busybox/networking/pscan.c

178 lines
5.3 KiB
C
Raw Normal View History

2007-06-17 02:22:33 +05:30
/*
* Pscan is a mini port scanner implementation for busybox
*
* Copyright 2007 Tito Ragusa <farmatito@tiscali.it>
*
* Licensed under GPLv2 or later, see file LICENSE in this source tree.
2007-06-17 02:22:33 +05:30
*/
//config:config PSCAN
//config: bool "pscan (6 kb)"
//config: default y
//config: help
//config: Simple network port scanner.
//applet:IF_PSCAN(APPLET(pscan, BB_DIR_USR_BIN, BB_SUID_DROP))
//kbuild:lib-$(CONFIG_PSCAN) += pscan.o
2007-06-17 02:22:33 +05:30
//usage:#define pscan_trivial_usage
//usage: "[-cb] [-p MIN_PORT] [-P MAX_PORT] [-t TIMEOUT] [-T MIN_RTT] HOST"
//usage:#define pscan_full_usage "\n\n"
//usage: "Scan a host, print all open ports\n"
//usage: "\n -c Show closed ports too"
//usage: "\n -b Show blocked ports too"
//usage: "\n -p Scan from this port (default 1)"
//usage: "\n -P Scan up to this port (default 1024)"
//usage: "\n -t Timeout (default 5000 ms)"
//usage: "\n -T Minimum rtt (default 5 ms, increase for congested hosts)"
2007-06-17 02:22:33 +05:30
#include "libbb.h"
/* debugging */
#ifdef DEBUG_PSCAN
#define DMSG(...) bb_error_msg(__VA_ARGS__)
#define DERR(...) bb_perror_msg(__VA_ARGS__)
#else
#define DMSG(...) ((void)0)
#define DERR(...) ((void)0)
#endif
static const char *port_name(unsigned port)
{
struct servent *server;
server = getservbyport(htons(port), NULL);
if (server)
return server->s_name;
return "unknown";
}
/* We don't expect to see 1000+ seconds delay, unsigned is enough */
#define MONOTONIC_US() ((unsigned)monotonic_us())
int pscan_main(int argc, char **argv) MAIN_EXTERNALLY_VISIBLE;
2008-07-05 14:48:54 +05:30
int pscan_main(int argc UNUSED_PARAM, char **argv)
2007-06-17 02:22:33 +05:30
{
const char *opt_max_port = "1024"; /* -P: default max port */
const char *opt_min_port = "1"; /* -p: default min port */
const char *opt_timeout = "5000"; /* -t: default timeout in msec */
/* We estimate rtt and wait rtt*4 before concluding that port is
2007-06-17 02:22:33 +05:30
* totally blocked. min rtt of 5 ms may be too low if you are
* scanning an Internet host behind saturated/traffic shaped link.
* Rule of thumb: with min_rtt of N msec, scanning 1000 ports
* will take N seconds at absolute minimum */
const char *opt_min_rtt = "5"; /* -T: default min rtt in msec */
const char *result_str;
2007-06-17 02:22:33 +05:30
len_and_sockaddr *lsap;
int s;
unsigned opt;
2007-06-17 02:22:33 +05:30
unsigned port, max_port, nports;
unsigned closed_ports = 0;
unsigned open_ports = 0;
/* all in usec */
unsigned timeout;
unsigned min_rtt;
unsigned rtt_4;
unsigned start, diff;
2007-06-17 02:22:33 +05:30
getopt32: remove opt_complementary function old new delta vgetopt32 1318 1392 +74 runsvdir_main 703 713 +10 bb_make_directory 423 425 +2 collect_cpu 546 545 -1 opt_chars 3 - -3 opt_complementary 4 - -4 tftpd_main 567 562 -5 ntp_init 476 471 -5 zcip_main 1266 1256 -10 xxd_main 428 418 -10 whois_main 140 130 -10 who_main 463 453 -10 which_main 212 202 -10 wget_main 2535 2525 -10 watchdog_main 291 281 -10 watch_main 222 212 -10 vlock_main 399 389 -10 uuencode_main 332 322 -10 uudecode_main 316 306 -10 unlink_main 45 35 -10 udhcpd_main 1482 1472 -10 udhcpc_main 2762 2752 -10 tune2fs_main 290 280 -10 tunctl_main 366 356 -10 truncate_main 218 208 -10 tr_main 518 508 -10 time_main 1134 1124 -10 tftp_main 286 276 -10 telnetd_main 1873 1863 -10 tcpudpsvd_main 1785 1775 -10 taskset_main 521 511 -10 tar_main 1009 999 -10 tail_main 1644 1634 -10 syslogd_main 1967 1957 -10 switch_root_main 368 358 -10 svlogd_main 1454 1444 -10 sv 1296 1286 -10 stat_main 104 94 -10 start_stop_daemon_main 1028 1018 -10 split_main 542 532 -10 sort_main 796 786 -10 slattach_main 624 614 -10 shuf_main 504 494 -10 setsid_main 96 86 -10 setserial_main 1132 1122 -10 setfont_main 388 378 -10 setconsole_main 78 68 -10 sendmail_main 1209 1199 -10 sed_main 677 667 -10 script_main 1077 1067 -10 run_parts_main 325 315 -10 rtcwake_main 454 444 -10 rm_main 175 165 -10 reformime_main 119 109 -10 readlink_main 123 113 -10 rdate_main 246 236 -10 pwdx_main 189 179 -10 pstree_main 317 307 -10 pscan_main 663 653 -10 popmaildir_main 818 808 -10 pmap_main 80 70 -10 nc_main 1042 1032 -10 mv_main 558 548 -10 mountpoint_main 477 467 -10 mount_main 1264 1254 -10 modprobe_main 768 758 -10 modinfo_main 333 323 -10 mktemp_main 200 190 -10 mkswap_main 324 314 -10 mkfs_vfat_main 1489 1479 -10 microcom_main 715 705 -10 md5_sha1_sum_main 521 511 -10 man_main 867 857 -10 makedevs_main 1052 1042 -10 ls_main 563 553 -10 losetup_main 432 422 -10 loadfont_main 89 79 -10 ln_main 524 514 -10 link_main 75 65 -10 ipcalc_main 544 534 -10 iostat_main 2397 2387 -10 install_main 768 758 -10 id_main 480 470 -10 i2cset_main 1239 1229 -10 i2cget_main 380 370 -10 i2cdump_main 1482 1472 -10 i2cdetect_main 682 672 -10 hwclock_main 406 396 -10 httpd_main 741 731 -10 grep_main 837 827 -10 getty_main 1559 1549 -10 fuser_main 297 287 -10 ftpgetput_main 345 335 -10 ftpd_main 2232 2222 -10 fstrim_main 251 241 -10 fsfreeze_main 77 67 -10 fsck_minix_main 2921 2911 -10 flock_main 314 304 -10 flashcp_main 740 730 -10 flash_eraseall_main 833 823 -10 fdformat_main 532 522 -10 expand_main 680 670 -10 eject_main 335 325 -10 dumpleases_main 630 620 -10 du_main 314 304 -10 dos2unix_main 441 431 -10 diff_main 1350 1340 -10 df_main 1064 1054 -10 date_main 1095 1085 -10 cut_main 961 951 -10 cryptpw_main 228 218 -10 crontab_main 575 565 -10 crond_main 1149 1139 -10 cp_main 370 360 -10 common_traceroute_main 3834 3824 -10 common_ping_main 1767 1757 -10 comm_main 239 229 -10 cmp_main 655 645 -10 chrt_main 379 369 -10 chpst_main 704 694 -10 chpasswd_main 308 298 -10 chown_main 171 161 -10 chmod_main 158 148 -10 cat_main 428 418 -10 bzip2_main 120 110 -10 blkdiscard_main 264 254 -10 base64_main 221 211 -10 arping_main 1665 1655 -10 ar_main 556 546 -10 adjtimex_main 406 396 -10 adduser_main 882 872 -10 addgroup_main 411 401 -10 acpid_main 1198 1188 -10 optstring 11 - -11 opt_string 18 - -18 OPT_STR 25 - -25 ubi_tools_main 1288 1258 -30 ls_options 31 - -31 ------------------------------------------------------------------------------ (add/remove: 0/6 grow/shrink: 3/129 up/down: 86/-1383) Total: -1297 bytes text data bss dec hex filename 915428 485 6876 922789 e14a5 busybox_old 914629 485 6872 921986 e1182 busybox_unstripped Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-08-09 01:25:02 +05:30
opt = getopt32(argv, "^"
"cbp:P:t:T:"
"\0" "=1", /* exactly one non-option */
&opt_min_port, &opt_max_port, &opt_timeout, &opt_min_rtt
);
2007-06-17 02:22:33 +05:30
argv += optind;
max_port = xatou_range(opt_max_port, 1, 65535);
port = xatou_range(opt_min_port, 1, max_port);
2007-06-17 02:22:33 +05:30
nports = max_port - port + 1;
min_rtt = xatou_range(opt_min_rtt, 1, INT_MAX/1000 / 4) * 1000;
timeout = xatou_range(opt_timeout, 1, INT_MAX/1000 / 4) * 1000;
/* Initial rtt is BIG: */
rtt_4 = timeout;
2007-06-17 02:22:33 +05:30
DMSG("min_rtt %u timeout %u", min_rtt, timeout);
lsap = xhost2sockaddr(*argv, port);
printf("Scanning %s ports %u to %u\n Port\tProto\tState\tService\n",
*argv, port, max_port);
for (; port <= max_port; port++) {
DMSG("rtt %u", rtt_4);
/* The SOCK_STREAM socket type is implemented on the TCP/IP protocol. */
set_nport(&lsap->u.sa, htons(port));
s = xsocket(lsap->u.sa.sa_family, SOCK_STREAM, 0);
2007-06-17 02:22:33 +05:30
/* We need unblocking socket so we don't need to wait for ETIMEOUT. */
/* Nonblocking connect typically "fails" with errno == EINPROGRESS */
ndelay_on(s);
2007-06-17 02:22:33 +05:30
DMSG("connect to port %u", port);
result_str = NULL;
start = MONOTONIC_US();
if (connect(s, &lsap->u.sa, lsap->len) == 0) {
2007-06-17 02:22:33 +05:30
/* Unlikely, for me even localhost fails :) */
DMSG("connect succeeded");
goto open;
}
/* Check for untypical errors... */
if (errno != EAGAIN && errno != EINPROGRESS
&& errno != ECONNREFUSED
) {
bb_perror_nomsg_and_die();
}
diff = 0;
2007-06-17 02:22:33 +05:30
while (1) {
if (errno == ECONNREFUSED) {
if (opt & 1) /* -c: show closed too */
result_str = "closed";
2007-06-17 02:22:33 +05:30
closed_ports++;
break;
}
DERR("port %u errno %d @%u", port, errno, diff);
if (diff > rtt_4) {
if (opt & 2) /* -b: show blocked too */
result_str = "blocked";
2007-06-17 02:22:33 +05:30
break;
}
2007-06-17 02:22:33 +05:30
/* Can sleep (much) longer than specified delay.
* We check rtt BEFORE we usleep, otherwise
* on localhost we'll have no writes done (!)
2007-06-17 02:22:33 +05:30
* before we exceed (rather small) rtt */
usleep(rtt_4 / 8);
2007-06-17 02:22:33 +05:30
open:
diff = MONOTONIC_US() - start;
DMSG("write to port %u @%u", port, diff - start);
if (write(s, " ", 1) >= 0) { /* We were able to write to the socket */
2007-06-17 02:22:33 +05:30
open_ports++;
result_str = "open";
2007-06-17 02:22:33 +05:30
break;
}
}
DMSG("out of loop @%u", diff);
if (result_str)
printf("%5u" "\t" "tcp" "\t" "%s" "\t" "%s" "\n",
port, result_str, port_name(port));
2007-06-17 02:22:33 +05:30
/* Estimate new rtt - we don't want to wait entire timeout
* for each port. *4 allows for rise in net delay.
* We increase rtt quickly (rtt_4*4), decrease slowly
* (diff is at least rtt_4/8, *4 == rtt_4/2)
2007-06-17 02:22:33 +05:30
* because we don't want to accidentally miss ports. */
rtt_4 = diff * 4;
2007-06-17 02:22:33 +05:30
if (rtt_4 < min_rtt)
rtt_4 = min_rtt;
if (rtt_4 > timeout)
rtt_4 = timeout;
/* Clean up */
close(s);
}
if (ENABLE_FEATURE_CLEAN_UP) free(lsap);
printf("%u closed, %u open, %u timed out (or blocked) ports\n",
2007-06-17 02:22:33 +05:30
closed_ports,
open_ports,
nports - (closed_ports + open_ports));
return EXIT_SUCCESS;
}