./p0fq_inlc.pl /var/run/p0f.sock 192.168.1.1 0 192.168.1.2 25
####
Adress 268633816
Adress 268633864
Adress 268633880
Adress 268633896
Adress 268633912
[-] ERROR: Bad IP/port values.
####
use Inline C;
die "usage: p0fq_inlc.pl p0f_socket src_ip src_port dst_ip dst_port"
unless $#ARGV == 4;
p0fq($ARGV[0], $ARGV[1], $ARGV[2], $ARGV[3], $ARGV[4]);
__END__
__C__
#include
#include "../types.h"
#include "../p0f-query.h"
#define debug(x...) fprintf(stderr,x)
#define fatal(x...) do { debug("[-] ERROR: " x); exit(2); } while (0)
#define pfatal(x) do { debug("[-] ERROR: "); perror(x); exit(2); } while (0)
int p0fq(SV* name1, ...) {
Inline_Stack_Vars;
struct sockaddr_un x;
struct p0f_query query;
struct p0f_response response;
_u32 src_add,dst_add,src_port,dst_port;
_s32 sock;
int i;
for (i = 0; i < Inline_Stack_Items; i++) {
printf("Adress %d\n", SvPV(Inline_Stack_Item(i), PL_na));
}
src_add = inet_addr(SvIVX(Inline_Stack_Item(1)));
src_port = atoi(SvIVX(Inline_Stack_Item(2)));
dst_add = inet_addr(SvIVX(Inline_Stack_Item(3)));
dst_port = atoi(SvIVX(Inline_Stack_Item(4)));
if (!dst_port || src_add == INADDR_NONE || dst_add == INADDR_NONE)
fatal("Bad IP/port values.\n");
sock = socket(PF_UNIX,SOCK_STREAM,0);
if (sock < 0) pfatal("socket");
memset(&x,0,sizeof(x));
x.sun_family=AF_UNIX;
strncpy(x.sun_path,SvPV(Inline_Stack_Item(0), PL_na),63);
if (connect(sock,(struct sockaddr*)&x,sizeof(x))) pfatal(SvPV(Inline_Stack_Item(0), PL_na));
query.magic = QUERY_MAGIC;
query.id = 0x12345678;
query.type = QTYPE_FINGERPRINT;
query.src_ad = src_add;
query.dst_ad = dst_add;
query.src_port = src_port;
query.dst_port = dst_port;
if (write(sock,&query,sizeof(query)) != sizeof(query))
fatal("Socket write error (timeout?).\n");
if (read(sock,&response,sizeof(response)) != sizeof(response))
fatal("Response read error (timeout?).\n");
if (response.magic != QUERY_MAGIC)
fatal("Bad response magic.\n");
if (response.type == RESP_BADQUERY)
fatal("P0f did not honor our query.\n");
if (response.type == RESP_NOMATCH) {
printf("This connection is not (no longer?) in the cache.\n");
exit(3);
}
if (!response.genre[0]) {
printf("Genre and OS details not recognized.\n");
} else {
printf("Genre : %s\n",response.genre);
printf("Details : %s\n",response.detail);
if (response.dist != -1) printf("Distance : %d hops\n",response.dist);
}
if (response.link[0]) printf("Link : %s\n",response.link);
if (response.tos[0]) printf("Service : %s\n",response.tos);
if (response.uptime != -1) printf("Uptime : %d hrs\n",response.uptime);
if (response.score != NO_SCORE)
printf("M-Score : %d%% (flags %x).\n",response.score,response.mflags);
if (response.fw) printf("The host is behind a firewall.\n");
if (response.nat) printf("The host is behind NAT or such.\n");
shutdown(sock,2);
close(sock);
return 0;
}