170224baaSJan Lentfer /* $OpenBSD: pfctl_osfp.c,v 1.15 2006/12/13 05:10:15 itojun Exp $ */
2*95cc27f0SJoerg Sonnenberger
3*95cc27f0SJoerg Sonnenberger /*
4*95cc27f0SJoerg Sonnenberger * Copyright (c) 2003 Mike Frantzen <frantzen@openbsd.org>
5*95cc27f0SJoerg Sonnenberger *
6*95cc27f0SJoerg Sonnenberger * Permission to use, copy, modify, and distribute this software for any
7*95cc27f0SJoerg Sonnenberger * purpose with or without fee is hereby granted, provided that the above
8*95cc27f0SJoerg Sonnenberger * copyright notice and this permission notice appear in all copies.
9*95cc27f0SJoerg Sonnenberger *
10*95cc27f0SJoerg Sonnenberger * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11*95cc27f0SJoerg Sonnenberger * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12*95cc27f0SJoerg Sonnenberger * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13*95cc27f0SJoerg Sonnenberger * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14*95cc27f0SJoerg Sonnenberger * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15*95cc27f0SJoerg Sonnenberger * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16*95cc27f0SJoerg Sonnenberger * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17*95cc27f0SJoerg Sonnenberger */
18*95cc27f0SJoerg Sonnenberger
19*95cc27f0SJoerg Sonnenberger #include <sys/types.h>
20*95cc27f0SJoerg Sonnenberger #include <sys/ioctl.h>
21*95cc27f0SJoerg Sonnenberger #include <sys/socket.h>
22*95cc27f0SJoerg Sonnenberger
23*95cc27f0SJoerg Sonnenberger #include <net/if.h>
24*95cc27f0SJoerg Sonnenberger #include <net/pf/pfvar.h>
25*95cc27f0SJoerg Sonnenberger
2670224baaSJan Lentfer #include <netinet/in_systm.h>
2770224baaSJan Lentfer #include <netinet/ip.h>
2870224baaSJan Lentfer #include <netinet/ip6.h>
2970224baaSJan Lentfer
30*95cc27f0SJoerg Sonnenberger #include <ctype.h>
31*95cc27f0SJoerg Sonnenberger #include <err.h>
32*95cc27f0SJoerg Sonnenberger #include <errno.h>
33*95cc27f0SJoerg Sonnenberger #include <stdio.h>
34*95cc27f0SJoerg Sonnenberger #include <stdlib.h>
35*95cc27f0SJoerg Sonnenberger #include <string.h>
36*95cc27f0SJoerg Sonnenberger
37*95cc27f0SJoerg Sonnenberger #include "pfctl_parser.h"
38*95cc27f0SJoerg Sonnenberger #include "pfctl.h"
39*95cc27f0SJoerg Sonnenberger
40*95cc27f0SJoerg Sonnenberger #ifndef MIN
41*95cc27f0SJoerg Sonnenberger # define MIN(a,b) (((a) < (b)) ? (a) : (b))
42*95cc27f0SJoerg Sonnenberger #endif /* MIN */
43*95cc27f0SJoerg Sonnenberger #ifndef MAX
44*95cc27f0SJoerg Sonnenberger # define MAX(a,b) (((a) > (b)) ? (a) : (b))
45*95cc27f0SJoerg Sonnenberger #endif /* MAX */
46*95cc27f0SJoerg Sonnenberger
47*95cc27f0SJoerg Sonnenberger
48*95cc27f0SJoerg Sonnenberger #if 0
49*95cc27f0SJoerg Sonnenberger # define DEBUG(fp, str, v...) \
50*95cc27f0SJoerg Sonnenberger fprintf(stderr, "%s:%s:%s " str "\n", (fp)->fp_os.fp_class_nm, \
51*95cc27f0SJoerg Sonnenberger (fp)->fp_os.fp_version_nm, (fp)->fp_os.fp_subtype_nm , ## v);
52*95cc27f0SJoerg Sonnenberger #else
53*95cc27f0SJoerg Sonnenberger # define DEBUG(fp, str, v...) ((void)0)
54*95cc27f0SJoerg Sonnenberger #endif
55*95cc27f0SJoerg Sonnenberger
56*95cc27f0SJoerg Sonnenberger
57*95cc27f0SJoerg Sonnenberger struct name_entry;
58*95cc27f0SJoerg Sonnenberger LIST_HEAD(name_list, name_entry);
59*95cc27f0SJoerg Sonnenberger struct name_entry {
60*95cc27f0SJoerg Sonnenberger LIST_ENTRY(name_entry) nm_entry;
61*95cc27f0SJoerg Sonnenberger int nm_num;
62*95cc27f0SJoerg Sonnenberger char nm_name[PF_OSFP_LEN];
63*95cc27f0SJoerg Sonnenberger
64*95cc27f0SJoerg Sonnenberger struct name_list nm_sublist;
65*95cc27f0SJoerg Sonnenberger int nm_sublist_num;
66*95cc27f0SJoerg Sonnenberger };
67*95cc27f0SJoerg Sonnenberger struct name_list classes = LIST_HEAD_INITIALIZER(&classes);
68*95cc27f0SJoerg Sonnenberger int class_count;
69*95cc27f0SJoerg Sonnenberger int fingerprint_count;
70*95cc27f0SJoerg Sonnenberger
71*95cc27f0SJoerg Sonnenberger void add_fingerprint(int, int, struct pf_osfp_ioctl *);
72*95cc27f0SJoerg Sonnenberger struct name_entry *fingerprint_name_entry(struct name_list *, char *);
73*95cc27f0SJoerg Sonnenberger void pfctl_flush_my_fingerprints(struct name_list *);
74*95cc27f0SJoerg Sonnenberger char *get_field(char **, size_t *, int *);
75*95cc27f0SJoerg Sonnenberger int get_int(char **, size_t *, int *, int *, const char *,
76*95cc27f0SJoerg Sonnenberger int, int, const char *, int);
77*95cc27f0SJoerg Sonnenberger int get_str(char **, size_t *, char **, const char *, int,
78*95cc27f0SJoerg Sonnenberger const char *, int);
79*95cc27f0SJoerg Sonnenberger int get_tcpopts(const char *, int, const char *,
80*95cc27f0SJoerg Sonnenberger pf_tcpopts_t *, int *, int *, int *, int *, int *,
81*95cc27f0SJoerg Sonnenberger int *);
82*95cc27f0SJoerg Sonnenberger void import_fingerprint(struct pf_osfp_ioctl *);
83*95cc27f0SJoerg Sonnenberger const char *print_ioctl(struct pf_osfp_ioctl *);
84*95cc27f0SJoerg Sonnenberger void print_name_list(int, struct name_list *, const char *);
85*95cc27f0SJoerg Sonnenberger void sort_name_list(int, struct name_list *);
86*95cc27f0SJoerg Sonnenberger struct name_entry *lookup_name_list(struct name_list *, const char *);
87*95cc27f0SJoerg Sonnenberger
88*95cc27f0SJoerg Sonnenberger /* Load fingerprints from a file */
89*95cc27f0SJoerg Sonnenberger int
pfctl_file_fingerprints(int dev,int opts,const char * fp_filename)90*95cc27f0SJoerg Sonnenberger pfctl_file_fingerprints(int dev, int opts, const char *fp_filename)
91*95cc27f0SJoerg Sonnenberger {
92*95cc27f0SJoerg Sonnenberger FILE *in;
93*95cc27f0SJoerg Sonnenberger char *line;
94*95cc27f0SJoerg Sonnenberger size_t len, i;
95*95cc27f0SJoerg Sonnenberger int lineno = 0;
96*95cc27f0SJoerg Sonnenberger int window, w_mod, ttl, df, psize, p_mod, mss, mss_mod, wscale,
97*95cc27f0SJoerg Sonnenberger wscale_mod, optcnt, ts0;
98*95cc27f0SJoerg Sonnenberger pf_tcpopts_t packed_tcpopts;
99*95cc27f0SJoerg Sonnenberger char *class, *version, *subtype, *desc, *tcpopts;
100*95cc27f0SJoerg Sonnenberger struct pf_osfp_ioctl fp;
101*95cc27f0SJoerg Sonnenberger
102*95cc27f0SJoerg Sonnenberger pfctl_flush_my_fingerprints(&classes);
103*95cc27f0SJoerg Sonnenberger
10470224baaSJan Lentfer if ((in = pfctl_fopen(fp_filename, "r")) == NULL) {
10570224baaSJan Lentfer warn("%s", fp_filename);
106*95cc27f0SJoerg Sonnenberger return (1);
107*95cc27f0SJoerg Sonnenberger }
108*95cc27f0SJoerg Sonnenberger class = version = subtype = desc = tcpopts = NULL;
109*95cc27f0SJoerg Sonnenberger
110*95cc27f0SJoerg Sonnenberger if ((opts & PF_OPT_NOACTION) == 0)
111*95cc27f0SJoerg Sonnenberger pfctl_clear_fingerprints(dev, opts);
112*95cc27f0SJoerg Sonnenberger
113*95cc27f0SJoerg Sonnenberger while ((line = fgetln(in, &len)) != NULL) {
114*95cc27f0SJoerg Sonnenberger lineno++;
115*95cc27f0SJoerg Sonnenberger if (class)
116*95cc27f0SJoerg Sonnenberger free(class);
117*95cc27f0SJoerg Sonnenberger if (version)
118*95cc27f0SJoerg Sonnenberger free(version);
119*95cc27f0SJoerg Sonnenberger if (subtype)
120*95cc27f0SJoerg Sonnenberger free(subtype);
121*95cc27f0SJoerg Sonnenberger if (desc)
122*95cc27f0SJoerg Sonnenberger free(desc);
123*95cc27f0SJoerg Sonnenberger if (tcpopts)
124*95cc27f0SJoerg Sonnenberger free(tcpopts);
125*95cc27f0SJoerg Sonnenberger class = version = subtype = desc = tcpopts = NULL;
126*95cc27f0SJoerg Sonnenberger memset(&fp, 0, sizeof(fp));
127*95cc27f0SJoerg Sonnenberger
128*95cc27f0SJoerg Sonnenberger /* Chop off comment */
129*95cc27f0SJoerg Sonnenberger for (i = 0; i < len; i++)
130*95cc27f0SJoerg Sonnenberger if (line[i] == '#') {
131*95cc27f0SJoerg Sonnenberger len = i;
132*95cc27f0SJoerg Sonnenberger break;
133*95cc27f0SJoerg Sonnenberger }
134*95cc27f0SJoerg Sonnenberger /* Chop off whitespace */
135*95cc27f0SJoerg Sonnenberger while (len > 0 && isspace(line[len - 1]))
136*95cc27f0SJoerg Sonnenberger len--;
137*95cc27f0SJoerg Sonnenberger while (len > 0 && isspace(line[0])) {
138*95cc27f0SJoerg Sonnenberger len--;
139*95cc27f0SJoerg Sonnenberger line++;
140*95cc27f0SJoerg Sonnenberger }
141*95cc27f0SJoerg Sonnenberger if (len == 0)
142*95cc27f0SJoerg Sonnenberger continue;
143*95cc27f0SJoerg Sonnenberger
144*95cc27f0SJoerg Sonnenberger #define T_DC 0x01 /* Allow don't care */
145*95cc27f0SJoerg Sonnenberger #define T_MSS 0x02 /* Allow MSS multiple */
146*95cc27f0SJoerg Sonnenberger #define T_MTU 0x04 /* Allow MTU multiple */
147*95cc27f0SJoerg Sonnenberger #define T_MOD 0x08 /* Allow modulus */
148*95cc27f0SJoerg Sonnenberger
149*95cc27f0SJoerg Sonnenberger #define GET_INT(v, mod, n, ty, mx) \
150*95cc27f0SJoerg Sonnenberger get_int(&line, &len, &v, mod, n, ty, mx, fp_filename, lineno)
151*95cc27f0SJoerg Sonnenberger #define GET_STR(v, n, mn) \
152*95cc27f0SJoerg Sonnenberger get_str(&line, &len, &v, n, mn, fp_filename, lineno)
153*95cc27f0SJoerg Sonnenberger
154*95cc27f0SJoerg Sonnenberger if (GET_INT(window, &w_mod, "window size", T_DC|T_MSS|T_MTU|
155*95cc27f0SJoerg Sonnenberger T_MOD, 0xffff) ||
156*95cc27f0SJoerg Sonnenberger GET_INT(ttl, NULL, "ttl", 0, 0xff) ||
157*95cc27f0SJoerg Sonnenberger GET_INT(df, NULL, "don't fragment frag", 0, 1) ||
158*95cc27f0SJoerg Sonnenberger GET_INT(psize, &p_mod, "overall packet size", T_MOD|T_DC,
159*95cc27f0SJoerg Sonnenberger 8192) ||
160*95cc27f0SJoerg Sonnenberger GET_STR(tcpopts, "TCP Options", 1) ||
161*95cc27f0SJoerg Sonnenberger GET_STR(class, "OS class", 1) ||
162*95cc27f0SJoerg Sonnenberger GET_STR(version, "OS version", 0) ||
163*95cc27f0SJoerg Sonnenberger GET_STR(subtype, "OS subtype", 0) ||
164*95cc27f0SJoerg Sonnenberger GET_STR(desc, "OS description", 2))
165*95cc27f0SJoerg Sonnenberger continue;
166*95cc27f0SJoerg Sonnenberger if (get_tcpopts(fp_filename, lineno, tcpopts, &packed_tcpopts,
167*95cc27f0SJoerg Sonnenberger &optcnt, &mss, &mss_mod, &wscale, &wscale_mod, &ts0))
168*95cc27f0SJoerg Sonnenberger continue;
169*95cc27f0SJoerg Sonnenberger if (len != 0) {
170*95cc27f0SJoerg Sonnenberger fprintf(stderr, "%s:%d excess field\n", fp_filename,
171*95cc27f0SJoerg Sonnenberger lineno);
172*95cc27f0SJoerg Sonnenberger continue;
173*95cc27f0SJoerg Sonnenberger }
174*95cc27f0SJoerg Sonnenberger
175*95cc27f0SJoerg Sonnenberger fp.fp_ttl = ttl;
176*95cc27f0SJoerg Sonnenberger if (df)
177*95cc27f0SJoerg Sonnenberger fp.fp_flags |= PF_OSFP_DF;
178*95cc27f0SJoerg Sonnenberger switch (w_mod) {
179*95cc27f0SJoerg Sonnenberger case 0:
180*95cc27f0SJoerg Sonnenberger break;
181*95cc27f0SJoerg Sonnenberger case T_DC:
182*95cc27f0SJoerg Sonnenberger fp.fp_flags |= PF_OSFP_WSIZE_DC;
183*95cc27f0SJoerg Sonnenberger break;
184*95cc27f0SJoerg Sonnenberger case T_MSS:
185*95cc27f0SJoerg Sonnenberger fp.fp_flags |= PF_OSFP_WSIZE_MSS;
186*95cc27f0SJoerg Sonnenberger break;
187*95cc27f0SJoerg Sonnenberger case T_MTU:
188*95cc27f0SJoerg Sonnenberger fp.fp_flags |= PF_OSFP_WSIZE_MTU;
189*95cc27f0SJoerg Sonnenberger break;
190*95cc27f0SJoerg Sonnenberger case T_MOD:
191*95cc27f0SJoerg Sonnenberger fp.fp_flags |= PF_OSFP_WSIZE_MOD;
192*95cc27f0SJoerg Sonnenberger break;
193*95cc27f0SJoerg Sonnenberger }
194*95cc27f0SJoerg Sonnenberger fp.fp_wsize = window;
195*95cc27f0SJoerg Sonnenberger
196*95cc27f0SJoerg Sonnenberger switch (p_mod) {
197*95cc27f0SJoerg Sonnenberger case T_DC:
198*95cc27f0SJoerg Sonnenberger fp.fp_flags |= PF_OSFP_PSIZE_DC;
199*95cc27f0SJoerg Sonnenberger break;
200*95cc27f0SJoerg Sonnenberger case T_MOD:
201*95cc27f0SJoerg Sonnenberger fp.fp_flags |= PF_OSFP_PSIZE_MOD;
202*95cc27f0SJoerg Sonnenberger }
203*95cc27f0SJoerg Sonnenberger fp.fp_psize = psize;
204*95cc27f0SJoerg Sonnenberger
205*95cc27f0SJoerg Sonnenberger
206*95cc27f0SJoerg Sonnenberger switch (wscale_mod) {
207*95cc27f0SJoerg Sonnenberger case T_DC:
208*95cc27f0SJoerg Sonnenberger fp.fp_flags |= PF_OSFP_WSCALE_DC;
209*95cc27f0SJoerg Sonnenberger break;
210*95cc27f0SJoerg Sonnenberger case T_MOD:
211*95cc27f0SJoerg Sonnenberger fp.fp_flags |= PF_OSFP_WSCALE_MOD;
212*95cc27f0SJoerg Sonnenberger }
213*95cc27f0SJoerg Sonnenberger fp.fp_wscale = wscale;
214*95cc27f0SJoerg Sonnenberger
215*95cc27f0SJoerg Sonnenberger switch (mss_mod) {
216*95cc27f0SJoerg Sonnenberger case T_DC:
217*95cc27f0SJoerg Sonnenberger fp.fp_flags |= PF_OSFP_MSS_DC;
218*95cc27f0SJoerg Sonnenberger break;
219*95cc27f0SJoerg Sonnenberger case T_MOD:
220*95cc27f0SJoerg Sonnenberger fp.fp_flags |= PF_OSFP_MSS_MOD;
221*95cc27f0SJoerg Sonnenberger break;
222*95cc27f0SJoerg Sonnenberger }
223*95cc27f0SJoerg Sonnenberger fp.fp_mss = mss;
224*95cc27f0SJoerg Sonnenberger
225*95cc27f0SJoerg Sonnenberger fp.fp_tcpopts = packed_tcpopts;
226*95cc27f0SJoerg Sonnenberger fp.fp_optcnt = optcnt;
227*95cc27f0SJoerg Sonnenberger if (ts0)
228*95cc27f0SJoerg Sonnenberger fp.fp_flags |= PF_OSFP_TS0;
229*95cc27f0SJoerg Sonnenberger
230*95cc27f0SJoerg Sonnenberger if (class[0] == '@')
231*95cc27f0SJoerg Sonnenberger fp.fp_os.fp_enflags |= PF_OSFP_GENERIC;
232*95cc27f0SJoerg Sonnenberger if (class[0] == '*')
233*95cc27f0SJoerg Sonnenberger fp.fp_os.fp_enflags |= PF_OSFP_NODETAIL;
234*95cc27f0SJoerg Sonnenberger
235*95cc27f0SJoerg Sonnenberger if (class[0] == '@' || class[0] == '*')
236*95cc27f0SJoerg Sonnenberger strlcpy(fp.fp_os.fp_class_nm, class + 1,
237*95cc27f0SJoerg Sonnenberger sizeof(fp.fp_os.fp_class_nm));
238*95cc27f0SJoerg Sonnenberger else
239*95cc27f0SJoerg Sonnenberger strlcpy(fp.fp_os.fp_class_nm, class,
240*95cc27f0SJoerg Sonnenberger sizeof(fp.fp_os.fp_class_nm));
241*95cc27f0SJoerg Sonnenberger strlcpy(fp.fp_os.fp_version_nm, version,
242*95cc27f0SJoerg Sonnenberger sizeof(fp.fp_os.fp_version_nm));
243*95cc27f0SJoerg Sonnenberger strlcpy(fp.fp_os.fp_subtype_nm, subtype,
244*95cc27f0SJoerg Sonnenberger sizeof(fp.fp_os.fp_subtype_nm));
245*95cc27f0SJoerg Sonnenberger
246*95cc27f0SJoerg Sonnenberger add_fingerprint(dev, opts, &fp);
24770224baaSJan Lentfer
24870224baaSJan Lentfer fp.fp_flags |= (PF_OSFP_DF | PF_OSFP_INET6);
24970224baaSJan Lentfer fp.fp_psize += sizeof(struct ip6_hdr) - sizeof(struct ip);
25070224baaSJan Lentfer add_fingerprint(dev, opts, &fp);
251*95cc27f0SJoerg Sonnenberger }
252*95cc27f0SJoerg Sonnenberger
253*95cc27f0SJoerg Sonnenberger if (class)
254*95cc27f0SJoerg Sonnenberger free(class);
255*95cc27f0SJoerg Sonnenberger if (version)
256*95cc27f0SJoerg Sonnenberger free(version);
257*95cc27f0SJoerg Sonnenberger if (subtype)
258*95cc27f0SJoerg Sonnenberger free(subtype);
259*95cc27f0SJoerg Sonnenberger if (desc)
260*95cc27f0SJoerg Sonnenberger free(desc);
26170224baaSJan Lentfer if (tcpopts)
26270224baaSJan Lentfer free(tcpopts);
263*95cc27f0SJoerg Sonnenberger
264*95cc27f0SJoerg Sonnenberger fclose(in);
265*95cc27f0SJoerg Sonnenberger
266*95cc27f0SJoerg Sonnenberger if (opts & PF_OPT_VERBOSE2)
267*95cc27f0SJoerg Sonnenberger printf("Loaded %d passive OS fingerprints\n",
268*95cc27f0SJoerg Sonnenberger fingerprint_count);
269*95cc27f0SJoerg Sonnenberger return (0);
270*95cc27f0SJoerg Sonnenberger }
271*95cc27f0SJoerg Sonnenberger
272*95cc27f0SJoerg Sonnenberger /* flush the kernel's fingerprints */
273*95cc27f0SJoerg Sonnenberger void
pfctl_clear_fingerprints(int dev,int opts __unused)274*95cc27f0SJoerg Sonnenberger pfctl_clear_fingerprints(int dev, int opts __unused)
275*95cc27f0SJoerg Sonnenberger {
276*95cc27f0SJoerg Sonnenberger if (ioctl(dev, DIOCOSFPFLUSH))
277*95cc27f0SJoerg Sonnenberger err(1, "DIOCOSFPFLUSH");
278*95cc27f0SJoerg Sonnenberger }
279*95cc27f0SJoerg Sonnenberger
280*95cc27f0SJoerg Sonnenberger /* flush pfctl's view of the fingerprints */
281*95cc27f0SJoerg Sonnenberger void
pfctl_flush_my_fingerprints(struct name_list * list)282*95cc27f0SJoerg Sonnenberger pfctl_flush_my_fingerprints(struct name_list *list)
283*95cc27f0SJoerg Sonnenberger {
284*95cc27f0SJoerg Sonnenberger struct name_entry *nm;
285*95cc27f0SJoerg Sonnenberger
286*95cc27f0SJoerg Sonnenberger while ((nm = LIST_FIRST(list)) != NULL) {
287*95cc27f0SJoerg Sonnenberger LIST_REMOVE(nm, nm_entry);
288*95cc27f0SJoerg Sonnenberger pfctl_flush_my_fingerprints(&nm->nm_sublist);
289*95cc27f0SJoerg Sonnenberger free(nm);
290*95cc27f0SJoerg Sonnenberger }
29170224baaSJan Lentfer fingerprint_count = 0;
292*95cc27f0SJoerg Sonnenberger class_count = 0;
293*95cc27f0SJoerg Sonnenberger }
294*95cc27f0SJoerg Sonnenberger
295*95cc27f0SJoerg Sonnenberger /* Fetch the active fingerprints from the kernel */
296*95cc27f0SJoerg Sonnenberger int
pfctl_load_fingerprints(int dev,int opts __unused)297*95cc27f0SJoerg Sonnenberger pfctl_load_fingerprints(int dev, int opts __unused)
298*95cc27f0SJoerg Sonnenberger {
299*95cc27f0SJoerg Sonnenberger struct pf_osfp_ioctl io;
300*95cc27f0SJoerg Sonnenberger int i;
301*95cc27f0SJoerg Sonnenberger
302*95cc27f0SJoerg Sonnenberger pfctl_flush_my_fingerprints(&classes);
303*95cc27f0SJoerg Sonnenberger
304*95cc27f0SJoerg Sonnenberger for (i = 0; i >= 0; i++) {
305*95cc27f0SJoerg Sonnenberger memset(&io, 0, sizeof(io));
306*95cc27f0SJoerg Sonnenberger io.fp_getnum = i;
307*95cc27f0SJoerg Sonnenberger if (ioctl(dev, DIOCOSFPGET, &io)) {
308*95cc27f0SJoerg Sonnenberger if (errno == EBUSY)
309*95cc27f0SJoerg Sonnenberger break;
310*95cc27f0SJoerg Sonnenberger warn("DIOCOSFPGET");
311*95cc27f0SJoerg Sonnenberger return (1);
312*95cc27f0SJoerg Sonnenberger }
313*95cc27f0SJoerg Sonnenberger import_fingerprint(&io);
314*95cc27f0SJoerg Sonnenberger }
315*95cc27f0SJoerg Sonnenberger return (0);
316*95cc27f0SJoerg Sonnenberger }
317*95cc27f0SJoerg Sonnenberger
318*95cc27f0SJoerg Sonnenberger /* List the fingerprints */
319*95cc27f0SJoerg Sonnenberger void
pfctl_show_fingerprints(int opts)320*95cc27f0SJoerg Sonnenberger pfctl_show_fingerprints(int opts)
321*95cc27f0SJoerg Sonnenberger {
322*95cc27f0SJoerg Sonnenberger if (LIST_FIRST(&classes) != NULL) {
323*95cc27f0SJoerg Sonnenberger if (opts & PF_OPT_SHOWALL) {
324*95cc27f0SJoerg Sonnenberger pfctl_print_title("OS FINGERPRINTS:");
325*95cc27f0SJoerg Sonnenberger printf("%u fingerprints loaded\n", fingerprint_count);
326*95cc27f0SJoerg Sonnenberger } else {
327*95cc27f0SJoerg Sonnenberger printf("Class\tVersion\tSubtype(subversion)\n");
328*95cc27f0SJoerg Sonnenberger printf("-----\t-------\t-------------------\n");
329*95cc27f0SJoerg Sonnenberger sort_name_list(opts, &classes);
330*95cc27f0SJoerg Sonnenberger print_name_list(opts, &classes, "");
331*95cc27f0SJoerg Sonnenberger }
332*95cc27f0SJoerg Sonnenberger }
333*95cc27f0SJoerg Sonnenberger }
334*95cc27f0SJoerg Sonnenberger
335*95cc27f0SJoerg Sonnenberger /* Lookup a fingerprint */
336*95cc27f0SJoerg Sonnenberger pf_osfp_t
pfctl_get_fingerprint(const char * name)337*95cc27f0SJoerg Sonnenberger pfctl_get_fingerprint(const char *name)
338*95cc27f0SJoerg Sonnenberger {
339*95cc27f0SJoerg Sonnenberger struct name_entry *nm, *class_nm, *version_nm, *subtype_nm;
340*95cc27f0SJoerg Sonnenberger pf_osfp_t ret = PF_OSFP_NOMATCH;
341*95cc27f0SJoerg Sonnenberger int class, version, subtype;
342*95cc27f0SJoerg Sonnenberger int unp_class, unp_version, unp_subtype;
343*95cc27f0SJoerg Sonnenberger int wr_len, version_len, subtype_len;
344*95cc27f0SJoerg Sonnenberger char *ptr, *wr_name;
345*95cc27f0SJoerg Sonnenberger
346*95cc27f0SJoerg Sonnenberger if (strcasecmp(name, "unknown") == 0)
347*95cc27f0SJoerg Sonnenberger return (PF_OSFP_UNKNOWN);
348*95cc27f0SJoerg Sonnenberger
349*95cc27f0SJoerg Sonnenberger /* Try most likely no version and no subtype */
350*95cc27f0SJoerg Sonnenberger if ((nm = lookup_name_list(&classes, name))) {
351*95cc27f0SJoerg Sonnenberger class = nm->nm_num;
352*95cc27f0SJoerg Sonnenberger version = PF_OSFP_ANY;
353*95cc27f0SJoerg Sonnenberger subtype = PF_OSFP_ANY;
354*95cc27f0SJoerg Sonnenberger goto found;
355*95cc27f0SJoerg Sonnenberger } else {
356*95cc27f0SJoerg Sonnenberger
357*95cc27f0SJoerg Sonnenberger /* Chop it up into class/version/subtype */
358*95cc27f0SJoerg Sonnenberger
359*95cc27f0SJoerg Sonnenberger if ((wr_name = strdup(name)) == NULL)
360*95cc27f0SJoerg Sonnenberger err(1, "malloc");
36170224baaSJan Lentfer if ((ptr = strchr(wr_name, ' ')) == NULL) {
362*95cc27f0SJoerg Sonnenberger free(wr_name);
363*95cc27f0SJoerg Sonnenberger return (PF_OSFP_NOMATCH);
364*95cc27f0SJoerg Sonnenberger }
365*95cc27f0SJoerg Sonnenberger *ptr++ = '\0';
366*95cc27f0SJoerg Sonnenberger
367*95cc27f0SJoerg Sonnenberger /* The class is easy to find since it is delimited by a space */
368*95cc27f0SJoerg Sonnenberger if ((class_nm = lookup_name_list(&classes, wr_name)) == NULL) {
369*95cc27f0SJoerg Sonnenberger free(wr_name);
370*95cc27f0SJoerg Sonnenberger return (PF_OSFP_NOMATCH);
371*95cc27f0SJoerg Sonnenberger }
372*95cc27f0SJoerg Sonnenberger class = class_nm->nm_num;
373*95cc27f0SJoerg Sonnenberger
374*95cc27f0SJoerg Sonnenberger /* Try no subtype */
375*95cc27f0SJoerg Sonnenberger if ((version_nm = lookup_name_list(&class_nm->nm_sublist, ptr)))
376*95cc27f0SJoerg Sonnenberger {
377*95cc27f0SJoerg Sonnenberger version = version_nm->nm_num;
378*95cc27f0SJoerg Sonnenberger subtype = PF_OSFP_ANY;
379*95cc27f0SJoerg Sonnenberger free(wr_name);
380*95cc27f0SJoerg Sonnenberger goto found;
381*95cc27f0SJoerg Sonnenberger }
382*95cc27f0SJoerg Sonnenberger
383*95cc27f0SJoerg Sonnenberger
384*95cc27f0SJoerg Sonnenberger /*
385*95cc27f0SJoerg Sonnenberger * There must be a version and a subtype.
386*95cc27f0SJoerg Sonnenberger * We'll do some fuzzy matching to pick up things like:
387*95cc27f0SJoerg Sonnenberger * Linux 2.2.14 (version=2.2 subtype=14)
388*95cc27f0SJoerg Sonnenberger * FreeBSD 4.0-STABLE (version=4.0 subtype=STABLE)
389*95cc27f0SJoerg Sonnenberger * Windows 2000 SP2 (version=2000 subtype=SP2)
390*95cc27f0SJoerg Sonnenberger */
391*95cc27f0SJoerg Sonnenberger #define CONNECTOR(x) ((x) == '.' || (x) == ' ' || (x) == '\t' || (x) == '-')
392*95cc27f0SJoerg Sonnenberger wr_len = strlen(ptr);
393*95cc27f0SJoerg Sonnenberger LIST_FOREACH(version_nm, &class_nm->nm_sublist, nm_entry) {
394*95cc27f0SJoerg Sonnenberger version_len = strlen(version_nm->nm_name);
395*95cc27f0SJoerg Sonnenberger if (wr_len < version_len + 2 ||
396*95cc27f0SJoerg Sonnenberger !CONNECTOR(ptr[version_len]))
397*95cc27f0SJoerg Sonnenberger continue;
398*95cc27f0SJoerg Sonnenberger /* first part of the string must be version */
399*95cc27f0SJoerg Sonnenberger if (strncasecmp(ptr, version_nm->nm_name,
400*95cc27f0SJoerg Sonnenberger version_len))
401*95cc27f0SJoerg Sonnenberger continue;
402*95cc27f0SJoerg Sonnenberger
403*95cc27f0SJoerg Sonnenberger LIST_FOREACH(subtype_nm, &version_nm->nm_sublist,
404*95cc27f0SJoerg Sonnenberger nm_entry) {
405*95cc27f0SJoerg Sonnenberger subtype_len = strlen(subtype_nm->nm_name);
406*95cc27f0SJoerg Sonnenberger if (wr_len != version_len + subtype_len + 1)
407*95cc27f0SJoerg Sonnenberger continue;
408*95cc27f0SJoerg Sonnenberger
409*95cc27f0SJoerg Sonnenberger /* last part of the string must be subtype */
410*95cc27f0SJoerg Sonnenberger if (strcasecmp(&ptr[version_len+1],
411*95cc27f0SJoerg Sonnenberger subtype_nm->nm_name) != 0)
412*95cc27f0SJoerg Sonnenberger continue;
413*95cc27f0SJoerg Sonnenberger
414*95cc27f0SJoerg Sonnenberger /* Found it!! */
415*95cc27f0SJoerg Sonnenberger version = version_nm->nm_num;
416*95cc27f0SJoerg Sonnenberger subtype = subtype_nm->nm_num;
417*95cc27f0SJoerg Sonnenberger free(wr_name);
418*95cc27f0SJoerg Sonnenberger goto found;
419*95cc27f0SJoerg Sonnenberger }
420*95cc27f0SJoerg Sonnenberger }
421*95cc27f0SJoerg Sonnenberger
422*95cc27f0SJoerg Sonnenberger free(wr_name);
423*95cc27f0SJoerg Sonnenberger return (PF_OSFP_NOMATCH);
424*95cc27f0SJoerg Sonnenberger }
425*95cc27f0SJoerg Sonnenberger
426*95cc27f0SJoerg Sonnenberger found:
427*95cc27f0SJoerg Sonnenberger PF_OSFP_PACK(ret, class, version, subtype);
428*95cc27f0SJoerg Sonnenberger if (ret != PF_OSFP_NOMATCH) {
429*95cc27f0SJoerg Sonnenberger PF_OSFP_UNPACK(ret, unp_class, unp_version, unp_subtype);
430*95cc27f0SJoerg Sonnenberger if (class != unp_class) {
431*95cc27f0SJoerg Sonnenberger fprintf(stderr, "warning: fingerprint table overflowed "
432*95cc27f0SJoerg Sonnenberger "classes\n");
433*95cc27f0SJoerg Sonnenberger return (PF_OSFP_NOMATCH);
434*95cc27f0SJoerg Sonnenberger }
435*95cc27f0SJoerg Sonnenberger if (version != unp_version) {
436*95cc27f0SJoerg Sonnenberger fprintf(stderr, "warning: fingerprint table overflowed "
437*95cc27f0SJoerg Sonnenberger "versions\n");
438*95cc27f0SJoerg Sonnenberger return (PF_OSFP_NOMATCH);
439*95cc27f0SJoerg Sonnenberger }
440*95cc27f0SJoerg Sonnenberger if (subtype != unp_subtype) {
441*95cc27f0SJoerg Sonnenberger fprintf(stderr, "warning: fingerprint table overflowed "
442*95cc27f0SJoerg Sonnenberger "subtypes\n");
443*95cc27f0SJoerg Sonnenberger return (PF_OSFP_NOMATCH);
444*95cc27f0SJoerg Sonnenberger }
445*95cc27f0SJoerg Sonnenberger }
446*95cc27f0SJoerg Sonnenberger if (ret == PF_OSFP_ANY) {
447*95cc27f0SJoerg Sonnenberger /* should never happen */
448*95cc27f0SJoerg Sonnenberger fprintf(stderr, "warning: fingerprint packed to 'any'\n");
449*95cc27f0SJoerg Sonnenberger return (PF_OSFP_NOMATCH);
450*95cc27f0SJoerg Sonnenberger }
451*95cc27f0SJoerg Sonnenberger
452*95cc27f0SJoerg Sonnenberger return (ret);
453*95cc27f0SJoerg Sonnenberger }
454*95cc27f0SJoerg Sonnenberger
455*95cc27f0SJoerg Sonnenberger /* Lookup a fingerprint name by ID */
456*95cc27f0SJoerg Sonnenberger char *
pfctl_lookup_fingerprint(pf_osfp_t fp,char * buf,size_t len)457*95cc27f0SJoerg Sonnenberger pfctl_lookup_fingerprint(pf_osfp_t fp, char *buf, size_t len)
458*95cc27f0SJoerg Sonnenberger {
459*95cc27f0SJoerg Sonnenberger int class, version, subtype;
460*95cc27f0SJoerg Sonnenberger struct name_list *list;
461*95cc27f0SJoerg Sonnenberger struct name_entry *nm;
462*95cc27f0SJoerg Sonnenberger
463*95cc27f0SJoerg Sonnenberger char *class_name, *version_name, *subtype_name;
464*95cc27f0SJoerg Sonnenberger class_name = version_name = subtype_name = NULL;
465*95cc27f0SJoerg Sonnenberger
466*95cc27f0SJoerg Sonnenberger if (fp == PF_OSFP_UNKNOWN) {
467*95cc27f0SJoerg Sonnenberger strlcpy(buf, "unknown", len);
468*95cc27f0SJoerg Sonnenberger return (buf);
469*95cc27f0SJoerg Sonnenberger }
470*95cc27f0SJoerg Sonnenberger if (fp == PF_OSFP_ANY) {
471*95cc27f0SJoerg Sonnenberger strlcpy(buf, "any", len);
472*95cc27f0SJoerg Sonnenberger return (buf);
473*95cc27f0SJoerg Sonnenberger }
474*95cc27f0SJoerg Sonnenberger
475*95cc27f0SJoerg Sonnenberger PF_OSFP_UNPACK(fp, class, version, subtype);
476*95cc27f0SJoerg Sonnenberger if (class >= (1 << _FP_CLASS_BITS) ||
477*95cc27f0SJoerg Sonnenberger version >= (1 << _FP_VERSION_BITS) ||
478*95cc27f0SJoerg Sonnenberger subtype >= (1 << _FP_SUBTYPE_BITS)) {
479*95cc27f0SJoerg Sonnenberger warnx("PF_OSFP_UNPACK(0x%x) failed!!", fp);
480*95cc27f0SJoerg Sonnenberger strlcpy(buf, "nomatch", len);
481*95cc27f0SJoerg Sonnenberger return (buf);
482*95cc27f0SJoerg Sonnenberger }
483*95cc27f0SJoerg Sonnenberger
484*95cc27f0SJoerg Sonnenberger LIST_FOREACH(nm, &classes, nm_entry) {
485*95cc27f0SJoerg Sonnenberger if (nm->nm_num == class) {
486*95cc27f0SJoerg Sonnenberger class_name = nm->nm_name;
487*95cc27f0SJoerg Sonnenberger if (version == PF_OSFP_ANY)
488*95cc27f0SJoerg Sonnenberger goto found;
489*95cc27f0SJoerg Sonnenberger list = &nm->nm_sublist;
490*95cc27f0SJoerg Sonnenberger LIST_FOREACH(nm, list, nm_entry) {
491*95cc27f0SJoerg Sonnenberger if (nm->nm_num == version) {
492*95cc27f0SJoerg Sonnenberger version_name = nm->nm_name;
493*95cc27f0SJoerg Sonnenberger if (subtype == PF_OSFP_ANY)
494*95cc27f0SJoerg Sonnenberger goto found;
495*95cc27f0SJoerg Sonnenberger list = &nm->nm_sublist;
496*95cc27f0SJoerg Sonnenberger LIST_FOREACH(nm, list, nm_entry) {
497*95cc27f0SJoerg Sonnenberger if (nm->nm_num == subtype) {
498*95cc27f0SJoerg Sonnenberger subtype_name =
499*95cc27f0SJoerg Sonnenberger nm->nm_name;
500*95cc27f0SJoerg Sonnenberger goto found;
501*95cc27f0SJoerg Sonnenberger }
502*95cc27f0SJoerg Sonnenberger } /* foreach subtype */
503*95cc27f0SJoerg Sonnenberger strlcpy(buf, "nomatch", len);
504*95cc27f0SJoerg Sonnenberger return (buf);
505*95cc27f0SJoerg Sonnenberger }
506*95cc27f0SJoerg Sonnenberger } /* foreach version */
507*95cc27f0SJoerg Sonnenberger strlcpy(buf, "nomatch", len);
508*95cc27f0SJoerg Sonnenberger return (buf);
509*95cc27f0SJoerg Sonnenberger }
510*95cc27f0SJoerg Sonnenberger } /* foreach class */
511*95cc27f0SJoerg Sonnenberger
512*95cc27f0SJoerg Sonnenberger strlcpy(buf, "nomatch", len);
513*95cc27f0SJoerg Sonnenberger return (buf);
514*95cc27f0SJoerg Sonnenberger
515*95cc27f0SJoerg Sonnenberger found:
516*95cc27f0SJoerg Sonnenberger snprintf(buf, len, "%s", class_name);
517*95cc27f0SJoerg Sonnenberger if (version_name) {
518*95cc27f0SJoerg Sonnenberger strlcat(buf, " ", len);
519*95cc27f0SJoerg Sonnenberger strlcat(buf, version_name, len);
520*95cc27f0SJoerg Sonnenberger if (subtype_name) {
52170224baaSJan Lentfer if (strchr(version_name, ' '))
522*95cc27f0SJoerg Sonnenberger strlcat(buf, " ", len);
52370224baaSJan Lentfer else if (strchr(version_name, '.') &&
524*95cc27f0SJoerg Sonnenberger isdigit(*subtype_name))
525*95cc27f0SJoerg Sonnenberger strlcat(buf, ".", len);
526*95cc27f0SJoerg Sonnenberger else
527*95cc27f0SJoerg Sonnenberger strlcat(buf, " ", len);
528*95cc27f0SJoerg Sonnenberger strlcat(buf, subtype_name, len);
529*95cc27f0SJoerg Sonnenberger }
530*95cc27f0SJoerg Sonnenberger }
531*95cc27f0SJoerg Sonnenberger return (buf);
532*95cc27f0SJoerg Sonnenberger }
533*95cc27f0SJoerg Sonnenberger
534*95cc27f0SJoerg Sonnenberger /* lookup a name in a list */
535*95cc27f0SJoerg Sonnenberger struct name_entry *
lookup_name_list(struct name_list * list,const char * name)536*95cc27f0SJoerg Sonnenberger lookup_name_list(struct name_list *list, const char *name)
537*95cc27f0SJoerg Sonnenberger {
538*95cc27f0SJoerg Sonnenberger struct name_entry *nm;
539*95cc27f0SJoerg Sonnenberger LIST_FOREACH(nm, list, nm_entry)
540*95cc27f0SJoerg Sonnenberger if (strcasecmp(name, nm->nm_name) == 0)
541*95cc27f0SJoerg Sonnenberger return (nm);
542*95cc27f0SJoerg Sonnenberger
543*95cc27f0SJoerg Sonnenberger return (NULL);
544*95cc27f0SJoerg Sonnenberger }
545*95cc27f0SJoerg Sonnenberger
546*95cc27f0SJoerg Sonnenberger
547*95cc27f0SJoerg Sonnenberger void
add_fingerprint(int dev,int opts,struct pf_osfp_ioctl * fp)548*95cc27f0SJoerg Sonnenberger add_fingerprint(int dev, int opts, struct pf_osfp_ioctl *fp)
549*95cc27f0SJoerg Sonnenberger {
550*95cc27f0SJoerg Sonnenberger struct pf_osfp_ioctl fptmp;
551*95cc27f0SJoerg Sonnenberger struct name_entry *nm_class, *nm_version, *nm_subtype;
552*95cc27f0SJoerg Sonnenberger int class, version, subtype;
553*95cc27f0SJoerg Sonnenberger
554*95cc27f0SJoerg Sonnenberger /* We expand #-# or #.#-#.# version/subtypes into multiple fingerprints */
555*95cc27f0SJoerg Sonnenberger #define EXPAND(field) do { \
556*95cc27f0SJoerg Sonnenberger int _dot = -1, _start = -1, _end = -1, _i = 0; \
557*95cc27f0SJoerg Sonnenberger /* pick major version out of #.# */ \
558*95cc27f0SJoerg Sonnenberger if (isdigit(fp->field[_i]) && fp->field[_i+1] == '.') { \
559*95cc27f0SJoerg Sonnenberger _dot = fp->field[_i] - '0'; \
560*95cc27f0SJoerg Sonnenberger _i += 2; \
561*95cc27f0SJoerg Sonnenberger } \
562*95cc27f0SJoerg Sonnenberger if (isdigit(fp->field[_i])) \
563*95cc27f0SJoerg Sonnenberger _start = fp->field[_i++] - '0'; \
564*95cc27f0SJoerg Sonnenberger else \
565*95cc27f0SJoerg Sonnenberger break; \
566*95cc27f0SJoerg Sonnenberger if (isdigit(fp->field[_i])) \
567*95cc27f0SJoerg Sonnenberger _start = (_start * 10) + fp->field[_i++] - '0'; \
568*95cc27f0SJoerg Sonnenberger if (fp->field[_i++] != '-') \
569*95cc27f0SJoerg Sonnenberger break; \
570*95cc27f0SJoerg Sonnenberger if (isdigit(fp->field[_i]) && fp->field[_i+1] == '.' && \
571*95cc27f0SJoerg Sonnenberger fp->field[_i] - '0' == _dot) \
572*95cc27f0SJoerg Sonnenberger _i += 2; \
573*95cc27f0SJoerg Sonnenberger else if (_dot != -1) \
574*95cc27f0SJoerg Sonnenberger break; \
575*95cc27f0SJoerg Sonnenberger if (isdigit(fp->field[_i])) \
576*95cc27f0SJoerg Sonnenberger _end = fp->field[_i++] - '0'; \
577*95cc27f0SJoerg Sonnenberger else \
578*95cc27f0SJoerg Sonnenberger break; \
579*95cc27f0SJoerg Sonnenberger if (isdigit(fp->field[_i])) \
580*95cc27f0SJoerg Sonnenberger _end = (_end * 10) + fp->field[_i++] - '0'; \
581*95cc27f0SJoerg Sonnenberger if (isdigit(fp->field[_i])) \
582*95cc27f0SJoerg Sonnenberger _end = (_end * 10) + fp->field[_i++] - '0'; \
583*95cc27f0SJoerg Sonnenberger if (fp->field[_i] != '\0') \
584*95cc27f0SJoerg Sonnenberger break; \
585*95cc27f0SJoerg Sonnenberger memcpy(&fptmp, fp, sizeof(fptmp)); \
586*95cc27f0SJoerg Sonnenberger for (;_start <= _end; _start++) { \
587*95cc27f0SJoerg Sonnenberger memset(fptmp.field, 0, sizeof(fptmp.field)); \
588*95cc27f0SJoerg Sonnenberger fptmp.fp_os.fp_enflags |= PF_OSFP_EXPANDED; \
589*95cc27f0SJoerg Sonnenberger if (_dot == -1) \
590*95cc27f0SJoerg Sonnenberger snprintf(fptmp.field, sizeof(fptmp.field), \
591*95cc27f0SJoerg Sonnenberger "%d", _start); \
592*95cc27f0SJoerg Sonnenberger else \
593*95cc27f0SJoerg Sonnenberger snprintf(fptmp.field, sizeof(fptmp.field), \
594*95cc27f0SJoerg Sonnenberger "%d.%d", _dot, _start); \
595*95cc27f0SJoerg Sonnenberger add_fingerprint(dev, opts, &fptmp); \
596*95cc27f0SJoerg Sonnenberger } \
597*95cc27f0SJoerg Sonnenberger } while(0)
598*95cc27f0SJoerg Sonnenberger
599*95cc27f0SJoerg Sonnenberger /* We allow "#-#" as a version or subtype and we'll expand it */
600*95cc27f0SJoerg Sonnenberger EXPAND(fp_os.fp_version_nm);
601*95cc27f0SJoerg Sonnenberger EXPAND(fp_os.fp_subtype_nm);
602*95cc27f0SJoerg Sonnenberger
603*95cc27f0SJoerg Sonnenberger if (strcasecmp(fp->fp_os.fp_class_nm, "nomatch") == 0)
604*95cc27f0SJoerg Sonnenberger errx(1, "fingerprint class \"nomatch\" is reserved");
605*95cc27f0SJoerg Sonnenberger
606*95cc27f0SJoerg Sonnenberger version = PF_OSFP_ANY;
607*95cc27f0SJoerg Sonnenberger subtype = PF_OSFP_ANY;
608*95cc27f0SJoerg Sonnenberger
609*95cc27f0SJoerg Sonnenberger nm_class = fingerprint_name_entry(&classes, fp->fp_os.fp_class_nm);
610*95cc27f0SJoerg Sonnenberger if (nm_class->nm_num == 0)
611*95cc27f0SJoerg Sonnenberger nm_class->nm_num = ++class_count;
612*95cc27f0SJoerg Sonnenberger class = nm_class->nm_num;
613*95cc27f0SJoerg Sonnenberger
614*95cc27f0SJoerg Sonnenberger nm_version = fingerprint_name_entry(&nm_class->nm_sublist,
615*95cc27f0SJoerg Sonnenberger fp->fp_os.fp_version_nm);
616*95cc27f0SJoerg Sonnenberger if (nm_version) {
617*95cc27f0SJoerg Sonnenberger if (nm_version->nm_num == 0)
618*95cc27f0SJoerg Sonnenberger nm_version->nm_num = ++nm_class->nm_sublist_num;
619*95cc27f0SJoerg Sonnenberger version = nm_version->nm_num;
620*95cc27f0SJoerg Sonnenberger nm_subtype = fingerprint_name_entry(&nm_version->nm_sublist,
621*95cc27f0SJoerg Sonnenberger fp->fp_os.fp_subtype_nm);
622*95cc27f0SJoerg Sonnenberger if (nm_subtype) {
623*95cc27f0SJoerg Sonnenberger if (nm_subtype->nm_num == 0)
624*95cc27f0SJoerg Sonnenberger nm_subtype->nm_num =
625*95cc27f0SJoerg Sonnenberger ++nm_version->nm_sublist_num;
626*95cc27f0SJoerg Sonnenberger subtype = nm_subtype->nm_num;
627*95cc27f0SJoerg Sonnenberger }
628*95cc27f0SJoerg Sonnenberger }
629*95cc27f0SJoerg Sonnenberger
630*95cc27f0SJoerg Sonnenberger
631*95cc27f0SJoerg Sonnenberger DEBUG(fp, "\tsignature %d:%d:%d %s", class, version, subtype,
632*95cc27f0SJoerg Sonnenberger print_ioctl(fp));
633*95cc27f0SJoerg Sonnenberger
634*95cc27f0SJoerg Sonnenberger PF_OSFP_PACK(fp->fp_os.fp_os, class, version, subtype);
635*95cc27f0SJoerg Sonnenberger fingerprint_count++;
636*95cc27f0SJoerg Sonnenberger
637*95cc27f0SJoerg Sonnenberger #ifdef FAKE_PF_KERNEL
63870224baaSJan Lentfer /* Linked to the sys/net/pf_osfp.c. Call pf_osfp_add() */
639*95cc27f0SJoerg Sonnenberger if ((errno = pf_osfp_add(fp)))
640*95cc27f0SJoerg Sonnenberger #else
641*95cc27f0SJoerg Sonnenberger if ((opts & PF_OPT_NOACTION) == 0 && ioctl(dev, DIOCOSFPADD, fp))
642*95cc27f0SJoerg Sonnenberger #endif /* FAKE_PF_KERNEL */
643*95cc27f0SJoerg Sonnenberger {
644*95cc27f0SJoerg Sonnenberger if (errno == EEXIST) {
645*95cc27f0SJoerg Sonnenberger warn("Duplicate signature for %s %s %s",
646*95cc27f0SJoerg Sonnenberger fp->fp_os.fp_class_nm,
647*95cc27f0SJoerg Sonnenberger fp->fp_os.fp_version_nm,
648*95cc27f0SJoerg Sonnenberger fp->fp_os.fp_subtype_nm);
649*95cc27f0SJoerg Sonnenberger
650*95cc27f0SJoerg Sonnenberger } else {
651*95cc27f0SJoerg Sonnenberger err(1, "DIOCOSFPADD");
652*95cc27f0SJoerg Sonnenberger }
653*95cc27f0SJoerg Sonnenberger }
654*95cc27f0SJoerg Sonnenberger }
655*95cc27f0SJoerg Sonnenberger
656*95cc27f0SJoerg Sonnenberger /* import a fingerprint from the kernel */
657*95cc27f0SJoerg Sonnenberger void
import_fingerprint(struct pf_osfp_ioctl * fp)658*95cc27f0SJoerg Sonnenberger import_fingerprint(struct pf_osfp_ioctl *fp)
659*95cc27f0SJoerg Sonnenberger {
660*95cc27f0SJoerg Sonnenberger struct name_entry *nm_class, *nm_version, *nm_subtype;
661*95cc27f0SJoerg Sonnenberger int class, version, subtype;
662*95cc27f0SJoerg Sonnenberger
663*95cc27f0SJoerg Sonnenberger PF_OSFP_UNPACK(fp->fp_os.fp_os, class, version, subtype);
664*95cc27f0SJoerg Sonnenberger
665*95cc27f0SJoerg Sonnenberger nm_class = fingerprint_name_entry(&classes, fp->fp_os.fp_class_nm);
666*95cc27f0SJoerg Sonnenberger if (nm_class->nm_num == 0) {
667*95cc27f0SJoerg Sonnenberger nm_class->nm_num = class;
668*95cc27f0SJoerg Sonnenberger class_count = MAX(class_count, class);
669*95cc27f0SJoerg Sonnenberger }
670*95cc27f0SJoerg Sonnenberger
671*95cc27f0SJoerg Sonnenberger nm_version = fingerprint_name_entry(&nm_class->nm_sublist,
672*95cc27f0SJoerg Sonnenberger fp->fp_os.fp_version_nm);
673*95cc27f0SJoerg Sonnenberger if (nm_version) {
674*95cc27f0SJoerg Sonnenberger if (nm_version->nm_num == 0) {
675*95cc27f0SJoerg Sonnenberger nm_version->nm_num = version;
676*95cc27f0SJoerg Sonnenberger nm_class->nm_sublist_num = MAX(nm_class->nm_sublist_num,
677*95cc27f0SJoerg Sonnenberger version);
678*95cc27f0SJoerg Sonnenberger }
679*95cc27f0SJoerg Sonnenberger nm_subtype = fingerprint_name_entry(&nm_version->nm_sublist,
680*95cc27f0SJoerg Sonnenberger fp->fp_os.fp_subtype_nm);
681*95cc27f0SJoerg Sonnenberger if (nm_subtype) {
682*95cc27f0SJoerg Sonnenberger if (nm_subtype->nm_num == 0) {
683*95cc27f0SJoerg Sonnenberger nm_subtype->nm_num = subtype;
684*95cc27f0SJoerg Sonnenberger nm_version->nm_sublist_num =
685*95cc27f0SJoerg Sonnenberger MAX(nm_version->nm_sublist_num, subtype);
686*95cc27f0SJoerg Sonnenberger }
687*95cc27f0SJoerg Sonnenberger }
688*95cc27f0SJoerg Sonnenberger }
689*95cc27f0SJoerg Sonnenberger
690*95cc27f0SJoerg Sonnenberger
691*95cc27f0SJoerg Sonnenberger fingerprint_count++;
692*95cc27f0SJoerg Sonnenberger DEBUG(fp, "import signature %d:%d:%d", class, version, subtype);
693*95cc27f0SJoerg Sonnenberger }
694*95cc27f0SJoerg Sonnenberger
695*95cc27f0SJoerg Sonnenberger /* Find an entry for a fingerprints class/version/subtype */
696*95cc27f0SJoerg Sonnenberger struct name_entry *
fingerprint_name_entry(struct name_list * list,char * name)697*95cc27f0SJoerg Sonnenberger fingerprint_name_entry(struct name_list *list, char *name)
698*95cc27f0SJoerg Sonnenberger {
699*95cc27f0SJoerg Sonnenberger struct name_entry *nm_entry;
700*95cc27f0SJoerg Sonnenberger
701*95cc27f0SJoerg Sonnenberger if (name == NULL || strlen(name) == 0)
702*95cc27f0SJoerg Sonnenberger return (NULL);
703*95cc27f0SJoerg Sonnenberger
704*95cc27f0SJoerg Sonnenberger LIST_FOREACH(nm_entry, list, nm_entry) {
705*95cc27f0SJoerg Sonnenberger if (strcasecmp(nm_entry->nm_name, name) == 0) {
706*95cc27f0SJoerg Sonnenberger /* We'll move this to the front of the list later */
707*95cc27f0SJoerg Sonnenberger LIST_REMOVE(nm_entry, nm_entry);
708*95cc27f0SJoerg Sonnenberger break;
709*95cc27f0SJoerg Sonnenberger }
710*95cc27f0SJoerg Sonnenberger }
711*95cc27f0SJoerg Sonnenberger if (nm_entry == NULL) {
712*95cc27f0SJoerg Sonnenberger nm_entry = calloc(1, sizeof(*nm_entry));
713*95cc27f0SJoerg Sonnenberger if (nm_entry == NULL)
714*95cc27f0SJoerg Sonnenberger err(1, "calloc");
715*95cc27f0SJoerg Sonnenberger LIST_INIT(&nm_entry->nm_sublist);
71670224baaSJan Lentfer strlcpy(nm_entry->nm_name, name, sizeof(nm_entry->nm_name));
717*95cc27f0SJoerg Sonnenberger }
718*95cc27f0SJoerg Sonnenberger LIST_INSERT_HEAD(list, nm_entry, nm_entry);
719*95cc27f0SJoerg Sonnenberger return (nm_entry);
720*95cc27f0SJoerg Sonnenberger }
721*95cc27f0SJoerg Sonnenberger
722*95cc27f0SJoerg Sonnenberger
723*95cc27f0SJoerg Sonnenberger void
print_name_list(int opts,struct name_list * nml,const char * prefix)724*95cc27f0SJoerg Sonnenberger print_name_list(int opts, struct name_list *nml, const char *prefix)
725*95cc27f0SJoerg Sonnenberger {
726*95cc27f0SJoerg Sonnenberger char newprefix[32];
727*95cc27f0SJoerg Sonnenberger struct name_entry *nm;
728*95cc27f0SJoerg Sonnenberger
729*95cc27f0SJoerg Sonnenberger LIST_FOREACH(nm, nml, nm_entry) {
730*95cc27f0SJoerg Sonnenberger snprintf(newprefix, sizeof(newprefix), "%s%s\t", prefix,
731*95cc27f0SJoerg Sonnenberger nm->nm_name);
732*95cc27f0SJoerg Sonnenberger printf("%s\n", newprefix);
733*95cc27f0SJoerg Sonnenberger print_name_list(opts, &nm->nm_sublist, newprefix);
734*95cc27f0SJoerg Sonnenberger }
735*95cc27f0SJoerg Sonnenberger }
736*95cc27f0SJoerg Sonnenberger
737*95cc27f0SJoerg Sonnenberger void
sort_name_list(int opts,struct name_list * nml)738*95cc27f0SJoerg Sonnenberger sort_name_list(int opts, struct name_list *nml)
739*95cc27f0SJoerg Sonnenberger {
740*95cc27f0SJoerg Sonnenberger struct name_list new;
741*95cc27f0SJoerg Sonnenberger struct name_entry *nm, *nmsearch, *nmlast;
742*95cc27f0SJoerg Sonnenberger
743*95cc27f0SJoerg Sonnenberger /* yes yes, it's a very slow sort. so sue me */
744*95cc27f0SJoerg Sonnenberger
745*95cc27f0SJoerg Sonnenberger LIST_INIT(&new);
746*95cc27f0SJoerg Sonnenberger
747*95cc27f0SJoerg Sonnenberger while ((nm = LIST_FIRST(nml)) != NULL) {
748*95cc27f0SJoerg Sonnenberger LIST_REMOVE(nm, nm_entry);
749*95cc27f0SJoerg Sonnenberger nmlast = NULL;
750*95cc27f0SJoerg Sonnenberger LIST_FOREACH(nmsearch, &new, nm_entry) {
751*95cc27f0SJoerg Sonnenberger if (strcasecmp(nmsearch->nm_name, nm->nm_name) > 0) {
752*95cc27f0SJoerg Sonnenberger LIST_INSERT_BEFORE(nmsearch, nm, nm_entry);
753*95cc27f0SJoerg Sonnenberger break;
754*95cc27f0SJoerg Sonnenberger }
755*95cc27f0SJoerg Sonnenberger nmlast = nmsearch;
756*95cc27f0SJoerg Sonnenberger }
757*95cc27f0SJoerg Sonnenberger if (nmsearch == NULL) {
758*95cc27f0SJoerg Sonnenberger if (nmlast)
759*95cc27f0SJoerg Sonnenberger LIST_INSERT_AFTER(nmlast, nm, nm_entry);
760*95cc27f0SJoerg Sonnenberger else
761*95cc27f0SJoerg Sonnenberger LIST_INSERT_HEAD(&new, nm, nm_entry);
762*95cc27f0SJoerg Sonnenberger }
763*95cc27f0SJoerg Sonnenberger
764*95cc27f0SJoerg Sonnenberger sort_name_list(opts, &nm->nm_sublist);
765*95cc27f0SJoerg Sonnenberger }
766*95cc27f0SJoerg Sonnenberger nmlast = NULL;
767*95cc27f0SJoerg Sonnenberger while ((nm = LIST_FIRST(&new)) != NULL) {
768*95cc27f0SJoerg Sonnenberger LIST_REMOVE(nm, nm_entry);
769*95cc27f0SJoerg Sonnenberger if (nmlast == NULL)
770*95cc27f0SJoerg Sonnenberger LIST_INSERT_HEAD(nml, nm, nm_entry);
771*95cc27f0SJoerg Sonnenberger else
772*95cc27f0SJoerg Sonnenberger LIST_INSERT_AFTER(nmlast, nm, nm_entry);
773*95cc27f0SJoerg Sonnenberger nmlast = nm;
774*95cc27f0SJoerg Sonnenberger }
775*95cc27f0SJoerg Sonnenberger }
776*95cc27f0SJoerg Sonnenberger
777*95cc27f0SJoerg Sonnenberger /* parse the next integer in a formatted config file line */
778*95cc27f0SJoerg Sonnenberger int
get_int(char ** line,size_t * len,int * var,int * mod,const char * name,int flags,int max,const char * filename,int lineno)779*95cc27f0SJoerg Sonnenberger get_int(char **line, size_t *len, int *var, int *mod,
780*95cc27f0SJoerg Sonnenberger const char *name, int flags, int max, const char *filename, int lineno)
781*95cc27f0SJoerg Sonnenberger {
782*95cc27f0SJoerg Sonnenberger int fieldlen, i;
783*95cc27f0SJoerg Sonnenberger char *field;
784*95cc27f0SJoerg Sonnenberger long val = 0;
785*95cc27f0SJoerg Sonnenberger
786*95cc27f0SJoerg Sonnenberger if (mod)
787*95cc27f0SJoerg Sonnenberger *mod = 0;
788*95cc27f0SJoerg Sonnenberger *var = 0;
789*95cc27f0SJoerg Sonnenberger
790*95cc27f0SJoerg Sonnenberger field = get_field(line, len, &fieldlen);
791*95cc27f0SJoerg Sonnenberger if (field == NULL)
792*95cc27f0SJoerg Sonnenberger return (1);
793*95cc27f0SJoerg Sonnenberger if (fieldlen == 0) {
794*95cc27f0SJoerg Sonnenberger fprintf(stderr, "%s:%d empty %s\n", filename, lineno, name);
795*95cc27f0SJoerg Sonnenberger return (1);
796*95cc27f0SJoerg Sonnenberger }
797*95cc27f0SJoerg Sonnenberger
798*95cc27f0SJoerg Sonnenberger i = 0;
799*95cc27f0SJoerg Sonnenberger if ((*field == '%' || *field == 'S' || *field == 'T' || *field == '*')
800*95cc27f0SJoerg Sonnenberger && fieldlen >= 1) {
801*95cc27f0SJoerg Sonnenberger switch (*field) {
802*95cc27f0SJoerg Sonnenberger case 'S':
803*95cc27f0SJoerg Sonnenberger if (mod && (flags & T_MSS))
804*95cc27f0SJoerg Sonnenberger *mod = T_MSS;
805*95cc27f0SJoerg Sonnenberger if (fieldlen == 1)
806*95cc27f0SJoerg Sonnenberger return (0);
807*95cc27f0SJoerg Sonnenberger break;
808*95cc27f0SJoerg Sonnenberger case 'T':
809*95cc27f0SJoerg Sonnenberger if (mod && (flags & T_MTU))
810*95cc27f0SJoerg Sonnenberger *mod = T_MTU;
811*95cc27f0SJoerg Sonnenberger if (fieldlen == 1)
812*95cc27f0SJoerg Sonnenberger return (0);
813*95cc27f0SJoerg Sonnenberger break;
814*95cc27f0SJoerg Sonnenberger case '*':
815*95cc27f0SJoerg Sonnenberger if (fieldlen != 1) {
816*95cc27f0SJoerg Sonnenberger fprintf(stderr, "%s:%d long '%c' %s\n",
817*95cc27f0SJoerg Sonnenberger filename, lineno, *field, name);
818*95cc27f0SJoerg Sonnenberger return (1);
819*95cc27f0SJoerg Sonnenberger }
820*95cc27f0SJoerg Sonnenberger if (mod && (flags & T_DC)) {
821*95cc27f0SJoerg Sonnenberger *mod = T_DC;
822*95cc27f0SJoerg Sonnenberger return (0);
823*95cc27f0SJoerg Sonnenberger }
824*95cc27f0SJoerg Sonnenberger case '%':
825*95cc27f0SJoerg Sonnenberger if (mod && (flags & T_MOD))
826*95cc27f0SJoerg Sonnenberger *mod = T_MOD;
827*95cc27f0SJoerg Sonnenberger if (fieldlen == 1) {
828*95cc27f0SJoerg Sonnenberger fprintf(stderr, "%s:%d modulus %s must have a "
829*95cc27f0SJoerg Sonnenberger "value\n", filename, lineno, name);
830*95cc27f0SJoerg Sonnenberger return (1);
831*95cc27f0SJoerg Sonnenberger }
832*95cc27f0SJoerg Sonnenberger break;
833*95cc27f0SJoerg Sonnenberger }
834*95cc27f0SJoerg Sonnenberger if (mod == NULL || *mod == 0) {
835*95cc27f0SJoerg Sonnenberger fprintf(stderr, "%s:%d does not allow %c' %s\n",
836*95cc27f0SJoerg Sonnenberger filename, lineno, *field, name);
837*95cc27f0SJoerg Sonnenberger return (1);
838*95cc27f0SJoerg Sonnenberger }
839*95cc27f0SJoerg Sonnenberger i++;
840*95cc27f0SJoerg Sonnenberger }
841*95cc27f0SJoerg Sonnenberger
842*95cc27f0SJoerg Sonnenberger for (; i < fieldlen; i++) {
843*95cc27f0SJoerg Sonnenberger if (field[i] < '0' || field[i] > '9') {
844*95cc27f0SJoerg Sonnenberger fprintf(stderr, "%s:%d non-digit character in %s\n",
845*95cc27f0SJoerg Sonnenberger filename, lineno, name);
846*95cc27f0SJoerg Sonnenberger return (1);
847*95cc27f0SJoerg Sonnenberger }
848*95cc27f0SJoerg Sonnenberger val = val * 10 + field[i] - '0';
849*95cc27f0SJoerg Sonnenberger if (val < 0) {
850*95cc27f0SJoerg Sonnenberger fprintf(stderr, "%s:%d %s overflowed\n", filename,
851*95cc27f0SJoerg Sonnenberger lineno, name);
852*95cc27f0SJoerg Sonnenberger return (1);
853*95cc27f0SJoerg Sonnenberger }
854*95cc27f0SJoerg Sonnenberger }
855*95cc27f0SJoerg Sonnenberger
856*95cc27f0SJoerg Sonnenberger if (val > max) {
857*95cc27f0SJoerg Sonnenberger fprintf(stderr, "%s:%d %s value %ld > %d\n", filename, lineno,
858*95cc27f0SJoerg Sonnenberger name, val, max);
859*95cc27f0SJoerg Sonnenberger return (1);
860*95cc27f0SJoerg Sonnenberger }
861*95cc27f0SJoerg Sonnenberger *var = (int)val;
862*95cc27f0SJoerg Sonnenberger
863*95cc27f0SJoerg Sonnenberger return (0);
864*95cc27f0SJoerg Sonnenberger }
865*95cc27f0SJoerg Sonnenberger
866*95cc27f0SJoerg Sonnenberger /* parse the next string in a formatted config file line */
867*95cc27f0SJoerg Sonnenberger int
get_str(char ** line,size_t * len,char ** v,const char * name,int minlen,const char * filename,int lineno)868*95cc27f0SJoerg Sonnenberger get_str(char **line, size_t *len, char **v, const char *name, int minlen,
869*95cc27f0SJoerg Sonnenberger const char *filename, int lineno)
870*95cc27f0SJoerg Sonnenberger {
871*95cc27f0SJoerg Sonnenberger int fieldlen;
872*95cc27f0SJoerg Sonnenberger char *ptr;
873*95cc27f0SJoerg Sonnenberger
874*95cc27f0SJoerg Sonnenberger ptr = get_field(line, len, &fieldlen);
875*95cc27f0SJoerg Sonnenberger if (ptr == NULL)
876*95cc27f0SJoerg Sonnenberger return (1);
877*95cc27f0SJoerg Sonnenberger if (fieldlen < minlen) {
878*95cc27f0SJoerg Sonnenberger fprintf(stderr, "%s:%d too short %s\n", filename, lineno, name);
879*95cc27f0SJoerg Sonnenberger return (1);
880*95cc27f0SJoerg Sonnenberger }
881*95cc27f0SJoerg Sonnenberger if ((*v = malloc(fieldlen + 1)) == NULL) {
882*95cc27f0SJoerg Sonnenberger perror("malloc()");
883*95cc27f0SJoerg Sonnenberger return (1);
884*95cc27f0SJoerg Sonnenberger }
885*95cc27f0SJoerg Sonnenberger memcpy(*v, ptr, fieldlen);
886*95cc27f0SJoerg Sonnenberger (*v)[fieldlen] = '\0';
887*95cc27f0SJoerg Sonnenberger
888*95cc27f0SJoerg Sonnenberger return (0);
889*95cc27f0SJoerg Sonnenberger }
890*95cc27f0SJoerg Sonnenberger
891*95cc27f0SJoerg Sonnenberger /* Parse out the TCP opts */
892*95cc27f0SJoerg Sonnenberger int
get_tcpopts(const char * filename,int lineno,const char * tcpopts,pf_tcpopts_t * packed,int * optcnt,int * mss,int * mss_mod,int * wscale,int * wscale_mod,int * ts0)893*95cc27f0SJoerg Sonnenberger get_tcpopts(const char *filename, int lineno, const char *tcpopts,
894*95cc27f0SJoerg Sonnenberger pf_tcpopts_t *packed, int *optcnt, int *mss, int *mss_mod, int *wscale,
895*95cc27f0SJoerg Sonnenberger int *wscale_mod, int *ts0)
896*95cc27f0SJoerg Sonnenberger {
897*95cc27f0SJoerg Sonnenberger int i, opt;
898*95cc27f0SJoerg Sonnenberger
899*95cc27f0SJoerg Sonnenberger *packed = 0;
900*95cc27f0SJoerg Sonnenberger *optcnt = 0;
901*95cc27f0SJoerg Sonnenberger *wscale = 0;
902*95cc27f0SJoerg Sonnenberger *wscale_mod = T_DC;
903*95cc27f0SJoerg Sonnenberger *mss = 0;
904*95cc27f0SJoerg Sonnenberger *mss_mod = T_DC;
905*95cc27f0SJoerg Sonnenberger *ts0 = 0;
906*95cc27f0SJoerg Sonnenberger if (strcmp(tcpopts, ".") == 0)
907*95cc27f0SJoerg Sonnenberger return (0);
908*95cc27f0SJoerg Sonnenberger
909*95cc27f0SJoerg Sonnenberger for (i = 0; tcpopts[i] && (size_t)*optcnt < PF_OSFP_MAX_OPTS;) {
910*95cc27f0SJoerg Sonnenberger switch ((opt = toupper(tcpopts[i++]))) {
911*95cc27f0SJoerg Sonnenberger case 'N': /* FALLTHROUGH */
912*95cc27f0SJoerg Sonnenberger case 'S':
913*95cc27f0SJoerg Sonnenberger *packed = (*packed << PF_OSFP_TCPOPT_BITS) |
914*95cc27f0SJoerg Sonnenberger (opt == 'N' ? PF_OSFP_TCPOPT_NOP :
915*95cc27f0SJoerg Sonnenberger PF_OSFP_TCPOPT_SACK);
916*95cc27f0SJoerg Sonnenberger break;
917*95cc27f0SJoerg Sonnenberger case 'W': /* FALLTHROUGH */
918*95cc27f0SJoerg Sonnenberger case 'M': {
919*95cc27f0SJoerg Sonnenberger int *this_mod, *this;
920*95cc27f0SJoerg Sonnenberger
921*95cc27f0SJoerg Sonnenberger if (opt == 'W') {
922*95cc27f0SJoerg Sonnenberger this = wscale;
923*95cc27f0SJoerg Sonnenberger this_mod = wscale_mod;
924*95cc27f0SJoerg Sonnenberger } else {
925*95cc27f0SJoerg Sonnenberger this = mss;
926*95cc27f0SJoerg Sonnenberger this_mod = mss_mod;
927*95cc27f0SJoerg Sonnenberger }
928*95cc27f0SJoerg Sonnenberger *this = 0;
929*95cc27f0SJoerg Sonnenberger *this_mod = 0;
930*95cc27f0SJoerg Sonnenberger
931*95cc27f0SJoerg Sonnenberger *packed = (*packed << PF_OSFP_TCPOPT_BITS) |
932*95cc27f0SJoerg Sonnenberger (opt == 'W' ? PF_OSFP_TCPOPT_WSCALE :
933*95cc27f0SJoerg Sonnenberger PF_OSFP_TCPOPT_MSS);
934*95cc27f0SJoerg Sonnenberger if (tcpopts[i] == '*' && (tcpopts[i + 1] == '\0' ||
935*95cc27f0SJoerg Sonnenberger tcpopts[i + 1] == ',')) {
936*95cc27f0SJoerg Sonnenberger *this_mod = T_DC;
937*95cc27f0SJoerg Sonnenberger i++;
938*95cc27f0SJoerg Sonnenberger break;
939*95cc27f0SJoerg Sonnenberger }
940*95cc27f0SJoerg Sonnenberger
941*95cc27f0SJoerg Sonnenberger if (tcpopts[i] == '%') {
942*95cc27f0SJoerg Sonnenberger *this_mod = T_MOD;
943*95cc27f0SJoerg Sonnenberger i++;
944*95cc27f0SJoerg Sonnenberger }
945*95cc27f0SJoerg Sonnenberger do {
946*95cc27f0SJoerg Sonnenberger if (!isdigit(tcpopts[i])) {
947*95cc27f0SJoerg Sonnenberger fprintf(stderr, "%s:%d unknown "
948*95cc27f0SJoerg Sonnenberger "character '%c' in %c TCP opt\n",
949*95cc27f0SJoerg Sonnenberger filename, lineno, tcpopts[i], opt);
950*95cc27f0SJoerg Sonnenberger return (1);
951*95cc27f0SJoerg Sonnenberger }
952*95cc27f0SJoerg Sonnenberger *this = (*this * 10) + tcpopts[i++] - '0';
953*95cc27f0SJoerg Sonnenberger } while(tcpopts[i] != ',' && tcpopts[i] != '\0');
954*95cc27f0SJoerg Sonnenberger break;
955*95cc27f0SJoerg Sonnenberger }
956*95cc27f0SJoerg Sonnenberger case 'T':
957*95cc27f0SJoerg Sonnenberger if (tcpopts[i] == '0') {
958*95cc27f0SJoerg Sonnenberger *ts0 = 1;
959*95cc27f0SJoerg Sonnenberger i++;
960*95cc27f0SJoerg Sonnenberger }
961*95cc27f0SJoerg Sonnenberger *packed = (*packed << PF_OSFP_TCPOPT_BITS) |
962*95cc27f0SJoerg Sonnenberger PF_OSFP_TCPOPT_TS;
963*95cc27f0SJoerg Sonnenberger break;
964*95cc27f0SJoerg Sonnenberger }
965*95cc27f0SJoerg Sonnenberger (*optcnt) ++;
966*95cc27f0SJoerg Sonnenberger if (tcpopts[i] == '\0')
967*95cc27f0SJoerg Sonnenberger break;
968*95cc27f0SJoerg Sonnenberger if (tcpopts[i] != ',') {
969*95cc27f0SJoerg Sonnenberger fprintf(stderr, "%s:%d unknown option to %c TCP opt\n",
970*95cc27f0SJoerg Sonnenberger filename, lineno, opt);
971*95cc27f0SJoerg Sonnenberger return (1);
972*95cc27f0SJoerg Sonnenberger }
973*95cc27f0SJoerg Sonnenberger i++;
974*95cc27f0SJoerg Sonnenberger }
975*95cc27f0SJoerg Sonnenberger
976*95cc27f0SJoerg Sonnenberger return (0);
977*95cc27f0SJoerg Sonnenberger }
978*95cc27f0SJoerg Sonnenberger
979*95cc27f0SJoerg Sonnenberger /* rip the next field ouf of a formatted config file line */
980*95cc27f0SJoerg Sonnenberger char *
get_field(char ** line,size_t * len,int * fieldlen)981*95cc27f0SJoerg Sonnenberger get_field(char **line, size_t *len, int *fieldlen)
982*95cc27f0SJoerg Sonnenberger {
983*95cc27f0SJoerg Sonnenberger char *ret, *ptr = *line;
984*95cc27f0SJoerg Sonnenberger size_t plen = *len;
985*95cc27f0SJoerg Sonnenberger
986*95cc27f0SJoerg Sonnenberger
987*95cc27f0SJoerg Sonnenberger while (plen && isspace(*ptr)) {
988*95cc27f0SJoerg Sonnenberger plen--;
989*95cc27f0SJoerg Sonnenberger ptr++;
990*95cc27f0SJoerg Sonnenberger }
991*95cc27f0SJoerg Sonnenberger ret = ptr;
992*95cc27f0SJoerg Sonnenberger *fieldlen = 0;
993*95cc27f0SJoerg Sonnenberger
994*95cc27f0SJoerg Sonnenberger for (; plen > 0 && *ptr != ':'; plen--, ptr++)
995*95cc27f0SJoerg Sonnenberger (*fieldlen)++;
996*95cc27f0SJoerg Sonnenberger if (plen) {
997*95cc27f0SJoerg Sonnenberger *line = ptr + 1;
998*95cc27f0SJoerg Sonnenberger *len = plen - 1;
999*95cc27f0SJoerg Sonnenberger } else {
1000*95cc27f0SJoerg Sonnenberger *len = 0;
1001*95cc27f0SJoerg Sonnenberger }
1002*95cc27f0SJoerg Sonnenberger while (*fieldlen && isspace(ret[*fieldlen - 1]))
1003*95cc27f0SJoerg Sonnenberger (*fieldlen)--;
1004*95cc27f0SJoerg Sonnenberger return (ret);
1005*95cc27f0SJoerg Sonnenberger }
1006*95cc27f0SJoerg Sonnenberger
1007*95cc27f0SJoerg Sonnenberger
1008*95cc27f0SJoerg Sonnenberger const char *
print_ioctl(struct pf_osfp_ioctl * fp)1009*95cc27f0SJoerg Sonnenberger print_ioctl(struct pf_osfp_ioctl *fp)
1010*95cc27f0SJoerg Sonnenberger {
1011*95cc27f0SJoerg Sonnenberger static char buf[1024];
1012*95cc27f0SJoerg Sonnenberger char tmp[32];
1013*95cc27f0SJoerg Sonnenberger int i, opt;
1014*95cc27f0SJoerg Sonnenberger
1015*95cc27f0SJoerg Sonnenberger *buf = '\0';
1016*95cc27f0SJoerg Sonnenberger if (fp->fp_flags & PF_OSFP_WSIZE_DC)
1017*95cc27f0SJoerg Sonnenberger strlcat(buf, "*", sizeof(buf));
1018*95cc27f0SJoerg Sonnenberger else if (fp->fp_flags & PF_OSFP_WSIZE_MSS)
1019*95cc27f0SJoerg Sonnenberger strlcat(buf, "S", sizeof(buf));
1020*95cc27f0SJoerg Sonnenberger else if (fp->fp_flags & PF_OSFP_WSIZE_MTU)
1021*95cc27f0SJoerg Sonnenberger strlcat(buf, "T", sizeof(buf));
1022*95cc27f0SJoerg Sonnenberger else {
1023*95cc27f0SJoerg Sonnenberger if (fp->fp_flags & PF_OSFP_WSIZE_MOD)
1024*95cc27f0SJoerg Sonnenberger strlcat(buf, "%", sizeof(buf));
1025*95cc27f0SJoerg Sonnenberger snprintf(tmp, sizeof(tmp), "%d", fp->fp_wsize);
1026*95cc27f0SJoerg Sonnenberger strlcat(buf, tmp, sizeof(buf));
1027*95cc27f0SJoerg Sonnenberger }
1028*95cc27f0SJoerg Sonnenberger strlcat(buf, ":", sizeof(buf));
1029*95cc27f0SJoerg Sonnenberger
1030*95cc27f0SJoerg Sonnenberger snprintf(tmp, sizeof(tmp), "%d", fp->fp_ttl);
1031*95cc27f0SJoerg Sonnenberger strlcat(buf, tmp, sizeof(buf));
1032*95cc27f0SJoerg Sonnenberger strlcat(buf, ":", sizeof(buf));
1033*95cc27f0SJoerg Sonnenberger
1034*95cc27f0SJoerg Sonnenberger if (fp->fp_flags & PF_OSFP_DF)
1035*95cc27f0SJoerg Sonnenberger strlcat(buf, "1", sizeof(buf));
1036*95cc27f0SJoerg Sonnenberger else
1037*95cc27f0SJoerg Sonnenberger strlcat(buf, "0", sizeof(buf));
1038*95cc27f0SJoerg Sonnenberger strlcat(buf, ":", sizeof(buf));
1039*95cc27f0SJoerg Sonnenberger
1040*95cc27f0SJoerg Sonnenberger if (fp->fp_flags & PF_OSFP_PSIZE_DC)
1041*95cc27f0SJoerg Sonnenberger strlcat(buf, "*", sizeof(buf));
1042*95cc27f0SJoerg Sonnenberger else {
1043*95cc27f0SJoerg Sonnenberger if (fp->fp_flags & PF_OSFP_PSIZE_MOD)
1044*95cc27f0SJoerg Sonnenberger strlcat(buf, "%", sizeof(buf));
1045*95cc27f0SJoerg Sonnenberger snprintf(tmp, sizeof(tmp), "%d", fp->fp_psize);
1046*95cc27f0SJoerg Sonnenberger strlcat(buf, tmp, sizeof(buf));
1047*95cc27f0SJoerg Sonnenberger }
1048*95cc27f0SJoerg Sonnenberger strlcat(buf, ":", sizeof(buf));
1049*95cc27f0SJoerg Sonnenberger
1050*95cc27f0SJoerg Sonnenberger if (fp->fp_optcnt == 0)
1051*95cc27f0SJoerg Sonnenberger strlcat(buf, ".", sizeof(buf));
1052*95cc27f0SJoerg Sonnenberger for (i = fp->fp_optcnt - 1; i >= 0; i--) {
1053*95cc27f0SJoerg Sonnenberger opt = fp->fp_tcpopts >> (i * PF_OSFP_TCPOPT_BITS);
1054*95cc27f0SJoerg Sonnenberger opt &= (1 << PF_OSFP_TCPOPT_BITS) - 1;
1055*95cc27f0SJoerg Sonnenberger switch (opt) {
1056*95cc27f0SJoerg Sonnenberger case PF_OSFP_TCPOPT_NOP:
1057*95cc27f0SJoerg Sonnenberger strlcat(buf, "N", sizeof(buf));
1058*95cc27f0SJoerg Sonnenberger break;
1059*95cc27f0SJoerg Sonnenberger case PF_OSFP_TCPOPT_SACK:
1060*95cc27f0SJoerg Sonnenberger strlcat(buf, "S", sizeof(buf));
1061*95cc27f0SJoerg Sonnenberger break;
1062*95cc27f0SJoerg Sonnenberger case PF_OSFP_TCPOPT_TS:
1063*95cc27f0SJoerg Sonnenberger strlcat(buf, "T", sizeof(buf));
1064*95cc27f0SJoerg Sonnenberger if (fp->fp_flags & PF_OSFP_TS0)
1065*95cc27f0SJoerg Sonnenberger strlcat(buf, "0", sizeof(buf));
1066*95cc27f0SJoerg Sonnenberger break;
1067*95cc27f0SJoerg Sonnenberger case PF_OSFP_TCPOPT_MSS:
1068*95cc27f0SJoerg Sonnenberger strlcat(buf, "M", sizeof(buf));
1069*95cc27f0SJoerg Sonnenberger if (fp->fp_flags & PF_OSFP_MSS_DC)
1070*95cc27f0SJoerg Sonnenberger strlcat(buf, "*", sizeof(buf));
1071*95cc27f0SJoerg Sonnenberger else {
1072*95cc27f0SJoerg Sonnenberger if (fp->fp_flags & PF_OSFP_MSS_MOD)
1073*95cc27f0SJoerg Sonnenberger strlcat(buf, "%", sizeof(buf));
1074*95cc27f0SJoerg Sonnenberger snprintf(tmp, sizeof(tmp), "%d", fp->fp_mss);
1075*95cc27f0SJoerg Sonnenberger strlcat(buf, tmp, sizeof(buf));
1076*95cc27f0SJoerg Sonnenberger }
1077*95cc27f0SJoerg Sonnenberger break;
1078*95cc27f0SJoerg Sonnenberger case PF_OSFP_TCPOPT_WSCALE:
1079*95cc27f0SJoerg Sonnenberger strlcat(buf, "W", sizeof(buf));
1080*95cc27f0SJoerg Sonnenberger if (fp->fp_flags & PF_OSFP_WSCALE_DC)
1081*95cc27f0SJoerg Sonnenberger strlcat(buf, "*", sizeof(buf));
1082*95cc27f0SJoerg Sonnenberger else {
1083*95cc27f0SJoerg Sonnenberger if (fp->fp_flags & PF_OSFP_WSCALE_MOD)
1084*95cc27f0SJoerg Sonnenberger strlcat(buf, "%", sizeof(buf));
1085*95cc27f0SJoerg Sonnenberger snprintf(tmp, sizeof(tmp), "%d", fp->fp_wscale);
1086*95cc27f0SJoerg Sonnenberger strlcat(buf, tmp, sizeof(buf));
1087*95cc27f0SJoerg Sonnenberger }
1088*95cc27f0SJoerg Sonnenberger break;
1089*95cc27f0SJoerg Sonnenberger }
1090*95cc27f0SJoerg Sonnenberger
1091*95cc27f0SJoerg Sonnenberger if (i != 0)
1092*95cc27f0SJoerg Sonnenberger strlcat(buf, ",", sizeof(buf));
1093*95cc27f0SJoerg Sonnenberger }
1094*95cc27f0SJoerg Sonnenberger strlcat(buf, ":", sizeof(buf));
1095*95cc27f0SJoerg Sonnenberger
1096*95cc27f0SJoerg Sonnenberger strlcat(buf, fp->fp_os.fp_class_nm, sizeof(buf));
1097*95cc27f0SJoerg Sonnenberger strlcat(buf, ":", sizeof(buf));
1098*95cc27f0SJoerg Sonnenberger strlcat(buf, fp->fp_os.fp_version_nm, sizeof(buf));
1099*95cc27f0SJoerg Sonnenberger strlcat(buf, ":", sizeof(buf));
1100*95cc27f0SJoerg Sonnenberger strlcat(buf, fp->fp_os.fp_subtype_nm, sizeof(buf));
1101*95cc27f0SJoerg Sonnenberger strlcat(buf, ":", sizeof(buf));
1102*95cc27f0SJoerg Sonnenberger
1103*95cc27f0SJoerg Sonnenberger snprintf(tmp, sizeof(tmp), "TcpOpts %d 0x%llx", fp->fp_optcnt,
1104*95cc27f0SJoerg Sonnenberger (long long int)fp->fp_tcpopts);
1105*95cc27f0SJoerg Sonnenberger strlcat(buf, tmp, sizeof(buf));
1106*95cc27f0SJoerg Sonnenberger
1107*95cc27f0SJoerg Sonnenberger return (buf);
1108*95cc27f0SJoerg Sonnenberger }
1109