Re^11: p0fq.pl and pack

I looked into p0f's source. It appears the format is just a memory dump of the structures you showed earlier.

struct p0f_query q;
recv(c,&q,sizeof(q),MSG_NOSIGNAL)

struct p0f_response r;
send(sock,&r,sizeof(r),MSG_NOSIGNAL)

struct p0f_response* n;
send(sock,n,sizeof(struct p0f_response),MSG_NOSIGNAL)
[download]

In that case, Convert::Binary::C would be simpler to use instead of pack and unpack. (This falls under the "If you know the library that was used to serialize the data, you could potentially use the same library or a port of it to deserialize the data." case I mentioned earlier.)

The layout of a C structure varies by system. If p0f and p0fq.pl are not both executed on the same machine, you'll need to configure your Convert::Binary::C object's ByteOrder and Alignment.

use strict;
use warnings;

use Convert::Binary::C qw( );
use IO::Socket         qw( );
use Net::IP            qw( );

use constant QUERY_MAGIC       => 0x0defaced;
use constant QTYPE_FINGERPRINT => 1;

my %p0h_arch = (
   #ByteOrder => ...,
   #Alignment => ...,
);

{
   die "usage: p0fq.pl p0f_socket src_ip src_port dst_ip dst_port"
      unless @ARGV == 5;

   my $c = Convert::Binary::C
           ->new(%p0h_arch)
           ->parse_file('p0f-query.h');

   # Convert the IPs and pack the request message
   my $src = Net::IP->new($ARGV[1]) or die (Net::IP::Error());
   my $dst = Net::IP->new($ARGV[3]) or die (Net::IP::Error());
   print "$ARGV[1]\n";
   my $query = $c->pack(p0f_query =>
      QUERY_MAGIC,
      QTYPE_FINGERPRINT,
      0x12345678,
      $src->intip(),
      $dst->intip(),
      $ARGV[2],
      $ARGV[4],
   );

   # Open the connection to p0f
   my $sock = IO::Socket::UNIX->new(
      Peer => $ARGV[0],
      Type => SOCK_STREAM,
   )
      or die "Could not create socket: $!\n";

   # Ask p0f
   print $sock $query;
   my $response = <$sock>;  # yuck!
   close $sock;

   # Extract the response from p0f
   my ($magic, $id, $type, $genre, $detail, $dist, $link,
       $tos, $fw, $nat, $real, $score, $mflags, $uptime) =
      $c->unpack(p0h_response => $response);
   die "Bad response magic.\n" if $magic != QUERY_MAGIC;
   die "P0f did not honor our query.\n" if $type == 1;
   die "This connection is not (no longer?) in the cache.\n" if $type 
+== 2;

   # Display result
   print "Genre    : " . $genre . "\n";
   print "Details  : " . $detail . "\n";
   print "Distance : " . $dist . " hops\n";
   print "Link     : " . $link . "\n";
   print "Uptime   : " . $uptime . " hrs\n";
}
[download]

Comment on Re^11: p0fq.pl and pack Select or Download Code

Replies are listed 'Best First'.
Re^12: p0fq.pl and pack by Anonymous Monk on Feb 24, 2007 at 04:42 UTC
I appreciate your patience to guide me :) I don't know much about c and I am perl newbie too, but I feel I am understanding more and more under your guidance, I will try your script and get to know more about how to use Convert::Binary::C, please wait for my feedback :)	[reply]
Re^12: p0fq.pl and pack by macli (Beadle) on Feb 25, 2007 at 06:29 UTC
I tried your script, but it got: "Usage: Convert::Binary::C::pack(THIS, type, data = &PL_sv_undef, string = NULL) at ./p0fq.pl line 30." error I modifed your script as: use strict; use warnings; use Convert::Binary::C qw( ); use IO::Socket; use Net::IP qw( ); use Data::Hexdumper; use constant QUERY_MAGIC => 0x0defaced; use constant QTYPE_FINGERPRINT => 1; die "usage: p0fq.pl p0f_socket src_ip src_port dst_ip dst_port" unless @ARGV == 5; my $c = Convert::Binary::C->new( LongSize => 4, ShortSize => 2, Alignment => 4, ByteOrder => 'BigEndian', ); eval { $c->parse_file("p0f-query.h") }; if ($@) { die "Parse error: $@"; } # Convert the IPs and pack the request message my $src = Net::IP->new( $ARGV[1] ) or die( Net::IP::Error() ); my $dst = Net::IP->new( $ARGV[3] ) or die( Net::IP::Error() ); print "src ip:", ($src->ip()), "\n", "dst ip:", ($dst->ip()), "\n"; my $query = $c->pack( 'p0f_query', { magic => QUERY_MAGIC, type => QTYPE_FINGERPRINT, id => 0x12345678, src_ad => $src->intip(), dst_ad => $dst->intip(), src_port => $ARGV[2], dst_port => $ARGV[4], } ); print "query:\n", hexdump( data => $query, ); # Open the connection to p0f my $sock = IO::Socket::UNIX->new( Peer => $ARGV[0], Type => SOCK_STREAM, ) or die "Could not create socket: $!\n"; # Ask p0f print $sock $query; my $response = <$sock>; # yuck! close $sock; print "response:\n", hexdump( data => $response, ); # Extract the response from p0f my $data = $c->unpack( 'p0f_response', $response ); die "Bad response magic.\n" if $data->{magic} != QUERY_MAGIC; die "P0f did not honor our query.\n" if $data->{type} == 1; die "This connection is not (no longer?) in the cache.\n" if $data->{t +ype} == 2; # Display result print "Genre : " . $data->{genre} . "\n"; print "Details : " . $data->{detail} . "\n"; print "Distance : " . $data->{dist} . " hops\n"; print "Link : " . $data->{link} . "\n"; print "Uptime : " . $data->{uptime} . " hrs\n"; [download] Now the running result as: src ip:192.168.1.2 dst ip:192.168.1.1 query: 0x0000 : 0D EF AC ED 01 00 00 00 12 34 56 78 00 00 00 00 : ......... +4Vx.... 0x0010 : 00 00 00 00 00 00 01 BB + : ........ response: 0x0000 : 0D EF AC ED 12 34 56 78 02 00 00 00 00 00 00 00 : .....4Vx. +....... 0x0010 : 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 : ......... +....... 0x0020 : 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 : ......... +....... 0x0030 : 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 : ......... +....... 0x0040 : 00 00 00 00 00 FF 00 00 00 00 00 00 00 00 00 00 : ......... +....... 0x0050 : 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 : ......... +....... 0x0060 : 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 : ......... +....... 0x0070 : 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 : ......... +....... 0x0080 : 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 : ......... +....... This connection is not (no longer?) in the cache. [download] It is getting close, the strange thing is that the pack method seems eat up the src_ip, dst_ip, from the query hex dump, you can see src_ip and dst_ip are all 0x00, I am lost again.	[reply] [d/l] [select]
Re^13: p0fq.pl and pack by ikegami (Patriarch) on Feb 25, 2007 at 08:41 UTC
I tried your script, but it got: I have never used Convert::Binary::C. I didn't even have it installed. I figured you'd be able to sort out the details. the strange thing is that the pack method seems eat up the src_ip, dst_ip, from the query hex dump ~~Ah, of course! You're feeding it the string `"\xC0\xA8\x00\x01"` (packed) where it's expecting the number `(0xC0<<24)\|(0xA8<<16)\|(0x00<<8)\|(0x01)` (unpacked).~~ ~~`src_ad => unpack('N', $src->intip()), # or 'L'? dst_ad => unpack('N', $dst->intip()), # or 'L'?`~~ ~~[download]~~	[reply] [d/l] [select]
Re^14: p0fq.pl and pack by Anonymous Monk on Feb 26, 2007 at 00:58 UTC
No I am feed it as: `src_ad => $src->intip(), dst_ad => $dst->intip(),` [download] $src->intip() is 3232235778 and $dst-intip() is 3232235777 If If hard coded in the src,dst ip as: `src_ad => '3232235778', dst_ad => '3232235777',` [download] It works, seems Convert::Binary::C pack method won't take varible but constant only, isn't that odd?	[reply] [d/l] [select]
Re^15: p0fq.pl and pack by ikegami (Patriarch) on Feb 26, 2007 at 01:31 UTC
Re^16: p0fq.pl and pack by macli (Beadle) on Feb 26, 2007 at 02:34 UTC
Some notes below your chosen depth have not been shown here