[mirror_ubuntu-artful-kernel.git] / net / netfilter / xt_osf.c

/*
 * Copyright (c) 2003+ Evgeniy Polyakov <zbr@ioremap.net>
 *
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 2 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, see <http://www.gnu.org/licenses/>.
 */
#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
#include <linux/module.h>
#include <linux/kernel.h>

#include <linux/if.h>
#include <linux/inetdevice.h>
#include <linux/ip.h>
#include <linux/list.h>
#include <linux/rculist.h>
#include <linux/skbuff.h>
#include <linux/slab.h>
#include <linux/tcp.h>

#include <net/ip.h>
#include <net/tcp.h>

#include <linux/netfilter/nfnetlink.h>
#include <linux/netfilter/x_tables.h>
#include <net/netfilter/nf_log.h>
#include <linux/netfilter/xt_osf.h>

struct xt_osf_finger {
	struct rcu_head			rcu_head;
	struct list_head		finger_entry;
	struct xt_osf_user_finger	finger;
};

enum osf_fmatch_states {
	/* Packet does not match the fingerprint */
	FMATCH_WRONG = 0,
	/* Packet matches the fingerprint */
	FMATCH_OK,
	/* Options do not match the fingerprint, but header does */
	FMATCH_OPT_WRONG,
};

/*
 * Indexed by dont-fragment bit.
 * It is the only constant value in the fingerprint.
 */
static struct list_head xt_osf_fingers[2];

static const struct nla_policy xt_osf_policy[OSF_ATTR_MAX + 1] = {
	[OSF_ATTR_FINGER]	= { .len = sizeof(struct xt_osf_user_finger) },
};

static int xt_osf_add_callback(struct net *net, struct sock *ctnl,
			       struct sk_buff *skb, const struct nlmsghdr *nlh,
			       const struct nlattr * const osf_attrs[],
			       struct netlink_ext_ack *extack)
{
	struct xt_osf_user_finger *f;
	struct xt_osf_finger *kf = NULL, *sf;
	int err = 0;

	if (!osf_attrs[OSF_ATTR_FINGER])
		return -EINVAL;

	if (!(nlh->nlmsg_flags & NLM_F_CREATE))
		return -EINVAL;

	f = nla_data(osf_attrs[OSF_ATTR_FINGER]);

	kf = kmalloc(sizeof(struct xt_osf_finger), GFP_KERNEL);
	if (!kf)
		return -ENOMEM;

	memcpy(&kf->finger, f, sizeof(struct xt_osf_user_finger));

	list_for_each_entry(sf, &xt_osf_fingers[!!f->df], finger_entry) {
		if (memcmp(&sf->finger, f, sizeof(struct xt_osf_user_finger)))
			continue;

		kfree(kf);
		kf = NULL;

		if (nlh->nlmsg_flags & NLM_F_EXCL)
			err = -EEXIST;
		break;
	}

	/*
	 * We are protected by nfnl mutex.
	 */
	if (kf)
		list_add_tail_rcu(&kf->finger_entry, &xt_osf_fingers[!!f->df]);

	return err;
}

static int xt_osf_remove_callback(struct net *net, struct sock *ctnl,
				  struct sk_buff *skb,
				  const struct nlmsghdr *nlh,
				  const struct nlattr * const osf_attrs[],
				  struct netlink_ext_ack *extack)
{
	struct xt_osf_user_finger *f;
	struct xt_osf_finger *sf;
	int err = -ENOENT;

	if (!osf_attrs[OSF_ATTR_FINGER])
		return -EINVAL;

	f = nla_data(osf_attrs[OSF_ATTR_FINGER]);

	list_for_each_entry(sf, &xt_osf_fingers[!!f->df], finger_entry) {
		if (memcmp(&sf->finger, f, sizeof(struct xt_osf_user_finger)))
			continue;

		/*
		 * We are protected by nfnl mutex.
		 */
		list_del_rcu(&sf->finger_entry);
		kfree_rcu(sf, rcu_head);

		err = 0;
		break;
	}

	return err;
}

static const struct nfnl_callback xt_osf_nfnetlink_callbacks[OSF_MSG_MAX] = {
	[OSF_MSG_ADD]	= {
		.call		= xt_osf_add_callback,
		.attr_count	= OSF_ATTR_MAX,
		.policy		= xt_osf_policy,
	},
	[OSF_MSG_REMOVE]	= {
		.call		= xt_osf_remove_callback,
		.attr_count	= OSF_ATTR_MAX,
		.policy		= xt_osf_policy,
	},
};

static const struct nfnetlink_subsystem xt_osf_nfnetlink = {
	.name			= "osf",
	.subsys_id		= NFNL_SUBSYS_OSF,
	.cb_count		= OSF_MSG_MAX,
	.cb			= xt_osf_nfnetlink_callbacks,
};

static inline int xt_osf_ttl(const struct sk_buff *skb, const struct xt_osf_info *info,
			    unsigned char f_ttl)
{
	const struct iphdr *ip = ip_hdr(skb);

	if (info->flags & XT_OSF_TTL) {
		if (info->ttl == XT_OSF_TTL_TRUE)
			return ip->ttl == f_ttl;
		if (info->ttl == XT_OSF_TTL_NOCHECK)
			return 1;
		else if (ip->ttl <= f_ttl)
			return 1;
		else {
			struct in_device *in_dev = __in_dev_get_rcu(skb->dev);
			int ret = 0;

			for_ifa(in_dev) {
				if (inet_ifa_match(ip->saddr, ifa)) {
					ret = (ip->ttl == f_ttl);
					break;
				}
			}
			endfor_ifa(in_dev);

			return ret;
		}
	}

	return ip->ttl == f_ttl;
}

static bool
xt_osf_match_packet(const struct sk_buff *skb, struct xt_action_param *p)
{
	const struct xt_osf_info *info = p->matchinfo;
	const struct iphdr *ip = ip_hdr(skb);
	const struct tcphdr *tcp;
	struct tcphdr _tcph;
	int fmatch = FMATCH_WRONG, fcount = 0;
	unsigned int optsize = 0, check_WSS = 0;
	u16 window, totlen, mss = 0;
	bool df;
	const unsigned char *optp = NULL, *_optp = NULL;
	unsigned char opts[MAX_IPOPTLEN];
	const struct xt_osf_finger *kf;
	const struct xt_osf_user_finger *f;
	struct net *net = xt_net(p);

	if (!info)
		return false;

	tcp = skb_header_pointer(skb, ip_hdrlen(skb), sizeof(struct tcphdr), &_tcph);
	if (!tcp)
		return false;

	if (!tcp->syn)
		return false;

	totlen = ntohs(ip->tot_len);
	df = ntohs(ip->frag_off) & IP_DF;
	window = ntohs(tcp->window);

	if (tcp->doff * 4 > sizeof(struct tcphdr)) {
		optsize = tcp->doff * 4 - sizeof(struct tcphdr);

		_optp = optp = skb_header_pointer(skb, ip_hdrlen(skb) +
				sizeof(struct tcphdr), optsize, opts);
	}

	rcu_read_lock();
	list_for_each_entry_rcu(kf, &xt_osf_fingers[df], finger_entry) {
		int foptsize, optnum;

		f = &kf->finger;

		if (!(info->flags & XT_OSF_LOG) && strcmp(info->genre, f->genre))
			continue;

		optp = _optp;
		fmatch = FMATCH_WRONG;

		if (totlen != f->ss || !xt_osf_ttl(skb, info, f->ttl))
			continue;

		/*
		 * Should not happen if userspace parser was written correctly.
		 */
		if (f->wss.wc >= OSF_WSS_MAX)
			continue;

		/* Check options */

		foptsize = 0;
		for (optnum = 0; optnum < f->opt_num; ++optnum)
			foptsize += f->opt[optnum].length;

		if (foptsize > MAX_IPOPTLEN ||
		    optsize > MAX_IPOPTLEN ||
		    optsize != foptsize)
			continue;

		check_WSS = f->wss.wc;

		for (optnum = 0; optnum < f->opt_num; ++optnum) {
			if (f->opt[optnum].kind == (*optp)) {
				__u32 len = f->opt[optnum].length;
				const __u8 *optend = optp + len;

				fmatch = FMATCH_OK;

				switch (*optp) {
				case OSFOPT_MSS:
					mss = optp[3];
					mss <<= 8;
					mss |= optp[2];

					mss = ntohs((__force __be16)mss);
					break;
				case OSFOPT_TS:
					break;
				}

				optp = optend;
			} else
				fmatch = FMATCH_OPT_WRONG;

			if (fmatch != FMATCH_OK)
				break;
		}

		if (fmatch != FMATCH_OPT_WRONG) {
			fmatch = FMATCH_WRONG;

			switch (check_WSS) {
			case OSF_WSS_PLAIN:
				if (f->wss.val == 0 || window == f->wss.val)
					fmatch = FMATCH_OK;
				break;
			case OSF_WSS_MSS:
				/*
				 * Some smart modems decrease mangle MSS to
				 * SMART_MSS_2, so we check standard, decreased
				 * and the one provided in the fingerprint MSS
				 * values.
				 */
#define SMART_MSS_1	1460
#define SMART_MSS_2	1448
				if (window == f->wss.val * mss ||
				    window == f->wss.val * SMART_MSS_1 ||
				    window == f->wss.val * SMART_MSS_2)
					fmatch = FMATCH_OK;
				break;
			case OSF_WSS_MTU:
				if (window == f->wss.val * (mss + 40) ||
				    window == f->wss.val * (SMART_MSS_1 + 40) ||
				    window == f->wss.val * (SMART_MSS_2 + 40))
					fmatch = FMATCH_OK;
				break;
			case OSF_WSS_MODULO:
				if ((window % f->wss.val) == 0)
					fmatch = FMATCH_OK;
				break;
			}
		}

		if (fmatch != FMATCH_OK)
			continue;

		fcount++;

		if (info->flags & XT_OSF_LOG)
			nf_log_packet(net, xt_family(p), xt_hooknum(p), skb,
				      xt_in(p), xt_out(p), NULL,
				      "%s [%s:%s] : %pI4:%d -> %pI4:%d hops=%d\n",
				      f->genre, f->version, f->subtype,
				      &ip->saddr, ntohs(tcp->source),
				      &ip->daddr, ntohs(tcp->dest),
				      f->ttl - ip->ttl);

		if ((info->flags & XT_OSF_LOG) &&
		    info->loglevel == XT_OSF_LOGLEVEL_FIRST)
			break;
	}
	rcu_read_unlock();

	if (!fcount && (info->flags & XT_OSF_LOG))
		nf_log_packet(net, xt_family(p), xt_hooknum(p), skb, xt_in(p),
			      xt_out(p), NULL,
			"Remote OS is not known: %pI4:%u -> %pI4:%u\n",
				&ip->saddr, ntohs(tcp->source),
				&ip->daddr, ntohs(tcp->dest));

	if (fcount)
		fmatch = FMATCH_OK;

	return fmatch == FMATCH_OK;
}

static struct xt_match xt_osf_match = {
	.name 		= "osf",
	.revision	= 0,
	.family		= NFPROTO_IPV4,
	.proto		= IPPROTO_TCP,
	.hooks      	= (1 << NF_INET_LOCAL_IN) |
				(1 << NF_INET_PRE_ROUTING) |
				(1 << NF_INET_FORWARD),
	.match 		= xt_osf_match_packet,
	.matchsize	= sizeof(struct xt_osf_info),
	.me		= THIS_MODULE,
};

static int __init xt_osf_init(void)
{
	int err = -EINVAL;
	int i;

	for (i=0; i<ARRAY_SIZE(xt_osf_fingers); ++i)
		INIT_LIST_HEAD(&xt_osf_fingers[i]);

	err = nfnetlink_subsys_register(&xt_osf_nfnetlink);
	if (err < 0) {
		pr_err("Failed to register OSF nsfnetlink helper (%d)\n", err);
		goto err_out_exit;
	}

	err = xt_register_match(&xt_osf_match);
	if (err) {
		pr_err("Failed to register OS fingerprint "
		       "matching module (%d)\n", err);
		goto err_out_remove;
	}

	return 0;

err_out_remove:
	nfnetlink_subsys_unregister(&xt_osf_nfnetlink);
err_out_exit:
	return err;
}

static void __exit xt_osf_fini(void)
{
	struct xt_osf_finger *f;
	int i;

	nfnetlink_subsys_unregister(&xt_osf_nfnetlink);
	xt_unregister_match(&xt_osf_match);

	rcu_read_lock();
	for (i=0; i<ARRAY_SIZE(xt_osf_fingers); ++i) {

		list_for_each_entry_rcu(f, &xt_osf_fingers[i], finger_entry) {
			list_del_rcu(&f->finger_entry);
			kfree_rcu(f, rcu_head);
		}
	}
	rcu_read_unlock();

	rcu_barrier();
}

module_init(xt_osf_init);
module_exit(xt_osf_fini);

MODULE_LICENSE("GPL");
MODULE_AUTHOR("Evgeniy Polyakov <zbr@ioremap.net>");
MODULE_DESCRIPTION("Passive OS fingerprint matching.");
MODULE_ALIAS("ipt_osf");
MODULE_ALIAS("ip6t_osf");
MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_OSF);
Commit	Line	Data
11eeef41 EP	1	/*
	2	* Copyright (c) 2003+ Evgeniy Polyakov <zbr@ioremap.net>
	3	*
	4	*
	5	* This program is free software; you can redistribute it and/or modify
	6	* it under the terms of the GNU General Public License as published by
	7	* the Free Software Foundation; either version 2 of the License, or
	8	* (at your option) any later version.
	9	*
	10	* This program is distributed in the hope that it will be useful,
	11	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	12	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	13	* GNU General Public License for more details.
	14	*
	15	* You should have received a copy of the GNU General Public License
e664eabd	16	* along with this program; if not, see <http://www.gnu.org/licenses/>.
11eeef41	17	*/
8bee4bad	18	#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
11eeef41 EP	19	#include <linux/module.h>
	20	#include <linux/kernel.h>
	21
	22	#include <linux/if.h>
	23	#include <linux/inetdevice.h>
	24	#include <linux/ip.h>
	25	#include <linux/list.h>
	26	#include <linux/rculist.h>
	27	#include <linux/skbuff.h>
	28	#include <linux/slab.h>
	29	#include <linux/tcp.h>
	30
	31	#include <net/ip.h>
	32	#include <net/tcp.h>
	33
	34	#include <linux/netfilter/nfnetlink.h>
	35	#include <linux/netfilter/x_tables.h>
	36	#include <net/netfilter/nf_log.h>
	37	#include <linux/netfilter/xt_osf.h>
	38
	39	struct xt_osf_finger {
	40	struct rcu_head rcu_head;
	41	struct list_head finger_entry;
	42	struct xt_osf_user_finger finger;
	43	};
	44
	45	enum osf_fmatch_states {
	46	/* Packet does not match the fingerprint */
	47	FMATCH_WRONG = 0,
	48	/* Packet matches the fingerprint */
	49	FMATCH_OK,
	50	/* Options do not match the fingerprint, but header does */
	51	FMATCH_OPT_WRONG,
	52	};
	53
	54	/*
	55	* Indexed by dont-fragment bit.
	56	* It is the only constant value in the fingerprint.
	57	*/
	58	static struct list_head xt_osf_fingers[2];
	59
	60	static const struct nla_policy xt_osf_policy[OSF_ATTR_MAX + 1] = {
	61	[OSF_ATTR_FINGER] = { .len = sizeof(struct xt_osf_user_finger) },
	62	};
	63
7b8002a1 PNA	64	static int xt_osf_add_callback(struct net net, struct sock ctnl,
7b8002a1 PNA	65	struct sk_buff skb, const struct nlmsghdr nlh,
04ba724b PNA	66	const struct nlattr * const osf_attrs[],
04ba724b PNA	67	struct netlink_ext_ack *extack)
11eeef41 EP	68	{
	69	struct xt_osf_user_finger *f;
	70	struct xt_osf_finger kf = NULL, sf;
	71	int err = 0;
	72
	73	if (!osf_attrs[OSF_ATTR_FINGER])
	74	return -EINVAL;
	75
	76	if (!(nlh->nlmsg_flags & NLM_F_CREATE))
	77	return -EINVAL;
	78
	79	f = nla_data(osf_attrs[OSF_ATTR_FINGER]);
	80
	81	kf = kmalloc(sizeof(struct xt_osf_finger), GFP_KERNEL);
	82	if (!kf)
	83	return -ENOMEM;
	84
	85	memcpy(&kf->finger, f, sizeof(struct xt_osf_user_finger));
	86
	87	list_for_each_entry(sf, &xt_osf_fingers[!!f->df], finger_entry) {
	88	if (memcmp(&sf->finger, f, sizeof(struct xt_osf_user_finger)))
	89	continue;
	90
	91	kfree(kf);
	92	kf = NULL;
	93
	94	if (nlh->nlmsg_flags & NLM_F_EXCL)
	95	err = -EEXIST;
	96	break;
	97	}
	98
	99	/*
	100	* We are protected by nfnl mutex.
	101	*/
	102	if (kf)
	103	list_add_tail_rcu(&kf->finger_entry, &xt_osf_fingers[!!f->df]);
	104
	105	return err;
	106	}
	107
7b8002a1 PNA	108	static int xt_osf_remove_callback(struct net net, struct sock ctnl,
7b8002a1 PNA	109	struct sk_buff *skb,
39938324	110	const struct nlmsghdr *nlh,
04ba724b PNA	111	const struct nlattr * const osf_attrs[],
04ba724b PNA	112	struct netlink_ext_ack *extack)
11eeef41 EP	113	{
	114	struct xt_osf_user_finger *f;
	115	struct xt_osf_finger *sf;
d667b9cf	116	int err = -ENOENT;
11eeef41 EP	117
	118	if (!osf_attrs[OSF_ATTR_FINGER])
	119	return -EINVAL;
	120
	121	f = nla_data(osf_attrs[OSF_ATTR_FINGER]);
	122
	123	list_for_each_entry(sf, &xt_osf_fingers[!!f->df], finger_entry) {
	124	if (memcmp(&sf->finger, f, sizeof(struct xt_osf_user_finger)))
	125	continue;
	126
	127	/*
	128	* We are protected by nfnl mutex.
	129	*/
	130	list_del_rcu(&sf->finger_entry);
88b4a034	131	kfree_rcu(sf, rcu_head);
11eeef41 EP	132
	133	err = 0;
	134	break;
	135	}
	136
	137	return err;
	138	}
	139
	140	static const struct nfnl_callback xt_osf_nfnetlink_callbacks[OSF_MSG_MAX] = {
	141	[OSF_MSG_ADD] = {
	142	.call = xt_osf_add_callback,
	143	.attr_count = OSF_ATTR_MAX,
	144	.policy = xt_osf_policy,
	145	},
	146	[OSF_MSG_REMOVE] = {
	147	.call = xt_osf_remove_callback,
	148	.attr_count = OSF_ATTR_MAX,
	149	.policy = xt_osf_policy,
	150	},
	151	};
	152
	153	static const struct nfnetlink_subsystem xt_osf_nfnetlink = {
	154	.name = "osf",
	155	.subsys_id = NFNL_SUBSYS_OSF,
	156	.cb_count = OSF_MSG_MAX,
	157	.cb = xt_osf_nfnetlink_callbacks,
	158	};
	159
	160	static inline int xt_osf_ttl(const struct sk_buff skb, const struct xt_osf_info info,
	161	unsigned char f_ttl)
	162	{
	163	const struct iphdr *ip = ip_hdr(skb);
	164
	165	if (info->flags & XT_OSF_TTL) {
	166	if (info->ttl == XT_OSF_TTL_TRUE)
	167	return ip->ttl == f_ttl;
	168	if (info->ttl == XT_OSF_TTL_NOCHECK)
	169	return 1;
	170	else if (ip->ttl <= f_ttl)
	171	return 1;
	172	else {
	173	struct in_device *in_dev = __in_dev_get_rcu(skb->dev);
	174	int ret = 0;
	175
	176	for_ifa(in_dev) {
	177	if (inet_ifa_match(ip->saddr, ifa)) {
	178	ret = (ip->ttl == f_ttl);
	179	break;
	180	}
	181	}
	182	endfor_ifa(in_dev);
	183
	184	return ret;
	185	}
	186	}
	187
	188	return ip->ttl == f_ttl;
	189	}
	190
4b560b44	191	static bool
62fc8051	192	xt_osf_match_packet(const struct sk_buff skb, struct xt_action_param p)
11eeef41 EP	193	{
	194	const struct xt_osf_info *info = p->matchinfo;
	195	const struct iphdr *ip = ip_hdr(skb);
	196	const struct tcphdr *tcp;
	197	struct tcphdr _tcph;
	198	int fmatch = FMATCH_WRONG, fcount = 0;
	199	unsigned int optsize = 0, check_WSS = 0;
	200	u16 window, totlen, mss = 0;
	201	bool df;
	202	const unsigned char optp = NULL, _optp = NULL;
	203	unsigned char opts[MAX_IPOPTLEN];
	204	const struct xt_osf_finger *kf;
	205	const struct xt_osf_user_finger *f;
613dbd95	206	struct net *net = xt_net(p);
11eeef41 EP	207
	208	if (!info)
	209	return false;
	210
	211	tcp = skb_header_pointer(skb, ip_hdrlen(skb), sizeof(struct tcphdr), &_tcph);
	212	if (!tcp)
	213	return false;
	214
	215	if (!tcp->syn)
	216	return false;
	217
	218	totlen = ntohs(ip->tot_len);
	219	df = ntohs(ip->frag_off) & IP_DF;
	220	window = ntohs(tcp->window);
	221
	222	if (tcp->doff * 4 > sizeof(struct tcphdr)) {
	223	optsize = tcp->doff * 4 - sizeof(struct tcphdr);
	224
	225	_optp = optp = skb_header_pointer(skb, ip_hdrlen(skb) +
	226	sizeof(struct tcphdr), optsize, opts);
	227	}
	228
	229	rcu_read_lock();
	230	list_for_each_entry_rcu(kf, &xt_osf_fingers[df], finger_entry) {
372e2866 JP	231	int foptsize, optnum;
372e2866 JP	232
11eeef41 EP	233	f = &kf->finger;
	234
	235	if (!(info->flags & XT_OSF_LOG) && strcmp(info->genre, f->genre))
	236	continue;
	237
	238	optp = _optp;
	239	fmatch = FMATCH_WRONG;
	240
372e2866 JP	241	if (totlen != f->ss \|\| !xt_osf_ttl(skb, info, f->ttl))
372e2866 JP	242	continue;
11eeef41	243
372e2866 JP	244	/*
	245	* Should not happen if userspace parser was written correctly.
	246	*/
	247	if (f->wss.wc >= OSF_WSS_MAX)
	248	continue;
11eeef41	249
372e2866	250	/* Check options */
11eeef41	251
372e2866 JP	252	foptsize = 0;
	253	for (optnum = 0; optnum < f->opt_num; ++optnum)
	254	foptsize += f->opt[optnum].length;
11eeef41	255
372e2866 JP	256	if (foptsize > MAX_IPOPTLEN \|\|
	257	optsize > MAX_IPOPTLEN \|\|
	258	optsize != foptsize)
	259	continue;
11eeef41	260
372e2866	261	check_WSS = f->wss.wc;
11eeef41	262
372e2866 JP	263	for (optnum = 0; optnum < f->opt_num; ++optnum) {
	264	if (f->opt[optnum].kind == (*optp)) {
	265	__u32 len = f->opt[optnum].length;
	266	const __u8 *optend = optp + len;
11eeef41	267
372e2866	268	fmatch = FMATCH_OK;
11eeef41	269
372e2866 JP	270	switch (*optp) {
	271	case OSFOPT_MSS:
	272	mss = optp[3];
	273	mss <<= 8;
	274	mss \|= optp[2];
11eeef41	275
372e2866 JP	276	mss = ntohs((__force __be16)mss);
	277	break;
	278	case OSFOPT_TS:
372e2866 JP	279	break;
372e2866 JP	280	}
11eeef41	281
372e2866 JP	282	optp = optend;
	283	} else
	284	fmatch = FMATCH_OPT_WRONG;
11eeef41	285
372e2866 JP	286	if (fmatch != FMATCH_OK)
	287	break;
	288	}
11eeef41	289
372e2866 JP	290	if (fmatch != FMATCH_OPT_WRONG) {
372e2866 JP	291	fmatch = FMATCH_WRONG;
11eeef41	292
372e2866 JP	293	switch (check_WSS) {
	294	case OSF_WSS_PLAIN:
	295	if (f->wss.val == 0 \|\| window == f->wss.val)
	296	fmatch = FMATCH_OK;
	297	break;
	298	case OSF_WSS_MSS:
	299	/*
	300	* Some smart modems decrease mangle MSS to
	301	* SMART_MSS_2, so we check standard, decreased
	302	* and the one provided in the fingerprint MSS
	303	* values.
	304	*/
11eeef41 EP	305	#define SMART_MSS_1 1460
11eeef41 EP	306	#define SMART_MSS_2 1448
372e2866 JP	307	if (window == f->wss.val * mss \|\|
	308	window == f->wss.val * SMART_MSS_1 \|\|
	309	window == f->wss.val * SMART_MSS_2)
	310	fmatch = FMATCH_OK;
	311	break;
	312	case OSF_WSS_MTU:
	313	if (window == f->wss.val * (mss + 40) \|\|
	314	window == f->wss.val * (SMART_MSS_1 + 40) \|\|
	315	window == f->wss.val * (SMART_MSS_2 + 40))
	316	fmatch = FMATCH_OK;
	317	break;
	318	case OSF_WSS_MODULO:
	319	if ((window % f->wss.val) == 0)
	320	fmatch = FMATCH_OK;
	321	break;
11eeef41	322	}
372e2866	323	}
11eeef41	324
372e2866 JP	325	if (fmatch != FMATCH_OK)
372e2866 JP	326	continue;
11eeef41	327
372e2866	328	fcount++;
11eeef41	329
372e2866	330	if (info->flags & XT_OSF_LOG)
613dbd95 PNA	331	nf_log_packet(net, xt_family(p), xt_hooknum(p), skb,
613dbd95 PNA	332	xt_in(p), xt_out(p), NULL,
372e2866 JP	333	"%s [%s:%s] : %pI4:%d -> %pI4:%d hops=%d\n",
	334	f->genre, f->version, f->subtype,
	335	&ip->saddr, ntohs(tcp->source),
	336	&ip->daddr, ntohs(tcp->dest),
	337	f->ttl - ip->ttl);
11eeef41	338
372e2866 JP	339	if ((info->flags & XT_OSF_LOG) &&
	340	info->loglevel == XT_OSF_LOGLEVEL_FIRST)
	341	break;
11eeef41 EP	342	}
	343	rcu_read_unlock();
	344
	345	if (!fcount && (info->flags & XT_OSF_LOG))
613dbd95 PNA	346	nf_log_packet(net, xt_family(p), xt_hooknum(p), skb, xt_in(p),
613dbd95 PNA	347	xt_out(p), NULL,
7f635d0d	348	"Remote OS is not known: %pI4:%u -> %pI4:%u\n",
11eeef41 EP	349	&ip->saddr, ntohs(tcp->source),
	350	&ip->daddr, ntohs(tcp->dest));
	351
	352	if (fcount)
	353	fmatch = FMATCH_OK;
	354
	355	return fmatch == FMATCH_OK;
	356	}
	357
	358	static struct xt_match xt_osf_match = {
	359	.name = "osf",
	360	.revision = 0,
	361	.family = NFPROTO_IPV4,
	362	.proto = IPPROTO_TCP,
	363	.hooks = (1 << NF_INET_LOCAL_IN) \|
	364	(1 << NF_INET_PRE_ROUTING) \|
	365	(1 << NF_INET_FORWARD),
	366	.match = xt_osf_match_packet,
	367	.matchsize = sizeof(struct xt_osf_info),
	368	.me = THIS_MODULE,
	369	};
	370
	371	static int __init xt_osf_init(void)
	372	{
	373	int err = -EINVAL;
	374	int i;
	375
	376	for (i=0; i<ARRAY_SIZE(xt_osf_fingers); ++i)
	377	INIT_LIST_HEAD(&xt_osf_fingers[i]);
	378
	379	err = nfnetlink_subsys_register(&xt_osf_nfnetlink);
	380	if (err < 0) {
8bee4bad	381	pr_err("Failed to register OSF nsfnetlink helper (%d)\n", err);
11eeef41 EP	382	goto err_out_exit;
	383	}
	384
	385	err = xt_register_match(&xt_osf_match);
	386	if (err) {
8bee4bad JE	387	pr_err("Failed to register OS fingerprint "
8bee4bad JE	388	"matching module (%d)\n", err);
11eeef41 EP	389	goto err_out_remove;
	390	}
	391
	392	return 0;
	393
	394	err_out_remove:
	395	nfnetlink_subsys_unregister(&xt_osf_nfnetlink);
	396	err_out_exit:
	397	return err;
	398	}
	399
	400	static void __exit xt_osf_fini(void)
	401	{
	402	struct xt_osf_finger *f;
	403	int i;
	404
	405	nfnetlink_subsys_unregister(&xt_osf_nfnetlink);
	406	xt_unregister_match(&xt_osf_match);
	407
	408	rcu_read_lock();
	409	for (i=0; i<ARRAY_SIZE(xt_osf_fingers); ++i) {
	410
	411	list_for_each_entry_rcu(f, &xt_osf_fingers[i], finger_entry) {
	412	list_del_rcu(&f->finger_entry);
88b4a034	413	kfree_rcu(f, rcu_head);
11eeef41 EP	414	}
	415	}
	416	rcu_read_unlock();
	417
	418	rcu_barrier();
	419	}
	420
	421	module_init(xt_osf_init);
	422	module_exit(xt_osf_fini);
	423
	424	MODULE_LICENSE("GPL");
	425	MODULE_AUTHOR("Evgeniy Polyakov <zbr@ioremap.net>");
	426	MODULE_DESCRIPTION("Passive OS fingerprint matching.");
b8ddd9ea KT	427	MODULE_ALIAS("ipt_osf");
b8ddd9ea KT	428	MODULE_ALIAS("ip6t_osf");
11eeef41	429	MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_OSF);