/*
* Passively fingerprint the OS of the host (IPv4 TCP SYN packets only)
* Returns the list of possible OSes.
*/
struct pf_osfp_enlist *
pf_osfp_fingerprint(struct pf_pdesc *pd)
{
struct tcphdr *th = pd->hdr.tcp;
struct ip *ip = NULL;
struct ip6_hdr *ip6 = NULL;
char hdr[60];
if (pd->proto != IPPROTO_TCP)
return (NULL);
switch (pd->af) {
case AF_INET:
ip = mtod(pd->m, struct ip *);
break;
case AF_INET6:
ip6 = mtod(pd->m, struct ip6_hdr *);
break;
}
if (!pf_pull_hdr(pd->m, pd->off, hdr, th->th_off << 2, NULL, NULL,
pd->af))
return (NULL);
return (pf_osfp_fingerprint_hdr(ip, ip6, (struct tcphdr *)hdr));
}
void
tcp_print(const u_char *bp, u_int length, const u_char *bp2)
{
const struct tcphdr *tp;
const struct ip *ip;
u_char flags;
int hlen;
char ch;
struct tcp_seq_hash *th = NULL;
int rev = 0;
u_int16_t sport, dport, win, urp;
tcp_seq seq, ack;
#ifdef INET6
const struct ip6_hdr *ip6;
#endif
tp = (struct tcphdr *)bp;
switch (((struct ip *)bp2)->ip_v) {
case 4:
ip = (struct ip *)bp2;
#ifdef INET6
ip6 = NULL;
#endif
break;
#ifdef INET6
case 6:
ip = NULL;
ip6 = (struct ip6_hdr *)bp2;
break;
#endif
default:
(void)printf("invalid ip version");
return;
}
ch = '\0';
if (length < sizeof(*tp)) {
(void)printf("truncated-tcp %u", length);
return;
}
if (!TTEST(tp->th_dport)) {
#ifdef INET6
if (ip6) {
(void)printf("%s > %s: [|tcp]",
ip6addr_string(&ip6->ip6_src),
ip6addr_string(&ip6->ip6_dst));
} else
#endif /*INET6*/
{
(void)printf("%s > %s: [|tcp]",
ipaddr_string(&ip->ip_src),
ipaddr_string(&ip->ip_dst));
}
return;
}
sport = ntohs(tp->th_sport);
dport = ntohs(tp->th_dport);
#ifdef INET6
if (ip6) {
if (ip6->ip6_nxt == IPPROTO_TCP) {
(void)printf("%s.%s > %s.%s: ",
ip6addr_string(&ip6->ip6_src),
tcpport_string(sport),
ip6addr_string(&ip6->ip6_dst),
tcpport_string(dport));
} else {
(void)printf("%s > %s: ",
tcpport_string(sport), tcpport_string(dport));
}
} else
#endif /*INET6*/
{
if (ip->ip_p == IPPROTO_TCP) {
(void)printf("%s.%s > %s.%s: ",
ipaddr_string(&ip->ip_src),
tcpport_string(sport),
ipaddr_string(&ip->ip_dst),
tcpport_string(dport));
} else {
(void)printf("%s > %s: ",
tcpport_string(sport), tcpport_string(dport));
}
}
if (!qflag && TTEST(tp->th_seq) && !TTEST(tp->th_ack))
(void)printf("%u ", ntohl(tp->th_seq));
TCHECK(*tp);
seq = ntohl(tp->th_seq);
ack = ntohl(tp->th_ack);
win = ntohs(tp->th_win);
urp = ntohs(tp->th_urp);
hlen = tp->th_off * 4;
if (qflag) {
(void)printf("tcp %d", length - tp->th_off * 4);
return;
} else if (packettype != PT_TCP) {
/*
* If data present and NFS port used, assume NFS.
* Pass offset of data plus 4 bytes for RPC TCP msg length
* to NFS print routines.
*/
u_int len = length - hlen;
if ((u_char *)tp + 4 + sizeof(struct rpc_msg) <= snapend &&
dport == NFS_PORT) {
nfsreq_print((u_char *)tp + hlen + 4, len, bp2);
return;
} else if ((u_char *)tp + 4 +
sizeof(struct rpc_msg) <= snapend && sport == NFS_PORT) {
nfsreply_print((u_char *)tp + hlen + 4, len, bp2);
return;
}
}
if ((flags = tp->th_flags) & (TH_SYN|TH_FIN|TH_RST|TH_PUSH|
TH_ECNECHO|TH_CWR)) {
if (flags & TH_SYN)
putchar('S');
if (flags & TH_FIN)
putchar('F');
if (flags & TH_RST)
putchar('R');
if (flags & TH_PUSH)
putchar('P');
if (flags & TH_CWR)
putchar('W'); /* congestion _W_indow reduced (ECN) */
if (flags & TH_ECNECHO)
putchar('E'); /* ecn _E_cho sent (ECN) */
} else
putchar('.');
if (!Sflag && (flags & TH_ACK)) {
struct tha tha;
/*
* Find (or record) the initial sequence numbers for
* this conversation. (we pick an arbitrary
* collating order so there's only one entry for
* both directions).
*/
#ifdef INET6
bzero(&tha, sizeof(tha));
rev = 0;
if (ip6) {
if (sport > dport) {
rev = 1;
} else if (sport == dport) {
int i;
for (i = 0; i < 4; i++) {
if (((u_int32_t *)(&ip6->ip6_src))[i] >
((u_int32_t *)(&ip6->ip6_dst))[i]) {
rev = 1;
break;
}
}
}
if (rev) {
tha.src = ip6->ip6_dst;
tha.dst = ip6->ip6_src;
tha.port = dport << 16 | sport;
} else {
tha.dst = ip6->ip6_dst;
tha.src = ip6->ip6_src;
tha.port = sport << 16 | dport;
}
} else {
if (sport > dport ||
(sport == dport &&
ip->ip_src.s_addr > ip->ip_dst.s_addr)) {
rev = 1;
}
if (rev) {
*(struct in_addr *)&tha.src = ip->ip_dst;
*(struct in_addr *)&tha.dst = ip->ip_src;
tha.port = dport << 16 | sport;
} else {
*(struct in_addr *)&tha.dst = ip->ip_dst;
*(struct in_addr *)&tha.src = ip->ip_src;
tha.port = sport << 16 | dport;
}
}
#else
if (sport < dport ||
(sport == dport &&
ip->ip_src.s_addr < ip->ip_dst.s_addr)) {
tha.src = ip->ip_src, tha.dst = ip->ip_dst;
tha.port = sport << 16 | dport;
rev = 0;
} else {
tha.src = ip->ip_dst, tha.dst = ip->ip_src;
tha.port = dport << 16 | sport;
rev = 1;
}
#endif
for (th = &tcp_seq_hash[tha.port % TSEQ_HASHSIZE];
th->nxt; th = th->nxt)
if (!memcmp((char *)&tha, (char *)&th->addr,
sizeof(th->addr)))
break;
if (!th->nxt || flags & TH_SYN) {
/* didn't find it or new conversation */
if (th->nxt == NULL) {
th->nxt = calloc(1, sizeof(*th));
if (th->nxt == NULL)
error("tcp_print: calloc");
}
th->addr = tha;
if (rev)
th->ack = seq, th->seq = ack - 1;
else
th->seq = seq, th->ack = ack - 1;
} else {
if (rev)
seq -= th->ack, ack -= th->seq;
else
seq -= th->seq, ack -= th->ack;
}
}
hlen = tp->th_off * 4;
if (hlen > length) {
(void)printf(" [bad hdr length]");
return;
}
if (ip && ip->ip_v == 4 && vflag) {
if (TTEST2(tp->th_sport, length)) {
u_int16_t sum, tcp_sum;
sum = tcp_cksum(ip, tp, length);
if (sum != 0) {
tcp_sum = EXTRACT_16BITS(&tp->th_sum);
(void)printf(" [bad tcp cksum %x! -> %x]", tcp_sum,
in_cksum_shouldbe(tcp_sum, sum));
} else
(void)printf(" [tcp sum ok]");
}
}
#ifdef INET6
if (ip6 && ip6->ip6_plen && vflag) {
if (TTEST2(tp->th_sport, length)) {
u_int16_t sum, tcp_sum;
sum = tcp6_cksum(ip6, tp, length);
if (sum != 0) {
tcp_sum = EXTRACT_16BITS(&tp->th_sum);
(void)printf(" [bad tcp cksum %x! -> %x]", tcp_sum,
in_cksum_shouldbe(tcp_sum, sum));
} else
(void)printf(" [tcp sum ok]");
}
}
#endif
/* OS Fingerprint */
if (oflag && (flags & (TH_SYN|TH_ACK)) == TH_SYN) {
struct pf_osfp_enlist *head = NULL;
struct pf_osfp_entry *fp;
unsigned long left;
left = (unsigned long)(snapend - (const u_char *)tp);
if (left >= hlen)
head = pf_osfp_fingerprint_hdr(ip, ip6, tp);
if (head) {
int prev = 0;
printf(" (src OS:");
SLIST_FOREACH(fp, head, fp_entry) {
if (fp->fp_enflags & PF_OSFP_EXPANDED)
continue;
if (prev)
printf(",");
printf(" %s", fp->fp_class_nm);
if (fp->fp_version_nm[0])
printf(" %s", fp->fp_version_nm);
if (fp->fp_subtype_nm[0])
printf(" %s", fp->fp_subtype_nm);
prev = 1;
}
printf(")");
} else {
if (left < hlen)
printf(" (src OS: short-pkt)");
else
printf(" (src OS: unknown)");
}
}
