1.1 --- a/honeyd/honeyd.patch Thu Oct 04 20:26:02 2012 +0200
1.2 +++ b/honeyd/honeyd.patch Thu Oct 04 20:30:05 2012 +0200
1.3 @@ -190,3 +190,108 @@
1.4 SLIST_HEAD(pf_osfp_list, pf_os_fingerprint) pf_osfp_list;
1.5 pool_t pf_osfp_entry_pl;
1.6 pool_t pf_osfp_pl;
1.7 +Index: nmap.prints
1.8 +--- nmap.prints.orig 2007-05-28 08:05:05.000000000 +0200
1.9 ++++ nmap.prints 2012-10-02 20:41:53.110772932 +0200
1.10 +@@ -662,18 +662,6 @@
1.11 + T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
1.12 + PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
1.13 +
1.14 +-Fingerprint IBM OS/400 V4R2M0
1.15 +-Class IBM | OS/400 | V4 | general purpose
1.16 +-TSeq(Class=TD|RI%gcd=<6%SI=<285DC&>206%IPID=I%TS=U)
1.17 +-T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=M)
1.18 +-T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
1.19 +-T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=M)
1.20 +-T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
1.21 +-T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
1.22 +-T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
1.23 +-T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
1.24 +-PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
1.25 +-
1.26 + Fingerprint IBM OS/400 V4R5M0
1.27 + Class IBM | OS/400 | V4 | general purpose
1.28 + T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
1.29 +@@ -11085,18 +11073,6 @@
1.30 +
1.31 + Fingerprint Microsoft Windows NT 4.0 SP3
1.32 + Class Microsoft | Windows | NT/2K/XP | general purpose
1.33 +-TSeq(Class=TD|RI%gcd=<18%SI=<2A00DA&>6B73)
1.34 +-T1(DF=Y%W=7FFF|2017%ACK=S++%Flags=AS%Ops=M|MNWNNT)
1.35 +-T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
1.36 +-T3(Resp=Y%DF=Y%W=7FFF|2017%ACK=S++|O%Flags=AS|A%Ops=M|NNT)
1.37 +-T4(DF=N%W=0%ACK=O|S%Flags=R%Ops=)
1.38 +-T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
1.39 +-T6(DF=N%W=0%ACK=O|S++%Flags=R%Ops=)
1.40 +-T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
1.41 +-PU(TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
1.42 +-
1.43 +-Fingerprint Microsoft Windows NT 4.0 SP3
1.44 +-Class Microsoft | Windows | NT/2K/XP | general purpose
1.45 + TSeq(Class=TD%gcd=<F4%SI=<3C%IPID=BI%TS=U)
1.46 + T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
1.47 + T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
1.48 +Index: interface.c
1.49 +--- interface.c.orig 2007-05-28 08:12:52.000000000 +0200
1.50 ++++ interface.c 2012-10-02 21:16:53.229492754 +0200
1.51 +@@ -114,6 +114,7 @@
1.52 + {
1.53 + char ebuf[PCAP_ERRBUF_SIZE];
1.54 + struct interface *inter;
1.55 ++ char *iface = 0;
1.56 +
1.57 + if ((inter = calloc(1, sizeof(struct interface))) == NULL)
1.58 + err(1, "%s: calloc", __func__);
1.59 +@@ -126,14 +127,23 @@
1.60 + TAILQ_INSERT_TAIL(&interfaces, inter, next);
1.61 +
1.62 + inter->if_ent.intf_len = sizeof(struct intf_entry);
1.63 +- strlcpy(inter->if_ent.intf_name, dev, sizeof(inter->if_ent.intf_name));
1.64 ++
1.65 ++ /* mitigate slash paths in OS that provide */
1.66 ++ /* network devices in subdirectories of /dev */
1.67 ++ iface = strrchr(dev, '/');
1.68 ++ if (iface)
1.69 ++ iface += sizeof(char);
1.70 ++ else
1.71 ++ iface = dev;
1.72 ++
1.73 ++ strlcpy(inter->if_ent.intf_name, iface, sizeof(inter->if_ent.intf_name));
1.74 +
1.75 + if (intf_get(intf, &inter->if_ent) < 0)
1.76 + err(1, "%s: intf_get", __func__);
1.77 +
1.78 + if (inter->if_ent.intf_addr.addr_type != ADDR_TYPE_IP)
1.79 + errx(1, "%s: bad interface configuration: %s is not IP",
1.80 +- __func__, dev);
1.81 ++ __func__, iface);
1.82 +
1.83 + return (inter);
1.84 + }
1.85 +@@ -244,7 +254,7 @@
1.86 + }
1.87 +
1.88 + void
1.89 +-interface_ether_filter(struct interface *inter,
1.90 ++interface_ether_filter(char *dev, struct interface *inter,
1.91 + int naddresses, char **addresses)
1.92 + {
1.93 + char line[48];
1.94 +@@ -259,7 +269,7 @@
1.95 + sizeof(inter->if_filter))
1.96 + errx(1, "%s: pcap filter exceeds maximum length", __func__);
1.97 +
1.98 +- inter->if_eth = eth_open(inter->if_ent.intf_name);
1.99 ++ inter->if_eth = eth_open(dev);
1.100 + if (inter->if_eth == NULL)
1.101 + errx(1, "%s: eth_open: %s", inter->if_ent.intf_name);
1.102 +
1.103 +@@ -307,7 +317,7 @@
1.104 + * ignore our own packets.
1.105 + */
1.106 + if (inter->if_ent.intf_link_addr.addr_type == ADDR_TYPE_ETH) {
1.107 +- interface_ether_filter(inter, naddresses, addresses);
1.108 ++ interface_ether_filter(dev, inter, naddresses, addresses);
1.109 +
1.110 + /*
1.111 + * We open all interfaces before parsing the
