netfilter: passive OS fingerprint xtables match (11eeef41) · Commits · 戴 / test

include/linux/netfilter/Kbuild

+1 −0

Original line number	Diff line number	Diff line
		@@ -33,6 +33,7 @@ header-y += xt_limit.h
		header-y += xt_mac.h
		header-y += xt_mark.h
		header-y += xt_multiport.h
		header-y += xt_osf.h
		header-y += xt_owner.h
		header-y += xt_pkttype.h
		header-y += xt_quota.h

include/linux/netfilter/nfnetlink.h

+2 −1

Original line number	Diff line number	Diff line
		@@ -46,7 +46,8 @@ struct nfgenmsg {
		#define NFNL_SUBSYS_CTNETLINK_EXP 2
		#define NFNL_SUBSYS_QUEUE 3
		#define NFNL_SUBSYS_ULOG 4
		#define NFNL_SUBSYS_COUNT 5
		#define NFNL_SUBSYS_OSF 5
		#define NFNL_SUBSYS_COUNT 6

		#ifdef __KERNEL__

include/linux/netfilter/xt_osf.h

0 → 100644

+133 −0

Original line number	Diff line number	Diff line
		/*
		* Copyright (c) 2003+ Evgeniy Polyakov <johnpol@2ka.mxt.ru>
		*
		*
		* This program is free software; you can redistribute it and/or modify
		* it under the terms of the GNU General Public License as published by
		* the Free Software Foundation; either version 2 of the License, or
		* (at your option) any later version.
		*
		* This program is distributed in the hope that it will be useful,
		* but WITHOUT ANY WARRANTY; without even the implied warranty of
		* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
		* GNU General Public License for more details.
		*
		* You should have received a copy of the GNU General Public License
		* along with this program; if not, write to the Free Software
		* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
		*/

		#ifndef _XT_OSF_H
		#define _XT_OSF_H

		#define MAXGENRELEN 32

		#define XT_OSF_GENRE (1<<0)
		#define XT_OSF_TTL (1<<1)
		#define XT_OSF_LOG (1<<2)
		#define XT_OSF_INVERT (1<<3)

		#define XT_OSF_LOGLEVEL_ALL 0 /* log all matched fingerprints */
		#define XT_OSF_LOGLEVEL_FIRST 1 /* log only the first matced fingerprint */
		#define XT_OSF_LOGLEVEL_ALL_KNOWN 2 /* do not log unknown packets */

		#define XT_OSF_TTL_TRUE 0 /* True ip and fingerprint TTL comparison */
		#define XT_OSF_TTL_LESS 1 /* Check if ip TTL is less than fingerprint one */
		#define XT_OSF_TTL_NOCHECK 2 /* Do not compare ip and fingerprint TTL at all */

		struct xt_osf_info {
		char genre[MAXGENRELEN];
		__u32 len;
		__u32 flags;
		__u32 loglevel;
		__u32 ttl;
		};

		/*
		* Wildcard MSS (kind of).
		* It is used to implement a state machine for the different wildcard values
		* of the MSS and window sizes.
		*/
		struct xt_osf_wc {
		__u32 wc;
		__u32 val;
		};

		/*
		* This struct represents IANA options
		* http://www.iana.org/assignments/tcp-parameters
		*/
		struct xt_osf_opt {
		__u16 kind, length;
		struct xt_osf_wc wc;
		};

		struct xt_osf_user_finger {
		struct xt_osf_wc wss;

		__u8 ttl, df;
		__u16 ss, mss;
		__u16 opt_num;

		char genre[MAXGENRELEN];
		char version[MAXGENRELEN];
		char subtype[MAXGENRELEN];

		/* MAX_IPOPTLEN is maximum if all options are NOPs or EOLs */
		struct xt_osf_opt opt[MAX_IPOPTLEN];
		};

		struct xt_osf_nlmsg {
		struct xt_osf_user_finger f;
		struct iphdr ip;
		struct tcphdr tcp;
		};

		/* Defines for IANA option kinds */

		enum iana_options {
		OSFOPT_EOL = 0, /* End of options */
		OSFOPT_NOP, /* NOP */
		OSFOPT_MSS, /* Maximum segment size */
		OSFOPT_WSO, /* Window scale option */
		OSFOPT_SACKP, /* SACK permitted */
		OSFOPT_SACK, /* SACK */
		OSFOPT_ECHO,
		OSFOPT_ECHOREPLY,
		OSFOPT_TS, /* Timestamp option */
		OSFOPT_POCP, /* Partial Order Connection Permitted */
		OSFOPT_POSP, /* Partial Order Service Profile */

		/* Others are not used in the current OSF */
		OSFOPT_EMPTY = 255,
		};

		/*
		* Initial window size option state machine: multiple of mss, mtu or
		* plain numeric value. Can also be made as plain numeric value which
		* is not a multiple of specified value.
		*/
		enum xt_osf_window_size_options {
		OSF_WSS_PLAIN = 0,
		OSF_WSS_MSS,
		OSF_WSS_MTU,
		OSF_WSS_MODULO,
		OSF_WSS_MAX,
		};

		/*
		* Add/remove fingerprint from the kernel.
		*/
		enum xt_osf_msg_types {
		OSF_MSG_ADD,
		OSF_MSG_REMOVE,
		OSF_MSG_MAX,
		};

		enum xt_osf_attr_type {
		OSF_ATTR_UNSPEC,
		OSF_ATTR_FINGER,
		OSF_ATTR_MAX,
		};

		#endif /* _XT_OSF_H */

net/netfilter/Kconfig

+13 −0

Original line number	Diff line number	Diff line
		@@ -917,6 +917,19 @@ config NETFILTER_XT_MATCH_U32

		Details and examples are in the kernel module source.

		config NETFILTER_XT_MATCH_OSF
		tristate '"osf" Passive OS fingerprint match'
		depends on NETFILTER_ADVANCED && NETFILTER_NETLINK
		help
		This option selects the Passive OS Fingerprinting match module
		that allows to passively match the remote operating system by
		analyzing incoming TCP SYN packets.

		Rules and loading software can be downloaded from
		http://www.ioremap.net/projects/osf

		To compile it as a module, choose M here. If unsure, say N.

		endif # NETFILTER_XTABLES

		endmenu

net/netfilter/Makefile

+1 −0

Original line number	Diff line number	Diff line
		@@ -77,6 +77,7 @@ obj-$(CONFIG_NETFILTER_XT_MATCH_LIMIT) += xt_limit.o
		obj-$(CONFIG_NETFILTER_XT_MATCH_MAC) += xt_mac.o
		obj-$(CONFIG_NETFILTER_XT_MATCH_MARK) += xt_mark.o
		obj-$(CONFIG_NETFILTER_XT_MATCH_MULTIPORT) += xt_multiport.o
		obj-$(CONFIG_NETFILTER_XT_MATCH_OSF) += xt_osf.o
		obj-$(CONFIG_NETFILTER_XT_MATCH_OWNER) += xt_owner.o
		obj-$(CONFIG_NETFILTER_XT_MATCH_PHYSDEV) += xt_physdev.o
		obj-$(CONFIG_NETFILTER_XT_MATCH_PKTTYPE) += xt_pkttype.o

Admin message