diff --git a/example/osfp_example.c b/example/osfp_example.c index a9b3017..7924e73 100644 --- a/example/osfp_example.c +++ b/example/osfp_example.c @@ -431,7 +431,7 @@ const char *PrintInet(int af, const void *src, char *dst, socklen_t size) void example_detect(struct osfp_db *osfp_db, Packet *p) { int ret; - char str_buf[1024] = ""; + char str_buf[2048] = ""; //unsigned char *iph = (unsigned char *)(p->iph != NULL ? (void *)p->iph : (void *)p->ip6h); struct iphdr *iph; struct ip6_hdr *ip6h; @@ -449,14 +449,19 @@ void example_detect(struct osfp_db *osfp_db, Packet *p) struct osfp_fingerprint fp = {0}; + if (iph) { + osfp_fingerprinting((unsigned char*)iph, (unsigned char*)tcph, tcph_len, &fp, 4); + } else if (ip6h) { + osfp_fingerprinting((unsigned char*)iph, (unsigned char*)tcph, tcph_len, &fp, 6); + } else { + goto exit; + } osfp_profile_get_cycle(c1); if (iph) { result = osfp_ipv4_identify(osfp_db, iph, tcph, tcph_len); - osfp_fingerprinting(iph, tcph, tcph_len, &fp, 4); } else if (ip6h) { result = osfp_ipv6_identify(osfp_db, ip6h, tcph, tcph_len); - osfp_fingerprinting(iph, tcph, tcph_len, &fp, 6); } else { goto exit; } @@ -475,15 +480,20 @@ void example_detect(struct osfp_db *osfp_db, Packet *p) char *json = osfp_result_score_detail_export(result); - osfp_fingerprint_to_json_buf(&fp, str_buf, 2048, 0); - printf("%s\n", str_buf); - - if (1) { + if (debug_enable) { + if (p->tcph->ack) { + printf("--------------------------- SYN/ACK\n"); + } else { + printf("--------------------------- SYN\n"); + } + osfp_fingerprint_to_json_buf(&fp, str_buf, 2048, 0); + printf("%s\n", str_buf); printf("Example ipv4 header detect: --------------------------\n"); printf("Connection info: %s:%d -> %s:%d\n", p->srcip, p->sp, p->dstip, p->dp); printf("Most likely os class: %s\n", osfp_result_os_name_get(result)); printf("Details:\n"); printf("%s\n", json); + fflush(stdout); } exit: @@ -510,11 +520,6 @@ void process_packet(char *user, struct pcap_pkthdr *h, u_char *pkt) goto exit; } - if (p->tcph->ack) { - printf("--------------------------- SYN/ACK\n"); - } else { - printf("--------------------------- SYN\n"); - } if (p->iph) { PrintInet(AF_INET, (const void *)&(p->src.addr_data32[0]), p->srcip, sizeof(p->srcip)); @@ -555,6 +560,8 @@ static void signal_handler(int signum) printf("%s: %u\n", osfp_os_class_id_to_name(i), result_os_count[i]); } + fflush(stdout); + exit(0); } diff --git a/test/test.c b/test/test.c index bdce05b..3cb0206 100644 --- a/test/test.c +++ b/test/test.c @@ -181,6 +181,8 @@ void test_miss_rate() unsigned int other_count = 0; unsigned int unknown_count = 0; unsigned int identify_failed_count = 0; + unsigned int prefiltered_count = 0; + unsigned int prefiltered_wrong_count = 0; unsigned int wrong_count = 0; unsigned int verified_count = 0; unsigned int fingerprint_count = 0; @@ -221,6 +223,12 @@ void test_miss_rate() const char *fp_str = cJSON_PrintUnformatted(entry); + struct osfp_fingerprint fp = {0}; + osfp_fingerprint_from_json(&fp, (char*)fp_str); + char str_buf[2048] = ""; + osfp_fingerprint_to_json_buf(&fp, str_buf, 2048, 0); + fprintf(log_file_ptr, "%s\n", str_buf); + struct osfp_result *result = osfp_json_identify(osfp_db, fp_str); if (result == NULL) { identify_failed_count++; @@ -229,12 +237,19 @@ void test_miss_rate() testresult[result->likely_os_class][os_class]++; + if (result->details[result->likely_os_class].score == 100) { + prefiltered_count++; + } + if (os_class == result->likely_os_class) { verified_count++; osfp_result_free(result); continue; } + if (result->details[result->likely_os_class].score == 100) { + prefiltered_wrong_count++; + } wrong_count++; if (result->likely_os_class == OSFP_OS_CLASS_OTHERS) { @@ -245,7 +260,7 @@ void test_miss_rate() unknown_count++; } - fprintf(log_file_ptr, "expect: %s, result: %s\n", os_class_json->valuestring, osfp_result_os_name_get(result)); + fprintf(log_file_ptr, "expect: %s, result: %s, \n", os_class_json->valuestring, osfp_result_os_name_get(result)); char *result_json = osfp_result_score_detail_export(result); if (result_json) { @@ -258,8 +273,8 @@ void test_miss_rate() } } - printf("total %u, failed %u, pass %u, wrong %u, other %u, unknown %u\n", - fingerprint_count, identify_failed_count, verified_count, wrong_count, other_count, unknown_count); + printf("total %u, failed %u, pass %u, prefiltered %u (wrong: %u), wrong %u, other %u, unknown %u\n", + fingerprint_count, identify_failed_count, verified_count, prefiltered_count, prefiltered_wrong_count, wrong_count, other_count, unknown_count); //printf("miss rate: %d%%\n", 100 - (verified_count * 100 / fingerprint_count));