10 Commits
main ... v1.3.1

Author SHA1 Message Date
zhuzhenjun
1de666a56e test: print confusion matrix 2023-10-17 23:37:20 +08:00
zhuzhenjun
168f931da6 fingerprint/score: bring back tcp_options_ordered 2023-10-17 23:36:10 +08:00
zhuzhenjun
e62ff39d81 api: MESA_osfp_xx -> osfp_xx
header: MESA_osfp.h -> osfp.h
2023-10-13 14:08:55 +08:00
zhuzhenjun
cfaf003d4f package: rpm name MESA_osfp -> libosfp
library: libMESA_osfp -> libosfp
2023-10-13 10:24:25 +08:00
zhuzhenjun
8b8627b0d8 symbol: set public symbols prefix 2023-10-12 15:36:31 +08:00
zhuzhenjun
7e1849233b compile: migrate to cmake
ci: migrate to MESA ci template
2023-10-12 14:48:10 +08:00
zhuzhenjun
b7ee724244 profile: init profile stats 2023-10-11 15:08:32 +08:00
zhuzhenjun
9056ffb00f ci: init gitlab ci 2023-10-10 19:04:34 +08:00
zhuzhenjun
f6af0204eb src: linux/*.h -> netinet/*.h 2023-10-10 17:14:34 +08:00
zhuzhenjun
f203d15fae example: fix sample.c 2023-10-10 10:55:49 +08:00
36 changed files with 2551 additions and 67963 deletions

4
.gitignore vendored
View File

@@ -21,3 +21,7 @@ missing
compile compile
libosfp-config libosfp-config
osfp_match osfp_match
osfp_example
osfp_test
sample
osfp_test.log

257
.gitlab-ci.yml Normal file
View File

@@ -0,0 +1,257 @@
variables:
GIT_STRATEGY: "clone"
BUILD_IMAGE_CENTOS7: "git.mesalab.cn:7443/mesa_platform/build-env:master"
BUILD_IMAGE_CENTOS8: "git.mesalab.cn:7443/mesa_platform/build-env:rockylinux"
BUILD_PADDING_PREFIX: /tmp/padding_for_CPACK_RPM_BUILD_SOURCE_DIRS_PREFIX_PREFIX_PREFIX_PREFIX_PREFIX_PREFIX/
INSTALL_DEPENDENCY_LIBRARY: libasan libpcap-devel
stages:
- build
- test
.build_before_script:
before_script:
- mkdir -p $BUILD_PADDING_PREFIX/$CI_PROJECT_NAMESPACE/
- ln -s $CI_PROJECT_DIR $BUILD_PADDING_PREFIX/$CI_PROJECT_PATH
- cd $BUILD_PADDING_PREFIX/$CI_PROJECT_PATH
- chmod +x ./ci/travis.sh
- yum makecache
- yum install -y elfutils-libelf-devel
.build_by_travis_for_centos7:
stage: build
image: $BUILD_IMAGE_CENTOS7
extends: .build_before_script
script:
- yum install -y libmnl-devel
- yum install -y libnfnetlink-devel
- ./ci/travis.sh
- cd build
tags:
- share
.build_by_travis_for_centos8:
stage: build
image: $BUILD_IMAGE_CENTOS8
extends: .build_before_script
script:
- dnf --enablerepo=powertools install -y libmnl-devel
- dnf --enablerepo=powertools install -y libnfnetlink-devel
- ./ci/travis.sh
tags:
- share
run_test_for_centos7:
stage: test
image: $BUILD_IMAGE_CENTOS7
extends: .build_by_travis_for_centos7
script:
- yum makecache
- ./ci/travis.sh
- cd build
- ctest --verbose
run_test_for_centos8:
stage: test
image: $BUILD_IMAGE_CENTOS8
extends: .build_by_travis_for_centos8
script:
- yum makecache
- ./ci/travis.sh
- cd build
- ctest --verbose
branch_build_debug_for_centos7:
stage: build
extends: .build_by_travis_for_centos7
variables:
BUILD_TYPE: Debug
except:
- /^develop.*$/i
- /^master.*$/i
- /^dev*.*$/i
- /^rel*.*$/i
- tags
branch_build_release_for_centos7:
stage: build
variables:
BUILD_TYPE: RelWithDebInfo
extends: .build_by_travis_for_centos7
except:
- /^develop.*$/i
- /^master.*$/i
- /^dev*.*$/i
- /^rel*.*$/i
- tags
develop_build_debug_for_centos7:
stage: build
extends: .build_by_travis_for_centos7
variables:
BUILD_TYPE: Debug
PACKAGE: 1
UPLOAD_RPM: 1
ASAN_OPTION: ADDRESS
TESTING_VERSION_BUILD: 1
PULP3_REPO_NAME: framework-testing-x86_64.el7
PULP3_DIST_NAME: framework-testing-x86_64.el7
artifacts:
name: "libosfp-$CI_COMMIT_REF_NAME-debug"
paths:
- build/*.rpm
only:
- /^develop.*$/i
- /^master.*$/i
- /^dev*.*$/i
- /^rel*.*$/i
develop_build_release_for_centos7:
stage: build
extends: .build_by_travis_for_centos7
variables:
BUILD_TYPE: RelWithDebInfo
PACKAGE: 1
UPLOAD_RPM: 1
TESTING_VERSION_BUILD: 1
PULP3_REPO_NAME: framework-testing-x86_64.el7
PULP3_DIST_NAME: framework-testing-x86_64.el7
artifacts:
name: "libosfp-$CI_COMMIT_REF_NAME-release"
paths:
- build/*.rpm
only:
- /^develop.*$/i
- /^master.*$/i
- /^dev*.*$/i
- /^rel*.*$/i
release_build_debug_for_centos7:
stage: build
variables:
BUILD_TYPE: Debug
PACKAGE: 1
UPLOAD_RPM: 1
PULP3_REPO_NAME: framework-stable-x86_64.el7
PULP3_DIST_NAME: framework-stable-x86_64.el7
extends: .build_by_travis_for_centos7
artifacts:
name: "libosfp-$CI_COMMIT_REF_NAME-debug"
paths:
- build/*.rpm
only:
- tags
release_build_release_for_centos7:
stage: build
variables:
BUILD_TYPE: RelWithDebInfo
PACKAGE: 1
UPLOAD_RPM: 1
PULP3_REPO_NAME: framework-stable-x86_64.el7
PULP3_DIST_NAME: framework-stable-x86_64.el7
extends: .build_by_travis_for_centos7
artifacts:
name: "libosfp-$CI_COMMIT_REF_NAME-release"
paths:
- build/*.rpm
only:
- tags
branch_build_debug_for_centos8:
stage: build
extends: .build_by_travis_for_centos8
variables:
BUILD_TYPE: Debug
except:
- /^develop.*$/i
- /^master.*$/i
- /^dev*.*$/i
- /^rel*.*$/i
- tags
branch_build_release_for_centos8:
stage: build
variables:
BUILD_TYPE: RelWithDebInfo
extends: .build_by_travis_for_centos8
except:
- /^develop.*$/i
- /^master.*$/i
- /^dev*.*$/i
- /^rel*.*$/i
- tags
develop_build_debug_for_centos8:
stage: build
extends: .build_by_travis_for_centos8
variables:
BUILD_TYPE: Debug
PACKAGE: 1
UPLOAD_RPM: 1
ASAN_OPTION: ADDRESS
TESTING_VERSION_BUILD: 1
PULP3_REPO_NAME: framework-testing-x86_64.el8
PULP3_DIST_NAME: framework-testing-x86_64.el8
artifacts:
name: "libosfp-$CI_COMMIT_REF_NAME-debug"
paths:
- build/*.rpm
only:
- /^develop.*$/i
- /^master.*$/i
- /^dev*.*$/i
- /^rel*.*$/i
develop_build_release_for_centos8:
stage: build
extends: .build_by_travis_for_centos8
variables:
BUILD_TYPE: RelWithDebInfo
PACKAGE: 1
UPLOAD_RPM: 1
TESTING_VERSION_BUILD: 1
PULP3_REPO_NAME: framework-testing-x86_64.el8
PULP3_DIST_NAME: framework-testing-x86_64.el8
artifacts:
name: "libosfp-$CI_COMMIT_REF_NAME-release"
paths:
- build/*.rpm
only:
- /^develop.*$/i
- /^master.*$/i
- /^dev*.*$/i
- /^rel*.*$/i
release_build_debug_for_centos8:
stage: build
variables:
BUILD_TYPE: Debug
PACKAGE: 1
UPLOAD_RPM: 1
PULP3_REPO_NAME: framework-stable-x86_64.el8
PULP3_DIST_NAME: framework-stable-x86_64.el8
extends: .build_by_travis_for_centos8
artifacts:
name: "libosfp-$CI_COMMIT_REF_NAME-debug"
paths:
- build/*.rpm
only:
- tags
release_build_release_for_centos8:
stage: build
variables:
BUILD_TYPE: RelWithDebInfo
PACKAGE: 1
UPLOAD_RPM: 1
PULP3_REPO_NAME: framework-stable-x86_64.el8
PULP3_DIST_NAME: framework-stable-x86_64.el8
extends: .build_by_travis_for_centos8
artifacts:
name: "libosfp-$CI_COMMIT_REF_NAME-release"
paths:
- build/*.rpm
only:
- tags

79
CMakeLists.txt Normal file
View File

@@ -0,0 +1,79 @@
cmake_minimum_required (VERSION 2.8)
set(lib_name osfp)
project (${lib_name})
set(LIB_MAJOR_VERSION 1)
set(LIB_MINOR_VERSION 3)
set(CMAKE_MODULE_PATH ${PROJECT_SOURCE_DIR}/cmake)
include(Version)
set(CMAKE_MACOSX_RPATH 0)
set(CMAKE_CXX_FLAGS ${CMAKE_CXX_FLAGS} -Wall)
set(CMAKE_INSTALL_PREFIX /opt/MESA)
#for ASAN
option(ENABLE_SANITIZE_ADDRESS "Enable AddressSanitizer" FALSE)
option(ENABLE_SANITIZE_THREAD "Enable ThreadSanitizer" FALSE)
if(ENABLE_SANITIZE_ADDRESS)
set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -fsanitize=address -fno-omit-frame-pointer")
set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -fsanitize=address -fno-omit-frame-pointer")
set(CMAKE_EXE_LINKER_FLAGS "${CMAKE_EXE_LINKER_FLAGS} -lasan")
set(CMAKE_SHARED_LINKER_FLAGS "${CMAKE_EXE_LINKER_FLAGS} -lasan")
elseif(ENABLE_SANITIZE_THREAD)
set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -fsanitize=thread -fno-omit-frame-pointer")
set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -fsanitize=thread -fno-omit-frame-pointer")
set(CMAKE_EXE_LINKER_FLAGS "${CMAKE_EXE_LINKER_FLAGS} -lasan")
set(CMAKE_SHARED_LINKER_FLAGS "${CMAKE_EXE_LINKER_FLAGS} -lasan")
endif()
# end of for ASAN
include_directories(${PROJECT_SOURCE_DIR}/src/)
aux_source_directory(${PROJECT_SOURCE_DIR}/src SRCLIST)
# Shared Library Output
add_library(${lib_name}_shared SHARED ${SRCLIST})
set_target_properties(${lib_name}_shared PROPERTIES LINK_FLAGS
"-Wl,--version-script=${PROJECT_SOURCE_DIR}/src/version.map")
if(DEFINED MESA_SHARED_INSTALL_DIR)
set_target_properties(${lib_name}_shared PROPERTIES OUTPUT_NAME ${lib_name} LIBRARY_OUTPUT_DIRECTORY ${MESA_SHARED_INSTALL_DIR})
else()
set_target_properties(${lib_name}_shared PROPERTIES OUTPUT_NAME ${lib_name})
endif()
set_target_properties(${lib_name}_shared PROPERTIES VERSION ${LIB_MAJOR_VERSION}.${LIB_MINOR_VERSION})
set_target_properties(${lib_name}_shared PROPERTIES SOVERSION ${LIB_MAJOR_VERSION})
# static Library Output
add_library(${lib_name}_static STATIC ${SRCLIST})
set_target_properties(${lib_name}_static PROPERTIES OUTPUT_NAME ${lib_name})
set(CMAKE_INSTALL_PREFIX /opt/MESA)
install(FILES src/osfp.h DESTINATION
${CMAKE_INSTALL_PREFIX}/include/MESA COMPONENT devel)
install(TARGETS ${lib_name}_shared LIBRARY DESTINATION ${CMAKE_INSTALL_PREFIX}/lib COMPONENT LIBRARIES)
install(FILES src/osfp.h DESTINATION ${CMAKE_INSTALL_PREFIX}/include/MESA COMPONENT HEADER)
install(FILES fp.json DESTINATION /var/lib/libosfp COMPONENT PROFILE)
add_executable(${lib_name}_sample example/sample.c)
target_link_libraries(${lib_name}_sample ${lib_name}_shared)
add_executable(${lib_name}_example example/osfp_example.c)
target_link_libraries(${lib_name}_example ${lib_name}_static)
target_link_libraries(${lib_name}_example pcap)
add_executable(${lib_name}_test test/test.c)
target_link_libraries(${lib_name}_test ${lib_name}_static)
enable_testing()
add_test(NAME sample COMMAND ${lib_name}_sample)
add_test(NAME test COMMAND ${lib_name}_test -f ../fp.json -t ../data.json)
include(Package)

View File

@@ -1,22 +0,0 @@
cmake_minimum_required(VERSION 2.8)
project(libosfp)
# 添加其他CMake配置
# 生成RPM包
set(CPACK_GENERATOR "RPM")
set(CPACK_PACKAGE_NAME "libosfp")
set(CPACK_PACKAGE_VENDOR "Geedge")
set(CPACK_PACKAGE_DESCRIPTION_SUMMARY "Libosfp is a C library for OS fingerprinting.")
set(CPACK_PACKAGE_VERSION "1.0.0")
set(CPACK_PACKAGE_RELEASE 1)
set(CPACK_PACKAGE_CONTACT "zhuzhenjun@geedgenetworks.com")
set(CPACK_RPM_PACKAGE_AUTOREQPROV "no")
install(DIRECTORY @prefix@/include DESTINATION . USE_SOURCE_PERMISSIONS)
install(DIRECTORY @prefix@/lib/ DESTINATION ./lib64 USE_SOURCE_PERMISSIONS FILES_MATCHING PATTERN "libosfp*")
install(DIRECTORY @prefix@/bin DESTINATION . USE_SOURCE_PERMISSIONS FILES_MATCHING PATTERN "osfp*")
install(FILES fp.json DESTINATION /var/lib/libosfp)
include(CPack)

View File

@@ -7,20 +7,19 @@ Libosfp is a C library for OS fingerprinting.
``` ```
# osfp_example depends on libpcap # osfp_example depends on libpcap
yum install -y libpcap-devel yum install -y libpcap-devel
# build and install BUILD_TYPE=Debug PACKAGE=1 ./ci/travis.sh
./build.sh yum install -y ./build/*.rpm
./package.sh
yum install package/*.rpm
``` ```
## library usage ## library usage
``` ```
gcc example/sample.c -o sample -losfp; cat example/sample.c gcc -I./src example/sample.c -o sample -L./build -losfp; cat example/sample.c
LD_LIBRARY_PATH=${PWD}/build ./sample
``` ```
## run example ## run example
``` ```
# load the fingerprint file and capture on eth0, filter tcp port 8888 # load the fingerprint file and capture on eth0, filter tcp port 8888
osfp_example -f /var/lib/libosfp/fp.json -i eth0 "tcp port 8888" ./build/osfp_example -f /var/lib/libosfp/fp.json -i eth0 "tcp port 8888"
``` ```

View File

@@ -1,14 +0,0 @@
#!/bin/sh
# Run this to generate all the initial makefiles, etc.
if which libtoolize > /dev/null; then
echo "Found libtoolize"
libtoolize -c
elif which glibtoolize > /dev/null; then
echo "Found glibtoolize"
glibtoolize -c
else
echo "Failed to find libtoolize or glibtoolize, please ensure it is installed and accessible via your PATH env variable"
exit 1
fi;
autoreconf -ifv || exit 1
echo "You can now run \"./configure\" and then \"make\"."

32
autorelease.sh Normal file
View File

@@ -0,0 +1,32 @@
#!/bin/sh
if [ $# -lt 6 ] ; then
echo "USAGE: ./autorelease.sh [API_V4_URL] [PROJECT_URL]
[PROJECT_ID] [TOKEN]
[COMMIT_TAG] [JOB] [PROJECT_NAME]"
exit 1;
fi
CI_API_V4_URL=$1
CI_PROJECT_URL=$2
CI_PROJECT_ID=$3
CI_TOKEN=$4
CI_COMMIT_TAG=$5
ARTIFACTS_JOB=$6
CI_PROJECT_NAME=$7
res=`echo -e "curl --header \"PRIVATE-TOKEN: $CI_TOKEN\" $CI_API_V4_URL/projects/$CI_PROJECT_ID/releases/$CI_COMMIT_TAG -o /dev/null -s -w %{http_code}"| /bin/bash`
if [[ $res == "200" ]]; then
eval $(echo -e "curl --request POST --header \"PRIVATE-TOKEN: $CI_TOKEN\" \
--data name=\"$CI_PROJECT_NAME-$CI_COMMIT_TAG-artifacts.zip\" \
--data url=\"$CI_PROJECT_URL/-/jobs/artifacts/$CI_COMMIT_TAG/download?job=$ARTIFACTS_JOB\"\
$CI_API_V4_URL/projects/$CI_PROJECT_ID/releases/$CI_COMMIT_TAG/assets/links")
else
eval $(echo -e "curl --header 'Content-Type: application/json' --header \
\"PRIVATE-TOKEN: $CI_TOKEN\" --data '{ \"name\": \"$CI_COMMIT_TAG\", \
\"tag_name\": \"$CI_COMMIT_TAG\", \"description\": \"auto_release\",\
\"assets\": { \"links\": [{ \"name\": \
\"$CI_PROJECT_NAME-$CI_COMMIT_TAG-artifacts.zip\", \"url\": \
\"$CI_PROJECT_URL/-/jobs/artifacts/$CI_COMMIT_TAG/download?job=$ARTIFACTS_JOB\"\
}] } }' --request POST $CI_API_V4_URL/projects/$CI_PROJECT_ID/releases/")
fi

1268
autorevision.sh Normal file

File diff suppressed because it is too large Load Diff

View File

@@ -1,6 +0,0 @@
#!/bin/bash
./autogen.sh;
./configure --prefix=$(pwd)/target;
make -j
make install

48
ci/get-nprocessors.sh Executable file
View File

@@ -0,0 +1,48 @@
#!/usr/bin/env bash
# Copyright 2017 Google Inc.
# All Rights Reserved.
#
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions are
# met:
#
# * Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# * Redistributions in binary form must reproduce the above
# copyright notice, this list of conditions and the following disclaimer
# in the documentation and/or other materials provided with the
# distribution.
# * Neither the name of Google Inc. nor the names of its
# contributors may be used to endorse or promote products derived from
# this software without specific prior written permission.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
# This file is typically sourced by another script.
# if possible, ask for the precise number of processors,
# otherwise take 2 processors as reasonable default; see
# https://docs.travis-ci.com/user/speeding-up-the-build/#Makefile-optimization
if [ -x /usr/bin/getconf ]; then
NPROCESSORS=$(/usr/bin/getconf _NPROCESSORS_ONLN)
else
NPROCESSORS=2
fi
# as of 2017-09-04 Travis CI reports 32 processors, but GCC build
# crashes if parallelized too much (maybe memory consumption problem),
# so limit to 4 processors for the time being.
if [ $NPROCESSORS -gt 4 ] ; then
echo "$0:Note: Limiting processors to use by make from $NPROCESSORS to 4."
NPROCESSORS=4
fi

3
ci/perpare_pulp3_netrc.sh Executable file
View File

@@ -0,0 +1,3 @@
#!/usr/bin/env sh
set -evx
echo "machine ${PULP3_SERVER_URL}\nlogin ${PULP3_SERVER_LOGIN}\npassword ${PULP3_SERVER_PASSWORD}\n" > ~/.netrc

71
ci/travis.sh Executable file
View File

@@ -0,0 +1,71 @@
#!/usr/bin/env sh
set -evx
chmod +x ci/get-nprocessors.sh
. ci/get-nprocessors.sh
# if possible, ask for the precise number of processors,
# otherwise take 2 processors as reasonable default; see
# https://docs.travis-ci.com/user/speeding-up-the-build/#Makefile-optimization
if [ -x /usr/bin/getconf ]; then
NPROCESSORS=$(/usr/bin/getconf _NPROCESSORS_ONLN)
else
NPROCESSORS=2
fi
# as of 2017-09-04 Travis CI reports 32 processors, but GCC build
# crashes if parallelized too much (maybe memory consumption problem),
# so limit to 4 processors for the time being.
if [ $NPROCESSORS -gt 4 ] ; then
echo "$0:Note: Limiting processors to use by make from $NPROCESSORS to 4."
NPROCESSORS=4
fi
# Tell make to use the processors. No preceding '-' required.
MAKEFLAGS="j${NPROCESSORS}"
export MAKEFLAGS
env | sort
# Set default values to OFF for these variables if not specified.
: "${NO_EXCEPTION:=OFF}"
: "${NO_RTTI:=OFF}"
: "${COMPILER_IS_GNUCXX:=OFF}"
# Install dependency from YUM
if [ -n "${INSTALL_DEPENDENCY_LIBRARY}" ]; then
yum install -y $INSTALL_DEPENDENCY_LIBRARY
fi
if [ $ASAN_OPTION ] && [ -f "/opt/rh/devtoolset-7/enable" ] ;then
source /opt/rh/devtoolset-7/enable
fi
mkdir build || true
cd build
cmake3 -DCMAKE_CXX_FLAGS=$CXX_FLAGS \
-DCMAKE_BUILD_TYPE=$BUILD_TYPE \
-DCMAKE_INSTALL_PREFIX=$INSTALL_PREFIX \
-DENABLE_DEVEL=$ENABLE_DEVEL_SWITCH \
-DASAN_OPTION=$ASAN_OPTION \
-DVERSION_DAILY_BUILD=$TESTING_VERSION_BUILD \
..
make
if [ -n "${PACKAGE}" ]; then
make package
fi
if [ -n "${UPLOAD_RPM}" ]; then
cp ~/rpm_upload_tools.py ./
python3 rpm_upload_tools.py ${PULP3_REPO_NAME} ${PULP3_DIST_NAME} *.rpm
fi
if [ -n "${UPLOAD_SYMBOL_FILES}" ]; then
rpm -i $SYMBOL_TARGET*debuginfo*.rpm
_symbol_file=`find /usr/lib/debug/ -name "$SYMBOL_TARGET*.so*.debug"`
cp $_symbol_file ${_symbol_file}info.${CI_COMMIT_SHORT_SHA}
sentry-cli upload-dif -t elf ${_symbol_file}info.${CI_COMMIT_SHORT_SHA}
fi

57
cmake/Package.cmake Normal file
View File

@@ -0,0 +1,57 @@
if(CMAKE_BUILD_TYPE STREQUAL "Debug")
set(MY_RPM_NAME_PREFIX "lib${lib_name}-debug")
else()
set(MY_RPM_NAME_PREFIX "lib${lib_name}")
endif()
message(STATUS "Package: ${MY_RPM_NAME_PREFIX}")
set(CPACK_PACKAGE_VECDOR "MESA")
set(CPACK_PACKAGE_VERSION_MAJOR "${VERSION_MAJOR}")
set(CPACK_PACKAGE_VERSION_MINOR "${VERSION_MINOR}")
set(CPACK_PACKAGE_VERSION_PATCH "${VERSION_PATCH}.${VERSION_BUILD}")
set(CPACK_PACKAGING_INSTALL_PREFIX ${CMAKE_INSTALL_PREFIX})
set(CPACK_PACKAGE_VERSION "${VERSION_MAJOR}.${VERSION_MINOR}.${VERSION_PATCH}.${VERSION_BUILD}")
execute_process(COMMAND sh changelog.sh ${CMAKE_BINARY_DIR} WORKING_DIRECTORY ${PROJECT_SOURCE_DIR}/cmake)
SET(CPACK_RPM_CHANGELOG_FILE ${CMAKE_BINARY_DIR}/changelog.txt)
# RPM Build
set(CPACK_GENERATOR "RPM")
set(CPACK_RPM_AUTO_GENERATED_FILE_NAME ON)
set(CPACK_RPM_FILE_NAME "RPM-DEFAULT")
set(CPACK_RPM_PACKAGE_VENDOR "MESA")
set(CPACK_RPM_PACKAGE_AUTOREQPROV "yes")
set(CPACK_RPM_PACKAGE_RELEASE_DIST "on")
set(CPACK_RPM_DEBUGINFO_PACKAGE "on")
set(CPACK_RPM_COMPONENT_INSTALL ON)
set(CPACK_COMPONENTS_IGNORE_GROUPS 1)
set(CPACK_COMPONENTS_GROUPING ONE_PER_GROUP)
set(CPACK_COMPONENT_HEADER_DISPLAY_NAME "develop")
set(CPACK_COMPONENT_LIBRARIES_REQUIRED TRUE)
set(CPACK_RPM_LIBRARIES_PACKAGE_NAME ${MY_RPM_NAME_PREFIX})
set(CPACK_COMPONENT_LIBRARIES_GROUP "LIBRARIES")
set(CPACK_COMPONENT_EXECUTABLE_GROUP "LIBRARIES")
set(CPACK_COMPONENT_PROFILE_GROUP "LIBRARIES")
set(CPACK_COMPONENT_HEADER_REQUIRED TRUE)
set(CPACK_RPM_HEADER_PACKAGE_NAME "${MY_RPM_NAME_PREFIX}-devel")
set(CPACK_COMPONENT_HEADER_GROUP "header")
set(CPACK_RPM_HEADER_PACKAGE_REQUIRES_PRE ${CPACK_RPM_LIBRARIES_PACKAGE_NAME})
set(CPACK_RPM_HEADER_PACKAGE_CONFLICTS ${CPACK_RPM_HEADER_PACKAGE_NAME})
set(CPACK_COMPONENTS_ALL LIBRARIES HEADER EXECUTABLE PROFILE)
set(CPACK_RPM_POST_INSTALL_SCRIPT_FILE ${CMAKE_SOURCE_DIR}/cmake/PostInstall.in)
set(CPACK_RPM_POST_UNINSTALL_SCRIPT_FILE ${CMAKE_SOURCE_DIR}/cmake/PostInstall.in)
set(CPACK_BUILD_SOURCE_DIRS "${CMAKE_SOURCE_DIR}")
# Must uninstall the debug package before install release package
set(CPACK_RPM_PACKAGE_CONFLICTS ${MY_RPM_NAME_PREFIX})
# set(CPACK_STRIP_FILES TRUE)
include(CPack)

49
cmake/Version.cmake Normal file
View File

@@ -0,0 +1,49 @@
# Using autorevision.sh to generate version information
set(__SOURCE_AUTORESIVISION ${CMAKE_SOURCE_DIR}/autorevision.sh)
set(__AUTORESIVISION ${CMAKE_BINARY_DIR}/autorevision.sh)
set(__VERSION_CACHE ${CMAKE_BINARY_DIR}/version.txt)
set(__VERSION_CONFIG ${CMAKE_BINARY_DIR}/version.cmake)
file(COPY ${__SOURCE_AUTORESIVISION} DESTINATION ${CMAKE_BINARY_DIR}
FILE_PERMISSIONS OWNER_READ OWNER_WRITE OWNER_EXECUTE GROUP_READ GROUP_EXECUTE
WORLD_READ WORLD_EXECUTE)
# execute autorevision.sh to generate version information
execute_process(COMMAND ${__AUTORESIVISION} -t cmake -o ${__VERSION_CACHE}
OUTPUT_FILE ${__VERSION_CONFIG} ERROR_QUIET)
include(${__VERSION_CONFIG})
# extract major, minor, patch version from git tag
string(REGEX REPLACE "^v([0-9]+)\\..*" "\\1" VERSION_MAJOR "${VCS_TAG}")
string(REGEX REPLACE "^v[0-9]+\\.([0-9]+).*" "\\1" VERSION_MINOR "${VCS_TAG}")
string(REGEX REPLACE "^v[0-9]+\\.[0-9]+\\.([0-9]+).*" "\\1" VERSION_PATCH "${VCS_TAG}")
if(NOT VERSION_MAJOR)
set(VERSION_MAJOR 1)
endif()
if(NOT VERSION_MINOR)
set(VERSION_MINOR 0)
endif()
if(NOT VERSION_PATCH)
set(VERSION_PATCH 0)
endif()
set(VERSION "${VERSION_MAJOR}_${VERSION_MINOR}_${VERSION_PATCH}")
set(VERSION_BUILD "${VCS_SHORT_HASH}")
# print information
message(STATUS "Version: ${VERSION}-${VERSION_BUILD}")
option(DEFINE_GIT_VERSION "Set DEFINE_GIT_VERSION to TRUE or FALSE" TRUE)
if(DEFINE_GIT_VERSION)
set(GIT_VERSION
"${VERSION}-${CMAKE_BUILD_TYPE}-${VERSION_BUILD}-${VCS_BRANCH}-${VCS_TAG}-${VCS_DATE}")
string(REGEX REPLACE "[-:+/\\.]" "_" GIT_VERSION ${GIT_VERSION})
add_definitions(-DGIT_VERSION=${GIT_VERSION})
endif()

4
cmake/changelog.sh Normal file
View File

@@ -0,0 +1,4 @@
#!/bin/sh
work_path=$1
branch=`git status | grep branch | awk '{print $NF}'`
git log --branches=$branch --no-merges --date=local --show-signature --pretty="* %ad %an %ae %nhash: %H%ncommit:%n%B" | awk -F"-" '{print "- "$0}' | sed 's/- \*/\*/g' | sed 's/- $//g' | sed 's/-/ -/g' | sed 's/[0-9]\{2\}:[0-9]\{2\}:[0-9]\{2\}//g' > $work_path/changelog.txt

View File

@@ -1,26 +0,0 @@
AC_INIT([libosfp],[1.0.0],[zhuzhenjun@geedgenetworks.com])
AM_INIT_AUTOMAKE([foreign])
#m4_ifndef([AM_SILENT_RULES], [m4_define([AM_SILENT_RULES],[])])AM_SILENT_RULES([yes])
AC_CONFIG_MACRO_DIR([m4])
AC_ARG_ENABLE([debug], [AS_HELP_STRING([--enable-debug], [enable debug info])], [enable_debug=$enableval], [enable_debug=no])
AS_IF([test "x$enable_debug" = xyes],
[CFLAGS="-DDEBUGLOG -ggdb3 -O0 -fsanitize=address -fno-omit-frame-pointer"],
[CFLAGS="-g -O2"])
AC_ARG_ENABLE([test], [AS_HELP_STRING([--enable-test], [enable test])], [enable_test=$enableval], [enable_test=yes])
AS_IF([test "x$enable_test" = xyes],
[CFLAGS="${CFLAGS} -DUNITTEST"])
AC_PROG_CC
AC_PROG_CPP
AC_PROG_INSTALL
AC_PROG_LN_S
AC_PROG_MAKE_SET
AC_PROG_LIBTOOL
AC_CONFIG_FILES([CMakeLists.txt libosfp-config Makefile src/Makefile example/Makefile test/Makefile])
AC_OUTPUT

View File

@@ -1,14 +0,0 @@
bin_PROGRAMS = osfp_example
osfp_example_SOURCES = \
osfp_example.c
osfp_example_LDADD = \
../src/.libs/libosfp.la
osfp_example_LDFLAGS = \
-lpcap
osfp_example_CFLAGS = \
-I../src

View File

@@ -3,12 +3,7 @@
#include <string.h> #include <string.h>
#include <unistd.h> #include <unistd.h>
#include <time.h> #include <time.h>
#include <signal.h>
#include <linux/in.h>
#include <linux/if_ether.h>
#include <linux/ip.h>
#include <linux/ipv6.h>
#include <linux/tcp.h>
#include <sys/socket.h> #include <sys/socket.h>
@@ -52,14 +47,6 @@ typedef struct Address_ {
#define addr_data8 address.address_un_data8 #define addr_data8 address.address_un_data8
#define addr_in6addr address.address_un_in6 #define addr_in6addr address.address_un_in6
#define COPY_ADDRESS(a, b) do { \
(b)->family = (a)->family; \
(b)->addr_data32[0] = (a)->addr_data32[0]; \
(b)->addr_data32[1] = (a)->addr_data32[1]; \
(b)->addr_data32[2] = (a)->addr_data32[2]; \
(b)->addr_data32[3] = (a)->addr_data32[3]; \
} while (0)
/* Set the IPv4 addresses into the Addrs of the Packet. /* Set the IPv4 addresses into the Addrs of the Packet.
* Make sure p->ip4h is initialized and validated. * Make sure p->ip4h is initialized and validated.
* *
@@ -85,18 +72,18 @@ typedef struct Address_ {
* Make sure p->ip6h is initialized and validated. */ * Make sure p->ip6h is initialized and validated. */
#define SET_IPV6_SRC_ADDR(p, a) do { \ #define SET_IPV6_SRC_ADDR(p, a) do { \
(a)->family = AF_INET6; \ (a)->family = AF_INET6; \
(a)->addr_data32[0] = (p)->ip6h->saddr.s6_addr32[0]; \ (a)->addr_data32[0] = (p)->ip6h->ip6_src.__in6_u.__u6_addr32[0]; \
(a)->addr_data32[1] = (p)->ip6h->saddr.s6_addr32[1]; \ (a)->addr_data32[1] = (p)->ip6h->ip6_src.__in6_u.__u6_addr32[1]; \
(a)->addr_data32[2] = (p)->ip6h->saddr.s6_addr32[2]; \ (a)->addr_data32[2] = (p)->ip6h->ip6_src.__in6_u.__u6_addr32[2]; \
(a)->addr_data32[3] = (p)->ip6h->saddr.s6_addr32[3]; \ (a)->addr_data32[3] = (p)->ip6h->ip6_src.__in6_u.__u6_addr32[3]; \
} while (0) } while (0)
#define SET_IPV6_DST_ADDR(p, a) do { \ #define SET_IPV6_DST_ADDR(p, a) do { \
(a)->family = AF_INET6; \ (a)->family = AF_INET6; \
(a)->addr_data32[0] = (p)->ip6h->daddr.s6_addr32[0]; \ (a)->addr_data32[0] = (p)->ip6h->ip6_dst.__in6_u.__u6_addr32[0]; \
(a)->addr_data32[1] = (p)->ip6h->daddr.s6_addr32[1]; \ (a)->addr_data32[1] = (p)->ip6h->ip6_dst.__in6_u.__u6_addr32[1]; \
(a)->addr_data32[2] = (p)->ip6h->daddr.s6_addr32[2]; \ (a)->addr_data32[2] = (p)->ip6h->ip6_dst.__in6_u.__u6_addr32[2]; \
(a)->addr_data32[3] = (p)->ip6h->daddr.s6_addr32[3]; \ (a)->addr_data32[3] = (p)->ip6h->ip6_dst.__in6_u.__u6_addr32[3]; \
} while (0) } while (0)
#define TCP_GET_RAW_SRC_PORT(tcph) ntohs((tcph)->source) #define TCP_GET_RAW_SRC_PORT(tcph) ntohs((tcph)->source)
@@ -131,7 +118,7 @@ typedef struct Address_ {
typedef struct Packet_ { typedef struct Packet_ {
struct ethhdr *ethh; struct ethhdr *ethh;
struct iphdr *iph; struct iphdr *iph;
struct ipv6hdr *ip6h; struct ip6_hdr *ip6h;
struct tcphdr *tcph; struct tcphdr *tcph;
char srcip[46]; char srcip[46];
@@ -159,6 +146,11 @@ typedef struct Packet_ {
int vlan_layer; int vlan_layer;
} Packet; } Packet;
typedef struct EthernetHdr_ {
uint8_t eth_dst[6];
uint8_t eth_src[6];
uint16_t eth_type;
} __attribute__((__packed__)) EthernetHdr;
unsigned char *fp_file_path; unsigned char *fp_file_path;
unsigned char *fp_output_file_path; unsigned char *fp_output_file_path;
@@ -173,6 +165,12 @@ pcap_t *pcap_handle;
int processed_packet; int processed_packet;
int link_type; int link_type;
struct osfp_profile_counter identify_profile;
unsigned int identify_failed_count = 0;
unsigned int identify_count = 0;
unsigned int result_os_count[OSFP_OS_CLASS_MAX];
void usage(void) { void usage(void) {
fprintf(stderr, fprintf(stderr,
"Usage: osfp_match [ ...options... ] [ 'filter rule' ]\n" "Usage: osfp_match [ ...options... ] [ 'filter rule' ]\n"
@@ -186,13 +184,6 @@ void usage(void) {
exit(1); exit(1);
} }
typedef struct EthernetHdr_ {
uint8_t eth_dst[6];
uint8_t eth_src[6];
uint16_t eth_type;
} __attribute__((__packed__)) EthernetHdr;
int packet_decode_tcp(Packet *p, const unsigned char *data, unsigned int len) int packet_decode_tcp(Packet *p, const unsigned char *data, unsigned int len)
{ {
int ret = -1; int ret = -1;
@@ -268,15 +259,15 @@ int packet_decode_ipv6(Packet *p, const unsigned char *data, unsigned int len)
int ret = -1; int ret = -1;
unsigned short ip6_payload_len; unsigned short ip6_payload_len;
unsigned char ip6_nexthdr; unsigned char ip6_nexthdr;
struct ipv6hdr *ip6h; struct ip6_hdr *ip6h;
if (len < IPV6_HEADER_LEN) { if (len < IPV6_HEADER_LEN) {
goto exit; goto exit;
} }
ip6h = (struct ipv6hdr *)data; ip6h = (struct ip6_hdr *)data;
ip6_payload_len = ntohs(ip6h->payload_len); ip6_payload_len = ntohs(ip6h->ip6_ctlun.ip6_un1.ip6_un1_plen);
ip6_nexthdr = ip6h->nexthdr; ip6_nexthdr = ip6h->ip6_ctlun.ip6_un1.ip6_un1_nxt;
if (len < IPV6_HEADER_LEN + ip6_payload_len) { if (len < IPV6_HEADER_LEN + ip6_payload_len) {
goto exit; goto exit;
@@ -443,18 +434,21 @@ void example_detect(struct osfp_db *osfp_db, Packet *p)
char str_buf[1024]; char str_buf[1024];
//unsigned char *iph = (unsigned char *)(p->iph != NULL ? (void *)p->iph : (void *)p->ip6h); //unsigned char *iph = (unsigned char *)(p->iph != NULL ? (void *)p->iph : (void *)p->ip6h);
struct iphdr *iph; struct iphdr *iph;
struct ipv6hdr *ip6h; struct ip6_hdr *ip6h;
struct tcphdr *tcph; struct tcphdr *tcph;
unsigned int tcph_len; unsigned int tcph_len;
struct osfp_result *result = NULL; struct osfp_result *result = NULL;
printf("Example ipv4 header detect: --------------------------\n");
iph = (struct iphdr *)p->iph; iph = (struct iphdr *)p->iph;
ip6h = (struct ipv6hdr *)p->ip6h; ip6h = (struct ip6_hdr *)p->ip6h;
tcph = (struct tcphdr *)p->tcph; tcph = (struct tcphdr *)p->tcph;
tcph_len = tcph->doff << 2; tcph_len = tcph->doff << 2;
osfp_profile_cycle(c1);
osfp_profile_cycle(c2);
osfp_profile_get_cycle(c1);
if (iph) { if (iph) {
result = osfp_ipv4_identify(osfp_db, iph, tcph, tcph_len); result = osfp_ipv4_identify(osfp_db, iph, tcph, tcph_len);
} else if (ip6h) { } else if (ip6h) {
@@ -462,17 +456,28 @@ void example_detect(struct osfp_db *osfp_db, Packet *p)
} else { } else {
goto exit; goto exit;
} }
osfp_profile_get_cycle(c2);
osfp_profile_counter_update(&identify_profile, c2 - c1);
identify_count++;
if (result == NULL) { if (result == NULL) {
identify_failed_count++;
printf("osfp header match failed, erro: %s\n", "?"); printf("osfp header match failed, erro: %s\n", "?");
goto exit; goto exit;
} }
printf("Connection info: %s:%d -> %s:%d\n", p->srcip, p->sp, p->dstip, p->dp); result_os_count[result->likely_os_class]++;
printf("Most likely os class: %s\n", osfp_result_os_name_get(result));
printf("Details:\n"); char *json = osfp_result_score_detail_export(result);
printf("%s\n", osfp_result_score_detail_export(result));
if (1) {
printf("Example ipv4 header detect: --------------------------\n");
printf("Connection info: %s:%d -> %s:%d\n", p->srcip, p->sp, p->dstip, p->dp);
printf("Most likely os class: %s\n", osfp_result_os_name_get(result));
printf("Details:\n");
printf("%s\n", json);
}
exit: exit:
if (result) { if (result) {
@@ -513,7 +518,10 @@ void process_packet(char *user, struct pcap_pkthdr *h, u_char *pkt)
} }
// tcp/ip header detect example for user // tcp/ip header detect example for user
example_detect(osfp_db, p); int i;
for (i = 0; i < 1; i++) {
example_detect(osfp_db, p);
}
printf("--------------------------- processed packet count %d\n", ++processed_packet); printf("--------------------------- processed packet count %d\n", ++processed_packet);
@@ -521,10 +529,35 @@ exit:
return; return;
} }
static void signal_handler(int signum)
{
printf("profile identify: avg: %lu max: %lu min: %lu curr: %lu total: %lu count: %lu\n",
identify_profile.total_cycle / identify_profile.count,
identify_profile.max_cycle,
identify_profile.min_cycle,
identify_profile.curr_cycle,
identify_profile.total_cycle,
identify_profile.count);
osfp_profile_print_stats();
printf("total %u, failed %u\n",
identify_count, identify_failed_count);
int i;
for (i = 0; i < OSFP_OS_CLASS_MAX; i++) {
printf("%s: %u\n", osfp_os_class_id_to_name(i), result_os_count[i]);
}
exit(0);
}
int main(int argc, char *argv[]) int main(int argc, char *argv[])
{ {
int r; int r;
signal(SIGINT, signal_handler);
signal(SIGTERM, signal_handler);
while ((r = getopt(argc, argv, "+f:i:r:o:d")) != -1) { while ((r = getopt(argc, argv, "+f:i:r:o:d")) != -1) {
switch(r) { switch(r) {
case 'f': case 'f':
@@ -635,14 +668,14 @@ int main(int argc, char *argv[])
osfp_log_level_set(OSFP_LOG_LEVEL_DEBUG); osfp_log_level_set(OSFP_LOG_LEVEL_DEBUG);
} }
osfp_profile_set(1);
struct osfp_db *osfp_db = osfp_db_new(fp_file_path); struct osfp_db *osfp_db = osfp_db_new(fp_file_path);
if (osfp_db == NULL) { if (osfp_db == NULL) {
printf("could not create osfp context. fingerprints file: %s\n", fp_file_path); printf("could not create osfp context. fingerprints file: %s\n", fp_file_path);
exit(1); exit(1);
} }
osfp_score_db_debug_print(osfp_db->score_db);
// loop // loop
while (1) { while (1) {
int r = pcap_dispatch(pcap_handle, 0, (pcap_handler)process_packet, (void*)osfp_db); int r = pcap_dispatch(pcap_handle, 0, (pcap_handler)process_packet, (void*)osfp_db);

View File

@@ -1,5 +1,5 @@
#include "stdio.h" #include "stdio.h"
#include "libosfp/osfp.h" #include "osfp.h"
char iph[] = { char iph[] = {
0x45, 0x00, 0x00, 0x34, 0x51, 0xc4, 0x40, 0x00, 0x45, 0x00, 0x00, 0x34, 0x51, 0xc4, 0x40, 0x00,
@@ -29,7 +29,7 @@ int main(int argc, char **argv)
printf("likely os: %s\n", osfp_result_os_name_get(result)); printf("likely os: %s\n", osfp_result_os_name_get(result));
printf("details: \n%s\n", osfp_result_score_detail_export(result)); printf("details: \n%s\n", osfp_result_score_detail_export(result));
osfp_result_free(result); osfp_result_free(result);
osfp_db_free(db);
} }
osfp_db_free(db);
} }
} }

View File

@@ -1,4 +0,0 @@
prefix=@prefix@
exec_prefix=@exec_prefix@
libdir=@libdir@
includedir=@includedir@

View File

@@ -1,8 +0,0 @@
#!/bin/bash
rm -rf package
mkdir package
cd package
cmake ..
cpack
cd -

BIN
pcap/synmerge.pcap Normal file

Binary file not shown.

View File

@@ -1,23 +0,0 @@
lib_LTLIBRARIES = libosfp.la
libosfp_la_SOURCES = \
utarray.h \
uthash.h \
utlist.h \
utringbuffer.h \
utstack.h \
utstring.h \
cJSON.h \
cJSON.c \
osfp_common.h \
osfp_common.c \
osfp.h \
osfp.c \
osfp_fingerprint.h \
osfp_fingerprint.c \
osfp_log.h \
osfp_log.c \
osfp_score_db.h \
osfp_score_db.c
pkginclude_HEADERS = osfp.h osfp_fingerprint.h osfp_score_db.h osfp_common.h

View File

@@ -94,6 +94,10 @@ char *osfp_result_score_detail_export(struct osfp_result *result)
cJSON *array; cJSON *array;
cJSON *os_score; cJSON *os_score;
osfp_profile_cycle(c1);
osfp_profile_cycle(c2);
osfp_profile_get_cycle(c1);
if (result == NULL) { if (result == NULL) {
goto exit; goto exit;
} }
@@ -139,6 +143,10 @@ exit:
if (root) { if (root) {
cJSON_Delete(root); cJSON_Delete(root);
} }
if (result_str) {
osfp_profile_get_cycle(c2);
osfp_profile_counter_update(&osfp_profile_result_export, c2 - c1);
}
return result_str; return result_str;
} }
@@ -159,21 +167,33 @@ struct osfp_result *osfp_ipv4_identify(struct osfp_db *db, struct iphdr* l3_hdr,
struct osfp_os_class_score os_class_score; struct osfp_os_class_score os_class_score;
struct osfp_result *result; struct osfp_result *result;
osfp_profile_cycle(c1);
osfp_profile_cycle(c2);
if (db == NULL || l3_hdr == NULL || l4_hdr == NULL || l4_hdr == 0) { if (db == NULL || l3_hdr == NULL || l4_hdr == NULL || l4_hdr == 0) {
goto exit; goto exit;
} }
osfp_profile_get_cycle(c1);
ret = osfp_fingerprinting((unsigned char *)l3_hdr, (unsigned char *)l4_hdr, (unsigned int)l4_hdr_len, &fp, 4); ret = osfp_fingerprinting((unsigned char *)l3_hdr, (unsigned char *)l4_hdr, (unsigned int)l4_hdr_len, &fp, 4);
osfp_profile_get_cycle(c2);
osfp_profile_counter_update(&osfp_profile_fingerprinting, c2 - c1);
if (ret != 0) { if (ret != 0) {
goto exit; goto exit;
} }
osfp_profile_get_cycle(c1);
ret = osfp_score_db_score(db->score_db, 0, &fp, &os_class_score); ret = osfp_score_db_score(db->score_db, 0, &fp, &os_class_score);
osfp_profile_get_cycle(c2);
osfp_profile_counter_update(&osfp_profile_score, c2 - c1);
if (ret != 0) { if (ret != 0) {
goto exit; goto exit;
} }
osfp_profile_get_cycle(c1);
result = osfp_result_build(&os_class_score); result = osfp_result_build(&os_class_score);
osfp_profile_get_cycle(c2);
osfp_profile_counter_update(&osfp_profile_result_build, c2 - c1);
if (result == NULL) { if (result == NULL) {
goto exit; goto exit;
} }
@@ -183,14 +203,14 @@ exit:
return NULL; return NULL;
} }
struct osfp_result *osfp_ipv6_identify(struct osfp_db *db, struct ipv6hdr* l3_hdr, struct tcphdr *l4_hdr, size_t l4_hdr_len) struct osfp_result *osfp_ipv6_identify(struct osfp_db *db, struct ip6_hdr* l3_hdr, struct tcphdr *l4_hdr, size_t l4_hdr_len)
{ {
int ret = OSFP_EINVAL; int ret = OSFP_EINVAL;
struct osfp_fingerprint fp; struct osfp_fingerprint fp;
struct osfp_os_class_score os_class_score; struct osfp_os_class_score os_class_score;
struct osfp_result *result; struct osfp_result *result;
if (db == NULL || l3_hdr == NULL || l4_hdr == NULL) { if (db == NULL || l3_hdr == NULL || l4_hdr == NULL || l4_hdr_len == 0) {
goto exit; goto exit;
} }
@@ -225,7 +245,7 @@ struct osfp_result *osfp_json_identify(struct osfp_db *db, const char *json_str)
goto exit; goto exit;
} }
ret = osfp_fingerprint_from_json(&fp, json_str); ret = osfp_fingerprint_from_json(&fp, (char *)json_str);
if (ret != 0) { if (ret != 0) {
goto exit; goto exit;
} }

View File

@@ -2,61 +2,20 @@
#define __OSFP_H__ #define __OSFP_H__
#include <stddef.h> #include <stddef.h>
#include <linux/in.h> #include <netinet/in.h>
#include <netinet/ip.h>
#include <netinet/ip6.h>
#include <netinet/tcp.h>
#include <linux/if_ether.h> #include <linux/if_ether.h>
#include <linux/ip.h>
#include <linux/ipv6.h>
#include <linux/tcp.h>
/** #ifdef __cplusplus
* @brief 定义操作系统类别的名称常量。 extern "C"
*/ {
#define OSFP_OS_CLASS_NAME_UNKNOWN "Unknown" #endif
#define OSFP_OS_CLASS_NAME_WINDOWS "Windows"
#define OSFP_OS_CLASS_NAME_LINUX "Linux"
#define OSFP_OS_CLASS_NAME_MAC_OS "Mac OS"
#define OSFP_OS_CLASS_NAME_IOS "iOS"
#define OSFP_OS_CLASS_NAME_ANDROID "Android"
#define OSFP_OS_CLASS_NAME_OTHERS "Others"
/** struct osfp_result_detail;
* @brief 枚举表示不同的操作系统类别。 struct osfp_result;
*/ struct osfp_db;
enum osfp_os_class_id {
OSFP_OS_CLASS_UNKNOWN, // 未知
OSFP_OS_CLASS_WINDOWS, // Windows
OSFP_OS_CLASS_LINUX, // Linux
OSFP_OS_CLASS_MAC_OS, // Mac OS
OSFP_OS_CLASS_IOS, // iOS
OSFP_OS_CLASS_ANDROID, // Android
OSFP_OS_CLASS_OTHERS, // 其他
OSFP_OS_CLASS_MAX,
};
/**
* @brief 结构体用于 osfp_result 中的详细结果。
*/
struct osfp_result_detail {
unsigned int score; // 得分
unsigned int possibility; // 可能性
};
/**
* @brief 结构体用于表示操作系统识别结果。
*/
struct osfp_result {
char *json_str; // JSON 字符串
enum osfp_os_class_id likely_os_class; // 最可能的操作系统类别
struct osfp_result_detail details[OSFP_OS_CLASS_MAX]; // 详细结果数组
};
/**
* @brief 结构体用于表示操作系统指纹库。
*/
struct osfp_db {
char *db_json_path; // 操作系统指纹库 JSON 文件路径
void *score_db; // 分数数据库指针
};
/** /**
* @brief 创建一个新的操作系统指纹库。 * @brief 创建一个新的操作系统指纹库。
@@ -93,7 +52,7 @@ struct osfp_result *osfp_ipv4_identify(struct osfp_db *db, struct iphdr* l3_hdr,
* @param l4_hdr_len TCP 头部的长度注意包含TCP选项部分 * @param l4_hdr_len TCP 头部的长度注意包含TCP选项部分
* @return 指向操作系统识别结果的指针(注意:内存需要使用者释放)。 * @return 指向操作系统识别结果的指针(注意:内存需要使用者释放)。
*/ */
struct osfp_result *osfp_ipv6_identify(struct osfp_db *db, struct ipv6hdr* l3_hdr, struct tcphdr *l4_hdr, size_t l4_hdr_len); struct osfp_result *osfp_ipv6_identify(struct osfp_db *db, struct ip6_hdr* l3_hdr, struct tcphdr *l4_hdr, size_t l4_hdr_len);
/** /**
* @brief 通过 json 格式的指纹识别操作系统。 * @brief 通过 json 格式的指纹识别操作系统。
@@ -127,4 +86,7 @@ char *osfp_result_score_detail_export(struct osfp_result *result);
*/ */
void osfp_result_free(struct osfp_result *result); void osfp_result_free(struct osfp_result *result);
#ifdef __cplusplus
}
#endif
#endif #endif

View File

@@ -2,7 +2,9 @@
#include "osfp.h" #include "osfp.h"
const char *os_class_name[OSFP_OS_CLASS_MAX] = { unsigned int osfp_profile_enable;
const char *osfp_os_class_name[OSFP_OS_CLASS_MAX] = {
OSFP_OS_CLASS_NAME_UNKNOWN, OSFP_OS_CLASS_NAME_UNKNOWN,
OSFP_OS_CLASS_NAME_WINDOWS, OSFP_OS_CLASS_NAME_WINDOWS,
OSFP_OS_CLASS_NAME_LINUX, OSFP_OS_CLASS_NAME_LINUX,
@@ -12,6 +14,59 @@ const char *os_class_name[OSFP_OS_CLASS_MAX] = {
OSFP_OS_CLASS_NAME_OTHERS OSFP_OS_CLASS_NAME_OTHERS
}; };
struct osfp_profile_counter osfp_profile_fingerprinting;
struct osfp_profile_counter osfp_profile_score;
struct osfp_profile_counter osfp_profile_result_build;
struct osfp_profile_counter osfp_profile_result_export;
const char *osfp_os_class_id_to_name(enum osfp_os_class_id os_class)
{
return osfp_os_class_name[os_class];
}
void osfp_profile_counter_print(struct osfp_profile_counter *profile, const char *name)
{
printf("profile %s: avg: %lu max: %lu min: %lu curr: %lu total: %lu count: %lu\n",
name,
profile->total_cycle / profile->count,
profile->max_cycle,
profile->min_cycle,
profile->curr_cycle,
profile->total_cycle,
profile->count);
}
void osfp_profile_counter_update(struct osfp_profile_counter *profile, unsigned long long curr_cycle)
{
profile->count++;
profile->curr_cycle = curr_cycle;
profile->total_cycle += curr_cycle;
if (profile->min_cycle == 0) {
profile->min_cycle = curr_cycle;
} else {
if (profile->min_cycle > curr_cycle) {
profile->min_cycle = curr_cycle;
}
}
if (profile->max_cycle < curr_cycle) {
profile->max_cycle = curr_cycle;
}
}
void osfp_profile_print_stats(void)
{
osfp_profile_counter_print(&osfp_profile_fingerprinting, "fingerprinting");
osfp_profile_counter_print(&osfp_profile_score, "score");
osfp_profile_counter_print(&osfp_profile_result_build, "result_build");
osfp_profile_counter_print(&osfp_profile_result_export, "result export");
}
void osfp_profile_set(unsigned int enabled)
{
osfp_profile_enable = enabled;
}
enum osfp_os_class_id osfp_os_class_name_to_id(char *name) enum osfp_os_class_id osfp_os_class_name_to_id(char *name)
{ {
enum osfp_os_class_id os_class; enum osfp_os_class_id os_class;
@@ -33,8 +88,3 @@ enum osfp_os_class_id osfp_os_class_name_to_id(char *name)
return os_class; return os_class;
} }
const char *osfp_os_class_id_to_name(enum osfp_os_class_id os_class)
{
return os_class_name[os_class];
}

View File

@@ -8,11 +8,6 @@
#include <stdarg.h> #include <stdarg.h>
#include <time.h> #include <time.h>
#include <linux/in.h>
#include <linux/if_ether.h>
#include <linux/ip.h>
#include <linux/ipv6.h>
#include <linux/tcp.h>
#include <sys/fcntl.h> #include <sys/fcntl.h>
#include <sys/types.h> #include <sys/types.h>
#include <sys/stat.h> #include <sys/stat.h>
@@ -28,8 +23,54 @@
#include "osfp.h" #include "osfp.h"
#define OSFP_TCP_OPTLENMAX 64 static inline unsigned long long osfp_rdtsc(void)
#define OSFP_TCP_OPTMAX 20 {
union {
unsigned long long tsc_64;
struct {
unsigned int lo_32;
unsigned int hi_32;
};
} tsc;
asm volatile("rdtsc" :
"=a" (tsc.lo_32),
"=d" (tsc.hi_32));
return tsc.tsc_64;
}
extern unsigned int osfp_profile_enable;
#define osfp_profile_cycle(x) volatile unsigned long long x = 0
#define osfp_profile_get_cycle(x) do { \
if (__builtin_expect(!!(osfp_profile_enable), 0)) { \
x = osfp_rdtsc(); \
} else { \
x = 0; \
} \
} while(0)
struct osfp_profile_counter {
unsigned long long count;
unsigned long long curr_cycle;
unsigned long long max_cycle;
unsigned long long min_cycle;
unsigned long long total_cycle;
};
extern struct osfp_profile_counter osfp_profile_fingerprinting;
extern struct osfp_profile_counter osfp_profile_score;
extern struct osfp_profile_counter osfp_profile_result_build;
extern struct osfp_profile_counter osfp_profile_result_export;
void osfp_profile_counter_update(struct osfp_profile_counter *profile, unsigned long long curr_cycle);
void osfp_profile_print_stats(void);
void osfp_profile_set(unsigned int enabled);
#define OSFP_BIT_U32(n) (1UL << (n))
#define OSFP_PERCENTILE 100
#define OSFP_ETHERNET_HEADER_LEN 14 #define OSFP_ETHERNET_HEADER_LEN 14
#define OSFP_VLAN_HEADER_LEN 4 #define OSFP_VLAN_HEADER_LEN 4
@@ -37,8 +78,8 @@
#define OSFP_IPV6_HEADER_LEN 40 #define OSFP_IPV6_HEADER_LEN 40
#define OSFP_TCP_HEADER_LEN 20 #define OSFP_TCP_HEADER_LEN 20
#define OSFP_TCP_DATA_OFF_MAX 60 #define OSFP_TCP_DATA_OFF_MAX 60
#define OSFP_TCP_OPTLENMAX 64
#define OSFP_TCP_OPTMAX 20
//# TCP Options (opt_type) - http://www.iana.org/assignments/tcp-parameters //# TCP Options (opt_type) - http://www.iana.org/assignments/tcp-parameters
#define OSFP_TCP_OPT_EOL 0 //# end of option list #define OSFP_TCP_OPT_EOL 0 //# end of option list
#define OSFP_TCP_OPT_NOP 1 //# no operation #define OSFP_TCP_OPT_NOP 1 //# no operation
@@ -74,7 +115,6 @@
#define OSFP_TCP_OPY_ENCNEG 69 //# Encryption Negotiation (TCP-ENO) [RFC8547] #define OSFP_TCP_OPY_ENCNEG 69 //# Encryption Negotiation (TCP-ENO) [RFC8547]
#define OSFP_TCP_OPT_EXP1 253 //# RFC3692-style Experiment 1 (also improperly used for shipping products) #define OSFP_TCP_OPT_EXP1 253 //# RFC3692-style Experiment 1 (also improperly used for shipping products)
#define OSFP_TCP_OPT_EXP2 254 //# RFC3692-style Experiment 2 (also improperly used for shipping products) #define OSFP_TCP_OPT_EXP2 254 //# RFC3692-style Experiment 2 (also improperly used for shipping products)
#define OSFP_TCP_OPT_SACKOK_LEN 2 #define OSFP_TCP_OPT_SACKOK_LEN 2
#define OSFP_TCP_OPT_WS_LEN 3 #define OSFP_TCP_OPT_WS_LEN 3
#define OSFP_TCP_OPT_TS_LEN 10 #define OSFP_TCP_OPT_TS_LEN 10
@@ -84,28 +124,39 @@
#define OSFP_TCP_OPT_TFO_MIN_LEN 4 /* kind, len, 2 bytes cookie: 4 */ #define OSFP_TCP_OPT_TFO_MIN_LEN 4 /* kind, len, 2 bytes cookie: 4 */
#define OSFP_TCP_OPT_TFO_MAX_LEN 18 /* kind, len, 18 */ #define OSFP_TCP_OPT_TFO_MAX_LEN 18 /* kind, len, 18 */
static inline unsigned long long osfp_rdtsc(void)
{
union {
unsigned long long tsc_64;
struct {
unsigned int lo_32;
unsigned int hi_32;
};
} tsc;
asm volatile("rdtsc" : /**
"=a" (tsc.lo_32), * @brief 定义操作系统类别的名称常量。
"=d" (tsc.hi_32)); */
return tsc.tsc_64; #define OSFP_OS_CLASS_NAME_UNKNOWN "Unknown"
} #define OSFP_OS_CLASS_NAME_WINDOWS "Windows"
#define OSFP_OS_CLASS_NAME_LINUX "Linux"
#define OSFP_OS_CLASS_NAME_MAC_OS "Mac OS"
#define OSFP_OS_CLASS_NAME_IOS "iOS"
#define OSFP_OS_CLASS_NAME_ANDROID "Android"
#define OSFP_OS_CLASS_NAME_OTHERS "Others"
#define osfp_profile_cycle(x) volatile unsigned long long x = 0 /**
#define osfp_profile_get_cycle(x) do { \ * @brief 枚举表示不同的操作系统类别。
x = osfp_rdtsc(); \ */
} while(0) enum osfp_os_class_id {
OSFP_OS_CLASS_UNKNOWN, // 未知
OSFP_OS_CLASS_WINDOWS, // Windows
OSFP_OS_CLASS_LINUX, // Linux
OSFP_OS_CLASS_MAC_OS, // Mac OS
OSFP_OS_CLASS_IOS, // iOS
OSFP_OS_CLASS_ANDROID, // Android
OSFP_OS_CLASS_OTHERS, // 其他
OSFP_OS_CLASS_MAX,
};
#define OSFP_OS_CLASS_FLAG_WINDOWS OSFP_BIT_U32(OSFP_OS_CLASS_WINDOWS)
#define OSFP_OS_CLASS_FLAG_LINUX OSFP_BIT_U32(OSFP_OS_CLASS_LINUX)
#define OSFP_OS_CLASS_FLAG_MAC_OS OSFP_BIT_U32(OSFP_OS_CLASS_MAC_OS)
#define OSFP_OS_CLASS_FLAG_IOS OSFP_BIT_U32(OSFP_OS_CLASS_IOS)
#define OSFP_OS_CLASS_FLAG_ANDROID OSFP_BIT_U32(OSFP_OS_CLASS_ANDROID)
#define OSFP_BIT_U32(n) (1UL << (n))
enum osfp_error_code { enum osfp_error_code {
OSFP_NOERR, OSFP_NOERR,
@@ -116,18 +167,36 @@ enum osfp_error_code {
OSFP_ERR_SCORE_DB_UNSUPPORTED, OSFP_ERR_SCORE_DB_UNSUPPORTED,
OSFP_ERR_FINGERPRINTING_UNSUPPORTED, OSFP_ERR_FINGERPRINTING_UNSUPPORTED,
}; };
#define OSFP_OS_CLASS_FLAG_WINDOWS OSFP_BIT_U32(OSFP_OS_CLASS_WINDOWS)
#define OSFP_OS_CLASS_FLAG_LINUX OSFP_BIT_U32(OSFP_OS_CLASS_LINUX)
#define OSFP_OS_CLASS_FLAG_MAC_OS OSFP_BIT_U32(OSFP_OS_CLASS_MAC_OS)
#define OSFP_OS_CLASS_FLAG_IOS OSFP_BIT_U32(OSFP_OS_CLASS_IOS)
#define OSFP_OS_CLASS_FLAG_ANDROID OSFP_BIT_U32(OSFP_OS_CLASS_ANDROID)
#define OSFP_PERCENTILE 100 /**
* @brief 结构体用于 osfp_result 中的详细结果。
*/
struct osfp_result_detail {
unsigned int score; // 得分
unsigned int possibility; // 可能性
};
/**
* @brief 结构体用于表示操作系统识别结果。
*/
struct osfp_result {
char *json_str; // JSON 字符串
enum osfp_os_class_id likely_os_class; // 最可能的操作系统类别
struct osfp_result_detail details[OSFP_OS_CLASS_MAX]; // 详细结果数组
};
/**
* @brief 结构体用于表示操作系统指纹库。
*/
struct osfp_db {
char *db_json_path; // 操作系统指纹库 JSON 文件路径
void *score_db; // 分数数据库指针
};
const char *osfp_os_class_id_to_name(enum osfp_os_class_id os_class);
enum osfp_os_class_id osfp_os_class_name_to_id(char *name); enum osfp_os_class_id osfp_os_class_name_to_id(char *name);
const char *osfp_os_class_id_to_name(enum osfp_os_class_id os_class);
#endif #endif

View File

@@ -40,10 +40,44 @@ struct osfp_fingerprint_field fp_fields[OSFP_FIELD_MAX] = {
{OSFP_FINGERPRINT_FIELD_NAME_TCP_FLAGS, 1, OSFP_FIELD_TYPE_UINT, 25, NULL, 0}, {OSFP_FINGERPRINT_FIELD_NAME_TCP_FLAGS, 1, OSFP_FIELD_TYPE_UINT, 25, NULL, 0},
{OSFP_FINGERPRINT_FIELD_NAME_TCP_MSS, 1, OSFP_FIELD_TYPE_UINT, 150, NULL, 0}, {OSFP_FINGERPRINT_FIELD_NAME_TCP_MSS, 1, OSFP_FIELD_TYPE_UINT, 150, NULL, 0},
{OSFP_FINGERPRINT_FIELD_NAME_TCP_OPTIONS, 1, OSFP_FIELD_TYPE_STRING, 400, NULL, 0}, {OSFP_FINGERPRINT_FIELD_NAME_TCP_OPTIONS, 1, OSFP_FIELD_TYPE_STRING, 400, NULL, 0},
{OSFP_FINGERPRINT_FIELD_NAME_TCP_OPTIONS_ORDERED, 0, OSFP_FIELD_TYPE_STRING, 250, NULL, 0}, {OSFP_FINGERPRINT_FIELD_NAME_TCP_OPTIONS_ORDERED, 1, OSFP_FIELD_TYPE_STRING, 250, NULL, 0},
{OSFP_FINGERPRINT_FIELD_NAME_OS, 0, OSFP_FIELD_TYPE_STRING, 0, NULL, 0}, {OSFP_FINGERPRINT_FIELD_NAME_OS, 0, OSFP_FIELD_TYPE_STRING, 0, NULL, 0},
}; };
static char *osfp_fingerprint_tcp_options_to_ordered(char *tcp_options, unsigned int len)
{
int i;
char *tcp_options_ordered;
unsigned tcp_options_ordered_offset;
unsigned tcp_options_offset;
if (tcp_options == NULL && len == 0) {
goto exit;
}
tcp_options_ordered = malloc(len + 1);
if (tcp_options_ordered == NULL) {
goto exit;
}
tcp_options_offset = 0;
tcp_options_ordered_offset = 0;
while(tcp_options_offset < len) {
if (isalpha(tcp_options[tcp_options_offset])) {
tcp_options_ordered[tcp_options_ordered_offset] = tcp_options[tcp_options_offset];
tcp_options_ordered_offset++;
}
tcp_options_offset++;
}
tcp_options_ordered[tcp_options_ordered_offset] = 0;
return tcp_options_ordered;
exit:
return NULL;
}
static char option_to_ascii(unsigned char type) static char option_to_ascii(unsigned char type)
{ {
switch (type) { switch (type) {
@@ -88,6 +122,30 @@ static unsigned int compute_ip_ttl(unsigned int ip_ttl)
return ip_ttl; return ip_ttl;
} }
static void osfp_fingerprint_setup_field(struct osfp_fingerprint *fp, enum osfp_field_id field_id, void *value, unsigned int len)
{
fp->fields[field_id].name = osfp_fingerprint_get_field_name(field_id);
fp->fields[field_id].enabled = 1;
if (fp->value_buffer_used + len <= sizeof(fp->value_buffer)) {
memcpy(fp->value_buffer + fp->value_buffer_used, value, len);
fp->fields[field_id].value = fp->value_buffer + fp->value_buffer_used;
fp->fields[field_id].value_len = len;
fp->value_buffer_used += len;
} else {
fp->fields[field_id].value = NULL;
fp->fields[field_id].value_len = 0;
}
}
static void osfp_fingerprint_init_field(struct osfp_fingerprint *fp, enum osfp_field_id field_id)
{
fp->fields[field_id].name = osfp_fingerprint_get_field_name(field_id);
fp->fields[field_id].enabled = 0;
fp->fields[field_id].value = NULL;
fp->fields[field_id].value_len = 0;
}
static unsigned int decode_tcp_options(struct osfp_tcp_opt *tcp_opts, unsigned int max_opt_cnt, unsigned char *data, unsigned int len) static unsigned int decode_tcp_options(struct osfp_tcp_opt *tcp_opts, unsigned int max_opt_cnt, unsigned char *data, unsigned int len)
{ {
unsigned int offset = 0; unsigned int offset = 0;
@@ -125,140 +183,7 @@ static unsigned int decode_tcp_options(struct osfp_tcp_opt *tcp_opts, unsigned i
return tcp_opt_cnt; return tcp_opt_cnt;
} }
int osfp_fingerprint_to_json_buf(struct osfp_fingerprint *fp, char *strbuf, unsigned int buf_len, unsigned int format) static int osfp_fingerprinting_tcp_option(unsigned char *opt_data, unsigned int opt_len, struct osfp_fingerprint *fp)
{
int rlen = 0, ret, i;
cJSON *root;
if (fp == NULL || strbuf == NULL || buf_len == 0) {
return 0;
}
strbuf[0] = 0;
root = cJSON_CreateObject();
if (root == NULL) {
return 0;
}
for (i = 0; i < OSFP_FIELD_MAX; i++) {
if (fp->fields[i].enabled) {
switch (fp_fields[i].type) {
case OSFP_FIELD_TYPE_UINT:
cJSON_AddNumberToObject(root, fp_fields[i].name, *(unsigned int *)fp->fields[i].value);
break;
case OSFP_FIELD_TYPE_STRING:
cJSON_AddStringToObject(root, fp_fields[i].name, (char *)fp->fields[i].value);
break;
default:
break;
}
} else {
cJSON_AddNullToObject(root, fp_fields[i].name);
}
}
if (!cJSON_PrintPreallocated(root, strbuf, buf_len, format)) {
return 0;
}
cJSON_Delete(root);
return strlen(strbuf) + 1;
}
int osfp_fingerprint_from_json(struct osfp_fingerprint *fp, char *json_str)
{
int ret, i;
cJSON *root;
cJSON *field;
void *value_ptr;
unsigned int value_len;
if (fp == NULL || json_str == NULL) {
goto exit;
}
memset(fp, 0, sizeof(struct osfp_fingerprint));
root = cJSON_Parse(json_str);
if (root == NULL) {
osfp_log_error("parse json: '%s'\n", json_str);
goto exit;
}
for (i = 0; i < OSFP_FIELD_OS; i++) {
if (!fp_fields[i].enabled) {
continue;
}
field = cJSON_GetObjectItem(root, osfp_fingerprint_get_field_name(i));
if (field == NULL) {
goto exit;
}
switch (field->type) {
case cJSON_Number:
value_ptr = (void *)&field->valueint;
value_len = sizeof(field->valueint);
osfp_fingerprint_setup_field(fp, i, value_ptr, value_len);
break;
case cJSON_String:
value_ptr = (void *)field->valuestring;
value_len = strlen(field->valuestring) + 1;
osfp_fingerprint_setup_field(fp, i, value_ptr, value_len);
break;
case cJSON_NULL:
//printf("fingerprint parse error: %s\n%s\n", field->string, cJSON_Print(root));
break;
default:
goto exit;
}
}
return 0;
exit:
return ret;
}
unsigned int osfp_fingerprint_get_field_enabled(enum osfp_field_id field_id)
{
return fp_fields[field_id].enabled;
}
unsigned int osfp_fingerprint_get_field_importance(enum osfp_field_id field_id)
{
return fp_fields[field_id].importance;
}
const char *osfp_fingerprint_get_field_name(enum osfp_field_id field_id)
{
return fp_fields[field_id].name;
}
unsigned int osfp_fingerprint_get_field_type(enum osfp_field_id field_id)
{
return fp_fields[field_id].type;
}
void osfp_fingerprint_setup_field(struct osfp_fingerprint *fp, enum osfp_field_id field_id, void *value, unsigned int len)
{
fp->fields[field_id].name = osfp_fingerprint_get_field_name(field_id);
fp->fields[field_id].enabled = 1;
if (fp->value_buffer_used + len <= sizeof(fp->value_buffer)) {
memcpy(fp->value_buffer + fp->value_buffer_used, value, len);
fp->fields[field_id].value = fp->value_buffer + fp->value_buffer_used;
fp->fields[field_id].value_len = len;
fp->value_buffer_used += len;
} else {
fp->fields[field_id].value = NULL;
fp->fields[field_id].value_len = 0;
}
}
int osfp_fingerprinting_tcp_option(unsigned char *opt_data, unsigned int opt_len, struct osfp_fingerprint *fp)
{ {
int ret,i; int ret,i;
@@ -356,7 +281,7 @@ exit:
return -1; return -1;
} }
int osfp_fingerprinting_tcp(struct tcphdr *tcph, unsigned int tcph_len, struct osfp_fingerprint *fp) static int osfp_fingerprinting_tcp(struct tcphdr *tcph, unsigned int tcph_len, struct osfp_fingerprint *fp)
{ {
unsigned int tcp_off; unsigned int tcp_off;
unsigned int tcp_window_size; unsigned int tcp_window_size;
@@ -368,7 +293,7 @@ int osfp_fingerprinting_tcp(struct tcphdr *tcph, unsigned int tcph_len, struct o
tcp_off = tcph->doff << 2; tcp_off = tcph->doff << 2;
tcp_window_size = ntohs(tcph->window); tcp_window_size = ntohs(tcph->window);
tcp_flags = *((unsigned char *)&tcph->window - 1); tcp_flags = *((unsigned char *)&tcph->ack_seq + 5);
if (tcp_off != tcph_len) { if (tcp_off != tcph_len) {
goto exit; goto exit;
@@ -378,6 +303,13 @@ int osfp_fingerprinting_tcp(struct tcphdr *tcph, unsigned int tcph_len, struct o
osfp_fingerprint_setup_field(fp, OSFP_FIELD_TCP_WINDOW_SIZE, &tcp_window_size, sizeof(tcp_window_size)); osfp_fingerprint_setup_field(fp, OSFP_FIELD_TCP_WINDOW_SIZE, &tcp_window_size, sizeof(tcp_window_size));
osfp_fingerprint_setup_field(fp, OSFP_FIELD_TCP_FLAGS, &tcp_flags, sizeof(tcp_flags)); osfp_fingerprint_setup_field(fp, OSFP_FIELD_TCP_FLAGS, &tcp_flags, sizeof(tcp_flags));
osfp_fingerprint_init_field(fp, OSFP_FIELD_TCP_TIMESTAMP);
osfp_fingerprint_init_field(fp, OSFP_FIELD_TCP_TIMESTAMP_ECHO_REPLY);
osfp_fingerprint_init_field(fp, OSFP_FIELD_TCP_WINDOW_SCALING);
osfp_fingerprint_init_field(fp, OSFP_FIELD_TCP_MSS);
osfp_fingerprint_init_field(fp, OSFP_FIELD_TCP_OPTIONS);
osfp_fingerprint_init_field(fp, OSFP_FIELD_TCP_OPTIONS_ORDERED);
// tcp options // tcp options
if (tcp_off > OSFP_TCP_HEADER_LEN) { if (tcp_off > OSFP_TCP_HEADER_LEN) {
osfp_fingerprinting_tcp_option((unsigned char *)tcph + OSFP_TCP_HEADER_LEN, tcp_off - OSFP_TCP_HEADER_LEN, fp); osfp_fingerprinting_tcp_option((unsigned char *)tcph + OSFP_TCP_HEADER_LEN, tcp_off - OSFP_TCP_HEADER_LEN, fp);
@@ -388,7 +320,7 @@ exit:
return -1; return -1;
} }
int osfp_fingerprinting_ipv4(struct iphdr *iph, struct osfp_fingerprint *fp) static int osfp_fingerprinting_ipv4(struct iphdr *iph, struct osfp_fingerprint *fp)
{ {
if (iph == NULL || fp == NULL) { if (iph == NULL || fp == NULL) {
goto exit; goto exit;
@@ -409,7 +341,7 @@ exit:
return -1; return -1;
} }
int osfp_fingerprinting_ipv6(struct ipv6hdr *iph, struct osfp_fingerprint *fp) static int osfp_fingerprinting_ipv6(struct ip6_hdr *iph, struct osfp_fingerprint *fp)
{ {
if (iph == NULL || fp == NULL) { if (iph == NULL || fp == NULL) {
goto exit; goto exit;
@@ -417,19 +349,133 @@ int osfp_fingerprinting_ipv6(struct ipv6hdr *iph, struct osfp_fingerprint *fp)
//unsigned int ip_id = 0; //unsigned int ip_id = 0;
//unsigned int ip_tos = 0; //unsigned int ip_tos = 0;
unsigned int ip_total_length = OSFP_IPV6_HEADER_LEN + ntohs(iph->payload_len); unsigned int ip_total_length = OSFP_IPV6_HEADER_LEN + ntohs(iph->ip6_ctlun.ip6_un1.ip6_un1_plen);
unsigned int ip_ttl = compute_ip_ttl(iph->hop_limit); unsigned int ip_ttl = compute_ip_ttl(iph->ip6_ctlun.ip6_un1.ip6_un1_hlim);
//osfp_fingerprint_setup_field(fp, OSFP_FIELD_IP_ID, &ip_id, sizeof(ip_id));
//osfp_fingerprint_setup_field(fp, OSFP_FIELD_IP_TOS, &ip_tos, sizeof(ip_tos));
osfp_fingerprint_setup_field(fp, OSFP_FIELD_IP_TOTAL_LENGTH, &ip_total_length, sizeof(ip_total_length)); osfp_fingerprint_setup_field(fp, OSFP_FIELD_IP_TOTAL_LENGTH, &ip_total_length, sizeof(ip_total_length));
osfp_fingerprint_setup_field(fp, OSFP_FIELD_IP_TTL, &ip_ttl, sizeof(ip_ttl)); osfp_fingerprint_setup_field(fp, OSFP_FIELD_IP_TTL, &ip_ttl, sizeof(ip_ttl));
osfp_fingerprint_init_field(fp, OSFP_FIELD_IP_ID);
osfp_fingerprint_init_field(fp, OSFP_FIELD_IP_TOS);
return 0; return 0;
exit: exit:
return -1; return -1;
} }
int osfp_fingerprint_to_json_buf(struct osfp_fingerprint *fp, char *strbuf, unsigned int buf_len, unsigned int format)
{
int rlen = 0, ret, i;
cJSON *root;
if (fp == NULL || strbuf == NULL || buf_len == 0) {
return 0;
}
strbuf[0] = 0;
root = cJSON_CreateObject();
if (root == NULL) {
return 0;
}
for (i = 0; i < OSFP_FIELD_MAX; i++) {
if (fp->fields[i].enabled) {
switch (fp_fields[i].type) {
case OSFP_FIELD_TYPE_UINT:
cJSON_AddNumberToObject(root, fp_fields[i].name, *(unsigned int *)fp->fields[i].value);
break;
case OSFP_FIELD_TYPE_STRING:
cJSON_AddStringToObject(root, fp_fields[i].name, (char *)fp->fields[i].value);
break;
default:
break;
}
} else {
cJSON_AddNullToObject(root, fp_fields[i].name);
}
}
if (!cJSON_PrintPreallocated(root, strbuf, buf_len, format)) {
return 0;
}
cJSON_Delete(root);
return strlen(strbuf) + 1;
}
int osfp_fingerprint_from_json(struct osfp_fingerprint *fp, char *json_str)
{
int ret, i;
cJSON *root;
cJSON *field;
void *value_ptr;
unsigned int value_len;
if (fp == NULL || json_str == NULL) {
goto exit;
}
memset(fp, 0, sizeof(struct osfp_fingerprint));
root = cJSON_Parse(json_str);
if (root == NULL) {
osfp_log_error("parse json: '%s'\n", json_str);
goto exit;
}
field = cJSON_GetObjectItem(root, osfp_fingerprint_get_field_name(OSFP_FIELD_TCP_OPTIONS_ORDERED));
if (field == NULL) {
field = cJSON_GetObjectItem(root, osfp_fingerprint_get_field_name(OSFP_FIELD_TCP_OPTIONS));
if (field) {
char *tcp_options_ordered_str = osfp_fingerprint_tcp_options_to_ordered(field->valuestring, strlen(field->valuestring));
if (tcp_options_ordered_str) {
cJSON_AddItemToObject(root, osfp_fingerprint_get_field_name(OSFP_FIELD_TCP_OPTIONS_ORDERED),
cJSON_CreateString(tcp_options_ordered_str));
free(tcp_options_ordered_str);
}
}
}
for (i = 0; i < OSFP_FIELD_OS; i++) {
if (!fp_fields[i].enabled) {
continue;
}
field = cJSON_GetObjectItem(root, osfp_fingerprint_get_field_name(i));
if (field == NULL) {
goto exit;
}
switch (field->type) {
case cJSON_Number:
value_ptr = (void *)&field->valueint;
value_len = sizeof(field->valueint);
osfp_fingerprint_setup_field(fp, i, value_ptr, value_len);
break;
case cJSON_String:
value_ptr = (void *)field->valuestring;
value_len = strlen(field->valuestring) + 1;
osfp_fingerprint_setup_field(fp, i, value_ptr, value_len);
break;
case cJSON_NULL:
//printf("fingerprint parse error: %s\n%s\n", field->string, cJSON_Print(root));
break;
default:
goto exit;
}
}
ret = 0;
exit:
if (root) {
cJSON_Delete(root);
}
return ret;
}
int osfp_fingerprinting(unsigned char *iph, unsigned char *tcph, unsigned int tcph_len, struct osfp_fingerprint *fp, unsigned int ip_version) int osfp_fingerprinting(unsigned char *iph, unsigned char *tcph, unsigned int tcph_len, struct osfp_fingerprint *fp, unsigned int ip_version)
{ {
int ret = OSFP_EINVAL; int ret = OSFP_EINVAL;
@@ -438,14 +484,14 @@ int osfp_fingerprinting(unsigned char *iph, unsigned char *tcph, unsigned int tc
goto exit; goto exit;
} }
memset(fp, 0, sizeof(struct osfp_fingerprint)); fp->value_buffer_used = 0;
switch (ip_version) { switch (ip_version) {
case 4: case 4:
ret = osfp_fingerprinting_ipv4((struct iphdr *)iph, fp); ret = osfp_fingerprinting_ipv4((struct iphdr *)iph, fp);
break; break;
case 6: case 6:
ret = osfp_fingerprinting_ipv6((struct ipv6hdr *)iph, fp); ret = osfp_fingerprinting_ipv6((struct ip6_hdr *)iph, fp);
break; break;
default: default:
ret = -1; ret = -1;
@@ -468,7 +514,6 @@ exit:
return -1; return -1;
} }
#ifdef UNITTEST
int test_osfp_fingerprinting_ipv4(void) int test_osfp_fingerprinting_ipv4(void)
{ {
int ret; int ret;
@@ -499,6 +544,7 @@ int test_osfp_fingerprinting_ipv4(void)
goto exit; goto exit;
} }
ret = -1;
if (0 != memcmp(str_buf, target, strlen(target))) { if (0 != memcmp(str_buf, target, strlen(target))) {
goto exit; goto exit;
} }
@@ -538,6 +584,7 @@ int test_osfp_fingerprinting_ipv6(void)
goto exit; goto exit;
} }
ret = -1;
if (0 != memcmp(str_buf, target, strlen(target))) { if (0 != memcmp(str_buf, target, strlen(target))) {
goto exit; goto exit;
} }
@@ -566,6 +613,7 @@ int test_osfp_fingerprinting_tcp_option(void)
goto exit; goto exit;
} }
ret = -1;
if (fp.fields[OSFP_FIELD_TCP_OPTIONS].value_len != strlen(target_options) + 1) if (fp.fields[OSFP_FIELD_TCP_OPTIONS].value_len != strlen(target_options) + 1)
{ {
goto exit; goto exit;
@@ -587,4 +635,3 @@ int test_osfp_fingerprinting_tcp_option(void)
exit: exit:
return ret; return ret;
} }
#endif

View File

@@ -43,24 +43,33 @@ struct osfp_fingerprint {
unsigned int value_buffer_used; unsigned int value_buffer_used;
}; };
extern struct osfp_fingerprint_field fp_fields[OSFP_FIELD_MAX];
static inline unsigned int osfp_fingerprint_get_field_enabled(enum osfp_field_id field_id)
{
return fp_fields[field_id].enabled;
}
static inline unsigned int osfp_fingerprint_get_field_importance(enum osfp_field_id field_id)
{
return fp_fields[field_id].importance;
}
static inline const char *osfp_fingerprint_get_field_name(enum osfp_field_id field_id)
{
return fp_fields[field_id].name;
}
static inline unsigned int osfp_fingerprint_get_field_type(enum osfp_field_id field_id)
{
return fp_fields[field_id].type;
}
int osfp_fingerprint_from_json(struct osfp_fingerprint *fp, char *json_str);
int osfp_fingerprint_to_json_buf(struct osfp_fingerprint *fp, char *strbuf, unsigned int buf_len, unsigned int format); int osfp_fingerprint_to_json_buf(struct osfp_fingerprint *fp, char *strbuf, unsigned int buf_len, unsigned int format);
void osfp_fingerprint_setup_field(struct osfp_fingerprint *fp, enum osfp_field_id field_id, void *value, unsigned int len);
const char *osfp_fingerprint_get_field_name(enum osfp_field_id field_id);
unsigned int osfp_fingerprint_get_field_enabled(enum osfp_field_id field_id);
unsigned int osfp_fingerprint_get_field_importance(enum osfp_field_id field_id);
unsigned int osfp_fingerprint_get_field_type(enum osfp_field_id field_id);
int osfp_fingerprinting_tcp_option(unsigned char *pkt, unsigned int pktlen, struct osfp_fingerprint *fp);
int osfp_fingerprinting_tcp(struct tcphdr *tcph, unsigned int tcph_len, struct osfp_fingerprint *fp);
int osfp_fingerprinting_ipv4(struct iphdr *iph, struct osfp_fingerprint *fp);
int osfp_fingerprinting_ipv6(struct ipv6hdr *iph, struct osfp_fingerprint *fp);
int osfp_fingerprinting(unsigned char *iph, unsigned char *tcph, unsigned int tcph_len, struct osfp_fingerprint *fp, unsigned int ip_version); int osfp_fingerprinting(unsigned char *iph, unsigned char *tcph, unsigned int tcph_len, struct osfp_fingerprint *fp, unsigned int ip_version);
#ifdef UNITTEST
int test_osfp_fingerprinting_ipv4(void); int test_osfp_fingerprinting_ipv4(void);
int test_osfp_fingerprinting_ipv6(void); int test_osfp_fingerprinting_ipv6(void);
int test_osfp_fingerprinting_tcp_option(void); int test_osfp_fingerprinting_tcp_option(void);
#endif #endif
#endif

View File

@@ -26,7 +26,7 @@ struct osfp_score_db_hash_data {
struct osfp_score_db_hash_element *hash_head; struct osfp_score_db_hash_element *hash_head;
}; };
int osfp_score_db_array_add(void *data, struct osfp_os_class_score *os_class_score, void *value, unsigned int len) static int osfp_score_db_array_add(void *data, struct osfp_os_class_score *os_class_score, void *value, unsigned int len)
{ {
int ret = -1, i; int ret = -1, i;
unsigned int index; unsigned int index;
@@ -55,7 +55,7 @@ exit:
return ret; return ret;
} }
struct osfp_os_class_score *osfp_score_db_array_match(void *data, void *value, unsigned int len) static struct osfp_os_class_score *osfp_score_db_array_match(void *data, void *value, unsigned int len)
{ {
unsigned int index; unsigned int index;
struct osfp_score_db_array_data *array_data = (struct osfp_score_db_array_data *)data; struct osfp_score_db_array_data *array_data = (struct osfp_score_db_array_data *)data;
@@ -77,7 +77,7 @@ struct osfp_os_class_score *osfp_score_db_array_match(void *data, void *value, u
return &((array_data->array_head)[index]); return &((array_data->array_head)[index]);
} }
void *osfp_score_db_array_create(void) static void *osfp_score_db_array_create(void)
{ {
struct osfp_score_db_array_data *array_data = calloc(1, sizeof(struct osfp_score_db_array_data)); struct osfp_score_db_array_data *array_data = calloc(1, sizeof(struct osfp_score_db_array_data));
if (array_data == NULL) { if (array_data == NULL) {
@@ -95,7 +95,7 @@ void *osfp_score_db_array_create(void)
return (void *)array_data; return (void *)array_data;
} }
void osfp_score_db_array_destroy(void *data) { static void osfp_score_db_array_destroy(void *data) {
struct osfp_score_db_array_data *array_data = (struct osfp_score_db_array_data *)data; struct osfp_score_db_array_data *array_data = (struct osfp_score_db_array_data *)data;
if (array_data) { if (array_data) {
@@ -106,7 +106,7 @@ void osfp_score_db_array_destroy(void *data) {
} }
} }
int osfp_score_db_hash_add(void *data, struct osfp_os_class_score *os_class_score, void *value, unsigned int len) static int osfp_score_db_hash_add(void *data, struct osfp_os_class_score *os_class_score, void *value, unsigned int len)
{ {
int ret = -1, i; int ret = -1, i;
struct osfp_score_db_hash_data *hash_data = (struct osfp_score_db_hash_data *)data; struct osfp_score_db_hash_data *hash_data = (struct osfp_score_db_hash_data *)data;
@@ -142,7 +142,7 @@ exit:
return ret; return ret;
} }
struct osfp_os_class_score *osfp_score_db_hash_match(void *data, void *value, unsigned int len) static struct osfp_os_class_score *osfp_score_db_hash_match(void *data, void *value, unsigned int len)
{ {
struct osfp_score_db_hash_data *hash_data = (struct osfp_score_db_hash_data *)data; struct osfp_score_db_hash_data *hash_data = (struct osfp_score_db_hash_data *)data;
struct osfp_score_db_hash_element *element = NULL; struct osfp_score_db_hash_element *element = NULL;
@@ -163,12 +163,12 @@ struct osfp_os_class_score *osfp_score_db_hash_match(void *data, void *value, un
return element->score; return element->score;
} }
void *osfp_score_db_hash_create(void) static void *osfp_score_db_hash_create(void)
{ {
return (void*)calloc(1, sizeof(struct osfp_score_db_hash_data)); return (void*)calloc(1, sizeof(struct osfp_score_db_hash_data));
} }
void osfp_score_db_hash_destroy(void *data) { static void osfp_score_db_hash_destroy(void *data) {
struct osfp_score_db_hash_data *hash_data = (struct osfp_score_db_hash_data *)data; struct osfp_score_db_hash_data *hash_data = (struct osfp_score_db_hash_data *)data;
struct osfp_score_db_hash_element *element = NULL; struct osfp_score_db_hash_element *element = NULL;
struct osfp_score_db_hash_element *tmp = NULL; struct osfp_score_db_hash_element *tmp = NULL;
@@ -192,55 +192,7 @@ void osfp_score_db_hash_destroy(void *data) {
} }
} }
char *osfp_score_db_read_file(char *fp_file) static int osfp_score_db_load_field(struct osfp_field_score_db *db, cJSON *field, enum osfp_os_class_id os_class)
{
int ret = -1;
char *file_buffer = NULL;
unsigned int file_len = 0;
FILE *fp = NULL;
struct stat st;
if (0 > stat(fp_file, &st)) {
osfp_log_error("stat() failed on '%s'.\n", fp_file);
goto exit;
}
if (st.st_size == 0) {
osfp_log_error("Empty file: '%s'.\n", fp_file);
goto exit;
}
file_len = (unsigned int)st.st_size;
file_buffer = malloc(file_len + 1);
if (file_buffer == NULL) {
osfp_log_error("Not enough memory for file buffer. file name: '%s'\n",fp_file);
goto exit;
}
fp = fopen(fp_file, "r");
if (fp == NULL) {
osfp_log_error("Cannot open '%s' for reading.\n", fp_file);
goto exit;
}
ret = fread(file_buffer, 1, file_len, fp);
if (ret < 0) {
osfp_log_error("fread() failed on '%s'.\n", fp_file);
free(file_buffer);
fclose(fp);
goto exit;
}
fclose(fp);
file_buffer[file_len] = 0;
return file_buffer;
exit:
return NULL;
}
int osfp_score_db_load_field(struct osfp_field_score_db *db, cJSON *field, enum osfp_os_class_id os_class)
{ {
int ret = -1; int ret = -1;
struct osfp_os_class_score os_class_score = {0}; struct osfp_os_class_score os_class_score = {0};
@@ -278,7 +230,7 @@ exit:
return ret; return ret;
} }
int osfp_score_db_load_entry(struct osfp_score_db *score_db, cJSON *entry) static int osfp_score_db_load_entry(struct osfp_score_db *score_db, cJSON *entry)
{ {
int ret = -1, i; int ret = -1, i;
cJSON *field = NULL; cJSON *field = NULL;
@@ -332,6 +284,54 @@ exit:
return ret; return ret;
} }
char *osfp_score_db_read_file(char *fp_file)
{
int ret = -1;
char *file_buffer = NULL;
unsigned int file_len = 0;
FILE *fp = NULL;
struct stat st;
if (0 > stat(fp_file, &st)) {
osfp_log_error("stat() failed on '%s'.\n", fp_file);
goto exit;
}
if (st.st_size == 0) {
osfp_log_error("Empty file: '%s'.\n", fp_file);
goto exit;
}
file_len = (unsigned int)st.st_size;
file_buffer = malloc(file_len + 1);
if (file_buffer == NULL) {
osfp_log_error("Not enough memory for file buffer. file name: '%s'\n",fp_file);
goto exit;
}
fp = fopen(fp_file, "r");
if (fp == NULL) {
osfp_log_error("Cannot open '%s' for reading.\n", fp_file);
goto exit;
}
ret = fread(file_buffer, 1, file_len, fp);
if (ret < 0) {
osfp_log_error("fread() failed on '%s'.\n", fp_file);
free(file_buffer);
fclose(fp);
goto exit;
}
fclose(fp);
file_buffer[file_len] = 0;
return file_buffer;
exit:
return NULL;
}
int osfp_score_db_load(struct osfp_score_db *score_db, char *fp_file) int osfp_score_db_load(struct osfp_score_db *score_db, char *fp_file)
{ {
int ret = OSFP_EINVAL, i, count; int ret = OSFP_EINVAL, i, count;
@@ -373,7 +373,7 @@ int osfp_score_db_load(struct osfp_score_db *score_db, char *fp_file)
for (i = 0; i < OSFP_FIELD_MAX; i++) { for (i = 0; i < OSFP_FIELD_MAX; i++) {
field_score_db = &score_db->field_score_dbs[i]; field_score_db = &score_db->field_score_dbs[i];
if (field_score_db->enabled && i != OSFP_FIELD_TCP_OPTIONS) { if (field_score_db->enabled && i != OSFP_FIELD_TCP_OPTIONS_ORDERED) {
score_db->perfect_score += osfp_fingerprint_get_field_importance(i); score_db->perfect_score += osfp_fingerprint_get_field_importance(i);
} }
} }
@@ -447,6 +447,11 @@ int osfp_score_db_score(struct osfp_score_db *score_db, unsigned int flags, stru
result_score->scores[j] += ((OSFP_PERCENTILE * importance / perfect_score) * tmp_score) / entry_count; result_score->scores[j] += ((OSFP_PERCENTILE * importance / perfect_score) * tmp_score) / entry_count;
} }
} }
if (i == OSFP_FIELD_TCP_OPTIONS) {
// if OSFP_FIELD_TCP_OPTIONS matched OSFP_FIELD_TCP_OPTIONS_ORDERED is not needed
i++;
}
} }
return OSFP_NOERR; return OSFP_NOERR;
@@ -547,7 +552,6 @@ void osfp_score_db_destroy(struct osfp_score_db *score_db)
} }
} }
#ifdef UNITTEST
int test_osfp_score_db(void) int test_osfp_score_db(void)
{ {
int ret, i; int ret, i;
@@ -618,5 +622,3 @@ int test_osfp_score_db(void)
exit: exit:
return -1; return -1;
} }
#endif

View File

@@ -3,6 +3,7 @@
#include "osfp.h" #include "osfp.h"
#include "osfp_fingerprint.h" #include "osfp_fingerprint.h"
#include "osfp_common.h"
struct osfp_os_class_score { struct osfp_os_class_score {
unsigned int scores[OSFP_OS_CLASS_MAX]; unsigned int scores[OSFP_OS_CLASS_MAX];
@@ -37,8 +38,6 @@ int osfp_score_db_score(struct osfp_score_db *score_db, unsigned int flags, stru
struct osfp_score_db *osfp_score_db_create(void); struct osfp_score_db *osfp_score_db_create(void);
void osfp_score_db_destroy(struct osfp_score_db *score_db); void osfp_score_db_destroy(struct osfp_score_db *score_db);
#ifdef UNITTEST
int test_osfp_score_db(void); int test_osfp_score_db(void);
#endif
#endif #endif

4
src/version.map Normal file
View File

@@ -0,0 +1,4 @@
{
global: osfp*;GIT_VERSION_*;
local: *;
};

View File

@@ -1,11 +0,0 @@
bin_PROGRAMS = osfp_test
osfp_test_SOURCES = \
test.c
osfp_test_LDADD = \
../src/.libs/libosfp.la
osfp_test_CFLAGS = \
-I../src

View File

@@ -1,228 +0,0 @@
#! /bin/sh
# osfp_test - temporary wrapper script for .libs/osfp_test
# Generated by libtool (GNU libtool) 2.4.2
#
# The osfp_test program cannot be directly executed until all the libtool
# libraries that it depends on are installed.
#
# This wrapper script should never be moved out of the build directory.
# If it is, it will not operate correctly.
# Sed substitution that helps us do robust quoting. It backslashifies
# metacharacters that are still active within double-quoted strings.
sed_quote_subst='s/\([`"$\\]\)/\\\1/g'
# Be Bourne compatible
if test -n "${ZSH_VERSION+set}" && (emulate sh) >/dev/null 2>&1; then
emulate sh
NULLCMD=:
# Zsh 3.x and 4.x performs word splitting on ${1+"$@"}, which
# is contrary to our usage. Disable this feature.
alias -g '${1+"$@"}'='"$@"'
setopt NO_GLOB_SUBST
else
case `(set -o) 2>/dev/null` in *posix*) set -o posix;; esac
fi
BIN_SH=xpg4; export BIN_SH # for Tru64
DUALCASE=1; export DUALCASE # for MKS sh
# The HP-UX ksh and POSIX shell print the target directory to stdout
# if CDPATH is set.
(unset CDPATH) >/dev/null 2>&1 && unset CDPATH
relink_command="(cd /root/geedge/libosfp/test; { test -z \"\${LIBRARY_PATH+set}\" || unset LIBRARY_PATH || { LIBRARY_PATH=; export LIBRARY_PATH; }; }; { test -z \"\${COMPILER_PATH+set}\" || unset COMPILER_PATH || { COMPILER_PATH=; export COMPILER_PATH; }; }; { test -z \"\${GCC_EXEC_PREFIX+set}\" || unset GCC_EXEC_PREFIX || { GCC_EXEC_PREFIX=; export GCC_EXEC_PREFIX; }; }; { test -z \"\${LD_RUN_PATH+set}\" || unset LD_RUN_PATH || { LD_RUN_PATH=; export LD_RUN_PATH; }; }; { test -z \"\${LD_LIBRARY_PATH+set}\" || unset LD_LIBRARY_PATH || { LD_LIBRARY_PATH=; export LD_LIBRARY_PATH; }; }; PATH=/root/.cargo/bin:/usr/lib64/ccache:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/root/bin; export PATH; gcc -I../src -g -O2 -DUNITTEST -o \$progdir/\$file osfp_test-test.o ../src/.libs/libosfp.so -Wl,-rpath -Wl,/root/geedge/libosfp/src/.libs -Wl,-rpath -Wl,/root/geedge/libosfp/target/lib)"
# This environment variable determines our operation mode.
if test "$libtool_install_magic" = "%%%MAGIC variable%%%"; then
# install mode needs the following variables:
generated_by_libtool_version='2.4.2'
notinst_deplibs=' ../src/.libs/libosfp.la'
else
# When we are sourced in execute mode, $file and $ECHO are already set.
if test "$libtool_execute_magic" != "%%%MAGIC variable%%%"; then
file="$0"
# A function that is used when there is no print builtin or printf.
func_fallback_echo ()
{
eval 'cat <<_LTECHO_EOF
$1
_LTECHO_EOF'
}
ECHO="printf %s\\n"
fi
# Very basic option parsing. These options are (a) specific to
# the libtool wrapper, (b) are identical between the wrapper
# /script/ and the wrapper /executable/ which is used only on
# windows platforms, and (c) all begin with the string --lt-
# (application programs are unlikely to have options which match
# this pattern).
#
# There are only two supported options: --lt-debug and
# --lt-dump-script. There is, deliberately, no --lt-help.
#
# The first argument to this parsing function should be the
# script's ../libtool value, followed by no.
lt_option_debug=
func_parse_lt_options ()
{
lt_script_arg0=$0
shift
for lt_opt
do
case "$lt_opt" in
--lt-debug) lt_option_debug=1 ;;
--lt-dump-script)
lt_dump_D=`$ECHO "X$lt_script_arg0" | /usr/bin/sed -e 's/^X//' -e 's%/[^/]*$%%'`
test "X$lt_dump_D" = "X$lt_script_arg0" && lt_dump_D=.
lt_dump_F=`$ECHO "X$lt_script_arg0" | /usr/bin/sed -e 's/^X//' -e 's%^.*/%%'`
cat "$lt_dump_D/$lt_dump_F"
exit 0
;;
--lt-*)
$ECHO "Unrecognized --lt- option: '$lt_opt'" 1>&2
exit 1
;;
esac
done
# Print the debug banner immediately:
if test -n "$lt_option_debug"; then
echo "osfp_test:osfp_test:${LINENO}: libtool wrapper (GNU libtool) 2.4.2" 1>&2
fi
}
# Used when --lt-debug. Prints its arguments to stdout
# (redirection is the responsibility of the caller)
func_lt_dump_args ()
{
lt_dump_args_N=1;
for lt_arg
do
$ECHO "osfp_test:osfp_test:${LINENO}: newargv[$lt_dump_args_N]: $lt_arg"
lt_dump_args_N=`expr $lt_dump_args_N + 1`
done
}
# Core function for launching the target application
func_exec_program_core ()
{
if test -n "$lt_option_debug"; then
$ECHO "osfp_test:osfp_test:${LINENO}: newargv[0]: $progdir/$program" 1>&2
func_lt_dump_args ${1+"$@"} 1>&2
fi
exec "$progdir/$program" ${1+"$@"}
$ECHO "$0: cannot exec $program $*" 1>&2
exit 1
}
# A function to encapsulate launching the target application
# Strips options in the --lt-* namespace from $@ and
# launches target application with the remaining arguments.
func_exec_program ()
{
case " $* " in
*\ --lt-*)
for lt_wr_arg
do
case $lt_wr_arg in
--lt-*) ;;
*) set x "$@" "$lt_wr_arg"; shift;;
esac
shift
done ;;
esac
func_exec_program_core ${1+"$@"}
}
# Parse options
func_parse_lt_options "$0" ${1+"$@"}
# Find the directory that this script lives in.
thisdir=`$ECHO "$file" | /usr/bin/sed 's%/[^/]*$%%'`
test "x$thisdir" = "x$file" && thisdir=.
# Follow symbolic links until we get to the real thisdir.
file=`ls -ld "$file" | /usr/bin/sed -n 's/.*-> //p'`
while test -n "$file"; do
destdir=`$ECHO "$file" | /usr/bin/sed 's%/[^/]*$%%'`
# If there was a directory component, then change thisdir.
if test "x$destdir" != "x$file"; then
case "$destdir" in
[\\/]* | [A-Za-z]:[\\/]*) thisdir="$destdir" ;;
*) thisdir="$thisdir/$destdir" ;;
esac
fi
file=`$ECHO "$file" | /usr/bin/sed 's%^.*/%%'`
file=`ls -ld "$thisdir/$file" | /usr/bin/sed -n 's/.*-> //p'`
done
# Usually 'no', except on cygwin/mingw when embedded into
# the cwrapper.
WRAPPER_SCRIPT_BELONGS_IN_OBJDIR=no
if test "$WRAPPER_SCRIPT_BELONGS_IN_OBJDIR" = "yes"; then
# special case for '.'
if test "$thisdir" = "."; then
thisdir=`pwd`
fi
# remove .libs from thisdir
case "$thisdir" in
*[\\/].libs ) thisdir=`$ECHO "$thisdir" | /usr/bin/sed 's%[\\/][^\\/]*$%%'` ;;
.libs ) thisdir=. ;;
esac
fi
# Try to get the absolute directory name.
absdir=`cd "$thisdir" && pwd`
test -n "$absdir" && thisdir="$absdir"
program=lt-'osfp_test'
progdir="$thisdir/.libs"
if test ! -f "$progdir/$program" ||
{ file=`ls -1dt "$progdir/$program" "$progdir/../$program" 2>/dev/null | /usr/bin/sed 1q`; \
test "X$file" != "X$progdir/$program"; }; then
file="$$-$program"
if test ! -d "$progdir"; then
mkdir "$progdir"
else
rm -f "$progdir/$file"
fi
# relink executable if necessary
if test -n "$relink_command"; then
if relink_command_output=`eval $relink_command 2>&1`; then :
else
printf %s\n "$relink_command_output" >&2
rm -f "$progdir/$file"
exit 1
fi
fi
mv -f "$progdir/$file" "$progdir/$program" 2>/dev/null ||
{ rm -f "$progdir/$program";
mv -f "$progdir/$file" "$progdir/$program"; }
rm -f "$progdir/$file"
fi
if test -f "$progdir/$program"; then
if test "$libtool_execute_magic" != "%%%MAGIC variable%%%"; then
# Run the actual program with our arguments.
func_exec_program ${1+"$@"}
fi
else
# The program doesn't exist.
$ECHO "$0: error: \`$progdir/$program' does not exist" 1>&2
$ECHO "This script is just a wrapper for $program." 1>&2
$ECHO "See the libtool documentation for more information." 1>&2
exit 1
fi
fi

File diff suppressed because it is too large Load Diff

View File

@@ -10,6 +10,7 @@
#include "osfp_fingerprint.h" #include "osfp_fingerprint.h"
#include "osfp_score_db.h" #include "osfp_score_db.h"
#include "osfp_log.h" #include "osfp_log.h"
#include "osfp_common.h" #include "osfp_common.h"
#define DATA_FILE_PATH "./data.json" #define DATA_FILE_PATH "./data.json"
@@ -17,6 +18,9 @@
#define TEST_FILE_PATH "./test.json" #define TEST_FILE_PATH "./test.json"
#define LOG_FILE_PATH "./osfp_test.log" #define LOG_FILE_PATH "./osfp_test.log"
#define OSFP_OS_CLASS_MERGED_MAX (OSFP_OS_CLASS_MAX - 2)
#define EntryWidth 8
unsigned char *data_file_path = DATA_FILE_PATH; unsigned char *data_file_path = DATA_FILE_PATH;
unsigned char *db_file_path; unsigned char *db_file_path;
unsigned char *test_file_path; unsigned char *test_file_path;
@@ -28,6 +32,101 @@ FILE *log_file_ptr;
unsigned int debug_enable; unsigned int debug_enable;
//enum osfp_os_class_id {
// OSFP_OS_CLASS_UNKNOWN, // 未知
// OSFP_OS_CLASS_WINDOWS, // Windows
// OSFP_OS_CLASS_LINUX, // Linux
// OSFP_OS_CLASS_MAC_OS, // Mac OS
// OSFP_OS_CLASS_IOS, // iOS
// OSFP_OS_CLASS_ANDROID, // Android
// OSFP_OS_CLASS_OTHERS, // 其他
// OSFP_OS_CLASS_MAX,
//};
// merged classes: unknown 0 windows-like 1 unix-like 2 apple-like 3 others 4
unsigned int testresult[OSFP_OS_CLASS_MAX][OSFP_OS_CLASS_MAX] = {0};
unsigned int testresult_merged[OSFP_OS_CLASS_MERGED_MAX][OSFP_OS_CLASS_MERGED_MAX] = {0};
static const char *class_to_merged_name(unsigned int class)
{
switch (class) {
case 0:
return "Unknown";
case 1:
return "Windows-Like";
case 2:
return "Unix-Like";
case 3:
return "Apple-Like";
case 4:
return "Others";
}
return NULL;
}
static unsigned int class_to_merged_class(unsigned int class)
{
switch (class) {
case OSFP_OS_CLASS_UNKNOWN:
return 0;
case OSFP_OS_CLASS_WINDOWS:
return 1;
case OSFP_OS_CLASS_LINUX:
return 2;
case OSFP_OS_CLASS_MAC_OS:
return 3;
case OSFP_OS_CLASS_IOS:
return 3;
case OSFP_OS_CLASS_ANDROID:
return 2;
case OSFP_OS_CLASS_OTHERS:
return 4;
}
return 0;
}
static void testresult_class_merge()
{
int i,j;
for (i = 0; i < OSFP_OS_CLASS_MAX; i++) {
for (j = 0; j < OSFP_OS_CLASS_MAX; j++) {
testresult_merged[class_to_merged_class(i)][class_to_merged_class(j)] += testresult[i][j];
}
}
}
static void print_confusion_matrix(unsigned int *result, unsigned int os_class_max, const char *(*get_name)(unsigned int))
{
int i,j;
int matched = 0, missed = 0;
for (i = 0; i < os_class_max; i++) {
printf("%*s(%c)", EntryWidth-3, " ", 'a' + i);
}
printf(" <-" " classified as" "\n");
for (i = 0; i < os_class_max; i++) {
printf("%*.*s", EntryWidth, EntryWidth-2, "----------");
}
printf("\n");
for (i = 0; i < os_class_max; i++) {
for (j = 0; j < os_class_max; j++) {
if (i == j) {
matched += *(result + os_class_max * i + j);
} else {
missed += *(result + os_class_max * i + j);
}
printf(" %*d", EntryWidth-1, *(result + os_class_max * i + j));
}
printf(" (%c): " "class" " %s\n", 'a' + i, get_name(i));
}
printf("miss rate: %u%%\n", 100 * missed / (matched + missed));
}
void test_data_prepare() void test_data_prepare()
{ {
char *file_buffer; char *file_buffer;
@@ -128,6 +227,8 @@ void test_miss_rate()
continue; continue;
} }
testresult[result->likely_os_class][os_class]++;
if (os_class == result->likely_os_class) { if (os_class == result->likely_os_class) {
verified_count++; verified_count++;
osfp_result_free(result); osfp_result_free(result);
@@ -160,7 +261,13 @@ void test_miss_rate()
printf("total %u, failed %u, pass %u, wrong %u, other %u, unknown %u\n", printf("total %u, failed %u, pass %u, wrong %u, other %u, unknown %u\n",
fingerprint_count, identify_failed_count, verified_count, wrong_count, other_count, unknown_count); fingerprint_count, identify_failed_count, verified_count, wrong_count, other_count, unknown_count);
printf("miss rate: %d%%\n", 100 - (verified_count * 100 / fingerprint_count)); //printf("miss rate: %d%%\n", 100 - (verified_count * 100 / fingerprint_count));
testresult_class_merge();
print_confusion_matrix((unsigned int *)testresult, OSFP_OS_CLASS_MAX, osfp_os_class_id_to_name);
print_confusion_matrix((unsigned int *)testresult_merged, OSFP_OS_CLASS_MERGED_MAX, class_to_merged_name);
printf("details in: %s\n", LOG_FILE_PATH); printf("details in: %s\n", LOG_FILE_PATH);