/*

 * Copyright (c) 2003+ Evgeniy Polyakov <zbr@ioremap.net>

 *

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License as published by

 * the Free Software Foundation; either version 2 of the License, or

 * (at your option) any later version.

 *

 * This program is distributed in the hope that it will be useful,

 * but WITHOUT ANY WARRANTY; without even the implied warranty of

 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

 * GNU General Public License for more details.

 *

 * You should have received a copy of the GNU General Public License

 * along with this program; if not, write to the Free Software

 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.

 */

/*

 * xtables interface for OS fingerprint matching module.

 */

#include <stdio.h>

#include <string.h>

#include <xtables.h>

#include <netinet/ip.h>

#include <netinet/tcp.h>

#include <linux/netfilter/xt_osf.h>

enum {

	O_GENRE = 0,

	O_TTL,

	O_LOGLEVEL,

};

static void osf_help(void)

{

	printf("OS fingerprint match options:\n"

		"[!] --genre string     Match a OS genre by passive fingerprinting.\n"

		"--ttl level            Use some TTL check extensions to determine OS:\n"

		"       0                       true ip and fingerprint TTL comparison. Works for LAN.\n"

		"       1                       check if ip TTL is less than fingerprint one. Works for global addresses.\n"

		"       2                       do not compare TTL at all. Allows to detect NMAP, but can produce false results.\n"

		"--log level            Log determined genres into dmesg even if they do not match desired one:\n"

		"       0                       log all matched or unknown signatures.\n"

		"       1                       log only first one.\n"

		"       2                       log all known matched signatures.\n"

		);

}

#define s struct xt_osf_info

static const struct xt_option_entry osf_opts[] = {

	{.name = "genre", .id = O_GENRE, .type = XTTYPE_STRING,

	 .flags = XTOPT_MAND | XTOPT_INVERT | XTOPT_PUT,

	 XTOPT_POINTER(s, genre)},

	{.name = "ttl", .id = O_TTL, .type = XTTYPE_UINT32,

	 .flags = XTOPT_PUT, XTOPT_POINTER(s, ttl), .min = 0, .max = 2},

	{.name = "log", .id = O_LOGLEVEL, .type = XTTYPE_UINT32,

	 .flags = XTOPT_PUT, XTOPT_POINTER(s, loglevel), .min = 0, .max = 2},

	XTOPT_TABLEEND,

};

#undef s

static void osf_parse(struct xt_option_call *cb)

{

	struct xt_osf_info *info = cb->data;

	xtables_option_parse(cb);

	switch (cb->entry->id) {

		case O_GENRE:

			if (cb->invert)

				info->flags |= XT_OSF_INVERT;

			info->len = strlen(info->genre);

			break;

		case O_TTL:

			info->flags |= XT_OSF_TTL;

			break;

		case O_LOGLEVEL:

			info->flags |= XT_OSF_LOG;

			break;

	}

}

static void osf_print(const void *ip, const struct xt_entry_match *match, int numeric)

{

	const struct xt_osf_info *info = (const struct xt_osf_info*) match->data;

	printf(" OS fingerprint match %s%s", (info->flags & XT_OSF_INVERT) ? "! " : "", info->genre);

}

static void osf_save(const void *ip, const struct xt_entry_match *match)

{

	const struct xt_osf_info *info = (const struct xt_osf_info*) match->data;

	if (info->flags & XT_OSF_INVERT)

		printf(" !");

	printf(" --genre %s", info->genre);

	if (info->flags & XT_OSF_TTL)

		printf(" --ttl %u", info->ttl);

	if (info->flags & XT_OSF_LOG)

		printf(" --log %u", info->loglevel);

}

static struct xtables_match osf_match = {

	.name		= "osf",

	.version	= XTABLES_VERSION,

	.size		= XT_ALIGN(sizeof(struct xt_osf_info)),

	.userspacesize	= XT_ALIGN(sizeof(struct xt_osf_info)),

	.help		= osf_help,

	.x6_parse	= osf_parse,

	.print		= osf_print,

	.save		= osf_save,

	.x6_options	= osf_opts,

	.family		= NFPROTO_IPV4,

};

void _init(void)

{

	xtables_register_match(&osf_match);

}