From e60fdcffd2bbb41c587828b97d077d8d6a2c70b9 Mon Sep 17 00:00:00 2001
From: Denton Gentry <dgentry@google.com>
Date: Sun, 4 May 2014 21:49:41 -0700
Subject: [PATCH] SSDP fingerprinting support

The SERVER identification in SSDP could be useful for
client OS fingerprinting. Have minissdpd store the server
entries, and add a new query type (type 5) over the unix
domain socket to retrieve them.
---
 minissdpd.c | 28 +++++++++++++++++++++++-----
 1 file changed, 23 insertions(+), 5 deletions(-)

diff --git a/minissdpd.c b/minissdpd.c
index 520a6c5..dccb694 100644
--- a/minissdpd.c
+++ b/minissdpd.c
@@ -51,11 +51,13 @@ struct header {
 #define HEADER_NT	0
 #define HEADER_USN	1
 #define HEADER_LOCATION	2
+#define HEADER_SERVER	3
+#define HEADER_MAX	4
 
 struct device {
 	struct device * next;
 	time_t t;                 /* validity time */
-	struct header headers[3]; /* NT, USN and LOCATION headers */
+	struct header headers[HEADER_MAX]; /* NT, USN, LOCATION, SERVER hdrs */
 	char data[];
 };
 
@@ -131,7 +133,7 @@ updateDevice(const struct header * headers, time_t t)
 		char * pc;
 		int i;
 		p = malloc(  sizeof(struct device)
-		           + headers[0].l+headers[1].l+headers[2].l );
+		           + headers[0].l+headers[1].l+headers[2].l+headers[3].l );
 		if(!p) {
 			syslog(LOG_ERR, "updateDevice(): cannot allocate memory");
 			return -1;
@@ -139,7 +141,7 @@ updateDevice(const struct header * headers, time_t t)
 		p->next = devlist;
 		p->t = t;
 		pc = p->data;
-		for(i = 0; i < 3; i++)
+		for(i = 0; i < HEADER_MAX; i++)
 		{
 			p->headers[i].p = pc;
 			p->headers[i].l = headers[i].l;
@@ -330,7 +332,7 @@ ParseSSDPPacket(int s, const char * p, ssize_t n,
 	const char * lineend;
 	const char * nameend;
 	const char * valuestart;
-	struct header headers[3];
+	struct header headers[HEADER_MAX];
 	int i, r = 0;
 	int methodlen;
 	int nts = -1;
@@ -392,6 +394,8 @@ ParseSSDPPacket(int s, const char * p, ssize_t n,
 				else if(m==11 && 0==strncasecmp(valuestart, "ssdp:update", 11))
 					nts = NTS_SSDP_UPDATE;
 			}
+			else if(l==6 && 0==strncasecmp(linestart, "server", 6))
+				i = HEADER_SERVER;
 			else if(l==8 && 0==strncasecmp(linestart, "location", 8))
 				i = HEADER_LOCATION;
 			else if(l==13 && 0==strncasecmp(linestart, "cache-control", 13)) {
@@ -569,6 +573,7 @@ void processRequest(struct reqelem * req)
 	case 1:
 	case 2:
 	case 3:
+	case 5:
 		while(d && (nrep < 255)) {
 			if(d->t < t) {
 				syslog(LOG_INFO, "outdated device");
@@ -598,6 +603,19 @@ void processRequest(struct reqelem * req)
 					memcpy(rp, d->headers[HEADER_USN].p, d->headers[HEADER_USN].l);
 					rp += d->headers[HEADER_USN].l;
 					nrep++;
+				} else if (type==5) {
+					/* response :
+					 * 1 - Location
+					 * 2 - server */
+					m = d->headers[HEADER_LOCATION].l;
+					CODELENGTH(m, rp);
+					memcpy(rp, d->headers[HEADER_LOCATION].p, d->headers[HEADER_LOCATION].l);
+					rp += d->headers[HEADER_LOCATION].l;
+					m = d->headers[HEADER_SERVER].l;
+					CODELENGTH(m, rp);
+					memcpy(rp, d->headers[HEADER_SERVER].p, d->headers[HEADER_SERVER].l);
+					rp += d->headers[HEADER_SERVER].l;
+					nrep++;
 				}
 			}
 			d = d->next;
-- 
1.9.1.423.g4596e3a