netfilter: extract Passive OS fingerprint infrastructure from xt_osf

Add nf_osf_ttl() and nf_osf_match() into nf_osf.c to prepare for nf_tables support.

Fernando Fernandez Mancera committed 8 years ago

Commit bfb15f21 parent 3f9c56a7 files · +359 −289Browse files

Showing the changes to include/uapi/linux/netfilter (2 of 7 files). Show all

Unified · Split

2 files

include/uapi/linux/netfilter/nf_osf.h +90 −0
include/uapi/linux/netfilter/xt_osf.h +17 −89

include/uapi/linux/netfilter/nf_osf.h+90−0

@@ -0,0 +1,90 @@
	1	#ifndef _NF_OSF_H
	2	#define _NF_OSF_H
	3
	4	#define MAXGENRELEN 32
	5
	6	#define NF_OSF_GENRE (1 << 0)
	7	#define NF_OSF_TTL (1 << 1)
	8	#define NF_OSF_LOG (1 << 2)
	9	#define NF_OSF_INVERT (1 << 3)
	10
	11	#define NF_OSF_LOGLEVEL_ALL 0 /* log all matched fingerprints */
	12	#define NF_OSF_LOGLEVEL_FIRST 1 /* log only the first matced fingerprint */
	13	#define NF_OSF_LOGLEVEL_ALL_KNOWN 2 /* do not log unknown packets */
	14
	15	#define NF_OSF_TTL_TRUE 0 /* True ip and fingerprint TTL comparison */
	16
	17	/* Do not compare ip and fingerprint TTL at all */
	18	#define NF_OSF_TTL_NOCHECK 2
	19
	20	/* Wildcard MSS (kind of).
	21	* It is used to implement a state machine for the different wildcard values
	22	* of the MSS and window sizes.
	23	*/
	24	struct nf_osf_wc {
	25	__u32 wc;
	26	__u32 val;
	27	};
	28
	29	/* This struct represents IANA options
	30	* http://www.iana.org/assignments/tcp-parameters
	31	*/
	32	struct nf_osf_opt {
	33	__u16 kind, length;
	34	struct nf_osf_wc wc;
	35	};
	36
	37	struct nf_osf_info {
	38	char genre[MAXGENRELEN];
	39	__u32 len;
	40	__u32 flags;
	41	__u32 loglevel;
	42	__u32 ttl;
	43	};
	44
	45	struct nf_osf_user_finger {
	46	struct nf_osf_wc wss;
	47
	48	__u8 ttl, df;
	49	__u16 ss, mss;
	50	__u16 opt_num;
	51
	52	char genre[MAXGENRELEN];
	53	char version[MAXGENRELEN];
	54	char subtype[MAXGENRELEN];
	55
	56	/* MAX_IPOPTLEN is maximum if all options are NOPs or EOLs */
	57	struct nf_osf_opt opt[MAX_IPOPTLEN];
	58	};
	59
	60	struct nf_osf_finger {
	61	struct rcu_head rcu_head;
	62	struct list_head finger_entry;
	63	struct nf_osf_user_finger finger;
	64	};
	65
	66	struct nf_osf_nlmsg {
	67	struct nf_osf_user_finger f;
	68	struct iphdr ip;
	69	struct tcphdr tcp;
	70	};
	71
	72	/* Defines for IANA option kinds */
	73	enum iana_options {
	74	OSFOPT_EOL = 0, /* End of options */
	75	OSFOPT_NOP, /* NOP */
	76	OSFOPT_MSS, /* Maximum segment size */
	77	OSFOPT_WSO, /* Window scale option */
	78	OSFOPT_SACKP, /* SACK permitted */
	79	OSFOPT_SACK, /* SACK */
	80	OSFOPT_ECHO,
	81	OSFOPT_ECHOREPLY,
	82	OSFOPT_TS, /* Timestamp option */
	83	OSFOPT_POCP, /* Partial Order Connection Permitted */
	84	OSFOPT_POSP, /* Partial Order Service Profile */
	85
	86	/* Others are not used in the current OSF */
	87	OSFOPT_EMPTY = 255,
	88	};
	89
	90	#endif /* _NF_OSF_H */

include/uapi/linux/netfilter/xt_osf.h+17−89

@@ -23,101 +23,29 @@ · 22 unmodified lines
23	#include <linux/types.h>	23	#include <linux/types.h>
24	#include <linux/ip.h>	24	#include <linux/ip.h>
25	#include <linux/tcp.h>	25	#include <linux/tcp.h>
		26	#include <linux/netfilter/nf_osf.h>
26		27
27	#define MAXGENRELEN 32	28	#define XT_OSF_GENRE NF_OSF_GENRE
		29	#define XT_OSF_INVERT NF_OSF_INVERT
28		30
29	#define XT_OSF_GENRE (1<<0)	31	#define XT_OSF_TTL NF_OSF_TTL
30	#define XT_OSF_TTL (1<<1)	32	#define XT_OSF_LOG NF_OSF_LOG
31	#define XT_OSF_LOG (1<<2)
32	#define XT_OSF_INVERT (1<<3)
33		33
34	#define XT_OSF_LOGLEVEL_ALL 0 /* log all matched fingerprints */	34	#define XT_OSF_LOGLEVEL_ALL NF_OSF_LOGLEVEL_ALL
35	#define XT_OSF_LOGLEVEL_FIRST 1 /* log only the first matced fingerprint */	35	#define XT_OSF_LOGLEVEL_FIRST NF_OSF_LOGLEVEL_FIRST
36	#define XT_OSF_LOGLEVEL_ALL_KNOWN 2 /* do not log unknown packets */	36	#define XT_OSF_LOGLEVEL_ALL_KNOWN NF_OSF_LOGLEVEL_ALL_KNOWN
37		37
38	#define XT_OSF_TTL_TRUE 0 /* True ip and fingerprint TTL comparison */	38	#define XT_OSF_TTL_TRUE NF_OSF_TTL_TRUE
39	#define XT_OSF_TTL_LESS 1 /* Check if ip TTL is less than fingerprint one */	39	#define XT_OSF_TTL_NOCHECK NF_OSF_TTL_NOCHECK
40	#define XT_OSF_TTL_NOCHECK 2 /* Do not compare ip and fingerprint TTL at all */
41		40
42	struct xt_osf_info {	41	#define XT_OSF_TTL_LESS 1 /* Check if ip TTL is less than fingerprint one */
43	char genre[MAXGENRELEN];
44	__u32 len;
45	__u32 flags;
46	__u32 loglevel;
47	__u32 ttl;
48	};
49
50	/*
51	* Wildcard MSS (kind of).
52	* It is used to implement a state machine for the different wildcard values
53	* of the MSS and window sizes.
54	*/
55	struct xt_osf_wc {
56	__u32 wc;
57	__u32 val;
58	};
59
60	/*
61	* This struct represents IANA options
62	* http://www.iana.org/assignments/tcp-parameters
63	*/
64	struct xt_osf_opt {
65	__u16 kind, length;
66	struct xt_osf_wc wc;
67	};
68
69	struct xt_osf_user_finger {
70	struct xt_osf_wc wss;
71
72	__u8 ttl, df;
73	__u16 ss, mss;
74	__u16 opt_num;
75
76	char genre[MAXGENRELEN];
77	char version[MAXGENRELEN];
78	char subtype[MAXGENRELEN];
79		42
80	/* MAX_IPOPTLEN is maximum if all options are NOPs or EOLs */	43	#define xt_osf_wc nf_osf_wc
81	struct xt_osf_opt opt[MAX_IPOPTLEN];	44	#define xt_osf_opt nf_osf_opt
82	};	45	#define xt_osf_info nf_osf_info
83		46	#define xt_osf_user_finger nf_osf_user_finger
84	struct xt_osf_nlmsg {	47	#define xt_osf_finger nf_osf_finger
85	struct xt_osf_user_finger f;	48	#define xt_osf_nlmsg nf_osf_nlmsg
86	struct iphdr ip;
87	struct tcphdr tcp;
88	};
89
90	/* Defines for IANA option kinds */
91
92	enum iana_options {
93	OSFOPT_EOL = 0, /* End of options */
94	OSFOPT_NOP, /* NOP */
95	OSFOPT_MSS, /* Maximum segment size */
96	OSFOPT_WSO, /* Window scale option */
97	OSFOPT_SACKP, /* SACK permitted */
98	OSFOPT_SACK, /* SACK */
99	OSFOPT_ECHO,
100	OSFOPT_ECHOREPLY,
101	OSFOPT_TS, /* Timestamp option */
102	OSFOPT_POCP, /* Partial Order Connection Permitted */
103	OSFOPT_POSP, /* Partial Order Service Profile */
104
105	/* Others are not used in the current OSF */
106	OSFOPT_EMPTY = 255,
107	};
108
109	/*
110	* Initial window size option state machine: multiple of mss, mtu or
111	* plain numeric value. Can also be made as plain numeric value which
112	* is not a multiple of specified value.
113	*/
114	enum xt_osf_window_size_options {
115	OSF_WSS_PLAIN = 0,
116	OSF_WSS_MSS,
117	OSF_WSS_MTU,
118	OSF_WSS_MODULO,
119	OSF_WSS_MAX,
120	};
121		49
122	/*	50	/*
123	* Add/remove fingerprint from the kernel.	51	* Add/remove fingerprint from the kernel.