Repository navigation
Expand file tree
/
Copy pathpfvar.h
More file actions
153 lines (139 loc) · 6.04 KB
/
Copy pathpfvar.h
File metadata and controls
153 lines (139 loc) · 6.04 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
/* $OpenBSD: pfvar.h,v 1.171 2003/09/26 21:44:09 cedric Exp $ */
/*
* Copyright (c) 2001 Daniel Hartmeier
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
*
* - Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* - Redistributions in binary form must reproduce the above
* copyright notice, this list of conditions and the following
* disclaimer in the documentation and/or other materials provided
* with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
* FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
* COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
* BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
* CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
* ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
* POSSIBILITY OF SUCH DAMAGE.
*
*/
#ifndef _NET_PFVAR_H_
#define _NET_PFVAR_H_
#include <sys/types.h>
#include <sys/queue.h>
#include <sys/tree.h>
/* A packed Operating System description for fingerprinting */
typedef u_int32_t pf_osfp_t;
#define PF_OSFP_ANY ((pf_osfp_t)0)
#define PF_OSFP_UNKNOWN ((pf_
9EC9
osfp_t)-1)
#define PF_OSFP_NOMATCH ((pf_osfp_t)-2)
struct pf_osfp_entry {
SLIST_ENTRY(pf_osfp_entry) fp_entry;
pf_osfp_t fp_os;
int fp_enflags;
#define PF_OSFP_EXPANDED 0x001 /* expanded entry */
#define PF_OSFP_GENERIC 0x002 /* generic signature */
#define PF_OSFP_NODETAIL 0x004 /* no p0f details */
#define PF_OSFP_LEN 32
char fp_class_nm[PF_OSFP_LEN];
char fp_version_nm[PF_OSFP_LEN];
char fp_subtype_nm[PF_OSFP_LEN];
};
#define PF_OSFP_ENTRY_EQ(a, b) \
((a)->fp_os == (b)->fp_os && \
memcmp((a)->fp_class_nm, (b)->fp_class_nm, PF_OSFP_LEN) == 0 && \
memcmp((a)->fp_version_nm, (b)->fp_version_nm, PF_OSFP_LEN) == 0 && \
memcmp((a)->fp_subtype_nm, (b)->fp_subtype_nm, PF_OSFP_LEN) == 0)
/* handle pf_osfp_t packing */
#define _FP_RESERVED_BIT 1 /* For the special negative #defines */
#define _FP_UNUSED_BITS 1
#define _FP_CLASS_BITS 10 /* OS Class (Windows, Linux) */
#define _FP_VERSION_BITS 10 /* OS version (95, 98, NT, 2.4.54, 3.2) */
#define _FP_SUBTYPE_BITS 10 /* patch level (NT SP4, SP3, ECN patch) */
#define PF_OSFP_UNPACK(osfp, class, version, subtype) do { \
(class) = ((osfp) >> (_FP_VERSION_BITS+_FP_SUBTYPE_BITS)) & \
((1 << _FP_CLASS_BITS) - 1); \
(version) = ((osfp) >> _FP_SUBTYPE_BITS) & \
((1 << _FP_VERSION_BITS) - 1);\
(subtype) = (osfp) & ((1 << _FP_SUBTYPE_BITS) - 1); \
} while(0)
#define PF_OSFP_PACK(osfp, class, version, subtype) do { \
(osfp) = ((class) & ((1 << _FP_CLASS_BITS) - 1)) << (_FP_VERSION_BITS \
+ _FP_SUBTYPE_BITS); \
(osfp) |= ((version) & ((1 << _FP_VERSION_BITS) - 1)) << \
_FP_SUBTYPE_BITS; \
(osfp) |= (subtype) & ((1 << _FP_SUBTYPE_BITS) - 1); \
} while(0)
/* the fingerprint of an OSes TCP SYN packet */
typedef u_int64_t pf_tcpopts_t;
struct pf_os_fingerprint {
SLIST_HEAD(pf_osfp_enlist, pf_osfp_entry) fp_oses; /* list of matches */
pf_tcpopts_t fp_tcpopts; /* packed TCP options */
u_int16_t fp_wsize; /* TCP window size */
u_int16_t fp_psize; /* ip->ip_len */
u_int16_t fp_mss; /* TCP MSS */
u_int16_t fp_flags;
#define PF_OSFP_WSIZE_MOD 0x0001 /* Window modulus */
#define PF_OSFP_WSIZE_DC 0x0002 /* Window don't care */
#define PF_OSFP_WSIZE_MSS 0x0004 /* Window multiple of MSS */
#define PF_OSFP_WSIZE_MTU 0x0008 /* Window multiple of MTU */
#define PF_OSFP_PSIZE_MOD 0x0010 /* packet size modulus */
#define PF_OSFP_PSIZE_DC 0x0020 /* packet size don't care */
#define PF_OSFP_WSCALE 0x0040 /* TCP window scaling */
#define PF_OSFP_WSCALE_MOD 0x0080 /* TCP window scale modulus */
#define PF_OSFP_WSCALE_DC 0x0100 /* TCP window scale dont-care */
#define PF_OSFP_MSS 0x0200 /* TCP MSS */
#define PF_OSFP_MSS_MOD 0x0400 /* TCP MSS modulus */
#define PF_OSFP_MSS_DC 0x0800 /* TCP MSS dont-care */
#define PF_OSFP_DF 0x1000 /* IPv4 don't fragment bit */
#define PF_OSFP_TS0 0x2000 /* Zero timestamp */
u_int8_t fp_optcnt; /* TCP option count */
u_int8_t fp_wscale; /* TCP window scaling */
u_int8_t fp_ttl; /* IPv4 TTL */
#define PF_OSFP_MAXTTL_OFFSET 40
/* TCP options packing */
#define PF_OSFP_TCPOPT_NOP 0x0 /* TCP NOP option */
#define PF_OSFP_TCPOPT_WSCALE 0x1 /* TCP window scaling option */
#define PF_OSFP_TCPOPT_MSS 0x2 /* TCP max segment size opt */
#define PF_OSFP_TCPOPT_SACK 0x3 /* TCP SACK OK option */
#define PF_OSFP_TCPOPT_TS 0x4 /* TCP timestamp option */
#define PF_OSFP_TCPOPT_BITS 3 /* bits used by each option */
#define PF_OSFP_MAX_OPTS \
(sizeof(((struct pf_os_fingerprint *)0)->fp_tcpopts) * 8) \
/ PF_OSFP_TCPOPT_BITS
SLIST_ENTRY(pf_os_fingerprint) fp_next;
};
struct pf_osfp_ioctl {
struct pf_osfp_entry fp_os;
pf_tcpopts_t fp_tcpopts; /* packed TCP options */
u_int16_t fp_wsize; /* TCP window size */
u_int16_t fp_psize; /* ip->ip_len */
u_int16_t fp_mss; /* TCP MSS */
u_int16_t fp_flags;
u_int8_t fp_optcnt; /* TCP option count */
u_int8_t fp_wscale; /* TCP window scaling */
u_int8_t fp_ttl; /* IPv4 TTL */
int fp_getnum; /* DIOCOSFPGET number */
};
/* The fingerprint functions can be linked into userland programs (tcpdump) */
int pf_osfp_add(struct pf_osfp_ioctl *);
struct pf_osfp_enlist *
pf_osfp_fingerprint_hdr(const struct ip_hdr *, const struct tcp_hdr *);
void pf_osfp_flush(void);
int pf_osfp_get(struct pf_osfp_ioctl *);
void pf_osfp_initialize(void);
int pf_osfp_match(struct pf_osfp_enlist *, pf_osfp_t);
struct pf_os_fingerprint *
pf_osfp_validate(void);
#endif /* _NET_PFVAR_H_ */