diff -uNr p0f-1.8.2/CREDITS p0f-1.8.2.1/CREDITS --- p0f-1.8.2/CREDITS Mon Feb 4 13:34:17 2002 +++ p0f-1.8.2.1/CREDITS Sun May 12 00:54:37 2002 @@ -5,6 +5,7 @@ - TAHARA Yuusuke (additional solaris compile fixes) - piggy (cosmetic error spotting) - John Sage (logcheck support note) +- Evrim ULU , Aycan IRICAN (mysql support, new sig) New Fingerprints diff -uNr p0f-1.8.2/ChangeLog p0f-1.8.2.1/ChangeLog --- p0f-1.8.2/ChangeLog Mon Feb 4 13:31:51 2002 +++ p0f-1.8.2.1/ChangeLog Sun May 12 00:45:38 2002 @@ -1,3 +1,13 @@ +1.8.2.1 (May 12, 2002) + - Mysql Support Added (Evrim ULU ) + - FPS Buffer Length increased from 120 to 150 (Evrim) + - p0f-mysql.conf config file added for mysql connectivity (Evrim) + - parser for p0f.fp was corrected. It was including + wwww:ttt: ... line in the comments. (Evrim) + - mysql/db.sql file is included for creation of db tables (Evrim) + - Makefile.mysql is added - no gnu autoconf support yet. (Evrim) + - New RedHat 7.0 Beta Fischer FP added. (Evrim) + - Max fingerprints raised to 5000 for the moresigs project. (Bill) 1.8.2 (Feb 04, 2002) - Addition of CREDITS, ChangeLog diff -uNr p0f-1.8.2/Makefile p0f-1.8.2.1/Makefile --- p0f-1.8.2/Makefile Sat Feb 2 02:09:14 2002 +++ p0f-1.8.2.1/Makefile Sun May 12 00:56:54 2002 @@ -5,12 +5,12 @@ # CC = gcc -CLIBS = -lpcap +CLIBS = -lpcap -I/usr/include/pcap SUNLIBS = -lsocket -lnsl -D_SUN_=1 STRIP = strip CFLAGS = -O3 -Wall FILE = p0f -VERSION = 1.8.2 +VERSION = 1.8.2.1 DISTRO = p0f.c Makefile README COPYING CREDITS ChangeLog tcp.h p0f.fp p0f.init p0frep @@ -18,7 +18,7 @@ $(FILE): p0f.c $(CC) $(CFLAGS) -DVER=\"$(VERSION)\" -o $@ p0f.c $(CLIBS) \ - `uname|egrep -i 'sunos|solar' >/dev/null && echo "$(SUNLIBS)"` + `uname|egrep -i 'sunos|solar' >/dev/null && echo "$(SUNLIBS)"` strip: strip $(FILE) || true diff -uNr p0f-1.8.2/Makefile.mysql p0f-1.8.2.1/Makefile.mysql --- p0f-1.8.2/Makefile.mysql Wed Dec 31 19:00:00 1969 +++ p0f-1.8.2.1/Makefile.mysql Sun May 12 00:57:00 2002 @@ -0,0 +1,81 @@ +# +# p0f - passive OS fingerprinting +# (C) Copyright 2000, 2001 by Michal Zalewski +# (C) Copyright 2001 by William Stearns +# + +CC = gcc +CLIBS = -L/usr/local/mysql/lib -lmysqlclient -lpcap -I/usr/include/pcap -I/usr/local/mysql/include +SUNLIBS = -lsocket -lnsl -D_SUN_=1 +STRIP = strip +CFLAGS = -O3 -Wall +FILE = p0f +VERSION = 1.8.2.1 + +DISTRO = p0f.c Makefile README COPYING CREDITS ChangeLog tcp.h p0f.fp p0f.init p0frep + +all: $(FILE) strip + +$(FILE): p0f.c + $(CC) $(CFLAGS) -DVER=\"$(VERSION)\" -o $@ p0f.c $(CLIBS) \ + `uname|egrep -i 'sunos|solar' >/dev/null && echo "$(SUNLIBS)"` -D__MYSQL__ + +strip: + strip $(FILE) || true + +clean: + rm -f core *.o $(FILE) + rm -rf p0f-$(VERSION) + +tgz: clean + mkdir -m 755 p0f-$(VERSION) + cp $(DISTRO) p0f-$(VERSION)/ + chmod 644 p0f-$(VERSION)/* + tar cfvz /tmp/$(FILE).tgz p0f-$(VERSION) + chmod 644 /tmp/$(FILE).tgz + #rm -rf p0f-$(VERSION) + +publish: tgz + #scp /tmp/p0f.tgz lcamtuf@dione.ids.pl:public_html/p0f.tgz + #scp /tmp/p0f.tgz lcamtuf@dione.ids.pl:public_html/p0f-$(VERSION).tgz + #rm -f /tmp/p0f.tgz + + +install: $(FILE) + mkdir -p $(DESTDIR)/usr/bin + mkdir -p $(DESTDIR)/usr/sbin + mkdir -p $(DESTDIR)/usr/share/doc/p0f-$(VERSION) + mkdir -p $(DESTDIR)/usr/share/man/man1 + cp -p p0f.fp $(DESTDIR)/etc + cp -p p0f.init $(DESTDIR)/etc/init.d/p0f + cp -p COPYING README CREDITS ChangeLog $(DESTDIR)/usr/share/doc/p0f-$(VERSION) + cp -p p0f $(DESTDIR)/usr/sbin + cp -p p0frep $(DESTDIR)/usr/bin + cp -p p0f.1 p0f.1.orig + rm -f p0f.1.gz + gzip -9 p0f.1 + mv p0f.1.orig p0f.1 + mv p0f.1.gz $(DESTDIR)/usr/share/man/man1 + chmod 755 $(DESTDIR)/etc/init.d/p0f $(DESTDIR)/usr/sbin/p0f $(DESTDIR)/usr/bin/p0frep + +distribs: + @echo This should only need to be used by the author in + @echo packing up the p0f package. + cd .. \ + && tar cf - p0f-$(VERSION)/ | \ + gzip -9 > p0f-$(VERSION).tgz \ + && rm -f p0f-current \ + && ln -sf p0f-$(VERSION) p0f-current \ + && tar cf - p0f-current/* | \ + gzip -9 > p0f-current.tgz \ + && cp p0f-$(VERSION).tgz /usr/src/redhat/SOURCES/ \ + && cd p0f-$(VERSION) \ + && cp -f p0f.spec /usr/src/redhat/SPECS/ \ + && rpm --sign -ba /usr/src/redhat/SPECS/p0f.spec \ + && mv /usr/src/p0f-*.tgz /home/wstearns/dist/pubroot/p0f/ \ + && mv /usr/src/redhat/RPMS/i386/p0f-*.i386.rpm /home/wstearns/dist/pubroot/p0f/ \ + && mv /usr/src/redhat/SRPMS/p0f-*.src.rpm /home/wstearns/dist/pubroot/p0f/ \ + && chown -R wstearns.wstearns /home/wstearns/dist/pubroot/p0f/ + @echo Please run distall, thanks. + + diff -uNr p0f-1.8.2/README p0f-1.8.2.1/README --- p0f-1.8.2/README Mon Feb 4 13:18:37 2002 +++ p0f-1.8.2.1/README Sat May 11 21:21:22 2002 @@ -169,6 +169,16 @@ Configuration ------------- +MYSQL: + If you want to use MYSQL support, first edit p0f-mysql.conf file + and set correct values inside to connect your server. + + Then use -m and -g parameters both at the same time to insert p0f.fp + to your db. Afterwars -m parameter is enough to get fprints + from db,process them and put the results into db. + +--------- + The database of OS fingerprints is usually kept in /etc/p0f.fp or ./p0f.fp . Its format is described below: diff -uNr p0f-1.8.2/mysql/db.sql p0f-1.8.2.1/mysql/db.sql --- p0f-1.8.2/mysql/db.sql Wed Dec 31 19:00:00 1969 +++ p0f-1.8.2.1/mysql/db.sql Tue Apr 23 16:24:58 2002 @@ -0,0 +1,34 @@ +drop table if exists pool; +drop table if exists os; +-- +-- Table structure for table 'P0f' +-- + +CREATE TABLE pool ( + IP varchar(15) NOT NULL default '', + Hops int(11) NOT NULL default '0', + OS int(11) NOT NULL default '0', + sport int(11) default NULL, + dport int(11) default NULL, + time timestamp(14) NOT NULL, + UNIQUE KEY IP (IP,dport,OS) +) TYPE=MyISAM; + +-- +-- Dumping data for table 'P0f' +-- + +CREATE TABLE os ( + osid int(11) NOT NULL default '0' auto_increment, + osname text default NULL, + win int, + ttl int, + mss int, + df int, + wscale int, + sok int, + nop int, + size int, + PRIMARY KEY (osid) +) TYPE=MyISAM; + diff -uNr p0f-1.8.2/mysql/p0f-mysql.conf p0f-1.8.2.1/mysql/p0f-mysql.conf --- p0f-1.8.2/mysql/p0f-mysql.conf Wed Dec 31 19:00:00 1969 +++ p0f-1.8.2.1/mysql/p0f-mysql.conf Mon Apr 22 04:37:04 2002 @@ -0,0 +1,5 @@ +mysql://localhost:root:s0lar1s:pof:3306 + +#mysql://hostname:user:pass:dbname:port +#Example mysql configuration line + diff -uNr p0f-1.8.2/p0f.1 p0f-1.8.2.1/p0f.1 --- p0f-1.8.2/p0f.1 Sat Jan 26 17:52:03 2002 +++ p0f-1.8.2.1/p0f.1 Sat May 11 21:30:06 2002 @@ -53,6 +53,12 @@ .TP \fB\-q\fR quiet mode - do not display banners +.TP +\fB\-m file\fR +send output to mysql server in 'file' +.TP +\fb\-g file\fR +insert fprints from 'file' into sql (must be used with -m) .SH FILES .TP .BI /etc/p0f.fp diff -uNr p0f-1.8.2/p0f.c p0f-1.8.2.1/p0f.c --- p0f-1.8.2/p0f.c Sat Feb 2 02:00:40 2002 +++ p0f-1.8.2.1/p0f.c Sun May 12 01:02:54 2002 @@ -31,10 +31,12 @@ #include #include #include +#include +#include #include "tcp.h" -#define MAXFPS 1000 -#define FPBUF 120 +#define MAXFPS 5000 +#define FPBUF 150 #define INBUF 1024 #define TTLDW 30 @@ -46,16 +48,90 @@ extern int optind; char fps[MAXFPS][FPBUF]; + +#ifdef __MYSQL__ +char mysqlstring[512]; +struct fp +{ + int win; + int ttl; + int mss; + int df; + int wscale; + int sok; + int nop; + int size; + char osname[255]; +}; + +struct mysqlconnectstring +{ + char hostname[50]; + char username[20]; + char password[20]; + char database[50]; + int port; +}; + +MYSQL *mysql; +MYSQL_RES *sqlres; +MYSQL_ROW sqlrow; +MYSQL_FIELD *fields; +char sqlquery[512]; +struct mysqlconnectstring mconnstr; +#endif + int wss, wscale, mss, nop, ttl, df, sok,tmp,header_len=14,dupa; u_int32_t timestamp; char T_nounk,T_nokn,T_tstamp; int verbose=0,sp,dp,totlen,origtot; +int usemysql = 0,generate=0; struct in_addr sip,dip; struct bpf_program flt; pcap_t *pt; +#ifdef __MYSQL__ +void load_mysql (char *mysqlconf) { + FILE *fd; + char *ptr, *token; + if (!(fd = fopen (mysqlconf, "r"))) { + fprintf (stderr, "Unable to open mysql configuration file"); + exit (0); + } + while (fgets (mysqlstring, 511, fd)) + { + if ((ptr = strstr (mysqlstring, "mysql://"))) + { + ptr += 8; + if ((token = strtok (ptr, ":"))) { + strcpy (mconnstr.hostname, token); + } + if ((token = strtok (NULL, ":"))) { + strcpy (mconnstr.username, token); + } + if ((token = strtok (NULL, ":"))) { + strcpy (mconnstr.password, token); + } + if ((token = strtok (NULL, ":"))) { + strcpy (mconnstr.database, token); + } + if ((token = strtok (NULL, ":"))) { + mconnstr.port = atoi (token); + return; + } + } + } + fprintf(stderr,"host:%s\nuser:%s\npass:%s\n",mconnstr.hostname,mconnstr.username,mconnstr.password); +} +#endif + + void die_nicely() { pcap_close(pt); +#ifdef __MYSQL__ + if (usemysql) + mysql_close(mysql); +#endif exit(0); } @@ -219,7 +295,10 @@ void lookup(void) { - int i=0,got=0,down=0; + int i=0,got=0,down=0,fpnum=0; +#ifdef __MYSQL__ + int r=0; +#endif int origw=wscale; char buf[INBUF],*p; char* plonked="\n"; @@ -229,6 +308,7 @@ sprintf(buf,"%d:%d:%d:%d:%d:%d:%d:%d",wss,ttl+down,mss,df,wscale,sok,nop,totlen); while (fps[i][0]) { if (!strncmp(buf, fps[i], strlen(buf))) { + fpnum=fips-i; got=1; p=strrchr(fps[i],':')+1; if (strchr(p, '\n')) p[strlen(p)-1]=0; @@ -240,6 +320,28 @@ if (x[strlen(x)-1]=='\n') x[strlen(x)-1]=0; printf("<%s> ",x); } + +#ifdef __MYSQL__ + if(usemysql) { + snprintf (sqlquery, 512, + "INSERT INTO pool (IP,Hops,OS,sport,dport,time) VALUES (\'%s\',%d,%d,%d,%d,NULL)", + inet_ntoa (sip), down + 1, fpnum, sp, dp); + + if (mysql_query (mysql, sqlquery)) { + r = mysql_errno(mysql); + if ( r == ER_DUP_ENTRY ) { + snprintf(sqlquery,512, + "UPDATE pool SET time=NULL where IP=\'%s\' and dport=%d and OS=%d", + inet_ntoa(sip),dp, fpnum); + mysql_query (mysql, sqlquery); + } else { + fprintf(stderr,"Unable to add entry: %s",mysql_error(mysql)); + } + } else { + sqlres = mysql_store_result (mysql); + } + } +#endif printf("%s [%d hops]: %s%s",inet_ntoa(sip),down+1,p,plonked); if (verbose) { printf(" + %s:%d ->",inet_ntoa(sip),sp); @@ -290,6 +392,7 @@ FILE *x; int i=0; char *p; + //bzero(fips,120000); x=fopen(filename, "r"); if (!x) x=fopen("p0f.fp", "r"); if (!x) { @@ -299,12 +402,131 @@ } while (fgets(fps[i],FPBUF-1,x)) { if ((p=strchr(fps[i],'#'))) *p=0; - if (fps[i][0]) i++; + if (fps[i][0]) { + //fprintf(stderr,"%s",fps[i]); + i++; + } } fips=i; fclose(x); } +#ifdef __MYSQL__ +void +load_fprints_sql(char *mysqlconf) +{ + int num_fields,i,j=0; + load_mysql (mysqlconf); + mysql = mysql_init (NULL); + mysql_options (mysql, MYSQL_OPT_COMPRESS, 0); + if (!mysql_real_connect + (mysql, mconnstr.hostname, mconnstr.username, + mconnstr.password, mconnstr.database, mconnstr.port, + NULL, 0)) { + /* we cannot connect */ + printf ("Failed to make mysql connection: %s", + mysql_error (mysql)); + exit (1); + } + mysql_query(mysql,"SELECT win,ttl,mss,df,wscale,sok,nop,size,osname FROM os order by osid desc"); + + sqlres = mysql_store_result(mysql); + num_fields = mysql_num_fields(sqlres); + while ((sqlrow = mysql_fetch_row(sqlres))) { + for(i=0;i, William Stearns \n"); - + +#ifdef __MYSQL__ + if (usemysql) { + load_mysql (mysqlconf); + mysql = mysql_init (NULL); + mysql_options (mysql, MYSQL_OPT_COMPRESS, 0); + if (!mysql_real_connect + (mysql, mconnstr.hostname, mconnstr.username, + mconnstr.password, mconnstr.database, mconnstr.port, + NULL, 0)) { + /* we cannot connect */ + printf ("Failed to make mysql connection: %s", mysql_error (mysql)); + exit (0); + } + } +#endif + if (s && inputfile && *inputfile) { if ((pt=pcap_open_offline(inputfile, errbuf))==NULL) { fprintf(stderr, "pcap_open_offline failed: %s\n", errbuf); @@ -402,8 +678,18 @@ signal(SIGINT,&die_nicely); signal(SIGTERM,&die_nicely); - load_fprints(filename); - + + +#ifdef __MYSQL__ + if (usemysql) { + load_fprints_sql(mysqlconf); + } else { +#endif + load_fprints(filename); +#ifdef __MYSQL__ + } +#endif + if (pcap_compile(pt, &flt, rul?rul:"", 1, 0)) { if (rul) { pcap_perror(pt,"pcap_compile"); diff -uNr p0f-1.8.2/p0f.fp p0f-1.8.2.1/p0f.fp --- p0f-1.8.2/p0f.fp Mon Feb 4 12:48:06 2002 +++ p0f-1.8.2.1/p0f.fp Sat May 11 21:33:30 2002 @@ -188,3 +188,4 @@ 16384:128:1460:1:52:1:1:48:Windows NT 5.0 (1) 8760:128:1460:1:-1:1:1:48:Windows NT 5.0 (2) 60352:64:1360:1:2:1:1:52:Windows NT 5.0 (3) +11400:64:3800:1:0:1:1:60:Linux 2.4.0-0.99.11 Redhat 7.0 Beta (Fischer)