netdev - Re: Passive OS fingerprint xtables match.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20090607151218.GA31757@ioremap.net>
Date:	Sun, 7 Jun 2009 19:12:18 +0400
From:	Evgeniy Polyakov <zbr@...emap.net>
To:	Patrick McHardy <kaber@...sh.net>
Cc:	netdev@...r.kernel.org, David Miller <davem@...emloft.net>,
	"Paul E. McKenney" <paulmck@...ux.vnet.ibm.com>,
	Netfilter Development Mailinglist 
	<netfilter-devel@...r.kernel.org>,
	Jan Engelhardt <jengelh@...ozas.de>
Subject: Re: Passive OS fingerprint xtables match.

Hi Patrick.

I've added mentioned cleanups except the one described below.

On Fri, Jun 05, 2009 at 01:54:15PM +0200, Patrick McHardy (kaber@...sh.net) wrote:

> >+	tcp = skb_header_pointer(skb, ip_hdrlen(skb), sizeof(struct tcphdr), 
> >&_tcph);
> >+	if (!tcp)
> >+		return false;
> >+
> >+	if (!tcp->syn)
> >+		return false;
> >+
> >+	totlen = ntohs(ip->tot_len);
> >+	df = ntohs(ip->frag_off) & IP_DF;
> >+	window = ntohs(tcp->window);
> >+
> >+	if (tcp->doff * 4 > sizeof(struct tcphdr)) {
> >+		optsize = tcp->doff * 4 - sizeof(struct tcphdr);
> 
> tcp_optlen()?

TCP header is potentially copied above and transport header may be not
set, so I work with that part of skb without assuming it was previously
set by lower layers.

> >+		if (info->flags & XT_OSF_LOG) {
> >+			if (info->loglevel != XT_OSF_LOGLEVEL_ALL_KNOWN)
> >+				nf_log_packet(p->hooknum, 0, skb, p->in, 
> >p->out, NULL,
> >+					"window: %u, mss: %u, totlen: %u, 
> >df: %d, ttl: %u : ",
> >+					window, mss, totlen, df, ip->ttl);
> 
> nf_log_packet() can pass the entire packet to userspace. Header-field
> extraction should be done by whatever is logging in userspace. This
> looks very much like debugging anyways, where is the actual message?

Message itself is 'printed' couple of lines below, but apparently it is
not needed for nf_log_packet, only for the printk()-based debug, so I
dropped that part.

-- 
	Evgeniy Polyakov
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html