2 * Copyright (c) 2003+ Evgeniy Polyakov <zbr@ioremap.net>
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License as published by
7 * the Free Software Foundation; either version 2 of the License, or
8 * (at your option) any later version.
10 * This program is distributed in the hope that it will be useful,
11 * but WITHOUT ANY WARRANTY; without even the implied warranty of
12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13 * GNU General Public License for more details.
15 * You should have received a copy of the GNU General Public License
16 * along with this program; if not, see <http://www.gnu.org/licenses/>.
18 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
19 #include <linux/module.h>
20 #include <linux/kernel.h>
23 #include <linux/inetdevice.h>
25 #include <linux/list.h>
26 #include <linux/rculist.h>
27 #include <linux/skbuff.h>
28 #include <linux/slab.h>
29 #include <linux/tcp.h>
34 #include <linux/netfilter/nfnetlink.h>
35 #include <linux/netfilter/x_tables.h>
36 #include <net/netfilter/nf_log.h>
37 #include <linux/netfilter/xt_osf.h>
39 struct xt_osf_finger
{
40 struct rcu_head rcu_head
;
41 struct list_head finger_entry
;
42 struct xt_osf_user_finger finger
;
45 enum osf_fmatch_states
{
46 /* Packet does not match the fingerprint */
48 /* Packet matches the fingerprint */
50 /* Options do not match the fingerprint, but header does */
55 * Indexed by dont-fragment bit.
56 * It is the only constant value in the fingerprint.
58 static struct list_head xt_osf_fingers
[2];
60 static const struct nla_policy xt_osf_policy
[OSF_ATTR_MAX
+ 1] = {
61 [OSF_ATTR_FINGER
] = { .len
= sizeof(struct xt_osf_user_finger
) },
64 static int xt_osf_add_callback(struct net
*net
, struct sock
*ctnl
,
65 struct sk_buff
*skb
, const struct nlmsghdr
*nlh
,
66 const struct nlattr
* const osf_attrs
[],
67 struct netlink_ext_ack
*extack
)
69 struct xt_osf_user_finger
*f
;
70 struct xt_osf_finger
*kf
= NULL
, *sf
;
73 if (!osf_attrs
[OSF_ATTR_FINGER
])
76 if (!(nlh
->nlmsg_flags
& NLM_F_CREATE
))
79 f
= nla_data(osf_attrs
[OSF_ATTR_FINGER
]);
81 kf
= kmalloc(sizeof(struct xt_osf_finger
), GFP_KERNEL
);
85 memcpy(&kf
->finger
, f
, sizeof(struct xt_osf_user_finger
));
87 list_for_each_entry(sf
, &xt_osf_fingers
[!!f
->df
], finger_entry
) {
88 if (memcmp(&sf
->finger
, f
, sizeof(struct xt_osf_user_finger
)))
94 if (nlh
->nlmsg_flags
& NLM_F_EXCL
)
100 * We are protected by nfnl mutex.
103 list_add_tail_rcu(&kf
->finger_entry
, &xt_osf_fingers
[!!f
->df
]);
108 static int xt_osf_remove_callback(struct net
*net
, struct sock
*ctnl
,
110 const struct nlmsghdr
*nlh
,
111 const struct nlattr
* const osf_attrs
[],
112 struct netlink_ext_ack
*extack
)
114 struct xt_osf_user_finger
*f
;
115 struct xt_osf_finger
*sf
;
118 if (!osf_attrs
[OSF_ATTR_FINGER
])
121 f
= nla_data(osf_attrs
[OSF_ATTR_FINGER
]);
123 list_for_each_entry(sf
, &xt_osf_fingers
[!!f
->df
], finger_entry
) {
124 if (memcmp(&sf
->finger
, f
, sizeof(struct xt_osf_user_finger
)))
128 * We are protected by nfnl mutex.
130 list_del_rcu(&sf
->finger_entry
);
131 kfree_rcu(sf
, rcu_head
);
140 static const struct nfnl_callback xt_osf_nfnetlink_callbacks
[OSF_MSG_MAX
] = {
142 .call
= xt_osf_add_callback
,
143 .attr_count
= OSF_ATTR_MAX
,
144 .policy
= xt_osf_policy
,
147 .call
= xt_osf_remove_callback
,
148 .attr_count
= OSF_ATTR_MAX
,
149 .policy
= xt_osf_policy
,
153 static const struct nfnetlink_subsystem xt_osf_nfnetlink
= {
155 .subsys_id
= NFNL_SUBSYS_OSF
,
156 .cb_count
= OSF_MSG_MAX
,
157 .cb
= xt_osf_nfnetlink_callbacks
,
160 static inline int xt_osf_ttl(const struct sk_buff
*skb
, const struct xt_osf_info
*info
,
163 const struct iphdr
*ip
= ip_hdr(skb
);
165 if (info
->flags
& XT_OSF_TTL
) {
166 if (info
->ttl
== XT_OSF_TTL_TRUE
)
167 return ip
->ttl
== f_ttl
;
168 if (info
->ttl
== XT_OSF_TTL_NOCHECK
)
170 else if (ip
->ttl
<= f_ttl
)
173 struct in_device
*in_dev
= __in_dev_get_rcu(skb
->dev
);
177 if (inet_ifa_match(ip
->saddr
, ifa
)) {
178 ret
= (ip
->ttl
== f_ttl
);
188 return ip
->ttl
== f_ttl
;
192 xt_osf_match_packet(const struct sk_buff
*skb
, struct xt_action_param
*p
)
194 const struct xt_osf_info
*info
= p
->matchinfo
;
195 const struct iphdr
*ip
= ip_hdr(skb
);
196 const struct tcphdr
*tcp
;
198 int fmatch
= FMATCH_WRONG
, fcount
= 0;
199 unsigned int optsize
= 0, check_WSS
= 0;
200 u16 window
, totlen
, mss
= 0;
202 const unsigned char *optp
= NULL
, *_optp
= NULL
;
203 unsigned char opts
[MAX_IPOPTLEN
];
204 const struct xt_osf_finger
*kf
;
205 const struct xt_osf_user_finger
*f
;
206 struct net
*net
= xt_net(p
);
211 tcp
= skb_header_pointer(skb
, ip_hdrlen(skb
), sizeof(struct tcphdr
), &_tcph
);
218 totlen
= ntohs(ip
->tot_len
);
219 df
= ntohs(ip
->frag_off
) & IP_DF
;
220 window
= ntohs(tcp
->window
);
222 if (tcp
->doff
* 4 > sizeof(struct tcphdr
)) {
223 optsize
= tcp
->doff
* 4 - sizeof(struct tcphdr
);
225 _optp
= optp
= skb_header_pointer(skb
, ip_hdrlen(skb
) +
226 sizeof(struct tcphdr
), optsize
, opts
);
230 list_for_each_entry_rcu(kf
, &xt_osf_fingers
[df
], finger_entry
) {
231 int foptsize
, optnum
;
235 if (!(info
->flags
& XT_OSF_LOG
) && strcmp(info
->genre
, f
->genre
))
239 fmatch
= FMATCH_WRONG
;
241 if (totlen
!= f
->ss
|| !xt_osf_ttl(skb
, info
, f
->ttl
))
245 * Should not happen if userspace parser was written correctly.
247 if (f
->wss
.wc
>= OSF_WSS_MAX
)
253 for (optnum
= 0; optnum
< f
->opt_num
; ++optnum
)
254 foptsize
+= f
->opt
[optnum
].length
;
256 if (foptsize
> MAX_IPOPTLEN
||
257 optsize
> MAX_IPOPTLEN
||
261 check_WSS
= f
->wss
.wc
;
263 for (optnum
= 0; optnum
< f
->opt_num
; ++optnum
) {
264 if (f
->opt
[optnum
].kind
== (*optp
)) {
265 __u32 len
= f
->opt
[optnum
].length
;
266 const __u8
*optend
= optp
+ len
;
276 mss
= ntohs((__force __be16
)mss
);
284 fmatch
= FMATCH_OPT_WRONG
;
286 if (fmatch
!= FMATCH_OK
)
290 if (fmatch
!= FMATCH_OPT_WRONG
) {
291 fmatch
= FMATCH_WRONG
;
295 if (f
->wss
.val
== 0 || window
== f
->wss
.val
)
300 * Some smart modems decrease mangle MSS to
301 * SMART_MSS_2, so we check standard, decreased
302 * and the one provided in the fingerprint MSS
305 #define SMART_MSS_1 1460
306 #define SMART_MSS_2 1448
307 if (window
== f
->wss
.val
* mss
||
308 window
== f
->wss
.val
* SMART_MSS_1
||
309 window
== f
->wss
.val
* SMART_MSS_2
)
313 if (window
== f
->wss
.val
* (mss
+ 40) ||
314 window
== f
->wss
.val
* (SMART_MSS_1
+ 40) ||
315 window
== f
->wss
.val
* (SMART_MSS_2
+ 40))
319 if ((window
% f
->wss
.val
) == 0)
325 if (fmatch
!= FMATCH_OK
)
330 if (info
->flags
& XT_OSF_LOG
)
331 nf_log_packet(net
, xt_family(p
), xt_hooknum(p
), skb
,
332 xt_in(p
), xt_out(p
), NULL
,
333 "%s [%s:%s] : %pI4:%d -> %pI4:%d hops=%d\n",
334 f
->genre
, f
->version
, f
->subtype
,
335 &ip
->saddr
, ntohs(tcp
->source
),
336 &ip
->daddr
, ntohs(tcp
->dest
),
339 if ((info
->flags
& XT_OSF_LOG
) &&
340 info
->loglevel
== XT_OSF_LOGLEVEL_FIRST
)
345 if (!fcount
&& (info
->flags
& XT_OSF_LOG
))
346 nf_log_packet(net
, xt_family(p
), xt_hooknum(p
), skb
, xt_in(p
),
348 "Remote OS is not known: %pI4:%u -> %pI4:%u\n",
349 &ip
->saddr
, ntohs(tcp
->source
),
350 &ip
->daddr
, ntohs(tcp
->dest
));
355 return fmatch
== FMATCH_OK
;
358 static struct xt_match xt_osf_match
= {
361 .family
= NFPROTO_IPV4
,
362 .proto
= IPPROTO_TCP
,
363 .hooks
= (1 << NF_INET_LOCAL_IN
) |
364 (1 << NF_INET_PRE_ROUTING
) |
365 (1 << NF_INET_FORWARD
),
366 .match
= xt_osf_match_packet
,
367 .matchsize
= sizeof(struct xt_osf_info
),
371 static int __init
xt_osf_init(void)
376 for (i
=0; i
<ARRAY_SIZE(xt_osf_fingers
); ++i
)
377 INIT_LIST_HEAD(&xt_osf_fingers
[i
]);
379 err
= nfnetlink_subsys_register(&xt_osf_nfnetlink
);
381 pr_err("Failed to register OSF nsfnetlink helper (%d)\n", err
);
385 err
= xt_register_match(&xt_osf_match
);
387 pr_err("Failed to register OS fingerprint "
388 "matching module (%d)\n", err
);
395 nfnetlink_subsys_unregister(&xt_osf_nfnetlink
);
400 static void __exit
xt_osf_fini(void)
402 struct xt_osf_finger
*f
;
405 nfnetlink_subsys_unregister(&xt_osf_nfnetlink
);
406 xt_unregister_match(&xt_osf_match
);
409 for (i
=0; i
<ARRAY_SIZE(xt_osf_fingers
); ++i
) {
411 list_for_each_entry_rcu(f
, &xt_osf_fingers
[i
], finger_entry
) {
412 list_del_rcu(&f
->finger_entry
);
413 kfree_rcu(f
, rcu_head
);
421 module_init(xt_osf_init
);
422 module_exit(xt_osf_fini
);
424 MODULE_LICENSE("GPL");
425 MODULE_AUTHOR("Evgeniy Polyakov <zbr@ioremap.net>");
426 MODULE_DESCRIPTION("Passive OS fingerprint matching.");
427 MODULE_ALIAS("ipt_osf");
428 MODULE_ALIAS("ip6t_osf");
429 MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_OSF
);