[apple/xnu.git] / bsd / net / pf_osfp.c

/*
 * Copyright (c) 2007-2020 Apple Inc. All rights reserved.
 *
 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
 *
 * This file contains Original Code and/or Modifications of Original Code
 * as defined in and that are subject to the Apple Public Source License
 * Version 2.0 (the 'License'). You may not use this file except in
 * compliance with the License. The rights granted to you under the License
 * may not be used to create, or enable the creation or redistribution of,
 * unlawful or unlicensed copies of an Apple operating system, or to
 * circumvent, violate, or enable the circumvention or violation of, any
 * terms of an Apple operating system software license agreement.
 *
 * Please obtain a copy of the License at
 * http://www.opensource.apple.com/apsl/ and read it before using this file.
 *
 * The Original Code and all software distributed under the License are
 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
 * Please see the License for the specific language governing rights and
 * limitations under the License.
 *
 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
 */

/*	$apfw: pf_osfp.c,v 1.4 2008/08/27 00:01:32 jhw Exp $ */
/*	$OpenBSD: pf_osfp.c,v 1.12 2006/12/13 18:14:10 itojun Exp $ */

/*
 * Copyright (c) 2003 Mike Frantzen <frantzen@w4g.org>
 *
 * Permission to use, copy, modify, and distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
 * copyright notice and this permission notice appear in all copies.
 *
 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 *
 */

#include <machine/endian.h>
#include <sys/param.h>
#include <sys/socket.h>
#include <sys/systm.h>
#include <sys/mbuf.h>

#include <netinet/in.h>
#include <netinet/in_systm.h>
#include <netinet/ip.h>
#include <netinet/tcp.h>
#include <netinet/tcp_fsm.h>

#include <net/if.h>
#include <net/pfvar.h>

#include <netinet/ip6.h>
#include <netinet6/in6_var.h>

#define DPFPRINTF(format, x...)                 \
	if (pf_status.debug >= PF_DEBUG_NOISY)  \
	        printf(format, ##x)

static SLIST_HEAD(pf_osfp_list, pf_os_fingerprint) pf_osfp_list;
static struct pool pf_osfp_entry_pl;
static struct pool pf_osfp_pl;

static struct pf_os_fingerprint *pf_osfp_find(struct pf_osfp_list *,
    struct pf_os_fingerprint *, u_int8_t);
static struct pf_os_fingerprint *pf_osfp_find_exact(struct pf_osfp_list *,
    struct pf_os_fingerprint *);
static void pf_osfp_insert(struct pf_osfp_list *, struct pf_os_fingerprint *);


/*
 * Passively fingerprint the OS of the host (IPv4 TCP SYN packets only)
 * Returns the list of possible OSes.
 */
struct pf_osfp_enlist *
pf_osfp_fingerprint(struct pf_pdesc *pd, pbuf_t *pbuf, int off,
    const struct tcphdr *tcp)
{
	struct ip *ip;
	struct ip6_hdr *ip6;
	char hdr[60];

	if ((pd->af != PF_INET && pd->af != PF_INET6) ||
	    pd->proto != IPPROTO_TCP ||
	    (tcp->th_off << 2) < (int)sizeof(*tcp)) {
		return NULL;
	}

	if (pd->af == PF_INET) {
		ip = pbuf->pb_data;
		ip6 = (struct ip6_hdr *)NULL;
	} else {
		ip = (struct ip *)NULL;
		ip6 = pbuf->pb_data;
	}
	if (!pf_pull_hdr(pbuf, off, hdr, tcp->th_off << 2, NULL, NULL,
	        pd->af)) {
		return NULL;
	}

	return pf_osfp_fingerprint_hdr(ip, ip6, (struct tcphdr *)(void *)hdr);
}

struct pf_osfp_enlist *
pf_osfp_fingerprint_hdr(const struct ip *ip, const struct ip6_hdr *ip6,
    const struct tcphdr *tcp)
{
	struct pf_os_fingerprint fp, *fpresult;
	int cnt, optlen = 0;
	const u_int8_t *optp;
	char srcname[128];

	if ((tcp->th_flags & (TH_SYN | TH_ACK)) != TH_SYN) {
		return NULL;
	}
	if (ip) {
		if ((ip->ip_off & htons(IP_OFFMASK)) != 0) {
			return NULL;
		}
	}

	memset(&fp, 0, sizeof(fp));

	if (ip) {
		fp.fp_psize = ntohs(ip->ip_len);
		fp.fp_ttl = ip->ip_ttl;
		if (ip->ip_off & htons(IP_DF)) {
			fp.fp_flags |= PF_OSFP_DF;
		}
		(void) inet_ntop(AF_INET, &ip->ip_src, srcname,
		    (socklen_t)sizeof(srcname));
	} else if (ip6) {
		/* jumbo payload? */
		fp.fp_psize = sizeof(struct ip6_hdr) + ntohs(ip6->ip6_plen);
		fp.fp_ttl = ip6->ip6_hlim;
		fp.fp_flags |= PF_OSFP_DF;
		fp.fp_flags |= PF_OSFP_INET6;
		(void) inet_ntop(AF_INET6, &ip6->ip6_src, srcname,
		    (socklen_t)sizeof(srcname));
	} else {
		return NULL;
	}
	fp.fp_wsize = ntohs(tcp->th_win);


	cnt = (tcp->th_off << 2) - sizeof(*tcp);
	optp = (const u_int8_t *)((const char *)tcp + sizeof(*tcp));
	for (; cnt > 0; cnt -= optlen, optp += optlen) {
		if (*optp == TCPOPT_EOL) {
			break;
		}

		fp.fp_optcnt++;
		if (*optp == TCPOPT_NOP) {
			fp.fp_tcpopts = (fp.fp_tcpopts << PF_OSFP_TCPOPT_BITS) |
			    PF_OSFP_TCPOPT_NOP;
			optlen = 1;
		} else {
			if (cnt < 2) {
				return NULL;
			}
			optlen = optp[1];
			if (optlen > cnt || optlen < 2) {
				return NULL;
			}
			switch (*optp) {
			case TCPOPT_MAXSEG:
				if (optlen >= TCPOLEN_MAXSEG) {
					memcpy(&fp.fp_mss, &optp[2],
					    sizeof(fp.fp_mss));
				}
				fp.fp_tcpopts = (fp.fp_tcpopts <<
				        PF_OSFP_TCPOPT_BITS) | PF_OSFP_TCPOPT_MSS;
#if BYTE_ORDER != BIG_ENDIAN
				NTOHS(fp.fp_mss);
#endif
				break;
			case TCPOPT_WINDOW:
				if (optlen >= TCPOLEN_WINDOW) {
					memcpy(&fp.fp_wscale, &optp[2],
					    sizeof(fp.fp_wscale));
				}
				fp.fp_tcpopts = (fp.fp_tcpopts <<
				        PF_OSFP_TCPOPT_BITS) |
				    PF_OSFP_TCPOPT_WSCALE;
				break;
			case TCPOPT_SACK_PERMITTED:
				fp.fp_tcpopts = (fp.fp_tcpopts <<
				        PF_OSFP_TCPOPT_BITS) | PF_OSFP_TCPOPT_SACK;
				break;
			case TCPOPT_TIMESTAMP:
				if (optlen >= TCPOLEN_TIMESTAMP) {
					u_int32_t ts;
					memcpy(&ts, &optp[2], sizeof(ts));
					if (ts == 0) {
						fp.fp_flags |= PF_OSFP_TS0;
					}
				}
				fp.fp_tcpopts = (fp.fp_tcpopts <<
				        PF_OSFP_TCPOPT_BITS) | PF_OSFP_TCPOPT_TS;
				break;
			default:
				return NULL;
			}
		}
		optlen = MAX(optlen, 1);        /* paranoia */
	}

	DPFPRINTF("fingerprinted %s:%d  %d:%d:%d:%d:%llx (%d) "
	    "(TS=%s,M=%s%d,W=%s%d)\n",
	    srcname, ntohs(tcp->th_sport),
	    fp.fp_wsize, fp.fp_ttl, (fp.fp_flags & PF_OSFP_DF) != 0,
	    fp.fp_psize, (long long int)fp.fp_tcpopts, fp.fp_optcnt,
	    (fp.fp_flags & PF_OSFP_TS0) ? "0" : "",
	    (fp.fp_flags & PF_OSFP_MSS_MOD) ? "%" :
	    (fp.fp_flags & PF_OSFP_MSS_DC) ? "*" : "",
	    fp.fp_mss,
	    (fp.fp_flags & PF_OSFP_WSCALE_MOD) ? "%" :
	    (fp.fp_flags & PF_OSFP_WSCALE_DC) ? "*" : "",
	    fp.fp_wscale);

	if ((fpresult = pf_osfp_find(&pf_osfp_list, &fp,
	    PF_OSFP_MAXTTL_OFFSET))) {
		return &fpresult->fp_oses;
	}
	return NULL;
}

/* Match a fingerprint ID against a list of OSes */
int
pf_osfp_match(struct pf_osfp_enlist *list, pf_osfp_t os)
{
	struct pf_osfp_entry *entry;
	int os_class, os_version, os_subtype;
	int en_class, en_version, en_subtype;

	if (os == PF_OSFP_ANY) {
		return 1;
	}
	if (list == NULL) {
		DPFPRINTF("osfp no match against %x\n", os);
		return os == PF_OSFP_UNKNOWN;
	}
	PF_OSFP_UNPACK(os, os_class, os_version, os_subtype);
	SLIST_FOREACH(entry, list, fp_entry) {
		PF_OSFP_UNPACK(entry->fp_os, en_class, en_version, en_subtype);
		if ((os_class == PF_OSFP_ANY || en_class == os_class) &&
		    (os_version == PF_OSFP_ANY || en_version == os_version) &&
		    (os_subtype == PF_OSFP_ANY || en_subtype == os_subtype)) {
			DPFPRINTF("osfp matched %s %s %s  %x==%x\n",
			    entry->fp_class_nm, entry->fp_version_nm,
			    entry->fp_subtype_nm, os, entry->fp_os);
			return 1;
		}
	}
	DPFPRINTF("fingerprint 0x%x didn't match\n", os);
	return 0;
}

/* Initialize the OS fingerprint system */
void
pf_osfp_initialize(void)
{
	pool_init(&pf_osfp_entry_pl, sizeof(struct pf_osfp_entry), 0, 0, 0,
	    "pfosfpen", NULL);
	pool_init(&pf_osfp_pl, sizeof(struct pf_os_fingerprint), 0, 0, 0,
	    "pfosfp", NULL);
	SLIST_INIT(&pf_osfp_list);
}

#if 0
void
pf_osfp_destroy(void)
{
	pf_osfp_flush();

	pool_destroy(&pf_osfp_pl);
	pool_destroy(&pf_osfp_entry_pl);
}
#endif

/* Flush the fingerprint list */
void
pf_osfp_flush(void)
{
	struct pf_os_fingerprint *fp;
	struct pf_osfp_entry *entry;

	while ((fp = SLIST_FIRST(&pf_osfp_list))) {
		SLIST_REMOVE_HEAD(&pf_osfp_list, fp_next);
		while ((entry = SLIST_FIRST(&fp->fp_oses))) {
			SLIST_REMOVE_HEAD(&fp->fp_oses, fp_entry);
			pool_put(&pf_osfp_entry_pl, entry);
		}
		pool_put(&pf_osfp_pl, fp);
	}
}


/* Add a fingerprint */
int
pf_osfp_add(struct pf_osfp_ioctl *fpioc)
{
	struct pf_os_fingerprint *fp, fpadd;
	struct pf_osfp_entry *entry, *uentry;

	memset(&fpadd, 0, sizeof(fpadd));
	fpadd.fp_tcpopts = fpioc->fp_tcpopts;
	fpadd.fp_wsize = fpioc->fp_wsize;
	fpadd.fp_psize = fpioc->fp_psize;
	fpadd.fp_mss = fpioc->fp_mss;
	fpadd.fp_flags = fpioc->fp_flags;
	fpadd.fp_optcnt = fpioc->fp_optcnt;
	fpadd.fp_wscale = fpioc->fp_wscale;
	fpadd.fp_ttl = fpioc->fp_ttl;

	uentry = &fpioc->fp_os;
	uentry->fp_entry.sle_next = NULL;
	uentry->fp_class_nm[sizeof(uentry->fp_class_nm) - 1] = '\0';
	uentry->fp_version_nm[sizeof(uentry->fp_version_nm) - 1] = '\0';
	uentry->fp_subtype_nm[sizeof(uentry->fp_subtype_nm) - 1] = '\0';

	DPFPRINTF("adding osfp %s %s %s = %s%d:%d:%d:%s%d:0x%llx %d "
	    "(TS=%s,M=%s%d,W=%s%d) %x\n",
	    fpioc->fp_os.fp_class_nm, fpioc->fp_os.fp_version_nm,
	    fpioc->fp_os.fp_subtype_nm,
	    (fpadd.fp_flags & PF_OSFP_WSIZE_MOD) ? "%" :
	    (fpadd.fp_flags & PF_OSFP_WSIZE_MSS) ? "S" :
	    (fpadd.fp_flags & PF_OSFP_WSIZE_MTU) ? "T" :
	    (fpadd.fp_flags & PF_OSFP_WSIZE_DC) ? "*" : "",
	    fpadd.fp_wsize,
	    fpadd.fp_ttl,
	    (fpadd.fp_flags & PF_OSFP_DF) ? 1 : 0,
	    (fpadd.fp_flags & PF_OSFP_PSIZE_MOD) ? "%" :
	    (fpadd.fp_flags & PF_OSFP_PSIZE_DC) ? "*" : "",
	    fpadd.fp_psize,
	    (long long int)fpadd.fp_tcpopts, fpadd.fp_optcnt,
	    (fpadd.fp_flags & PF_OSFP_TS0) ? "0" : "",
	    (fpadd.fp_flags & PF_OSFP_MSS_MOD) ? "%" :
	    (fpadd.fp_flags & PF_OSFP_MSS_DC) ? "*" : "",
	    fpadd.fp_mss,
	    (fpadd.fp_flags & PF_OSFP_WSCALE_MOD) ? "%" :
	    (fpadd.fp_flags & PF_OSFP_WSCALE_DC) ? "*" : "",
	    fpadd.fp_wscale,
	    fpioc->fp_os.fp_os);


	if ((fp = pf_osfp_find_exact(&pf_osfp_list, &fpadd))) {
		SLIST_FOREACH(entry, &fp->fp_oses, fp_entry) {
			if (PF_OSFP_ENTRY_EQ(entry, &fpioc->fp_os)) {
				return EEXIST;
			}
		}
		if ((entry = pool_get(&pf_osfp_entry_pl, PR_WAITOK)) == NULL) {
			return ENOMEM;
		}
	} else {
		if ((fp = pool_get(&pf_osfp_pl, PR_WAITOK)) == NULL) {
			return ENOMEM;
		}
		memset(fp, 0, sizeof(*fp));
		fp->fp_tcpopts = fpioc->fp_tcpopts;
		fp->fp_wsize = fpioc->fp_wsize;
		fp->fp_psize = fpioc->fp_psize;
		fp->fp_mss = fpioc->fp_mss;
		fp->fp_flags = fpioc->fp_flags;
		fp->fp_optcnt = fpioc->fp_optcnt;
		fp->fp_wscale = fpioc->fp_wscale;
		fp->fp_ttl = fpioc->fp_ttl;
		SLIST_INIT(&fp->fp_oses);
		if ((entry = pool_get(&pf_osfp_entry_pl, PR_WAITOK)) == NULL) {
			pool_put(&pf_osfp_pl, fp);
			return ENOMEM;
		}
		pf_osfp_insert(&pf_osfp_list, fp);
	}
	memcpy(entry, &fpioc->fp_os, sizeof(*entry));

	/* Make sure the strings are NUL terminated */
	entry->fp_class_nm[sizeof(entry->fp_class_nm) - 1] = '\0';
	entry->fp_version_nm[sizeof(entry->fp_version_nm) - 1] = '\0';
	entry->fp_subtype_nm[sizeof(entry->fp_subtype_nm) - 1] = '\0';

	SLIST_INSERT_HEAD(&fp->fp_oses, entry, fp_entry);

#ifdef PFDEBUG
	if ((fp = pf_osfp_validate())) {
		printf("Invalid fingerprint list\n");
	}
#endif /* PFDEBUG */
	return 0;
}


/* Find a fingerprint in the list */
struct pf_os_fingerprint *
pf_osfp_find(struct pf_osfp_list *list, struct pf_os_fingerprint *find,
    u_int8_t ttldiff)
{
	struct pf_os_fingerprint *f;

#define MATCH_INT(_MOD, _DC, _field)                                    \
	if ((f->fp_flags & _DC) == 0) {                                 \
	        if ((f->fp_flags & _MOD) == 0) {                        \
	                if (f->_field != find->_field)                  \
	                        continue;                               \
	        } else {                                                \
	                if (f->_field == 0 || find->_field % f->_field) \
	                        continue;                               \
	        }                                                       \
	}

	SLIST_FOREACH(f, list, fp_next) {
		if (f->fp_tcpopts != find->fp_tcpopts ||
		    f->fp_optcnt != find->fp_optcnt ||
		    f->fp_ttl < find->fp_ttl ||
		    f->fp_ttl - find->fp_ttl > ttldiff ||
		    (f->fp_flags & (PF_OSFP_DF | PF_OSFP_TS0)) !=
		    (find->fp_flags & (PF_OSFP_DF | PF_OSFP_TS0))) {
			continue;
		}

		MATCH_INT(PF_OSFP_PSIZE_MOD, PF_OSFP_PSIZE_DC, fp_psize)
		MATCH_INT(PF_OSFP_MSS_MOD, PF_OSFP_MSS_DC, fp_mss)
		MATCH_INT(PF_OSFP_WSCALE_MOD, PF_OSFP_WSCALE_DC, fp_wscale)
		if ((f->fp_flags & PF_OSFP_WSIZE_DC) == 0) {
			if (f->fp_flags & PF_OSFP_WSIZE_MSS) {
				if (find->fp_mss == 0) {
					continue;
				}

/*
 * Some "smart" NAT devices and DSL routers will tweak the MSS size and
 * will set it to whatever is suitable for the link type.
 */
#define SMART_MSS       1460
				if ((find->fp_wsize % find->fp_mss ||
				    find->fp_wsize / find->fp_mss !=
				    f->fp_wsize) &&
				    (find->fp_wsize % SMART_MSS ||
				    find->fp_wsize / SMART_MSS !=
				    f->fp_wsize)) {
					continue;
				}
			} else if (f->fp_flags & PF_OSFP_WSIZE_MTU) {
				if (find->fp_mss == 0) {
					continue;
				}

#define MTUOFF  (sizeof (struct ip) + sizeof (struct tcphdr))
#define SMART_MTU       (SMART_MSS + MTUOFF)
				if ((find->fp_wsize % (find->fp_mss + MTUOFF) ||
				    find->fp_wsize / (find->fp_mss + MTUOFF) !=
				    f->fp_wsize) &&
				    (find->fp_wsize % SMART_MTU ||
				    find->fp_wsize / SMART_MTU !=
				    f->fp_wsize)) {
					continue;
				}
			} else if (f->fp_flags & PF_OSFP_WSIZE_MOD) {
				if (f->fp_wsize == 0 || find->fp_wsize %
				    f->fp_wsize) {
					continue;
				}
			} else {
				if (f->fp_wsize != find->fp_wsize) {
					continue;
				}
			}
		}
		return f;
	}

	return NULL;
}

/* Find an exact fingerprint in the list */
struct pf_os_fingerprint *
pf_osfp_find_exact(struct pf_osfp_list *list, struct pf_os_fingerprint *find)
{
	struct pf_os_fingerprint *f;

	SLIST_FOREACH(f, list, fp_next) {
		if (f->fp_tcpopts == find->fp_tcpopts &&
		    f->fp_wsize == find->fp_wsize &&
		    f->fp_psize == find->fp_psize &&
		    f->fp_mss == find->fp_mss &&
		    f->fp_flags == find->fp_flags &&
		    f->fp_optcnt == find->fp_optcnt &&
		    f->fp_wscale == find->fp_wscale &&
		    f->fp_ttl == find->fp_ttl) {
			return f;
		}
	}

	return NULL;
}

/* Insert a fingerprint into the list */
void
pf_osfp_insert(struct pf_osfp_list *list, struct pf_os_fingerprint *ins)
{
	struct pf_os_fingerprint *f, *prev = NULL;

	/* XXX need to go semi tree based.  can key on tcp options */

	SLIST_FOREACH(f, list, fp_next)
	prev = f;
	if (prev) {
		SLIST_INSERT_AFTER(prev, ins, fp_next);
	} else {
		SLIST_INSERT_HEAD(list, ins, fp_next);
	}
}

/* Fill a fingerprint by its number (from an ioctl) */
int
pf_osfp_get(struct pf_osfp_ioctl *fpioc)
{
	struct pf_os_fingerprint *fp;
	struct pf_osfp_entry *entry;
	int num = fpioc->fp_getnum;
	int i = 0;


	memset(fpioc, 0, sizeof(*fpioc));
	SLIST_FOREACH(fp, &pf_osfp_list, fp_next) {
		SLIST_FOREACH(entry, &fp->fp_oses, fp_entry) {
			if (i++ == num) {
				fpioc->fp_mss = fp->fp_mss;
				fpioc->fp_wsize = fp->fp_wsize;
				fpioc->fp_flags = fp->fp_flags;
				fpioc->fp_psize = fp->fp_psize;
				fpioc->fp_ttl = fp->fp_ttl;
				fpioc->fp_wscale = fp->fp_wscale;
				fpioc->fp_getnum = num;
				memcpy(&fpioc->fp_os, entry,
				    sizeof(fpioc->fp_os));
				fpioc->fp_os.fp_entry.sle_next = NULL;
				return 0;
			}
		}
	}

	return EBUSY;
}


/* Validate that each signature is reachable */
struct pf_os_fingerprint *
pf_osfp_validate(void)
{
	struct pf_os_fingerprint *f, *f2, find;

	SLIST_FOREACH(f, &pf_osfp_list, fp_next) {
		memcpy(&find, f, sizeof(find));

		/* We do a few MSS/th_win percolations to make things unique */
		if (find.fp_mss == 0) {
			find.fp_mss = 128;
		}
		if (f->fp_flags & PF_OSFP_WSIZE_MSS) {
			find.fp_wsize *= find.fp_mss;
		} else if (f->fp_flags & PF_OSFP_WSIZE_MTU) {
			find.fp_wsize *= (find.fp_mss + 40);
		} else if (f->fp_flags & PF_OSFP_WSIZE_MOD) {
			find.fp_wsize *= 2;
		}
		if (f != (f2 = pf_osfp_find(&pf_osfp_list, &find, 0))) {
			if (f2) {
				printf("Found \"%s %s %s\" instead of "
				    "\"%s %s %s\"\n",
				    SLIST_FIRST(&f2->fp_oses)->fp_class_nm,
				    SLIST_FIRST(&f2->fp_oses)->fp_version_nm,
				    SLIST_FIRST(&f2->fp_oses)->fp_subtype_nm,
				    SLIST_FIRST(&f->fp_oses)->fp_class_nm,
				    SLIST_FIRST(&f->fp_oses)->fp_version_nm,
				    SLIST_FIRST(&f->fp_oses)->fp_subtype_nm);
			} else {
				printf("Couldn't find \"%s %s %s\"\n",
				    SLIST_FIRST(&f->fp_oses)->fp_class_nm,
				    SLIST_FIRST(&f->fp_oses)->fp_version_nm,
				    SLIST_FIRST(&f->fp_oses)->fp_subtype_nm);
			}
			return f;
		}
	}
	return NULL;
}
Commit	Line	Data
b0d623f7	1	/*
f427ee49	2	* Copyright (c) 2007-2020 Apple Inc. All rights reserved.
b0d623f7 A	3	*
	4	* @APPLE_OSREFERENCE_LICENSE_HEADER_START@
	5	*
	6	* This file contains Original Code and/or Modifications of Original Code
	7	* as defined in and that are subject to the Apple Public Source License
	8	* Version 2.0 (the 'License'). You may not use this file except in
	9	* compliance with the License. The rights granted to you under the License
	10	* may not be used to create, or enable the creation or redistribution of,
	11	* unlawful or unlicensed copies of an Apple operating system, or to
	12	* circumvent, violate, or enable the circumvention or violation of, any
	13	* terms of an Apple operating system software license agreement.
	14	*
	15	* Please obtain a copy of the License at
	16	* http://www.opensource.apple.com/apsl/ and read it before using this file.
	17	*
	18	* The Original Code and all software distributed under the License are
	19	* distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
	20	* EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
	21	* INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
	22	* FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
	23	* Please see the License for the specific language governing rights and
	24	* limitations under the License.
	25	*
	26	* @APPLE_OSREFERENCE_LICENSE_HEADER_END@
	27	*/
	28
	29	/* $apfw: pf_osfp.c,v 1.4 2008/08/27 00:01:32 jhw Exp $ */
	30	/* $OpenBSD: pf_osfp.c,v 1.12 2006/12/13 18:14:10 itojun Exp $ */
	31
	32	/*
	33	* Copyright (c) 2003 Mike Frantzen <frantzen@w4g.org>
	34	*
	35	* Permission to use, copy, modify, and distribute this software for any
	36	* purpose with or without fee is hereby granted, provided that the above
	37	* copyright notice and this permission notice appear in all copies.
	38	*
	39	* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
	40	* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
	41	* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
	42	* ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
	43	* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
	44	* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
	45	* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
	46	*
	47	*/
	48
	49	#include <machine/endian.h>
	50	#include <sys/param.h>
	51	#include <sys/socket.h>
	52	#include <sys/systm.h>
	53	#include <sys/mbuf.h>
	54
	55	#include <netinet/in.h>
	56	#include <netinet/in_systm.h>
	57	#include <netinet/ip.h>
	58	#include <netinet/tcp.h>
	59	#include <netinet/tcp_fsm.h>
	60
	61	#include <net/if.h>
	62	#include <net/pfvar.h>
	63
b0d623f7 A	64	#include <netinet/ip6.h>
b0d623f7 A	65	#include <netinet6/in6_var.h>
b0d623f7	66
0a7de745 A	67	#define DPFPRINTF(format, x...) \
	68	if (pf_status.debug >= PF_DEBUG_NOISY) \
	69	printf(format, ##x)
b0d623f7 A	70
	71	static SLIST_HEAD(pf_osfp_list, pf_os_fingerprint) pf_osfp_list;
	72	static struct pool pf_osfp_entry_pl;
	73	static struct pool pf_osfp_pl;
	74
0a7de745	75	static struct pf_os_fingerprint pf_osfp_find(struct pf_osfp_list ,
b0d623f7	76	struct pf_os_fingerprint *, u_int8_t);
0a7de745	77	static struct pf_os_fingerprint pf_osfp_find_exact(struct pf_osfp_list ,
b0d623f7 A	78	struct pf_os_fingerprint *);
	79	static void pf_osfp_insert(struct pf_osfp_list , struct pf_os_fingerprint );
	80
	81
	82	/*
	83	* Passively fingerprint the OS of the host (IPv4 TCP SYN packets only)
	84	* Returns the list of possible OSes.
	85	*/
	86	struct pf_osfp_enlist *
5ba3f43e	87	pf_osfp_fingerprint(struct pf_pdesc pd, pbuf_t pbuf, int off,
b0d623f7 A	88	const struct tcphdr *tcp)
	89	{
	90	struct ip *ip;
	91	struct ip6_hdr *ip6;
	92	char hdr[60];
	93
	94	if ((pd->af != PF_INET && pd->af != PF_INET6) \|\|
	95	pd->proto != IPPROTO_TCP \|\|
0a7de745 A	96	(tcp->th_off << 2) < (int)sizeof(*tcp)) {
	97	return NULL;
	98	}
b0d623f7 A	99
b0d623f7 A	100	if (pd->af == PF_INET) {
5ba3f43e	101	ip = pbuf->pb_data;
b0d623f7 A	102	ip6 = (struct ip6_hdr *)NULL;
	103	} else {
	104	ip = (struct ip *)NULL;
5ba3f43e	105	ip6 = pbuf->pb_data;
b0d623f7	106	}
5ba3f43e	107	if (!pf_pull_hdr(pbuf, off, hdr, tcp->th_off << 2, NULL, NULL,
0a7de745 A	108	pd->af)) {
	109	return NULL;
	110	}
b0d623f7	111
0a7de745	112	return pf_osfp_fingerprint_hdr(ip, ip6, (struct tcphdr )(void )hdr);
b0d623f7 A	113	}
	114
	115	struct pf_osfp_enlist *
	116	pf_osfp_fingerprint_hdr(const struct ip ip, const struct ip6_hdr ip6,
	117	const struct tcphdr *tcp)
	118	{
b0d623f7 A	119	struct pf_os_fingerprint fp, *fpresult;
	120	int cnt, optlen = 0;
	121	const u_int8_t *optp;
	122	char srcname[128];
	123
0a7de745 A	124	if ((tcp->th_flags & (TH_SYN \| TH_ACK)) != TH_SYN) {
	125	return NULL;
	126	}
b0d623f7	127	if (ip) {
0a7de745 A	128	if ((ip->ip_off & htons(IP_OFFMASK)) != 0) {
	129	return NULL;
	130	}
b0d623f7 A	131	}
b0d623f7 A	132
0a7de745	133	memset(&fp, 0, sizeof(fp));
b0d623f7 A	134
	135	if (ip) {
	136	fp.fp_psize = ntohs(ip->ip_len);
	137	fp.fp_ttl = ip->ip_ttl;
0a7de745	138	if (ip->ip_off & htons(IP_DF)) {
b0d623f7	139	fp.fp_flags \|= PF_OSFP_DF;
0a7de745	140	}
b0d623f7	141	(void) inet_ntop(AF_INET, &ip->ip_src, srcname,
0a7de745	142	(socklen_t)sizeof(srcname));
f427ee49	143	} else if (ip6) {
b0d623f7	144	/* jumbo payload? */
0a7de745	145	fp.fp_psize = sizeof(struct ip6_hdr) + ntohs(ip6->ip6_plen);
b0d623f7 A	146	fp.fp_ttl = ip6->ip6_hlim;
	147	fp.fp_flags \|= PF_OSFP_DF;
	148	fp.fp_flags \|= PF_OSFP_INET6;
	149	(void) inet_ntop(AF_INET6, &ip6->ip6_src, srcname,
0a7de745	150	(socklen_t)sizeof(srcname));
f427ee49	151	} else {
0a7de745 A	152	return NULL;
0a7de745 A	153	}
b0d623f7 A	154	fp.fp_wsize = ntohs(tcp->th_win);
	155
	156
0a7de745 A	157	cnt = (tcp->th_off << 2) - sizeof(*tcp);
0a7de745 A	158	optp = (const u_int8_t )((const char )tcp + sizeof(*tcp));
b0d623f7	159	for (; cnt > 0; cnt -= optlen, optp += optlen) {
0a7de745	160	if (*optp == TCPOPT_EOL) {
b0d623f7	161	break;
0a7de745	162	}
b0d623f7 A	163
	164	fp.fp_optcnt++;
	165	if (*optp == TCPOPT_NOP) {
	166	fp.fp_tcpopts = (fp.fp_tcpopts << PF_OSFP_TCPOPT_BITS) \|
	167	PF_OSFP_TCPOPT_NOP;
	168	optlen = 1;
	169	} else {
0a7de745 A	170	if (cnt < 2) {
	171	return NULL;
	172	}
b0d623f7	173	optlen = optp[1];
0a7de745 A	174	if (optlen > cnt \|\| optlen < 2) {
	175	return NULL;
	176	}
b0d623f7 A	177	switch (*optp) {
b0d623f7 A	178	case TCPOPT_MAXSEG:
0a7de745	179	if (optlen >= TCPOLEN_MAXSEG) {
b0d623f7	180	memcpy(&fp.fp_mss, &optp[2],
0a7de745 A	181	sizeof(fp.fp_mss));
0a7de745 A	182	}
b0d623f7	183	fp.fp_tcpopts = (fp.fp_tcpopts <<
0a7de745	184	PF_OSFP_TCPOPT_BITS) \| PF_OSFP_TCPOPT_MSS;
b0d623f7 A	185	#if BYTE_ORDER != BIG_ENDIAN
	186	NTOHS(fp.fp_mss);
	187	#endif
	188	break;
	189	case TCPOPT_WINDOW:
0a7de745	190	if (optlen >= TCPOLEN_WINDOW) {
b0d623f7	191	memcpy(&fp.fp_wscale, &optp[2],
0a7de745 A	192	sizeof(fp.fp_wscale));
0a7de745 A	193	}
b0d623f7	194	fp.fp_tcpopts = (fp.fp_tcpopts <<
0a7de745	195	PF_OSFP_TCPOPT_BITS) \|
b0d623f7 A	196	PF_OSFP_TCPOPT_WSCALE;
	197	break;
	198	case TCPOPT_SACK_PERMITTED:
	199	fp.fp_tcpopts = (fp.fp_tcpopts <<
0a7de745	200	PF_OSFP_TCPOPT_BITS) \| PF_OSFP_TCPOPT_SACK;
b0d623f7 A	201	break;
	202	case TCPOPT_TIMESTAMP:
	203	if (optlen >= TCPOLEN_TIMESTAMP) {
	204	u_int32_t ts;
0a7de745 A	205	memcpy(&ts, &optp[2], sizeof(ts));
0a7de745 A	206	if (ts == 0) {
b0d623f7	207	fp.fp_flags \|= PF_OSFP_TS0;
0a7de745	208	}
b0d623f7 A	209	}
b0d623f7 A	210	fp.fp_tcpopts = (fp.fp_tcpopts <<
0a7de745	211	PF_OSFP_TCPOPT_BITS) \| PF_OSFP_TCPOPT_TS;
b0d623f7 A	212	break;
b0d623f7 A	213	default:
0a7de745	214	return NULL;
b0d623f7 A	215	}
b0d623f7 A	216	}
0a7de745	217	optlen = MAX(optlen, 1); /* paranoia */
b0d623f7 A	218	}
	219
	220	DPFPRINTF("fingerprinted %s:%d %d:%d:%d:%d:%llx (%d) "
	221	"(TS=%s,M=%s%d,W=%s%d)\n",
	222	srcname, ntohs(tcp->th_sport),
	223	fp.fp_wsize, fp.fp_ttl, (fp.fp_flags & PF_OSFP_DF) != 0,
	224	fp.fp_psize, (long long int)fp.fp_tcpopts, fp.fp_optcnt,
	225	(fp.fp_flags & PF_OSFP_TS0) ? "0" : "",
	226	(fp.fp_flags & PF_OSFP_MSS_MOD) ? "%" :
	227	(fp.fp_flags & PF_OSFP_MSS_DC) ? "*" : "",
	228	fp.fp_mss,
	229	(fp.fp_flags & PF_OSFP_WSCALE_MOD) ? "%" :
	230	(fp.fp_flags & PF_OSFP_WSCALE_DC) ? "*" : "",
	231	fp.fp_wscale);
	232
	233	if ((fpresult = pf_osfp_find(&pf_osfp_list, &fp,
0a7de745 A	234	PF_OSFP_MAXTTL_OFFSET))) {
	235	return &fpresult->fp_oses;
	236	}
	237	return NULL;
b0d623f7 A	238	}
	239
	240	/* Match a fingerprint ID against a list of OSes */
	241	int
	242	pf_osfp_match(struct pf_osfp_enlist *list, pf_osfp_t os)
	243	{
	244	struct pf_osfp_entry *entry;
	245	int os_class, os_version, os_subtype;
	246	int en_class, en_version, en_subtype;
	247
0a7de745 A	248	if (os == PF_OSFP_ANY) {
	249	return 1;
	250	}
b0d623f7 A	251	if (list == NULL) {
b0d623f7 A	252	DPFPRINTF("osfp no match against %x\n", os);
0a7de745	253	return os == PF_OSFP_UNKNOWN;
b0d623f7 A	254	}
	255	PF_OSFP_UNPACK(os, os_class, os_version, os_subtype);
	256	SLIST_FOREACH(entry, list, fp_entry) {
	257	PF_OSFP_UNPACK(entry->fp_os, en_class, en_version, en_subtype);
	258	if ((os_class == PF_OSFP_ANY \|\| en_class == os_class) &&
	259	(os_version == PF_OSFP_ANY \|\| en_version == os_version) &&
	260	(os_subtype == PF_OSFP_ANY \|\| en_subtype == os_subtype)) {
	261	DPFPRINTF("osfp matched %s %s %s %x==%x\n",
	262	entry->fp_class_nm, entry->fp_version_nm,
	263	entry->fp_subtype_nm, os, entry->fp_os);
0a7de745	264	return 1;
b0d623f7 A	265	}
	266	}
	267	DPFPRINTF("fingerprint 0x%x didn't match\n", os);
0a7de745	268	return 0;
b0d623f7 A	269	}
	270
	271	/* Initialize the OS fingerprint system */
	272	void
	273	pf_osfp_initialize(void)
	274	{
0a7de745	275	pool_init(&pf_osfp_entry_pl, sizeof(struct pf_osfp_entry), 0, 0, 0,
b0d623f7	276	"pfosfpen", NULL);
0a7de745	277	pool_init(&pf_osfp_pl, sizeof(struct pf_os_fingerprint), 0, 0, 0,
b0d623f7 A	278	"pfosfp", NULL);
	279	SLIST_INIT(&pf_osfp_list);
	280	}
	281
	282	#if 0
	283	void
	284	pf_osfp_destroy(void)
	285	{
	286	pf_osfp_flush();
	287
	288	pool_destroy(&pf_osfp_pl);
	289	pool_destroy(&pf_osfp_entry_pl);
	290	}
	291	#endif
	292
	293	/* Flush the fingerprint list */
	294	void
	295	pf_osfp_flush(void)
	296	{
	297	struct pf_os_fingerprint *fp;
	298	struct pf_osfp_entry *entry;
	299
	300	while ((fp = SLIST_FIRST(&pf_osfp_list))) {
	301	SLIST_REMOVE_HEAD(&pf_osfp_list, fp_next);
	302	while ((entry = SLIST_FIRST(&fp->fp_oses))) {
	303	SLIST_REMOVE_HEAD(&fp->fp_oses, fp_entry);
	304	pool_put(&pf_osfp_entry_pl, entry);
	305	}
	306	pool_put(&pf_osfp_pl, fp);
	307	}
	308	}
	309
	310
	311	/* Add a fingerprint */
	312	int
	313	pf_osfp_add(struct pf_osfp_ioctl *fpioc)
	314	{
	315	struct pf_os_fingerprint *fp, fpadd;
6d2010ae	316	struct pf_osfp_entry entry, uentry;
b0d623f7	317
0a7de745	318	memset(&fpadd, 0, sizeof(fpadd));
b0d623f7 A	319	fpadd.fp_tcpopts = fpioc->fp_tcpopts;
	320	fpadd.fp_wsize = fpioc->fp_wsize;
	321	fpadd.fp_psize = fpioc->fp_psize;
	322	fpadd.fp_mss = fpioc->fp_mss;
	323	fpadd.fp_flags = fpioc->fp_flags;
	324	fpadd.fp_optcnt = fpioc->fp_optcnt;
	325	fpadd.fp_wscale = fpioc->fp_wscale;
	326	fpadd.fp_ttl = fpioc->fp_ttl;
	327
6d2010ae A	328	uentry = &fpioc->fp_os;
6d2010ae A	329	uentry->fp_entry.sle_next = NULL;
0a7de745 A	330	uentry->fp_class_nm[sizeof(uentry->fp_class_nm) - 1] = '\0';
	331	uentry->fp_version_nm[sizeof(uentry->fp_version_nm) - 1] = '\0';
	332	uentry->fp_subtype_nm[sizeof(uentry->fp_subtype_nm) - 1] = '\0';
6d2010ae	333
b0d623f7 A	334	DPFPRINTF("adding osfp %s %s %s = %s%d:%d:%d:%s%d:0x%llx %d "
	335	"(TS=%s,M=%s%d,W=%s%d) %x\n",
	336	fpioc->fp_os.fp_class_nm, fpioc->fp_os.fp_version_nm,
	337	fpioc->fp_os.fp_subtype_nm,
	338	(fpadd.fp_flags & PF_OSFP_WSIZE_MOD) ? "%" :
	339	(fpadd.fp_flags & PF_OSFP_WSIZE_MSS) ? "S" :
	340	(fpadd.fp_flags & PF_OSFP_WSIZE_MTU) ? "T" :
	341	(fpadd.fp_flags & PF_OSFP_WSIZE_DC) ? "*" : "",
	342	fpadd.fp_wsize,
	343	fpadd.fp_ttl,
	344	(fpadd.fp_flags & PF_OSFP_DF) ? 1 : 0,
	345	(fpadd.fp_flags & PF_OSFP_PSIZE_MOD) ? "%" :
	346	(fpadd.fp_flags & PF_OSFP_PSIZE_DC) ? "*" : "",
	347	fpadd.fp_psize,
	348	(long long int)fpadd.fp_tcpopts, fpadd.fp_optcnt,
	349	(fpadd.fp_flags & PF_OSFP_TS0) ? "0" : "",
	350	(fpadd.fp_flags & PF_OSFP_MSS_MOD) ? "%" :
	351	(fpadd.fp_flags & PF_OSFP_MSS_DC) ? "*" : "",
	352	fpadd.fp_mss,
	353	(fpadd.fp_flags & PF_OSFP_WSCALE_MOD) ? "%" :
	354	(fpadd.fp_flags & PF_OSFP_WSCALE_DC) ? "*" : "",
	355	fpadd.fp_wscale,
	356	fpioc->fp_os.fp_os);
	357
	358
	359	if ((fp = pf_osfp_find_exact(&pf_osfp_list, &fpadd))) {
	360	SLIST_FOREACH(entry, &fp->fp_oses, fp_entry) {
0a7de745 A	361	if (PF_OSFP_ENTRY_EQ(entry, &fpioc->fp_os)) {
	362	return EEXIST;
	363	}
	364	}
	365	if ((entry = pool_get(&pf_osfp_entry_pl, PR_WAITOK)) == NULL) {
	366	return ENOMEM;
b0d623f7	367	}
b0d623f7	368	} else {
0a7de745 A	369	if ((fp = pool_get(&pf_osfp_pl, PR_WAITOK)) == NULL) {
	370	return ENOMEM;
	371	}
	372	memset(fp, 0, sizeof(*fp));
b0d623f7 A	373	fp->fp_tcpopts = fpioc->fp_tcpopts;
	374	fp->fp_wsize = fpioc->fp_wsize;
	375	fp->fp_psize = fpioc->fp_psize;
	376	fp->fp_mss = fpioc->fp_mss;
	377	fp->fp_flags = fpioc->fp_flags;
	378	fp->fp_optcnt = fpioc->fp_optcnt;
	379	fp->fp_wscale = fpioc->fp_wscale;
	380	fp->fp_ttl = fpioc->fp_ttl;
	381	SLIST_INIT(&fp->fp_oses);
	382	if ((entry = pool_get(&pf_osfp_entry_pl, PR_WAITOK)) == NULL) {
	383	pool_put(&pf_osfp_pl, fp);
0a7de745	384	return ENOMEM;
b0d623f7 A	385	}
	386	pf_osfp_insert(&pf_osfp_list, fp);
	387	}
0a7de745	388	memcpy(entry, &fpioc->fp_os, sizeof(*entry));
b0d623f7 A	389
b0d623f7 A	390	/* Make sure the strings are NUL terminated */
0a7de745 A	391	entry->fp_class_nm[sizeof(entry->fp_class_nm) - 1] = '\0';
	392	entry->fp_version_nm[sizeof(entry->fp_version_nm) - 1] = '\0';
	393	entry->fp_subtype_nm[sizeof(entry->fp_subtype_nm) - 1] = '\0';
b0d623f7 A	394
	395	SLIST_INSERT_HEAD(&fp->fp_oses, entry, fp_entry);
	396
	397	#ifdef PFDEBUG
0a7de745	398	if ((fp = pf_osfp_validate())) {
b0d623f7	399	printf("Invalid fingerprint list\n");
0a7de745	400	}
b0d623f7	401	#endif /* PFDEBUG */
0a7de745	402	return 0;
b0d623f7 A	403	}
	404
	405
	406	/* Find a fingerprint in the list */
	407	struct pf_os_fingerprint *
	408	pf_osfp_find(struct pf_osfp_list list, struct pf_os_fingerprint find,
	409	u_int8_t ttldiff)
	410	{
	411	struct pf_os_fingerprint *f;
	412
0a7de745 A	413	#define MATCH_INT(_MOD, _DC, _field) \
	414	if ((f->fp_flags & _DC) == 0) { \
	415	if ((f->fp_flags & _MOD) == 0) { \
	416	if (f->_field != find->_field) \
	417	continue; \
	418	} else { \
	419	if (f->_field == 0 \|\| find->_field % f->_field) \
	420	continue; \
	421	} \
b0d623f7 A	422	}
	423
	424	SLIST_FOREACH(f, list, fp_next) {
	425	if (f->fp_tcpopts != find->fp_tcpopts \|\|
	426	f->fp_optcnt != find->fp_optcnt \|\|
	427	f->fp_ttl < find->fp_ttl \|\|
	428	f->fp_ttl - find->fp_ttl > ttldiff \|\|
0a7de745 A	429	(f->fp_flags & (PF_OSFP_DF \| PF_OSFP_TS0)) !=
0a7de745 A	430	(find->fp_flags & (PF_OSFP_DF \| PF_OSFP_TS0))) {
b0d623f7	431	continue;
0a7de745	432	}
b0d623f7 A	433
	434	MATCH_INT(PF_OSFP_PSIZE_MOD, PF_OSFP_PSIZE_DC, fp_psize)
	435	MATCH_INT(PF_OSFP_MSS_MOD, PF_OSFP_MSS_DC, fp_mss)
	436	MATCH_INT(PF_OSFP_WSCALE_MOD, PF_OSFP_WSCALE_DC, fp_wscale)
	437	if ((f->fp_flags & PF_OSFP_WSIZE_DC) == 0) {
	438	if (f->fp_flags & PF_OSFP_WSIZE_MSS) {
0a7de745	439	if (find->fp_mss == 0) {
b0d623f7	440	continue;
0a7de745	441	}
b0d623f7 A	442
	443	/*
	444	* Some "smart" NAT devices and DSL routers will tweak the MSS size and
	445	* will set it to whatever is suitable for the link type.
	446	*/
0a7de745	447	#define SMART_MSS 1460
b0d623f7 A	448	if ((find->fp_wsize % find->fp_mss \|\|
	449	find->fp_wsize / find->fp_mss !=
	450	f->fp_wsize) &&
	451	(find->fp_wsize % SMART_MSS \|\|
	452	find->fp_wsize / SMART_MSS !=
0a7de745	453	f->fp_wsize)) {
b0d623f7	454	continue;
0a7de745	455	}
b0d623f7	456	} else if (f->fp_flags & PF_OSFP_WSIZE_MTU) {
0a7de745	457	if (find->fp_mss == 0) {
b0d623f7	458	continue;
0a7de745	459	}
b0d623f7	460
0a7de745 A	461	#define MTUOFF (sizeof (struct ip) + sizeof (struct tcphdr))
0a7de745 A	462	#define SMART_MTU (SMART_MSS + MTUOFF)
b0d623f7 A	463	if ((find->fp_wsize % (find->fp_mss + MTUOFF) \|\|
	464	find->fp_wsize / (find->fp_mss + MTUOFF) !=
	465	f->fp_wsize) &&
	466	(find->fp_wsize % SMART_MTU \|\|
	467	find->fp_wsize / SMART_MTU !=
0a7de745	468	f->fp_wsize)) {
b0d623f7	469	continue;
0a7de745	470	}
b0d623f7 A	471	} else if (f->fp_flags & PF_OSFP_WSIZE_MOD) {
b0d623f7 A	472	if (f->fp_wsize == 0 \|\| find->fp_wsize %
0a7de745	473	f->fp_wsize) {
b0d623f7	474	continue;
0a7de745	475	}
b0d623f7	476	} else {
0a7de745	477	if (f->fp_wsize != find->fp_wsize) {
b0d623f7	478	continue;
0a7de745	479	}
b0d623f7 A	480	}
b0d623f7 A	481	}
0a7de745	482	return f;
b0d623f7 A	483	}
b0d623f7 A	484
0a7de745	485	return NULL;
b0d623f7 A	486	}
	487
	488	/* Find an exact fingerprint in the list */
	489	struct pf_os_fingerprint *
	490	pf_osfp_find_exact(struct pf_osfp_list list, struct pf_os_fingerprint find)
	491	{
	492	struct pf_os_fingerprint *f;
	493
	494	SLIST_FOREACH(f, list, fp_next) {
	495	if (f->fp_tcpopts == find->fp_tcpopts &&
	496	f->fp_wsize == find->fp_wsize &&
	497	f->fp_psize == find->fp_psize &&
	498	f->fp_mss == find->fp_mss &&
	499	f->fp_flags == find->fp_flags &&
	500	f->fp_optcnt == find->fp_optcnt &&
	501	f->fp_wscale == find->fp_wscale &&
0a7de745 A	502	f->fp_ttl == find->fp_ttl) {
	503	return f;
	504	}
b0d623f7 A	505	}
b0d623f7 A	506
0a7de745	507	return NULL;
b0d623f7 A	508	}
	509
	510	/* Insert a fingerprint into the list */
	511	void
	512	pf_osfp_insert(struct pf_osfp_list list, struct pf_os_fingerprint ins)
	513	{
	514	struct pf_os_fingerprint f, prev = NULL;
	515
	516	/* XXX need to go semi tree based. can key on tcp options */
	517
	518	SLIST_FOREACH(f, list, fp_next)
0a7de745 A	519	prev = f;
0a7de745 A	520	if (prev) {
b0d623f7	521	SLIST_INSERT_AFTER(prev, ins, fp_next);
0a7de745	522	} else {
b0d623f7	523	SLIST_INSERT_HEAD(list, ins, fp_next);
0a7de745	524	}
b0d623f7 A	525	}
	526
	527	/* Fill a fingerprint by its number (from an ioctl) */
	528	int
	529	pf_osfp_get(struct pf_osfp_ioctl *fpioc)
	530	{
	531	struct pf_os_fingerprint *fp;
	532	struct pf_osfp_entry *entry;
	533	int num = fpioc->fp_getnum;
	534	int i = 0;
	535
	536
0a7de745	537	memset(fpioc, 0, sizeof(*fpioc));
b0d623f7 A	538	SLIST_FOREACH(fp, &pf_osfp_list, fp_next) {
	539	SLIST_FOREACH(entry, &fp->fp_oses, fp_entry) {
	540	if (i++ == num) {
	541	fpioc->fp_mss = fp->fp_mss;
	542	fpioc->fp_wsize = fp->fp_wsize;
	543	fpioc->fp_flags = fp->fp_flags;
	544	fpioc->fp_psize = fp->fp_psize;
	545	fpioc->fp_ttl = fp->fp_ttl;
	546	fpioc->fp_wscale = fp->fp_wscale;
	547	fpioc->fp_getnum = num;
	548	memcpy(&fpioc->fp_os, entry,
0a7de745	549	sizeof(fpioc->fp_os));
6d2010ae	550	fpioc->fp_os.fp_entry.sle_next = NULL;
0a7de745	551	return 0;
b0d623f7 A	552	}
	553	}
	554	}
	555
0a7de745	556	return EBUSY;
b0d623f7 A	557	}
	558
	559
	560	/* Validate that each signature is reachable */
	561	struct pf_os_fingerprint *
	562	pf_osfp_validate(void)
	563	{
	564	struct pf_os_fingerprint f, f2, find;
	565
	566	SLIST_FOREACH(f, &pf_osfp_list, fp_next) {
0a7de745	567	memcpy(&find, f, sizeof(find));
b0d623f7 A	568
b0d623f7 A	569	/* We do a few MSS/th_win percolations to make things unique */
0a7de745	570	if (find.fp_mss == 0) {
b0d623f7	571	find.fp_mss = 128;
0a7de745 A	572	}
0a7de745 A	573	if (f->fp_flags & PF_OSFP_WSIZE_MSS) {
d1ecb069	574	find.fp_wsize *= find.fp_mss;
0a7de745	575	} else if (f->fp_flags & PF_OSFP_WSIZE_MTU) {
b0d623f7	576	find.fp_wsize *= (find.fp_mss + 40);
0a7de745	577	} else if (f->fp_flags & PF_OSFP_WSIZE_MOD) {
b0d623f7	578	find.fp_wsize *= 2;
0a7de745	579	}
b0d623f7	580	if (f != (f2 = pf_osfp_find(&pf_osfp_list, &find, 0))) {
0a7de745	581	if (f2) {
b0d623f7 A	582	printf("Found \"%s %s %s\" instead of "
	583	"\"%s %s %s\"\n",
	584	SLIST_FIRST(&f2->fp_oses)->fp_class_nm,
	585	SLIST_FIRST(&f2->fp_oses)->fp_version_nm,
	586	SLIST_FIRST(&f2->fp_oses)->fp_subtype_nm,
	587	SLIST_FIRST(&f->fp_oses)->fp_class_nm,
	588	SLIST_FIRST(&f->fp_oses)->fp_version_nm,
	589	SLIST_FIRST(&f->fp_oses)->fp_subtype_nm);
0a7de745	590	} else {
b0d623f7 A	591	printf("Couldn't find \"%s %s %s\"\n",
	592	SLIST_FIRST(&f->fp_oses)->fp_class_nm,
	593	SLIST_FIRST(&f->fp_oses)->fp_version_nm,
	594	SLIST_FIRST(&f->fp_oses)->fp_subtype_nm);
0a7de745 A	595	}
0a7de745 A	596	return f;
b0d623f7 A	597	}
b0d623f7 A	598	}
0a7de745	599	return NULL;
b0d623f7	600	}