Commit | Line | Data |
---|---|---|
c3a49fd7 JD |
1 | /* |
2 | p0f-client - simple API client | |
3 | ------------------------------ | |
4 | ||
5 | Can be used to query p0f API sockets. | |
6 | ||
7 | Copyright (C) 2012 by Michal Zalewski <lcamtuf@coredump.cx> | |
8 | ||
9 | Distributed under the terms and conditions of GNU LGPL. | |
10 | ||
11 | */ | |
12 | ||
13 | #include <stdio.h> | |
14 | #include <stdlib.h> | |
15 | #include <unistd.h> | |
16 | #include <string.h> | |
17 | #include <netdb.h> | |
18 | #include <errno.h> | |
19 | #include <ctype.h> | |
20 | #include <time.h> | |
21 | ||
22 | #include <netinet/in.h> | |
23 | #include <arpa/inet.h> | |
24 | #include <sys/types.h> | |
25 | #include <sys/time.h> | |
26 | #include <sys/socket.h> | |
27 | #include <sys/un.h> | |
28 | ||
29 | #include "../types.h" | |
30 | #include "../config.h" | |
31 | #include "../alloc-inl.h" | |
32 | #include "../debug.h" | |
33 | #include "../api.h" | |
34 | ||
35 | /* Parse IPv4 address into a buffer. */ | |
36 | ||
37 | static void parse_addr4(char* str, u8* ret) { | |
38 | ||
39 | u32 a1, a2, a3, a4; | |
40 | ||
41 | if (sscanf(str, "%u.%u.%u.%u", &a1, &a2, &a3, &a4) != 4) { | |
42 | SAYF("Malformed IPv4 address."); | |
43 | exit(1); | |
44 | } | |
45 | ||
46 | if (a1 > 255 || a2 > 255 || a3 > 255 || a4 > 255) { | |
47 | SAYF("Malformed IPv4 address."); | |
48 | exit(1); | |
49 | } | |
50 | ||
51 | ret[0] = a1; | |
52 | ret[1] = a2; | |
53 | ret[2] = a3; | |
54 | ret[3] = a4; | |
55 | ||
56 | } | |
57 | ||
58 | ||
59 | /* Parse IPv6 address into a buffer. */ | |
60 | ||
61 | static void parse_addr6(char* str, u8* ret) { | |
62 | ||
63 | u32 seg = 0; | |
64 | u32 val; | |
65 | ||
66 | while (*str) { | |
67 | ||
68 | if (seg == 8) { | |
69 | SAYF("Malformed IPv6 address (too many segments)."); | |
70 | exit(1); | |
71 | } | |
72 | ||
73 | ||
74 | if (*str == ':') { val = 0; } | |
75 | else if (sscanf((char*)str, "%x", &val) != 1 || val > 65535) { | |
76 | SAYF("Malformed IPv6 address (bad octet value)."); | |
77 | exit(1); | |
78 | } | |
79 | ||
80 | SAYF("str %s val %d\n", str, val); | |
81 | ||
82 | ret[seg * 2] = val >> 8; | |
83 | ret[seg * 2 + 1] = val; | |
84 | ||
85 | seg++; | |
86 | ||
87 | while (isxdigit(*str)) str++; | |
88 | if (*str) str++; | |
89 | ||
90 | } | |
91 | ||
92 | if (seg != 6) { | |
93 | SAYF("Malformed IPv6 address (incorrect number of segments parsed)"); | |
94 | exit(1); | |
95 | } | |
96 | ||
97 | } | |
98 | ||
99 | ||
100 | int main(int argc, char** argv) { | |
101 | ||
102 | u8 tmp[128]; | |
103 | struct tm* t; | |
104 | ||
105 | static struct p0f_api_query q; | |
106 | static struct p0f_api_response r; | |
107 | ||
108 | static struct sockaddr_un sun; | |
109 | ||
110 | s32 sock; | |
111 | time_t ut; | |
112 | ||
113 | if (argc != 3) { | |
114 | ERRORF("Usage: p0f-client /path/to/socket host_ip\n"); | |
115 | exit(1); | |
116 | } | |
117 | ||
118 | q.magic = P0F_QUERY_MAGIC; | |
119 | ||
120 | if (strchr(argv[2], ':')) { | |
121 | ||
122 | parse_addr6(argv[2], q.addr); | |
123 | q.addr_type = P0F_ADDR_IPV6; | |
124 | ||
125 | } else { | |
126 | ||
127 | parse_addr4(argv[2], q.addr); | |
128 | q.addr_type = P0F_ADDR_IPV4; | |
129 | ||
130 | } | |
131 | ||
132 | sock = socket(PF_UNIX, SOCK_STREAM, 0); | |
133 | ||
134 | if (sock < 0) { | |
135 | SAYF("Call to socket() failed."); | |
136 | return 1; | |
137 | } | |
138 | ||
139 | sun.sun_family = AF_UNIX; | |
140 | ||
141 | if (strlen(argv[1]) >= sizeof(sun.sun_path)) { | |
142 | SAYF("API socket filename is too long for sockaddr_un (blame Unix)."); | |
143 | return 1; | |
144 | } | |
145 | ||
146 | strcpy(sun.sun_path, argv[1]); | |
147 | ||
148 | if (connect(sock, (struct sockaddr*)&sun, sizeof(sun))) { | |
149 | SAYF("Can't connect to API socket."); | |
150 | return 1; | |
151 | } | |
152 | ||
153 | if (write(sock, &q, sizeof(struct p0f_api_query)) != | |
154 | sizeof(struct p0f_api_query)) { | |
155 | SAYF("Short write to API socket."); | |
156 | return 1; | |
157 | } | |
158 | ||
159 | if (read(sock, &r, sizeof(struct p0f_api_response)) != | |
160 | sizeof(struct p0f_api_response)) { | |
161 | SAYF("Short read from API socket."); | |
162 | } | |
163 | ||
164 | close(sock); | |
165 | ||
166 | if (r.magic != P0F_RESP_MAGIC) { | |
167 | SAYF("Bad response magic (0x%08x).\n", r.magic); | |
168 | return 1; | |
169 | } | |
170 | ||
171 | if (r.status == P0F_STATUS_BADQUERY) { | |
172 | SAYF("P0f did not understand the query.\n"); | |
173 | return 1; | |
174 | } | |
175 | ||
176 | if (r.status == P0F_STATUS_NOMATCH) { | |
177 | SAYF("No matching host in p0f cache. That's all we know.\n"); | |
178 | return 0; | |
179 | } | |
180 | ||
181 | ut = r.first_seen; | |
182 | t = localtime(&ut); | |
183 | strftime((char*)tmp, 128, "%Y/%m/%d %H:%M:%S", t); | |
184 | ||
185 | // SAYF("First seen = %s\n", tmp); | |
186 | ||
187 | ut = r.last_seen; | |
188 | t = localtime(&ut); | |
189 | strftime((char*)tmp, 128, "%Y/%m/%d %H:%M:%S", t); | |
190 | ||
191 | // SAYF("Last update = %s\n", tmp); | |
192 | ||
193 | // SAYF("Total flows = %u\n", r.total_conn); | |
194 | ||
195 | if (!r.os_name[0]) | |
196 | SAYF("Genre and OS details not recognized."); | |
197 | else | |
198 | SAYF("%s %s%s%s", r.os_name, r.os_flavor, | |
199 | (r.os_match_q & P0F_MATCH_GENERIC) ? " [generic]" : "", | |
200 | (r.os_match_q & P0F_MATCH_FUZZY) ? " [fuzzy]" : ""); | |
201 | ||
202 | // if (!r.http_name[0]) | |
203 | // SAYF("HTTP software = ???\n"); | |
204 | // else | |
205 | // SAYF("HTTP software = %s %s (ID %s)\n", r.http_name, r.http_flavor, | |
206 | // (r.bad_sw == 2) ? "is fake" : (r.bad_sw ? "OS mismatch" : "seems legit")); | |
207 | // | |
208 | // if (!r.link_type[0]) | |
209 | // SAYF("Network link = ???\n"); | |
210 | // else | |
211 | // SAYF("Network link = %s\n", r.link_type); | |
212 | // | |
213 | // if (!r.language[0]) | |
214 | // SAYF("Language = ???\n"); | |
215 | // else | |
216 | // SAYF("Language = %s\n", r.language); | |
217 | // | |
218 | // | |
219 | // if (r.distance == -1) | |
220 | // SAYF("Distance = ???\n"); | |
221 | // else | |
222 | // SAYF("Distance = %u\n", r.distance); | |
223 | // | |
224 | // if (r.last_nat) { | |
225 | // ut = r.last_nat; | |
226 | // t = localtime(&ut); | |
227 | // strftime((char*)tmp, 128, "%Y/%m/%d %H:%M:%S", t); | |
228 | // SAYF("IP sharing = %s\n", tmp); | |
229 | // } | |
230 | // | |
231 | // if (r.last_chg) { | |
232 | // ut = r.last_chg; | |
233 | // t = localtime(&ut); | |
234 | // strftime((char*)tmp, 128, "%Y/%m/%d %H:%M:%S", t); | |
235 | // SAYF("Sys change = %s\n", tmp); | |
236 | // } | |
237 | // | |
238 | // if (r.uptime_min) { | |
239 | // SAYF("Uptime = %u days %u hrs %u min (modulo %u days)\n", | |
240 | // r.uptime_min / 60 / 24, (r.uptime_min / 60) % 24, r.uptime_min % 60, | |
241 | // r.up_mod_days); | |
242 | // } | |
243 | ||
244 | return 0; | |
245 | ||
246 | } | |
247 |