Skip to content

Commit 11eeef4

Browse files
bioothodkaber
bioothod
authored and
kaber
committed
netfilter: passive OS fingerprint xtables match
Passive OS fingerprinting netfilter module allows to passively detect remote OS and perform various netfilter actions based on that knowledge. This module compares some data (WS, MSS, options and it's order, ttl, df and others) from packets with SYN bit set with dynamically loaded OS fingerprints. Fingerprint matching rules can be downloaded from OpenBSD source tree or found in archive and loaded via netfilter netlink subsystem into the kernel via special util found in archive. Archive contains library file (also attached), which was shipped with iptables extensions some time ago (at least when ipt_osf existed in patch-o-matic). Following changes were made in this release: * added NLM_F_CREATE/NLM_F_EXCL checks * dropped _rcu list traversing helpers in the protected add/remove calls * dropped unneded structures, debug prints, obscure comment and check Fingerprints can be downloaded from http://www.openbsd.org/cgi-bin/cvsweb/src/etc/pf.os or can be found in archive Example usage: -d switch removes fingerprints Please consider for inclusion. Thank you. Passive OS fingerprint homepage (archives, examples): http://www.ioremap.net/projects/osf Signed-off-by: Evgeniy Polyakov <[email protected]> Signed-off-by: Patrick McHardy <[email protected]>
1 parent f87fb66 commit 11eeef4

File tree

6 files changed

+578
-1
lines changed

6 files changed

+578
-1
lines changed

‎include/linux/netfilter/Kbuild

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,7 @@ header-y += xt_limit.h
3333
header-y += xt_mac.h
3434
header-y += xt_mark.h
3535
header-y += xt_multiport.h
36+
header-y += xt_osf.h
3637
header-y += xt_owner.h
3738
header-y += xt_pkttype.h
3839
header-y += xt_quota.h

‎include/linux/netfilter/nfnetlink.h

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,8 @@ struct nfgenmsg {
4646
#define NFNL_SUBSYS_CTNETLINK_EXP 2
4747
#define NFNL_SUBSYS_QUEUE 3
4848
#define NFNL_SUBSYS_ULOG 4
49-
#define NFNL_SUBSYS_COUNT 5
49+
#define NFNL_SUBSYS_OSF 5
50+
#define NFNL_SUBSYS_COUNT 6
5051

5152
#ifdef __KERNEL__
5253

‎include/linux/netfilter/xt_osf.h

Lines changed: 133 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,133 @@
1+
/*
2+
* Copyright (c) 2003+ Evgeniy Polyakov <[email protected]>
3+
*
4+
*
5+
* This program is free software; you can redistribute it and/or modify
6+
* it under the terms of the GNU General Public License as published by
7+
* the Free Software Foundation; either version 2 of the License, or
8+
* (at your option) any later version.
9+
*
10+
* This program is distributed in the hope that it will be useful,
11+
* but WITHOUT ANY WARRANTY; without even the implied warranty of
12+
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13+
* GNU General Public License for more details.
14+
*
15+
* You should have received a copy of the GNU General Public License
16+
* along with this program; if not, write to the Free Software
17+
* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
18+
*/
19+
20+
#ifndef _XT_OSF_H
21+
#define _XT_OSF_H
22+
23+
#define MAXGENRELEN 32
24+
25+
#define XT_OSF_GENRE (1<<0)
26+
#define XT_OSF_TTL (1<<1)
27+
#define XT_OSF_LOG (1<<2)
28+
#define XT_OSF_INVERT (1<<3)
29+
30+
#define XT_OSF_LOGLEVEL_ALL 0 /* log all matched fingerprints */
31+
#define XT_OSF_LOGLEVEL_FIRST 1 /* log only the first matced fingerprint */
32+
#define XT_OSF_LOGLEVEL_ALL_KNOWN 2 /* do not log unknown packets */
33+
34+
#define XT_OSF_TTL_TRUE 0 /* True ip and fingerprint TTL comparison */
35+
#define XT_OSF_TTL_LESS 1 /* Check if ip TTL is less than fingerprint one */
36+
#define XT_OSF_TTL_NOCHECK 2 /* Do not compare ip and fingerprint TTL at all */
37+
38+
struct xt_osf_info {
39+
char genre[MAXGENRELEN];
40+
__u32 len;
41+
__u32 flags;
42+
__u32 loglevel;
43+
__u32 ttl;
44+
};
45+
46+
/*
47+
* Wildcard MSS (kind of).
48+
* It is used to implement a state machine for the different wildcard values
49+
* of the MSS and window sizes.
50+
*/
51+
struct xt_osf_wc {
52+
__u32 wc;
53+
__u32 val;
54+
};
55+
56+
/*
57+
* This struct represents IANA options
58+
* http://www.iana.org/assignments/tcp-parameters
59+
*/
60+
struct xt_osf_opt {
61+
__u16 kind, length;
62+
struct xt_osf_wc wc;
63+
};
64+
65+
struct xt_osf_user_finger {
66+
struct xt_osf_wc wss;
67+
68+
__u8 ttl, df;
69+
__u16 ss, mss;
70+
__u16 opt_num;
71+
72+
char genre[MAXGENRELEN];
73+
char version[MAXGENRELEN];
74+
char subtype[MAXGENRELEN];
75+
76+
/* MAX_IPOPTLEN is maximum if all options are NOPs or EOLs */
77+
struct xt_osf_opt opt[MAX_IPOPTLEN];
78+
};
79+
80+
struct xt_osf_nlmsg {
81+
struct xt_osf_user_finger f;
82+
struct iphdr ip;
83+
struct tcphdr tcp;
84+
};
85+
86+
/* Defines for IANA option kinds */
87+
88+
enum iana_options {
89+
OSFOPT_EOL = 0, /* End of options */
90+
OSFOPT_NOP, /* NOP */
91+
OSFOPT_MSS, /* Maximum segment size */
92+
OSFOPT_WSO, /* Window scale option */
93+
OSFOPT_SACKP, /* SACK permitted */
94+
OSFOPT_SACK, /* SACK */
95+
OSFOPT_ECHO,
96+
OSFOPT_ECHOREPLY,
97+
OSFOPT_TS, /* Timestamp option */
98+
OSFOPT_POCP, /* Partial Order Connection Permitted */
99+
OSFOPT_POSP, /* Partial Order Service Profile */
100+
101+
/* Others are not used in the current OSF */
102+
OSFOPT_EMPTY = 255,
103+
};
104+
105+
/*
106+
* Initial window size option state machine: multiple of mss, mtu or
107+
* plain numeric value. Can also be made as plain numeric value which
108+
* is not a multiple of specified value.
109+
*/
110+
enum xt_osf_window_size_options {
111+
OSF_WSS_PLAIN = 0,
112+
OSF_WSS_MSS,
113+
OSF_WSS_MTU,
114+
OSF_WSS_MODULO,
115+
OSF_WSS_MAX,
116+
};
117+
118+
/*
119+
* Add/remove fingerprint from the kernel.
120+
*/
121+
enum xt_osf_msg_types {
122+
OSF_MSG_ADD,
123+
OSF_MSG_REMOVE,
124+
OSF_MSG_MAX,
125+
};
126+
127+
enum xt_osf_attr_type {
128+
OSF_ATTR_UNSPEC,
129+
OSF_ATTR_FINGER,
130+
OSF_ATTR_MAX,
131+
};
132+
133+
#endif /* _XT_OSF_H */

‎net/netfilter/Kconfig

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -917,6 +917,19 @@ config NETFILTER_XT_MATCH_U32
917917

918918
Details and examples are in the kernel module source.
919919

920+
config NETFILTER_XT_MATCH_OSF
921+
tristate '"osf" Passive OS fingerprint match'
922+
depends on NETFILTER_ADVANCED && NETFILTER_NETLINK
923+
help
924+
This option selects the Passive OS Fingerprinting match module
925+
that allows to passively match the remote operating system by
926+
analyzing incoming TCP SYN packets.
927+
928+
Rules and loading software can be downloaded from
929+
http://www.ioremap.net/projects/osf
930+
931+
To compile it as a module, choose M here. If unsure, say N.
932+
920933
endif # NETFILTER_XTABLES
921934

922935
endmenu

‎net/netfilter/Makefile

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -77,6 +77,7 @@ obj-$(CONFIG_NETFILTER_XT_MATCH_LIMIT) += xt_limit.o
7777
obj-$(CONFIG_NETFILTER_XT_MATCH_MAC) += xt_mac.o
7878
obj-$(CONFIG_NETFILTER_XT_MATCH_MARK) += xt_mark.o
7979
obj-$(CONFIG_NETFILTER_XT_MATCH_MULTIPORT) += xt_multiport.o
80+
obj-$(CONFIG_NETFILTER_XT_MATCH_OSF) += xt_osf.o
8081
obj-$(CONFIG_NETFILTER_XT_MATCH_OWNER) += xt_owner.o
8182
obj-$(CONFIG_NETFILTER_XT_MATCH_PHYSDEV) += xt_physdev.o
8283
obj-$(CONFIG_NETFILTER_XT_MATCH_PKTTYPE) += xt_pkttype.o

0 commit comments

Comments
 (0)