Hi Pablo,
On 2/8/19 5:07 PM, Pablo Neira Ayuso wrote:
> Hi Fernando,
>
> On Fri, Feb 08, 2019 at 03:06:00PM +0100, Fernando Fernandez Mancera wrote:
>> Hi,
>>
>> I have been updating the pf.os signatures with more recent OS
>> fingerprints. I have checked out new Linux, FreeBSD and OpenBSD but only
>> Linux and FreeBSD needed new ones. I have been doing this because it is
>> related with my work during the last Google Summer of Code. In addition,
>> Michal Zalewski is aware of the new fingerprints too.
>>
>> Thanks.
>>
>> P.S: Keep me on Cc. I'm not subscribed to the list.
>>
>> diff --git etc/pf.os etc/pf.os
>> index 41c1bc6a482..8f235876799 100644
>> --- etc/pf.os
>> +++ etc/pf.os
>> @@ -232,6 +232,11 @@ S4:64:1:60:M*,S,T,N,W7: Linux:2.6::Linux 2.6
>> (newer, 3)
>> T4:64:1:60:M*,S,T,N,W7: Linux:2.6::Linux 2.6 (newer, 4)
>>
>> S10:64:1:60:M*,S,T,N,W4:Linux:3.0::Linux 3.0
>> +S10:64:1:60:M*,S,T,N,W6:Linux:3.1::Linux 3.1
>> +S10:64:1:60:M*,S,T,N,W7:Linux:3.4-3.10::Linux 3.4 - 3.10
>> +S20:64:1:60:M*,S,T,N,W7:Linux:3.11-3.19::Linux 3.11 - 3.19
>> +S20:64:1:60:M*,S,T,N,W7:Linux:4.0-4.19::Linux 4.0 - 4.19
>
> Probably merge these two lines above? ie.
> > S20:64:1:60:M*,S,T,N,W7:Linux:3.11-4.19::Linux 3.11 - 4.19
>
I split this one by following the pattern of similar situations for
other fingerprints. eg.
16384:64:1:44:M*: FreeBSD:2.0-2.2::FreeBSD 2.0-4.2
16384:64:1:44:M*: FreeBSD:3.0-3.5::FreeBSD 2.0-4.2
16384:64:1:44:M*: FreeBSD:4.0-4.2::FreeBSD 2.0-4.2
65535:64:1:60:M*,N,W1,N,N,T:FreeBSD:4.7-4.11::FreeBSD 4.7-5.2
65535:64:1:60:M*,N,W1,N,N,T:FreeBSD:5.0-5.2::FreeBSD 4.7-5.2
In my opinion I would make no changes to these two lines. Do you agree?
>> +S44:64:1:60:M*,S,T,N,W7:Linux:4.20::Linux 4.20
>>
>> S3:64:1:60:M*,S,T,N,W1: Linux:2.5::Linux 2.5 (sometimes 2.4)
>> S4:64:1:60:M*,S,T,N,W1: Linux:2.5-2.6::Linux 2.5/2.6
>> @@ -283,6 +288,8 @@ S22:64:1:52:M*,N,N,S,N,W0: Linux:2.2:ts:Linux 2.2
>> w/o timestamps
>> 65535:64:1:60:M*,N,W1,N,N,T:FreeBSD:4.7-4.11::FreeBSD 4.7-5.2
>> 65535:64:1:60:M*,N,W1,N,N,T:FreeBSD:5.0-5.2::FreeBSD 4.7-5.2
>>
>> +65535:64:1:60:M*,N,W6,S,T: FreeBSD:9.0-12.0::FreeBSD 9.0 - 12.0
>> +
>> # XXX need quirks support
>> # 65535:64:1:60:M*,N,W0,N,N,T:Z:FreeBSD:5.1-5.4::5.1-current (1)
>> # 65535:64:1:60:M*,N,W1,N,N,T:Z:FreeBSD:5.1-5.4::5.1-current (2)
