sys/contrib/pf/net/pf_osfp.c

   1 /*      $OpenBSD: pf_osfp.c,v 1.14 2008/06/12 18:17:01 henning Exp $ */
   2
   3 /*
   4  * Copyright (c) 2003 Mike Frantzen <frantzen@w4g.org>
   5  *
   6  * Permission to use, copy, modify, and distribute this software for any
   7  * purpose with or without fee is hereby granted, provided that the above
   8  * copyright notice and this permission notice appear in all copies.
   9  *
  10  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  11  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  12  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  13  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  14  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  15  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  16  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  17  *
  18  */
  19
  20 #ifdef __FreeBSD__
  21 #include <sys/cdefs.h>
  22 __FBSDID("$FreeBSD$");
  23 #endif
  24
  25 #include <sys/param.h>
  26 #include <sys/socket.h>
  27 #ifdef _KERNEL
  28 #include <sys/systm.h>
  29 #ifndef __FreeBSD__
  30 #include <sys/pool.h>
  31 #endif
  32 #endif /* _KERNEL */
  33 #include <sys/mbuf.h>
  34
  35 #include <netinet/in.h>
  36 #include <netinet/in_systm.h>
  37 #include <netinet/ip.h>
  38 #include <netinet/tcp.h>
  39
  40 #include <net/if.h>
  41 #include <net/pfvar.h>
  42
  43 #include <netinet/ip6.h>
  44 #ifdef _KERNEL
  45 #include <netinet6/in6_var.h>
  46 #endif
  47
  48
  49 #ifdef _KERNEL
  50 #ifdef __FreeBSD__
  51 #define DPFPRINTF(format, x...)         \
  52         if (V_pf_status.debug >= PF_DEBUG_NOISY)        \
  53                 printf(format , ##x)
  54 #else
  55 #define DPFPRINTF(format, x...)         \
  56         if (pf_status.debug >= PF_DEBUG_NOISY)  \
  57                 printf(format , ##x)
  58 #endif
  59 #ifdef __FreeBSD__
  60 typedef uma_zone_t pool_t;
  61 #else
  62 typedef struct pool pool_t;
  63 #endif
  64
  65 #else
  66 /* Userland equivalents so we can lend code to tcpdump et al. */
  67
  68 #include <arpa/inet.h>
  69 #include <errno.h>
  70 #include <stdio.h>
  71 #include <stdlib.h>
  72 #include <string.h>
  73 #include <netdb.h>
  74 #define pool_t                  int
  75 #define pool_get(pool, flags)   malloc(*(pool))
  76 #define pool_put(pool, item)    free(item)
  77 #define pool_init(pool, size, a, ao, f, m, p)   (*(pool)) = (size)
  78
  79 #ifdef __FreeBSD__
  80 #define NTOHS(x) (x) = ntohs((u_int16_t)(x))
  81 #endif
  82
  83 #ifdef PFDEBUG
  84 #include <sys/stdarg.h>
  85 #define DPFPRINTF(format, x...) fprintf(stderr, format , ##x)
  86 #else
  87 #define DPFPRINTF(format, x...) ((void)0)
  88 #endif /* PFDEBUG */
  89 #endif /* _KERNEL */
  90
  91
  92 #ifdef __FreeBSD__
  93 SLIST_HEAD(pf_osfp_list, pf_os_fingerprint);
  94 VNET_DEFINE(struct pf_osfp_list,        pf_osfp_list);
  95 #define V_pf_osfp_list                  VNET(pf_osfp_list)
  96 VNET_DEFINE(pool_t,                     pf_osfp_entry_pl);
  97 #define pf_osfp_entry_pl                VNET(pf_osfp_entry_pl)
  98 VNET_DEFINE(pool_t,                     pf_osfp_pl);
  99 #define pf_osfp_pl                      VNET(pf_osfp_pl)
 100 #else
 101 SLIST_HEAD(pf_osfp_list, pf_os_fingerprint) pf_osfp_list;
 102 pool_t pf_osfp_entry_pl;
 103 pool_t pf_osfp_pl;
 104 #endif
 105
 106 struct pf_os_fingerprint        *pf_osfp_find(struct pf_osfp_list *,
 107                                     struct pf_os_fingerprint *, u_int8_t);
 108 struct pf_os_fingerprint        *pf_osfp_find_exact(struct pf_osfp_list *,
 109                                     struct pf_os_fingerprint *);
 110 void                             pf_osfp_insert(struct pf_osfp_list *,
 111                                     struct pf_os_fingerprint *);
 112
 113
 114 #ifdef _KERNEL
 115 /*
 116  * Passively fingerprint the OS of the host (IPv4 TCP SYN packets only)
 117  * Returns the list of possible OSes.
 118  */
 119 struct pf_osfp_enlist *
 120 pf_osfp_fingerprint(struct pf_pdesc *pd, struct mbuf *m, int off,
 121     const struct tcphdr *tcp)
 122 {
 123         struct ip *ip;
 124         struct ip6_hdr *ip6;
 125         char hdr[60];
 126
 127         if ((pd->af != PF_INET && pd->af != PF_INET6) ||
 128             pd->proto != IPPROTO_TCP || (tcp->th_off << 2) < sizeof(*tcp))
 129                 return (NULL);
 130
 131         if (pd->af == PF_INET) {
 132                 ip = mtod(m, struct ip *);
 133                 ip6 = (struct ip6_hdr *)NULL;
 134         } else {
 135                 ip = (struct ip *)NULL;
 136                 ip6 = mtod(m, struct ip6_hdr *);
 137         }
 138         if (!pf_pull_hdr(m, off, hdr, tcp->th_off << 2, NULL, NULL,
 139             pd->af)) return (NULL);
 140
 141         return (pf_osfp_fingerprint_hdr(ip, ip6, (struct tcphdr *)hdr));
 142 }
 143 #endif /* _KERNEL */
 144
 145 struct pf_osfp_enlist *
 146 pf_osfp_fingerprint_hdr(const struct ip *ip, const struct ip6_hdr *ip6, const struct tcphdr *tcp)
 147 {
 148         struct pf_os_fingerprint fp, *fpresult;
 149         int cnt, optlen = 0;
 150         const u_int8_t *optp;
 151 #ifdef _KERNEL
 152         char srcname[128];
 153 #else
 154         char srcname[NI_MAXHOST];
 155 #endif
 156
 157         if ((tcp->th_flags & (TH_SYN|TH_ACK)) != TH_SYN)
 158                 return (NULL);
 159         if (ip) {
 160                 if ((ip->ip_off & htons(IP_OFFMASK)) != 0)
 161                         return (NULL);
 162         }
 163
 164         memset(&fp, 0, sizeof(fp));
 165
 166         if (ip) {
 167 #ifndef _KERNEL
 168                 struct sockaddr_in sin;
 169 #endif
 170
 171                 fp.fp_psize = ntohs(ip->ip_len);
 172                 fp.fp_ttl = ip->ip_ttl;
 173                 if (ip->ip_off & htons(IP_DF))
 174                         fp.fp_flags |= PF_OSFP_DF;
 175 #ifdef _KERNEL
 176                 strlcpy(srcname, inet_ntoa(ip->ip_src), sizeof(srcname));
 177 #else
 178                 memset(&sin, 0, sizeof(sin));
 179                 sin.sin_family = AF_INET;
 180                 sin.sin_len = sizeof(struct sockaddr_in);
 181                 sin.sin_addr = ip->ip_src;
 182                 (void)getnameinfo((struct sockaddr *)&sin,
 183                     sizeof(struct sockaddr_in), srcname, sizeof(srcname),
 184                     NULL, 0, NI_NUMERICHOST);
 185 #endif
 186         }
 187 #ifdef INET6
 188         else if (ip6) {
 189 #ifndef _KERNEL
 190                 struct sockaddr_in6 sin6;
 191 #endif
 192
 193                 /* jumbo payload? */
 194                 fp.fp_psize = sizeof(struct ip6_hdr) + ntohs(ip6->ip6_plen);
 195                 fp.fp_ttl = ip6->ip6_hlim;
 196                 fp.fp_flags |= PF_OSFP_DF;
 197                 fp.fp_flags |= PF_OSFP_INET6;
 198 #ifdef _KERNEL
 199                 strlcpy(srcname, ip6_sprintf((struct in6_addr *)&ip6->ip6_src),
 200                     sizeof(srcname));
 201 #else
 202                 memset(&sin6, 0, sizeof(sin6));
 203                 sin6.sin6_family = AF_INET6;
 204                 sin6.sin6_len = sizeof(struct sockaddr_in6);
 205                 sin6.sin6_addr = ip6->ip6_src;
 206                 (void)getnameinfo((struct sockaddr *)&sin6,
 207                     sizeof(struct sockaddr_in6), srcname, sizeof(srcname),
 208                     NULL, 0, NI_NUMERICHOST);
 209 #endif
 210         }
 211 #endif
 212         else
 213                 return (NULL);
 214         fp.fp_wsize = ntohs(tcp->th_win);
 215
 216
 217         cnt = (tcp->th_off << 2) - sizeof(*tcp);
 218         optp = (const u_int8_t *)((const char *)tcp + sizeof(*tcp));
 219         for (; cnt > 0; cnt -= optlen, optp += optlen) {
 220                 if (*optp == TCPOPT_EOL)
 221                         break;
 222
 223                 fp.fp_optcnt++;
 224                 if (*optp == TCPOPT_NOP) {
 225                         fp.fp_tcpopts = (fp.fp_tcpopts << PF_OSFP_TCPOPT_BITS) |
 226                             PF_OSFP_TCPOPT_NOP;
 227                         optlen = 1;
 228                 } else {
 229                         if (cnt < 2)
 230                                 return (NULL);
 231                         optlen = optp[1];
 232                         if (optlen > cnt || optlen < 2)
 233                                 return (NULL);
 234                         switch (*optp) {
 235                         case TCPOPT_MAXSEG:
 236                                 if (optlen >= TCPOLEN_MAXSEG)
 237                                         memcpy(&fp.fp_mss, &optp[2],
 238                                             sizeof(fp.fp_mss));
 239                                 fp.fp_tcpopts = (fp.fp_tcpopts <<
 240                                     PF_OSFP_TCPOPT_BITS) | PF_OSFP_TCPOPT_MSS;
 241                                 NTOHS(fp.fp_mss);
 242                                 break;
 243                         case TCPOPT_WINDOW:
 244                                 if (optlen >= TCPOLEN_WINDOW)
 245                                         memcpy(&fp.fp_wscale, &optp[2],
 246                                             sizeof(fp.fp_wscale));
 247                                 NTOHS(fp.fp_wscale);
 248                                 fp.fp_tcpopts = (fp.fp_tcpopts <<
 249                                     PF_OSFP_TCPOPT_BITS) |
 250                                     PF_OSFP_TCPOPT_WSCALE;
 251                                 break;
 252                         case TCPOPT_SACK_PERMITTED:
 253                                 fp.fp_tcpopts = (fp.fp_tcpopts <<
 254                                     PF_OSFP_TCPOPT_BITS) | PF_OSFP_TCPOPT_SACK;
 255                                 break;
 256                         case TCPOPT_TIMESTAMP:
 257                                 if (optlen >= TCPOLEN_TIMESTAMP) {
 258                                         u_int32_t ts;
 259                                         memcpy(&ts, &optp[2], sizeof(ts));
 260                                         if (ts == 0)
 261                                                 fp.fp_flags |= PF_OSFP_TS0;
 262
 263                                 }
 264                                 fp.fp_tcpopts = (fp.fp_tcpopts <<
 265                                     PF_OSFP_TCPOPT_BITS) | PF_OSFP_TCPOPT_TS;
 266                                 break;
 267                         default:
 268                                 return (NULL);
 269                         }
 270                 }
 271                 optlen = MAX(optlen, 1);        /* paranoia */
 272         }
 273
 274         DPFPRINTF("fingerprinted %s:%d  %d:%d:%d:%d:%llx (%d) "
 275             "(TS=%s,M=%s%d,W=%s%d)\n",
 276             srcname, ntohs(tcp->th_sport),
 277             fp.fp_wsize, fp.fp_ttl, (fp.fp_flags & PF_OSFP_DF) != 0,
 278             fp.fp_psize, (long long int)fp.fp_tcpopts, fp.fp_optcnt,
 279             (fp.fp_flags & PF_OSFP_TS0) ? "0" : "",
 280             (fp.fp_flags & PF_OSFP_MSS_MOD) ? "%" :
 281             (fp.fp_flags & PF_OSFP_MSS_DC) ? "*" : "",
 282             fp.fp_mss,
 283             (fp.fp_flags & PF_OSFP_WSCALE_MOD) ? "%" :
 284             (fp.fp_flags & PF_OSFP_WSCALE_DC) ? "*" : "",
 285             fp.fp_wscale);
 286
 287 #ifdef __FreeBSD__
 288         if ((fpresult = pf_osfp_find(&V_pf_osfp_list, &fp,
 289 #else
 290         if ((fpresult = pf_osfp_find(&pf_osfp_list, &fp,
 291 #endif
 292             PF_OSFP_MAXTTL_OFFSET)))
 293                 return (&fpresult->fp_oses);
 294         return (NULL);
 295 }
 296
 297 /* Match a fingerprint ID against a list of OSes */
 298 int
 299 pf_osfp_match(struct pf_osfp_enlist *list, pf_osfp_t os)
 300 {
 301         struct pf_osfp_entry *entry;
 302         int os_class, os_version, os_subtype;
 303         int en_class, en_version, en_subtype;
 304
 305         if (os == PF_OSFP_ANY)
 306                 return (1);
 307         if (list == NULL) {
 308                 DPFPRINTF("osfp no match against %x\n", os);
 309                 return (os == PF_OSFP_UNKNOWN);
 310         }
 311         PF_OSFP_UNPACK(os, os_class, os_version, os_subtype);
 312         SLIST_FOREACH(entry, list, fp_entry) {
 313                 PF_OSFP_UNPACK(entry->fp_os, en_class, en_version, en_subtype);
 314                 if ((os_class == PF_OSFP_ANY || en_class == os_class) &&
 315                     (os_version == PF_OSFP_ANY || en_version == os_version) &&
 316                     (os_subtype == PF_OSFP_ANY || en_subtype == os_subtype)) {
 317                         DPFPRINTF("osfp matched %s %s %s  %x==%x\n",
 318                             entry->fp_class_nm, entry->fp_version_nm,
 319                             entry->fp_subtype_nm, os, entry->fp_os);
 320                         return (1);
 321                 }
 322         }
 323         DPFPRINTF("fingerprint 0x%x didn't match\n", os);
 324         return (0);
 325 }
 326
 327 /* Initialize the OS fingerprint system */
 328 #ifdef __FreeBSD__
 329 int
 330 #else
 331 void
 332 #endif
 333 pf_osfp_initialize(void)
 334 {
 335 #if defined(__FreeBSD__) && defined(_KERNEL)
 336         int error = ENOMEM;
 337
 338         do {
 339                 pf_osfp_entry_pl = pf_osfp_pl = NULL;
 340                 UMA_CREATE(pf_osfp_entry_pl, struct pf_osfp_entry, "pfospfen");
 341                 UMA_CREATE(pf_osfp_pl, struct pf_os_fingerprint, "pfosfp");
 342                 error = 0;
 343         } while(0);
 344
 345         SLIST_INIT(&V_pf_osfp_list);
 346 #else
 347         pool_init(&pf_osfp_entry_pl, sizeof(struct pf_osfp_entry), 0, 0, 0,
 348             "pfosfpen", &pool_allocator_nointr);
 349         pool_init(&pf_osfp_pl, sizeof(struct pf_os_fingerprint), 0, 0, 0,
 350             "pfosfp", &pool_allocator_nointr);
 351         SLIST_INIT(&pf_osfp_list);
 352 #endif
 353
 354 #ifdef __FreeBSD__
 355 #ifdef _KERNEL
 356         return (error);
 357 #else
 358         return (0);
 359 #endif
 360 #endif
 361 }
 362
 363 #if defined(__FreeBSD__) && (_KERNEL)
 364 void
 365 pf_osfp_cleanup(void)
 366 {
 367
 368         UMA_DESTROY(pf_osfp_entry_pl);
 369         UMA_DESTROY(pf_osfp_pl);
 370 }
 371 #endif
 372
 373 /* Flush the fingerprint list */
 374 void
 375 pf_osfp_flush(void)
 376 {
 377         struct pf_os_fingerprint *fp;
 378         struct pf_osfp_entry *entry;
 379
 380 #ifdef __FreeBSD__
 381         while ((fp = SLIST_FIRST(&V_pf_osfp_list))) {
 382                 SLIST_REMOVE_HEAD(&V_pf_osfp_list, fp_next);
 383 #else
 384         while ((fp = SLIST_FIRST(&pf_osfp_list))) {
 385                 SLIST_REMOVE_HEAD(&pf_osfp_list, fp_next);
 386 #endif
 387                 while ((entry = SLIST_FIRST(&fp->fp_oses))) {
 388                         SLIST_REMOVE_HEAD(&fp->fp_oses, fp_entry);
 389                         pool_put(&pf_osfp_entry_pl, entry);
 390                 }
 391                 pool_put(&pf_osfp_pl, fp);
 392         }
 393 }
 394
 395
 396 /* Add a fingerprint */
 397 int
 398 pf_osfp_add(struct pf_osfp_ioctl *fpioc)
 399 {
 400         struct pf_os_fingerprint *fp, fpadd;
 401         struct pf_osfp_entry *entry;
 402
 403         memset(&fpadd, 0, sizeof(fpadd));
 404         fpadd.fp_tcpopts = fpioc->fp_tcpopts;
 405         fpadd.fp_wsize = fpioc->fp_wsize;
 406         fpadd.fp_psize = fpioc->fp_psize;
 407         fpadd.fp_mss = fpioc->fp_mss;
 408         fpadd.fp_flags = fpioc->fp_flags;
 409         fpadd.fp_optcnt = fpioc->fp_optcnt;
 410         fpadd.fp_wscale = fpioc->fp_wscale;
 411         fpadd.fp_ttl = fpioc->fp_ttl;
 412
 413 #if 0   /* XXX RYAN wants to fix logging */
 414         DPFPRINTF("adding osfp %s %s %s = %s%d:%d:%d:%s%d:0x%llx %d "
 415             "(TS=%s,M=%s%d,W=%s%d) %x\n",
 416             fpioc->fp_os.fp_class_nm, fpioc->fp_os.fp_version_nm,
 417             fpioc->fp_os.fp_subtype_nm,
 418             (fpadd.fp_flags & PF_OSFP_WSIZE_MOD) ? "%" :
 419             (fpadd.fp_flags & PF_OSFP_WSIZE_MSS) ? "S" :
 420             (fpadd.fp_flags & PF_OSFP_WSIZE_MTU) ? "T" :
 421             (fpadd.fp_flags & PF_OSFP_WSIZE_DC) ? "*" : "",
 422             fpadd.fp_wsize,
 423             fpadd.fp_ttl,
 424             (fpadd.fp_flags & PF_OSFP_DF) ? 1 : 0,
 425             (fpadd.fp_flags & PF_OSFP_PSIZE_MOD) ? "%" :
 426             (fpadd.fp_flags & PF_OSFP_PSIZE_DC) ? "*" : "",
 427             fpadd.fp_psize,
 428             (long long int)fpadd.fp_tcpopts, fpadd.fp_optcnt,
 429             (fpadd.fp_flags & PF_OSFP_TS0) ? "0" : "",
 430             (fpadd.fp_flags & PF_OSFP_MSS_MOD) ? "%" :
 431             (fpadd.fp_flags & PF_OSFP_MSS_DC) ? "*" : "",
 432             fpadd.fp_mss,
 433             (fpadd.fp_flags & PF_OSFP_WSCALE_MOD) ? "%" :
 434             (fpadd.fp_flags & PF_OSFP_WSCALE_DC) ? "*" : "",
 435             fpadd.fp_wscale,
 436             fpioc->fp_os.fp_os);
 437 #endif
 438
 439 #ifdef __FreeBSD__
 440         if ((fp = pf_osfp_find_exact(&V_pf_osfp_list, &fpadd))) {
 441 #else
 442         if ((fp = pf_osfp_find_exact(&pf_osfp_list, &fpadd))) {
 443 #endif
 444                  SLIST_FOREACH(entry, &fp->fp_oses, fp_entry) {
 445                         if (PF_OSFP_ENTRY_EQ(entry, &fpioc->fp_os))
 446                                 return (EEXIST);
 447                 }
 448                 if ((entry = pool_get(&pf_osfp_entry_pl,
 449 #ifdef __FreeBSD__
 450                     PR_NOWAIT)) == NULL)
 451 #else
 452                     PR_WAITOK|PR_LIMITFAIL)) == NULL)
 453 #endif
 454                         return (ENOMEM);
 455         } else {
 456                 if ((fp = pool_get(&pf_osfp_pl,
 457 #ifdef __FreeBSD__
 458                     PR_NOWAIT)) == NULL)
 459 #else
 460                     PR_WAITOK|PR_LIMITFAIL)) == NULL)
 461 #endif
 462                         return (ENOMEM);
 463                 memset(fp, 0, sizeof(*fp));
 464                 fp->fp_tcpopts = fpioc->fp_tcpopts;
 465                 fp->fp_wsize = fpioc->fp_wsize;
 466                 fp->fp_psize = fpioc->fp_psize;
 467                 fp->fp_mss = fpioc->fp_mss;
 468                 fp->fp_flags = fpioc->fp_flags;
 469                 fp->fp_optcnt = fpioc->fp_optcnt;
 470                 fp->fp_wscale = fpioc->fp_wscale;
 471                 fp->fp_ttl = fpioc->fp_ttl;
 472                 SLIST_INIT(&fp->fp_oses);
 473                 if ((entry = pool_get(&pf_osfp_entry_pl,
 474 #ifdef __FreeBSD__
 475                     PR_NOWAIT)) == NULL) {
 476 #else
 477                     PR_WAITOK|PR_LIMITFAIL)) == NULL) {
 478 #endif
 479                         pool_put(&pf_osfp_pl, fp);
 480                         return (ENOMEM);
 481                 }
 482 #ifdef __FreeBSD__
 483                 pf_osfp_insert(&V_pf_osfp_list, fp);
 484 #else
 485                 pf_osfp_insert(&pf_osfp_list, fp);
 486 #endif
 487         }
 488         memcpy(entry, &fpioc->fp_os, sizeof(*entry));
 489
 490         /* Make sure the strings are NUL terminated */
 491         entry->fp_class_nm[sizeof(entry->fp_class_nm)-1] = '\0';
 492         entry->fp_version_nm[sizeof(entry->fp_version_nm)-1] = '\0';
 493         entry->fp_subtype_nm[sizeof(entry->fp_subtype_nm)-1] = '\0';
 494
 495         SLIST_INSERT_HEAD(&fp->fp_oses, entry, fp_entry);
 496
 497 #ifdef PFDEBUG
 498         if ((fp = pf_osfp_validate()))
 499                 printf("Invalid fingerprint list\n");
 500 #endif /* PFDEBUG */
 501         return (0);
 502 }
 503
 504
 505 /* Find a fingerprint in the list */
 506 struct pf_os_fingerprint *
 507 pf_osfp_find(struct pf_osfp_list *list, struct pf_os_fingerprint *find,
 508     u_int8_t ttldiff)
 509 {
 510         struct pf_os_fingerprint *f;
 511
 512 #define MATCH_INT(_MOD, _DC, _field)                                    \
 513         if ((f->fp_flags & _DC) == 0) {                                 \
 514                 if ((f->fp_flags & _MOD) == 0) {                        \
 515                         if (f->_field != find->_field)                  \
 516                                 continue;                               \
 517                 } else {                                                \
 518                         if (f->_field == 0 || find->_field % f->_field) \
 519                                 continue;                               \
 520                 }                                                       \
 521         }
 522
 523         SLIST_FOREACH(f, list, fp_next) {
 524                 if (f->fp_tcpopts != find->fp_tcpopts ||
 525                     f->fp_optcnt != find->fp_optcnt ||
 526                     f->fp_ttl < find->fp_ttl ||
 527                     f->fp_ttl - find->fp_ttl > ttldiff ||
 528                     (f->fp_flags & (PF_OSFP_DF|PF_OSFP_TS0)) !=
 529                     (find->fp_flags & (PF_OSFP_DF|PF_OSFP_TS0)))
 530                         continue;
 531
 532                 MATCH_INT(PF_OSFP_PSIZE_MOD, PF_OSFP_PSIZE_DC, fp_psize)
 533                 MATCH_INT(PF_OSFP_MSS_MOD, PF_OSFP_MSS_DC, fp_mss)
 534                 MATCH_INT(PF_OSFP_WSCALE_MOD, PF_OSFP_WSCALE_DC, fp_wscale)
 535                 if ((f->fp_flags & PF_OSFP_WSIZE_DC) == 0) {
 536                         if (f->fp_flags & PF_OSFP_WSIZE_MSS) {
 537                                 if (find->fp_mss == 0)
 538                                         continue;
 539
 540 /*
 541  * Some "smart" NAT devices and DSL routers will tweak the MSS size and
 542  * will set it to whatever is suitable for the link type.
 543  */
 544 #define SMART_MSS       1460
 545                                 if ((find->fp_wsize % find->fp_mss ||
 546                                     find->fp_wsize / find->fp_mss !=
 547                                     f->fp_wsize) &&
 548                                     (find->fp_wsize % SMART_MSS ||
 549                                     find->fp_wsize / SMART_MSS !=
 550                                     f->fp_wsize))
 551                                         continue;
 552                         } else if (f->fp_flags & PF_OSFP_WSIZE_MTU) {
 553                                 if (find->fp_mss == 0)
 554                                         continue;
 555
 556 #define MTUOFF          (sizeof(struct ip) + sizeof(struct tcphdr))
 557 #define SMART_MTU       (SMART_MSS + MTUOFF)
 558                                 if ((find->fp_wsize % (find->fp_mss + MTUOFF) ||
 559                                     find->fp_wsize / (find->fp_mss + MTUOFF) !=
 560                                     f->fp_wsize) &&
 561                                     (find->fp_wsize % SMART_MTU ||
 562                                     find->fp_wsize / SMART_MTU !=
 563                                     f->fp_wsize))
 564                                         continue;
 565                         } else if (f->fp_flags & PF_OSFP_WSIZE_MOD) {
 566                                 if (f->fp_wsize == 0 || find->fp_wsize %
 567                                     f->fp_wsize)
 568                                         continue;
 569                         } else {
 570                                 if (f->fp_wsize != find->fp_wsize)
 571                                         continue;
 572                         }
 573                 }
 574                 return (f);
 575         }
 576
 577         return (NULL);
 578 }
 579
 580 /* Find an exact fingerprint in the list */
 581 struct pf_os_fingerprint *
 582 pf_osfp_find_exact(struct pf_osfp_list *list, struct pf_os_fingerprint *find)
 583 {
 584         struct pf_os_fingerprint *f;
 585
 586         SLIST_FOREACH(f, list, fp_next) {
 587                 if (f->fp_tcpopts == find->fp_tcpopts &&
 588                     f->fp_wsize == find->fp_wsize &&
 589                     f->fp_psize == find->fp_psize &&
 590                     f->fp_mss == find->fp_mss &&
 591                     f->fp_flags == find->fp_flags &&
 592                     f->fp_optcnt == find->fp_optcnt &&
 593                     f->fp_wscale == find->fp_wscale &&
 594                     f->fp_ttl == find->fp_ttl)
 595                         return (f);
 596         }
 597
 598         return (NULL);
 599 }
 600
 601 /* Insert a fingerprint into the list */
 602 void
 603 pf_osfp_insert(struct pf_osfp_list *list, struct pf_os_fingerprint *ins)
 604 {
 605         struct pf_os_fingerprint *f, *prev = NULL;
 606
 607         /* XXX need to go semi tree based.  can key on tcp options */
 608
 609         SLIST_FOREACH(f, list, fp_next)
 610                 prev = f;
 611         if (prev)
 612                 SLIST_INSERT_AFTER(prev, ins, fp_next);
 613         else
 614                 SLIST_INSERT_HEAD(list, ins, fp_next);
 615 }
 616
 617 /* Fill a fingerprint by its number (from an ioctl) */
 618 int
 619 pf_osfp_get(struct pf_osfp_ioctl *fpioc)
 620 {
 621         struct pf_os_fingerprint *fp;
 622         struct pf_osfp_entry *entry;
 623         int num = fpioc->fp_getnum;
 624         int i = 0;
 625
 626
 627         memset(fpioc, 0, sizeof(*fpioc));
 628 #ifdef __FreeBSD__
 629         SLIST_FOREACH(fp, &V_pf_osfp_list, fp_next) {
 630 #else
 631         SLIST_FOREACH(fp, &pf_osfp_list, fp_next) {
 632 #endif
 633                 SLIST_FOREACH(entry, &fp->fp_oses, fp_entry) {
 634                         if (i++ == num) {
 635                                 fpioc->fp_mss = fp->fp_mss;
 636                                 fpioc->fp_wsize = fp->fp_wsize;
 637                                 fpioc->fp_flags = fp->fp_flags;
 638                                 fpioc->fp_psize = fp->fp_psize;
 639                                 fpioc->fp_ttl = fp->fp_ttl;
 640                                 fpioc->fp_wscale = fp->fp_wscale;
 641                                 fpioc->fp_getnum = num;
 642                                 memcpy(&fpioc->fp_os, entry,
 643                                     sizeof(fpioc->fp_os));
 644                                 return (0);
 645                         }
 646                 }
 647         }
 648
 649         return (EBUSY);
 650 }
 651
 652
 653 /* Validate that each signature is reachable */
 654 struct pf_os_fingerprint *
 655 pf_osfp_validate(void)
 656 {
 657         struct pf_os_fingerprint *f, *f2, find;
 658
 659 #ifdef __FreeBSD__
 660         SLIST_FOREACH(f, &V_pf_osfp_list, fp_next) {
 661 #else
 662         SLIST_FOREACH(f, &pf_osfp_list, fp_next) {
 663 #endif
 664                 memcpy(&find, f, sizeof(find));
 665
 666                 /* We do a few MSS/th_win percolations to make things unique */
 667                 if (find.fp_mss == 0)
 668                         find.fp_mss = 128;
 669                 if (f->fp_flags & PF_OSFP_WSIZE_MSS)
 670                         find.fp_wsize *= find.fp_mss;
 671                 else if (f->fp_flags & PF_OSFP_WSIZE_MTU)
 672                         find.fp_wsize *= (find.fp_mss + 40);
 673                 else if (f->fp_flags & PF_OSFP_WSIZE_MOD)
 674                         find.fp_wsize *= 2;
 675 #ifdef __FreeBSD__
 676                 if (f != (f2 = pf_osfp_find(&V_pf_osfp_list, &find, 0))) {
 677 #else
 678                 if (f != (f2 = pf_osfp_find(&pf_osfp_list, &find, 0))) {
 679 #endif
 680                         if (f2)
 681                                 printf("Found \"%s %s %s\" instead of "
 682                                     "\"%s %s %s\"\n",
 683                                     SLIST_FIRST(&f2->fp_oses)->fp_class_nm,
 684                                     SLIST_FIRST(&f2->fp_oses)->fp_version_nm,
 685                                     SLIST_FIRST(&f2->fp_oses)->fp_subtype_nm,
 686                                     SLIST_FIRST(&f->fp_oses)->fp_class_nm,
 687                                     SLIST_FIRST(&f->fp_oses)->fp_version_nm,
 688                                     SLIST_FIRST(&f->fp_oses)->fp_subtype_nm);
 689                         else
 690                                 printf("Couldn't find \"%s %s %s\"\n",
 691                                     SLIST_FIRST(&f->fp_oses)->fp_class_nm,
 692                                     SLIST_FIRST(&f->fp_oses)->fp_version_nm,
 693                                     SLIST_FIRST(&f->fp_oses)->fp_subtype_nm);
 694                         return (f);
 695                 }
 696         }
 697         return (NULL);
 698 }