1 /* 2 * Copyright (c) 2003+ Evgeniy Polyakov <zbr@ioremap.net> 3 * 4 * 5 * This program is free software; you can redistribute it and/or modify 6 * it under the terms of the GNU General Public License as published by 7 * the Free Software Foundation; either version 2 of the License, or 8 * (at your option) any later version. 9 * 10 * This program is distributed in the hope that it will be useful, 11 * but WITHOUT ANY WARRANTY; without even the implied warranty of 12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 13 * GNU General Public License for more details. 14 * 15 * You should have received a copy of the GNU General Public License 16 * along with this program; if not, see <http://www.gnu.org/licenses/>. 17 */ 18 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 19 #include <linux/module.h> 20 #include <linux/kernel.h> 21 22 #include <linux/capability.h> 23 #include <linux/if.h> 24 #include <linux/inetdevice.h> 25 #include <linux/ip.h> 26 #include <linux/list.h> 27 #include <linux/rculist.h> 28 #include <linux/skbuff.h> 29 #include <linux/slab.h> 30 #include <linux/tcp.h> 31 32 #include <net/ip.h> 33 #include <net/tcp.h> 34 35 #include <linux/netfilter/nfnetlink.h> 36 #include <linux/netfilter/x_tables.h> 37 #include <net/netfilter/nf_log.h> 38 #include <linux/netfilter/xt_osf.h> 39 40 struct xt_osf_finger { 41 struct rcu_head rcu_head; 42 struct list_head finger_entry; 43 struct xt_osf_user_finger finger; 44 }; 45 46 enum osf_fmatch_states { 47 /* Packet does not match the fingerprint */ 48 FMATCH_WRONG = 0, 49 /* Packet matches the fingerprint */ 50 FMATCH_OK, 51 /* Options do not match the fingerprint, but header does */ 52 FMATCH_OPT_WRONG, 53 }; 54 55 /* 56 * Indexed by dont-fragment bit. 57 * It is the only constant value in the fingerprint. 58 */ 59 static struct list_head xt_osf_fingers[2]; 60 61 static const struct nla_policy xt_osf_policy[OSF_ATTR_MAX + 1] = { 62 [OSF_ATTR_FINGER] = { .len = sizeof(struct xt_osf_user_finger) }, 63 }; 64 65 static int xt_osf_add_callback(struct net *net, struct sock *ctnl, 66 struct sk_buff *skb, const struct nlmsghdr *nlh, 67 const struct nlattr * const osf_attrs[], 68 struct netlink_ext_ack *extack) 69 { 70 struct xt_osf_user_finger *f; 71 struct xt_osf_finger *kf = NULL, *sf; 72 int err = 0; 73 74 if (!capable(CAP_NET_ADMIN)) 75 return -EPERM; 76 77 if (!osf_attrs[OSF_ATTR_FINGER]) 78 return -EINVAL; 79 80 if (!(nlh->nlmsg_flags & NLM_F_CREATE)) 81 return -EINVAL; 82 83 f = nla_data(osf_attrs[OSF_ATTR_FINGER]); 84 85 kf = kmalloc(sizeof(struct xt_osf_finger), GFP_KERNEL); 86 if (!kf) 87 return -ENOMEM; 88 89 memcpy(&kf->finger, f, sizeof(struct xt_osf_user_finger)); 90 91 list_for_each_entry(sf, &xt_osf_fingers[!!f->df], finger_entry) { 92 if (memcmp(&sf->finger, f, sizeof(struct xt_osf_user_finger))) 93 continue; 94 95 kfree(kf); 96 kf = NULL; 97 98 if (nlh->nlmsg_flags & NLM_F_EXCL) 99 err = -EEXIST; 100 break; 101 } 102 103 /* 104 * We are protected by nfnl mutex. 105 */ 106 if (kf) 107 list_add_tail_rcu(&kf->finger_entry, &xt_osf_fingers[!!f->df]); 108 109 return err; 110 } 111 112 static int xt_osf_remove_callback(struct net *net, struct sock *ctnl, 113 struct sk_buff *skb, 114 const struct nlmsghdr *nlh, 115 const struct nlattr * const osf_attrs[], 116 struct netlink_ext_ack *extack) 117 { 118 struct xt_osf_user_finger *f; 119 struct xt_osf_finger *sf; 120 int err = -ENOENT; 121 122 if (!capable(CAP_NET_ADMIN)) 123 return -EPERM; 124 125 if (!osf_attrs[OSF_ATTR_FINGER]) 126 return -EINVAL; 127 128 f = nla_data(osf_attrs[OSF_ATTR_FINGER]); 129 130 list_for_each_entry(sf, &xt_osf_fingers[!!f->df], finger_entry) { 131 if (memcmp(&sf->finger, f, sizeof(struct xt_osf_user_finger))) 132 continue; 133 134 /* 135 * We are protected by nfnl mutex. 136 */ 137 list_del_rcu(&sf->finger_entry); 138 kfree_rcu(sf, rcu_head); 139 140 err = 0; 141 break; 142 } 143 144 return err; 145 } 146 147 static const struct nfnl_callback xt_osf_nfnetlink_callbacks[OSF_MSG_MAX] = { 148 [OSF_MSG_ADD] = { 149 .call = xt_osf_add_callback, 150 .attr_count = OSF_ATTR_MAX, 151 .policy = xt_osf_policy, 152 }, 153 [OSF_MSG_REMOVE] = { 154 .call = xt_osf_remove_callback, 155 .attr_count = OSF_ATTR_MAX, 156 .policy = xt_osf_policy, 157 }, 158 }; 159 160 static const struct nfnetlink_subsystem xt_osf_nfnetlink = { 161 .name = "osf", 162 .subsys_id = NFNL_SUBSYS_OSF, 163 .cb_count = OSF_MSG_MAX, 164 .cb = xt_osf_nfnetlink_callbacks, 165 }; 166 167 static inline int xt_osf_ttl(const struct sk_buff *skb, const struct xt_osf_info *info, 168 unsigned char f_ttl) 169 { 170 const struct iphdr *ip = ip_hdr(skb); 171 172 if (info->flags & XT_OSF_TTL) { 173 if (info->ttl == XT_OSF_TTL_TRUE) 174 return ip->ttl == f_ttl; 175 if (info->ttl == XT_OSF_TTL_NOCHECK) 176 return 1; 177 else if (ip->ttl <= f_ttl) 178 return 1; 179 else { 180 struct in_device *in_dev = __in_dev_get_rcu(skb->dev); 181 int ret = 0; 182 183 for_ifa(in_dev) { 184 if (inet_ifa_match(ip->saddr, ifa)) { 185 ret = (ip->ttl == f_ttl); 186 break; 187 } 188 } 189 endfor_ifa(in_dev); 190 191 return ret; 192 } 193 } 194 195 return ip->ttl == f_ttl; 196 } 197 198 static bool 199 xt_osf_match_packet(const struct sk_buff *skb, struct xt_action_param *p) 200 { 201 const struct xt_osf_info *info = p->matchinfo; 202 const struct iphdr *ip = ip_hdr(skb); 203 const struct tcphdr *tcp; 204 struct tcphdr _tcph; 205 int fmatch = FMATCH_WRONG, fcount = 0; 206 unsigned int optsize = 0, check_WSS = 0; 207 u16 window, totlen, mss = 0; 208 bool df; 209 const unsigned char *optp = NULL, *_optp = NULL; 210 unsigned char opts[MAX_IPOPTLEN]; 211 const struct xt_osf_finger *kf; 212 const struct xt_osf_user_finger *f; 213 struct net *net = xt_net(p); 214 215 if (!info) 216 return false; 217 218 tcp = skb_header_pointer(skb, ip_hdrlen(skb), sizeof(struct tcphdr), &_tcph); 219 if (!tcp) 220 return false; 221 222 if (!tcp->syn) 223 return false; 224 225 totlen = ntohs(ip->tot_len); 226 df = ntohs(ip->frag_off) & IP_DF; 227 window = ntohs(tcp->window); 228 229 if (tcp->doff * 4 > sizeof(struct tcphdr)) { 230 optsize = tcp->doff * 4 - sizeof(struct tcphdr); 231 232 _optp = optp = skb_header_pointer(skb, ip_hdrlen(skb) + 233 sizeof(struct tcphdr), optsize, opts); 234 } 235 236 list_for_each_entry_rcu(kf, &xt_osf_fingers[df], finger_entry) { 237 int foptsize, optnum; 238 239 f = &kf->finger; 240 241 if (!(info->flags & XT_OSF_LOG) && strcmp(info->genre, f->genre)) 242 continue; 243 244 optp = _optp; 245 fmatch = FMATCH_WRONG; 246 247 if (totlen != f->ss || !xt_osf_ttl(skb, info, f->ttl)) 248 continue; 249 250 /* 251 * Should not happen if userspace parser was written correctly. 252 */ 253 if (f->wss.wc >= OSF_WSS_MAX) 254 continue; 255 256 /* Check options */ 257 258 foptsize = 0; 259 for (optnum = 0; optnum < f->opt_num; ++optnum) 260 foptsize += f->opt[optnum].length; 261 262 if (foptsize > MAX_IPOPTLEN || 263 optsize > MAX_IPOPTLEN || 264 optsize != foptsize) 265 continue; 266 267 check_WSS = f->wss.wc; 268 269 for (optnum = 0; optnum < f->opt_num; ++optnum) { 270 if (f->opt[optnum].kind == (*optp)) { 271 __u32 len = f->opt[optnum].length; 272 const __u8 *optend = optp + len; 273 274 fmatch = FMATCH_OK; 275 276 switch (*optp) { 277 case OSFOPT_MSS: 278 mss = optp[3]; 279 mss <<= 8; 280 mss |= optp[2]; 281 282 mss = ntohs((__force __be16)mss); 283 break; 284 case OSFOPT_TS: 285 break; 286 } 287 288 optp = optend; 289 } else 290 fmatch = FMATCH_OPT_WRONG; 291 292 if (fmatch != FMATCH_OK) 293 break; 294 } 295 296 if (fmatch != FMATCH_OPT_WRONG) { 297 fmatch = FMATCH_WRONG; 298 299 switch (check_WSS) { 300 case OSF_WSS_PLAIN: 301 if (f->wss.val == 0 || window == f->wss.val) 302 fmatch = FMATCH_OK; 303 break; 304 case OSF_WSS_MSS: 305 /* 306 * Some smart modems decrease mangle MSS to 307 * SMART_MSS_2, so we check standard, decreased 308 * and the one provided in the fingerprint MSS 309 * values. 310 */ 311 #define SMART_MSS_1 1460 312 #define SMART_MSS_2 1448 313 if (window == f->wss.val * mss || 314 window == f->wss.val * SMART_MSS_1 || 315 window == f->wss.val * SMART_MSS_2) 316 fmatch = FMATCH_OK; 317 break; 318 case OSF_WSS_MTU: 319 if (window == f->wss.val * (mss + 40) || 320 window == f->wss.val * (SMART_MSS_1 + 40) || 321 window == f->wss.val * (SMART_MSS_2 + 40)) 322 fmatch = FMATCH_OK; 323 break; 324 case OSF_WSS_MODULO: 325 if ((window % f->wss.val) == 0) 326 fmatch = FMATCH_OK; 327 break; 328 } 329 } 330 331 if (fmatch != FMATCH_OK) 332 continue; 333 334 fcount++; 335 336 if (info->flags & XT_OSF_LOG) 337 nf_log_packet(net, xt_family(p), xt_hooknum(p), skb, 338 xt_in(p), xt_out(p), NULL, 339 "%s [%s:%s] : %pI4:%d -> %pI4:%d hops=%d\n", 340 f->genre, f->version, f->subtype, 341 &ip->saddr, ntohs(tcp->source), 342 &ip->daddr, ntohs(tcp->dest), 343 f->ttl - ip->ttl); 344 345 if ((info->flags & XT_OSF_LOG) && 346 info->loglevel == XT_OSF_LOGLEVEL_FIRST) 347 break; 348 } 349 350 if (!fcount && (info->flags & XT_OSF_LOG)) 351 nf_log_packet(net, xt_family(p), xt_hooknum(p), skb, xt_in(p), 352 xt_out(p), NULL, 353 "Remote OS is not known: %pI4:%u -> %pI4:%u\n", 354 &ip->saddr, ntohs(tcp->source), 355 &ip->daddr, ntohs(tcp->dest)); 356 357 if (fcount) 358 fmatch = FMATCH_OK; 359 360 return fmatch == FMATCH_OK; 361 } 362 363 static struct xt_match xt_osf_match = { 364 .name = "osf", 365 .revision = 0, 366 .family = NFPROTO_IPV4, 367 .proto = IPPROTO_TCP, 368 .hooks = (1 << NF_INET_LOCAL_IN) | 369 (1 << NF_INET_PRE_ROUTING) | 370 (1 << NF_INET_FORWARD), 371 .match = xt_osf_match_packet, 372 .matchsize = sizeof(struct xt_osf_info), 373 .me = THIS_MODULE, 374 }; 375 376 static int __init xt_osf_init(void) 377 { 378 int err = -EINVAL; 379 int i; 380 381 for (i=0; i<ARRAY_SIZE(xt_osf_fingers); ++i) 382 INIT_LIST_HEAD(&xt_osf_fingers[i]); 383 384 err = nfnetlink_subsys_register(&xt_osf_nfnetlink); 385 if (err < 0) { 386 pr_err("Failed to register OSF nsfnetlink helper (%d)\n", err); 387 goto err_out_exit; 388 } 389 390 err = xt_register_match(&xt_osf_match); 391 if (err) { 392 pr_err("Failed to register OS fingerprint " 393 "matching module (%d)\n", err); 394 goto err_out_remove; 395 } 396 397 return 0; 398 399 err_out_remove: 400 nfnetlink_subsys_unregister(&xt_osf_nfnetlink); 401 err_out_exit: 402 return err; 403 } 404 405 static void __exit xt_osf_fini(void) 406 { 407 struct xt_osf_finger *f; 408 int i; 409 410 nfnetlink_subsys_unregister(&xt_osf_nfnetlink); 411 xt_unregister_match(&xt_osf_match); 412 413 rcu_read_lock(); 414 for (i=0; i<ARRAY_SIZE(xt_osf_fingers); ++i) { 415 416 list_for_each_entry_rcu(f, &xt_osf_fingers[i], finger_entry) { 417 list_del_rcu(&f->finger_entry); 418 kfree_rcu(f, rcu_head); 419 } 420 } 421 rcu_read_unlock(); 422 423 rcu_barrier(); 424 } 425 426 module_init(xt_osf_init); 427 module_exit(xt_osf_fini); 428 429 MODULE_LICENSE("GPL"); 430 MODULE_AUTHOR("Evgeniy Polyakov <zbr@ioremap.net>"); 431 MODULE_DESCRIPTION("Passive OS fingerprint matching."); 432 MODULE_ALIAS("ipt_osf"); 433 MODULE_ALIAS("ip6t_osf"); 434 MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_OSF); 435