?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
docs: moved manpages to man, remove talks from repo
[netsniff-ng.git] / astraceroute.c
blobd4c0be3effb1a79eb9125ab24d14f3099f180eaf
1 /*
2 * netsniff-ng - the packet sniffing beast
3 * By Daniel Borkmann <daniel@netsniff-ng.org>
4 * Copyright 2011 Daniel Borkmann.
5 * Subject to the GPL, version 2.
6 *
7 * An Autonomous System trace route utility based on TCP instead of ICMP for
8 * a better passing of firewalls. Supports IPv4 and IPv6. Based on the idea
9 * of tcptraceroute (http://michael.toren.net/code/tcptraceroute/), but hacked
10 * for Autonomous Systems tracing, thus you will know an approximate path of
11 * your curvetun tunneled packets, for instance. However, astraceroute was
12 * written from scratch and does not use any libraries. Special thanks to
13 * Team CYMRU!
14 *
15 * The road must be trod, but it will be very hard. And neither strength nor
16 * wisdom will carry us far upon it. This quest may be attempted by the weak
17 * with as much hope as the strong. Yet such is oft the course of deeds that
18 * move the wheels of the world: small hands do them because they must,
19 * while the eyes of the great are elsewhere.
20 *
21 * -- The Lord of the Rings, Elrond, Chapter 'The Council of Elrond'.
22 */
23
24 #include <stdio.h>
25 #include <stdlib.h>
26 #include <signal.h>
27 #include <getopt.h>
28 #include <ctype.h>
29 #include <stdint.h>
30 #include <sys/types.h>
31 #include <sys/stat.h>
32 #include <sys/socket.h>
33 #include <sys/fsuid.h>
34 #include <fcntl.h>
35 #include <time.h>
36 #include <string.h>
37 #include <asm/byteorder.h>
38 #include <linux/tcp.h>
39 #include <netinet/ip.h>
40 #include <netinet/ip6.h>
41 #include <netinet/in.h>
42 #include <errno.h>
43 #include <netdb.h>
44 #include <arpa/inet.h>
45 #include <linux/if_ether.h>
46 #include <linux/icmp.h>
47 #include <linux/icmpv6.h>
48 #include <GeoIP.h>
49 #include <GeoIPCity.h>
50
51 #include "bpf.h"
52 #include "die.h"
53 #include "tprintf.h"
54 #include "pkt_buff.h"
55 #include "proto.h"
56 #include "xmalloc.h"
57 #include "xio.h"
58 #include "aslookup.h"
59 #include "xutils.h"
60 #include "ring_rx.h"
61 #include "built_in.h"
62
63 #define WHOIS_SERVER_SOURCE "/etc/netsniff-ng/whois.conf"
64
65 struct ash_cfg {
66 char *host;
67 char *port;
68 int init_ttl;
69 int max_ttl;
70 int dns_resolv;
71 char *dev;
72 int queries;
73 int timeout;
74 int syn, ack, ecn, fin, psh, rst, urg;
75 int tos, nofrag;
76 int totlen;
77 char *whois;
78 char *whois_port;
79 int ip;
80 char *payload;
81 };
82
83 volatile sig_atomic_t sigint = 0;
84
85 static int show_pkt = 0;
86
87 static GeoIP *gi_country = NULL;
88 static GeoIP *gi_city = NULL;
89
90 static const char *short_options = "H:p:nNf:m:i:d:q:x:SAEFPURt:Gl:w:W:hv46X:ZLK";
91 static const struct option long_options[] = {
92 {"host", required_argument, NULL, 'H'},
93 {"port", required_argument, NULL, 'p'},
94 {"init-ttl", required_argument, NULL, 'f'},
95 {"max-ttl", required_argument, NULL, 'm'},
96 {"dev", required_argument, NULL, 'd'},
97 {"num-probes", required_argument, NULL, 'q'},
98 {"timeout", required_argument, NULL, 'x'},
99 {"tos", required_argument, NULL, 't'},
100 {"payload", required_argument, NULL, 'X'},
101 {"totlen", required_argument, NULL, 'l'},
102 {"whois", required_argument, NULL, 'w'},
103 {"wport", required_argument, NULL, 'W'},
104 {"city-db", required_argument, NULL, 'L'},
105 {"country-db", required_argument, NULL, 'K'},
106 {"numeric", no_argument, NULL, 'n'},
107 {"dns", no_argument, NULL, 'N'},
108 {"ipv4", no_argument, NULL, '4'},
109 {"ipv6", no_argument, NULL, '6'},
110 {"syn", no_argument, NULL, 'S'},
111 {"ack", no_argument, NULL, 'A'},
112 {"urg", no_argument, NULL, 'U'},
113 {"fin", no_argument, NULL, 'F'},
114 {"psh", no_argument, NULL, 'P'},
115 {"rst", no_argument, NULL, 'R'},
116 {"ecn-syn", no_argument, NULL, 'E'},
117 {"show-packet", no_argument, NULL, 'Z'},
118 {"nofrag", no_argument, NULL, 'G'},
119 {"version", no_argument, NULL, 'v'},
120 {"help", no_argument, NULL, 'h'},
121 {NULL, 0, NULL, 0}
122 };
123
124 static struct sock_filter ipv4_icmp_type_11[] = {
125 /* (000) ldh [12] */
126 { 0x28, 0, 0, 0x0000000c },
127 /* (001) jeq #0x800 jt 2 jf 10 */
128 { 0x15, 0, 8, 0x00000800 },
129 /* (002) ldb [23] */
130 { 0x30, 0, 0, 0x00000017 },
131 /* (003) jeq #0x1 jt 4 jf 10 */
132 { 0x15, 0, 6, 0x00000001 },
133 /* (004) ldh [20] */
134 { 0x28, 0, 0, 0x00000014 },
135 /* (005) jset #0x1fff jt 10 jf 6 */
136 { 0x45, 4, 0, 0x00001fff },
137 /* (006) ldxb 4*([14]&0xf) */
138 { 0xb1, 0, 0, 0x0000000e },
139 /* (007) ldb [x + 14] */
140 { 0x50, 0, 0, 0x0000000e },
141 /* (008) jeq #0xb jt 9 jf 10 */
142 { 0x15, 0, 1, 0x0000000b },
143 /* (009) ret #65535 */
144 { 0x06, 0, 0, 0xffffffff },
145 /* (010) ret #0 */
146 { 0x06, 0, 0, 0x00000000 },
147 };
148
149 static struct sock_filter ipv6_icmp6_type_3[] = {
150 /* (000) ldh [12] */
151 { 0x28, 0, 0, 0x0000000c },
152 /* (001) jeq #0x86dd jt 2 jf 7 */
153 { 0x15, 0, 5, 0x000086dd },
154 /* (002) ldb [20] */
155 { 0x30, 0, 0, 0x00000014 },
156 /* (003) jeq #0x3a jt 4 jf 7 */
157 { 0x15, 0, 3, 0x0000003a },
158 /* (004) ldb [54] */
159 { 0x30, 0, 0, 0x00000036 },
160 /* (005) jeq #0x3 jt 6 jf 7 */
161 { 0x15, 0, 1, 0x00000003 },
162 /* (006) ret #65535 */
163 { 0x06, 0, 0, 0xffffffff },
164 /* (007) ret #0 */
165 { 0x06, 0, 0, 0x00000000 },
166 };
167
168 #define PKT_NOT_FOR_US 0
169 #define PKT_GOOD 1
170
171 static inline const char *make_n_a(const char *p)
172 {
173 return p ? : "N/A";
174 }
175
176 static void signal_handler(int number)
177 {
178 switch (number) {
179 case SIGINT:
180 sigint = 1;
181 break;
182 default:
183 break;
184 }
185 }
186
187 static void header(void)
188 {
189 printf("%s%s%s\n", colorize_start(bold), "astraceroute "
190 VERSION_STRING, colorize_end());
191 }
192
193 static void help(void)
194 {
195
196 printf("\nastraceroute %s, autonomous system trace route utility\n",
197 VERSION_STRING);
198 puts("http://www.netsniff-ng.org\n\n"
199 "Usage: astraceroute [options]\n"
200 "Options:\n"
201 " -H|--host <host> Host/IPv4/IPv6 to lookup AS route to\n"
202 " -p|--port <port> Hosts port to lookup AS route to\n"
203 " -i|-d|--dev <device> Networking device, i.e. eth0\n"
204 " -4|--ipv4 Use IPv4 requests (default)\n"
205 " -6|--ipv6 Use IPv6 requests\n"
206 " -n|--numeric Do not do reverse DNS lookup for hops\n"
207 " -N|--dns Do a reverse DNS lookup for hops\n"
208 " -f|--init-ttl <ttl> Set initial TTL\n"
209 " -m|--max-ttl <ttl> Set maximum TTL (default: 30)\n"
210 " -q|--num-probes <num> Number of max probes for each hop (default: 3)\n"
211 " -x|--timeout <sec> Probe response timeout in sec (default: 3)\n"
212 " -S|--syn Set TCP SYN flag in packets\n"
213 " -A|--ack Set TCP ACK flag in packets\n"
214 " -F|--fin Set TCP FIN flag in packets\n"
215 " -P|--psh Set TCP PSH flag in packets\n"
216 " -U|--urg Set TCP URG flag in packets\n"
217 " -R|--rst Set TCP RST flag in packets\n"
218 " -E|--ecn-syn Send ECN SYN packets (RFC3168)\n"
219 " -t|--tos <tos> Set the IP TOS field\n"
220 " -G|--nofrag Set do not fragment bit\n"
221 " -X|--payload <string> Specify a payload string to test DPIs\n"
222 " -Z|--show-packet Show returned packet on each hop\n"
223 " -l|--totlen <len> Specify total packet len\n"
224 " -w|--whois <server> Use a different AS whois DB server\n"
225 " (default: /etc/netsniff-ng/whois.conf)\n"
226 " -W|--wport <port> Use a different port to AS whois server\n"
227 " (default: /etc/netsniff-ng/whois.conf)\n"
228 " --city-db <path> Specifiy path for geoip city database\n"
229 " --country-db <path> Specifiy path for geoip country database\n"
230 " -v|--version Print version\n"
231 " -h|--help Print this help\n\n"
232 "Examples:\n"
233 " IPv4 trace of AS with TCP SYN probe (this will most-likely pass):\n"
234 " astraceroute -i eth0 -N -S -H netsniff-ng.org\n"
235 " IPv4 trace of AS with TCP ECN SYN probe:\n"
236 " astraceroute -i eth0 -N -E -H netsniff-ng.org\n"
237 " IPv4 trace of AS with TCP FIN probe:\n"
238 " astraceroute -i eth0 -N -F -H netsniff-ng.org\n"
239 " IPv4 trace of AS with Xmas probe:\n"
240 " astraceroute -i eth0 -N -FPU -H netsniff-ng.org\n"
241 " IPv4 trace of AS with Null probe with ASCII payload:\n"
242 " astraceroute -i eth0 -N -H netsniff-ng.org -X \"censor-me\" -Z\n"
243 " IPv6 trace of AS up to www.6bone.net:\n"
244 " astraceroute -6 -i eth0 -S -E -N -H www.6bone.net\n\n"
245 "Note:\n"
246 " If the TCP probe did not give any results, then astraceroute will\n"
247 " automatically probe for classic ICMP packets! To gather more\n"
248 " information about astraceroute's fetched AS numbers, see i.e.\n"
249 " http://bgp.he.net/AS<number>!\n\n"
250 "Please report bugs to <bugs@netsniff-ng.org>\n"
251 "Copyright (C) 2011-2012 Daniel Borkmann <daniel@netsniff-ng.org>\n"
252 "Swiss federal institute of technology (ETH Zurich)\n"
253 "License: GNU GPL version 2.0\n"
254 "This is free software: you are free to change and redistribute it.\n"
255 "There is NO WARRANTY, to the extent permitted by law.\n");
256 die();
257 }
258
259 static void version(void)
260 {
261 printf("\nastraceroute %s, autonomous system trace route utility\n",
262 VERSION_STRING);
263 puts("http://www.netsniff-ng.org\n\n"
264 "Please report bugs to <bugs@netsniff-ng.org>\n"
265 "Copyright (C) 2011-2012 Daniel Borkmann <daniel@netsniff-ng.org>\n"
266 "Swiss federal institute of technology (ETH Zurich)\n"
267 "License: GNU GPL version 2.0\n"
268 "This is free software: you are free to change and redistribute it.\n"
269 "There is NO WARRANTY, to the extent permitted by law.\n");
270 die();
271 }
272
273 static inline unsigned short csum(unsigned short *buf, int nwords)
274 {
275 unsigned long sum;
276
277 for (sum = 0; nwords > 0; nwords--)
278 sum += *buf++;
279 sum = (sum >> 16) + (sum & 0xffff);
280 sum += (sum >> 16);
281
282 return ~sum;
283 }
284
285 static void assemble_data(uint8_t *packet, size_t len, const char *payload)
286 {
287 int i;
288
289 if (payload == NULL) {
290 for (i = 0; i < len; ++i)
291 packet[i] = (uint8_t) rand();
292 } else {
293 int lmin = min(len, strlen(payload));
294 for (i = 0; i < lmin; ++i)
295 packet[i] = (uint8_t) payload[i];
296 for (i = lmin; i < len; ++i)
297 packet[i] = (uint8_t) rand();
298 }
299 }
300
301 static void assemble_icmp4(uint8_t *packet, size_t len)
302 {
303 struct icmphdr *icmph = (struct icmphdr *) packet;
304
305 bug_on(len < sizeof(struct icmphdr));
306
307 icmph->type = ICMP_ECHO;
308 icmph->code = 0;
309 icmph->checksum = 0;
310 }
311
312 static void assemble_icmp6(uint8_t *packet, size_t len)
313 {
314 struct icmp6hdr *icmp6h = (struct icmp6hdr *) packet;
315
316 bug_on(len < sizeof(struct icmp6hdr));
317
318 icmp6h->icmp6_type = ICMPV6_ECHO_REQUEST;
319 icmp6h->icmp6_code = 0;
320 icmp6h->icmp6_cksum = 0;
321 }
322
323 static void assemble_tcp(uint8_t *packet, size_t len, int syn, int ack,
324 int urg, int fin, int rst, int psh, int ecn, int dport)
325 {
326 struct tcphdr *tcph = (struct tcphdr *) packet;
327
328 bug_on(len < sizeof(struct tcphdr));
329
330 tcph->source = htons((uint16_t) rand());
331 tcph->dest = htons((uint16_t) dport);
332 tcph->seq = htonl(rand());
333 tcph->ack_seq = (!!ack ? htonl(rand()) : 0);
334 tcph->doff = 5;
335 tcph->syn = !!syn;
336 tcph->ack = !!ack;
337 tcph->urg = !!urg;
338 tcph->fin = !!fin;
339 tcph->rst = !!rst;
340 tcph->psh = !!psh;
341 tcph->ece = !!ecn;
342 tcph->cwr = !!ecn;
343 tcph->window = htons((uint16_t) (100 + (rand() % 65435)));
344 tcph->check = 0;
345 tcph->urg_ptr = (!!urg ? htons((uint16_t) rand()) : 0);
346 }
347
348 static int assemble_ipv4_tcp(uint8_t *packet, size_t len, int ttl,
349 int tos, const struct sockaddr *dst,
350 const struct sockaddr *src, int syn, int ack,
351 int urg, int fin, int rst, int psh, int ecn,
352 int nofrag, int dport, const char *payload)
353 {
354 struct iphdr *iph = (struct iphdr *) packet;
355 uint8_t *data;
356 size_t data_len;
357
358 bug_on(!src || !dst);
359 bug_on(src->sa_family != PF_INET || dst->sa_family != PF_INET);
360 bug_on(len < sizeof(*iph) + sizeof(struct tcphdr));
361
362 iph->ihl = 5;
363 iph->version = 4;
364 iph->tos = (uint8_t) tos;
365 iph->tot_len = htons((uint16_t) len);
366 iph->id = htons((uint16_t) rand());
367 iph->frag_off = nofrag ? IP_DF : 0;
368 iph->ttl = (uint8_t) ttl;
369 iph->protocol = 6; /* TCP */
370 iph->saddr = ((const struct sockaddr_in *) src)->sin_addr.s_addr;
371 iph->daddr = ((const struct sockaddr_in *) dst)->sin_addr.s_addr;
372
373 data = packet + sizeof(*iph);
374 data_len = len - sizeof(*iph);
375 assemble_tcp(data, data_len, syn, ack, urg, fin, rst, psh, ecn, dport);
376
377 data = packet + sizeof(*iph) + sizeof(struct tcphdr);
378 data_len = len - sizeof(*iph) - sizeof(struct tcphdr);
379 assemble_data(data, data_len, payload);
380
381 iph->check = csum((unsigned short *) packet, ntohs(iph->tot_len) >> 1);
382
383 return ntohs(iph->id);
384 }
385
386 static int assemble_ipv6_tcp(uint8_t *packet, size_t len, int ttl,
387 const struct sockaddr *dst,
388 const struct sockaddr *src, int syn, int ack,
389 int urg, int fin, int rst, int psh, int ecn,
390 int dport, const char *payload)
391 {
392 struct ip6_hdr *ip6h = (struct ip6_hdr *) packet;
393 uint8_t *data;
394 size_t data_len;
395
396 bug_on(!src || !dst);
397 bug_on(src->sa_family != PF_INET6 || dst->sa_family != PF_INET6);
398 bug_on(len < sizeof(*ip6h) + sizeof(struct tcphdr));
399
400 ip6h->ip6_flow = htonl(rand() & 0x000fffff);
401 ip6h->ip6_vfc = 0x60;
402 ip6h->ip6_plen = htons((uint16_t) len - sizeof(*ip6h));
403 ip6h->ip6_nxt = 6; /* TCP */
404 ip6h->ip6_hlim = (uint8_t) ttl;
405 memcpy(&ip6h->ip6_src, &(((const struct sockaddr_in6 *)
406 src)->sin6_addr), sizeof(ip6h->ip6_src));
407 memcpy(&ip6h->ip6_dst, &(((const struct sockaddr_in6 *)
408 dst)->sin6_addr), sizeof(ip6h->ip6_dst));
409
410 data = packet + sizeof(*ip6h);
411 data_len = len - sizeof(*ip6h);
412 assemble_tcp(data, data_len, syn, ack, urg, fin, rst, psh, ecn, dport);
413
414 data = packet + sizeof(*ip6h) + sizeof(struct tcphdr);
415 data_len = len - sizeof(*ip6h) - sizeof(struct tcphdr);
416 assemble_data(data, data_len, payload);
417
418 return ntohl(ip6h->ip6_flow) & 0x000fffff;
419 }
420
421 static int assemble_ipv6_icmp6(uint8_t *packet, size_t len, int ttl,
422 const struct sockaddr *dst,
423 const struct sockaddr *src,
424 const char *payload)
425 {
426 struct ip6_hdr *ip6h = (struct ip6_hdr *) packet;
427 uint8_t *data;
428 size_t data_len;
429
430 bug_on(!src || !dst);
431 bug_on(src->sa_family != PF_INET6 || dst->sa_family != PF_INET6);
432 bug_on(len < sizeof(*ip6h) + sizeof(struct icmp6hdr));
433
434 ip6h->ip6_flow = htonl(rand() & 0x000fffff);
435 ip6h->ip6_vfc = 0x60;
436 ip6h->ip6_plen = htons((uint16_t) len - sizeof(*ip6h));
437 ip6h->ip6_nxt = 0x3a; /* ICMP6 */
438 ip6h->ip6_hlim = (uint8_t) ttl;
439 memcpy(&ip6h->ip6_src, &(((const struct sockaddr_in6 *)
440 src)->sin6_addr), sizeof(ip6h->ip6_src));
441 memcpy(&ip6h->ip6_dst, &(((const struct sockaddr_in6 *)
442 dst)->sin6_addr), sizeof(ip6h->ip6_dst));
443
444 data = packet + sizeof(*ip6h);
445 data_len = len - sizeof(*ip6h);
446 assemble_icmp6(data, data_len);
447
448 data = packet + sizeof(*ip6h) + sizeof(struct icmp6hdr);
449 data_len = len - sizeof(*ip6h) - sizeof(struct icmp6hdr);
450 assemble_data(data, data_len, payload);
451
452 return ntohl(ip6h->ip6_flow) & 0x000fffff;
453 }
454
455 static int assemble_ipv4_icmp4(uint8_t *packet, size_t len, int ttl,
456 int tos, const struct sockaddr *dst,
457 const struct sockaddr *src, int nofrag,
458 const char *payload)
459 {
460 struct iphdr *iph = (struct iphdr *) packet;
461 uint8_t *data;
462 size_t data_len;
463
464 bug_on(!src || !dst);
465 bug_on(src->sa_family != PF_INET || dst->sa_family != PF_INET);
466 bug_on(len < sizeof(struct iphdr) + sizeof(struct icmphdr));
467
468 iph->ihl = 5;
469 iph->version = 4;
470 iph->tos = 0;
471 iph->tot_len = htons((uint16_t) len);
472 iph->id = htons((uint16_t) rand());
473 iph->frag_off = nofrag ? IP_DF : 0;
474 iph->ttl = (uint8_t) ttl;
475 iph->protocol = 1; /* ICMP4 */
476 iph->saddr = ((const struct sockaddr_in *) src)->sin_addr.s_addr;
477 iph->daddr = ((const struct sockaddr_in *) dst)->sin_addr.s_addr;
478
479 data = packet + sizeof(*iph);
480 data_len = len - sizeof(*iph);
481 assemble_icmp4(data, data_len);
482
483 data = packet + sizeof(*iph) + sizeof(struct icmphdr);
484 data_len = len - sizeof(*iph) - sizeof(struct icmphdr);
485 assemble_data(data, data_len, payload);
486
487 iph->check = csum((unsigned short *) packet, ntohs(iph->tot_len) >> 1);
488
489 return ntohs(iph->id);
490 }
491
492 static int assemble_packet_or_die(uint8_t *packet, size_t len,
493 int ttl, int icmp,
494 const struct ash_cfg *cfg,
495 const struct sockaddr *dst,
496 const struct sockaddr *src)
497 {
498 if (icmp) {
499 if (cfg->ip == 4) {
500 return assemble_ipv4_icmp4(packet, len, ttl, cfg->tos,
501 dst, src, cfg->nofrag,
502 cfg->payload);
503 } else {
504 return assemble_ipv6_icmp6(packet, len, ttl, dst, src,
505 cfg->payload);
506 }
507 } else {
508 if (cfg->ip == 4) {
509 return assemble_ipv4_tcp(packet, len, ttl, cfg->tos,
510 dst, src, cfg->syn, cfg->ack,
511 cfg->urg, cfg->fin, cfg->rst,
512 cfg->psh, cfg->ecn,
513 cfg->nofrag, atoi(cfg->port),
514 cfg->payload);
515 } else {
516 return assemble_ipv6_tcp(packet, len, ttl, dst, src,
517 cfg->syn, cfg->ack, cfg->urg,
518 cfg->fin, cfg->rst, cfg->psh,
519 cfg->ecn, atoi(cfg->port),
520 cfg->payload);
521 }
522 }
523
524 return -EIO;
525 }
526
527 static int handle_ipv4_icmp(uint8_t *packet, size_t len, int ttl, int id,
528 const struct sockaddr *own, int dns_resolv)
529 {
530 int ret;
531 struct iphdr *iph = (struct iphdr *) packet;
532 struct iphdr *iph_inner;
533 struct icmphdr *icmph;
534 char *hbuff;
535 struct sockaddr_in sa;
536 struct asrecord rec;
537 GeoIPRecord *gir;
538
539 if (iph->protocol != 1)
540 return PKT_NOT_FOR_US;
541 if (iph->daddr != ((const struct sockaddr_in *) own)->sin_addr.s_addr)
542 return PKT_NOT_FOR_US;
543
544 icmph = (struct icmphdr *) (packet + sizeof(struct iphdr));
545 if (icmph->type != ICMP_TIME_EXCEEDED)
546 return PKT_NOT_FOR_US;
547 if (icmph->code != ICMP_EXC_TTL)
548 return PKT_NOT_FOR_US;
549
550 iph_inner = (struct iphdr *) (packet + sizeof(struct iphdr) +
551 sizeof(struct icmphdr));
552 if (ntohs(iph_inner->id) != id)
553 return PKT_NOT_FOR_US;
554
555 hbuff = xzmalloc(NI_MAXHOST);
556
557 memset(&sa, 0, sizeof(sa));
558 sa.sin_family = PF_INET;
559 sa.sin_addr.s_addr = iph->saddr;
560
561 getnameinfo((struct sockaddr *) &sa, sizeof(sa), hbuff, NI_MAXHOST,
562 NULL, 0, NI_NUMERICHOST);
563
564 memset(&rec, 0, sizeof(rec));
565 ret = aslookup(hbuff, &rec);
566 if (ret < 0)
567 panic("AS lookup error %d!\n", ret);
568
569 gir = GeoIP_record_by_ipnum(gi_city, ntohl(iph->saddr));
570 if (!dns_resolv) {
571 if (strlen(rec.country) > 0 && gir) {
572 const char *city = make_n_a(gir->city);
573
574 printf("%s in AS%s (%s, %s, %s, %f, %f), %s %s (%s), %s", hbuff,
575 rec.number, rec.country,
576 GeoIP_country_name_by_ipnum(gi_country, ntohl(iph->saddr)),
577 city, gir->latitude, gir->longitude,
578 rec.prefix, rec.registry, rec.since, rec.name);
579 } else if (strlen(rec.country) > 0 && !gir) {
580 printf("%s in AS%s (%s, %s), %s %s (%s), %s", hbuff,
581 rec.number, rec.country,
582 GeoIP_country_name_by_ipnum(gi_country, ntohl(iph->saddr)),
583 rec.prefix, rec.registry, rec.since, rec.name);
584 } else {
585 printf("%s in unknown AS", hbuff);
586 }
587 } else {
588 struct hostent *hent = gethostbyaddr(&sa.sin_addr,
589 sizeof(sa.sin_addr),
590 PF_INET);
591
592 if (strlen(rec.country) > 0 && gir) {
593 const char *city = make_n_a(gir->city);
594 printf("%s (%s) in AS%s (%s, %s, %s, %f, %f), %s %s (%s), %s",
595 (hent ? hent->h_name : hbuff), hbuff,
596 rec.number, rec.country,
597 GeoIP_country_name_by_ipnum(gi_country, ntohl(iph->saddr)),
598 city, gir->latitude, gir->longitude,
599 rec.prefix, rec.registry,
600 rec.since, rec.name);
601 } else if (strlen(rec.country) > 0 && !gir) {
602 printf("%s (%s) in AS%s (%s, %s), %s %s (%s), %s",
603 (hent ? hent->h_name : hbuff), hbuff,
604 rec.number, rec.country,
605 GeoIP_country_name_by_ipnum(gi_country, ntohl(iph->saddr)),
606 rec.prefix, rec.registry,
607 rec.since, rec.name);
608 } else {
609 printf("%s (%s) in unknown AS",
610 (hent ? hent->h_name : hbuff), hbuff);
611 }
612 }
613
614 xfree(hbuff);
615
616 return PKT_GOOD;
617 }
618
619 static int handle_ipv6_icmp(uint8_t *packet, size_t len, int ttl, int id,
620 const struct sockaddr *own, int dns_resolv)
621 {
622 int ret;
623 struct ip6_hdr *ip6h = (struct ip6_hdr *) packet;
624 struct ip6_hdr *ip6h_inner;
625 struct icmp6hdr *icmp6h;
626 char *hbuff;
627 struct sockaddr_in6 sa;
628 struct asrecord rec;
629 GeoIPRecord *gir;
630
631 if (ip6h->ip6_nxt != 0x3a)
632 return PKT_NOT_FOR_US;
633 if (memcmp(&ip6h->ip6_dst, &(((const struct sockaddr_in6 *)
634 own)->sin6_addr), sizeof(ip6h->ip6_dst)))
635 return PKT_NOT_FOR_US;
636
637 icmp6h = (struct icmp6hdr *) (packet + sizeof(*ip6h));
638 if (icmp6h->icmp6_type != ICMPV6_TIME_EXCEED)
639 return PKT_NOT_FOR_US;
640 if (icmp6h->icmp6_code != ICMPV6_EXC_HOPLIMIT)
641 return PKT_NOT_FOR_US;
642
643 ip6h_inner = (struct ip6_hdr *) (packet + sizeof(*ip6h) + sizeof(*icmp6h));
644 if ((ntohl(ip6h_inner->ip6_flow) & 0x000fffff) != id)
645 return PKT_NOT_FOR_US;
646
647 hbuff = xzmalloc(NI_MAXHOST);
648
649 memset(&sa, 0, sizeof(sa));
650 sa.sin6_family = PF_INET6;
651 memcpy(&sa.sin6_addr, &ip6h->ip6_src, sizeof(ip6h->ip6_src));
652
653 getnameinfo((struct sockaddr *) &sa, sizeof(sa), hbuff, NI_MAXHOST,
654 NULL, 0, NI_NUMERICHOST);
655
656 memset(&rec, 0, sizeof(rec));
657 ret = aslookup(hbuff, &rec);
658 if (ret < 0)
659 panic("AS lookup error %d!\n", ret);
660
661 gir = GeoIP_record_by_ipnum_v6(gi_city, sa.sin6_addr);
662 if (!dns_resolv) {
663 if (strlen(rec.country) > 0 && gir) {
664 const char *city = make_n_a(gir->city);
665
666 printf("%s in AS%s (%s, %s, %s, %f, %f), %s %s (%s), %s", hbuff,
667 rec.number, rec.country,
668 GeoIP_country_name_by_ipnum_v6(gi_country, sa.sin6_addr),
669 city, gir->latitude, gir->longitude,
670 rec.prefix, rec.registry, rec.since, rec.name);
671 } else if (strlen(rec.country) > 0 && !gir) {
672 printf("%s in AS%s (%s, %s), %s %s (%s), %s", hbuff,
673 rec.number, rec.country,
674 GeoIP_country_name_by_ipnum_v6(gi_country, sa.sin6_addr),
675 rec.prefix, rec.registry, rec.since, rec.name);
676 } else {
677 printf("%s in unknown AS", hbuff);
678 }
679 } else {
680 struct hostent *hent = gethostbyaddr(&sa.sin6_addr,
681 sizeof(sa.sin6_addr),
682 PF_INET6);
683
684 if (strlen(rec.country) > 0 && gir) {
685 const char *city = make_n_a(gir->city);
686 printf("%s (%s) in AS%s (%s, %s, %s, %f, %f), %s %s (%s), %s",
687 (hent ? hent->h_name : hbuff), hbuff,
688 rec.number, rec.country,
689 GeoIP_country_name_by_ipnum_v6(gi_country, sa.sin6_addr),
690 city, gir->latitude, gir->longitude,
691 rec.prefix, rec.registry,
692 rec.since, rec.name);
693 } else if (strlen(rec.country) > 0 && !gir) {
694 printf("%s (%s) in AS%s (%s, %s), %s %s (%s), %s",
695 (hent ? hent->h_name : hbuff), hbuff,
696 rec.number, rec.country,
697 GeoIP_country_name_by_ipnum_v6(gi_country, sa.sin6_addr),
698 rec.prefix, rec.registry,
699 rec.since, rec.name);
700 } else {
701 printf("%s (%s) in unknown AS",
702 (hent ? hent->h_name : hbuff), hbuff);
703 }
704 }
705
706 xfree(hbuff);
707
708 return PKT_GOOD;
709 }
710
711 static int handle_packet(uint8_t *packet, size_t len, int ip, int ttl, int id,
712 struct sockaddr *own, int dns_resolv)
713 {
714 if (ip == 4)
715 return handle_ipv4_icmp(packet, len, ttl, id, own, dns_resolv);
716 else
717 return handle_ipv6_icmp(packet, len, ttl, id, own, dns_resolv);
718 }
719
720 static int do_trace(const struct ash_cfg *cfg)
721 {
722 int ttl, query, fd = -1, one = 1, ret, fd_cap, ifindex;
723 int is_okay = 0, id, timeout_poll;
724 uint8_t *packet, *packet_rcv;
725 ssize_t err, real_len, sd_len;
726 size_t len, len_rcv;
727 struct addrinfo hints, *ahead, *ai;
728 char *hbuff1, *hbuff2;
729 struct sockaddr_storage ss, sd;
730 struct sock_fprog bpf_ops;
731 struct ring dummy_ring;
732 struct pollfd pfd;
733
734 srand(time(NULL));
735
736 memset(&hints, 0, sizeof(hints));
737 hints.ai_family = PF_UNSPEC;
738 hints.ai_socktype = SOCK_STREAM;
739 hints.ai_protocol = IPPROTO_TCP;
740 hints.ai_flags = AI_NUMERICSERV;
741
742 ret = getaddrinfo(cfg->host, cfg->port, &hints, &ahead);
743 if (ret < 0) {
744 whine("Cannot get address info!\n");
745 return -EIO;
746 }
747
748 for (ai = ahead; ai != NULL && fd < 0; ai = ai->ai_next) {
749 if (!((ai->ai_family == PF_INET6 && cfg->ip == 6) ||
750 (ai->ai_family == PF_INET && cfg->ip == 4)))
751 continue;
752 fd = socket(ai->ai_family, SOCK_RAW, IPPROTO_RAW);
753 if (fd < 0)
754 continue;
755 fd_cap = pf_socket();
756
757 memset(&ss, 0, sizeof(ss));
758 ret = device_address(cfg->dev, ai->ai_family, &ss);
759 if (ret < 0)
760 panic("Cannot get own device address!\n");
761
762 ret = bind(fd, (struct sockaddr *) &ss, sizeof(ss));
763 if (ret < 0)
764 panic("Cannot bind socket!\n");
765
766 memset(&sd, 0, sizeof(sd));
767 memcpy(&sd, ai->ai_addr, ai->ai_addrlen);
768 if (ai->ai_family == PF_INET6) {
769 struct sockaddr_in6 *sd6 = (struct sockaddr_in6 *) &sd;
770 sd6->sin6_port = htons(0);
771 }
772 sd_len = ai->ai_addrlen;
773
774 break;
775 }
776
777 freeaddrinfo(ahead);
778
779 if (fd < 0) {
780 whine("Cannot create socket! Does remote support IPv%d?!\n",
781 cfg->ip);
782 return -EIO;
783 }
784
785 len = cfg->totlen;
786 if (cfg->ip == 4) {
787 if (len < sizeof(struct iphdr) + sizeof(struct tcphdr)) {
788 len = sizeof(struct iphdr) + sizeof(struct tcphdr);
789 if (cfg->payload)
790 len += strlen(cfg->payload);
791 }
792 } else {
793 if (len < sizeof(struct ip6_hdr) + sizeof(struct tcphdr)) {
794 len = sizeof(struct ip6_hdr) + sizeof(struct tcphdr);
795 if (cfg->payload)
796 len += strlen(cfg->payload);
797 }
798 }
799
800 len_rcv = device_mtu(cfg->dev);
801 if (len >= len_rcv)
802 panic("Packet len exceeds device MTU!\n");
803
804 packet = xmalloc(len);
805 packet_rcv = xmalloc(len_rcv);
806
807 hbuff1 = xzmalloc(256);
808 getnameinfo((struct sockaddr *) &sd, sizeof(sd), hbuff1, 256,
809 NULL, 0, NI_NUMERICHOST);
810
811 hbuff2 = xzmalloc(256);
812 getnameinfo((struct sockaddr *) &ss, sizeof(ss), hbuff2, 256,
813 NULL, 0, NI_NUMERICHOST);
814
815 ret = setsockopt(fd, cfg->ip == 4 ? IPPROTO_IP : IPPROTO_IPV6,
816 IP_HDRINCL, &one, sizeof(one));
817 if (ret < 0)
818 panic("Kernel does not support IP_HDRINCL!\n");
819
820 printf("AS path IPv%d TCP trace from %s to %s:%s (%s) with len %zu "
821 "Bytes, %u max hops\n", cfg->ip, hbuff2, hbuff1, cfg->port,
822 cfg->host, len, cfg->max_ttl);
823
824 printf("Using flags SYN:%d,ACK:%d,ECN:%d,FIN:%d,PSH:%d,RST:%d,URG:%d\n",
825 cfg->syn, cfg->ack, cfg->ecn, cfg->fin, cfg->psh, cfg->rst,
826 cfg->urg);
827
828 if (cfg->payload)
829 printf("With payload: \'%s\'\n", cfg->payload);
830
831 fflush(stdout);
832
833 xfree(hbuff1);
834 xfree(hbuff2);
835
836 hbuff1 = hbuff2 = NULL;
837
838 enable_kernel_bpf_jit_compiler();
839
840 memset(&bpf_ops, 0, sizeof(bpf_ops));
841 if (cfg->ip == 4) {
842 bpf_ops.filter = ipv4_icmp_type_11;
843 bpf_ops.len = (sizeof(ipv4_icmp_type_11) /
844 sizeof(ipv4_icmp_type_11[0]));
845 } else {
846 bpf_ops.filter = ipv6_icmp6_type_3;
847 bpf_ops.len = (sizeof(ipv6_icmp6_type_3) /
848 sizeof(ipv6_icmp6_type_3[0]));
849 }
850
851 bpf_attach_to_sock(fd_cap, &bpf_ops);
852 ifindex = device_ifindex(cfg->dev);
853 bind_rx_ring(fd_cap, &dummy_ring, ifindex);
854 prepare_polling(fd_cap, &pfd);
855
856 timeout_poll = (cfg->timeout > 0 ? cfg->timeout : 3) * 1000;
857
858 for (ttl = cfg->init_ttl; ttl <= cfg->max_ttl; ++ttl) {
859 int icmp = 0;
860 is_okay = 0;
861
862 if ((ttl == cfg->init_ttl && !show_pkt) ||
863 (ttl > cfg->init_ttl)) {
864 printf("%2d: ", ttl);
865 fflush(stdout);
866 }
867 retry:
868 for (query = 0; query < cfg->queries && !is_okay; ++query) {
869 id = assemble_packet_or_die(packet, len, ttl, icmp, cfg,
870 (struct sockaddr *) &sd,
871 (struct sockaddr *) &ss);
872 if (ttl == cfg->init_ttl && query == 0 && show_pkt) {
873 struct pkt_buff *pkt;
874
875 printf("Original packet:\n");
876
877 pkt = pkt_alloc(packet, len);
878 hex_ascii(pkt);
879 tprintf_flush();
880 pkt_free(pkt);
881
882 printf("\n%2d: ", ttl);
883 fflush(stdout);
884 }
885
886 err = sendto(fd, packet, len, 0, (struct sockaddr *) &sd,
887 sd_len);
888 if (err < 0)
889 panic("sendto failed: %s\n", strerror(errno));
890
891 err = poll(&pfd, 1, timeout_poll);
892 if (err > 0 && pfd.revents & POLLIN) {
893 real_len = recvfrom(fd_cap, packet_rcv, len_rcv,
894 0, NULL, NULL);
895 if (real_len < sizeof(struct ethhdr) +
896 (cfg->ip ? sizeof(struct iphdr) +
897 sizeof(struct icmphdr) :
898 sizeof(struct ip6_hdr) +
899 sizeof(struct icmp6hdr)))
900 continue;
901
902 is_okay = handle_packet(packet_rcv + sizeof(struct ethhdr),
903 real_len - sizeof(struct ethhdr),
904 cfg->ip, ttl, id,
905 (struct sockaddr *) &ss,
906 cfg->dns_resolv);
907 if (is_okay && show_pkt) {
908 struct pkt_buff *pkt;
909
910 printf("\n Received packet:\n");
911
912 pkt = pkt_alloc(packet_rcv, real_len);
913 hex_ascii(pkt);
914 tprintf_flush();
915 pkt_free(pkt);
916 }
917 } else {
918 printf("* ");
919 fflush(stdout);
920 is_okay = 0;
921 }
922 }
923
924 if (is_okay == 0 && icmp == 0) {
925 icmp = 1;
926 goto retry;
927 }
928
929 printf("\n");
930 fflush(stdout);
931 }
932
933 close(fd_cap);
934 close(fd);
935
936 xfree(packet);
937 xfree(packet_rcv);
938
939 return 0;
940 }
941
942 static void parse_whois_or_die(struct ash_cfg *cfg)
943 {
944 int fd;
945 ssize_t ret;
946 char tmp[512], *ptr, *ptr2;
947
948 fd = open_or_die(WHOIS_SERVER_SOURCE, O_RDONLY);
949
950 memset(tmp, 0, sizeof(tmp));
951 while ((ret = read(fd, tmp, sizeof(tmp))) > 0) {
952 tmp[sizeof(tmp) - 1] = 0;
953 ptr = skips(tmp);
954 ptr2 = ptr;
955 while (*ptr2 != ' ' && ptr2 < &tmp[sizeof(tmp) - 1])
956 ptr2++;
957 if (*ptr2 != ' ')
958 panic("Parser error!\n");
959 *ptr2 = 0;
960 cfg->whois = xstrdup(ptr);
961 ptr = ptr2 + 1;
962 if (ptr >= &tmp[sizeof(tmp) - 1])
963 panic("Parser error!\n");
964 ptr = skips(ptr);
965 ptr[strlen(ptr) - 1] = 0;
966 cfg->whois_port = xstrdup(ptr);
967 break;
968 }
969
970 close(fd);
971 }
972
973 int main(int argc, char **argv)
974 {
975 int c, opt_index, ret;
976 struct ash_cfg cfg;
977 char *path_city_db = NULL, *path_country_db = NULL;
978
979 setfsuid(getuid());
980 setfsgid(getgid());
981
982 memset(&cfg, 0, sizeof(cfg));
983 cfg.init_ttl = 1;
984 cfg.max_ttl = 30;
985 cfg.queries = 3;
986 cfg.timeout = 3;
987 cfg.ip = 4;
988 cfg.payload = NULL;
989 cfg.dev = xstrdup("eth0");
990 cfg.port = xstrdup("80");
991
992 while ((c = getopt_long(argc, argv, short_options, long_options,
993 &opt_index)) != EOF) {
994 switch (c) {
995 case 'h':
996 help();
997 break;
998 case 'v':
999 version();
1000 break;
1001 case 'H':
1002 cfg.host = xstrdup(optarg);
1003 break;
1004 case 'p':
1005 if (cfg.port)
1006 xfree(cfg.port);
1007 cfg.port = xstrdup(optarg);
1008 break;
1009 case 'n':
1010 cfg.dns_resolv = 0;
1011 break;
1012 case '4':
1013 cfg.ip = 4;
1014 break;
1015 case '6':
1016 cfg.ip = 6;
1017 break;
1018 case 'Z':
1019 show_pkt = 1;
1020 break;
1021 case 'N':
1022 cfg.dns_resolv = 1;
1023 break;
1024 case 'f':
1025 cfg.init_ttl = atoi(optarg);
1026 if (cfg.init_ttl <= 0)
1027 help();
1028 break;
1029 case 'm':
1030 cfg.max_ttl = atoi(optarg);
1031 if (cfg.max_ttl <= 0)
1032 help();
1033 break;
1034 case 'i':
1035 case 'd':
1036 if (cfg.dev)
1037 xfree(cfg.dev);
1038 cfg.dev = xstrdup(optarg);
1039 break;
1040 case 'q':
1041 cfg.queries = atoi(optarg);
1042 if (cfg.queries <= 0)
1043 help();
1044 break;
1045 case 'x':
1046 cfg.timeout = atoi(optarg);
1047 if (cfg.timeout <= 0)
1048 help();
1049 break;
1050 case 'S':
1051 cfg.syn = 1;
1052 break;
1053 case 'A':
1054 cfg.ack = 1;
1055 break;
1056 case 'F':
1057 cfg.fin = 1;
1058 break;
1059 case 'U':
1060 cfg.urg = 1;
1061 break;
1062 case 'P':
1063 cfg.psh = 1;
1064 break;
1065 case 'R':
1066 cfg.rst = 1;
1067 break;
1068 case 'E':
1069 cfg.syn = 1;
1070 cfg.ecn = 1;
1071 break;
1072 case 't':
1073 cfg.tos = atoi(optarg);
1074 if (cfg.tos < 0)
1075 help();
1076 break;
1077 case 'G':
1078 cfg.nofrag = 1;
1079 break;
1080 case 'X':
1081 cfg.payload = xstrdup(optarg);
1082 break;
1083 case 'l':
1084 cfg.totlen = atoi(optarg);
1085 if (cfg.totlen <= 0)
1086 help();
1087 break;
1088 case 'w':
1089 cfg.whois = xstrdup(optarg);
1090 break;
1091 case 'W':
1092 cfg.whois_port = xstrdup(optarg);
1093 break;
1094 case 'L':
1095 path_city_db = xstrdup(optarg);
1096 break;
1097 case 'K':
1098 path_country_db = xstrdup(optarg);
1099 break;
1100 case '?':
1101 switch (optopt) {
1102 case 'H':
1103 case 'p':
1104 case 'L':
1105 case 'K':
1106 case 'f':
1107 case 'm':
1108 case 'i':
1109 case 'd':
1110 case 'q':
1111 case 'x':
1112 case 'X':
1113 case 't':
1114 case 'l':
1115 case 'w':
1116 case 'W':
1117 panic("Option -%c requires an argument!\n",
1118 optopt);
1119 default:
1120 if (isprint(optopt))
1121 whine("Unknown option character "
1122 "`0x%X\'!\n", optopt);
1123 die();
1124 }
1125 default:
1126 break;
1127 }
1128 }
1129
1130 if (argc < 3 ||
1131 !cfg.host || !cfg.port ||
1132 cfg.init_ttl > cfg.max_ttl ||
1133 cfg.init_ttl > MAXTTL ||
1134 cfg.max_ttl > MAXTTL)
1135 help();
1136
1137 if (!device_up_and_running(cfg.dev))
1138 panic("Networking device not up and running!\n");
1139 if (!cfg.whois || !cfg.whois_port)
1140 parse_whois_or_die(&cfg);
1141 if (device_mtu(cfg.dev) <= cfg.totlen)
1142 panic("Packet larger than device MTU!\n");
1143
1144 register_signal(SIGHUP, signal_handler);
1145
1146 header();
1147
1148 tprintf_init();
1149
1150 ret = aslookup_prepare(cfg.whois, cfg.whois_port);
1151 if (ret < 0)
1152 panic("Cannot resolve whois server!\n");
1153
1154 if (path_country_db)
1155 gi_country = GeoIP_open(path_country_db, GEOIP_MMAP_CACHE);
1156 else
1157 gi_country = GeoIP_open_type(cfg.ip == 4 ?
1158 GEOIP_COUNTRY_EDITION :
1159 GEOIP_COUNTRY_EDITION_V6,
1160 GEOIP_MMAP_CACHE);
1161
1162 if (path_city_db)
1163 gi_city = GeoIP_open(path_city_db, GEOIP_MMAP_CACHE);
1164 else
1165 gi_city = GeoIP_open_type(cfg.ip == 4 ?
1166 GEOIP_CITY_EDITION_REV1 :
1167 GEOIP_CITY_EDITION_REV1_V6,
1168 GEOIP_MMAP_CACHE);
1169
1170 if (!gi_country || !gi_city)
1171 panic("Cannot open GeoIP database! Wrong path?!\n");
1172
1173 GeoIP_set_charset(gi_country, GEOIP_CHARSET_UTF8);
1174 GeoIP_set_charset(gi_city, GEOIP_CHARSET_UTF8);
1175
1176 ret = do_trace(&cfg);
1177
1178 GeoIP_delete(gi_city);
1179 GeoIP_delete(gi_country);
1180
1181 tprintf_cleanup();
1182
1183 free(cfg.whois_port);
1184 free(cfg.whois);
1185 free(cfg.dev);
1186 free(cfg.host);
1187 free(cfg.port);
1188 free(cfg.payload);
1189 free(path_city_db);
1190 free(path_country_db);
1191
1192 return ret;
1193 }
netsniff-ng toolkit, the packet sniffing beast, staging tree