
#if BYTE_ORDER != BIG_ENDIAN
				NTOHS(fp.fp_mss);
#endif
				break;
			case TCPOPT_WINDOW:
				if (optlen >= TCPOLEN_WINDOW) {
					memcpy(&fp.fp_wscale, &optp[2],
					    sizeof(fp.fp_wscale));
				}
#if BYTE_ORDER != BIG_ENDIAN
				NTOHS(fp.fp_wscale);
#endif
				fp.fp_tcpopts = (fp.fp_tcpopts <<
				        PF_OSFP_TCPOPT_BITS) |
				    PF_OSFP_TCPOPT_WSCALE;
				break;
			case TCPOPT_SACK_PERMITTED:
				fp.fp_tcpopts = (fp.fp_tcpopts <<
				        PF_OSFP_TCPOPT_BITS) | PF_OSFP_TCPOPT_SACK;
				break;
			case TCPOPT_TIMESTAMP:
				if (optlen >= TCPOLEN_TIMESTAMP) {
					u_int32_t ts;
					memcpy(&ts, &optp[2], sizeof(ts));
					if (ts == 0) {
						fp.fp_flags |= PF_OSFP_TS0;
					}
				}
				fp.fp_tcpopts = (fp.fp_tcpopts <<
				        PF_OSFP_TCPOPT_BITS) | PF_OSFP_TCPOPT_TS;
				break;
			default:
				return NULL;
			}
		}
		optlen = MAX(optlen, 1);        /* paranoia */
	}

	DPFPRINTF("fingerprinted %s:%d  %d:%d:%d:%d:%llx (%d) "
	    "(TS=%s,M=%s%d,W=%s%d)\n",
	    srcname, ntohs(tcp->th_sport),
	    fp.fp_wsize, fp.fp_ttl, (fp.fp_flags & PF_OSFP_DF) != 0,
	    fp.fp_psize, (long long int)fp.fp_tcpopts, fp.fp_optcnt,
	    (fp.fp_flags & PF_OSFP_TS0) ? "0" : "",
	    (fp.fp_flags & PF_OSFP_MSS_MOD) ? "%" :
	    (fp.fp_flags & PF_OSFP_MSS_DC) ? "*" : "",
	    fp.fp_mss,
	    (fp.fp_flags & PF_OSFP_WSCALE_MOD) ? "%" :
	    (fp.fp_flags & PF_OSFP_WSCALE_DC) ? "*" : "",
	    fp.fp_wscale);

	if ((fpresult = pf_osfp_find(&pf_osfp_list, &fp,
	    PF_OSFP_MAXTTL_OFFSET))) {
		return &fpresult->fp_oses;
	}
	return NULL;
}

/* Match a fingerprint ID against a list of OSes */
int
pf_osfp_match(struct pf_osfp_enlist *list, pf_osfp_t os)
{
	struct pf_osfp_entry *entry;
	int os_class, os_version, os_subtype;
	int en_class, en_version, en_subtype;

	if (os == PF_OSFP_ANY) {
		return 1;
	}
	if (list == NULL) {
		DPFPRINTF("osfp no match against %x\n", os);
		return os == PF_OSFP_UNKNOWN;
	}
	PF_OSFP_UNPACK(os, os_class, os_version, os_subtype);
	SLIST_FOREACH(entry, list, fp_entry) {
		PF_OSFP_UNPACK(entry->fp_os, en_class, en_version, en_subtype);
		if ((os_class == PF_OSFP_ANY || en_class == os_class) &&
		    (os_version == PF_OSFP_ANY || en_version == os_version) &&
		    (os_subtype == PF_OSFP_ANY || en_subtype == os_subtype)) {
			DPFPRINTF("osfp matched %s %s %s  %x==%x\n",
			    entry->fp_class_nm, entry->fp_version_nm,
			    entry->fp_subtype_nm, os, entry->fp_os);
			return 1;
		}
	}
	DPFPRINTF("fingerprint 0x%x didn't match\n", os);
	return 0;
}

/* Initialize the OS fingerprint system */
void
pf_osfp_initialize(void)
{
	pool_init(&pf_osfp_entry_pl, sizeof(struct pf_osfp_entry), 0, 0, 0,
	    "pfosfpen", NULL);
	pool_init(&pf_osfp_pl, sizeof(struct pf_os_fingerprint), 0, 0, 0,
	    "pfosfp", NULL);
	SLIST_INIT(&pf_osfp_list);
}

#if 0
void
pf_osfp_destroy(void)
{
	pf_osfp_flush();

	pool_destroy(&pf_osfp_pl);
	pool_destroy(&pf_osfp_entry_pl);
}
#endif

/* Flush the fingerprint list */
void
pf_osfp_flush(void)
{
	struct pf_os_fingerprint *fp;
	struct pf_osfp_entry *entry;

	while ((fp = SLIST_FIRST(&pf_osfp_list))) {
		SLIST_REMOVE_HEAD(&pf_osfp_list, fp_next);
		while ((entry = SLIST_FIRST(&fp->fp_oses))) {
			SLIST_REMOVE_HEAD(&fp->fp_oses, fp_entry);
			pool_put(&pf_osfp_entry_pl, entry);
		}
		pool_put(&pf_osfp_pl, fp);
	}
}


/* Add a fingerprint */
int
pf_osfp_add(struct pf_osfp_ioctl *fpioc)
{
	struct pf_os_fingerprint *fp, fpadd;
	struct pf_osfp_entry *entry, *uentry;

	memset(&fpadd, 0, sizeof(fpadd));
	fpadd.fp_tcpopts = fpioc->fp_tcpopts;
	fpadd.fp_wsize = fpioc->fp_wsize;
	fpadd.fp_psize = fpioc->fp_psize;
	fpadd.fp_mss = fpioc->fp_mss;
	fpadd.fp_flags = fpioc->fp_flags;
	fpadd.fp_optcnt = fpioc->fp_optcnt;
	fpadd.fp_wscale = fpioc->fp_wscale;
	fpadd.fp_ttl = fpioc->fp_ttl;

	uentry = &fpioc->fp_os;
	uentry->fp_entry.sle_next = NULL;
	uentry->fp_class_nm[sizeof(uentry->fp_class_nm) - 1] = '\0';
	uentry->fp_version_nm[sizeof(uentry->fp_version_nm) - 1] = '\0';
	uentry->fp_subtype_nm[sizeof(uentry->fp_subtype_nm) - 1] = '\0';

	DPFPRINTF("adding osfp %s %s %s = %s%d:%d:%d:%s%d:0x%llx %d "
	    "(TS=%s,M=%s%d,W=%s%d) %x\n",
	    fpioc->fp_os.fp_class_nm, fpioc->fp_os.fp_version_nm,
	    fpioc->fp_os.fp_subtype_nm,
	    (fpadd.fp_flags & PF_OSFP_WSIZE_MOD) ? "%" :
	    (fpadd.fp_flags & PF_OSFP_WSIZE_MSS) ? "S" :
	    (fpadd.fp_flags & PF_OSFP_WSIZE_MTU) ? "T" :
	    (fpadd.fp_flags & PF_OSFP_WSIZE_DC) ? "*" : "",
	    fpadd.fp_wsize,
	    fpadd.fp_ttl,
	    (fpadd.fp_flags & PF_OSFP_DF) ? 1 : 0,
	    (fpadd.fp_flags & PF_OSFP_PSIZE_MOD) ? "%" :
	    (fpadd.fp_flags & PF_OSFP_PSIZE_DC) ? "*" : "",
	    fpadd.fp_psize,
	    (long long int)fpadd.fp_tcpopts, fpadd.fp_optcnt,
	    (fpadd.fp_flags & PF_OSFP_TS0) ? "0" : "",
	    (fpadd.fp_flags & PF_OSFP_MSS_MOD) ? "%" :
	    (fpadd.fp_flags & PF_OSFP_MSS_DC) ? "*" : "",
	    fpadd.fp_mss,
	    (fpadd.fp_flags & PF_OSFP_WSCALE_MOD) ? "%" :
	    (fpadd.fp_flags & PF_OSFP_WSCALE_DC) ? "*" : "",
	    fpadd.fp_wscale,
	    fpioc->fp_os.fp_os);


	if ((fp = pf_osfp_find_exact(&pf_osfp_list, &fpadd))) {
		SLIST_FOREACH(entry, &fp->fp_oses, fp_entry) {
			if (PF_OSFP_ENTRY_EQ(entry, &fpioc->fp_os)) {
				return EEXIST;
			}
		}
		if ((entry = pool_get(&pf_osfp_entry_pl, PR_WAITOK)) == NULL) {
			return ENOMEM;
		}
	} else {
		if ((fp = pool_get(&pf_osfp_pl, PR_WAITOK)) == NULL) {
			return ENOMEM;
		}
		memset(fp, 0, sizeof(*fp));
		fp->fp_tcpopts = fpioc->fp_tcpopts;
		fp->fp_wsize = fpioc->fp_wsize;
		fp->fp_psize = fpioc->fp_psize;
		fp->fp_mss = fpioc->fp_mss;
		fp->fp_flags = fpioc->fp_flags;
		fp->fp_optcnt = fpioc->fp_optcnt;
		fp->fp_wscale = fpioc->fp_wscale;
		fp->fp_ttl = fpioc->fp_ttl;
		SLIST_INIT(&fp->fp_oses);
		if ((entry = pool_get(&pf_osfp_entry_pl, PR_WAITOK)) == NULL) {
			pool_put(&pf_osfp_pl, fp);
			return ENOMEM;
		}
		pf_osfp_insert(&pf_osfp_list, fp);
	}
	memcpy(entry, &fpioc->fp_os, sizeof(*entry));

	/* Make sure the strings are NUL terminated */
	entry->fp_class_nm[sizeof(entry->fp_class_nm) - 1] = '\0';
	entry->fp_version_nm[sizeof(entry->fp_version_nm) - 1] = '\0';
	entry->fp_subtype_nm[sizeof(entry->fp_subtype_nm) - 1] = '\0';

	SLIST_INSERT_HEAD(&fp->fp_oses, entry, fp_entry);

#ifdef PFDEBUG
	if ((fp = pf_osfp_validate())) {
		printf("Invalid fingerprint list\n");
	}
#endif /* PFDEBUG */
	return 0;
}


/* Find a fingerprint in the list */
struct pf_os_fingerprint *
pf_osfp_find(struct pf_osfp_list *list, struct pf_os_fingerprint *find,
    u_int8_t ttldiff)
{
	struct pf_os_fingerprint *f;

#define MATCH_INT(_MOD, _DC, _field)                                    \
	if ((f->fp_flags & _DC) == 0) {                                 \
	        if ((f->fp_flags & _MOD) == 0) {                        \
	                if (f->_field != find->_field)                  \
	                        continue;                               \
	        } else {                                                \
	                if (f->_field == 0 || find->_field % f->_field) \
	                        continue;                               \
	        }                                                       \
	}

	SLIST_FOREACH(f, list, fp_next) {
		if (f->fp_tcpopts != find->fp_tcpopts ||
		    f->fp_optcnt != find->fp_optcnt ||
		    f->fp_ttl < find->fp_ttl ||
		    f->fp_ttl - find->fp_ttl > ttldiff ||
		    (f->fp_flags & (PF_OSFP_DF | PF_OSFP_TS0)) !=
		    (find->fp_flags & (PF_OSFP_DF | PF_OSFP_TS0))) {
			continue;
		}

		MATCH_INT(PF_OSFP_PSIZE_MOD, PF_OSFP_PSIZE_DC, fp_psize)
		MATCH_INT(PF_OSFP_MSS_MOD, PF_OSFP_MSS_DC, fp_mss)
		MATCH_INT(PF_OSFP_WSCALE_MOD, PF_OSFP_WSCALE_DC, fp_wscale)
		if ((f->fp_flags & PF_OSFP_WSIZE_DC) == 0) {
			if (f->fp_flags & PF_OSFP_WSIZE_MSS) {
				if (find->fp_mss == 0) {
					continue;
				}

/*
 * Some "smart" NAT devices and DSL routers will tweak the MSS size and
 * will set it to whatever is suitable for the link type.
 */
#define SMART_MSS       1460
				if ((find->fp_wsize % find->fp_mss ||
				    find->fp_wsize / find->fp_mss !=
				    f->fp_wsize) &&
				    (find->fp_wsize % SMART_MSS ||
				    find->fp_wsize / SMART_MSS !=
				    f->fp_wsize)) {
					continue;
				}
			} else if (f->fp_flags & PF_OSFP_WSIZE_MTU) {
				if (find->fp_mss == 0) {
					continue;
				}

#define MTUOFF  (sizeof (struct ip) + sizeof (struct tcphdr))
#define SMART_MTU       (SMART_MSS + MTUOFF)
				if ((find->fp_wsize % (find->fp_mss + MTUOFF) ||
				    find->fp_wsize / (find->fp_mss + MTUOFF) !=
				    f->fp_wsize) &&
				    (find->fp_wsize % SMART_MTU ||
				    find->fp_wsize / SMART_MTU !=
				    f->fp_wsize)) {
					continue;
				}
			} else if (f->fp_flags & PF_OSFP_WSIZE_MOD) {
				if (f->fp_wsize == 0 || find->fp_wsize %
				    f->fp_wsize) {
					continue;
				}
			} else {
				if (f->fp_wsize != find->fp_wsize) {
					continue;
				}
			}
		}
		return f;
	}

	return NULL;
}

/* Find an exact fingerprint in the list */
struct pf_os_fingerprint *
pf_osfp_find_exact(struct pf_osfp_list *list, struct pf_os_fingerprint *find)
{
	struct pf_os_fingerprint *f;

	SLIST_FOREACH(f, list, fp_next) {
		if (f->fp_tcpopts == find->fp_tcpopts &&
		    f->fp_wsize == find->fp_wsize &&
		    f->fp_psize == find->fp_psize &&
		    f->fp_mss == find->fp_mss &&
		    f->fp_flags == find->fp_flags &&
		    f->fp_optcnt == find->fp_optcnt &&
		    f->fp_wscale == find->fp_wscale &&
		    f->fp_ttl == find->fp_ttl) {
			return f;
		}
	}

	return NULL;
}

/* Insert a fingerprint into the list */
void
pf_osfp_insert(struct pf_osfp_list *list, struct pf_os_fingerprint *ins)
{
	struct pf_os_fingerprint *f, *prev = NULL;

	/* XXX need to go semi tree based.  can key on tcp options */

	SLIST_FOREACH(f, list, fp_next)
	prev = f;
	if (prev) {
		SLIST_INSERT_AFTER(prev, ins, fp_next);
	} else {
		SLIST_INSERT_HEAD(list, ins, fp_next);
	}
}

/* Fill a fingerprint by its number (from an ioctl) */
int
pf_osfp_get(struct pf_osfp_ioctl *fpioc)
{
	struct pf_os_fingerprint *fp;
	struct pf_osfp_entry *entry;
	int num = fpioc->fp_getnum;
	int i = 0;


	memset(fpioc, 0, sizeof(*fpioc));
	SLIST_FOREACH(fp, &pf_osfp_list, fp_next) {
		SLIST_FOREACH(entry, &fp->fp_oses, fp_entry) {
			if (i++ == num) {
				fpioc->fp_mss = fp->fp_mss;
				fpioc->fp_wsize = fp->fp_wsize;
				fpioc->fp_flags = fp->fp_flags;
				fpioc->fp_psize = fp->fp_psize;
				fpioc->fp_ttl = fp->fp_ttl;
				fpioc->fp_wscale = fp->fp_wscale;
				fpioc->fp_getnum = num;
				memcpy(&fpioc->fp_os, entry,
				    sizeof(fpioc->fp_os));
				fpioc->fp_os.fp_entry.sle_next = NULL;
				return 0;
			}
		}
	}

	return EBUSY;
}


/* Validate that each signature is reachable */
struct pf_os_fingerprint *
pf_osfp_validate(void)
{
	struct pf_os_fingerprint *f, *f2, find;

	SLIST_FOREACH(f, &pf_osfp_list, fp_next) {
		memcpy(&find, f, sizeof(find));

		/* We do a few MSS/th_win percolations to make things unique */
		if (find.fp_mss == 0) {
			find.fp_mss = 128;
		}
		if (f->fp_flags & PF_OSFP_WSIZE_MSS) {
			find.fp_wsize *= find.fp_mss;
		} else if (f->fp_flags & PF_OSFP_WSIZE_MTU) {
			find.fp_wsize *= (find.fp_mss + 40);
		} else if (f->fp_flags & PF_OSFP_WSIZE_MOD) {
			find.fp_wsize *= 2;
		}
		if (f != (f2 = pf_osfp_find(&pf_osfp_list, &find, 0))) {
			if (f2) {
				printf("Found \"%s %s %s\" instead of "
				    "\"%s %s %s\"\n",
				    SLIST_FIRST(&f2->fp_oses)->fp_class_nm,
				    SLIST_FIRST(&f2->fp_oses)->fp_version_nm,
				    SLIST_FIRST(&f2->fp_oses)->fp_subtype_nm,
				    SLIST_FIRST(&f->fp_oses)->fp_class_nm,
				    SLIST_FIRST(&f->fp_oses)->fp_version_nm,
				    SLIST_FIRST(&f->fp_oses)->fp_subtype_nm);
			} else {
				printf("Couldn't find \"%s %s %s\"\n",
				    SLIST_FIRST(&f->fp_oses)->fp_class_nm,
				    SLIST_FIRST(&f->fp_oses)->fp_version_nm,
				    SLIST_FIRST(&f->fp_oses)->fp_subtype_nm);
			}
			return f;
		}
	}
	return NULL;
}
Commit	Line	Data
b0d623f7	1	/*
316670eb	2	* Copyright (c) 2007-2011 Apple Inc. All rights reserved.
b0d623f7 A	3	*
	4	* @APPLE_OSREFERENCE_LICENSE_HEADER_START@
	5	*
	6	* This file contains Original Code and/or Modifications of Original Code
	7	* as defined in and that are subject to the Apple Public Source License
	8	* Version 2.0 (the 'License'). You may not use this file except in
	9	* compliance with the License. The rights granted to you under the License
	10	* may not be used to create, or enable the creation or redistribution of,
	11	* unlawful or unlicensed copies of an Apple operating system, or to
	12	* circumvent, violate, or enable the circumvention or violation of, any
	13	* terms of an Apple operating system software license agreement.
	14	*
	15	* Please obtain a copy of the License at
	16	* http://www.opensource.apple.com/apsl/ and read it before using this file.
	17	*
	18	* The Original Code and all software distributed under the License are
	19	* distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
	20	* EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
	21	* INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
	22	* FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
	23	* Please see the License for the specific language governing rights and
	24	* limitations under the License.
	25	*
	26	* @APPLE_OSREFERENCE_LICENSE_HEADER_END@
	27	*/
	28
	29	/* $apfw: pf_osfp.c,v 1.4 2008/08/27 00:01:32 jhw Exp $ */
	30	/* $OpenBSD: pf_osfp.c,v 1.12 2006/12/13 18:14:10 itojun Exp $ */
	31
	32	/*
	33	* Copyright (c) 2003 Mike Frantzen <frantzen@w4g.org>
	34	*
	35	* Permission to use, copy, modify, and distribute this software for any
	36	* purpose with or without fee is hereby granted, provided that the above
	37	* copyright notice and this permission notice appear in all copies.
	38	*
	39	* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
	40	* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
	41	* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
	42	* ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
	43	* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
	44	* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
	45	* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
	46	*
	47	*/
	48
	49	#include <machine/endian.h>
	50	#include <sys/param.h>
	51	#include <sys/socket.h>
	52	#include <sys/systm.h>
	53	#include <sys/mbuf.h>
	54
	55	#include <netinet/in.h>
	56	#include <netinet/in_systm.h>
	57	#include <netinet/ip.h>
	58	#include <netinet/tcp.h>
	59	#include <netinet/tcp_fsm.h>
	60
	61	#include <net/if.h>
	62	#include <net/pfvar.h>
	63
	64	#if INET6
	65	#include <netinet/ip6.h>
	66	#include <netinet6/in6_var.h>
67	#endif /* INET6 */
68
0a7de745 A	69	#define DPFPRINTF(format, x...) \
	70	if (pf_status.debug >= PF_DEBUG_NOISY) \
	71	printf(format, ##x)
b0d623f7 A	72
	73	static SLIST_HEAD(pf_osfp_list, pf_os_fingerprint) pf_osfp_list;
	74	static struct pool pf_osfp_entry_pl;
	75	static struct pool pf_osfp_pl;
	76
0a7de745	77	static struct pf_os_fingerprint pf_osfp_find(struct pf_osfp_list ,
b0d623f7	78	struct pf_os_fingerprint *, u_int8_t);
0a7de745	79	static struct pf_os_fingerprint pf_osfp_find_exact(struct pf_osfp_list ,
b0d623f7 A	80	struct pf_os_fingerprint *);
	81	static void pf_osfp_insert(struct pf_osfp_list , struct pf_os_fingerprint );
	82
	83
	84	/*
	85	* Passively fingerprint the OS of the host (IPv4 TCP SYN packets only)
	86	* Returns the list of possible OSes.
	87	*/
	88	struct pf_osfp_enlist *
5ba3f43e	89	pf_osfp_fingerprint(struct pf_pdesc pd, pbuf_t pbuf, int off,
b0d623f7 A	90	const struct tcphdr *tcp)
	91	{
	92	struct ip *ip;
	93	struct ip6_hdr *ip6;
	94	char hdr[60];
	95
	96	if ((pd->af != PF_INET && pd->af != PF_INET6) \|\|
	97	pd->proto != IPPROTO_TCP \|\|
0a7de745 A	98	(tcp->th_off << 2) < (int)sizeof(*tcp)) {
	99	return NULL;
	100	}
b0d623f7 A	101
b0d623f7 A	102	if (pd->af == PF_INET) {
5ba3f43e	103	ip = pbuf->pb_data;
b0d623f7 A	104	ip6 = (struct ip6_hdr *)NULL;
	105	} else {
	106	ip = (struct ip *)NULL;
5ba3f43e	107	ip6 = pbuf->pb_data;
b0d623f7	108	}
5ba3f43e	109	if (!pf_pull_hdr(pbuf, off, hdr, tcp->th_off << 2, NULL, NULL,
0a7de745 A	110	pd->af)) {
	111	return NULL;
	112	}
b0d623f7	113
0a7de745	114	return pf_osfp_fingerprint_hdr(ip, ip6, (struct tcphdr )(void )hdr);
b0d623f7 A	115	}
	116
	117	struct pf_osfp_enlist *
	118	pf_osfp_fingerprint_hdr(const struct ip ip, const struct ip6_hdr ip6,
	119	const struct tcphdr *tcp)
	120	{
	121	#if !INET6
	122	#pragma unused(ip6)
	123	#endif /* !INET6 */
	124	struct pf_os_fingerprint fp, *fpresult;
	125	int cnt, optlen = 0;
	126	const u_int8_t *optp;
	127	char srcname[128];
	128
0a7de745 A	129	if ((tcp->th_flags & (TH_SYN \| TH_ACK)) != TH_SYN) {
	130	return NULL;
	131	}
b0d623f7	132	if (ip) {
0a7de745 A	133	if ((ip->ip_off & htons(IP_OFFMASK)) != 0) {
	134	return NULL;
	135	}
b0d623f7 A	136	}
b0d623f7 A	137
0a7de745	138	memset(&fp, 0, sizeof(fp));
b0d623f7 A	139
	140	if (ip) {
	141	fp.fp_psize = ntohs(ip->ip_len);
	142	fp.fp_ttl = ip->ip_ttl;
0a7de745	143	if (ip->ip_off & htons(IP_DF)) {
b0d623f7	144	fp.fp_flags \|= PF_OSFP_DF;
0a7de745	145	}
b0d623f7	146	(void) inet_ntop(AF_INET, &ip->ip_src, srcname,
0a7de745	147	(socklen_t)sizeof(srcname));
b0d623f7 A	148	}
	149	#if INET6
	150	else if (ip6) {
	151	/* jumbo payload? */
0a7de745	152	fp.fp_psize = sizeof(struct ip6_hdr) + ntohs(ip6->ip6_plen);
b0d623f7 A	153	fp.fp_ttl = ip6->ip6_hlim;
	154	fp.fp_flags \|= PF_OSFP_DF;
	155	fp.fp_flags \|= PF_OSFP_INET6;
	156	(void) inet_ntop(AF_INET6, &ip6->ip6_src, srcname,
0a7de745	157	(socklen_t)sizeof(srcname));
b0d623f7 A	158	}
b0d623f7 A	159	#endif
0a7de745 A	160	else {
	161	return NULL;
	162	}
b0d623f7 A	163	fp.fp_wsize = ntohs(tcp->th_win);
	164
	165
0a7de745 A	166	cnt = (tcp->th_off << 2) - sizeof(*tcp);
0a7de745 A	167	optp = (const u_int8_t )((const char )tcp + sizeof(*tcp));
b0d623f7	168	for (; cnt > 0; cnt -= optlen, optp += optlen) {
0a7de745	169	if (*optp == TCPOPT_EOL) {
b0d623f7	170	break;
0a7de745	171	}
b0d623f7 A	172
	173	fp.fp_optcnt++;
	174	if (*optp == TCPOPT_NOP) {
	175	fp.fp_tcpopts = (fp.fp_tcpopts << PF_OSFP_TCPOPT_BITS) \|
	176	PF_OSFP_TCPOPT_NOP;
	177	optlen = 1;
	178	} else {
0a7de745 A	179	if (cnt < 2) {
	180	return NULL;
	181	}
b0d623f7	182	optlen = optp[1];
0a7de745 A	183	if (optlen > cnt \|\| optlen < 2) {
	184	return NULL;
	185	}
b0d623f7 A	186	switch (*optp) {
b0d623f7 A	187	case TCPOPT_MAXSEG:
0a7de745	188	if (optlen >= TCPOLEN_MAXSEG) {
b0d623f7	189	memcpy(&fp.fp_mss, &optp[2],
0a7de745 A	190	sizeof(fp.fp_mss));
0a7de745 A	191	}
b0d623f7	192	fp.fp_tcpopts = (fp.fp_tcpopts <<
0a7de745	193	PF_OSFP_TCPOPT_BITS) \| PF_OSFP_TCPOPT_MSS;
b0d623f7 A	194	#if BYTE_ORDER != BIG_ENDIAN
	195	NTOHS(fp.fp_mss);
	196	#endif
	197	break;
	198	case TCPOPT_WINDOW:
0a7de745	199	if (optlen >= TCPOLEN_WINDOW) {
b0d623f7	200	memcpy(&fp.fp_wscale, &optp[2],
0a7de745 A	201	sizeof(fp.fp_wscale));
0a7de745 A	202	}
b0d623f7 A	203	#if BYTE_ORDER != BIG_ENDIAN
	204	NTOHS(fp.fp_wscale);
	205	#endif
	206	fp.fp_tcpopts = (fp.fp_tcpopts <<
0a7de745	207	PF_OSFP_TCPOPT_BITS) \|
b0d623f7 A	208	PF_OSFP_TCPOPT_WSCALE;
	209	break;
	210	case TCPOPT_SACK_PERMITTED:
	211	fp.fp_tcpopts = (fp.fp_tcpopts <<
0a7de745	212	PF_OSFP_TCPOPT_BITS) \| PF_OSFP_TCPOPT_SACK;
b0d623f7 A	213	break;
	214	case TCPOPT_TIMESTAMP:
	215	if (optlen >= TCPOLEN_TIMESTAMP) {
	216	u_int32_t ts;
0a7de745 A	217	memcpy(&ts, &optp[2], sizeof(ts));
0a7de745 A	218	if (ts == 0) {
b0d623f7	219	fp.fp_flags \|= PF_OSFP_TS0;
0a7de745	220	}
b0d623f7 A	221	}
b0d623f7 A	222	fp.fp_tcpopts = (fp.fp_tcpopts <<
0a7de745	223	PF_OSFP_TCPOPT_BITS) \| PF_OSFP_TCPOPT_TS;
b0d623f7 A	224	break;
b0d623f7 A	225	default:
0a7de745	226	return NULL;
b0d623f7 A	227	}
b0d623f7 A	228	}
0a7de745	229	optlen = MAX(optlen, 1); /* paranoia */
b0d623f7 A	230	}
	231
	232	DPFPRINTF("fingerprinted %s:%d %d:%d:%d:%d:%llx (%d) "
	233	"(TS=%s,M=%s%d,W=%s%d)\n",
	234	srcname, ntohs(tcp->th_sport),
	235	fp.fp_wsize, fp.fp_ttl, (fp.fp_flags & PF_OSFP_DF) != 0,
	236	fp.fp_psize, (long long int)fp.fp_tcpopts, fp.fp_optcnt,
	237	(fp.fp_flags & PF_OSFP_TS0) ? "0" : "",
	238	(fp.fp_flags & PF_OSFP_MSS_MOD) ? "%" :
	239	(fp.fp_flags & PF_OSFP_MSS_DC) ? "*" : "",
	240	fp.fp_mss,
	241	(fp.fp_flags & PF_OSFP_WSCALE_MOD) ? "%" :
	242	(fp.fp_flags & PF_OSFP_WSCALE_DC) ? "*" : "",
	243	fp.fp_wscale);
	244
	245	if ((fpresult = pf_osfp_find(&pf_osfp_list, &fp,
0a7de745 A	246	PF_OSFP_MAXTTL_OFFSET))) {
	247	return &fpresult->fp_oses;
	248	}
	249	return NULL;
b0d623f7 A	250	}
	251
	252	/* Match a fingerprint ID against a list of OSes */
	253	int
	254	pf_osfp_match(struct pf_osfp_enlist *list, pf_osfp_t os)
	255	{
	256	struct pf_osfp_entry *entry;
	257	int os_class, os_version, os_subtype;
	258	int en_class, en_version, en_subtype;
	259
0a7de745 A	260	if (os == PF_OSFP_ANY) {
	261	return 1;
	262	}
b0d623f7 A	263	if (list == NULL) {
b0d623f7 A	264	DPFPRINTF("osfp no match against %x\n", os);
0a7de745	265	return os == PF_OSFP_UNKNOWN;
b0d623f7 A	266	}
	267	PF_OSFP_UNPACK(os, os_class, os_version, os_subtype);
	268	SLIST_FOREACH(entry, list, fp_entry) {
	269	PF_OSFP_UNPACK(entry->fp_os, en_class, en_version, en_subtype);
	270	if ((os_class == PF_OSFP_ANY \|\| en_class == os_class) &&
	271	(os_version == PF_OSFP_ANY \|\| en_version == os_version) &&
	272	(os_subtype == PF_OSFP_ANY \|\| en_subtype == os_subtype)) {
	273	DPFPRINTF("osfp matched %s %s %s %x==%x\n",
	274	entry->fp_class_nm, entry->fp_version_nm,
	275	entry->fp_subtype_nm, os, entry->fp_os);
0a7de745	276	return 1;
b0d623f7 A	277	}
	278	}
	279	DPFPRINTF("fingerprint 0x%x didn't match\n", os);
0a7de745	280	return 0;
b0d623f7 A	281	}
	282
	283	/* Initialize the OS fingerprint system */
	284	void
	285	pf_osfp_initialize(void)
	286	{
0a7de745	287	pool_init(&pf_osfp_entry_pl, sizeof(struct pf_osfp_entry), 0, 0, 0,
b0d623f7	288	"pfosfpen", NULL);
0a7de745	289	pool_init(&pf_osfp_pl, sizeof(struct pf_os_fingerprint), 0, 0, 0,
b0d623f7 A	290	"pfosfp", NULL);
	291	SLIST_INIT(&pf_osfp_list);
	292	}
	293
	294	#if 0
	295	void
	296	pf_osfp_destroy(void)
	297	{
	298	pf_osfp_flush();
	299
	300	pool_destroy(&pf_osfp_pl);
	301	pool_destroy(&pf_osfp_entry_pl);
	302	}
	303	#endif
	304
	305	/* Flush the fingerprint list */
	306	void
	307	pf_osfp_flush(void)
	308	{
	309	struct pf_os_fingerprint *fp;
	310	struct pf_osfp_entry *entry;
	311
	312	while ((fp = SLIST_FIRST(&pf_osfp_list))) {
	313	SLIST_REMOVE_HEAD(&pf_osfp_list, fp_next);
	314	while ((entry = SLIST_FIRST(&fp->fp_oses))) {
	315	SLIST_REMOVE_HEAD(&fp->fp_oses, fp_entry);
	316	pool_put(&pf_osfp_entry_pl, entry);
	317	}
	318	pool_put(&pf_osfp_pl, fp);
	319	}
	320	}
	321
	322
	323	/* Add a fingerprint */
	324	int
	325	pf_osfp_add(struct pf_osfp_ioctl *fpioc)
	326	{
	327	struct pf_os_fingerprint *fp, fpadd;
6d2010ae	328	struct pf_osfp_entry entry, uentry;
b0d623f7	329
0a7de745	330	memset(&fpadd, 0, sizeof(fpadd));
b0d623f7 A	331	fpadd.fp_tcpopts = fpioc->fp_tcpopts;
	332	fpadd.fp_wsize = fpioc->fp_wsize;
	333	fpadd.fp_psize = fpioc->fp_psize;
	334	fpadd.fp_mss = fpioc->fp_mss;
	335	fpadd.fp_flags = fpioc->fp_flags;
	336	fpadd.fp_optcnt = fpioc->fp_optcnt;
	337	fpadd.fp_wscale = fpioc->fp_wscale;
	338	fpadd.fp_ttl = fpioc->fp_ttl;
	339
6d2010ae A	340	uentry = &fpioc->fp_os;
6d2010ae A	341	uentry->fp_entry.sle_next = NULL;
0a7de745 A	342	uentry->fp_class_nm[sizeof(uentry->fp_class_nm) - 1] = '\0';
	343	uentry->fp_version_nm[sizeof(uentry->fp_version_nm) - 1] = '\0';
	344	uentry->fp_subtype_nm[sizeof(uentry->fp_subtype_nm) - 1] = '\0';
6d2010ae	345
b0d623f7 A	346	DPFPRINTF("adding osfp %s %s %s = %s%d:%d:%d:%s%d:0x%llx %d "
	347	"(TS=%s,M=%s%d,W=%s%d) %x\n",
	348	fpioc->fp_os.fp_class_nm, fpioc->fp_os.fp_version_nm,
	349	fpioc->fp_os.fp_subtype_nm,
	350	(fpadd.fp_flags & PF_OSFP_WSIZE_MOD) ? "%" :
	351	(fpadd.fp_flags & PF_OSFP_WSIZE_MSS) ? "S" :
	352	(fpadd.fp_flags & PF_OSFP_WSIZE_MTU) ? "T" :
	353	(fpadd.fp_flags & PF_OSFP_WSIZE_DC) ? "*" : "",
	354	fpadd.fp_wsize,
	355	fpadd.fp_ttl,
	356	(fpadd.fp_flags & PF_OSFP_DF) ? 1 : 0,
	357	(fpadd.fp_flags & PF_OSFP_PSIZE_MOD) ? "%" :
	358	(fpadd.fp_flags & PF_OSFP_PSIZE_DC) ? "*" : "",
	359	fpadd.fp_psize,
	360	(long long int)fpadd.fp_tcpopts, fpadd.fp_optcnt,
	361	(fpadd.fp_flags & PF_OSFP_TS0) ? "0" : "",
	362	(fpadd.fp_flags & PF_OSFP_MSS_MOD) ? "%" :
	363	(fpadd.fp_flags & PF_OSFP_MSS_DC) ? "*" : "",
	364	fpadd.fp_mss,
	365	(fpadd.fp_flags & PF_OSFP_WSCALE_MOD) ? "%" :
	366	(fpadd.fp_flags & PF_OSFP_WSCALE_DC) ? "*" : "",
	367	fpadd.fp_wscale,
	368	fpioc->fp_os.fp_os);
	369
	370
	371	if ((fp = pf_osfp_find_exact(&pf_osfp_list, &fpadd))) {
	372	SLIST_FOREACH(entry, &fp->fp_oses, fp_entry) {
0a7de745 A	373	if (PF_OSFP_ENTRY_EQ(entry, &fpioc->fp_os)) {
	374	return EEXIST;
	375	}
	376	}
	377	if ((entry = pool_get(&pf_osfp_entry_pl, PR_WAITOK)) == NULL) {
	378	return ENOMEM;
b0d623f7	379	}
b0d623f7	380	} else {
0a7de745 A	381	if ((fp = pool_get(&pf_osfp_pl, PR_WAITOK)) == NULL) {
	382	return ENOMEM;
	383	}
	384	memset(fp, 0, sizeof(*fp));
b0d623f7 A	385	fp->fp_tcpopts = fpioc->fp_tcpopts;
	386	fp->fp_wsize = fpioc->fp_wsize;
	387	fp->fp_psize = fpioc->fp_psize;
	388	fp->fp_mss = fpioc->fp_mss;
	389	fp->fp_flags = fpioc->fp_flags;
	390	fp->fp_optcnt = fpioc->fp_optcnt;
	391	fp->fp_wscale = fpioc->fp_wscale;
	392	fp->fp_ttl = fpioc->fp_ttl;
	393	SLIST_INIT(&fp->fp_oses);
	394	if ((entry = pool_get(&pf_osfp_entry_pl, PR_WAITOK)) == NULL) {
	395	pool_put(&pf_osfp_pl, fp);
0a7de745	396	return ENOMEM;
b0d623f7 A	397	}
	398	pf_osfp_insert(&pf_osfp_list, fp);
	399	}
0a7de745	400	memcpy(entry, &fpioc->fp_os, sizeof(*entry));
b0d623f7 A	401
b0d623f7 A	402	/* Make sure the strings are NUL terminated */
0a7de745 A	403	entry->fp_class_nm[sizeof(entry->fp_class_nm) - 1] = '\0';
	404	entry->fp_version_nm[sizeof(entry->fp_version_nm) - 1] = '\0';
	405	entry->fp_subtype_nm[sizeof(entry->fp_subtype_nm) - 1] = '\0';
b0d623f7 A	406
	407	SLIST_INSERT_HEAD(&fp->fp_oses, entry, fp_entry);
	408
	409	#ifdef PFDEBUG
0a7de745	410	if ((fp = pf_osfp_validate())) {
b0d623f7	411	printf("Invalid fingerprint list\n");
0a7de745	412	}
b0d623f7	413	#endif /* PFDEBUG */
0a7de745	414	return 0;
b0d623f7 A	415	}
	416
	417
	418	/* Find a fingerprint in the list */
	419	struct pf_os_fingerprint *
	420	pf_osfp_find(struct pf_osfp_list list, struct pf_os_fingerprint find,
	421	u_int8_t ttldiff)
	422	{
	423	struct pf_os_fingerprint *f;
	424
0a7de745 A	425	#define MATCH_INT(_MOD, _DC, _field) \
	426	if ((f->fp_flags & _DC) == 0) { \
	427	if ((f->fp_flags & _MOD) == 0) { \
	428	if (f->_field != find->_field) \
	429	continue; \
	430	} else { \
	431	if (f->_field == 0 \|\| find->_field % f->_field) \
	432	continue; \
	433	} \
b0d623f7 A	434	}
	435
	436	SLIST_FOREACH(f, list, fp_next) {
	437	if (f->fp_tcpopts != find->fp_tcpopts \|\|
	438	f->fp_optcnt != find->fp_optcnt \|\|
	439	f->fp_ttl < find->fp_ttl \|\|
	440	f->fp_ttl - find->fp_ttl > ttldiff \|\|
0a7de745 A	441	(f->fp_flags & (PF_OSFP_DF \| PF_OSFP_TS0)) !=
0a7de745 A	442	(find->fp_flags & (PF_OSFP_DF \| PF_OSFP_TS0))) {
b0d623f7	443	continue;
0a7de745	444	}
b0d623f7 A	445
	446	MATCH_INT(PF_OSFP_PSIZE_MOD, PF_OSFP_PSIZE_DC, fp_psize)
	447	MATCH_INT(PF_OSFP_MSS_MOD, PF_OSFP_MSS_DC, fp_mss)
	448	MATCH_INT(PF_OSFP_WSCALE_MOD, PF_OSFP_WSCALE_DC, fp_wscale)
	449	if ((f->fp_flags & PF_OSFP_WSIZE_DC) == 0) {
	450	if (f->fp_flags & PF_OSFP_WSIZE_MSS) {
0a7de745	451	if (find->fp_mss == 0) {
b0d623f7	452	continue;
0a7de745	453	}
b0d623f7 A	454
	455	/*
	456	* Some "smart" NAT devices and DSL routers will tweak the MSS size and
	457	* will set it to whatever is suitable for the link type.
	458	*/
0a7de745	459	#define SMART_MSS 1460
b0d623f7 A	460	if ((find->fp_wsize % find->fp_mss \|\|
	461	find->fp_wsize / find->fp_mss !=
	462	f->fp_wsize) &&
	463	(find->fp_wsize % SMART_MSS \|\|
	464	find->fp_wsize / SMART_MSS !=
0a7de745	465	f->fp_wsize)) {
b0d623f7	466	continue;
0a7de745	467	}
b0d623f7	468	} else if (f->fp_flags & PF_OSFP_WSIZE_MTU) {
0a7de745	469	if (find->fp_mss == 0) {
b0d623f7	470	continue;
0a7de745	471	}
b0d623f7	472
0a7de745 A	473	#define MTUOFF (sizeof (struct ip) + sizeof (struct tcphdr))
0a7de745 A	474	#define SMART_MTU (SMART_MSS + MTUOFF)
b0d623f7 A	475	if ((find->fp_wsize % (find->fp_mss + MTUOFF) \|\|
	476	find->fp_wsize / (find->fp_mss + MTUOFF) !=
	477	f->fp_wsize) &&
	478	(find->fp_wsize % SMART_MTU \|\|
	479	find->fp_wsize / SMART_MTU !=
0a7de745	480	f->fp_wsize)) {
b0d623f7	481	continue;
0a7de745	482	}
b0d623f7 A	483	} else if (f->fp_flags & PF_OSFP_WSIZE_MOD) {
b0d623f7 A	484	if (f->fp_wsize == 0 \|\| find->fp_wsize %
0a7de745	485	f->fp_wsize) {
b0d623f7	486	continue;
0a7de745	487	}
b0d623f7	488	} else {
0a7de745	489	if (f->fp_wsize != find->fp_wsize) {
b0d623f7	490	continue;
0a7de745	491	}
b0d623f7 A	492	}
b0d623f7 A	493	}
0a7de745	494	return f;
b0d623f7 A	495	}
b0d623f7 A	496
0a7de745	497	return NULL;
b0d623f7 A	498	}
	499
	500	/* Find an exact fingerprint in the list */
	501	struct pf_os_fingerprint *
	502	pf_osfp_find_exact(struct pf_osfp_list list, struct pf_os_fingerprint find)
	503	{
	504	struct pf_os_fingerprint *f;
	505
	506	SLIST_FOREACH(f, list, fp_next) {
	507	if (f->fp_tcpopts == find->fp_tcpopts &&
	508	f->fp_wsize == find->fp_wsize &&
	509	f->fp_psize == find->fp_psize &&
	510	f->fp_mss == find->fp_mss &&
	511	f->fp_flags == find->fp_flags &&
	512	f->fp_optcnt == find->fp_optcnt &&
	513	f->fp_wscale == find->fp_wscale &&
0a7de745 A	514	f->fp_ttl == find->fp_ttl) {
	515	return f;
	516	}
b0d623f7 A	517	}
b0d623f7 A	518
0a7de745	519	return NULL;
b0d623f7 A	520	}
	521
	522	/* Insert a fingerprint into the list */
	523	void
	524	pf_osfp_insert(struct pf_osfp_list list, struct pf_os_fingerprint ins)
	525	{
	526	struct pf_os_fingerprint f, prev = NULL;
	527
	528	/* XXX need to go semi tree based. can key on tcp options */
	529
	530	SLIST_FOREACH(f, list, fp_next)
0a7de745 A	531	prev = f;
0a7de745 A	532	if (prev) {
b0d623f7	533	SLIST_INSERT_AFTER(prev, ins, fp_next);
0a7de745	534	} else {
b0d623f7	535	SLIST_INSERT_HEAD(list, ins, fp_next);
0a7de745	536	}
b0d623f7 A	537	}
	538
	539	/* Fill a fingerprint by its number (from an ioctl) */
	540	int
	541	pf_osfp_get(struct pf_osfp_ioctl *fpioc)
	542	{
	543	struct pf_os_fingerprint *fp;
	544	struct pf_osfp_entry *entry;
	545	int num = fpioc->fp_getnum;
	546	int i = 0;
	547
	548
0a7de745	549	memset(fpioc, 0, sizeof(*fpioc));
b0d623f7 A	550	SLIST_FOREACH(fp, &pf_osfp_list, fp_next) {
	551	SLIST_FOREACH(entry, &fp->fp_oses, fp_entry) {
	552	if (i++ == num) {
	553	fpioc->fp_mss = fp->fp_mss;
	554	fpioc->fp_wsize = fp->fp_wsize;
	555	fpioc->fp_flags = fp->fp_flags;
	556	fpioc->fp_psize = fp->fp_psize;
	557	fpioc->fp_ttl = fp->fp_ttl;
	558	fpioc->fp_wscale = fp->fp_wscale;
	559	fpioc->fp_getnum = num;
	560	memcpy(&fpioc->fp_os, entry,
0a7de745	561	sizeof(fpioc->fp_os));
6d2010ae	562	fpioc->fp_os.fp_entry.sle_next = NULL;
0a7de745	563	return 0;
b0d623f7 A	564	}
	565	}
	566	}
	567
0a7de745	568	return EBUSY;
b0d623f7 A	569	}
	570
	571
	572	/* Validate that each signature is reachable */
	573	struct pf_os_fingerprint *
	574	pf_osfp_validate(void)
	575	{
	576	struct pf_os_fingerprint f, f2, find;
	577
	578	SLIST_FOREACH(f, &pf_osfp_list, fp_next) {
0a7de745	579	memcpy(&find, f, sizeof(find));
b0d623f7 A	580
b0d623f7 A	581	/* We do a few MSS/th_win percolations to make things unique */
0a7de745	582	if (find.fp_mss == 0) {
b0d623f7	583	find.fp_mss = 128;
0a7de745 A	584	}
0a7de745 A	585	if (f->fp_flags & PF_OSFP_WSIZE_MSS) {
d1ecb069	586	find.fp_wsize *= find.fp_mss;
0a7de745	587	} else if (f->fp_flags & PF_OSFP_WSIZE_MTU) {
b0d623f7	588	find.fp_wsize *= (find.fp_mss + 40);
0a7de745	589	} else if (f->fp_flags & PF_OSFP_WSIZE_MOD) {
b0d623f7	590	find.fp_wsize *= 2;
0a7de745	591	}
b0d623f7	592	if (f != (f2 = pf_osfp_find(&pf_osfp_list, &find, 0))) {
0a7de745	593	if (f2) {
b0d623f7 A	594	printf("Found \"%s %s %s\" instead of "
	595	"\"%s %s %s\"\n",
	596	SLIST_FIRST(&f2->fp_oses)->fp_class_nm,
	597	SLIST_FIRST(&f2->fp_oses)->fp_version_nm,
	598	SLIST_FIRST(&f2->fp_oses)->fp_subtype_nm,
	599	SLIST_FIRST(&f->fp_oses)->fp_class_nm,
	600	SLIST_FIRST(&f->fp_oses)->fp_version_nm,
	601	SLIST_FIRST(&f->fp_oses)->fp_subtype_nm);
0a7de745	602	} else {
b0d623f7 A	603	printf("Couldn't find \"%s %s %s\"\n",
	604	SLIST_FIRST(&f->fp_oses)->fp_class_nm,
	605	SLIST_FIRST(&f->fp_oses)->fp_version_nm,
	606	SLIST_FIRST(&f->fp_oses)->fp_subtype_nm);
0a7de745 A	607	}
0a7de745 A	608	return f;
b0d623f7 A	609	}
b0d623f7 A	610	}
0a7de745	611	return NULL;
b0d623f7	612	}