pf_osfp.c revision 127145 
1/*	$FreeBSD: head/sys/contrib/pf/net/pf_osfp.c 127145 2004-03-17 21:11:02Z mlaier $	*/
2/*	$OpenBSD: pf_osfp.c,v 1.3 2003/08/27 18:23:36 frantzen Exp $ */
3
4/*
5 * Copyright (c) 2003 Mike Frantzen <frantzen@w4g.org>
6 *
7 * Permission to use, copy, modify, and distribute this software for any
8 * purpose with or without fee is hereby granted, provided that the above
9 * copyright notice and this permission notice appear in all copies.
10 *
11 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
12 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
13 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
14 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
15 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
16 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
17 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
18 *
19 */
20
21#include <sys/param.h>
22#include <sys/socket.h>
23#ifdef _KERNEL
24# include <sys/systm.h>
25#endif /* _KERNEL */
26#include <sys/mbuf.h>
27
28#include <netinet/in.h>
29#include <netinet/in_systm.h>
30#include <netinet/ip.h>
31#include <netinet/tcp.h>
32
33#include <net/if.h>
34#include <net/pfvar.h>
35
36#ifdef INET6
37#include <netinet/ip6.h>
38#endif /* INET6 */
39
40#ifdef _KERNEL
41# define DPFPRINTF(format, x...)		\
42	if (pf_status.debug >= PF_DEBUG_NOISY)	\
43		printf(format , ##x)
44#ifdef __FreeBSD__
45typedef uma_zone_t pool_t;
46#else
47typedef struct pool pool_t;
48#endif
49
50#else
51/* Userland equivalents so we can lend code to tcpdump et al. */
52
53# include <arpa/inet.h>
54# include <errno.h>
55# include <stdio.h>
56# include <stdlib.h>
57# define pool_t			int
58# define pool_get(pool, flags)	malloc(*(pool))
59# define pool_put(pool, item)	free(item)
60# define pool_init(pool, size, a, ao, f, m, p)	(*(pool)) = (size)
61
62# ifdef __FreeBSD__
63# define NTOHS(x) (x) = ntohs((u_int16_t)(x))
64# endif
65
66# ifdef PFDEBUG
67#  include <stdarg.h>
68#  define DPFPRINTF(format, x...)	fprintf(stderr, format , ##x)
69# else
70#  define DPFPRINTF(format, x...)	((void)0)
71# endif /* PFDEBUG */
72#endif /* _KERNEL */
73
74
75SLIST_HEAD(pf_osfp_list, pf_os_fingerprint) pf_osfp_list;
76pool_t pf_osfp_entry_pl;
77pool_t pf_osfp_pl;
78
79struct pf_os_fingerprint	*pf_osfp_find(struct pf_osfp_list *,
80				    struct pf_os_fingerprint *, u_int8_t);
81struct pf_os_fingerprint	*pf_osfp_find_exact(struct pf_osfp_list *,
82				    struct pf_os_fingerprint *);
83void				 pf_osfp_insert(struct pf_osfp_list *,
84				    struct pf_os_fingerprint *);
85
86
87#ifdef _KERNEL
88/*
89 * Passively fingerprint the OS of the host (IPv4 TCP SYN packets only)
90 * Returns the list of possible OSes.
91 */
92struct pf_osfp_enlist *
93pf_osfp_fingerprint(struct pf_pdesc *pd, struct mbuf *m, int off,
94    const struct tcphdr *tcp)
95{
96	struct ip *ip;
97	char hdr[60];
98
99	/* XXX don't have a fingerprint database for IPv6 :-( */
100	if (pd->af != PF_INET || pd->proto != IPPROTO_TCP || (tcp->th_off << 2)
101	    < sizeof(*tcp))
102		return (NULL);
103
104	ip = mtod(m, struct ip *);
105	if (!pf_pull_hdr(m, off, hdr, tcp->th_off << 2, NULL, NULL, pd->af))
106		return (NULL);
107
108	return (pf_osfp_fingerprint_hdr(ip, (struct tcphdr *)hdr));
109}
110#endif /* _KERNEL */
111
112struct pf_osfp_enlist *
113pf_osfp_fingerprint_hdr(const struct ip *ip, const struct tcphdr *tcp)
114{
115	struct pf_os_fingerprint fp, *fpresult;
116	int cnt, optlen = 0;
117	const u_int8_t *optp;
118
119	if ((tcp->th_flags & (TH_SYN|TH_ACK)) != TH_SYN || (ip->ip_off &
120	    htons(IP_OFFMASK)))
121		return (NULL);
122
123	memset(&fp, 0, sizeof(fp));
124
125	fp.fp_psize = ntohs(ip->ip_len);
126	fp.fp_ttl = ip->ip_ttl;
127	if (ip->ip_off & htons(IP_DF))
128		fp.fp_flags |= PF_OSFP_DF;
129	fp.fp_wsize = ntohs(tcp->th_win);
130
131
132	cnt = (tcp->th_off << 2) - sizeof(*tcp);
133	optp = (const u_int8_t *)((const char *)tcp + sizeof(*tcp));
134	for (; cnt > 0; cnt -= optlen, optp += optlen) {
135		if (*optp == TCPOPT_EOL)
136			break;
137
138		fp.fp_optcnt++;
139		if (*optp == TCPOPT_NOP) {
140			fp.fp_tcpopts = (fp.fp_tcpopts << PF_OSFP_TCPOPT_BITS) |
141			    PF_OSFP_TCPOPT_NOP;
142			optlen = 1;
143		} else {
144			if (cnt < 2)
145				return (NULL);
146			optlen = optp[1];
147			if (optlen > cnt || optlen < 2)
148				return (NULL);
149			switch (*optp) {
150			case TCPOPT_MAXSEG:
151				if (optlen >= TCPOLEN_MAXSEG)
152					memcpy(&fp.fp_mss, &optp[2],
153					    sizeof(fp.fp_mss));
154				fp.fp_tcpopts = (fp.fp_tcpopts <<
155				    PF_OSFP_TCPOPT_BITS) | PF_OSFP_TCPOPT_MSS;
156				NTOHS(fp.fp_mss);
157				break;
158			case TCPOPT_WINDOW:
159				if (optlen >= TCPOLEN_WINDOW)
160					memcpy(&fp.fp_wscale, &optp[2],
161					    sizeof(fp.fp_wscale));
162				NTOHS(fp.fp_wscale);
163				fp.fp_tcpopts = (fp.fp_tcpopts <<
164				    PF_OSFP_TCPOPT_BITS) |
165				    PF_OSFP_TCPOPT_WSCALE;
166				break;
167			case TCPOPT_SACK_PERMITTED:
168				fp.fp_tcpopts = (fp.fp_tcpopts <<
169				    PF_OSFP_TCPOPT_BITS) | PF_OSFP_TCPOPT_SACK;
170				break;
171			case TCPOPT_TIMESTAMP:
172				if (optlen >= TCPOLEN_TIMESTAMP) {
173					u_int32_t ts;
174					memcpy(&ts, &optp[2], sizeof(ts));
175					if (ts == 0)
176						fp.fp_flags |= PF_OSFP_TS0;
177
178				}
179				fp.fp_tcpopts = (fp.fp_tcpopts <<
180				    PF_OSFP_TCPOPT_BITS) | PF_OSFP_TCPOPT_TS;
181				break;
182			default:
183				return (NULL);
184			}
185		}
186		optlen = MAX(optlen, 1);	/* paranoia */
187	}
188
189	DPFPRINTF("fingerprinted %s:%d  %d:%d:%d:%d:%llx (%d) "
190	    "(TS=%s,M=%s%d,W=%s%d)\n",
191	    inet_ntoa(ip->ip_src), ntohs(tcp->th_sport),
192	    fp.fp_wsize, fp.fp_ttl, (fp.fp_flags & PF_OSFP_DF) != 0,
193	    fp.fp_psize, (long long int)fp.fp_tcpopts, fp.fp_optcnt,
194	    (fp.fp_flags & PF_OSFP_TS0) ? "0" : "",
195	    (fp.fp_flags & PF_OSFP_MSS_MOD) ? "%" :
196	    (fp.fp_flags & PF_OSFP_MSS_DC) ? "*" : "",
197	    fp.fp_mss,
198	    (fp.fp_flags & PF_OSFP_WSCALE_MOD) ? "%" :
199	    (fp.fp_flags & PF_OSFP_WSCALE_DC) ? "*" : "",
200	    fp.fp_wscale);
201
202	if ((fpresult = pf_osfp_find(&pf_osfp_list, &fp,
203	    PF_OSFP_MAXTTL_OFFSET)))
204		return (&fpresult->fp_oses);
205	return (NULL);
206}
207
208/* Match a fingerprint ID against a list of OSes */
209int
210pf_osfp_match(struct pf_osfp_enlist *list, pf_osfp_t os)
211{
212	struct pf_osfp_entry *entry;
213	int os_class, os_version, os_subtype;
214	int en_class, en_version, en_subtype;
215
216	if (os == PF_OSFP_ANY)
217		return (1);
218	if (list == NULL) {
219		DPFPRINTF("osfp no match against %x\n", os);
220		return (os == PF_OSFP_UNKNOWN);
221	}
222	PF_OSFP_UNPACK(os, os_class, os_version, os_subtype);
223	SLIST_FOREACH(entry, list, fp_entry) {
224		PF_OSFP_UNPACK(entry->fp_os, en_class, en_version, en_subtype);
225		if ((os_class == PF_OSFP_ANY || en_class == os_class) &&
226		    (os_version == PF_OSFP_ANY || en_version == os_version) &&
227		    (os_subtype == PF_OSFP_ANY || en_subtype == os_subtype)) {
228			DPFPRINTF("osfp matched %s %s %s  %x==%x\n",
229			    entry->fp_class_nm, entry->fp_version_nm,
230			    entry->fp_subtype_nm, os, entry->fp_os);
231			return (1);
232		}
233	}
234	DPFPRINTF("fingerprint 0x%x didn't match\n", os);
235	return (0);
236}
237
238/* Initialize the OS fingerprint system */
239#ifdef __FreeBSD__
240int
241#else
242void
243#endif
244pf_osfp_initialize(void)
245{
246#if defined(__FreeBSD__) && defined(_KERNEL)
247	int error = ENOMEM;
248
249	do {
250		pf_osfp_entry_pl = pf_osfp_pl = NULL;
251		UMA_CREATE(pf_osfp_entry_pl, struct pf_osfp_entry, "pfospfen");
252		UMA_CREATE(pf_osfp_pl, struct pf_os_fingerprint, "pfosfp");
253		error = 0;
254	} while(0);
255#else
256	pool_init(&pf_osfp_entry_pl, sizeof(struct pf_osfp_entry), 0, 0, 0,
257	    "pfosfpen", NULL);
258	pool_init(&pf_osfp_pl, sizeof(struct pf_os_fingerprint), 0, 0, 0,
259	    "pfosfp", NULL);
260#endif
261	SLIST_INIT(&pf_osfp_list);
262#ifdef __FreeBSD__
263#ifdef _KERNEL
264	return (error);
265#else
266	return (0);
267#endif
268#endif
269}
270
271#if defined(__FreeBSD__) && (_KERNEL)
272void
273pf_osfp_cleanup(void)
274{
275	UMA_DESTROY(pf_osfp_entry_pl);
276	UMA_DESTROY(pf_osfp_pl);
277}
278#endif
279
280/* Flush the fingerprint list */
281void
282pf_osfp_flush(void)
283{
284	struct pf_os_fingerprint *fp;
285	struct pf_osfp_entry *entry;
286
287	while ((fp = SLIST_FIRST(&pf_osfp_list))) {
288		SLIST_REMOVE_HEAD(&pf_osfp_list, fp_next);
289		while ((entry = SLIST_FIRST(&fp->fp_oses))) {
290			SLIST_REMOVE_HEAD(&fp->fp_oses, fp_entry);
291			pool_put(&pf_osfp_entry_pl, entry);
292		}
293		pool_put(&pf_osfp_pl, fp);
294	}
295}
296
297
298/* Add a fingerprint */
299int
300pf_osfp_add(struct pf_osfp_ioctl *fpioc)
301{
302	struct pf_os_fingerprint *fp, fpadd;
303	struct pf_osfp_entry *entry;
304
305	memset(&fpadd, 0, sizeof(fpadd));
306	fpadd.fp_tcpopts = fpioc->fp_tcpopts;
307	fpadd.fp_wsize = fpioc->fp_wsize;
308	fpadd.fp_psize = fpioc->fp_psize;
309	fpadd.fp_mss = fpioc->fp_mss;
310	fpadd.fp_flags = fpioc->fp_flags;
311	fpadd.fp_optcnt = fpioc->fp_optcnt;
312	fpadd.fp_wscale = fpioc->fp_wscale;
313	fpadd.fp_ttl = fpioc->fp_ttl;
314
315	DPFPRINTF("adding osfp %s %s %s = %s%d:%d:%d:%s%d:0x%llx %d "
316	    "(TS=%s,M=%s%d,W=%s%d) %x\n",
317	    fpioc->fp_os.fp_class_nm, fpioc->fp_os.fp_version_nm,
318	    fpioc->fp_os.fp_subtype_nm,
319	    (fpadd.fp_flags & PF_OSFP_WSIZE_MOD) ? "%" :
320	    (fpadd.fp_flags & PF_OSFP_WSIZE_MSS) ? "S" :
321	    (fpadd.fp_flags & PF_OSFP_WSIZE_MTU) ? "T" :
322	    (fpadd.fp_flags & PF_OSFP_WSIZE_DC) ? "*" : "",
323	    fpadd.fp_wsize,
324	    fpadd.fp_ttl,
325	    (fpadd.fp_flags & PF_OSFP_DF) ? 1 : 0,
326	    (fpadd.fp_flags & PF_OSFP_PSIZE_MOD) ? "%" :
327	    (fpadd.fp_flags & PF_OSFP_PSIZE_DC) ? "*" : "",
328	    fpadd.fp_psize,
329	    (long long int)fpadd.fp_tcpopts, fpadd.fp_optcnt,
330	    (fpadd.fp_flags & PF_OSFP_TS0) ? "0" : "",
331	    (fpadd.fp_flags & PF_OSFP_MSS_MOD) ? "%" :
332	    (fpadd.fp_flags & PF_OSFP_MSS_DC) ? "*" : "",
333	    fpadd.fp_mss,
334	    (fpadd.fp_flags & PF_OSFP_WSCALE_MOD) ? "%" :
335	    (fpadd.fp_flags & PF_OSFP_WSCALE_DC) ? "*" : "",
336	    fpadd.fp_wscale,
337	    fpioc->fp_os.fp_os);
338
339
340	if ((fp = pf_osfp_find_exact(&pf_osfp_list, &fpadd))) {
341		 SLIST_FOREACH(entry, &fp->fp_oses, fp_entry) {
342			if (PF_OSFP_ENTRY_EQ(entry, &fpioc->fp_os))
343				return (EEXIST);
344		}
345		if ((entry = pool_get(&pf_osfp_entry_pl, PR_NOWAIT)) == NULL)
346			return (ENOMEM);
347	} else {
348		if ((fp = pool_get(&pf_osfp_pl, PR_NOWAIT)) == NULL)
349			return (ENOMEM);
350		memset(fp, 0, sizeof(*fp));
351		fp->fp_tcpopts = fpioc->fp_tcpopts;
352		fp->fp_wsize = fpioc->fp_wsize;
353		fp->fp_psize = fpioc->fp_psize;
354		fp->fp_mss = fpioc->fp_mss;
355		fp->fp_flags = fpioc->fp_flags;
356		fp->fp_optcnt = fpioc->fp_optcnt;
357		fp->fp_wscale = fpioc->fp_wscale;
358		fp->fp_ttl = fpioc->fp_ttl;
359		SLIST_INIT(&fp->fp_oses);
360		if ((entry = pool_get(&pf_osfp_entry_pl, PR_NOWAIT)) == NULL) {
361			pool_put(&pf_osfp_pl, fp);
362			return (ENOMEM);
363		}
364		pf_osfp_insert(&pf_osfp_list, fp);
365	}
366	memcpy(entry, &fpioc->fp_os, sizeof(*entry));
367
368	/* Make sure the strings are NUL terminated */
369	entry->fp_class_nm[sizeof(entry->fp_class_nm)-1] = '\0';
370	entry->fp_version_nm[sizeof(entry->fp_version_nm)-1] = '\0';
371	entry->fp_subtype_nm[sizeof(entry->fp_subtype_nm)-1] = '\0';
372
373	SLIST_INSERT_HEAD(&fp->fp_oses, entry, fp_entry);
374
375#ifdef PFDEBUG
376	if ((fp = pf_osfp_validate()))
377		printf("Invalid fingerprint list\n");
378#endif /* PFDEBUG */
379	return (0);
380}
381
382
383/* Find a fingerprint in the list */
384struct pf_os_fingerprint *
385pf_osfp_find(struct pf_osfp_list *list, struct pf_os_fingerprint *find,
386    u_int8_t ttldiff)
387{
388	struct pf_os_fingerprint *f;
389
390#define MATCH_INT(_MOD, _DC, _field)					\
391	if ((f->fp_flags & _DC) == 0) {					\
392		if ((f->fp_flags & _MOD) == 0) {			\
393			if (f->_field != find->_field)			\
394				continue;				\
395		} else {						\
396			if (f->_field == 0 || find->_field % f->_field)	\
397				continue;				\
398		}							\
399	}
400
401	SLIST_FOREACH(f, list, fp_next) {
402		if (f->fp_tcpopts != find->fp_tcpopts ||
403		    f->fp_optcnt != find->fp_optcnt ||
404		    f->fp_ttl < find->fp_ttl ||
405		    f->fp_ttl - find->fp_ttl > ttldiff ||
406		    (f->fp_flags & (PF_OSFP_DF|PF_OSFP_TS0)) !=
407		    (find->fp_flags & (PF_OSFP_DF|PF_OSFP_TS0)))
408			continue;
409
410		MATCH_INT(PF_OSFP_PSIZE_MOD, PF_OSFP_PSIZE_DC, fp_psize)
411		MATCH_INT(PF_OSFP_MSS_MOD, PF_OSFP_MSS_DC, fp_mss)
412		MATCH_INT(PF_OSFP_WSCALE_MOD, PF_OSFP_WSCALE_DC, fp_wscale)
413		if ((f->fp_flags & PF_OSFP_WSIZE_DC) == 0) {
414			if (f->fp_flags & PF_OSFP_WSIZE_MSS) {
415				if (find->fp_mss == 0)
416					continue;
417
418/* Some "smart" NAT devices and DSL routers will tweak the MSS size and
419 * will set it to whatever is suitable for the link type.
420 */
421#define SMART_MSS	1460
422				if ((find->fp_wsize % find->fp_mss ||
423				    find->fp_wsize / find->fp_mss !=
424				    f->fp_wsize) &&
425				    (find->fp_wsize % SMART_MSS ||
426				    find->fp_wsize / SMART_MSS !=
427				    f->fp_wsize))
428					continue;
429			} else if (f->fp_flags & PF_OSFP_WSIZE_MTU) {
430				if (find->fp_mss == 0)
431					continue;
432
433#define MTUOFF	(sizeof(struct ip) + sizeof(struct tcphdr))
434#define SMART_MTU	(SMART_MSS + MTUOFF)
435				if ((find->fp_wsize % (find->fp_mss + MTUOFF) ||
436				    find->fp_wsize / (find->fp_mss + MTUOFF) !=
437				    f->fp_wsize) &&
438				    (find->fp_wsize % SMART_MTU ||
439				    find->fp_wsize / SMART_MTU !=
440				    f->fp_wsize))
441					continue;
442			} else if (f->fp_flags & PF_OSFP_WSIZE_MOD) {
443				if (f->fp_wsize == 0 || find->fp_wsize %
444				    f->fp_wsize)
445					continue;
446			} else {
447				if (f->fp_wsize != find->fp_wsize)
448					continue;
449			}
450		}
451		return (f);
452	}
453
454	return (NULL);
455}
456
457/* Find an exact fingerprint in the list */
458struct pf_os_fingerprint *
459pf_osfp_find_exact(struct pf_osfp_list *list, struct pf_os_fingerprint *find)
460{
461	struct pf_os_fingerprint *f;
462
463	SLIST_FOREACH(f, list, fp_next) {
464		if (f->fp_tcpopts == find->fp_tcpopts &&
465		    f->fp_wsize == find->fp_wsize &&
466		    f->fp_psize == find->fp_psize &&
467		    f->fp_mss == find->fp_mss &&
468		    f->fp_flags == find->fp_flags &&
469		    f->fp_optcnt == find->fp_optcnt &&
470		    f->fp_wscale == find->fp_wscale &&
471		    f->fp_ttl == find->fp_ttl)
472			return (f);
473	}
474
475	return (NULL);
476}
477
478/* Insert a fingerprint into the list */
479void
480pf_osfp_insert(struct pf_osfp_list *list, struct pf_os_fingerprint *ins)
481{
482	struct pf_os_fingerprint *f, *prev = NULL;
483
484	/* XXX need to go semi tree based.  can key on tcp options */
485
486	SLIST_FOREACH(f, list, fp_next)
487		prev = f;
488	if (prev)
489		SLIST_INSERT_AFTER(prev, ins, fp_next);
490	else
491		SLIST_INSERT_HEAD(list, ins, fp_next);
492}
493
494/* Fill a fingerprint by its number (from an ioctl) */
495int
496pf_osfp_get(struct pf_osfp_ioctl *fpioc)
497{
498	struct pf_os_fingerprint *fp;
499	struct pf_osfp_entry *entry;
500	int num = fpioc->fp_getnum;
501	int i = 0;
502
503
504	memset(fpioc, 0, sizeof(*fpioc));
505	SLIST_FOREACH(fp, &pf_osfp_list, fp_next) {
506		SLIST_FOREACH(entry, &fp->fp_oses, fp_entry) {
507			if (i++ == num) {
508				fpioc->fp_mss = fp->fp_mss;
509				fpioc->fp_wsize = fp->fp_wsize;
510				fpioc->fp_flags = fp->fp_flags;
511				fpioc->fp_psize = fp->fp_psize;
512				fpioc->fp_ttl = fp->fp_ttl;
513				fpioc->fp_wscale = fp->fp_wscale;
514				fpioc->fp_getnum = num;
515				memcpy(&fpioc->fp_os, entry,
516				    sizeof(fpioc->fp_os));
517				return (0);
518			}
519		}
520	}
521
522	return (EBUSY);
523}
524
525
526/* Validate that each signature is reachable */
527struct pf_os_fingerprint *
528pf_osfp_validate(void)
529{
530	struct pf_os_fingerprint *f, *f2, find;
531
532	SLIST_FOREACH(f, &pf_osfp_list, fp_next) {
533		memcpy(&find, f, sizeof(find));
534
535		/* We do a few MSS/th_win percolations to make things unique */
536		if (find.fp_mss == 0)
537			find.fp_mss = 128;
538		if (f->fp_flags & PF_OSFP_WSIZE_MSS)
539			find.fp_wsize *= find.fp_mss, 1;
540		else if (f->fp_flags & PF_OSFP_WSIZE_MTU)
541			find.fp_wsize *= (find.fp_mss + 40);
542		else if (f->fp_flags & PF_OSFP_WSIZE_MOD)
543			find.fp_wsize *= 2;
544		if (f != (f2 = pf_osfp_find(&pf_osfp_list, &find, 0))) {
545			if (f2)
546				printf("Found \"%s %s %s\" instead of "
547				    "\"%s %s %s\"\n",
548				    SLIST_FIRST(&f2->fp_oses)->fp_class_nm,
549				    SLIST_FIRST(&f2->fp_oses)->fp_version_nm,
550				    SLIST_FIRST(&f2->fp_oses)->fp_subtype_nm,
551				    SLIST_FIRST(&f->fp_oses)->fp_class_nm,
552				    SLIST_FIRST(&f->fp_oses)->fp_version_nm,
553				    SLIST_FIRST(&f->fp_oses)->fp_subtype_nm);
554			else
555				printf("Couldn't find \"%s %s %s\"\n",
556				    SLIST_FIRST(&f->fp_oses)->fp_class_nm,
557				    SLIST_FIRST(&f->fp_oses)->fp_version_nm,
558				    SLIST_FIRST(&f->fp_oses)->fp_subtype_nm);
559			return (f);
560		}
561	}
562	return (NULL);
563}
564