comparison: honeyd/honeyd.patch
honeyd/honeyd.patch
- changeset 764
- b3f4be54aeb4
- parent 575
- 6e491d7671a4
equal
deleted
inserted
replaced
| 1:09cea6f6b76a | 2:b0a90d2b061e |
|---|---|
| 188 +#endif | 188 +#endif |
| 189 + | 189 + |
| 190 SLIST_HEAD(pf_osfp_list, pf_os_fingerprint) pf_osfp_list; | 190 SLIST_HEAD(pf_osfp_list, pf_os_fingerprint) pf_osfp_list; |
| 191 pool_t pf_osfp_entry_pl; | 191 pool_t pf_osfp_entry_pl; |
| 192 pool_t pf_osfp_pl; | 192 pool_t pf_osfp_pl; |
| 193 Index: nmap.prints | |
| 194 --- nmap.prints.orig 2007-05-28 08:05:05.000000000 +0200 | |
| 195 +++ nmap.prints 2012-10-02 20:41:53.110772932 +0200 | |
| 196 @@ -662,18 +662,6 @@ | |
| 197 T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) | |
| 198 PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) | |
| 199 | |
| 200 -Fingerprint IBM OS/400 V4R2M0 | |
| 201 -Class IBM | OS/400 | V4 | general purpose | |
| 202 -TSeq(Class=TD|RI%gcd=<6%SI=<285DC&>206%IPID=I%TS=U) | |
| 203 -T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=M) | |
| 204 -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) | |
| 205 -T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=M) | |
| 206 -T4(DF=N%W=0%ACK=S%Flags=R%Ops=) | |
| 207 -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) | |
| 208 -T6(DF=N%W=0%ACK=S%Flags=R%Ops=) | |
| 209 -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) | |
| 210 -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) | |
| 211 - | |
| 212 Fingerprint IBM OS/400 V4R5M0 | |
| 213 Class IBM | OS/400 | V4 | general purpose | |
| 214 T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT) | |
| 215 @@ -11085,18 +11073,6 @@ | |
| 216 | |
| 217 Fingerprint Microsoft Windows NT 4.0 SP3 | |
| 218 Class Microsoft | Windows | NT/2K/XP | general purpose | |
| 219 -TSeq(Class=TD|RI%gcd=<18%SI=<2A00DA&>6B73) | |
| 220 -T1(DF=Y%W=7FFF|2017%ACK=S++%Flags=AS%Ops=M|MNWNNT) | |
| 221 -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) | |
| 222 -T3(Resp=Y%DF=Y%W=7FFF|2017%ACK=S++|O%Flags=AS|A%Ops=M|NNT) | |
| 223 -T4(DF=N%W=0%ACK=O|S%Flags=R%Ops=) | |
| 224 -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) | |
| 225 -T6(DF=N%W=0%ACK=O|S++%Flags=R%Ops=) | |
| 226 -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) | |
| 227 -PU(TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) | |
| 228 - | |
| 229 -Fingerprint Microsoft Windows NT 4.0 SP3 | |
| 230 -Class Microsoft | Windows | NT/2K/XP | general purpose | |
| 231 TSeq(Class=TD%gcd=<F4%SI=<3C%IPID=BI%TS=U) | |
| 232 T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M) | |
| 233 T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) | |
| 234 Index: interface.c | |
| 235 --- interface.c.orig 2007-05-28 08:12:52.000000000 +0200 | |
| 236 +++ interface.c 2012-10-02 21:16:53.229492754 +0200 | |
| 237 @@ -114,6 +114,7 @@ | |
| 238 { | |
| 239 char ebuf[PCAP_ERRBUF_SIZE]; | |
| 240 struct interface *inter; | |
| 241 + char *iface = 0; | |
| 242 | |
| 243 if ((inter = calloc(1, sizeof(struct interface))) == NULL) | |
| 244 err(1, "%s: calloc", __func__); | |
| 245 @@ -126,14 +127,23 @@ | |
| 246 TAILQ_INSERT_TAIL(&interfaces, inter, next); | |
| 247 | |
| 248 inter->if_ent.intf_len = sizeof(struct intf_entry); | |
| 249 - strlcpy(inter->if_ent.intf_name, dev, sizeof(inter->if_ent.intf_name)); | |
| 250 + | |
| 251 + /* mitigate slash paths in OS that provide */ | |
| 252 + /* network devices in subdirectories of /dev */ | |
| 253 + iface = strrchr(dev, '/'); | |
| 254 + if (iface) | |
| 255 + iface += sizeof(char); | |
| 256 + else | |
| 257 + iface = dev; | |
| 258 + | |
| 259 + strlcpy(inter->if_ent.intf_name, iface, sizeof(inter->if_ent.intf_name)); | |
| 260 | |
| 261 if (intf_get(intf, &inter->if_ent) < 0) | |
| 262 err(1, "%s: intf_get", __func__); | |
| 263 | |
| 264 if (inter->if_ent.intf_addr.addr_type != ADDR_TYPE_IP) | |
| 265 errx(1, "%s: bad interface configuration: %s is not IP", | |
| 266 - __func__, dev); | |
| 267 + __func__, iface); | |
| 268 | |
| 269 return (inter); | |
| 270 } | |
| 271 @@ -244,7 +254,7 @@ | |
| 272 } | |
| 273 | |
| 274 void | |
| 275 -interface_ether_filter(struct interface *inter, | |
| 276 +interface_ether_filter(char *dev, struct interface *inter, | |
| 277 int naddresses, char **addresses) | |
| 278 { | |
| 279 char line[48]; | |
| 280 @@ -259,7 +269,7 @@ | |
| 281 sizeof(inter->if_filter)) | |
| 282 errx(1, "%s: pcap filter exceeds maximum length", __func__); | |
| 283 | |
| 284 - inter->if_eth = eth_open(inter->if_ent.intf_name); | |
| 285 + inter->if_eth = eth_open(dev); | |
| 286 if (inter->if_eth == NULL) | |
| 287 errx(1, "%s: eth_open: %s", inter->if_ent.intf_name); | |
| 288 | |
| 289 @@ -307,7 +317,7 @@ | |
| 290 * ignore our own packets. | |
| 291 */ | |
| 292 if (inter->if_ent.intf_link_addr.addr_type == ADDR_TYPE_ETH) { | |
| 293 - interface_ether_filter(inter, naddresses, addresses); | |
| 294 + interface_ether_filter(dev, inter, naddresses, addresses); | |
| 295 | |
| 296 /* | |
| 297 * We open all interfaces before parsing the |
