path: root/networking/pscan.c (plain)
blob: 0893c3577f5ce37eaaec02ba10d4f933aec489b3

1	/*
2	* Pscan is a mini port scanner implementation for busybox
3	*
4	* Copyright 2007 Tito Ragusa <farmatito@tiscali.it>
5	*
6	* Licensed under GPLv2 or later, see file LICENSE in this source tree.
7	*/
8	//config:config PSCAN
9	//config: bool "pscan"
10	//config: default y
11	//config: help
12	//config: Simple network port scanner.
13
14	//applet:IF_PSCAN(APPLET(pscan, BB_DIR_USR_BIN, BB_SUID_DROP))
15
16	//kbuild:lib-$(CONFIG_PSCAN) += pscan.o
17
18	//usage:#define pscan_trivial_usage
19	//usage: "[-cb] [-p MIN_PORT] [-P MAX_PORT] [-t TIMEOUT] [-T MIN_RTT] HOST"
20	//usage:#define pscan_full_usage "\n\n"
21	//usage: "Scan a host, print all open ports\n"
22	//usage: "\n -c Show closed ports too"
23	//usage: "\n -b Show blocked ports too"
24	//usage: "\n -p Scan from this port (default 1)"
25	//usage: "\n -P Scan up to this port (default 1024)"
26	//usage: "\n -t Timeout (default 5000 ms)"
27	//usage: "\n -T Minimum rtt (default 5 ms, increase for congested hosts)"
28
29	#include "libbb.h"
30
31	/* debugging */
32	#ifdef DEBUG_PSCAN
33	#define DMSG(...) bb_error_msg(__VA_ARGS__)
34	#define DERR(...) bb_perror_msg(__VA_ARGS__)
35	#else
36	#define DMSG(...) ((void)0)
37	#define DERR(...) ((void)0)
38	#endif
39
40	static const char *port_name(unsigned port)
41	{
42	struct servent *server;
43
44	server = getservbyport(htons(port), NULL);
45	if (server)
46	return server->s_name;
47	return "unknown";
48	}
49
50	/* We don't expect to see 1000+ seconds delay, unsigned is enough */
51	#define MONOTONIC_US() ((unsigned)monotonic_us())
52
53	int pscan_main(int argc, char **argv) MAIN_EXTERNALLY_VISIBLE;
54	int pscan_main(int argc UNUSED_PARAM, char **argv)
55	{
56	const char *opt_max_port = "1024"; /* -P: default max port */
57	const char *opt_min_port = "1"; /* -p: default min port */
58	const char *opt_timeout = "5000"; /* -t: default timeout in msec */
59	/* We estimate rtt and wait rtt*4 before concluding that port is
60	* totally blocked. min rtt of 5 ms may be too low if you are
61	* scanning an Internet host behind saturated/traffic shaped link.
62	* Rule of thumb: with min_rtt of N msec, scanning 1000 ports
63	* will take N seconds at absolute minimum */
64	const char *opt_min_rtt = "5"; /* -T: default min rtt in msec */
65	const char *result_str;
66	len_and_sockaddr *lsap;
67	int s;
68	unsigned opt;
69	unsigned port, max_port, nports;
70	unsigned closed_ports = 0;
71	unsigned open_ports = 0;
72	/* all in usec */
73	unsigned timeout;
74	unsigned min_rtt;
75	unsigned rtt_4;
76	unsigned start, diff;
77
78	opt_complementary = "=1"; /* exactly one non-option */
79	opt = getopt32(argv, "cbp:P:t:T:", &opt_min_port, &opt_max_port, &opt_timeout, &opt_min_rtt);
80	argv += optind;
81	max_port = xatou_range(opt_max_port, 1, 65535);
82	port = xatou_range(opt_min_port, 1, max_port);
83	nports = max_port - port + 1;
84	min_rtt = xatou_range(opt_min_rtt, 1, INT_MAX/1000 / 4) * 1000;
85	timeout = xatou_range(opt_timeout, 1, INT_MAX/1000 / 4) * 1000;
86	/* Initial rtt is BIG: */
87	rtt_4 = timeout;
88
89	DMSG("min_rtt %u timeout %u", min_rtt, timeout);
90
91	lsap = xhost2sockaddr(*argv, port);
92	printf("Scanning %s ports %u to %u\n Port\tProto\tState\tService\n",
93	*argv, port, max_port);
94
95	for (; port <= max_port; port++) {
96	DMSG("rtt %u", rtt_4);
97
98	/* The SOCK_STREAM socket type is implemented on the TCP/IP protocol. */
99	set_nport(&lsap->u.sa, htons(port));
100	s = xsocket(lsap->u.sa.sa_family, SOCK_STREAM, 0);
101	/* We need unblocking socket so we don't need to wait for ETIMEOUT. */
102	/* Nonblocking connect typically "fails" with errno == EINPROGRESS */
103	ndelay_on(s);
104
105	DMSG("connect to port %u", port);
106	result_str = NULL;
107	start = MONOTONIC_US();
108	if (connect(s, &lsap->u.sa, lsap->len) == 0) {
109	/* Unlikely, for me even localhost fails :) */
110	DMSG("connect succeeded");
111	goto open;
112	}
113	/* Check for untypical errors... */
114	if (errno != EAGAIN && errno != EINPROGRESS
115	&& errno != ECONNREFUSED
116	) {
117	bb_perror_nomsg_and_die();
118	}
119
120	diff = 0;
121	while (1) {
122	if (errno == ECONNREFUSED) {
123	if (opt & 1) /* -c: show closed too */
124	result_str = "closed";
125	closed_ports++;
126	break;
127	}
128	DERR("port %u errno %d @%u", port, errno, diff);
129
130	if (diff > rtt_4) {
131	if (opt & 2) /* -b: show blocked too */
132	result_str = "blocked";
133	break;
134	}
135	/* Can sleep (much) longer than specified delay.
136	* We check rtt BEFORE we usleep, otherwise
137	* on localhost we'll have no writes done (!)
138	* before we exceed (rather small) rtt */
139	usleep(rtt_4/8);
140	open:
141	diff = MONOTONIC_US() - start;
142	DMSG("write to port %u @%u", port, diff - start);
143	if (write(s, " ", 1) >= 0) { /* We were able to write to the socket */
144	open_ports++;
145	result_str = "open";
146	break;
147	}
148	}
149	DMSG("out of loop @%u", diff);
150	if (result_str)
151	printf("%5u" "\t" "tcp" "\t" "%s" "\t" "%s" "\n",
152	port, result_str, port_name(port));
153
154	/* Estimate new rtt - we don't want to wait entire timeout
155	* for each port. *4 allows for rise in net delay.
156	* We increase rtt quickly (rtt_4*4), decrease slowly
157	* (diff is at least rtt_4/8, *4 == rtt_4/2)
158	* because we don't want to accidentally miss ports. */
159	rtt_4 = diff * 4;
160	if (rtt_4 < min_rtt)
161	rtt_4 = min_rtt;
162	if (rtt_4 > timeout)
163	rtt_4 = timeout;
164	/* Clean up */
165	close(s);
166	}
167	if (ENABLE_FEATURE_CLEAN_UP) free(lsap);
168
169	printf("%u closed, %u open, %u timed out (or blocked) ports\n",
170	closed_ports,
171	open_ports,
172	nports - (closed_ports + open_ports));
173	return EXIT_SUCCESS;
174	}
175