p0f-client.c

   1 /*
   2    p0f-client - simple API client
   3    ------------------------------
   4
   5    Can be used to query p0f API sockets.
   6
   7    Copyright (C) 2012 by Michal Zalewski <lcamtuf@coredump.cx>
   8
   9    Distributed under the terms and conditions of GNU LGPL.
  10
  11  */
  12
  13 #include <stdio.h>
  14 #include <stdlib.h>
  15 #include <unistd.h>
  16 #include <string.h>
  17 #include <netdb.h>
  18 #include <errno.h>
  19 #include <ctype.h>
  20 #include <time.h>
  21
  22 #include <netinet/in.h>
  23 #include <arpa/inet.h>
  24 #include <sys/types.h>
  25 #include <sys/time.h>
  26 #include <sys/socket.h>
  27 #include <sys/un.h>
  28
  29 #include "../types.h"
  30 #include "../config.h"
  31 #include "../alloc-inl.h"
  32 #include "../debug.h"
  33 #include "../api.h"
  34
  35 /* Parse IPv4 address into a buffer. */
  36
  37 static void parse_addr4(char* str, u8* ret) {
  38
  39   u32 a1, a2, a3, a4;
  40
  41   if (sscanf(str, "%u.%u.%u.%u", &a1, &a2, &a3, &a4) != 4)
  42     FATAL("Malformed IPv4 address.");
  43
  44   if (a1 > 255 || a2 > 255 || a3 > 255 || a4 > 255)
  45     FATAL("Malformed IPv4 address.");
  46
  47   ret[0] = a1;
  48   ret[1] = a2;
  49   ret[2] = a3;
  50   ret[3] = a4;
  51
  52 }
  53
  54
  55 /* Parse IPv6 address into a buffer. */
  56
  57 static void parse_addr6(char* str, u8* ret) {
  58
  59   u32 seg = 0;
  60   u32 val;
  61
  62   while (*str) {
  63
  64     if (seg == 8) FATAL("Malformed IPv6 address (too many segments).");
  65
  66     if (sscanf((char*)str, "%x", &val) != 1 ||
  67         val > 65535) FATAL("Malformed IPv6 address (bad octet value).");
  68
  69     ret[seg * 2] = val >> 8;
  70     ret[seg * 2 + 1] = val;
  71
  72     seg++;
  73
  74     while (isxdigit(*str)) str++;
  75     if (*str) str++;
  76
  77   }
  78
  79   if (seg != 8) FATAL("Malformed IPv6 address (don't abbreviate).");
  80
  81 }
  82
  83
  84 int main(int argc, char** argv) {
  85
  86   u8 tmp[128];
  87   struct tm* t;
  88
  89   static struct p0f_api_query q;
  90   static struct p0f_api_response r;
  91
  92   static struct sockaddr_un sun;
  93
  94   s32  sock;
  95   time_t ut;
  96
  97   if (argc != 3) {
  98     ERRORF("Usage: p0f-client /path/to/socket host_ip\n");
  99     exit(1);
 100   }
 101
 102   q.magic = P0F_QUERY_MAGIC;
 103
 104   if (strchr(argv[2], ':')) {
 105
 106     parse_addr6(argv[2], q.addr);
 107     q.addr_type = P0F_ADDR_IPV6;
 108
 109   } else {
 110
 111     parse_addr4(argv[2], q.addr);
 112     q.addr_type = P0F_ADDR_IPV4;
 113
 114   }
 115
 116   sock = socket(PF_UNIX, SOCK_STREAM, 0);
 117
 118   if (sock < 0) PFATAL("Call to socket() failed.");
 119
 120   sun.sun_family = AF_UNIX;
 121
 122   if (strlen(argv[1]) >= sizeof(sun.sun_path))
 123     FATAL("API socket filename is too long for sockaddr_un (blame Unix).");
 124
 125   strcpy(sun.sun_path, argv[1]);
 126
 127   if (connect(sock, (struct sockaddr*)&sun, sizeof(sun)))
 128     PFATAL("Can't connect to API socket.");
 129
 130   if (write(sock, &q, sizeof(struct p0f_api_query)) !=
 131       sizeof(struct p0f_api_query)) FATAL("Short write to API socket.");
 132
 133   if (read(sock, &r, sizeof(struct p0f_api_response)) !=
 134       sizeof(struct p0f_api_response)) FATAL("Short read from API socket.");
 135
 136   close(sock);
 137
 138   if (r.magic != P0F_RESP_MAGIC)
 139     FATAL("Bad response magic (0x%08x).\n", r.magic);
 140
 141   if (r.status == P0F_STATUS_BADQUERY)
 142     FATAL("P0f did not understand the query.\n");
 143
 144   if (r.status == P0F_STATUS_NOMATCH) {
 145     SAYF("No matching host in p0f cache. That's all we know.\n");
 146     return 0;
 147   }
 148
 149   ut = r.first_seen;
 150   t = localtime(&ut);
 151   strftime((char*)tmp, 128, "%Y/%m/%d %H:%M:%S", t);
 152
 153   SAYF("First seen    = %s\n", tmp);
 154
 155   ut = r.last_seen;
 156   t = localtime(&ut);
 157   strftime((char*)tmp, 128, "%Y/%m/%d %H:%M:%S", t);
 158
 159 //  SAYF("Last update   = %s\n", tmp);
 160
 161 //  SAYF("Total flows   = %u\n", r.total_conn);
 162
 163   if (!r.os_name[0])
 164     SAYF("Detected OS   = ???\n");
 165   else
 166     SAYF("Detected OS   = %s %s%s%s\n", r.os_name, r.os_flavor,
 167          (r.os_match_q & P0F_MATCH_GENERIC) ? " [generic]" : "",
 168          (r.os_match_q & P0F_MATCH_FUZZY) ? " [fuzzy]" : "");
 169
 170 //  if (!r.http_name[0])
 171 //    SAYF("HTTP software = ???\n");
 172 //  else
 173 //    SAYF("HTTP software = %s %s (ID %s)\n", r.http_name, r.http_flavor,
 174 //         (r.bad_sw == 2) ? "is fake" : (r.bad_sw ? "OS mismatch" : "seems legit"));
 175 //
 176 //  if (!r.link_type[0])
 177 //    SAYF("Network link  = ???\n");
 178 //  else
 179 //    SAYF("Network link  = %s\n", r.link_type);
 180 //
 181 //  if (!r.language[0])
 182 //    SAYF("Language      = ???\n");
 183 //  else
 184 //    SAYF("Language      = %s\n", r.language);
 185 //
 186 //
 187 //  if (r.distance == -1)
 188 //    SAYF("Distance      = ???\n");
 189 //  else
 190 //    SAYF("Distance      = %u\n", r.distance);
 191 //
 192 //  if (r.last_nat) {
 193 //    ut = r.last_nat;
 194 //    t = localtime(&ut);
 195 //    strftime((char*)tmp, 128, "%Y/%m/%d %H:%M:%S", t);
 196 //    SAYF("IP sharing    = %s\n", tmp);
 197 //  }
 198 //
 199 //  if (r.last_chg) {
 200 //    ut = r.last_chg;
 201 //    t = localtime(&ut);
 202 //    strftime((char*)tmp, 128, "%Y/%m/%d %H:%M:%S", t);
 203 //    SAYF("Sys change    = %s\n", tmp);
 204 //  }
 205 //
 206 //  if (r.uptime_min) {
 207 //    SAYF("Uptime        = %u days %u hrs %u min (modulo %u days)\n",
 208 //         r.uptime_min / 60 / 24, (r.uptime_min / 60) % 24, r.uptime_min % 60,
 209 //         r.up_mod_days);
 210 //  }
 211
 212   return 0;
 213
 214 }