Skip to content

HTTPS clone URL

Subversion checkout URL

You can clone with
or
.
Download ZIP
Browse files

p0f-3.00b

sha1: 573f956484be72448a1e7042d5c58deefbb6d48c  p0f-3.00b.tgz
  • Loading branch information...
commit 154ff59a62ca17c3bad1d4d6088bc627a0db9fc3 1 parent 4b4d1f3
@lcamtuf lcamtuf authored majek committed
Showing with 10,455 additions and 7,040 deletions.
  1. +0 −60 Build
  2. +11 −23 Makefile
  3. +1 −1  README
  4. +0 −106 WIN32-Code/getopt.c
  5. +0 −8 WIN32-Code/getopt.h
  6. BIN  WIN32-Prj/p0f.NET.ncb
  7. +0 −21 WIN32-Prj/p0f.NET.sln
  8. BIN  WIN32-Prj/p0f.NET.suo
  9. +0 −218 WIN32-Prj/p0f.NET.vcproj
  10. +0 −137 WIN32-Prj/p0f.dsp
  11. +0 −29 WIN32-Prj/p0f.dsw
  12. BIN  WIN32-Prj/p0f.ncb
  13. BIN  WIN32-Prj/p0f.opt
  14. +0 −27 WIN32-Prj/p0f.plg
  15. +485 −0 alloc-inl.h
  16. +105 −0 api.c
  17. +79 −0 api.h
  18. +355 −0 build.sh
  19. +225 −67 config.h
  20. +0 −89 crc32.c
  21. +0 −18 crc32.h
  22. +54 −0 debug.h
  23. +0 −66 doc/CREDITS
  24. +0 −220 doc/ChangeLog
  25. +0 −59 doc/INSTALL.Win32
  26. +0 −12 doc/KNOWN_BUGS
  27. +0 −1,018 doc/README
  28. +0 −25 doc/TODO
  29. +0 −129 doc/win-memleak.txt
  30. 0  {doc → docs}/COPYING
  31. +36 −0 docs/ChangeLog
  32. +906 −0 docs/README
  33. +26 −0 docs/TODO
  34. +29 −0 docs/existential-notes.txt
  35. +27 −0 docs/extra-sigs.txt
  36. +1,410 −0 fp_http.c
  37. +104 −0 fp_http.h
  38. +92 −0 fp_mtu.c
  39. +34 −0 fp_mtu.h
  40. +1,334 −0 fp_tcp.c
  41. +95 −0 fp_tcp.h
  42. +0 −62 fpentry.h
  43. +77 −0 hash.h
  44. +282 −0 languages.h
  45. +0 −49 mk/AIX
  46. +0 −57 mk/CYGWIN
  47. +0 −1  mk/Darwin
  48. +0 −1  mk/FreeBSD
  49. +0 −55 mk/Linux
  50. +0 −1  mk/NetBSD
  51. +0 −1  mk/OpenBSD
  52. +0 −46 mk/SunOS
  53. +0 −69 mtu.h
  54. +0 −278 p0f-query.c
  55. +0 −108 p0f-query.h
  56. +0 −279 p0f.1
  57. +843 −1,502 p0f.c
  58. +769 −758 p0f.fp
  59. +47 −0 p0f.h
  60. +0 −208 p0fa.fp
  61. +0 −48 p0fo.fp
  62. +0 −193 p0fr.fp
  63. +0 −58 p0frep
  64. +1,536 −0 process.c
  65. +216 −0 process.h
  66. +450 −0 readfp.c
  67. +41 −0 readfp.h
  68. +130 −58 tcp.h
  69. +0 −91 test/p0fping.c
  70. +0 −115 test/p0fq.c
  71. +0 −55 test/p0fq.pl
  72. +0 −135 test/sendack.c
  73. +0 −138 test/sendack2.c
  74. +0 −137 test/sendsyn.c
  75. +0 −12 test/tryid
  76. +0 −4 tmp/README
  77. +0 −15 tmp/ack_set
  78. +0 −21 tmp/ack_set2
  79. +0 −6 tmp/ack_set3
  80. +0 −8 tmp/badly_broken_linux
  81. +0 −4 tmp/extra_opts
  82. +0 −7 tmp/extra_opts2
  83. +0 −5 tmp/extra_opts3
  84. +0 −10 tmp/strange_opts
  85. +0 −7 tmp/strange_ttl
  86. +0 −15 tmp/tstamp_set
  87. +18 −0 tools/Makefile
  88. +13 −0 tools/README-TOOLS
  89. +210 −0 tools/p0f-client.c
  90. +185 −0 tools/p0f-sendsyn.c
  91. +198 −0 tools/p0f-sendsyn6.c
  92. +0 −69 tos.h
  93. +32 −21 types.h
View
60 Build
@@ -1,60 +0,0 @@
-#!/bin/sh
-#
-# p0f - main build script
-# -----------------------
-#
-# This script determines OS name and checks for the appropriate
-# makefile in mk/.
-#
-# (C) Copyright 2000-2006 by Michal Zalewski <lcamtuf@coredump.cx>
-#
-
-
-SYSTEM=`uname -s 2>/dev/null`
-
-test "$SYSTEM" = "" && SYSTEM="unknown"
-test -f /lib/libcygwin.a && SYSTEM=CYGWIN
-
-echo "Your system type is: $SYSTEM"
-
-if [ ! -f mk/$SYSTEM ]; then
- echo
- echo "This system is not currently supported. You can try to compile the"
- echo "program by trying one of the other supported options:"
- echo
- cd mk
- ls | cat
- echo
- echo "To do so, type 'make -f mk/XXX' or 'gmake -f mk/XXX', where XXX is the"
- echo "name of the system you have selected (case sensitive). If you manage to"
- echo "successfully compile the program, please let us know!"
- echo
- exit 1
-fi
-
-GMAKE_OK=`which gmake 2>/dev/null`
-
-USE_BPF="pcap-bpf.h"
-
-if [ ! -f "/usr/include/$USE_BPF" -a ! -f "/usr/local/include/$USE_BPF" ]; then
- USE_BPF="net/bpf.h"
-fi
-
-export USE_BPF
-
-echo
-echo "Please help with p0f 2:"
-echo " http://lcamtuf.coredump.cx/p0f-help/ "
-echo
-
-if [ ! -x "$GMAKE_OK" ]; then
- echo "GNU make not found; failing back to regular (BSD?) make."
- exec make -f mk/$SYSTEM "$@"
-else
- echo "GNU make found at $GMAKE_OK, trying to use it..."
- exec gmake -f mk/$SYSTEM "$@"
-fi
-
-echo "Error: failed to execute gmake or make."
-
-exit 1
View
34 Makefile
@@ -1,33 +1,21 @@
#
-# p0f - dummy makefile
-# --------------------
+# p0f - make wrapper
+# ------------------
#
-# Just for convenience.
-#
-# (C) Copyright 2000-2006 by Michal Zalewski <lcamtuf@coredump.cx>
+# Copyright (C) 2012 by Michal Zalewski <lcamtuf@coredump.cx>
+#
+# Distributed under the terms and conditions of GNU LGPL.
#
-all:
- ./Build $@
+all:
+ @./build.sh all
-static:
- ./Build $@
+debug:
+ @./build.sh debug
clean:
- ./Build $@
+ @./build.sh clean
publish:
- ./Build $@
-
-p0fq:
- ./Build $@
-
-p0fping:
- ./Build $@
-
-tools:
- ./Build $@
-
-install:
- ./Build $@
+ @./build.sh publish
View
2  README
View
106 WIN32-Code/getopt.c
@@ -1,106 +0,0 @@
-#include <stdio.h> /* for EOF */
-#include <string.h> /* for strchr() */
-
-#include "getopt.h"
-
-/* static (global) variables that are specified as exported by getopt() */
-char *optarg = NULL; /* pointer to the start of the option argument */
-int optind = 1; /* number of the next argv[] to be evaluated */
-int opterr = 1; /* non-zero if a question mark should be returned
- when a non-valid option character is detected */
-
-int getopt(int argc, char *argv[], char *opstring)
-{
- static char *pIndexPosition = NULL; /* place inside current argv string */
- char *pArgString = NULL; /* where to start from next */
- char *pOptString; /* the string in our program */
-
-
- if (pIndexPosition != NULL) {
- /* we last left off inside an argv string */
- if (*(++pIndexPosition)) {
- /* there is more to come in the most recent argv */
- pArgString = pIndexPosition;
- }
- }
-
- if (pArgString == NULL) {
- /* we didn't leave off in the middle of an argv string */
- if (optind >= argc) {
- /* more command-line arguments than the argument count */
- pIndexPosition = NULL; /* not in the middle of anything */
- return EOF; /* used up all command-line arguments */
- }
-
- /*---------------------------------------------------------------------
- * If the next argv[] is not an option, there can be no more options.
- *-------------------------------------------------------------------*/
- pArgString = argv[optind++]; /* set this to the next argument ptr */
-
- if (('/' != *pArgString) && /* doesn't start with a slash or a dash? */
- ('-' != *pArgString)) {
- --optind; /* point to current arg once we're done */
- optarg = NULL; /* no argument follows the option */
- pIndexPosition = NULL; /* not in the middle of anything */
- return EOF; /* used up all the command-line flags */
- }
-
- /* check for special end-of-flags markers */
- if ((strcmp(pArgString, "-") == 0) ||
- (strcmp(pArgString, "--") == 0)) {
- optarg = NULL; /* no argument follows the option */
- pIndexPosition = NULL; /* not in the middle of anything */
- return EOF; /* encountered the special flag */
- }
-
- pArgString++; /* look past the / or - */
- }
-
- if (':' == *pArgString) { /* is it a colon? */
- /*---------------------------------------------------------------------
- * Rare case: if opterr is non-zero, return a question mark;
- * otherwise, just return the colon we're on.
- *-------------------------------------------------------------------*/
- return (opterr ? (int)'?' : (int)':');
- }
- else if ((pOptString = strchr(opstring, *pArgString)) == 0) {
- /*---------------------------------------------------------------------
- * The letter on the command-line wasn't any good.
- *-------------------------------------------------------------------*/
- optarg = NULL; /* no argument follows the option */
- pIndexPosition = NULL; /* not in the middle of anything */
- return (opterr ? (int)'?' : (int)*pArgString);
- }
- else {
- /*---------------------------------------------------------------------
- * The letter on the command-line matches one we expect to see
- *-------------------------------------------------------------------*/
- if (':' == _next_char(pOptString)) { /* is the next letter a colon? */
- /* It is a colon. Look for an argument string. */
- if ('\0' != _next_char(pArgString)) { /* argument in this argv? */
- optarg = &pArgString[1]; /* Yes, it is */
- }
- else {
- /*-------------------------------------------------------------
- * The argument string must be in the next argv.
- * But, what if there is none (bad input from the user)?
- * In that case, return the letter, and optarg as NULL.
- *-----------------------------------------------------------*/
- if (optind < argc)
- optarg = argv[optind++];
- else {
- optarg = NULL;
- return (opterr ? (int)'?' : (int)*pArgString);
- }
- }
-
- pIndexPosition = NULL; /* not in the middle of anything */
- }
- else {
- /* it's not a colon, so just return the letter */
- optarg = NULL; /* no argument follows the option */
- pIndexPosition = pArgString; /* point to the letter we're on */
- }
- return (int)*pArgString; /* return the letter that matched */
- }
-}
View
8 WIN32-Code/getopt.h
@@ -1,8 +0,0 @@
-
-#define _next_char(string) (char)(*(string+1))
-
-extern char * optarg;
-extern int optind;
-
-int getopt(int, char**, char*);
-
View
BIN  WIN32-Prj/p0f.NET.ncb
Binary file not shown
View
21 WIN32-Prj/p0f.NET.sln
@@ -1,21 +0,0 @@
-Microsoft Visual Studio Solution File, Format Version 8.00
-Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "p0f", "p0f.NET.vcproj", "{AF72F57C-D302-40E6-9859-1F98A123F6EE}"
- ProjectSection(ProjectDependencies) = postProject
- EndProjectSection
-EndProject
-Global
- GlobalSection(SolutionConfiguration) = preSolution
- Debug = Debug
- Release = Release
- EndGlobalSection
- GlobalSection(ProjectConfiguration) = postSolution
- {AF72F57C-D302-40E6-9859-1F98A123F6EE}.Debug.ActiveCfg = Debug|Win32
- {AF72F57C-D302-40E6-9859-1F98A123F6EE}.Debug.Build.0 = Debug|Win32
- {AF72F57C-D302-40E6-9859-1F98A123F6EE}.Release.ActiveCfg = Release|Win32
- {AF72F57C-D302-40E6-9859-1F98A123F6EE}.Release.Build.0 = Release|Win32
- EndGlobalSection
- GlobalSection(ExtensibilityGlobals) = postSolution
- EndGlobalSection
- GlobalSection(ExtensibilityAddIns) = postSolution
- EndGlobalSection
-EndGlobal
View
BIN  WIN32-Prj/p0f.NET.suo
Binary file not shown
View
218 WIN32-Prj/p0f.NET.vcproj
@@ -1,218 +0,0 @@
-<?xml version="1.0" encoding="Windows-1252"?>
-<VisualStudioProject
- ProjectType="Visual C++"
- Version="7.10"
- Name="p0f"
- SccProjectName=""
- SccLocalPath="">
- <Platforms>
- <Platform
- Name="Win32"/>
- </Platforms>
- <Configurations>
- <Configuration
- Name="Debug|Win32"
- OutputDirectory=".\Debug"
- IntermediateDirectory=".\Debug"
- ConfigurationType="1"
- UseOfMFC="0"
- ATLMinimizesCRunTimeLibraryUsage="FALSE"
- CharacterSet="2">
- <Tool
- Name="VCCLCompilerTool"
- Optimization="0"
- AdditionalIncludeDirectories="..\,..\WIN32-Code,..\..\Wpdpack\include"
- PreprocessorDefinitions="WIN32;_DEBUG;_CONSOLE"
- BasicRuntimeChecks="3"
- RuntimeLibrary="5"
- UsePrecompiledHeader="2"
- PrecompiledHeaderFile=".\Debug/p0f.NET.pch"
- AssemblerListingLocation=".\Debug/"
- ObjectFile=".\Debug/"
- ProgramDataBaseFileName=".\Debug/"
- WarningLevel="3"
- SuppressStartupBanner="TRUE"
- DebugInformationFormat="4"
- CompileAs="0"/>
- <Tool
- Name="VCCustomBuildTool"/>
- <Tool
- Name="VCLinkerTool"
- AdditionalDependencies="ws2_32.lib ..\..\WPdpack\Lib\wpcap.lib Advapi32.lib"
- OutputFile=".\Debug/p0f.NET.exe"
- LinkIncremental="1"
- SuppressStartupBanner="TRUE"
- GenerateDebugInformation="TRUE"
- ProgramDatabaseFile=".\Debug/p0f.NET.pdb"
- SubSystem="1"
- TargetMachine="1"/>
- <Tool
- Name="VCMIDLTool"
- TypeLibraryName=".\Debug/p0f.NET.tlb"
- HeaderFileName=""/>
- <Tool
- Name="VCPostBuildEventTool"/>
- <Tool
- Name="VCPreBuildEventTool"/>
- <Tool
- Name="VCPreLinkEventTool"/>
- <Tool
- Name="VCResourceCompilerTool"
- PreprocessorDefinitions="_DEBUG"
- Culture="1033"/>
- <Tool
- Name="VCWebServiceProxyGeneratorTool"/>
- <Tool
- Name="VCXMLDataGeneratorTool"/>
- <Tool
- Name="VCWebDeploymentTool"/>
- <Tool
- Name="VCManagedWrapperGeneratorTool"/>
- <Tool
- Name="VCAuxiliaryManagedWrapperGeneratorTool"/>
- </Configuration>
- <Configuration
- Name="Release|Win32"
- OutputDirectory=".\Release"
- IntermediateDirectory=".\Release"
- ConfigurationType="1"
- UseOfMFC="0"
- ATLMinimizesCRunTimeLibraryUsage="FALSE"
- CharacterSet="2">
- <Tool
- Name="VCCLCompilerTool"
- Optimization="2"
- InlineFunctionExpansion="1"
- AdditionalIncludeDirectories=""
- PreprocessorDefinitions="WIN32;NDEBUG;_CONSOLE"
- StringPooling="TRUE"
- RuntimeLibrary="4"
- EnableFunctionLevelLinking="TRUE"
- UsePrecompiledHeader="2"
- PrecompiledHeaderFile=".\Release/p0f.NET.pch"
- AssemblerListingLocation=".\Release/"
- ObjectFile=".\Release/"
- ProgramDataBaseFileName=".\Release/"
- WarningLevel="4"
- SuppressStartupBanner="TRUE"
- CompileAs="0"/>
- <Tool
- Name="VCCustomBuildTool"/>
- <Tool
- Name="VCLinkerTool"
- AdditionalDependencies="ws2_32.lib Advapi32.lib"
- OutputFile=".\Release/p0f.NET.exe"
- LinkIncremental="1"
- SuppressStartupBanner="TRUE"
- ProgramDatabaseFile=".\Release/p0f.NET.pdb"
- SubSystem="1"
- TargetMachine="1"/>
- <Tool
- Name="VCMIDLTool"
- TypeLibraryName=".\Release/p0f.NET.tlb"
- HeaderFileName=""/>
- <Tool
- Name="VCPostBuildEventTool"/>
- <Tool
- Name="VCPreBuildEventTool"/>
- <Tool
- Name="VCPreLinkEventTool"/>
- <Tool
- Name="VCResourceCompilerTool"
- PreprocessorDefinitions="NDEBUG"
- Culture="1033"/>
- <Tool
- Name="VCWebServiceProxyGeneratorTool"/>
- <Tool
- Name="VCXMLDataGeneratorTool"/>
- <Tool
- Name="VCWebDeploymentTool"/>
- <Tool
- Name="VCManagedWrapperGeneratorTool"/>
- <Tool
- Name="VCAuxiliaryManagedWrapperGeneratorTool"/>
- </Configuration>
- </Configurations>
- <References>
- </References>
- <Files>
- <Filter
- Name="Source Files"
- Filter="cpp;c;cxx;rc;def;r;odl;idl;hpj;bat">
- <File
- RelativePath="..\WIN32-Code\getopt.c">
- <FileConfiguration
- Name="Debug|Win32">
- <Tool
- Name="VCCLCompilerTool"
- Optimization="0"
- AdditionalIncludeDirectories=""
- PreprocessorDefinitions=""
- BasicRuntimeChecks="3"/>
- </FileConfiguration>
- <FileConfiguration
- Name="Release|Win32">
- <Tool
- Name="VCCLCompilerTool"
- Optimization="2"
- AdditionalIncludeDirectories=""
- PreprocessorDefinitions=""/>
- </FileConfiguration>
- </File>
- <File
- RelativePath="..\p0f-query.c">
- </File>
- <File
- RelativePath="..\p0f.c">
- <FileConfiguration
- Name="Debug|Win32">
- <Tool
- Name="VCCLCompilerTool"
- Optimization="0"
- AdditionalIncludeDirectories=""
- PreprocessorDefinitions=""
- BasicRuntimeChecks="3"/>
- </FileConfiguration>
- <FileConfiguration
- Name="Release|Win32">
- <Tool
- Name="VCCLCompilerTool"
- Optimization="2"
- AdditionalIncludeDirectories=""
- PreprocessorDefinitions=""/>
- </FileConfiguration>
- </File>
- </Filter>
- <Filter
- Name="Header Files"
- Filter="h;hpp;hxx;hm;inl">
- <File
- RelativePath="..\config.h">
- </File>
- <File
- RelativePath="..\fpentry.h">
- </File>
- <File
- RelativePath="..\WIN32-Code\getopt.h">
- </File>
- <File
- RelativePath="..\mtu.h">
- </File>
- <File
- RelativePath="..\p0f-query.h">
- </File>
- <File
- RelativePath="..\tcp.h">
- </File>
- <File
- RelativePath="..\types.h">
- </File>
- </Filter>
- <Filter
- Name="Resource Files"
- Filter="ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe">
- </Filter>
- </Files>
- <Globals>
- </Globals>
-</VisualStudioProject>
View
137 WIN32-Prj/p0f.dsp
@@ -1,137 +0,0 @@
-# Microsoft Developer Studio Project File - Name="p0f" - Package Owner=<4>
-# Microsoft Developer Studio Generated Build File, Format Version 6.00
-# ** DO NOT EDIT **
-
-# TARGTYPE "Win32 (x86) Console Application" 0x0103
-
-CFG=p0f - Win32 Debug
-!MESSAGE This is not a valid makefile. To build this project using NMAKE,
-!MESSAGE use the Export Makefile command and run
-!MESSAGE
-!MESSAGE NMAKE /f "p0f.mak".
-!MESSAGE
-!MESSAGE You can specify a configuration when running NMAKE
-!MESSAGE by defining the macro CFG on the command line. For example:
-!MESSAGE
-!MESSAGE NMAKE /f "p0f.mak" CFG="p0f - Win32 Debug"
-!MESSAGE
-!MESSAGE Possible choices for configuration are:
-!MESSAGE
-!MESSAGE "p0f - Win32 Release" (based on "Win32 (x86) Console Application")
-!MESSAGE "p0f - Win32 Debug" (based on "Win32 (x86) Console Application")
-!MESSAGE
-
-# Begin Project
-# PROP AllowPerConfigDependencies 0
-# PROP Scc_ProjName ""
-# PROP Scc_LocalPath ""
-CPP=cl.exe
-RSC=rc.exe
-
-!IF "$(CFG)" == "p0f - Win32 Release"
-
-# PROP BASE Use_MFC 0
-# PROP BASE Use_Debug_Libraries 0
-# PROP BASE Output_Dir "Release"
-# PROP BASE Intermediate_Dir "Release"
-# PROP BASE Target_Dir ""
-# PROP Use_MFC 0
-# PROP Use_Debug_Libraries 0
-# PROP Output_Dir "Release"
-# PROP Intermediate_Dir "Release"
-# PROP Target_Dir ""
-# ADD BASE CPP /nologo /W3 /GX /O2 /D "WIN32" /D "NDEBUG" /D "_CONSOLE" /D "_MBCS" /YX /FD /c
-# ADD CPP /nologo /W3 /GX /O2 /I "..\\" /I "..\WIN32-Code" /I "..\..\Wpdpack\include" /D "WIN32" /D "NDEBUG" /D "_CONSOLE" /D "_MBCS" /YX /FD /c
-# ADD BASE RSC /l 0x409 /d "NDEBUG"
-# ADD RSC /l 0x409 /d "NDEBUG"
-BSC32=bscmake.exe
-# ADD BASE BSC32 /nologo
-# ADD BSC32 /nologo
-LINK32=link.exe
-# ADD BASE LINK32 kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib /nologo /subsystem:console /machine:I386
-# ADD LINK32 ws2_32.lib ..\..\WPdpack\Lib\wpcap.lib Advapi32.lib /nologo /subsystem:console /machine:I386
-
-!ELSEIF "$(CFG)" == "p0f - Win32 Debug"
-
-# PROP BASE Use_MFC 0
-# PROP BASE Use_Debug_Libraries 1
-# PROP BASE Output_Dir "Debug"
-# PROP BASE Intermediate_Dir "Debug"
-# PROP BASE Target_Dir ""
-# PROP Use_MFC 0
-# PROP Use_Debug_Libraries 1
-# PROP Output_Dir "Debug"
-# PROP Intermediate_Dir "Debug"
-# PROP Ignore_Export_Lib 0
-# PROP Target_Dir ""
-# ADD BASE CPP /nologo /W3 /Gm /GX /ZI /Od /D "WIN32" /D "_DEBUG" /D "_CONSOLE" /D "_MBCS" /YX /FD /GZ /c
-# ADD CPP /nologo /W3 /Gm /GX /ZI /Od /I "..\\" /I "..\WIN32-Code" /I "..\..\Wpdpack\include" /D "WIN32" /D "_DEBUG" /D "_CONSOLE" /D "_MBCS" /YX /FD /GZ /c
-# ADD BASE RSC /l 0x409 /d "_DEBUG"
-# ADD RSC /l 0x409 /d "_DEBUG"
-BSC32=bscmake.exe
-# ADD BASE BSC32 /nologo
-# ADD BSC32 /nologo
-LINK32=link.exe
-# ADD BASE LINK32 kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib /nologo /subsystem:console /debug /machine:I386 /pdbtype:sept
-# ADD LINK32 ws2_32.lib ..\..\WPdpack\Lib\wpcap.lib Advapi32.lib /nologo /subsystem:console /debug /machine:I386 /pdbtype:sept
-
-!ENDIF
-
-# Begin Target
-
-# Name "p0f - Win32 Release"
-# Name "p0f - Win32 Debug"
-# Begin Group "Source Files"
-
-# PROP Default_Filter "cpp;c;cxx;rc;def;r;odl;idl;hpj;bat"
-# Begin Source File
-
-SOURCE="..\WIN32-Code\getopt.c"
-# End Source File
-# Begin Source File
-
-SOURCE="..\p0f-query.c"
-# End Source File
-# Begin Source File
-
-SOURCE=..\p0f.c
-# End Source File
-# End Group
-# Begin Group "Header Files"
-
-# PROP Default_Filter "h;hpp;hxx;hm;inl"
-# Begin Source File
-
-SOURCE=..\config.h
-# End Source File
-# Begin Source File
-
-SOURCE=..\fpentry.h
-# End Source File
-# Begin Source File
-
-SOURCE="..\WIN32-Code\getopt.h"
-# End Source File
-# Begin Source File
-
-SOURCE=..\mtu.h
-# End Source File
-# Begin Source File
-
-SOURCE="..\p0f-query.h"
-# End Source File
-# Begin Source File
-
-SOURCE=..\tcp.h
-# End Source File
-# Begin Source File
-
-SOURCE=..\types.h
-# End Source File
-# End Group
-# Begin Group "Resource Files"
-
-# PROP Default_Filter "ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe"
-# End Group
-# End Target
-# End Project
View
29 WIN32-Prj/p0f.dsw
@@ -1,29 +0,0 @@
-Microsoft Developer Studio Workspace File, Format Version 6.00
-# WARNING: DO NOT EDIT OR DELETE THIS WORKSPACE FILE!
-
-###############################################################################
-
-Project: "p0f"=".\p0f.dsp" - Package Owner=<4>
-
-Package=<5>
-{{{
-}}}
-
-Package=<4>
-{{{
-}}}
-
-###############################################################################
-
-Global:
-
-Package=<5>
-{{{
-}}}
-
-Package=<3>
-{{{
-}}}
-
-###############################################################################
-
View
BIN  WIN32-Prj/p0f.ncb
Binary file not shown
View
BIN  WIN32-Prj/p0f.opt
Binary file not shown
View
27 WIN32-Prj/p0f.plg
@@ -1,27 +0,0 @@
-<html>
-<body>
-<pre>
-<h1>Build Log</h1>
-<h3>
---------------------Configuration: p0f - Win32 Release--------------------
-</h3>
-<h3>Command Lines</h3>
-Creating temporary file "D:\DOCUME~1\kkuehl\LOCALS~1\Temp\RSP49.tmp" with contents
-[
-/nologo /ML /W3 /GX /O2 /I "..\\" /I "..\WIN32-Code" /I "..\..\Wpdpack\include" /D "WIN32" /D "NDEBUG" /D "_CONSOLE" /D "_MBCS" /Fp"Release/p0f.pch" /YX /Fo"Release/" /Fd"Release/" /FD /c
-"D:\passive\p0f\p0f-query.c"
-]
-Creating command line "cl.exe @D:\DOCUME~1\kkuehl\LOCALS~1\Temp\RSP49.tmp"
-Creating command line "link.exe ws2_32.lib ..\..\WPdpack\Lib\wpcap.lib Advapi32.lib /nologo /subsystem:console /incremental:no /pdb:"Release/p0f.pdb" /machine:I386 /out:"Release/p0f.exe" ".\Release\getopt.obj" ".\Release\p0f.obj" ".\Release\p0f-query.obj" "
-<h3>Output Window</h3>
-Compiling...
-p0f-query.c
-Linking...
-
-
-
-<h3>Results</h3>
-p0f.exe - 0 error(s), 0 warning(s)
-</pre>
-</body>
-</html>
View
485 alloc-inl.h
@@ -0,0 +1,485 @@
+/*
+ p0f - error-checking, memory-zeroing alloc routines
+ ---------------------------------------------------
+
+ Copyright (C) 2012 by Michal Zalewski <lcamtuf@coredump.cx>
+
+ Distributed under the terms and conditions of GNU LGPL.
+
+ */
+
+#ifndef _HAVE_ALLOC_INL_H
+#define _HAVE_ALLOC_INL_H
+
+#include <stdlib.h>
+#include <string.h>
+
+#include "config.h"
+#include "types.h"
+#include "debug.h"
+
+#define ALLOC_CHECK_SIZE(_s) do { \
+ if ((_s) > MAX_ALLOC) \
+ ABORT("Bad alloc request: %u bytes", (_s)); \
+ } while (0)
+
+#define ALLOC_CHECK_RESULT(_r,_s) do { \
+ if (!(_r)) \
+ ABORT("Out of memory: can't allocate %u bytes", (_s)); \
+ } while (0)
+
+#define ALLOC_MAGIC 0xFF00
+#define ALLOC_MAGIC_F 0xFE00
+
+#define ALLOC_C(_ptr) (((u16*)(_ptr))[-3])
+#define ALLOC_S(_ptr) (((u32*)(_ptr))[-1])
+
+#define CHECK_PTR(_p) do { \
+ if ((_p) && ALLOC_C(_p) != ALLOC_MAGIC) {\
+ if (ALLOC_C(_p) == ALLOC_MAGIC_F) \
+ ABORT("Use after free."); \
+ else \
+ ABORT("Bad alloc canary."); \
+ } \
+ } while (0)
+
+
+#define CHECK_PTR_EXPR(_p) ({ \
+ typeof (_p) _tmp = (_p); \
+ CHECK_PTR(_tmp); \
+ _tmp; \
+ })
+
+#ifdef CHECK_UAF
+# define CP(_p) CHECK_PTR_EXPR(_p)
+#else
+# define CP(_p) (_p)
+#endif /* ^CHECK_UAF */
+
+#ifdef ALIGN_ACCESS
+# define ALLOC_OFF 8
+#else
+# define ALLOC_OFF 6
+#endif /* ^ALIGN_ACCESS */
+
+
+static inline void* DFL_ck_alloc(u32 size) {
+ void* ret;
+
+ if (!size) return NULL;
+
+ ALLOC_CHECK_SIZE(size);
+ ret = malloc(size + ALLOC_OFF);
+ ALLOC_CHECK_RESULT(ret, size);
+
+ ret += ALLOC_OFF;
+
+ ALLOC_C(ret) = ALLOC_MAGIC;
+ ALLOC_S(ret) = size;
+
+ return memset(ret, 0, size);
+}
+
+
+static inline void* DFL_ck_realloc(void* orig, u32 size) {
+ void* ret;
+ u32 old_size = 0;
+
+ if (!size) {
+
+ if (orig) {
+
+ CHECK_PTR(orig);
+
+ /* Catch pointer issues sooner. */
+
+#ifdef DEBUG_BUILD
+ memset(orig - ALLOC_OFF, 0xFF, ALLOC_S(orig) + ALLOC_OFF);
+#endif /* DEBUG_BUILD */
+
+ free(orig - ALLOC_OFF);
+
+ }
+
+ return NULL;
+
+ }
+
+ if (orig) {
+
+ CHECK_PTR(orig);
+
+#ifndef DEBUG_BUILD
+ ALLOC_C(orig) = ALLOC_MAGIC_F;
+#endif /* !DEBUG_BUILD */
+
+ old_size = ALLOC_S(orig);
+ orig -= ALLOC_OFF;
+
+ ALLOC_CHECK_SIZE(old_size);
+
+ }
+
+ ALLOC_CHECK_SIZE(size);
+
+#ifndef DEBUG_BUILD
+
+ ret = realloc(orig, size + ALLOC_OFF);
+ ALLOC_CHECK_RESULT(ret, size);
+
+#else
+
+ /* Catch pointer issues sooner: force relocation and make sure that the
+ original buffer is wiped. */
+
+ ret = malloc(size + ALLOC_OFF);
+ ALLOC_CHECK_RESULT(ret, size);
+
+ if (orig) {
+
+ memcpy(ret + ALLOC_OFF, orig + ALLOC_OFF, MIN(size, old_size));
+ memset(orig, 0xFF, old_size + ALLOC_OFF);
+
+ ALLOC_C(orig + ALLOC_OFF) = ALLOC_MAGIC_F;
+
+ free(orig);
+
+ }
+
+#endif /* ^!DEBUG_BUILD */
+
+ ret += ALLOC_OFF;
+
+ ALLOC_C(ret) = ALLOC_MAGIC;
+ ALLOC_S(ret) = size;
+
+ if (size > old_size)
+ memset(ret + old_size, 0, size - old_size);
+
+ return ret;
+}
+
+
+static inline void* DFL_ck_realloc_kb(void* orig, u32 size) {
+
+#ifndef DEBUG_BUILD
+
+ if (orig) {
+
+ CHECK_PTR(orig);
+
+ if (ALLOC_S(orig) >= size) return orig;
+
+ size = ((size >> 10) + 1) << 10;
+ }
+
+#endif /* !DEBUG_BUILD */
+
+ return DFL_ck_realloc(orig, size);
+}
+
+
+static inline u8* DFL_ck_strdup(u8* str) {
+ void* ret;
+ u32 size;
+
+ if (!str) return NULL;
+
+ size = strlen((char*)str) + 1;
+
+ ALLOC_CHECK_SIZE(size);
+ ret = malloc(size + ALLOC_OFF);
+ ALLOC_CHECK_RESULT(ret, size);
+
+ ret += ALLOC_OFF;
+
+ ALLOC_C(ret) = ALLOC_MAGIC;
+ ALLOC_S(ret) = size;
+
+ return memcpy(ret, str, size);
+}
+
+
+static inline void* DFL_ck_memdup(void* mem, u32 size) {
+ void* ret;
+
+ if (!mem || !size) return NULL;
+
+ ALLOC_CHECK_SIZE(size);
+ ret = malloc(size + ALLOC_OFF);
+ ALLOC_CHECK_RESULT(ret, size);
+
+ ret += ALLOC_OFF;
+
+ ALLOC_C(ret) = ALLOC_MAGIC;
+ ALLOC_S(ret) = size;
+
+ return memcpy(ret, mem, size);
+}
+
+
+static inline u8* DFL_ck_memdup_str(u8* mem, u32 size) {
+ u8* ret;
+
+ if (!mem || !size) return NULL;
+
+ ALLOC_CHECK_SIZE(size);
+ ret = malloc(size + ALLOC_OFF + 1);
+ ALLOC_CHECK_RESULT(ret, size);
+
+ ret += ALLOC_OFF;
+
+ ALLOC_C(ret) = ALLOC_MAGIC;
+ ALLOC_S(ret) = size;
+
+ memcpy(ret, mem, size);
+ ret[size] = 0;
+
+ return ret;
+}
+
+
+static inline void DFL_ck_free(void* mem) {
+
+ if (mem) {
+
+ CHECK_PTR(mem);
+
+#ifdef DEBUG_BUILD
+
+ /* Catch pointer issues sooner. */
+ memset(mem - ALLOC_OFF, 0xFF, ALLOC_S(mem) + ALLOC_OFF);
+
+#endif /* DEBUG_BUILD */
+
+ ALLOC_C(mem) = ALLOC_MAGIC_F;
+
+ free(mem - ALLOC_OFF);
+
+ }
+
+}
+
+#ifndef DEBUG_BUILD
+
+/* Non-debugging mode - straightforward aliasing. */
+
+#define ck_alloc DFL_ck_alloc
+#define ck_realloc DFL_ck_realloc
+#define ck_realloc_kb DFL_ck_realloc_kb
+#define ck_strdup DFL_ck_strdup
+#define ck_memdup DFL_ck_memdup
+#define ck_memdup_str DFL_ck_memdup_str
+#define ck_free DFL_ck_free
+
+#else
+
+/* Debugging mode - include additional structures and support code. */
+
+#define ALLOC_BUCKETS 4096
+#define ALLOC_TRK_CHUNK 256
+
+struct TRK_obj {
+ void *ptr;
+ char *file, *func;
+ u32 line;
+};
+
+
+extern struct TRK_obj* TRK[ALLOC_BUCKETS];
+extern u32 TRK_cnt[ALLOC_BUCKETS];
+
+#define TRKH(_ptr) (((((u32)(_ptr)) >> 16) ^ ((u32)(_ptr))) % ALLOC_BUCKETS)
+
+/* Adds a new entry to the list of allocated objects. */
+
+static inline void TRK_alloc_buf(void* ptr, const char* file, const char* func,
+ u32 line) {
+
+ u32 i, bucket;
+
+ if (!ptr) return;
+
+ bucket = TRKH(ptr);
+
+ for (i = 0; i < TRK_cnt[bucket]; i++)
+
+ if (!TRK[bucket][i].ptr) {
+
+ TRK[bucket][i].ptr = ptr;
+ TRK[bucket][i].file = (char*)file;
+ TRK[bucket][i].func = (char*)func;
+ TRK[bucket][i].line = line;
+ return;
+
+ }
+
+ /* No space available. */
+
+ if (!(i % ALLOC_TRK_CHUNK)) {
+
+ TRK[bucket] = DFL_ck_realloc(TRK[bucket],
+ TRK_cnt[bucket] + ALLOC_TRK_CHUNK);
+
+ }
+
+ TRK[bucket][i].ptr = ptr;
+ TRK[bucket][i].file = (char*)file;
+ TRK[bucket][i].func = (char*)func;
+ TRK[bucket][i].line = line;
+
+ TRK_cnt[bucket]++;
+
+}
+
+
+/* Removes entry from the list of allocated objects. */
+
+static inline void TRK_free_buf(void* ptr, const char* file, const char* func,
+ u32 line) {
+
+ u32 i, bucket;
+
+ if (!ptr) return;
+
+ bucket = TRKH(ptr);
+
+ for (i = 0; i < TRK_cnt[bucket]; i++)
+
+ if (TRK[bucket][i].ptr == ptr) {
+
+ TRK[bucket][i].ptr = 0;
+ return;
+
+ }
+
+ WARN("ALLOC: Attempt to free non-allocated memory in %s (%s:%u)",
+ func, file, line);
+
+}
+
+
+/* Does a final report on all non-deallocated objects. */
+
+static inline void TRK_report(void) {
+
+ u32 i, bucket;
+
+ fflush(0);
+
+ for (bucket = 0; bucket < ALLOC_BUCKETS; bucket++)
+ for (i = 0; i < TRK_cnt[bucket]; i++)
+ if (TRK[bucket][i].ptr)
+ WARN("ALLOC: Memory never freed, created in %s (%s:%u)",
+ TRK[bucket][i].func, TRK[bucket][i].file, TRK[bucket][i].line);
+
+}
+
+
+/* Simple wrappers for non-debugging functions: */
+
+static inline void* TRK_ck_alloc(u32 size, const char* file, const char* func,
+ u32 line) {
+
+ void* ret = DFL_ck_alloc(size);
+ TRK_alloc_buf(ret, file, func, line);
+ return ret;
+
+}
+
+
+static inline void* TRK_ck_realloc(void* orig, u32 size, const char* file,
+ const char* func, u32 line) {
+
+ void* ret = DFL_ck_realloc(orig, size);
+ TRK_free_buf(orig, file, func, line);
+ TRK_alloc_buf(ret, file, func, line);
+ return ret;
+
+}
+
+
+static inline void* TRK_ck_realloc_kb(void* orig, u32 size, const char* file,
+ const char* func, u32 line) {
+
+ void* ret = DFL_ck_realloc_kb(orig, size);
+ TRK_free_buf(orig, file, func, line);
+ TRK_alloc_buf(ret, file, func, line);
+ return ret;
+
+}
+
+
+static inline void* TRK_ck_strdup(u8* str, const char* file, const char* func,
+ u32 line) {
+
+ void* ret = DFL_ck_strdup(str);
+ TRK_alloc_buf(ret, file, func, line);
+ return ret;
+
+}
+
+
+static inline void* TRK_ck_memdup(void* mem, u32 size, const char* file,
+ const char* func, u32 line) {
+
+ void* ret = DFL_ck_memdup(mem, size);
+ TRK_alloc_buf(ret, file, func, line);
+ return ret;
+
+}
+
+
+static inline void* TRK_ck_memdup_str(void* mem, u32 size, const char* file,
+ const char* func, u32 line) {
+
+ void* ret = DFL_ck_memdup_str(mem, size);
+ TRK_alloc_buf(ret, file, func, line);
+ return ret;
+
+}
+
+
+static inline void TRK_ck_free(void* ptr, const char* file,
+ const char* func, u32 line) {
+
+ TRK_free_buf(ptr, file, func, line);
+ DFL_ck_free(ptr);
+
+}
+
+/* Alias user-facing names to tracking functions: */
+
+#define ck_alloc(_p1) \
+ TRK_ck_alloc(_p1, __FILE__, __FUNCTION__, __LINE__)
+
+#define ck_realloc(_p1, _p2) \
+ TRK_ck_realloc(_p1, _p2, __FILE__, __FUNCTION__, __LINE__)
+
+#define ck_realloc_kb(_p1, _p2) \
+ TRK_ck_realloc_kb(_p1, _p2, __FILE__, __FUNCTION__, __LINE__)
+
+#define ck_strdup(_p1) \
+ TRK_ck_strdup(_p1, __FILE__, __FUNCTION__, __LINE__)
+
+#define ck_memdup(_p1, _p2) \
+ TRK_ck_memdup(_p1, _p2, __FILE__, __FUNCTION__, __LINE__)
+
+#define ck_memdup_str(_p1, _p2) \
+ TRK_ck_memdup_str(_p1, _p2, __FILE__, __FUNCTION__, __LINE__)
+
+#define ck_free(_p1) \
+ TRK_ck_free(_p1, __FILE__, __FUNCTION__, __LINE__)
+
+#endif /* ^!DEBUG_BUILD */
+
+#define alloc_printf(_str...) ({ \
+ u8* _tmp; \
+ s32 _len = snprintf(NULL, 0, _str); \
+ if (_len < 0) FATAL("Whoa, snprintf() fails?!"); \
+ _tmp = ck_alloc(_len + 1); \
+ snprintf((char*)_tmp, _len + 1, _str); \
+ _tmp; \
+ })
+
+#endif /* ! _HAVE_ALLOC_INL_H */
View
105 api.c
@@ -0,0 +1,105 @@
+/*
+ p0f - API query code
+ --------------------
+
+ Copyright (C) 2012 by Michal Zalewski <lcamtuf@coredump.cx>
+
+ Distributed under the terms and conditions of GNU LGPL.
+
+ */
+
+#define _FROM_API
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+
+#include "types.h"
+#include "config.h"
+#include "debug.h"
+#include "alloc-inl.h"
+#include "p0f.h"
+#include "api.h"
+#include "process.h"
+#include "readfp.h"
+
+/* Process API queries. */
+
+void handle_query(struct p0f_api_query* q, struct p0f_api_response* r) {
+
+ struct host_data* h;
+
+ memset(r, 0, sizeof(struct p0f_api_response));
+
+ if (q->magic != P0F_QUERY_MAGIC) {
+
+ WARN("Query with bad magic (0x%x).", q->magic);
+
+ r->status = P0F_STATUS_BADQUERY;
+
+ return;
+
+ }
+
+ r->magic = P0F_RESP_MAGIC;
+
+ switch (q->addr_type) {
+
+ case P0F_ADDR_IPV4:
+ case P0F_ADDR_IPV6:
+ h = lookup_host(q->addr, q->addr_type);
+ break;
+
+ default:
+
+ WARN("Query with unknown address type %u.\n", q->addr_type);
+ r->status = P0F_STATUS_BADQUERY;
+ return;
+
+ }
+
+ if (!h) {
+ r->status = P0F_STATUS_NOMATCH;
+ return;
+ }
+
+ r->status = P0F_STATUS_OK;
+ r->first_seen = h->first_seen;
+ r->last_seen = h->last_seen;
+ r->total_conn = h->total_conn;
+
+ if (h->last_name_id != -1) {
+
+ strncpy((char*)r->os_name, (char*)fp_os_names[h->last_name_id],
+ P0F_STR_MAX + 1);
+
+ if (h->last_flavor)
+ strncpy((char*)r->os_flavor, (char*)h->last_flavor, P0F_STR_MAX + 1);
+
+ }
+
+ if (h->http_name_id != -1) {
+
+ strncpy((char*)r->http_name, (char*)fp_os_names[h->http_name_id],
+ P0F_STR_MAX + 1);
+
+ if (h->http_flavor)
+ strncpy((char*)r->http_flavor, (char*)h->http_flavor, P0F_STR_MAX + 1);
+
+ }
+
+ if (h->link_type)
+ strncpy((char*)r->link_type, (char*)h->link_type, P0F_STR_MAX + 1);
+
+ if (h->language)
+ strncpy((char*)r->language, (char*)h->language, P0F_STR_MAX + 1);
+
+ r->bad_sw = h->bad_sw;
+ r->last_nat = h->last_nat;
+ r->last_chg = h->last_chg;
+ r->up_mod_days = h->up_mod_days;
+ r->distance = h->distance;
+
+ if (h->last_up_min != -1) r->uptime_min = h->last_up_min;
+
+}
View
79 api.h
@@ -0,0 +1,79 @@
+/*
+ p0f - API query code
+ --------------------
+
+ Copyright (C) 2012 by Michal Zalewski <lcamtuf@coredump.cx>
+
+ Distributed under the terms and conditions of GNU LGPL.
+
+ */
+
+#ifndef _HAVE_API_H
+#define _HAVE_API_H
+
+#include "types.h"
+
+#define P0F_QUERY_MAGIC 0x50304601
+#define P0F_RESP_MAGIC 0x50304602
+
+#define P0F_STATUS_BADQUERY 0x00
+#define P0F_STATUS_OK 0x10
+#define P0F_STATUS_NOMATCH 0x20
+
+#define P0F_ADDR_IPV4 0x04
+#define P0F_ADDR_IPV6 0x06
+
+#define P0F_STR_MAX 31
+
+#define P0F_MATCH_FUZZY 0x01
+#define P0F_MATCH_GENERIC 0x02
+
+/* Keep these structures aligned to avoid architecture-specific padding. */
+
+struct p0f_api_query {
+
+ u32 magic; /* Must be P0F_QUERY_MAGIC */
+ u8 addr_type; /* P0F_ADDR_* */
+ u8 addr[16]; /* IP address (big endian left align) */
+
+};
+
+struct p0f_api_response {
+
+ u32 magic; /* Must be P0F_RESP_MAGIC */
+ u32 status; /* P0F_STATUS_* */
+
+ u32 first_seen; /* First seen (unix time) */
+ u32 last_seen; /* Last seen (unix time) */
+ u32 total_conn; /* Total connections seen */
+
+ u32 uptime_min; /* Last uptime (minutes) */
+ u32 up_mod_days; /* Uptime modulo (days) */
+
+ u32 last_nat; /* NAT / LB last detected (unix time) */
+ u32 last_chg; /* OS chg last detected (unix time) */
+
+ s16 distance; /* System distance */
+
+ u8 bad_sw; /* Host is lying about U-A / Server */
+ u8 os_match_q; /* Match quality */
+
+ u8 os_name[P0F_STR_MAX + 1]; /* Name of detected OS */
+ u8 os_flavor[P0F_STR_MAX + 1]; /* Flavor of detected OS */
+
+ u8 http_name[P0F_STR_MAX + 1]; /* Name of detected HTTP app */
+ u8 http_flavor[P0F_STR_MAX + 1]; /* Flavor of detected HTTP app */
+
+ u8 link_type[P0F_STR_MAX + 1]; /* Link type */
+
+ u8 language[P0F_STR_MAX + 1]; /* Language */
+
+};
+
+#ifdef _FROM_P0F
+
+void handle_query(struct p0f_api_query* q, struct p0f_api_response* r);
+
+#endif /* _FROM_API */
+
+#endif /* !_HAVE_API_H */
View
355 build.sh
@@ -0,0 +1,355 @@
+#!/bin/bash
+#
+# p0f - build script
+# ------------------
+#
+# Copyright (C) 2012 by Michal Zalewski <lcamtuf@coredump.cx>
+#
+# Distributed under the terms and conditions of GNU LGPL.
+#
+
+PROGNAME="p0f"
+VERSION="3.00b"
+
+test "$CC" = "" && CC="gcc"
+
+BASIC_CFLAGS="-Wall -Wno-format -I/usr/local/include/ \
+ -I/opt/local/include/ -DVERSION=\"$VERSION\" $CFLAGS"
+
+BASIC_LDFLAGS="-L/usr/local/lib/ -L/opt/local/lib $LDFLAGS"
+
+USE_CFLAGS="-fstack-protector-all -fPIE -D_FORTIFY_SOURCE=2 -g -ggdb \
+ $BASIC_CFLAGS"
+
+USE_LDFLAGS="-Wl,-z,relro -pie $BASIC_LDFLAGS"
+
+if [ "$OSTYPE" = "cygwin" ]; then
+ USE_LIBS="-lwpcap $LIBS"
+else
+ USE_LIBS="-lpcap $LIBS"
+fi
+
+OBJFILES="api.c process.c fp_tcp.c fp_mtu.c fp_http.c readfp.c"
+
+echo "Welcome to the build script for $PROGNAME $VERSION!"
+echo "Copyright (C) 2012 by Michal Zalewski <lcamtuf@coredump.cx>"
+echo
+
+if [ "$#" -gt "1" ]; then
+
+ echo "[-] Please specify one build target at a time."
+ exit 1
+
+fi
+
+if [ "$1" = "clean" -o "$1" = "publish" ]; then
+
+ echo "[*] Cleaning up build environment..."
+ rm -f -- "$PROGNAME" *.exe *.o a.out *~ core core.[1-9][0-9]* *.stackdump COMPILER-WARNINGS 2>/dev/null
+
+ ( cd tools && make clean ) &>/dev/null
+
+ if [ "$1" = "publish" ]; then
+
+ if [ ! "`basename -- \"$PWD\"`" = "$PROGNAME" ]; then
+ echo "[-] Invalid working directory."
+ exit 1
+ fi
+
+ if [ ! "$HOSTNAME" = "raccoon" ]; then
+ echo "[-] You are not my real dad!"
+ exit 1
+ fi
+
+ TARGET="/var/www/lcamtuf/$PROGNAME-$VERSION.tgz"
+
+ echo "[*] Creating $TARGET..."
+
+ cd ..
+ rm -rf "$PROGNAME-$VERSION"
+ cp -pr "$PROGNAME" "$PROGNAME-$VERSION"
+ tar cfvz "$TARGET" "$PROGNAME-$VERSION"
+
+ fi
+
+ echo "[+] All done!"
+
+ exit 0
+
+elif [ "$1" = "all" -o "$1" = "" ]; then
+
+ echo "[+] Configuring production build."
+ BASIC_CFLAGS="$BASIC_CFLAGS -O3"
+ USE_CFLAGS="$USE_CFLAGS -O3"
+
+elif [ "$1" = "debug" ]; then
+
+ echo "[+] Configuring debug build."
+ BASIC_CFLAGS="$BASIC_CFLAGS -DDEBUG_BUILD=1"
+ USE_CFLAGS="$USE_CFLAGS -DDEBUG_BUILD=1"
+
+else
+
+ echo "[-] Unrecognized build target '$1', sorry."
+ exit 1
+
+fi
+
+rm -f COMPILER-WARNINGS 2>/dev/null
+
+echo -n "[*] Checking for a sane build environment... "
+
+if ls -ld ./ | grep -q '^d.......w'; then
+
+ echo "FAIL (bad permissions)"
+ echo
+ echo "Duuude, don't build stuff in world-writable directories."
+ echo
+ exit 1
+
+fi
+
+TMP=".build-$$"
+
+rm -f "$TMP" 2>/dev/null
+
+if [ -f "$TMP" ]; then
+
+ echo "FAIL (can't delete)"
+ echo
+ echo "Check directory permissions and try again."
+ echo
+ exit 1
+
+fi
+
+touch "$TMP" 2>/dev/null
+
+if [ ! -f "$TMP" ]; then
+
+ echo "FAIL (can't create)"
+ echo
+ echo "Check directory permissions and try again."
+ echo
+ exit 1
+
+fi
+
+if [ ! -s "$PROGNAME.c" ]; then
+
+ echo "FAIL (no source)"
+ echo
+ echo "I'm no doctor, but I think the source code is missing from CWD."
+ echo
+ exit 1
+
+fi
+
+echo "OK"
+
+echo -n "[*] Checking for working GCC... "
+
+rm -f "$TMP" || exit 1
+
+echo "int main() { return 0; }" >"$TMP.c" || exit 1
+$CC $BASIC_CFLAGS $BASIC_LDFLAGS "$TMP.c" -o "$TMP" &>"$TMP.log"
+
+if [ ! -x "$TMP" ]; then
+
+ echo "FAIL"
+ echo
+ echo "Your compiler can't produce working binaries. You need a functioning install of"
+ echo "GCC and libc (including development headers) to continue. If you have these,"
+ echo "try setting CC, CFLAGS, and LDFLAGS appropriately."
+ echo
+ echo "Output from an attempt to execute GCC:"
+ cat "$TMP.log" | head -10
+ echo
+ rm -f "$TMP" "$TMP.log" "$TMP.c"
+ exit 1
+
+fi
+
+echo "OK"
+
+echo -n "[*] Checking for *modern* GCC... "
+
+rm -f "$TMP" "$TMP.c" "$TMP.log" || exit 1
+
+echo "int main() { return 0; }" >"$TMP.c" || exit 1
+$CC $USE_CFLAGS $USE_LDFLAGS "$TMP.c" -o "$TMP" &>"$TMP.log"
+
+if [ ! -x "$TMP" ]; then
+
+ echo "FAIL (but we can live with it)"
+ USE_CFLAGS="$BASIC_CFLAGS"
+ USE_LDFLAGS="$BASIC_LDFLAGS"
+
+else
+
+ echo "OK"
+
+fi
+
+echo -n "[*] Checking if memory alignment is required... "
+
+rm -f "$TMP" "$TMP.c" "$TMP.log" || exit 1
+
+echo -e "#include \"types.h\"\nvolatile u8 tmp[6]; int main() { printf(\"%d\x5cn\", *(u32*)(tmp+1)); return 0; }" >"$TMP.c" || exit 1
+$CC $USE_CFLAGS $USE_LDFLAGS "$TMP.c" -o "$TMP" &>"$TMP.log"
+
+if [ ! -x "$TMP" ]; then
+
+ echo "FAIL"
+ echo
+ echo "Well, something went horribly wrong, sorry. Here's the output from GCC:"
+ echo
+ cat "$TMP.log"
+ echo
+ echo "Sorry! You may want to ping <lcamtuf@coredump.cx> about this."
+ echo
+ rm -f "$TMP.log"
+ exit 1
+
+else
+
+ ulimit -c 0 &>/dev/null
+ ./"$TMP" &>/dev/null
+
+ if [ "$?" = "0" ]; then
+
+ echo "nope"
+
+ else
+
+ echo "yes"
+ USE_CFLAGS="$USE_CFLAGS -DALIGN_ACCESS=1"
+
+ fi
+
+fi
+
+
+echo -n "[*] Checking for working libpcap... "
+
+rm -f "$TMP" "$TMP.c" "$TMP.log" || exit 1
+
+echo -e "#include <pcap.h>\nint main() { char i[PCAP_ERRBUF_SIZE]; pcap_lookupdev(i); return 0; }" >"$TMP.c" || exit 1
+$CC $USE_CFLAGS $USE_LDFLAGS "$TMP.c" -o "$TMP" $USE_LIBS &>"$TMP.log"
+
+if [ ! -x "$TMP" ]; then
+ echo "FAIL"
+ echo
+
+ if [ "$OSTYPE" = "cygwin" ]; then
+
+ echo "You need a functioning install of winpcap. Download both of those:"
+ echo
+ echo " Main library : http://www.winpcap.org/install/default.htm"
+ echo " Developer tools : http://www.winpcap.org/devel.htm"
+ echo
+ echo "Under cygwin, copy the contents of wpdpack/include to /usr/include/, and"
+ echo "wpdpack/lib to /lib/. At that point, you should be able to build p0f."
+ echo
+
+ else
+
+ echo "You need a functioning installation of libpcap (including development headers)."
+ echo "You can download it from here:"
+ echo
+ echo " http://www.tcpdump.org/#latest-release"
+ echo
+
+ fi
+
+ echo "If you have the library installed at an unorthodox location, try setting CFLAGS"
+ echo "and LDFLAGS to point us in the right direction."
+ echo
+ echo "Output from an attempt to compile sample program:"
+ cat "$TMP.log" | head -10
+ echo
+ rm -f "$TMP" "$TMP.log" "$TMP.c"
+ exit 1
+
+fi
+
+echo "OK"
+
+echo -n "[*] Checking for working BPF... "
+
+rm -f "$TMP" "$TMP.c" "$TMP.log" || exit 1
+
+echo -e "#include <pcap.h>\n#include <pcap-bpf.h>\nint main() { return 0; }" >"$TMP.c" || exit 1
+$CC $USE_CFLAGS $USE_LDFLAGS "$TMP.c" -o "$TMP" $USE_LIBS &>"$TMP.log"
+
+if [ ! -x "$TMP" ]; then
+
+ rm -f "$TMP" "$TMP.c" "$TMP.log" || exit 1
+
+ echo -e "#include <pcap.h>\n#include <net/bpf.h>\nint main() { return 0; }" >"$TMP.c" || exit 1
+ $CC $USE_CFLAGS $USE_LDFLAGS "$TMP.c" -o "$TMP" $USE_LIBS &>"$TMP.log"
+
+ if [ ! -x "$TMP" ]; then
+ echo "FAIL"
+ echo
+ echo "Could not find a working version of pcap-bpf.h or net/bpf.h on your system."
+ echo "If it's available in a non-standard directory, set CFLAGS accordingly; if it"
+ echo "lives under a different name, you may need to edit the source and recompile."
+ echo
+
+ rm -f "$TMP" "$TMP.log" "$TMP.c"
+ exit 1
+
+ fi
+
+ USE_CFLAGS="$USE_CFLAGS -DNET_BPF=1"
+
+fi
+
+echo "OK"
+
+rm -f "$TMP" "$TMP.log" "$TMP.c" || exit 1
+
+echo "[+] Okay, you seem to be good to go. Fingers crossed!"
+
+echo -n "[*] Compiling $PROGNAME... "
+
+rm -f "$PROGNAME" || exit 1
+
+$CC $USE_CFLAGS $USE_LDFLAGS "$PROGNAME.c" $OBJFILES -o "$PROGNAME" $USE_LIBS &>"$TMP.log"
+
+if [ ! -x "$PROGNAME" ]; then
+
+ echo "FAIL"
+ echo
+ echo "Well, something went horribly wrong, sorry. Here's the output from GCC:"
+ echo
+ cat "$TMP.log"
+ echo
+ echo "Sorry! You may want to ping <lcamtuf@coredump.cx> about this."
+ echo
+ rm -f "$TMP.log"
+ exit 1
+
+fi
+
+if [ -s "$TMP.log" ]; then
+
+ echo "OK (see COMPILER-WARNINGS)"
+ mv "$TMP.log" COMPILER-WARNINGS
+
+ test "$1" = "debug" && cat COMPILER-WARNINGS
+
+else
+
+ rm -f "$TMP.log"
+ echo "OK"
+
+fi
+
+echo
+echo "Well, that's it. Be sure to review README. If you run into any problems, you"
+echo "can reach the author at <lcamtuf@coredump.cx>."
+echo
+
+exit 0
View
292 config.h
@@ -1,112 +1,270 @@
/*
+ p0f - vaguely configurable bits
+ -------------------------------
- p0f - configuration
- -------------------
+ Copyright (C) 2012 by Michal Zalewski <lcamtuf@coredump.cx>
- The defaults are rather sane. Be careful when changing them.
+ Distributed under the terms and conditions of GNU LGPL.
- Copyright (C) 2003-2006 by Michal Zalewski <lcamtuf@coredump.cx>
-
-*/
+ */
#ifndef _HAVE_CONFIG_H
#define _HAVE_CONFIG_H
-#define VER "2.0.8"
+#include "types.h"
+
+/********************************************
+ * Things you may reasonably want to change *
+ ********************************************/
+
+/* Default location of p0f.fp: */
+
+#ifndef FP_FILE
+# define FP_FILE "p0f.fp"
+#endif /* !FP_FILE */
+
+/* Initial permissions on log files: */
+
+#ifndef LOG_MODE
+# define LOG_MODE 0600
+#endif /* !LOG_MODE */
+
+/* Initial permissions on API sockets: */
+
+#ifndef API_MODE
+# define API_MODE 0666
+#endif /* !API_MODE */
+
+/* Default connection and host cache sizes (adjustable via -m): */
+
+#ifndef MAX_HOSTS
+# define MAX_CONN 1000
+# define MAX_HOSTS 10000
+#endif /* !MAX_HOSTS */
+
+/* Default connection and host time limits (adjustable via -t): */
+
+#ifndef HOST_IDLE_LIMIT
+# define CONN_MAX_AGE 30 /* seconds */
+# define HOST_IDLE_LIMIT 120 /* minutes */
+#endif /* !HOST_IDLE_LIMIT */
+
+/* Default number of API connections permitted (adjustable via -c): */
+
+#ifndef API_MAX_CONN
+# define API_MAX_CONN 20
+#endif /* !API_MAX_CONN */
+
+/* Maximum TTL distance for non-fuzzy signature matching: */
+
+#ifndef MAX_DIST
+# define MAX_DIST 35
+#endif /* !MAX_DIST */
+
+/* Detect use-after-free, at the expense of some performance cost: */
+
+#define CHECK_UAF 1
+
+/************************
+ * Really obscure stuff *
+ ************************/
+
+/* Maximum allocator request size (keep well under INT_MAX): */
+
+#define MAX_ALLOC 0x40000000
+
+/* Percentage of host entries / flows to prune when limits exceeded: */
+
+#define KILL_PERCENT 10
+
+/* PCAP snapshot length: */
+
+#define SNAPLEN 65535
+
+/* Maximum request, response size to keep per flow: */
+
+#define MAX_FLOW_DATA 8192
+
+/* Maximum number of TCP options we will process (< 256): */
+
+#define MAX_TCP_OPT 24
+
+/* Minimum and maximum frequency for timestamp clock (Hz). Note that RFC
+ 1323 permits 1 - 1000 Hz . At 1000 Hz, the 32-bit counter overflows
+ after about 50 days. */
+
+#define MIN_TSCALE 0.7
+#define MAX_TSCALE 1500
+
+/* Minimum and maximum interval (ms) for measuring timestamp progrssion. This
+ is used to make sure the timestamps are fresh enough to be of any value,
+ and that the measurement is not affected by network performance too
+ severely. */
+
+#define MIN_TWAIT 25
+#define MAX_TWAIT (1000 * 60 * 10)
+
+/* Time window in which to tolerate timestamps going back slightly or
+ otherwise misbehaving during NAT checks (ms): */
+
+#define TSTAMP_GRACE 100
+
+/* Maximum interval between packets used for TS-based NAT checks (ms): */
+
+#define MAX_NAT_TS (1000 * 60 * 60 * 24)
+
+/* Minimum port drop to serve as a NAT detection signal: */
+
+#define MIN_PORT_DROP 64
+
+/* Threshold before letting NAT detection make a big deal out of TTL change
+ for remote hosts (this is to account for peering changes): */
+
+#define SMALL_TTL_CHG 2
+
+/* The distance up to which the system is considered to be local, and therefore
+ the SMALL_TTL_CHG threshold should not be taken account: */
+
+#define LOCAL_TTL_LIMIT 5
+
+/* The distance past which the system is considered to be really distant,
+ and therefore, changes within SMALL_TTL_CHG should be completely ignored: */
+
+#define NEAR_TTL_LIMIT 9
+
+/* Number of packet scores to keep for NAT detection (< 256): */
-/* Paths and names to config files */
+#define NAT_SCORES 32
-#ifdef WIN32
-# define CONFIG_DIR "."
-#else
-# define CONFIG_DIR "/etc/p0f"
-#endif /* WIN32 */
+/* Number of hash buckets for p0f.fp signatures: */
-#define SYN_DB "p0f.fp"
-#define SYNACK_DB "p0fa.fp"
-#define RST_DB "p0fr.fp"
-#define OPEN_DB "p0fo.fp"
+#define SIG_BUCKETS 64
-/* Maximum number of signatures allowed in the config file */
+/* Number of hash buckets for active connections: */
-#define MAXSIGS 1024
+#define FLOW_BUCKETS 256
-/* Max signature line length */
+/* Number of hash buckets for host data: */
-#define MAXLINE 1024
+#define HOST_BUCKETS 1024
-/* Maximum distance from a host to be taken seriously. Between 35 and 64
- is sane. Making it too high might result in some (very rare) false
- positives, too low will result in needless UNKNOWNs. */
+/* Cache expiration interval (every n packets received): */
-#define MAXDIST 40
+#define EXPIRE_INTERVAL 50
-/* Maximum number of TCP packet options. Some systems really like to
- put lots of NOPs there. */
+/* Non-alphanumeric chars to permit in OS names. This is to allow 'sys' syntax
+ to be used unambiguously, yet allow some freedom: */
-#define MAXOPT 16
+#define NAME_CHARS " ./-_!?()"
-/* Max. reasonable DNS name length */
+/* Special window size and MSS used by p0f-sendsyn, and detected by p0f: */
-#define MY_MAXDNS 32
+#define SPECIAL_MSS 1331
+#define SPECIAL_WIN 1337
-/* Query cache for -S option. This is only the default. Keep it sane -
- increase this if your system gets lots of traffic and you get RESP_NOMATCH
- too often. */
+/* Maximum length of an HTTP URL line we're willing to entertain. The same
+ limit is also used for the first line of a response: */
-#define DEFAULT_QUERY_CACHE 128
+#define HTTP_MAX_URL 1024
-/* Maximum timestamp difference (hours) between two masquerade
- signatures to be considered sane; should be reasonably high, as some
- systems might be running at higher timestamp change frequencies
- than usual. */
+/* Maximum number of HTTP headers: */
-#define MAX_TIMEDIF 600
+#define HTTP_MAX_HDRS 32
-/* Packet dump - bytes per line; this is a sane setting. */
+/* Maximum length of a header name: */
-#define PKT_DLEN 16
+#define HTTP_MAX_HDR_NAME 32
-/* Display no more than PKT_MAXPAY bytes of payload in -X mode. */
+/* Maximum length of a header value: */
-#define PKT_MAXPAY 45
+#define HTTP_MAX_HDR_VAL 1024
-/* Size limit for size wildcards - see p0fr.fp for more information. */
+/* Maximum length of a header value for display purposes: */
-#define PACKET_BIG 100
+#define HTTP_MAX_SHOW 200
-/* Packet snap length. This is passed to libpcap, and should be never
- below 100 or such. Keep it reasonably low for performance reasons. */
+/* Maximum HTTP 'Date' progression jitter to overlook (s): */
-#define PACKET_SNAPLEN 200
+#define HTTP_MAX_DATE_DIFF 10
-/* Query timeout on -Q socket. You must send data QUERY_TIMEOUT seconds
- after establishing a connection. Set this to zero to disable timeouts
- (not really recommended). */
+#ifdef _FROM_FP_HTTP
-#define QUERY_TIMEOUT 2
+#include "fp_http.h"
-/* Uncomment this to give extra points for distance difference in
- masquerade detection. This is not recommended for Internet traffic,
- but a very good idea for looking at your local network. */
+/* Headers that should be tagged as optional by the HTTP fingerprinter in any
+ generated signatures: */
-// #define DIST_EXTRASCORE
+static struct http_id req_optional[] = {
+ { "Cookie", 0 },
+ { "Referer", 0 },
+ { "Origin", 0 },
+ { "Range", 0 },
+ { "If-Modified-Since", 0 },
+ { "If-None-Match", 0 },
+ { "Via", 0 },
+ { "X-Forwarded-For", 0 },
+ { "Authorization", 0 },
+ { "Proxy-Authorization", 0 },
+ { "Cache-Control", 0 },
+ { 0, 0 }
+};
-/* Uncomment this to display additional information as discussed in
- p0f.fp. This functionality is a hack and will disregard options such
- as greppable output or no details mode, so do not leave it on unless,
- well, debugging. */
+static struct http_id resp_optional[] = {
+ { "Set-Cookie", 0 },
+ { "Last-Modified", 0 },
+ { "ETag", 0 },
+ { "Content-Length", 0 },
+ { "Content-Disposition", 0 },
+ { "Cache-Control", 0 },
+ { "Expires", 0 },
+ { "Pragma", 0 },
+ { "Location", 0 },
+ { "Refresh", 0 },
+ { "Content-Range", 0 },
+ { "Vary", 0 },
+ { 0, 0 }
+};
-// #define DEBUG_EXTRAS
+/* Common headers that are expected to be present at all times, and deserve
+ a special mention if absent in a signature: */
-/* If you encounter any problems with false positives because of
- a system with random or incremental IP ID picking a zero value once
- in a while (probability under 0.002%, but always), uncomment this to
- disregard the 'Z' check in quirks section. */
+static struct http_id req_common[] = {
+ { "Host", 0 },
+ { "User-Agent", 0 },
+ { "Connection", 0 },
+ { "Accept", 0 },
+ { "Accept-Encoding", 0 },
+ { "Accept-Language", 0 },
+ { "Accept-Charset", 0 },
+ { 0, 0 }
+};
-// #define IGNORE_ZEROID
+static struct http_id resp_common[] = {
+ { "Content-Type", 0 },
+ { "Connection", 0 },
+ { "Keep-Alive", 0 },
+ { "Accept-Ranges", 0 },
+ { "Date", 0 },
+ { 0, 0 }
+};
+/* Headers for which values change depending on the context, and therefore
+ should not be included in proposed signatures. This is on top of the
+ "optional" header lists, which already implies skipping the value. */
-#define PID_PATH "/var/run/p0f.pid"
+static struct http_id req_skipval[] = {
+ { "Host", 0 },
+ { "User-Agent", 0 },
+ { 0, 0 }
+};
+
+static struct http_id resp_skipval[] = {
+ { "Date", 0 },
+ { "Content-Type", 0 },
+ { "Server", 0 },
+ { 0, 0 }
+};
+
+#endif /* _FROM_FP_HTTP */
#endif /* ! _HAVE_CONFIG_H */
View
89 crc32.c
@@ -1,89 +0,0 @@
-/*
-
- p0f - cyclic redundancy check
- -----------------------------
-
- CRC32 code. Polynomial 0x04c11db7LU.
-
- Copyright (C) 2006 by Mariusz Kozlowski <m.kozlowski@tuxland.pl>
-
- */
-
-#include "types.h"
-
-static const _u32 crc32table[] = {
- 0x00000000LU, 0x77073096LU, 0xee0e612cLU, 0x990951baLU,
- 0x076dc419LU, 0x706af48fLU, 0xe963a535LU, 0x9e6495a3LU,
- 0x0edb8832LU, 0x79dcb8a4LU, 0xe0d5e91eLU, 0x97d2d988LU,
- 0x09b64c2bLU, 0x7eb17cbdLU, 0xe7b82d07LU, 0x90bf1d91LU,
- 0x1db71064LU, 0x6ab020f2LU, 0xf3b97148LU, 0x84be41deLU,
- 0x1adad47dLU, 0x6ddde4ebLU, 0xf4d4b551LU, 0x83d385c7LU,
- 0x136c9856LU, 0x646ba8c0LU, 0xfd62f97aLU, 0x8a65c9ecLU,
- 0x14015c4fLU, 0x63066cd9LU, 0xfa0f3d63LU, 0x8d080df5LU,
- 0x3b6e20c8LU, 0x4c69105eLU, 0xd56041e4LU, 0xa2677172LU,
- 0x3c03e4d1LU, 0x4b04d447LU, 0xd20d85fdLU, 0xa50ab56bLU,
- 0x35b5a8faLU, 0x42b2986cLU, 0xdbbbc9d6LU, 0xacbcf940LU,
- 0x32d86ce3LU, 0x45df5c75LU, 0xdcd60dcfLU, 0xabd13d59LU,
- 0x26d930acLU, 0x51de003aLU, 0xc8d75180LU, 0xbfd06116LU,
- 0x21b4f4b5LU, 0x56b3c423LU, 0xcfba9599LU, 0xb8bda50fLU,
- 0x2802b89eLU, 0x5f058808LU, 0xc60cd9b2LU, 0xb10be924LU,
- 0x2f6f7c87LU, 0x58684c11LU, 0xc1611dabLU, 0xb6662d3dLU,
- 0x76dc4190LU, 0x01db7106LU, 0x98d220bcLU, 0xefd5102aLU,
- 0x71b18589LU, 0x06b6b51fLU, 0x9fbfe4a5LU, 0xe8b8d433LU,
- 0x7807c9a2LU, 0x0f00f934LU, 0x9609a88eLU, 0xe10e9818LU,
- 0x7f6a0dbbLU, 0x086d3d2dLU, 0x91646c97LU, 0xe6635c01LU,
- 0x6b6b51f4LU, 0x1c6c6162LU, 0x856530d8LU, 0xf262004eLU,
- 0x6c0695edLU, 0x1b01a57bLU, 0x8208f4c1LU, 0xf50fc457LU,
- 0x65b0d9c6LU, 0x12b7e950LU, 0x8bbeb8eaLU, 0xfcb9887cLU,
- 0x62dd1ddfLU, 0x15da2d49LU, 0x8cd37cf3LU, 0xfbd44c65LU,
- 0x4db26158LU, 0x3ab551ceLU, 0xa3bc0074LU, 0xd4bb30e2LU,
- 0x4adfa541LU, 0x3dd895d7LU, 0xa4d1c46dLU, 0xd3d6f4fbLU,
- 0x4369e96aLU, 0x346ed9fcLU, 0xad678846LU, 0xda60b8d0LU,
- 0x44042d73LU, 0x33031de5LU, 0xaa0a4c5fLU, 0xdd0d7cc9LU,
- 0x5005713cLU, 0x270241aaLU, 0xbe0b1010LU, 0xc90c2086LU,
- 0x5768b525LU, 0x206f85b3LU, 0xb966d409LU, 0xce61e49fLU,
- 0x5edef90eLU, 0x29d9c998LU, 0xb0d09822LU, 0xc7d7a8b4LU,
- 0x59b33d17LU, 0x2eb40d81LU, 0xb7bd5c3bLU, 0xc0ba6cadLU,
- 0xedb88320LU, 0x9abfb3b6LU, 0x03b6e20cLU, 0x74b1d29aLU,
- 0xead54739LU, 0x9dd277afLU, 0x04db2615LU, 0x73dc1683LU,
- 0xe3630b12LU, 0x94643b84LU, 0x0d6d6a3eLU, 0x7a6a5aa8LU,
- 0xe40ecf0bLU, 0x9309ff9dLU, 0x0a00ae27LU, 0x7d079eb1LU,
- 0xf00f9344LU, 0x8708a3d2LU, 0x1e01f268LU, 0x6906c2feLU,
- 0xf762575dLU, 0x806567cbLU, 0x196c3671LU, 0x6e6b06e7LU,
- 0xfed41b76LU, 0x89d32be0LU, 0x10da7a5aLU, 0x67dd4accLU,
- 0xf9b9df6fLU, 0x8ebeeff9LU, 0x17b7be43LU, 0x60b08ed5LU,
- 0xd6d6a3e8LU, 0xa1d1937eLU, 0x38d8c2c4LU, 0x4fdff252LU,
- 0xd1bb67f1LU, 0xa6bc5767LU, 0x3fb506ddLU, 0x48b2364bLU,
- 0xd80d2bdaLU, 0xaf0a1b4cLU, 0x36034af6LU, 0x41047a60LU,
- 0xdf60efc3LU, 0xa867df55LU, 0x316e8eefLU, 0x4669be79LU,
- 0xcb61b38cLU, 0xbc66831aLU, 0x256fd2a0LU, 0x5268e236LU,
- 0xcc0c7795LU, 0xbb0b4703LU, 0x220216b9LU, 0x5505262fLU,
- 0xc5ba3bbeLU, 0xb2bd0b28LU, 0x2bb45a92LU, 0x5cb36a04LU,
- 0xc2d7ffa7LU, 0xb5d0cf31LU, 0x2cd99e8bLU, 0x5bdeae1dLU,
- 0x9b64c2b0LU, 0xec63f226LU, 0x756aa39cLU, 0x026d930aLU,
- 0x9c0906a9LU, 0xeb0e363fLU, 0x72076785LU, 0x05005713LU,
- 0x95bf4a82LU, 0xe2b87a14LU, 0x7bb12baeLU, 0x0cb61b38LU,
- 0x92d28e9bLU, 0xe5d5be0dLU, 0x7cdcefb7LU, 0x0bdbdf21LU,
- 0x86d3d2d4LU, 0xf1d4e242LU, 0x68ddb3f8LU, 0x1fda836eLU,
- 0x81be16cdLU, 0xf6b9265bLU, 0x6fb077e1LU, 0x18b74777LU,
- 0x88085ae6LU, 0xff0f6a70LU, 0x66063bcaLU, 0x11010b5cLU,
- 0x8f659effLU, 0xf862ae69LU, 0x616bffd3LU, 0x166ccf45LU,
- 0xa00ae278LU, 0xd70dd2eeLU, 0x4e048354LU, 0x3903b3c2LU,
- 0xa7672661LU, 0xd06016f7LU, 0x4969474dLU, 0x3e6e77dbLU,
- 0xaed16a4aLU, 0xd9d65adcLU, 0x40df0b66LU, 0x37d83bf0LU,
- 0xa9bcae53LU, 0xdebb9ec5LU, 0x47b2cf7fLU, 0x30b5ffe9LU,
- 0xbdbdf21cLU, 0xcabac28aLU, 0x53b39330LU, 0x24b4a3a6LU,
- 0xbad03605LU, 0xcdd70693LU, 0x54de5729LU, 0x23d967bfLU,
- 0xb3667a2eLU, 0xc4614ab8LU, 0x5d681b02LU, 0x2a6f2b94LU,
- 0xb40bbe37LU, 0xc30c8ea1LU, 0x5a05df1bLU, 0x2d02ef8dLU
-};
-
-_u32 crc32(_u8 *data, _u32 len)
-{
- _u32 crc=0xffffffff;
-
- while (len--)
- crc=(crc>>8)^crc32table[(crc&0xff)^*data++];
- return crc^0xffffffff;
-}
-
View
18 crc32.h
@@ -1,18 +0,0 @@
-/*
-
- p0f - cyclic redundancy check
- -----------------------------
-
- CRC32 code. Polynomial 0x04c11db7LU.
-
- Copyright (C) 2006 by Mariusz Kozlowski <m.kozlowski@tuxland.pl>
-
- */
-
-#ifndef _HAVE_CRC32_H
-#define _HAVE_CRC32_H
-
-_u32 crc32(_u8 *data, _u32 len);
-
-#endif
-
View
54 debug.h
@@ -0,0 +1,54 @@
+/*
+ p0f - debug / error handling macros
+ -----------------------------------
+
+ Copyright (C) 2012 by Michal Zalewski <lcamtuf@coredump.cx>
+
+ Distributed under the terms and conditions of GNU LGPL.
+
+ */
+
+#ifndef _HAVE_DEBUG_H
+#define _HAVE_DEBUG_H
+
+#include "types.h"
+#include "config.h"
+
+#ifdef DEBUG_BUILD
+# define DEBUG(x...) fprintf(stderr, x)
+#else
+# define DEBUG(x...) do {} while (0)
+#endif /* ^DEBUG_BUILD */
+
+#define ERRORF(x...) fprintf(stderr, x)
+#define SAYF(x...) printf(x)
+
+#define WARN(x...) do { \
+ ERRORF("[!] WARNING: " x); \
+ ERRORF("\n"); \
+ } while (0)
+
+#define FATAL(x...) do { \
+ ERRORF("[-] PROGRAM ABORT : " x); \
+ ERRORF("\n Location : %s(), %s:%u\n\n", \
+ __FUNCTION__, __FILE__, __LINE__); \
+ exit(1); \
+ } while (0)
+
+#define ABORT(x...) do { \
+ ERRORF("[-] PROGRAM ABORT : " x); \
+ ERRORF("\n Location : %s(), %s:%u\n\n", \
+ __FUNCTION__, __FILE__, __LINE__); \
+ abort(); \
+ } while (0)
+
+#define PFATAL(x...) do { \
+ ERRORF("[-] SYSTEM ERROR : " x); \
+ ERRORF("\n Location : %s(), %s:%u\n", \
+ __FUNCTION__, __FILE__, __LINE__); \
+ perror(" OS message "); \
+ ERRORF("\n"); \
+ exit(1); \
+ } while (0)
+
+#endif /* ! _HAVE_DEBUG_H */
View
66 doc/CREDITS
@@ -1,66 +0,0 @@
-
- "You may kiss me of course,
- But you'll have to use force.
- Though god knows you're stronger than I am."
-
-
-And the credits go to:
-======================
-
- People who have contributed to the current form of this code (in order of
- appearance, of sorts):
-
- Michal Zalewski: initial code and some ideas, p0frep, fingerprints, etc
- Michael Davis: MSVC++ Windows port
- John Cartwright: testing, v2 Makefile for SunOS
- Mike Frantzen: discussions, T0 and Z quirk
- Jacon Winther: testing, feedback, MacOS X reports
- Lance Spitzner: useful feedback
- Rafal Wozniakowski: config reader bugfix
- Bert Kiers: NetBSD testing, suggestions
- Timo Sirainen: parser bug fix
- Sebastian Prause: pppoe on NetBSD fix
- Cristian Ionescu-Idbohrn: some interesting suggestions
- Michal Margula: masq threshold
- Dan Nelson: small p0frep fix
- rain forest puppy: many signatures
- Peter Gamache: p0fq fixes
- Paul Woo: signatures in bulk
- Michael Bauer: signatures in bulk
- Ryan Barnett: Solaris testing
- Kirby Kuehl: Windows port fixes and enhancements!
- Kevin Currie: p0f on the go.
- Adam Kaufman: FreeBSD build patch
- Troels Eklund Andersen: MacOS build fixes
- Radim Kolar: various minor fixes
- Safari: timestamp fixes and additions
- Aurelien Jacobs: perl version of p0f query tool
- Camilo Hernan Viecco: 802.11b fix
- Zaki Chakib: cygwin tips
- Gregory Steuck: sprintf fixes
- GoTaR: masquerade timestamp patch
- Ryan Kruse: boatloads of -A fingerprints
- Stas Bekman: p0f.pid support
- Mike Smith: -e option support
- Jarno Huuskonen: timezone in chroot() fix
- Adam Oschowski: harmless vlan bof fix
- Mariusz Kozlowski: diagnostic queries, p0fping.c and other contributions
-
- William Stearns did lots of work that made v1 successful.
- He does not have any direct contributions to v2 yet, but I hope this will
- change, until then, this is a honorary mention.
-
- We apologize all of you who should be listed here, but are not. If you
- feel this is the case, please let us know and we will fix this
- unintentional omission.
-
- A countless number of people contributed fingerprints via p0f-help website
- (ok, more precisely: thousands). Most of them did not provide their
- names, or requested not to be credited. For those who did, I simply couldn't
- keep up maintaining the list, and had a hard time deciding who should be
- credited and who shouldn't. Duplicates, the sheer amount of information
- provided, data reliability issues... I would still like to recognize
- people who have contributed a number of signatures, provided some
- rare fingerprints, or otherwise made a considerable contribution to the
- database. If you feel you should be listed here, please let me know.
-
View
220 doc/ChangeLog
@@ -1,220 +0,0 @@
-Version 2.0.8:
--------------
-
- More fingerprints, signature cleanup.
-
- p0fping.c and diagnostic queries added.
-
- Socket ownership fix when dropping privs.
-
- Some -O signatures.
-
-Version 2.0.7:
---------------
-
- Added -0 mode for port 0 wildcards in queries.
-
- Added -e option to make p0f work on some boxes.
-
- HDLC support added.
-
- New fingerprints, including Windows Vista betas.
-
- [BUG] Fixed timezone in logs after chroot().
-
- [BUG] Unlikely command-line overflow with VLANs fixed.
-
-Version 2.0.6:
---------------
-
- [BUG] Fixed pcap naming madness.
-
- Support for Cygwin.
-
- More signatures. Plenty of -A sigs from Ryan Kruse.
-
- [BUG] Fix to a command-line parsing snafu with sprintf; shame on me ;-)
-
- Timestamps in masquerade detection.
-
- Write PID to /var/run/p0f.pid
-
-Verison 2.0.5:
---------------
-
- [BUG] OpenBSD compile fix.
-
- Support for 802.1Q.
-
- New signatures.
-
- Speel-chceked teh docuhmentation!
-
- Absolutely experimental support for open connection fingerprinting (-O).
-
- Synced manpage and documentation.
-
- Added several -O signatures.
-
-Verison 2.0.4:
---------------
-
- More signatures.
-
- Improved documentation, mentions of p0f_db, etc.
-
- [BUG] Fixed a minor problem with installation on systems w/o /usr/man/.
-
- [BUG] Fixed a DLT_NULL problem, added a new loopback signature.
-
- Multiple timestamp options, timestamps now read from pcap dumps.
-
- Sync with new Windows port code.
-
- [BUG] Fixed one-line reporting for masquerade detection.
-
-Version 2.0.3:
---------------
-
- Iproved -F.
-