Compare commits
4 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
|
|
1de666a56e | ||
|
|
168f931da6 | ||
|
|
e62ff39d81 | ||
|
|
cfaf003d4f |
@@ -98,7 +98,7 @@ develop_build_debug_for_centos7:
|
||||
PULP3_REPO_NAME: framework-testing-x86_64.el7
|
||||
PULP3_DIST_NAME: framework-testing-x86_64.el7
|
||||
artifacts:
|
||||
name: "MESA_osfp-$CI_COMMIT_REF_NAME-debug"
|
||||
name: "libosfp-$CI_COMMIT_REF_NAME-debug"
|
||||
paths:
|
||||
- build/*.rpm
|
||||
only:
|
||||
@@ -118,7 +118,7 @@ develop_build_release_for_centos7:
|
||||
PULP3_REPO_NAME: framework-testing-x86_64.el7
|
||||
PULP3_DIST_NAME: framework-testing-x86_64.el7
|
||||
artifacts:
|
||||
name: "MESA_osfp-$CI_COMMIT_REF_NAME-release"
|
||||
name: "libosfp-$CI_COMMIT_REF_NAME-release"
|
||||
paths:
|
||||
- build/*.rpm
|
||||
only:
|
||||
@@ -137,7 +137,7 @@ release_build_debug_for_centos7:
|
||||
PULP3_DIST_NAME: framework-stable-x86_64.el7
|
||||
extends: .build_by_travis_for_centos7
|
||||
artifacts:
|
||||
name: "MESA_osfp-$CI_COMMIT_REF_NAME-debug"
|
||||
name: "libosfp-$CI_COMMIT_REF_NAME-debug"
|
||||
paths:
|
||||
- build/*.rpm
|
||||
only:
|
||||
@@ -153,7 +153,7 @@ release_build_release_for_centos7:
|
||||
PULP3_DIST_NAME: framework-stable-x86_64.el7
|
||||
extends: .build_by_travis_for_centos7
|
||||
artifacts:
|
||||
name: "MESA_osfp-$CI_COMMIT_REF_NAME-release"
|
||||
name: "libosfp-$CI_COMMIT_REF_NAME-release"
|
||||
paths:
|
||||
- build/*.rpm
|
||||
only:
|
||||
@@ -195,7 +195,7 @@ develop_build_debug_for_centos8:
|
||||
PULP3_REPO_NAME: framework-testing-x86_64.el8
|
||||
PULP3_DIST_NAME: framework-testing-x86_64.el8
|
||||
artifacts:
|
||||
name: "MESA_osfp-$CI_COMMIT_REF_NAME-debug"
|
||||
name: "libosfp-$CI_COMMIT_REF_NAME-debug"
|
||||
paths:
|
||||
- build/*.rpm
|
||||
only:
|
||||
@@ -215,7 +215,7 @@ develop_build_release_for_centos8:
|
||||
PULP3_REPO_NAME: framework-testing-x86_64.el8
|
||||
PULP3_DIST_NAME: framework-testing-x86_64.el8
|
||||
artifacts:
|
||||
name: "MESA_osfp-$CI_COMMIT_REF_NAME-release"
|
||||
name: "libosfp-$CI_COMMIT_REF_NAME-release"
|
||||
paths:
|
||||
- build/*.rpm
|
||||
only:
|
||||
@@ -234,7 +234,7 @@ release_build_debug_for_centos8:
|
||||
PULP3_DIST_NAME: framework-stable-x86_64.el8
|
||||
extends: .build_by_travis_for_centos8
|
||||
artifacts:
|
||||
name: "MESA_osfp-$CI_COMMIT_REF_NAME-debug"
|
||||
name: "libosfp-$CI_COMMIT_REF_NAME-debug"
|
||||
paths:
|
||||
- build/*.rpm
|
||||
only:
|
||||
@@ -250,7 +250,7 @@ release_build_release_for_centos8:
|
||||
PULP3_DIST_NAME: framework-stable-x86_64.el8
|
||||
extends: .build_by_travis_for_centos8
|
||||
artifacts:
|
||||
name: "MESA_osfp-$CI_COMMIT_REF_NAME-release"
|
||||
name: "libosfp-$CI_COMMIT_REF_NAME-release"
|
||||
paths:
|
||||
- build/*.rpm
|
||||
only:
|
||||
|
||||
@@ -1,11 +1,11 @@
|
||||
cmake_minimum_required (VERSION 2.8)
|
||||
|
||||
set(lib_name MESA_osfp)
|
||||
set(lib_name osfp)
|
||||
|
||||
project (${lib_name})
|
||||
|
||||
set(LIB_MAJOR_VERSION 1)
|
||||
set(LIB_MINOR_VERSION 1)
|
||||
set(LIB_MINOR_VERSION 3)
|
||||
|
||||
set(CMAKE_MODULE_PATH ${PROJECT_SOURCE_DIR}/cmake)
|
||||
include(Version)
|
||||
@@ -55,11 +55,11 @@ set_target_properties(${lib_name}_static PROPERTIES OUTPUT_NAME ${lib_name})
|
||||
|
||||
set(CMAKE_INSTALL_PREFIX /opt/MESA)
|
||||
|
||||
install(FILES src/MESA_osfp.h DESTINATION
|
||||
install(FILES src/osfp.h DESTINATION
|
||||
${CMAKE_INSTALL_PREFIX}/include/MESA COMPONENT devel)
|
||||
install(TARGETS ${lib_name}_shared LIBRARY DESTINATION ${CMAKE_INSTALL_PREFIX}/lib COMPONENT LIBRARIES)
|
||||
install(FILES src/MESA_osfp.h DESTINATION ${CMAKE_INSTALL_PREFIX}/include/MESA COMPONENT HEADER)
|
||||
install(FILES fp.json DESTINATION /var/lib/MESA_osfp COMPONENT PROFILE)
|
||||
install(FILES src/osfp.h DESTINATION ${CMAKE_INSTALL_PREFIX}/include/MESA COMPONENT HEADER)
|
||||
install(FILES fp.json DESTINATION /var/lib/libosfp COMPONENT PROFILE)
|
||||
|
||||
add_executable(${lib_name}_sample example/sample.c)
|
||||
target_link_libraries(${lib_name}_sample ${lib_name}_shared)
|
||||
@@ -73,7 +73,7 @@ target_link_libraries(${lib_name}_test ${lib_name}_static)
|
||||
|
||||
enable_testing()
|
||||
|
||||
add_test(NAME sample COMMAND MESA_osfp_sample)
|
||||
add_test(NAME test COMMAND MESA_osfp_test -f ../fp.json -t ../data.json)
|
||||
add_test(NAME sample COMMAND ${lib_name}_sample)
|
||||
add_test(NAME test COMMAND ${lib_name}_test -f ../fp.json -t ../data.json)
|
||||
|
||||
include(Package)
|
||||
|
||||
@@ -13,7 +13,7 @@ yum install -y ./build/*.rpm
|
||||
|
||||
## library usage
|
||||
```
|
||||
gcc -I./src example/sample.c -o sample -L./build -lMESA_osfp; cat example/sample.c
|
||||
gcc -I./src example/sample.c -o sample -L./build -losfp; cat example/sample.c
|
||||
LD_LIBRARY_PATH=${PWD}/build ./sample
|
||||
```
|
||||
|
||||
@@ -21,5 +21,5 @@ LD_LIBRARY_PATH=${PWD}/build ./sample
|
||||
|
||||
```
|
||||
# load the fingerprint file and capture on eth0, filter tcp port 8888
|
||||
./build/MESA_osfp_example -f /var/lib/MESA_osfp/fp.json -i eth0 "tcp port 8888"
|
||||
./build/osfp_example -f /var/lib/libosfp/fp.json -i eth0 "tcp port 8888"
|
||||
```
|
||||
|
||||
14
autogen.sh
14
autogen.sh
@@ -1,14 +0,0 @@
|
||||
#!/bin/sh
|
||||
# Run this to generate all the initial makefiles, etc.
|
||||
if which libtoolize > /dev/null; then
|
||||
echo "Found libtoolize"
|
||||
libtoolize -c
|
||||
elif which glibtoolize > /dev/null; then
|
||||
echo "Found glibtoolize"
|
||||
glibtoolize -c
|
||||
else
|
||||
echo "Failed to find libtoolize or glibtoolize, please ensure it is installed and accessible via your PATH env variable"
|
||||
exit 1
|
||||
fi;
|
||||
autoreconf -ifv || exit 1
|
||||
echo "You can now run \"./configure\" and then \"make\"."
|
||||
@@ -10,7 +10,7 @@
|
||||
#include <pcap.h>
|
||||
|
||||
#include "osfp_common.h"
|
||||
#include "MESA_osfp.h"
|
||||
#include "osfp.h"
|
||||
#include "osfp_log.h"
|
||||
#include "osfp_fingerprint.h"
|
||||
#include "osfp_score_db.h"
|
||||
@@ -450,9 +450,9 @@ void example_detect(struct osfp_db *osfp_db, Packet *p)
|
||||
|
||||
osfp_profile_get_cycle(c1);
|
||||
if (iph) {
|
||||
result = MESA_osfp_ipv4_identify(osfp_db, iph, tcph, tcph_len);
|
||||
result = osfp_ipv4_identify(osfp_db, iph, tcph, tcph_len);
|
||||
} else if (ip6h) {
|
||||
result = MESA_osfp_ipv6_identify(osfp_db, ip6h, tcph, tcph_len);
|
||||
result = osfp_ipv6_identify(osfp_db, ip6h, tcph, tcph_len);
|
||||
} else {
|
||||
goto exit;
|
||||
}
|
||||
@@ -469,19 +469,19 @@ void example_detect(struct osfp_db *osfp_db, Packet *p)
|
||||
|
||||
result_os_count[result->likely_os_class]++;
|
||||
|
||||
char *json = MESA_osfp_result_score_detail_export(result);
|
||||
char *json = osfp_result_score_detail_export(result);
|
||||
|
||||
if (1) {
|
||||
printf("Example ipv4 header detect: --------------------------\n");
|
||||
printf("Connection info: %s:%d -> %s:%d\n", p->srcip, p->sp, p->dstip, p->dp);
|
||||
printf("Most likely os class: %s\n", MESA_osfp_result_os_name_get(result));
|
||||
printf("Most likely os class: %s\n", osfp_result_os_name_get(result));
|
||||
printf("Details:\n");
|
||||
printf("%s\n", json);
|
||||
}
|
||||
|
||||
exit:
|
||||
if (result) {
|
||||
MESA_osfp_result_free(result);
|
||||
osfp_result_free(result);
|
||||
}
|
||||
return;
|
||||
}
|
||||
@@ -670,7 +670,7 @@ int main(int argc, char *argv[])
|
||||
|
||||
osfp_profile_set(1);
|
||||
|
||||
struct osfp_db *osfp_db = MESA_osfp_db_new(fp_file_path);
|
||||
struct osfp_db *osfp_db = osfp_db_new(fp_file_path);
|
||||
if (osfp_db == NULL) {
|
||||
printf("could not create osfp context. fingerprints file: %s\n", fp_file_path);
|
||||
exit(1);
|
||||
@@ -686,7 +686,7 @@ int main(int argc, char *argv[])
|
||||
}
|
||||
|
||||
// destroy osfp db
|
||||
MESA_osfp_db_free(osfp_db);
|
||||
osfp_db_free(osfp_db);
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
#include "stdio.h"
|
||||
#include "MESA_osfp.h"
|
||||
#include "osfp.h"
|
||||
|
||||
char iph[] = {
|
||||
0x45, 0x00, 0x00, 0x34, 0x51, 0xc4, 0x40, 0x00,
|
||||
@@ -22,14 +22,14 @@ int main(int argc, char **argv)
|
||||
struct tcphdr *l4_hdr = (struct tcphdr *)tcph;
|
||||
size_t l4_hdr_len = sizeof(tcph);
|
||||
|
||||
struct osfp_db *db = MESA_osfp_db_new(json_file_path);
|
||||
struct osfp_db *db = osfp_db_new(json_file_path);
|
||||
if (db) {
|
||||
struct osfp_result *result = MESA_osfp_ipv4_identify(db, l3_hdr, l4_hdr, l4_hdr_len);
|
||||
struct osfp_result *result = osfp_ipv4_identify(db, l3_hdr, l4_hdr, l4_hdr_len);
|
||||
if (result) {
|
||||
printf("likely os: %s\n", MESA_osfp_result_os_name_get(result));
|
||||
printf("details: \n%s\n", MESA_osfp_result_score_detail_export(result));
|
||||
MESA_osfp_result_free(result);
|
||||
printf("likely os: %s\n", osfp_result_os_name_get(result));
|
||||
printf("details: \n%s\n", osfp_result_score_detail_export(result));
|
||||
osfp_result_free(result);
|
||||
}
|
||||
MESA_osfp_db_free(db);
|
||||
osfp_db_free(db);
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1,4 +0,0 @@
|
||||
prefix=@prefix@
|
||||
exec_prefix=@exec_prefix@
|
||||
libdir=@libdir@
|
||||
includedir=@includedir@
|
||||
@@ -1,6 +1,6 @@
|
||||
#include "osfp_common.h"
|
||||
|
||||
#include "MESA_osfp.h"
|
||||
#include "osfp.h"
|
||||
#include "osfp_fingerprint.h"
|
||||
#include "osfp_score_db.h"
|
||||
#include "osfp_log.h"
|
||||
@@ -70,7 +70,7 @@ exit:
|
||||
return NULL;
|
||||
}
|
||||
|
||||
const char *MESA_osfp_result_os_name_get(struct osfp_result *result)
|
||||
const char *osfp_result_os_name_get(struct osfp_result *result)
|
||||
{
|
||||
enum osfp_os_class_id os_class;
|
||||
|
||||
@@ -86,7 +86,7 @@ const char *MESA_osfp_result_os_name_get(struct osfp_result *result)
|
||||
return osfp_os_class_id_to_name(os_class);
|
||||
}
|
||||
|
||||
char *MESA_osfp_result_score_detail_export(struct osfp_result *result)
|
||||
char *osfp_result_score_detail_export(struct osfp_result *result)
|
||||
{
|
||||
int i;
|
||||
char *result_str = NULL;
|
||||
@@ -150,7 +150,7 @@ exit:
|
||||
return result_str;
|
||||
}
|
||||
|
||||
void MESA_osfp_result_free(struct osfp_result *result)
|
||||
void osfp_result_free(struct osfp_result *result)
|
||||
{
|
||||
if (result) {
|
||||
if (result->json_str) {
|
||||
@@ -160,7 +160,7 @@ void MESA_osfp_result_free(struct osfp_result *result)
|
||||
}
|
||||
}
|
||||
|
||||
struct osfp_result *MESA_osfp_ipv4_identify(struct osfp_db *db, struct iphdr* l3_hdr, struct tcphdr *l4_hdr, size_t l4_hdr_len)
|
||||
struct osfp_result *osfp_ipv4_identify(struct osfp_db *db, struct iphdr* l3_hdr, struct tcphdr *l4_hdr, size_t l4_hdr_len)
|
||||
{
|
||||
int ret = OSFP_EINVAL;
|
||||
struct osfp_fingerprint fp;
|
||||
@@ -203,7 +203,7 @@ exit:
|
||||
return NULL;
|
||||
}
|
||||
|
||||
struct osfp_result *MESA_osfp_ipv6_identify(struct osfp_db *db, struct ip6_hdr* l3_hdr, struct tcphdr *l4_hdr, size_t l4_hdr_len)
|
||||
struct osfp_result *osfp_ipv6_identify(struct osfp_db *db, struct ip6_hdr* l3_hdr, struct tcphdr *l4_hdr, size_t l4_hdr_len)
|
||||
{
|
||||
int ret = OSFP_EINVAL;
|
||||
struct osfp_fingerprint fp;
|
||||
@@ -234,7 +234,7 @@ exit:
|
||||
return NULL;
|
||||
}
|
||||
|
||||
struct osfp_result *MESA_osfp_json_identify(struct osfp_db *db, const char *json_str)
|
||||
struct osfp_result *osfp_json_identify(struct osfp_db *db, const char *json_str)
|
||||
{
|
||||
int ret = OSFP_EINVAL;
|
||||
struct osfp_fingerprint fp;
|
||||
@@ -265,7 +265,7 @@ exit:
|
||||
return NULL;
|
||||
}
|
||||
|
||||
struct osfp_db *MESA_osfp_db_new(const char *db_json_file)
|
||||
struct osfp_db *osfp_db_new(const char *db_json_file)
|
||||
{
|
||||
int ret;
|
||||
struct osfp_db *db;
|
||||
@@ -299,12 +299,12 @@ struct osfp_db *MESA_osfp_db_new(const char *db_json_file)
|
||||
return db;
|
||||
exit:
|
||||
if (db) {
|
||||
MESA_osfp_db_free(db);
|
||||
osfp_db_free(db);
|
||||
}
|
||||
return NULL;
|
||||
}
|
||||
|
||||
void MESA_osfp_db_free(struct osfp_db *db)
|
||||
void osfp_db_free(struct osfp_db *db)
|
||||
{
|
||||
if (db) {
|
||||
if (db->db_json_path) {
|
||||
@@ -23,14 +23,14 @@ struct osfp_db;
|
||||
* @param db_json_path 操作系统指纹库 JSON 文件的路径。
|
||||
* @return 指向新创建的操作系统指纹库的指针。
|
||||
*/
|
||||
struct osfp_db *MESA_osfp_db_new(const char *db_json_path);
|
||||
struct osfp_db *osfp_db_new(const char *db_json_path);
|
||||
|
||||
/**
|
||||
* @brief 释放操作系统指纹库占用的内存。
|
||||
*
|
||||
* @param db 指向要释放的操作系统指纹库的指针。
|
||||
*/
|
||||
void MESA_osfp_db_free(struct osfp_db *db);
|
||||
void osfp_db_free(struct osfp_db *db);
|
||||
|
||||
/**
|
||||
* @brief 通过 IPv4 头部和 TCP 头部识别操作系统。
|
||||
@@ -41,7 +41,7 @@ void MESA_osfp_db_free(struct osfp_db *db);
|
||||
* @param l4_hdr_len TCP 头部的长度(注意:包含TCP选项部分)。
|
||||
* @return 指向操作系统识别结果的指针。
|
||||
*/
|
||||
struct osfp_result *MESA_osfp_ipv4_identify(struct osfp_db *db, struct iphdr* l3_hdr, struct tcphdr *l4_hdr, size_t l4_hdr_len);
|
||||
struct osfp_result *osfp_ipv4_identify(struct osfp_db *db, struct iphdr* l3_hdr, struct tcphdr *l4_hdr, size_t l4_hdr_len);
|
||||
|
||||
/**
|
||||
* @brief 通过 IPv6 头部和 TCP 头部识别操作系统。
|
||||
@@ -52,7 +52,7 @@ struct osfp_result *MESA_osfp_ipv4_identify(struct osfp_db *db, struct iphdr* l3
|
||||
* @param l4_hdr_len TCP 头部的长度(注意:包含TCP选项部分)。
|
||||
* @return 指向操作系统识别结果的指针(注意:内存需要使用者释放)。
|
||||
*/
|
||||
struct osfp_result *MESA_osfp_ipv6_identify(struct osfp_db *db, struct ip6_hdr* l3_hdr, struct tcphdr *l4_hdr, size_t l4_hdr_len);
|
||||
struct osfp_result *osfp_ipv6_identify(struct osfp_db *db, struct ip6_hdr* l3_hdr, struct tcphdr *l4_hdr, size_t l4_hdr_len);
|
||||
|
||||
/**
|
||||
* @brief 通过 json 格式的指纹识别操作系统。
|
||||
@@ -61,7 +61,7 @@ struct osfp_result *MESA_osfp_ipv6_identify(struct osfp_db *db, struct ip6_hdr*
|
||||
* @param json_str 指纹字符串。
|
||||
* @return 指向操作系统识别结果的指针(注意:内存需要使用者释放)。
|
||||
*/
|
||||
struct osfp_result *MESA_osfp_json_identify(struct osfp_db *db, const char *json_str);
|
||||
struct osfp_result *osfp_json_identify(struct osfp_db *db, const char *json_str);
|
||||
|
||||
/**
|
||||
* @brief 获取操作系统识别结果的操作系统名称。
|
||||
@@ -69,7 +69,7 @@ struct osfp_result *MESA_osfp_json_identify(struct osfp_db *db, const char *json
|
||||
* @param result 操作系统识别结果。
|
||||
* @return 指向操作系统名称的常量字符指针(注意:这块内存将由osfp_result_free释放)。
|
||||
*/
|
||||
const char *MESA_osfp_result_os_name_get(struct osfp_result *result);
|
||||
const char *osfp_result_os_name_get(struct osfp_result *result);
|
||||
|
||||
/**
|
||||
* @brief 导出操作系统识别结果的得分详情。
|
||||
@@ -77,14 +77,14 @@ const char *MESA_osfp_result_os_name_get(struct osfp_result *result);
|
||||
* @param result 操作系统识别结果。
|
||||
* @return 指向得分详情字符串的指针(注意:内存需要使用者释放)。
|
||||
*/
|
||||
char *MESA_osfp_result_score_detail_export(struct osfp_result *result);
|
||||
char *osfp_result_score_detail_export(struct osfp_result *result);
|
||||
|
||||
/**
|
||||
* @brief 释放操作系统识别结果占用的内存。
|
||||
*
|
||||
* @param result 操作系统识别结果。
|
||||
*/
|
||||
void MESA_osfp_result_free(struct osfp_result *result);
|
||||
void osfp_result_free(struct osfp_result *result);
|
||||
|
||||
#ifdef __cplusplus
|
||||
}
|
||||
@@ -1,6 +1,6 @@
|
||||
#include "osfp_common.h"
|
||||
|
||||
#include "MESA_osfp.h"
|
||||
#include "osfp.h"
|
||||
|
||||
unsigned int osfp_profile_enable;
|
||||
|
||||
|
||||
@@ -21,6 +21,8 @@
|
||||
|
||||
#include "cJSON.h"
|
||||
|
||||
#include "osfp.h"
|
||||
|
||||
static inline unsigned long long osfp_rdtsc(void)
|
||||
{
|
||||
union {
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
#include "osfp_common.h"
|
||||
|
||||
#include "MESA_osfp.h"
|
||||
#include "osfp.h"
|
||||
#include "osfp_fingerprint.h"
|
||||
#include "osfp_log.h"
|
||||
|
||||
@@ -40,10 +40,44 @@ struct osfp_fingerprint_field fp_fields[OSFP_FIELD_MAX] = {
|
||||
{OSFP_FINGERPRINT_FIELD_NAME_TCP_FLAGS, 1, OSFP_FIELD_TYPE_UINT, 25, NULL, 0},
|
||||
{OSFP_FINGERPRINT_FIELD_NAME_TCP_MSS, 1, OSFP_FIELD_TYPE_UINT, 150, NULL, 0},
|
||||
{OSFP_FINGERPRINT_FIELD_NAME_TCP_OPTIONS, 1, OSFP_FIELD_TYPE_STRING, 400, NULL, 0},
|
||||
{OSFP_FINGERPRINT_FIELD_NAME_TCP_OPTIONS_ORDERED, 0, OSFP_FIELD_TYPE_STRING, 250, NULL, 0},
|
||||
{OSFP_FINGERPRINT_FIELD_NAME_TCP_OPTIONS_ORDERED, 1, OSFP_FIELD_TYPE_STRING, 250, NULL, 0},
|
||||
{OSFP_FINGERPRINT_FIELD_NAME_OS, 0, OSFP_FIELD_TYPE_STRING, 0, NULL, 0},
|
||||
};
|
||||
|
||||
|
||||
static char *osfp_fingerprint_tcp_options_to_ordered(char *tcp_options, unsigned int len)
|
||||
{
|
||||
int i;
|
||||
char *tcp_options_ordered;
|
||||
unsigned tcp_options_ordered_offset;
|
||||
unsigned tcp_options_offset;
|
||||
|
||||
if (tcp_options == NULL && len == 0) {
|
||||
goto exit;
|
||||
}
|
||||
|
||||
tcp_options_ordered = malloc(len + 1);
|
||||
if (tcp_options_ordered == NULL) {
|
||||
goto exit;
|
||||
}
|
||||
|
||||
tcp_options_offset = 0;
|
||||
tcp_options_ordered_offset = 0;
|
||||
while(tcp_options_offset < len) {
|
||||
if (isalpha(tcp_options[tcp_options_offset])) {
|
||||
tcp_options_ordered[tcp_options_ordered_offset] = tcp_options[tcp_options_offset];
|
||||
tcp_options_ordered_offset++;
|
||||
}
|
||||
tcp_options_offset++;
|
||||
}
|
||||
|
||||
tcp_options_ordered[tcp_options_ordered_offset] = 0;
|
||||
|
||||
return tcp_options_ordered;
|
||||
exit:
|
||||
return NULL;
|
||||
}
|
||||
|
||||
static char option_to_ascii(unsigned char type)
|
||||
{
|
||||
switch (type) {
|
||||
@@ -392,6 +426,19 @@ int osfp_fingerprint_from_json(struct osfp_fingerprint *fp, char *json_str)
|
||||
goto exit;
|
||||
}
|
||||
|
||||
field = cJSON_GetObjectItem(root, osfp_fingerprint_get_field_name(OSFP_FIELD_TCP_OPTIONS_ORDERED));
|
||||
if (field == NULL) {
|
||||
field = cJSON_GetObjectItem(root, osfp_fingerprint_get_field_name(OSFP_FIELD_TCP_OPTIONS));
|
||||
if (field) {
|
||||
char *tcp_options_ordered_str = osfp_fingerprint_tcp_options_to_ordered(field->valuestring, strlen(field->valuestring));
|
||||
if (tcp_options_ordered_str) {
|
||||
cJSON_AddItemToObject(root, osfp_fingerprint_get_field_name(OSFP_FIELD_TCP_OPTIONS_ORDERED),
|
||||
cJSON_CreateString(tcp_options_ordered_str));
|
||||
free(tcp_options_ordered_str);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
for (i = 0; i < OSFP_FIELD_OS; i++) {
|
||||
if (!fp_fields[i].enabled) {
|
||||
continue;
|
||||
@@ -421,8 +468,11 @@ int osfp_fingerprint_from_json(struct osfp_fingerprint *fp, char *json_str)
|
||||
}
|
||||
}
|
||||
|
||||
return 0;
|
||||
ret = 0;
|
||||
exit:
|
||||
if (root) {
|
||||
cJSON_Delete(root);
|
||||
}
|
||||
return ret;
|
||||
}
|
||||
|
||||
@@ -494,6 +544,7 @@ int test_osfp_fingerprinting_ipv4(void)
|
||||
goto exit;
|
||||
}
|
||||
|
||||
ret = -1;
|
||||
if (0 != memcmp(str_buf, target, strlen(target))) {
|
||||
goto exit;
|
||||
}
|
||||
@@ -533,6 +584,7 @@ int test_osfp_fingerprinting_ipv6(void)
|
||||
goto exit;
|
||||
}
|
||||
|
||||
ret = -1;
|
||||
if (0 != memcmp(str_buf, target, strlen(target))) {
|
||||
goto exit;
|
||||
}
|
||||
@@ -561,6 +613,7 @@ int test_osfp_fingerprinting_tcp_option(void)
|
||||
goto exit;
|
||||
}
|
||||
|
||||
ret = -1;
|
||||
if (fp.fields[OSFP_FIELD_TCP_OPTIONS].value_len != strlen(target_options) + 1)
|
||||
{
|
||||
goto exit;
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
#include "osfp_common.h"
|
||||
|
||||
#include "MESA_osfp.h"
|
||||
#include "osfp.h"
|
||||
#include "osfp_fingerprint.h"
|
||||
#include "osfp_score_db.h"
|
||||
#include "osfp_log.h"
|
||||
@@ -373,7 +373,7 @@ int osfp_score_db_load(struct osfp_score_db *score_db, char *fp_file)
|
||||
|
||||
for (i = 0; i < OSFP_FIELD_MAX; i++) {
|
||||
field_score_db = &score_db->field_score_dbs[i];
|
||||
if (field_score_db->enabled && i != OSFP_FIELD_TCP_OPTIONS) {
|
||||
if (field_score_db->enabled && i != OSFP_FIELD_TCP_OPTIONS_ORDERED) {
|
||||
score_db->perfect_score += osfp_fingerprint_get_field_importance(i);
|
||||
}
|
||||
}
|
||||
@@ -447,6 +447,11 @@ int osfp_score_db_score(struct osfp_score_db *score_db, unsigned int flags, stru
|
||||
result_score->scores[j] += ((OSFP_PERCENTILE * importance / perfect_score) * tmp_score) / entry_count;
|
||||
}
|
||||
}
|
||||
|
||||
if (i == OSFP_FIELD_TCP_OPTIONS) {
|
||||
// if OSFP_FIELD_TCP_OPTIONS matched OSFP_FIELD_TCP_OPTIONS_ORDERED is not needed
|
||||
i++;
|
||||
}
|
||||
}
|
||||
|
||||
return OSFP_NOERR;
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
#ifndef __OSFP_SCORE_DB_H__
|
||||
#define __OSFP_SCORE_DB_H__
|
||||
|
||||
#include "osfp.h"
|
||||
#include "osfp_fingerprint.h"
|
||||
#include "osfp_common.h"
|
||||
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
{
|
||||
global: MESA_osfp*;GIT_VERSION_*;
|
||||
global: osfp*;GIT_VERSION_*;
|
||||
local: *;
|
||||
};
|
||||
|
||||
124
test/test.c
124
test/test.c
@@ -6,7 +6,7 @@
|
||||
|
||||
#include "cJSON.h"
|
||||
|
||||
#include "MESA_osfp.h"
|
||||
#include "osfp.h"
|
||||
#include "osfp_fingerprint.h"
|
||||
#include "osfp_score_db.h"
|
||||
#include "osfp_log.h"
|
||||
@@ -18,6 +18,9 @@
|
||||
#define TEST_FILE_PATH "./test.json"
|
||||
#define LOG_FILE_PATH "./osfp_test.log"
|
||||
|
||||
#define OSFP_OS_CLASS_MERGED_MAX (OSFP_OS_CLASS_MAX - 2)
|
||||
#define EntryWidth 8
|
||||
|
||||
unsigned char *data_file_path = DATA_FILE_PATH;
|
||||
unsigned char *db_file_path;
|
||||
unsigned char *test_file_path;
|
||||
@@ -29,6 +32,101 @@ FILE *log_file_ptr;
|
||||
|
||||
unsigned int debug_enable;
|
||||
|
||||
//enum osfp_os_class_id {
|
||||
// OSFP_OS_CLASS_UNKNOWN, // 未知
|
||||
// OSFP_OS_CLASS_WINDOWS, // Windows
|
||||
// OSFP_OS_CLASS_LINUX, // Linux
|
||||
// OSFP_OS_CLASS_MAC_OS, // Mac OS
|
||||
// OSFP_OS_CLASS_IOS, // iOS
|
||||
// OSFP_OS_CLASS_ANDROID, // Android
|
||||
// OSFP_OS_CLASS_OTHERS, // 其他
|
||||
// OSFP_OS_CLASS_MAX,
|
||||
//};
|
||||
// merged classes: unknown 0 windows-like 1 unix-like 2 apple-like 3 others 4
|
||||
|
||||
unsigned int testresult[OSFP_OS_CLASS_MAX][OSFP_OS_CLASS_MAX] = {0};
|
||||
unsigned int testresult_merged[OSFP_OS_CLASS_MERGED_MAX][OSFP_OS_CLASS_MERGED_MAX] = {0};
|
||||
|
||||
static const char *class_to_merged_name(unsigned int class)
|
||||
{
|
||||
switch (class) {
|
||||
case 0:
|
||||
return "Unknown";
|
||||
case 1:
|
||||
return "Windows-Like";
|
||||
case 2:
|
||||
return "Unix-Like";
|
||||
case 3:
|
||||
return "Apple-Like";
|
||||
case 4:
|
||||
return "Others";
|
||||
}
|
||||
return NULL;
|
||||
}
|
||||
static unsigned int class_to_merged_class(unsigned int class)
|
||||
{
|
||||
switch (class) {
|
||||
case OSFP_OS_CLASS_UNKNOWN:
|
||||
return 0;
|
||||
case OSFP_OS_CLASS_WINDOWS:
|
||||
return 1;
|
||||
case OSFP_OS_CLASS_LINUX:
|
||||
return 2;
|
||||
case OSFP_OS_CLASS_MAC_OS:
|
||||
return 3;
|
||||
case OSFP_OS_CLASS_IOS:
|
||||
return 3;
|
||||
case OSFP_OS_CLASS_ANDROID:
|
||||
return 2;
|
||||
case OSFP_OS_CLASS_OTHERS:
|
||||
return 4;
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
|
||||
static void testresult_class_merge()
|
||||
{
|
||||
int i,j;
|
||||
for (i = 0; i < OSFP_OS_CLASS_MAX; i++) {
|
||||
for (j = 0; j < OSFP_OS_CLASS_MAX; j++) {
|
||||
testresult_merged[class_to_merged_class(i)][class_to_merged_class(j)] += testresult[i][j];
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
static void print_confusion_matrix(unsigned int *result, unsigned int os_class_max, const char *(*get_name)(unsigned int))
|
||||
{
|
||||
int i,j;
|
||||
int matched = 0, missed = 0;
|
||||
|
||||
for (i = 0; i < os_class_max; i++) {
|
||||
printf("%*s(%c)", EntryWidth-3, " ", 'a' + i);
|
||||
}
|
||||
printf(" <-" " classified as" "\n");
|
||||
|
||||
for (i = 0; i < os_class_max; i++) {
|
||||
printf("%*.*s", EntryWidth, EntryWidth-2, "----------");
|
||||
}
|
||||
|
||||
printf("\n");
|
||||
|
||||
|
||||
for (i = 0; i < os_class_max; i++) {
|
||||
for (j = 0; j < os_class_max; j++) {
|
||||
if (i == j) {
|
||||
matched += *(result + os_class_max * i + j);
|
||||
} else {
|
||||
missed += *(result + os_class_max * i + j);
|
||||
}
|
||||
printf(" %*d", EntryWidth-1, *(result + os_class_max * i + j));
|
||||
}
|
||||
printf(" (%c): " "class" " %s\n", 'a' + i, get_name(i));
|
||||
}
|
||||
|
||||
printf("miss rate: %u%%\n", 100 * missed / (matched + missed));
|
||||
}
|
||||
|
||||
|
||||
void test_data_prepare()
|
||||
{
|
||||
char *file_buffer;
|
||||
@@ -105,7 +203,7 @@ void test_miss_rate()
|
||||
osfp_log_level_set(OSFP_LOG_LEVEL_DEBUG);
|
||||
}
|
||||
|
||||
struct osfp_db *osfp_db = MESA_osfp_db_new(db_file_path);
|
||||
struct osfp_db *osfp_db = osfp_db_new(db_file_path);
|
||||
if (osfp_db == NULL) {
|
||||
printf("could not create osfp context. fingerprints file: %s\n", db_file_path);
|
||||
exit(1);
|
||||
@@ -123,15 +221,17 @@ void test_miss_rate()
|
||||
|
||||
const char *fp_str = cJSON_PrintUnformatted(entry);
|
||||
|
||||
struct osfp_result *result = MESA_osfp_json_identify(osfp_db, fp_str);
|
||||
struct osfp_result *result = osfp_json_identify(osfp_db, fp_str);
|
||||
if (result == NULL) {
|
||||
identify_failed_count++;
|
||||
continue;
|
||||
}
|
||||
|
||||
testresult[result->likely_os_class][os_class]++;
|
||||
|
||||
if (os_class == result->likely_os_class) {
|
||||
verified_count++;
|
||||
MESA_osfp_result_free(result);
|
||||
osfp_result_free(result);
|
||||
continue;
|
||||
}
|
||||
|
||||
@@ -145,27 +245,33 @@ void test_miss_rate()
|
||||
unknown_count++;
|
||||
}
|
||||
|
||||
fprintf(log_file_ptr, "expect: %s, result: %s\n", os_class_json->valuestring, MESA_osfp_result_os_name_get(result));
|
||||
fprintf(log_file_ptr, "expect: %s, result: %s\n", os_class_json->valuestring, osfp_result_os_name_get(result));
|
||||
|
||||
char *result_json = MESA_osfp_result_score_detail_export(result);
|
||||
char *result_json = osfp_result_score_detail_export(result);
|
||||
if (result_json) {
|
||||
fprintf(log_file_ptr, "%s\n", result_json);
|
||||
} else {
|
||||
fprintf(log_file_ptr, "result detail error:%p\n", result);
|
||||
}
|
||||
fflush(log_file_ptr);
|
||||
MESA_osfp_result_free(result);
|
||||
osfp_result_free(result);
|
||||
}
|
||||
}
|
||||
|
||||
printf("total %u, failed %u, pass %u, wrong %u, other %u, unknown %u\n",
|
||||
fingerprint_count, identify_failed_count, verified_count, wrong_count, other_count, unknown_count);
|
||||
|
||||
printf("miss rate: %d%%\n", 100 - (verified_count * 100 / fingerprint_count));
|
||||
//printf("miss rate: %d%%\n", 100 - (verified_count * 100 / fingerprint_count));
|
||||
|
||||
testresult_class_merge();
|
||||
|
||||
print_confusion_matrix((unsigned int *)testresult, OSFP_OS_CLASS_MAX, osfp_os_class_id_to_name);
|
||||
|
||||
print_confusion_matrix((unsigned int *)testresult_merged, OSFP_OS_CLASS_MERGED_MAX, class_to_merged_name);
|
||||
|
||||
printf("details in: %s\n", LOG_FILE_PATH);
|
||||
|
||||
MESA_osfp_db_free(osfp_db);
|
||||
osfp_db_free(osfp_db);
|
||||
}
|
||||
|
||||
int main(int argc, char **argv)
|
||||
|
||||
Reference in New Issue
Block a user