zhuzhenjun-libosfp/src/osfp.c

#include "osfp_common.h"

#include "osfp.h"
#include "osfp_fingerprint.h"
#include "osfp_score_db.h"
#include "osfp_log.h"

#define OSFP_DEFAULT_RESULT_BUFLEN_MAX  512
#define OSFP_LOWEST_SCORE_LIMIT 20

static struct osfp_result *osfp_result_build(struct osfp_os_class_score *os_class_score)
{
    int i;
    unsigned int tmp_score;
    unsigned int sum_score;
    unsigned int likely_score;
    enum osfp_os_class_id likely_os_class;
    struct osfp_result *result;

    result = calloc(1, sizeof(struct osfp_result));
    if (result == NULL) {
        goto exit;
    }

    likely_score = 0;
    likely_os_class = OSFP_OS_CLASS_OTHERS;
    sum_score = 0;

    for (i = 0; i < OSFP_OS_CLASS_MAX; i++) {
        tmp_score = os_class_score->scores[i];

        if (likely_score < tmp_score) {
            likely_score = tmp_score;
            likely_os_class = i;
        }
        result->details[i].score = tmp_score;
        sum_score += tmp_score;
    }

    if (sum_score) {
        for (i = 0; i < OSFP_OS_CLASS_MAX; i++) {
            result->details[i].possibility = OSFP_PERCENTILE * result->details[i].score / sum_score;
        }
    }

    if (likely_score < OSFP_LOWEST_SCORE_LIMIT) {
        likely_os_class = OSFP_OS_CLASS_OTHERS;
    } else {
        for (i = 0; i < OSFP_OS_CLASS_MAX; i++) {
            if (likely_os_class == i) {
                continue;
            }
            if (likely_score == os_class_score->scores[i]) {
                if (likely_os_class == OSFP_OS_CLASS_LINUX && i == OSFP_OS_CLASS_ANDROID) {
                    continue;
                } else if (likely_os_class == OSFP_OS_CLASS_MAC_OS && i == OSFP_OS_CLASS_IOS) {
                    continue;
                } else {
                    likely_os_class = OSFP_OS_CLASS_UNKNOWN;
                    break;
                }
            }
        }
    }

    result->likely_os_class = likely_os_class;

    return result;
exit:
    return NULL;
}

const char *osfp_result_os_name_get(struct osfp_result *result)
{
    enum osfp_os_class_id os_class;

    if (result == NULL) {
        return NULL;
    }

    os_class = result->likely_os_class;
    if (os_class < 0 || os_class >= OSFP_OS_CLASS_MAX) {
        return NULL;
    }

    return osfp_os_class_id_to_name(os_class);
}

char *osfp_result_score_detail_export(struct osfp_result *result)
{
    int i;
    char *result_str = NULL;
    cJSON *root = NULL;
    cJSON *array;
    cJSON *os_score;

    if (result == NULL) {
        goto exit;
    }

    if (result->json_str != NULL) {
        result_str = result->json_str;
        goto exit;
    }

    root = cJSON_CreateObject();
    if (root == NULL) {
        goto exit;
    }

    os_score = cJSON_AddObjectToObject(root, "likely");
    if (os_score) {
        cJSON_AddStringToObject(os_score, "name", osfp_os_class_id_to_name(result->likely_os_class));
        cJSON_AddNumberToObject(os_score, "score", result->details[result->likely_os_class].score);
        //cJSON_AddNumberToObject(os_score, "possibility", result->details[result->likely_os_class].possibility);
    }

    array = cJSON_AddArrayToObject(root, "details");
    if (array) {
        for (i = OSFP_OS_CLASS_WINDOWS; i < OSFP_OS_CLASS_OTHERS; i++) {
            os_score = cJSON_CreateObject();
            if (os_score) {
                cJSON_AddStringToObject(os_score, "name", osfp_os_class_id_to_name(i));
                cJSON_AddNumberToObject(os_score, "score", result->details[i].score);
                //cJSON_AddNumberToObject(os_score, "possibility", result->details[i].possibility);
                cJSON_AddItemToArray(array, os_score);
            }
        }
    }

    result_str = cJSON_Print(root);
    if (result_str == NULL) {
        goto exit;
    }

    result->json_str = result_str;

exit:
    if (root) {
        cJSON_Delete(root);
    }
    return result_str;
}

void osfp_result_free(struct osfp_result *result)
{
    if (result) {
        if (result->json_str) {
            free(result->json_str);
        }
        free(result);
    }
}

struct osfp_result *osfp_ipv4_identify(struct osfp_db *db, struct iphdr* l3_hdr, struct tcphdr *l4_hdr, size_t l4_hdr_len)
{
    int ret = OSFP_EINVAL;
    struct osfp_fingerprint fp;
    struct osfp_os_class_score os_class_score;
    struct osfp_result *result;

    if (db == NULL || l3_hdr == NULL || l4_hdr == NULL || l4_hdr == 0) {
        goto exit;
    }

    ret = osfp_fingerprinting((unsigned char *)l3_hdr, (unsigned char *)l4_hdr, (unsigned int)l4_hdr_len, &fp, 4);
    if (ret != 0) {
        goto exit;
    }

    ret = osfp_score_db_score(db->score_db, 0, &fp, &os_class_score);
    if (ret != 0) {
        goto exit;
    }

    result = osfp_result_build(&os_class_score);
    if (result == NULL) {
        goto exit;
    }

    return result;
exit:
    return NULL;
}

struct osfp_result *osfp_ipv6_identify(struct osfp_db *db, struct ipv6hdr* l3_hdr, struct tcphdr *l4_hdr, size_t l4_hdr_len)
{
    int ret = OSFP_EINVAL;
    struct osfp_fingerprint fp;
    struct osfp_os_class_score os_class_score;
    struct osfp_result *result;

    if (db == NULL || l3_hdr == NULL || l4_hdr == NULL) {
        goto exit;
    }

    ret = osfp_fingerprinting((unsigned char *)l3_hdr, (unsigned char *)l4_hdr, (unsigned int)l4_hdr_len, &fp, 6);
    if (ret != 0) {
        goto exit;
    }

    ret = osfp_score_db_score(db->score_db, 0, &fp, &os_class_score);
    if (ret != 0) {
        goto exit;
    }

    result = osfp_result_build(&os_class_score);
    if (result == NULL) {
        goto exit;
    }

    return result;
exit:
    return NULL;
}

struct osfp_result *osfp_json_identify(struct osfp_db *db, const char *json_str)
{
    int ret = OSFP_EINVAL;
    struct osfp_fingerprint fp;
    struct osfp_os_class_score os_class_score;
    struct osfp_result *result;

    if (db == NULL) {
        goto exit;
    }

    ret = osfp_fingerprint_from_json(&fp, json_str);
    if (ret != 0) {
        goto exit;
    }

    ret = osfp_score_db_score(db->score_db, 0, &fp, &os_class_score);
    if (ret != 0) {
        goto exit;
    }

    result = osfp_result_build(&os_class_score);
    if (result == NULL) {
        goto exit;
    }

    return result;
exit:
    return NULL;
}

struct osfp_db *osfp_db_new(const char *db_json_file)
{
    int ret;
    struct osfp_db *db;

    db = calloc(1, sizeof(struct osfp_db));
    if (db == NULL) {
        goto exit;
    }

    if (db_json_file != NULL) {
        if (0 != access(db_json_file, R_OK)) {
            goto exit;
        }

        db->db_json_path = strdup((const char*)db_json_file);
        if (db->db_json_path == NULL) {
            goto exit;
        }
    }

    db->score_db = (void *)osfp_score_db_create();
    if (db->score_db == NULL) {
        goto exit;
    }

    ret = osfp_score_db_load((struct osfp_score_db *)db->score_db, db->db_json_path);
    if (ret != 0) {
        goto exit;
    }

    return db;
exit:
    if (db) {
        osfp_db_free(db);
    }
    return NULL;
}

void osfp_db_free(struct osfp_db *db)
{
    if (db) {
        if (db->db_json_path) {
            free(db->db_json_path);
        }
        if (db->score_db) {
            osfp_score_db_destroy(db->score_db);
        }
        free(db);
    }
}