1/*	$NetBSD: pf_osfp.c,v 1.13 2017/01/16 15:46:19 christos Exp $	*/
2/*	$OpenBSD: pf_osfp.c,v 1.12 2006/12/13 18:14:10 itojun Exp $ */
3
4/*
5 * Copyright (c) 2003 Mike Frantzen <frantzen@w4g.org>
6 *
7 * Permission to use, copy, modify, and distribute this software for any
8 * purpose with or without fee is hereby granted, provided that the above
9 * copyright notice and this permission notice appear in all copies.
10 *
11 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
12 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
13 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
14 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
15 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
16 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
17 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
18 *
19 */
20
21#include <sys/cdefs.h>
22__KERNEL_RCSID(0, "$NetBSD: pf_osfp.c,v 1.13 2017/01/16 15:46:19 christos Exp $");
23
24#ifdef _KERNEL_OPT
25#include "opt_inet.h"
26#endif
27
28#include <sys/param.h>
29#include <sys/socket.h>
30#ifdef _KERNEL
31# include <sys/systm.h>
32#endif /* _KERNEL */
33#include <sys/mbuf.h>
34
35#include <netinet/in.h>
36#include <netinet/in_systm.h>
37#include <netinet/ip.h>
38#include <netinet/tcp.h>
39
40#include <net/if.h>
41#include <net/pfvar.h>
42
43#include <netinet/ip6.h>
44#ifdef _KERNEL
45#include <netinet6/in6_var.h>
46#endif
47
48
49#ifdef _KERNEL
50# define DPFPRINTF(format, x...)		\
51	if (pf_status.debug >= PF_DEBUG_NOISY)	\
52		printf(format , ##x)
53typedef struct pool pool_t;
54
55#else
56/* Userland equivalents so we can lend code to tcpdump et al. */
57
58# include <arpa/inet.h>
59# include <errno.h>
60# include <stdio.h>
61# include <stdlib.h>
62# include <string.h>
63# include <netdb.h>
64# define pool_t			int
65# define pool_get(pool, flags)	malloc(*(pool))
66# define pool_put(pool, item)	free(item)
67# define pool_init(pool, size, a, ao, f, m, p)	(*(pool)) = (size)
68
69# ifdef PFDEBUG
70#  include <sys/stdarg.h>
71#  define DPFPRINTF(format, x...)	fprintf(stderr, format , ##x)
72# else
73#  define DPFPRINTF(format, x...)	((void)0)
74# endif /* PFDEBUG */
75#endif /* _KERNEL */
76
77
78SLIST_HEAD(pf_osfp_list, pf_os_fingerprint) pf_osfp_list;
79pool_t pf_osfp_entry_pl;
80pool_t pf_osfp_pl;
81
82struct pf_os_fingerprint	*pf_osfp_find(struct pf_osfp_list *,
83				    struct pf_os_fingerprint *, u_int8_t);
84struct pf_os_fingerprint	*pf_osfp_find_exact(struct pf_osfp_list *,
85				    struct pf_os_fingerprint *);
86void				 pf_osfp_insert(struct pf_osfp_list *,
87				    struct pf_os_fingerprint *);
88
89
90#ifdef _KERNEL
91/*
92 * Passively fingerprint the OS of the host (IPv4 TCP SYN packets only)
93 * Returns the list of possible OSes.
94 */
95struct pf_osfp_enlist *
96pf_osfp_fingerprint(struct pf_pdesc *pd, struct mbuf *m, int off,
97    const struct tcphdr *tcp)
98{
99	struct ip *ip;
100	struct ip6_hdr *ip6;
101	char hdr[60];
102
103	if ((pd->af != PF_INET && pd->af != PF_INET6) ||
104	    pd->proto != IPPROTO_TCP || (tcp->th_off << 2) < sizeof(*tcp))
105		return (NULL);
106
107	if (pd->af == PF_INET) {
108		ip = mtod(m, struct ip *);
109		ip6 = (struct ip6_hdr *)NULL;
110	} else {
111		ip = (struct ip *)NULL;
112		ip6 = mtod(m, struct ip6_hdr *);
113	}
114	if (!pf_pull_hdr(m, off, hdr, tcp->th_off << 2, NULL, NULL,
115	    pd->af)) return (NULL);
116
117	return (pf_osfp_fingerprint_hdr(ip, ip6, (struct tcphdr *)hdr));
118}
119#endif /* _KERNEL */
120
121struct pf_osfp_enlist *
122pf_osfp_fingerprint_hdr(const struct ip *ip, const struct ip6_hdr *ip6, const struct tcphdr *tcp)
123{
124	struct pf_os_fingerprint fp, *fpresult;
125	int cnt, optlen = 0;
126	const u_int8_t *optp;
127#ifdef _KERNEL
128	char srcname[128];
129#else
130	char srcname[NI_MAXHOST];
131#endif
132
133	if ((tcp->th_flags & (TH_SYN|TH_ACK)) != TH_SYN)
134		return (NULL);
135	if (ip) {
136		if ((ip->ip_off & htons(IP_OFFMASK)) != 0)
137			return (NULL);
138	}
139
140	memset(&fp, 0, sizeof(fp));
141
142	if (ip) {
143#ifndef _KERNEL
144		struct sockaddr_in sin;
145#endif
146
147		fp.fp_psize = ntohs(ip->ip_len);
148		fp.fp_ttl = ip->ip_ttl;
149		if (ip->ip_off & htons(IP_DF))
150			fp.fp_flags |= PF_OSFP_DF;
151#ifdef _KERNEL
152		strlcpy(srcname, inet_ntoa(ip->ip_src), sizeof(srcname));
153#else
154		memset(&sin, 0, sizeof(sin));
155		sin.sin_family = AF_INET;
156		sin.sin_len = sizeof(struct sockaddr_in);
157		sin.sin_addr = ip->ip_src;
158		(void)getnameinfo((struct sockaddr *)&sin,
159		    sizeof(struct sockaddr_in), srcname, sizeof(srcname),
160		    NULL, 0, NI_NUMERICHOST);
161#endif
162	}
163#ifdef INET6
164	else if (ip6) {
165#ifndef _KERNEL
166		struct sockaddr_in6 sin6;
167#endif
168
169		/* jumbo payload? */
170		fp.fp_psize = sizeof(struct ip6_hdr) + ntohs(ip6->ip6_plen);
171		fp.fp_ttl = ip6->ip6_hlim;
172		fp.fp_flags |= PF_OSFP_DF;
173		fp.fp_flags |= PF_OSFP_INET6;
174#ifdef _KERNEL
175		in6_print(srcname, sizeof(srcname),
176		    (const struct in6_addr *)&ip6->ip6_src);
177#else
178		memset(&sin6, 0, sizeof(sin6));
179		sin6.sin6_family = AF_INET6;
180		sin6.sin6_len = sizeof(struct sockaddr_in6);
181		sin6.sin6_addr = ip6->ip6_src;
182		(void)getnameinfo((struct sockaddr *)&sin6,
183		    sizeof(struct sockaddr_in6), srcname, sizeof(srcname),
184		    NULL, 0, NI_NUMERICHOST);
185#endif
186	}
187#endif
188	else
189		return (NULL);
190	fp.fp_wsize = ntohs(tcp->th_win);
191
192
193	cnt = (tcp->th_off << 2) - sizeof(*tcp);
194	optp = (const u_int8_t *)((const char *)tcp + sizeof(*tcp));
195	for (; cnt > 0; cnt -= optlen, optp += optlen) {
196		if (*optp == TCPOPT_EOL)
197			break;
198
199		fp.fp_optcnt++;
200		if (*optp == TCPOPT_NOP) {
201			fp.fp_tcpopts = (fp.fp_tcpopts << PF_OSFP_TCPOPT_BITS) |
202			    PF_OSFP_TCPOPT_NOP;
203			optlen = 1;
204		} else {
205			if (cnt < 2)
206				return (NULL);
207			optlen = optp[1];
208			if (optlen > cnt || optlen < 2)
209				return (NULL);
210			switch (*optp) {
211			case TCPOPT_MAXSEG:
212				if (optlen >= TCPOLEN_MAXSEG)
213					memcpy(&fp.fp_mss, &optp[2],
214					    sizeof(fp.fp_mss));
215				fp.fp_tcpopts = (fp.fp_tcpopts <<
216				    PF_OSFP_TCPOPT_BITS) | PF_OSFP_TCPOPT_MSS;
217				NTOHS(fp.fp_mss);
218				break;
219			case TCPOPT_WINDOW:
220				if (optlen >= TCPOLEN_WINDOW)
221					memcpy(&fp.fp_wscale, &optp[2],
222					    sizeof(fp.fp_wscale));
223				NTOHS(fp.fp_wscale);
224				fp.fp_tcpopts = (fp.fp_tcpopts <<
225				    PF_OSFP_TCPOPT_BITS) |
226				    PF_OSFP_TCPOPT_WSCALE;
227				break;
228			case TCPOPT_SACK_PERMITTED:
229				fp.fp_tcpopts = (fp.fp_tcpopts <<
230				    PF_OSFP_TCPOPT_BITS) | PF_OSFP_TCPOPT_SACK;
231				break;
232			case TCPOPT_TIMESTAMP:
233				if (optlen >= TCPOLEN_TIMESTAMP) {
234					u_int32_t ts;
235					memcpy(&ts, &optp[2], sizeof(ts));
236					if (ts == 0)
237						fp.fp_flags |= PF_OSFP_TS0;
238
239				}
240				fp.fp_tcpopts = (fp.fp_tcpopts <<
241				    PF_OSFP_TCPOPT_BITS) | PF_OSFP_TCPOPT_TS;
242				break;
243			default:
244				return (NULL);
245			}
246		}
247		optlen = MAX(optlen, 1);	/* paranoia */
248	}
249
250	DPFPRINTF("fingerprinted %s:%d  %d:%d:%d:%d:%llx (%d) "
251	    "(TS=%s,M=%s%d,W=%s%d)\n",
252	    srcname, ntohs(tcp->th_sport),
253	    fp.fp_wsize, fp.fp_ttl, (fp.fp_flags & PF_OSFP_DF) != 0,
254	    fp.fp_psize, (long long int)fp.fp_tcpopts, fp.fp_optcnt,
255	    (fp.fp_flags & PF_OSFP_TS0) ? "0" : "",
256	    (fp.fp_flags & PF_OSFP_MSS_MOD) ? "%" :
257	    (fp.fp_flags & PF_OSFP_MSS_DC) ? "*" : "",
258	    fp.fp_mss,
259	    (fp.fp_flags & PF_OSFP_WSCALE_MOD) ? "%" :
260	    (fp.fp_flags & PF_OSFP_WSCALE_DC) ? "*" : "",
261	    fp.fp_wscale);
262
263	if ((fpresult = pf_osfp_find(&pf_osfp_list, &fp,
264	    PF_OSFP_MAXTTL_OFFSET)))
265		return (&fpresult->fp_oses);
266	return (NULL);
267}
268
269/* Match a fingerprint ID against a list of OSes */
270int
271pf_osfp_match(struct pf_osfp_enlist *list, pf_osfp_t os)
272{
273	struct pf_osfp_entry *entry;
274	int os_class, os_version, os_subtype;
275	int en_class, en_version, en_subtype;
276
277	if (os == PF_OSFP_ANY)
278		return (1);
279	if (list == NULL) {
280		DPFPRINTF("osfp no match against %x\n", os);
281		return (os == PF_OSFP_UNKNOWN);
282	}
283	PF_OSFP_UNPACK(os, os_class, os_version, os_subtype);
284	SLIST_FOREACH(entry, list, fp_entry) {
285		PF_OSFP_UNPACK(entry->fp_os, en_class, en_version, en_subtype);
286		if ((os_class == PF_OSFP_ANY || en_class == os_class) &&
287		    (os_version == PF_OSFP_ANY || en_version == os_version) &&
288		    (os_subtype == PF_OSFP_ANY || en_subtype == os_subtype)) {
289			DPFPRINTF("osfp matched %s %s %s  %x==%x\n",
290			    entry->fp_class_nm, entry->fp_version_nm,
291			    entry->fp_subtype_nm, os, entry->fp_os);
292			return (1);
293		}
294	}
295	DPFPRINTF("fingerprint 0x%x didn't match\n", os);
296	return (0);
297}
298
299/* Initialize the OS fingerprint system */
300void
301pf_osfp_initialize(void)
302{
303#ifdef __NetBSD__
304	pool_init(&pf_osfp_entry_pl, sizeof(struct pf_osfp_entry), 0, 0, 0,
305	    "pfosfpen", &pool_allocator_nointr, IPL_NONE);
306	pool_init(&pf_osfp_pl, sizeof(struct pf_os_fingerprint), 0, 0, 0,
307	    "pfosfp", &pool_allocator_nointr, IPL_NONE);
308#else
309	pool_init(&pf_osfp_entry_pl, sizeof(struct pf_osfp_entry), 0, 0, 0,
310	    "pfosfpen", &pool_allocator_nointr);
311	pool_init(&pf_osfp_pl, sizeof(struct pf_os_fingerprint), 0, 0, 0,
312	    "pfosfp", &pool_allocator_nointr);
313#endif /* !__NetBSD__ */
314	SLIST_INIT(&pf_osfp_list);
315}
316
317#ifdef _MODULE
318void
319pf_osfp_destroy(void)
320{
321	pf_osfp_flush();
322
323	pool_destroy(&pf_osfp_pl);
324	pool_destroy(&pf_osfp_entry_pl);
325}
326#endif /* _MODULE */
327
328/* Flush the fingerprint list */
329void
330pf_osfp_flush(void)
331{
332	struct pf_os_fingerprint *fp;
333	struct pf_osfp_entry *entry;
334
335	while ((fp = SLIST_FIRST(&pf_osfp_list))) {
336		SLIST_REMOVE_HEAD(&pf_osfp_list, fp_next);
337		while ((entry = SLIST_FIRST(&fp->fp_oses))) {
338			SLIST_REMOVE_HEAD(&fp->fp_oses, fp_entry);
339			pool_put(&pf_osfp_entry_pl, entry);
340		}
341		pool_put(&pf_osfp_pl, fp);
342	}
343}
344
345
346/* Add a fingerprint */
347int
348pf_osfp_add(struct pf_osfp_ioctl *fpioc)
349{
350	struct pf_os_fingerprint *fp, fpadd;
351	struct pf_osfp_entry *entry;
352
353	memset(&fpadd, 0, sizeof(fpadd));
354	fpadd.fp_tcpopts = fpioc->fp_tcpopts;
355	fpadd.fp_wsize = fpioc->fp_wsize;
356	fpadd.fp_psize = fpioc->fp_psize;
357	fpadd.fp_mss = fpioc->fp_mss;
358	fpadd.fp_flags = fpioc->fp_flags;
359	fpadd.fp_optcnt = fpioc->fp_optcnt;
360	fpadd.fp_wscale = fpioc->fp_wscale;
361	fpadd.fp_ttl = fpioc->fp_ttl;
362
363	DPFPRINTF("adding osfp %s %s %s = %s%d:%d:%d:%s%d:0x%llx %d "
364	    "(TS=%s,M=%s%d,W=%s%d) %x\n",
365	    fpioc->fp_os.fp_class_nm, fpioc->fp_os.fp_version_nm,
366	    fpioc->fp_os.fp_subtype_nm,
367	    (fpadd.fp_flags & PF_OSFP_WSIZE_MOD) ? "%" :
368	    (fpadd.fp_flags & PF_OSFP_WSIZE_MSS) ? "S" :
369	    (fpadd.fp_flags & PF_OSFP_WSIZE_MTU) ? "T" :
370	    (fpadd.fp_flags & PF_OSFP_WSIZE_DC) ? "*" : "",
371	    fpadd.fp_wsize,
372	    fpadd.fp_ttl,
373	    (fpadd.fp_flags & PF_OSFP_DF) ? 1 : 0,
374	    (fpadd.fp_flags & PF_OSFP_PSIZE_MOD) ? "%" :
375	    (fpadd.fp_flags & PF_OSFP_PSIZE_DC) ? "*" : "",
376	    fpadd.fp_psize,
377	    (long long int)fpadd.fp_tcpopts, fpadd.fp_optcnt,
378	    (fpadd.fp_flags & PF_OSFP_TS0) ? "0" : "",
379	    (fpadd.fp_flags & PF_OSFP_MSS_MOD) ? "%" :
380	    (fpadd.fp_flags & PF_OSFP_MSS_DC) ? "*" : "",
381	    fpadd.fp_mss,
382	    (fpadd.fp_flags & PF_OSFP_WSCALE_MOD) ? "%" :
383	    (fpadd.fp_flags & PF_OSFP_WSCALE_DC) ? "*" : "",
384	    fpadd.fp_wscale,
385	    fpioc->fp_os.fp_os);
386
387
388	if ((fp = pf_osfp_find_exact(&pf_osfp_list, &fpadd))) {
389		 SLIST_FOREACH(entry, &fp->fp_oses, fp_entry) {
390			if (PF_OSFP_ENTRY_EQ(entry, &fpioc->fp_os))
391				return (EEXIST);
392		}
393		if ((entry = pool_get(&pf_osfp_entry_pl, PR_NOWAIT)) == NULL)
394			return (ENOMEM);
395	} else {
396		if ((fp = pool_get(&pf_osfp_pl, PR_NOWAIT)) == NULL)
397			return (ENOMEM);
398		memset(fp, 0, sizeof(*fp));
399		fp->fp_tcpopts = fpioc->fp_tcpopts;
400		fp->fp_wsize = fpioc->fp_wsize;
401		fp->fp_psize = fpioc->fp_psize;
402		fp->fp_mss = fpioc->fp_mss;
403		fp->fp_flags = fpioc->fp_flags;
404		fp->fp_optcnt = fpioc->fp_optcnt;
405		fp->fp_wscale = fpioc->fp_wscale;
406		fp->fp_ttl = fpioc->fp_ttl;
407		SLIST_INIT(&fp->fp_oses);
408		if ((entry = pool_get(&pf_osfp_entry_pl, PR_NOWAIT)) == NULL) {
409			pool_put(&pf_osfp_pl, fp);
410			return (ENOMEM);
411		}
412		pf_osfp_insert(&pf_osfp_list, fp);
413	}
414	memcpy(entry, &fpioc->fp_os, sizeof(*entry));
415
416	/* Make sure the strings are NUL terminated */
417	entry->fp_class_nm[sizeof(entry->fp_class_nm)-1] = '\0';
418	entry->fp_version_nm[sizeof(entry->fp_version_nm)-1] = '\0';
419	entry->fp_subtype_nm[sizeof(entry->fp_subtype_nm)-1] = '\0';
420
421	SLIST_INSERT_HEAD(&fp->fp_oses, entry, fp_entry);
422
423#ifdef PFDEBUG
424	if ((fp = pf_osfp_validate()))
425		printf("Invalid fingerprint list\n");
426#endif /* PFDEBUG */
427	return (0);
428}
429
430
431/* Find a fingerprint in the list */
432struct pf_os_fingerprint *
433pf_osfp_find(struct pf_osfp_list *list, struct pf_os_fingerprint *find,
434    u_int8_t ttldiff)
435{
436	struct pf_os_fingerprint *f;
437
438#define MATCH_INT(_MOD, _DC, _field)					\
439	if ((f->fp_flags & _DC) == 0) {					\
440		if ((f->fp_flags & _MOD) == 0) {			\
441			if (f->_field != find->_field)			\
442				continue;				\
443		} else {						\
444			if (f->_field == 0 || find->_field % f->_field)	\
445				continue;				\
446		}							\
447	}
448
449	SLIST_FOREACH(f, list, fp_next) {
450		if (f->fp_tcpopts != find->fp_tcpopts ||
451		    f->fp_optcnt != find->fp_optcnt ||
452		    f->fp_ttl < find->fp_ttl ||
453		    f->fp_ttl - find->fp_ttl > ttldiff ||
454		    (f->fp_flags & (PF_OSFP_DF|PF_OSFP_TS0)) !=
455		    (find->fp_flags & (PF_OSFP_DF|PF_OSFP_TS0)))
456			continue;
457
458		MATCH_INT(PF_OSFP_PSIZE_MOD, PF_OSFP_PSIZE_DC, fp_psize)
459		MATCH_INT(PF_OSFP_MSS_MOD, PF_OSFP_MSS_DC, fp_mss)
460		MATCH_INT(PF_OSFP_WSCALE_MOD, PF_OSFP_WSCALE_DC, fp_wscale)
461		if ((f->fp_flags & PF_OSFP_WSIZE_DC) == 0) {
462			if (f->fp_flags & PF_OSFP_WSIZE_MSS) {
463				if (find->fp_mss == 0)
464					continue;
465
466/* Some "smart" NAT devices and DSL routers will tweak the MSS size and
467 * will set it to whatever is suitable for the link type.
468 */
469#define SMART_MSS	1460
470				if ((find->fp_wsize % find->fp_mss ||
471				    find->fp_wsize / find->fp_mss !=
472				    f->fp_wsize) &&
473				    (find->fp_wsize % SMART_MSS ||
474				    find->fp_wsize / SMART_MSS !=
475				    f->fp_wsize))
476					continue;
477			} else if (f->fp_flags & PF_OSFP_WSIZE_MTU) {
478				if (find->fp_mss == 0)
479					continue;
480
481#define MTUOFF	(sizeof(struct ip) + sizeof(struct tcphdr))
482#define SMART_MTU	(SMART_MSS + MTUOFF)
483				if ((find->fp_wsize % (find->fp_mss + MTUOFF) ||
484				    find->fp_wsize / (find->fp_mss + MTUOFF) !=
485				    f->fp_wsize) &&
486				    (find->fp_wsize % SMART_MTU ||
487				    find->fp_wsize / SMART_MTU !=
488				    f->fp_wsize))
489					continue;
490			} else if (f->fp_flags & PF_OSFP_WSIZE_MOD) {
491				if (f->fp_wsize == 0 || find->fp_wsize %
492				    f->fp_wsize)
493					continue;
494			} else {
495				if (f->fp_wsize != find->fp_wsize)
496					continue;
497			}
498		}
499		return (f);
500	}
501
502	return (NULL);
503}
504
505/* Find an exact fingerprint in the list */
506struct pf_os_fingerprint *
507pf_osfp_find_exact(struct pf_osfp_list *list, struct pf_os_fingerprint *find)
508{
509	struct pf_os_fingerprint *f;
510
511	SLIST_FOREACH(f, list, fp_next) {
512		if (f->fp_tcpopts == find->fp_tcpopts &&
513		    f->fp_wsize == find->fp_wsize &&
514		    f->fp_psize == find->fp_psize &&
515		    f->fp_mss == find->fp_mss &&
516		    f->fp_flags == find->fp_flags &&
517		    f->fp_optcnt == find->fp_optcnt &&
518		    f->fp_wscale == find->fp_wscale &&
519		    f->fp_ttl == find->fp_ttl)
520			return (f);
521	}
522
523	return (NULL);
524}
525
526/* Insert a fingerprint into the list */
527void
528pf_osfp_insert(struct pf_osfp_list *list, struct pf_os_fingerprint *ins)
529{
530	struct pf_os_fingerprint *f, *prev = NULL;
531
532	/* XXX need to go semi tree based.  can key on tcp options */
533
534	SLIST_FOREACH(f, list, fp_next)
535		prev = f;
536	if (prev)
537		SLIST_INSERT_AFTER(prev, ins, fp_next);
538	else
539		SLIST_INSERT_HEAD(list, ins, fp_next);
540}
541
542/* Fill a fingerprint by its number (from an ioctl) */
543int
544pf_osfp_get(struct pf_osfp_ioctl *fpioc)
545{
546	struct pf_os_fingerprint *fp;
547	struct pf_osfp_entry *entry;
548	int num = fpioc->fp_getnum;
549	int i = 0;
550
551
552	memset(fpioc, 0, sizeof(*fpioc));
553	SLIST_FOREACH(fp, &pf_osfp_list, fp_next) {
554		SLIST_FOREACH(entry, &fp->fp_oses, fp_entry) {
555			if (i++ == num) {
556				fpioc->fp_mss = fp->fp_mss;
557				fpioc->fp_wsize = fp->fp_wsize;
558				fpioc->fp_flags = fp->fp_flags;
559				fpioc->fp_psize = fp->fp_psize;
560				fpioc->fp_ttl = fp->fp_ttl;
561				fpioc->fp_wscale = fp->fp_wscale;
562				fpioc->fp_getnum = num;
563				memcpy(&fpioc->fp_os, entry,
564				    sizeof(fpioc->fp_os));
565				return (0);
566			}
567		}
568	}
569
570	return (EBUSY);
571}
572
573
574/* Validate that each signature is reachable */
575struct pf_os_fingerprint *
576pf_osfp_validate(void)
577{
578	struct pf_os_fingerprint *f, *f2, find;
579
580	SLIST_FOREACH(f, &pf_osfp_list, fp_next) {
581		memcpy(&find, f, sizeof(find));
582
583		/* We do a few MSS/th_win percolations to make things unique */
584		if (find.fp_mss == 0)
585			find.fp_mss = 128;
586		if (f->fp_flags & PF_OSFP_WSIZE_MSS)
587			find.fp_wsize *= find.fp_mss;
588		else if (f->fp_flags & PF_OSFP_WSIZE_MTU)
589			find.fp_wsize *= (find.fp_mss + 40);
590		else if (f->fp_flags & PF_OSFP_WSIZE_MOD)
591			find.fp_wsize *= 2;
592		if (f != (f2 = pf_osfp_find(&pf_osfp_list, &find, 0))) {
593			if (f2)
594				printf("Found \"%s %s %s\" instead of "
595				    "\"%s %s %s\"\n",
596				    SLIST_FIRST(&f2->fp_oses)->fp_class_nm,
597				    SLIST_FIRST(&f2->fp_oses)->fp_version_nm,
598				    SLIST_FIRST(&f2->fp_oses)->fp_subtype_nm,
599				    SLIST_FIRST(&f->fp_oses)->fp_class_nm,
600				    SLIST_FIRST(&f->fp_oses)->fp_version_nm,
601				    SLIST_FIRST(&f->fp_oses)->fp_subtype_nm);
602			else
603				printf("Couldn't find \"%s %s %s\"\n",
604				    SLIST_FIRST(&f->fp_oses)->fp_class_nm,
605				    SLIST_FIRST(&f->fp_oses)->fp_version_nm,
606				    SLIST_FIRST(&f->fp_oses)->fp_subtype_nm);
607			return (f);
608		}
609	}
610	return (NULL);
611}
612