History

netfilter: extract Passive OS fingerprint infrastructure from xt_osf

Add nf_osf_ttl() and nf_osf_match() into nf_osf.c to prepare for nf_tables support.

Fernando Fernandez Mancera committed 8 years ago

Commit bfb15f21 parent 3f9c56a7 files · +359 −289Browse files

Showing the changes to include/uapi/linux/netfilter (2 of 7 files). Show all

Unified · Split

2 files
  1. include/uapi/linux/netfilter/nf_osf.h +90 −0
  2. include/uapi/linux/netfilter/xt_osf.h +17 −89
include/uapi/linux/netfilter/nf_osf.h+90−0
@@ -0,0 +1,90 @@
1+#ifndef _NF_OSF_H
2+#define _NF_OSF_H
3+
4+#define MAXGENRELEN 32
5+
6+#define NF_OSF_GENRE (1 << 0)
7+#define NF_OSF_TTL (1 << 1)
8+#define NF_OSF_LOG (1 << 2)
9+#define NF_OSF_INVERT (1 << 3)
10+
11+#define NF_OSF_LOGLEVEL_ALL 0 /* log all matched fingerprints */
12+#define NF_OSF_LOGLEVEL_FIRST 1 /* log only the first matced fingerprint */
13+#define NF_OSF_LOGLEVEL_ALL_KNOWN 2 /* do not log unknown packets */
14+
15+#define NF_OSF_TTL_TRUE 0 /* True ip and fingerprint TTL comparison */
16+
17+/* Do not compare ip and fingerprint TTL at all */
18+#define NF_OSF_TTL_NOCHECK 2
19+
20+/* Wildcard MSS (kind of).
21+ * It is used to implement a state machine for the different wildcard values
22+ * of the MSS and window sizes.
23+ */
24+struct nf_osf_wc {
25+ __u32 wc;
26+ __u32 val;
27+};
28+
29+/* This struct represents IANA options
30+ * http://www.iana.org/assignments/tcp-parameters
31+ */
32+struct nf_osf_opt {
33+ __u16 kind, length;
34+ struct nf_osf_wc wc;
35+};
36+
37+struct nf_osf_info {
38+ char genre[MAXGENRELEN];
39+ __u32 len;
40+ __u32 flags;
41+ __u32 loglevel;
42+ __u32 ttl;
43+};
44+
45+struct nf_osf_user_finger {
46+ struct nf_osf_wc wss;
47+
48+ __u8 ttl, df;
49+ __u16 ss, mss;
50+ __u16 opt_num;
51+
52+ char genre[MAXGENRELEN];
53+ char version[MAXGENRELEN];
54+ char subtype[MAXGENRELEN];
55+
56+ /* MAX_IPOPTLEN is maximum if all options are NOPs or EOLs */
57+ struct nf_osf_opt opt[MAX_IPOPTLEN];
58+};
59+
60+struct nf_osf_finger {
61+ struct rcu_head rcu_head;
62+ struct list_head finger_entry;
63+ struct nf_osf_user_finger finger;
64+};
65+
66+struct nf_osf_nlmsg {
67+ struct nf_osf_user_finger f;
68+ struct iphdr ip;
69+ struct tcphdr tcp;
70+};
71+
72+/* Defines for IANA option kinds */
73+enum iana_options {
74+ OSFOPT_EOL = 0, /* End of options */
75+ OSFOPT_NOP, /* NOP */
76+ OSFOPT_MSS, /* Maximum segment size */
77+ OSFOPT_WSO, /* Window scale option */
78+ OSFOPT_SACKP, /* SACK permitted */
79+ OSFOPT_SACK, /* SACK */
80+ OSFOPT_ECHO,
81+ OSFOPT_ECHOREPLY,
82+ OSFOPT_TS, /* Timestamp option */
83+ OSFOPT_POCP, /* Partial Order Connection Permitted */
84+ OSFOPT_POSP, /* Partial Order Service Profile */
85+
86+ /* Others are not used in the current OSF */
87+ OSFOPT_EMPTY = 255,
88+};
89+
90+#endif /* _NF_OSF_H */
include/uapi/linux/netfilter/xt_osf.h+17−89
@@ -23,101 +23,29 @@ · 22 unmodified lines
2323 #include <linux/types.h>
2424 #include <linux/ip.h>
2525 #include <linux/tcp.h>
26+#include <linux/netfilter/nf_osf.h>
2627
27−#define MAXGENRELEN 32
28+#define XT_OSF_GENRE NF_OSF_GENRE
29+#define XT_OSF_INVERT NF_OSF_INVERT
2830
29−#define XT_OSF_GENRE (1<<0)
30−#define XT_OSF_TTL (1<<1)
31−#define XT_OSF_LOG (1<<2)
32−#define XT_OSF_INVERT (1<<3)
31+#define XT_OSF_TTL NF_OSF_TTL
32+#define XT_OSF_LOG NF_OSF_LOG
3333
34−#define XT_OSF_LOGLEVEL_ALL 0 /* log all matched fingerprints */
35−#define XT_OSF_LOGLEVEL_FIRST 1 /* log only the first matced fingerprint */
36−#define XT_OSF_LOGLEVEL_ALL_KNOWN 2 /* do not log unknown packets */
34+#define XT_OSF_LOGLEVEL_ALL NF_OSF_LOGLEVEL_ALL
35+#define XT_OSF_LOGLEVEL_FIRST NF_OSF_LOGLEVEL_FIRST
36+#define XT_OSF_LOGLEVEL_ALL_KNOWN NF_OSF_LOGLEVEL_ALL_KNOWN
3737
38−#define XT_OSF_TTL_TRUE 0 /* True ip and fingerprint TTL comparison */
39−#define XT_OSF_TTL_LESS 1 /* Check if ip TTL is less than fingerprint one */
40−#define XT_OSF_TTL_NOCHECK 2 /* Do not compare ip and fingerprint TTL at all */
38+#define XT_OSF_TTL_TRUE NF_OSF_TTL_TRUE
39+#define XT_OSF_TTL_NOCHECK NF_OSF_TTL_NOCHECK
4140
42−struct xt_osf_info {
43− char genre[MAXGENRELEN];
44− __u32 len;
45− __u32 flags;
46− __u32 loglevel;
47− __u32 ttl;
48−};
49−
50−/*
51− * Wildcard MSS (kind of).
52− * It is used to implement a state machine for the different wildcard values
53− * of the MSS and window sizes.
54− */
55−struct xt_osf_wc {
56− __u32 wc;
57− __u32 val;
58−};
59−
60−/*
61− * This struct represents IANA options
62− * http://www.iana.org/assignments/tcp-parameters
63− */
64−struct xt_osf_opt {
65− __u16 kind, length;
66− struct xt_osf_wc wc;
67−};
68−
69−struct xt_osf_user_finger {
70− struct xt_osf_wc wss;
71−
72− __u8 ttl, df;
73− __u16 ss, mss;
74− __u16 opt_num;
75−
76− char genre[MAXGENRELEN];
77− char version[MAXGENRELEN];
78− char subtype[MAXGENRELEN];
41+#define XT_OSF_TTL_LESS 1 /* Check if ip TTL is less than fingerprint one */
7942
80− /* MAX_IPOPTLEN is maximum if all options are NOPs or EOLs */
81− struct xt_osf_opt opt[MAX_IPOPTLEN];
82−};
83−
84−struct xt_osf_nlmsg {
85− struct xt_osf_user_finger f;
86− struct iphdr ip;
87− struct tcphdr tcp;
88−};
89−
90−/* Defines for IANA option kinds */
91−
92−enum iana_options {
93− OSFOPT_EOL = 0, /* End of options */
94− OSFOPT_NOP, /* NOP */
95− OSFOPT_MSS, /* Maximum segment size */
96− OSFOPT_WSO, /* Window scale option */
97− OSFOPT_SACKP, /* SACK permitted */
98− OSFOPT_SACK, /* SACK */
99− OSFOPT_ECHO,
100− OSFOPT_ECHOREPLY,
101− OSFOPT_TS, /* Timestamp option */
102− OSFOPT_POCP, /* Partial Order Connection Permitted */
103− OSFOPT_POSP, /* Partial Order Service Profile */
104−
105− /* Others are not used in the current OSF */
106− OSFOPT_EMPTY = 255,
107−};
108−
109−/*
110− * Initial window size option state machine: multiple of mss, mtu or
111− * plain numeric value. Can also be made as plain numeric value which
112− * is not a multiple of specified value.
113− */
114−enum xt_osf_window_size_options {
115− OSF_WSS_PLAIN = 0,
116− OSF_WSS_MSS,
117− OSF_WSS_MTU,
118− OSF_WSS_MODULO,
119− OSF_WSS_MAX,
120−};
43+#define xt_osf_wc nf_osf_wc
44+#define xt_osf_opt nf_osf_opt
45+#define xt_osf_info nf_osf_info
46+#define xt_osf_user_finger nf_osf_user_finger
47+#define xt_osf_finger nf_osf_finger
48+#define xt_osf_nlmsg nf_osf_nlmsg
12149
12250 /*
12351 * Add/remove fingerprint from the kernel.