src/ashunt.c

   1 /*
   2  * netsniff-ng - the packet sniffing beast
   3  * By Daniel Borkmann <daniel@netsniff-ng.org>
   4  * Copyright 2011 Daniel Borkmann.
   5  * Subject to the GPL, version 2.
   6  *
   7  * An Autonomous System trace route utility based on TCP instead of ICMP for
   8  * a better passing of firewalls. Supports IPv4 and IPv6. Based on the idea
   9  * of tcptraceroute (http://michael.toren.net/code/tcptraceroute/), but hacked
  10  * for Autonomous Systems tracing, thus you will know an approximate path of
  11  * your curvetun tunneled packets, for instance. However, ashunt was written
  12  * from scratch and does not use any libraries. Special thanks to Team CYMRU!
  13  *
  14  *   The road must be trod, but it will be very hard. And neither strength nor
  15  *   wisdom will carry us far upon it. This quest may be attempted by the weak
  16  *   with as much hope as the strong. Yet such is oft the course of deeds that
  17  *   move the wheels of the world: small hands do them because they must,
  18  *   while the eyes of the great are elsewhere.
  19  *
  20  *     -- The Lord of the Rings, Elrond, Chapter 'The Council of Elrond'.
  21  *
  22  * ashunt includes GeoLite data created by MaxMind, available from
  23  * http://www.maxmind.com/. On Debian you need libgeoip-dev, libgeoip1 and
  24  * geoip-database-contrib.
  25  */
  26
  27 /*
  28
  29 =head1 NAME
  30
  31 ashunt - Autonomous System (AS) trace route utility
  32
  33 =head1 SYNOPSIS
  34
  35 ashunt  -H|--host <host> -i|-d|--dev <dev> [-6|--ipv6]
  36         [-n|--numeric] [-N|--dns] [-f|--init-ttl <ttl>]
  37         [-m|--max-ttl <ttl>] [-q|--num-probes] [-x|--timeout <sec>]
  38         [-S|--syn] [-A|--ack] [-F|--fin] [-P|--psh] [-U|--urg]
  39         [-R|--rst] [-E|--ecn-syn] [-t|--tos <tos>] [-G|--nofrag]
  40         [-X|--payload <string>] [-Z|--show-packet] [-l|--totlen <len>]
  41         [-w|--whois <server>] [-W|--wport <port>] [--city-db <path>]
  42         [--country-db <path>] [-v|--version] [-h|--help]
  43
  44 =head1 DESCRIPTION
  45
  46 This program provides AS information on each hop between the client
  47 and the target host.
  48
  49 =head1 OPTIONS
  50
  51 =over
  52
  53 =item ashunt -i eth0 -N -E -H netsniff-ng.org
  54
  55 IPv4 trace of AS with TCP ECN SYN probe
  56
  57 =item ashunt -i eth0 -N -S -H netsniff-ng.org
  58
  59 IPv4 trace of AS with TCP SYN probe
  60
  61 =item ashunt -i eth0 -N -F -H netsniff-ng.org
  62
  63 IPv4 trace of AS with TCP FIN probe
  64
  65 =item ashunt -i eth0 -N -FPU -H netsniff-ng.org
  66
  67 IPv4 trace of AS with Xmas probe
  68
  69 =item ashunt -i eth0 -N -H netsniff-ng.org -X "censor-me" -Z
  70
  71 IPv4 trace of AS with Null probe with ASCII payload
  72
  73 =item ashunt -6 -S -i eth0 -H netsniff-ng.org
  74
  75 IPv6 trace of AS up to netsniff-ng.org
  76
  77 =back
  78
  79 =head1 OPTIONS
  80
  81 =over
  82
  83 =item -h|--help
  84
  85 Print help text and lists all options.
  86
  87 =item -v|--version
  88
  89 Print version.
  90
  91 =item -H|--host <host>
  92
  93 Host/IPv4/IPv6 to lookup AS route to
  94
  95 =item i-|-d|--dev <netdev>
  96
  97 Networking device, i.e. eth0
  98
  99 =item -p|--port <port>
 100
 101 Hosts port to lookup AS route to
 102
 103 =item -4|--ipv4
 104
 105 Use IPv4 requests (default)
 106
 107 =item -6|--ipv6
 108
 109 Use IPv6 requests
 110
 111 =item -n|--numeric
 112
 113 Do not do reverse DNS lookup for hops
 114
 115 =item -N|--dns
 116
 117 Do a reverse DNS lookup for hops
 118
 119 =item -f|--init-ttl <ttl>
 120
 121 Set initial TTL
 122
 123 =item -m|--max-ttl <ttl>
 124
 125 Set maximum TTL (default: 30)
 126
 127 =item -q|--num-probes <num>
 128
 129 Number of max probes for each hop (default: 3)
 130
 131 =item -x|--timeout <sec>
 132
 133 Probe response timeout in sec (default: 3)
 134
 135 =item -S|--syn
 136
 137 Set TCP SYN flag in packets
 138
 139 =item -A|--ack
 140
 141 Set TCP ACK flag in packets
 142
 143 =item -F|--fin
 144
 145 Set TCP FIN flag in packets
 146
 147 =item -P|--psh
 148
 149 Set TCP PSH flag in packets
 150
 151 =item -U|--urg
 152
 153 Set TCP URG flag in packets
 154
 155 =item -R|--rst
 156
 157 Set TCP RST flag in packets
 158
 159 =item -E|--ecn-syn
 160
 161 Send ECN SYN packets (RFC3168)
 162
 163 =item -t|--tos <tos>
 164
 165 Set the IP TOS field
 166
 167 =item -w|--whois <server>
 168
 169 Use a different AS whois DB server
 170 (default: /etc/netsniff-ng/whois.conf)
 171
 172 =item -W|--wport <port>
 173
 174 Use a different port to AS whois server
 175 (default: /etc/netsniff-ng/whois.conf)
 176
 177 =item --city-db <path>
 178
 179 Specifiy path for geoip city database
 180
 181 =item --country-db <path>
 182
 183 Specifiy path for geoip country database
 184
 185 =back
 186
 187 =head1 AUTHOR
 188
 189 Written by Daniel Borkmann <daniel@netsniff-ng.org>
 190
 191 =head1 DOCUMENTATION
 192
 193 Documentation by Emmanuel Roullit <emmanuel@netsniff-ng.org>
 194
 195 =head1 BUGS
 196
 197 Please report bugs to <bugs@netsniff-ng.org>
 198
 199 =cut
 200
 201 */
 202
 203 #include <stdio.h>
 204 #include <stdlib.h>
 205 #include <signal.h>
 206 #include <getopt.h>
 207 #include <ctype.h>
 208 #include <stdint.h>
 209 #include <sys/types.h>
 210 #include <sys/stat.h>
 211 #include <sys/socket.h>
 212 #include <fcntl.h>
 213 #include <string.h>
 214 #include <asm/byteorder.h>
 215 #include <linux/tcp.h>
 216 #include <netinet/ip.h>
 217 #include <netinet/ip6.h>
 218 #include <netinet/in.h>
 219 #include <errno.h>
 220 #include <netdb.h>
 221 #include <arpa/inet.h>
 222 #include <linux/if_ether.h>
 223 #include <linux/icmp.h>
 224 #include <linux/icmpv6.h>
 225 #include <GeoIP.h>
 226 #include <GeoIPCity.h>
 227
 228 #include "bpf.h"
 229 #include "die.h"
 230 #include "tprintf.h"
 231 #include "pkt_buff.h"
 232 #include "proto.h"
 233 #include "xmalloc.h"
 234 #include "xio.h"
 235 #include "aslookup.h"
 236 #include "xutils.h"
 237 #include "mtrand.h"
 238 #include "ring_rx.h"
 239 #include "built_in.h"
 240
 241 #define WHOIS_SERVER_SOURCE "/etc/netsniff-ng/whois.conf"
 242
 243 static int assemble_ipv6_tcp(uint8_t *packet, size_t len, int ttl,
 244                              struct sockaddr_in *sin) __attribute__ ((unused));
 245
 246 struct ash_cfg {
 247         char *host;
 248         char *port;
 249         int init_ttl;
 250         int max_ttl;
 251         int dns_resolv;
 252         char *dev;
 253         int queries;
 254         int timeout;
 255         int syn, ack, ecn, fin, psh, rst, urg;
 256         int tos, nofrag;
 257         int totlen;
 258         char *whois;
 259         char *whois_port;
 260         int ip;
 261         char *payload;
 262 };
 263
 264 volatile sig_atomic_t sigint = 0;
 265
 266 static int show_pkt = 0;
 267
 268 static GeoIP *gi_country = NULL;
 269 static GeoIP *gi_city = NULL;
 270
 271 static const char *short_options = "H:p:nNf:m:i:d:q:x:SAEFPURt:Gl:w:W:hv46X:ZLK";
 272
 273 static struct option long_options[] = {
 274         {"host", required_argument, 0, 'H'},
 275         {"port", required_argument, 0, 'p'},
 276         {"init-ttl", required_argument, 0, 'f'},
 277         {"max-ttl", required_argument, 0, 'm'},
 278         {"numeric", no_argument, 0, 'n'},
 279         {"dns", no_argument, 0, 'N'},
 280         {"ipv4", no_argument, 0, '4'},
 281         {"ipv6", no_argument, 0, '6'},
 282         {"dev", required_argument, 0, 'd'},
 283         {"num-probes", required_argument, 0, 'q'},
 284         {"timeout", required_argument, 0, 'x'},
 285         {"syn", no_argument, 0, 'S'},
 286         {"ack", no_argument, 0, 'A'},
 287         {"urg", no_argument, 0, 'U'},
 288         {"fin", no_argument, 0, 'F'},
 289         {"psh", no_argument, 0, 'P'},
 290         {"rst", no_argument, 0, 'R'},
 291         {"ecn-syn", no_argument, 0, 'E'},
 292         {"tos", required_argument, 0, 't'},
 293         {"payload", required_argument, 0, 'X'},
 294         {"show-packet", no_argument, 0, 'Z'},
 295         {"nofrag", no_argument, 0, 'G'},
 296         {"totlen", required_argument, 0, 'l'},
 297         {"whois", required_argument, 0, 'w'},
 298         {"wport", required_argument, 0, 'W'},
 299         {"city-db", required_argument, 0, 'L'},
 300         {"country-db", required_argument, 0, 'K'},
 301         {"version", no_argument, 0, 'v'},
 302         {"help", no_argument, 0, 'h'},
 303         {0, 0, 0, 0}
 304 };
 305
 306 static struct sock_filter ipv4_icmp_type_11[] = {
 307         /* (000) ldh  [12] */
 308         { 0x28, 0, 0, 0x0000000c },
 309         /* (001) jeq  #0x800 jt 2 jf 10 */
 310         { 0x15, 0, 8, 0x00000800 },
 311         /* (002) ldb  [23] */
 312         { 0x30, 0, 0, 0x00000017 },
 313         /* (003) jeq  #0x1 jt 4 jf 10 */
 314         { 0x15, 0, 6, 0x00000001 },
 315         /* (004) ldh  [20] */
 316         { 0x28, 0, 0, 0x00000014 },
 317         /* (005) jset #0x1fff jt 10 jf 6 */
 318         { 0x45, 4, 0, 0x00001fff },
 319         /* (006) ldxb 4*([14]&0xf) */
 320         { 0xb1, 0, 0, 0x0000000e },
 321         /* (007) ldb  [x + 14] */
 322         { 0x50, 0, 0, 0x0000000e },
 323         /* (008) jeq  #0xb jt 9 jf 10 */
 324         { 0x15, 0, 1, 0x0000000b },
 325         /* (009) ret  #65535 */
 326         { 0x06, 0, 0, 0xffffffff },
 327         /* (010) ret  #0 */
 328         { 0x06, 0, 0, 0x00000000 },
 329 };
 330
 331 static struct sock_filter ipv6_icmp6_type_3[] = {
 332         /* (000) ldh [12] */
 333         { 0x28, 0, 0, 0x0000000c },
 334         /* (001) jeq  #0x86dd jt 2 jf 7 */
 335         { 0x15, 0, 5, 0x000086dd },
 336         /* (002) ldb  [20] */
 337         { 0x30, 0, 0, 0x00000014 },
 338         /* (003) jeq  #0x3a jt 4 jf 7 */
 339         { 0x15, 0, 3, 0x0000003a },
 340         /* (004) ldb  [54] */
 341         { 0x30, 0, 0, 0x00000036 },
 342         /* (005) jeq  #0x3 jt 6 jf 7 */
 343         { 0x15, 0, 1, 0x00000003 },
 344         /* (006) ret  #65535 */
 345         { 0x06, 0, 0, 0xffffffff },
 346         /* (007) ret  #0 */
 347         { 0x06, 0, 0, 0x00000000 },
 348 };
 349
 350 static void signal_handler(int number)
 351 {
 352         switch (number) {
 353         case SIGINT:
 354                 sigint = 1;
 355                 break;
 356         default:
 357                 break;
 358         }
 359 }
 360
 361 static void header(void)
 362 {
 363         printf("%s%s%s\n", colorize_start(bold), "ashunt "
 364                VERSION_STRING, colorize_end());
 365 }
 366
 367 static void help(void)
 368 {
 369
 370         printf("\nashunt %s, Autonomous System (AS) trace route utility\n",
 371                VERSION_STRING);
 372         printf("http://www.netsniff-ng.org\n\n");
 373         printf("Usage: ashunt [options]\n");
 374         printf("Options:\n");
 375         printf(" -H|--host <host>        Host/IPv4/IPv6 to lookup AS route to\n");
 376         printf(" -p|--port <port>        Hosts port to lookup AS route to\n");
 377         printf(" -i|-d|--dev <device>    Networking device, i.e. eth0\n");
 378         printf(" -4|--ipv4               Use IPv4 requests (default)\n");
 379         printf(" -6|--ipv6               Use IPv6 requests\n");
 380         printf(" -n|--numeric            Do not do reverse DNS lookup for hops\n");
 381         printf(" -N|--dns                Do a reverse DNS lookup for hops\n");
 382         printf(" -f|--init-ttl <ttl>     Set initial TTL\n");
 383         printf(" -m|--max-ttl <ttl>      Set maximum TTL (default: 30)\n");
 384         printf(" -q|--num-probes <num>   Number of max probes for each hop (default: 3)\n");
 385         printf(" -x|--timeout <sec>      Probe response timeout in sec (default: 3)\n");
 386         printf(" -S|--syn                Set TCP SYN flag in packets\n");
 387         printf(" -A|--ack                Set TCP ACK flag in packets\n");
 388         printf(" -F|--fin                Set TCP FIN flag in packets\n");
 389         printf(" -P|--psh                Set TCP PSH flag in packets\n");
 390         printf(" -U|--urg                Set TCP URG flag in packets\n");
 391         printf(" -R|--rst                Set TCP RST flag in packets\n");
 392         printf(" -E|--ecn-syn            Send ECN SYN packets (RFC3168)\n");
 393         printf(" -t|--tos <tos>          Set the IP TOS field\n");
 394         printf(" -G|--nofrag             Set do not fragment bit\n");
 395         printf(" -X|--payload <string>   Specify a payload string to test DPIs\n");
 396         printf(" -Z|--show-packet        Show returned packet on each hop\n");
 397         printf(" -l|--totlen <len>       Specify total packet len\n");
 398         printf(" -w|--whois <server>     Use a different AS whois DB server\n");
 399         printf("                         (default: /etc/netsniff-ng/whois.conf)\n");
 400         printf(" -W|--wport <port>       Use a different port to AS whois server\n");
 401         printf("                         (default: /etc/netsniff-ng/whois.conf)\n");
 402         printf(" --city-db <path>        Specifiy path for geoip city database\n");
 403         printf(" --country-db <path>     Specifiy path for geoip country database\n");
 404         printf(" -v|--version            Print version\n");
 405         printf(" -h|--help               Print this help\n");
 406         printf("\n");
 407         printf("Examples:\n");
 408         printf("  IPv4 trace of AS with TCP ECN SYN probe:\n");
 409         printf("    ashunt -i eth0 -N -E -H netsniff-ng.org\n");
 410         printf("  IPv4 trace of AS with TCP SYN probe (this will most-likely pass):\n");
 411         printf("    ashunt -i eth0 -N -S -H netsniff-ng.org\n");
 412         printf("  IPv4 trace of AS with TCP FIN probe:\n");
 413         printf("    ashunt -i eth0 -N -F -H netsniff-ng.org\n");
 414         printf("  IPv4 trace of AS with Xmas probe:\n");
 415         printf("    ashunt -i eth0 -N -FPU -H netsniff-ng.org\n");
 416         printf("  IPv4 trace of AS with Null probe with ASCII payload:\n");
 417         printf("    ashunt -i eth0 -N -H netsniff-ng.org -X \"censor-me\" -Z\n");
 418         printf("  IPv6 trace of AS up to netsniff-ng.org:\n");
 419         printf("    ashunt -6 -S -i eth0 -H netsniff-ng.org\n");
 420         printf("\n");
 421         printf("Note:\n");
 422         printf("  If the TCP probe did not give any results, then ashunt will\n");
 423         printf("  automatically probe for classic ICMP packets! To gather more\n");
 424         printf("  information about ashunt's fetched AS numbers, see i.e.\n");
 425         printf("  http://bgp.he.net/AS<number>!\n");
 426         printf("\n");
 427         printf("Please report bugs to <bugs@netsniff-ng.org>\n");
 428         printf("Copyright (C) 2011-2012 Daniel Borkmann <dborkma@tik.ee.ethz.ch>,\n");
 429         printf("Swiss federal institute of technology (ETH Zurich)\n");
 430         printf("License: GNU GPL version 2\n");
 431         printf("This is free software: you are free to change and redistribute it.\n");
 432         printf("There is NO WARRANTY, to the extent permitted by law.\n\n");
 433         die();
 434 }
 435
 436 static void version(void)
 437 {
 438         printf("\nashunt %s, AS trace route utility\n",
 439                VERSION_STRING);
 440         printf("http://www.netsniff-ng.org\n\n");
 441         printf("Please report bugs to <bugs@netsniff-ng.org>\n");
 442         printf("Copyright (C) 2011-2012 Daniel Borkmann <dborkma@tik.ee.ethz.ch>,\n");
 443         printf("Swiss federal institute of technology (ETH Zurich)\n");
 444         printf("License: GNU GPL version 2\n");
 445         printf("This is free software: you are free to change and redistribute it.\n");
 446         printf("There is NO WARRANTY, to the extent permitted by law.\n\n");
 447         die();
 448 }
 449
 450 static inline unsigned short csum(unsigned short *buf, int nwords)
 451 {
 452         unsigned long sum;
 453
 454         for (sum = 0; nwords > 0; nwords--)
 455                 sum += *buf++;
 456         sum = (sum >> 16) + (sum & 0xffff);
 457         sum += (sum >> 16);
 458
 459         return ~sum;
 460 }
 461
 462 static void assemble_data(uint8_t *packet, size_t len, const char *payload)
 463 {
 464         int i;
 465
 466         if (payload == NULL) {
 467                 for (i = 0; i < len; ++i)
 468                         packet[i] = (uint8_t) mt_rand_int32();
 469         } else {
 470                 int lmin = min(len, strlen(payload));
 471                 for (i = 0; i < lmin; ++i)
 472                         packet[i] = (uint8_t) payload[i];
 473                 for (i = lmin; i < len; ++i)
 474                         packet[i] = (uint8_t) mt_rand_int32();
 475         }
 476 }
 477
 478 static void assemble_tcp(uint8_t *packet, size_t len, int syn, int ack,
 479                          int urg, int fin, int rst, int psh, int ecn, int dport)
 480 {
 481         struct tcphdr *tcph = (struct tcphdr *) packet;
 482
 483         bug_on(len < sizeof(struct tcphdr));
 484
 485         tcph->source = htons((uint16_t) mt_rand_int32());
 486         tcph->dest = htons((uint16_t) dport);
 487         tcph->seq = htonl(mt_rand_int32());
 488         tcph->ack_seq = (!!ack ? htonl(mt_rand_int32()) : 0);
 489         tcph->doff = 5;
 490         tcph->syn = !!syn;
 491         tcph->ack = !!ack;
 492         tcph->urg = !!urg;
 493         tcph->fin = !!fin;
 494         tcph->rst = !!rst;
 495         tcph->psh = !!psh;
 496         tcph->ece = !!ecn;
 497         tcph->cwr = !!ecn;
 498         tcph->window = htons((uint16_t) (100 + (mt_rand_int32() % 65435)));
 499         tcph->check = 0;
 500         tcph->urg_ptr = (!!urg ? htons((uint16_t) mt_rand_int32()) :  0);
 501 }
 502
 503 /* returns: ipv4 id */
 504 static int assemble_ipv4_tcp(uint8_t *packet, size_t len, int ttl,
 505                              int tos, const struct sockaddr *dst,
 506                              const struct sockaddr *src, int syn, int ack,
 507                              int urg, int fin, int rst, int psh, int ecn,
 508                              int nofrag, int dport, const char *payload)
 509 {
 510         struct iphdr *iph = (struct iphdr *) packet;
 511
 512         bug_on(!src || !dst);
 513         bug_on(src->sa_family != PF_INET || dst->sa_family != PF_INET);
 514         bug_on(len < sizeof(struct iphdr) + sizeof(struct tcphdr));
 515
 516         iph->ihl = 5;
 517         iph->version = 4;
 518         iph->tos = (uint8_t) tos;
 519         iph->tot_len = htons((uint16_t) len);
 520         iph->id = htons((uint16_t) mt_rand_int32());
 521         iph->frag_off = nofrag ? IP_DF : 0;
 522         iph->ttl = (uint8_t) ttl;
 523         iph->protocol = 6; /* TCP */
 524         iph->saddr = ((const struct sockaddr_in *) src)->sin_addr.s_addr;
 525         iph->daddr = ((const struct sockaddr_in *) dst)->sin_addr.s_addr;
 526
 527         assemble_tcp(packet + sizeof(struct iphdr),
 528                      len - sizeof(struct iphdr), syn, ack, urg, fin, rst,
 529                      psh, ecn, dport);
 530
 531         assemble_data(packet + sizeof(struct iphdr) + sizeof(struct tcphdr),
 532                       len - sizeof(struct iphdr) - sizeof(struct tcphdr),
 533                       payload);
 534
 535         iph->check = csum((unsigned short *) packet,
 536                           ntohs(iph->tot_len) >> 1);
 537
 538         return ntohs(iph->id);
 539 }
 540
 541 /* returns: ipv6 flow label */
 542 static int assemble_ipv6_tcp(uint8_t *packet, size_t len, int ttl,
 543                              struct sockaddr_in *sin)
 544 {
 545         return 0;
 546 }
 547
 548 static void assemble_icmp4(uint8_t *packet, size_t len)
 549 {
 550         struct icmphdr *icmph = (struct icmphdr *) packet;
 551
 552         bug_on(len < sizeof(struct icmphdr));
 553
 554         icmph->type = ICMP_ECHO;
 555         icmph->code = 0;
 556         icmph->checksum = 0;
 557 }
 558
 559 /* returns: ipv4 id */
 560 static int assemble_ipv4_icmp4(uint8_t *packet, size_t len, int ttl,
 561                                int tos, const struct sockaddr *dst,
 562                                const struct sockaddr *src, int nofrag,
 563                                const char *payload)
 564 {
 565         struct iphdr *iph = (struct iphdr *) packet;
 566
 567         bug_on(!src || !dst);
 568         bug_on(src->sa_family != PF_INET || dst->sa_family != PF_INET);
 569         bug_on(len < sizeof(struct iphdr) + sizeof(struct tcphdr));
 570
 571         iph->ihl = 5;
 572         iph->version = 4;
 573         iph->tos = 0;
 574         iph->tot_len = htons((uint16_t) len);
 575         iph->id = htons((uint16_t) mt_rand_int32());
 576         iph->frag_off = nofrag ? IP_DF : 0;
 577         iph->ttl = (uint8_t) ttl;
 578         iph->protocol = 1; /* ICMP4 */
 579         iph->saddr = ((const struct sockaddr_in *) src)->sin_addr.s_addr;
 580         iph->daddr = ((const struct sockaddr_in *) dst)->sin_addr.s_addr;
 581
 582         assemble_icmp4(packet + sizeof(struct iphdr),
 583                        len - sizeof(struct iphdr));
 584
 585         assemble_data(packet + sizeof(struct iphdr) + sizeof(struct icmphdr),
 586                       len - sizeof(struct iphdr) - sizeof(struct icmphdr),
 587                       payload);
 588
 589         iph->check = csum((unsigned short *) packet,
 590                           ntohs(iph->tot_len) >> 1);
 591
 592         return ntohs(iph->id);
 593 }
 594
 595 static int assemble_packet_or_die(uint8_t *packet, size_t len, int ttl, int icmp,
 596                                   const struct ash_cfg *cfg,
 597                                   const struct sockaddr *dst,
 598                                   const struct sockaddr *src)
 599 {
 600         if (icmp)
 601                 return assemble_ipv4_icmp4(packet, len, ttl, cfg->tos, dst, src,
 602                                            cfg->nofrag, cfg->payload);
 603         else
 604                 return assemble_ipv4_tcp(packet, len, ttl, cfg->tos, dst, src,
 605                                          cfg->syn, cfg->ack, cfg->urg, cfg->fin,
 606                                          cfg->rst, cfg->psh, cfg->ecn,
 607                                          cfg->nofrag, atoi(cfg->port),
 608                                          cfg->payload);
 609 }
 610
 611 #define PKT_NOT_FOR_US  0
 612 #define PKT_GOOD        1
 613
 614 static inline const char *make_n_a(const char *p)
 615 {
 616         return p ? : "N/A";
 617 }
 618
 619 static int handle_ipv4_icmp(uint8_t *packet, size_t len, int ttl, int id,
 620                             const struct sockaddr *own, int dns_resolv)
 621 {
 622         int ret;
 623         struct iphdr *iph = (struct iphdr *) packet;
 624         struct iphdr *iph_inner;
 625         struct icmphdr *icmph;
 626         char *hbuff;
 627         struct sockaddr_in sa;
 628         struct asrecord rec;
 629         GeoIPRecord *gir;
 630
 631         if (iph->protocol != 1)
 632                 return PKT_NOT_FOR_US;
 633         if (iph->daddr != ((const struct sockaddr_in *) own)->sin_addr.s_addr)
 634                 return PKT_NOT_FOR_US;
 635
 636         icmph = (struct icmphdr *) (packet + sizeof(struct iphdr));
 637         if (icmph->type != ICMP_TIME_EXCEEDED)
 638                 return PKT_NOT_FOR_US;
 639         if (icmph->code != ICMP_EXC_TTL)
 640                 return PKT_NOT_FOR_US;
 641
 642         iph_inner = (struct iphdr *) (packet + sizeof(struct iphdr) +
 643                                       sizeof(struct icmphdr));
 644         if (ntohs(iph_inner->id) != id)
 645                 return PKT_NOT_FOR_US;
 646
 647         hbuff = xzmalloc(NI_MAXHOST);
 648
 649         memset(&sa, 0, sizeof(sa));
 650         sa.sin_family = PF_INET;
 651         sa.sin_addr.s_addr = iph->saddr;
 652
 653         getnameinfo((struct sockaddr *) &sa, sizeof(sa), hbuff, NI_MAXHOST,
 654                     NULL, 0, NI_NUMERICHOST);
 655
 656         memset(&rec, 0, sizeof(rec));
 657         ret = aslookup(hbuff, &rec);
 658         if (ret < 0)
 659                 panic("AS lookup error %d!\n", ret);
 660
 661         gir = GeoIP_record_by_ipnum(gi_city, ntohl(iph->saddr));
 662         if (!dns_resolv) {
 663                 if (strlen(rec.country) > 0 && gir) {
 664                         const char *city = make_n_a(gir->city);
 665
 666                         printf("%s in AS%s (%s, %s, %s, %f, %f), %s %s (%s), %s", hbuff,
 667                                rec.number, rec.country,
 668                                GeoIP_country_name_by_ipnum(gi_country, ntohl(iph->saddr)),
 669                                city, gir->latitude, gir->longitude,
 670                                rec.prefix, rec.registry, rec.since, rec.name);
 671                 } else if (strlen(rec.country) > 0 && !gir) {
 672                         printf("%s in AS%s (%s, %s), %s %s (%s), %s", hbuff,
 673                                rec.number, rec.country,
 674                                GeoIP_country_name_by_ipnum(gi_country, ntohl(iph->saddr)),
 675                                rec.prefix, rec.registry, rec.since, rec.name);
 676                 } else {
 677                         printf("%s in unkown AS", hbuff);
 678                 }
 679         } else {
 680                 struct hostent *hent = gethostbyaddr(&sa.sin_addr,
 681                                                      sizeof(sa.sin_addr),
 682                                                      PF_INET);
 683
 684                 if (strlen(rec.country) > 0 && gir) {
 685                         const char *city = make_n_a(gir->city);
 686                         printf("%s (%s) in AS%s (%s, %s, %s, %f, %f), %s %s (%s), %s",
 687                                (hent ? hent->h_name : hbuff), hbuff,
 688                                rec.number, rec.country,
 689                                GeoIP_country_name_by_ipnum(gi_country, ntohl(iph->saddr)),
 690                                city, gir->latitude, gir->longitude,
 691                                rec.prefix, rec.registry,
 692                                rec.since, rec.name);
 693                 } else if (strlen(rec.country) > 0 && !gir) {
 694                         printf("%s (%s) in AS%s (%s, %s), %s %s (%s), %s",
 695                                (hent ? hent->h_name : hbuff), hbuff,
 696                                rec.number, rec.country,
 697                                GeoIP_country_name_by_ipnum(gi_country, ntohl(iph->saddr)),
 698                                rec.prefix, rec.registry,
 699                                rec.since, rec.name);
 700                 } else {
 701                         printf("%s (%s) in unkown AS",
 702                                (hent ? hent->h_name : hbuff), hbuff);
 703                 }
 704         }
 705
 706         xfree(hbuff);
 707
 708         return PKT_GOOD;
 709 }
 710
 711 static int handle_packet(uint8_t *packet, size_t len, int ip, int ttl, int id,
 712                          struct sockaddr *own, int dns_resolv)
 713 {
 714         return handle_ipv4_icmp(packet, len, ttl, id, own, dns_resolv);
 715 }
 716
 717 static int do_trace(const struct ash_cfg *cfg)
 718 {
 719         int ttl, query, fd = -1, one = 1, ret, fd_cap, ifindex;
 720         int is_okay = 0, id, timeout_poll;
 721         uint8_t *packet, *packet_rcv;
 722         ssize_t err, real_len;
 723         size_t len, len_rcv;
 724         struct addrinfo hints, *ahead, *ai;
 725         char *hbuff1, *hbuff2;
 726         struct sockaddr_storage ss, sd;
 727         struct sock_fprog bpf_ops;
 728         struct ring dummy_ring;
 729         struct pollfd pfd;
 730
 731         mt_init_by_random_device();
 732
 733         memset(&hints, 0, sizeof(hints));
 734         hints.ai_family = PF_UNSPEC;
 735         hints.ai_socktype = SOCK_STREAM;
 736         hints.ai_protocol = IPPROTO_TCP;
 737         hints.ai_flags = AI_NUMERICSERV;
 738
 739         ret = getaddrinfo(cfg->host, cfg->port, &hints, &ahead);
 740         if (ret < 0) {
 741                 whine("Cannot get address info!\n");
 742                 return -EIO;
 743         }
 744
 745         for (ai = ahead; ai != NULL && fd < 0; ai = ai->ai_next) {
 746                 if (!((ai->ai_family == PF_INET6 && cfg->ip == 6) ||
 747                       (ai->ai_family == PF_INET && cfg->ip == 4)))
 748                         continue;
 749                 fd = socket(ai->ai_family, SOCK_RAW, ai->ai_protocol);
 750                 if (fd < 0)
 751                         continue;
 752
 753                 fd_cap = pf_socket();
 754
 755                 memset(&ss, 0, sizeof(ss));
 756                 ret = device_address(cfg->dev, ai->ai_family, &ss);
 757                 if (ret < 0)
 758                         panic("Cannot get own device address!\n");
 759
 760                 ret = bind(fd, (struct sockaddr *) &ss, sizeof(ss));
 761                 if (ret < 0)
 762                         panic("Cannot bind socket!\n");
 763
 764                 memset(&sd, 0, sizeof(sd));
 765                 memcpy(&sd, ai->ai_addr, ai->ai_addrlen);
 766
 767                 break;
 768         }
 769
 770         freeaddrinfo(ahead);
 771
 772         if (fd < 0) {
 773                 whine("Cannot create socket! Does remote support IPv%d?!\n",
 774                       cfg->ip);
 775                 return -EIO;
 776         }
 777
 778         len = cfg->totlen;
 779         if (cfg->ip == 4) {
 780                 if (len < sizeof(struct iphdr) + sizeof(struct tcphdr)) {
 781                         len = sizeof(struct iphdr) + sizeof(struct tcphdr);
 782                         if (cfg->payload)
 783                                 len += strlen(cfg->payload);
 784                 }
 785         } else {
 786                 if (len < sizeof(struct ip6_hdr) + sizeof(struct tcphdr)) {
 787                         len = sizeof(struct ip6_hdr) + sizeof(struct tcphdr);
 788                         if (cfg->payload)
 789                                 len += strlen(cfg->payload);
 790                 }
 791         }
 792
 793         if (len >= device_mtu(cfg->dev))
 794                 panic("Packet len exceeds device MTU!\n");
 795
 796         packet = xmalloc(len);
 797         len_rcv = device_mtu(cfg->dev);
 798         packet_rcv = xmalloc(len_rcv);
 799
 800         hbuff1 = xzmalloc(256);
 801         getnameinfo((struct sockaddr *) &sd, sizeof(sd), hbuff1, 256,
 802                     NULL, 0, NI_NUMERICHOST);
 803
 804         hbuff2 = xzmalloc(256);
 805         getnameinfo((struct sockaddr *) &ss, sizeof(ss), hbuff2, 256,
 806                     NULL, 0, NI_NUMERICHOST);
 807
 808         ret = setsockopt(fd, cfg->ip == 4 ? IPPROTO_IP : IPPROTO_IPV6,
 809                          IP_HDRINCL, &one, sizeof(one));
 810         if (ret < 0)
 811                 panic("Kernel does not support IP_HDRINCL!\n");
 812
 813         printf("AS path IPv%d TCP trace from %s to %s:%s (%s) with len %zu "
 814                "Bytes, %u max hops\n", cfg->ip, hbuff2, hbuff1, cfg->port,
 815                cfg->host, len, cfg->max_ttl);
 816
 817         printf("Using flags SYN:%d,ACK:%d,ECN:%d,FIN:%d,PSH:%d,RST:%d,URG:%d\n",
 818                cfg->syn, cfg->ack, cfg->ecn, cfg->fin, cfg->psh, cfg->rst,
 819                cfg->urg);
 820
 821         if (cfg->payload)
 822                 printf("With payload: \'%s\'\n", cfg->payload);
 823
 824         fflush(stdout);
 825
 826         xfree(hbuff1);
 827         xfree(hbuff2);
 828
 829         hbuff1 = hbuff2 = NULL;
 830
 831         enable_kernel_bpf_jit_compiler();
 832
 833         memset(&bpf_ops, 0, sizeof(bpf_ops));
 834         if (cfg->ip == 4) {
 835                 bpf_ops.filter = ipv4_icmp_type_11;
 836                 bpf_ops.len = (sizeof(ipv4_icmp_type_11) /
 837                                sizeof(ipv4_icmp_type_11[0]));
 838         } else {
 839                 bpf_ops.filter = ipv6_icmp6_type_3;
 840                 bpf_ops.len = (sizeof(ipv6_icmp6_type_3) /
 841                                sizeof(ipv6_icmp6_type_3[0]));
 842         }
 843
 844         bpf_attach_to_sock(fd_cap, &bpf_ops);
 845         ifindex = device_ifindex(cfg->dev);
 846         bind_rx_ring(fd_cap, &dummy_ring, ifindex);
 847         prepare_polling(fd_cap, &pfd);
 848
 849         timeout_poll = (cfg->timeout > 0 ? cfg->timeout : 3) * 1000;
 850
 851         for (ttl = cfg->init_ttl; ttl <= cfg->max_ttl; ++ttl) {
 852                 int icmp = 0;
 853                 is_okay = 0;
 854
 855                 if ((ttl == cfg->init_ttl && !show_pkt) ||
 856                     (ttl > cfg->init_ttl)) {
 857                         printf("%2d: ", ttl);
 858                         fflush(stdout);
 859                 }
 860 retry:
 861                 for (query = 0; query < cfg->queries && !is_okay; ++query) {
 862                         id = assemble_packet_or_die(packet, len, ttl, icmp, cfg,
 863                                                     (struct sockaddr *) &sd,
 864                                                     (struct sockaddr *) &ss);
 865                         if (ttl == cfg->init_ttl && query == 0 && show_pkt) {
 866                                 struct pkt_buff *pkt;
 867
 868                                 printf("Original packet:\n");
 869
 870                                 pkt = pkt_alloc(packet, len);
 871                                 hex_ascii(pkt);
 872                                 tprintf_flush();
 873                                 pkt_free(pkt);
 874
 875                                 printf("\n%2d: ", ttl);
 876                                 fflush(stdout);
 877                         }
 878
 879                         err = sendto(fd, packet, len, 0, (struct sockaddr *) &sd,
 880                                      sizeof(sd));
 881                         if (err < 0)
 882                                 panic("sendto failed: %s\n", strerror(errno));
 883
 884                         err = poll(&pfd, 1, timeout_poll);
 885                         if (err > 0 && pfd.revents & POLLIN) {
 886                                 real_len = recvfrom(fd_cap, packet_rcv, len_rcv,
 887                                                     0, NULL, NULL);
 888                                 if (real_len < sizeof(struct ethhdr) +
 889                                     (cfg->ip ? sizeof(struct iphdr) +
 890                                                sizeof(struct icmphdr) :
 891                                                sizeof(struct ip6_hdr) +
 892                                                sizeof(struct icmp6hdr)))
 893                                         continue;
 894
 895                                 is_okay = handle_packet(packet_rcv + sizeof(struct ethhdr),
 896                                                         real_len - sizeof(struct ethhdr),
 897                                                         cfg->ip, ttl, id,
 898                                                         (struct sockaddr *) &ss,
 899                                                         cfg->dns_resolv);
 900                                 if (is_okay && show_pkt) {
 901                                         struct pkt_buff *pkt;
 902
 903                                         printf("\n  Received packet:\n");
 904
 905                                         pkt = pkt_alloc(packet_rcv, real_len);
 906                                         hex_ascii(pkt);
 907                                         tprintf_flush();
 908                                         pkt_free(pkt);
 909                                 }
 910                         } else {
 911                                 printf("* ");
 912                                 fflush(stdout);
 913                                 is_okay = 0;
 914                         }
 915                 }
 916
 917                 if (is_okay == 0 && icmp == 0) {
 918                         icmp = 1;
 919                         goto retry;
 920                 }
 921
 922                 printf("\n");
 923                 fflush(stdout);
 924         }
 925
 926         close(fd_cap);
 927         close(fd);
 928
 929         xfree(packet);
 930         xfree(packet_rcv);
 931
 932         return 0;
 933 }
 934
 935 static void parse_whois_or_die(struct ash_cfg *cfg)
 936 {
 937         int fd;
 938         ssize_t ret;
 939         char tmp[512], *ptr, *ptr2;
 940
 941         fd = open_or_die(WHOIS_SERVER_SOURCE, O_RDONLY);
 942
 943         while ((ret = read(fd, tmp, sizeof(tmp))) > 0) {
 944                 tmp[sizeof(tmp) - 1] = 0;
 945                 ptr = skips(tmp);
 946                 ptr2 = ptr;
 947                 while (*ptr2 != ' ' && ptr2 < &tmp[sizeof(tmp) - 1])
 948                         ptr2++;
 949                 if (*ptr2 != ' ')
 950                         panic("Parser error!\n");
 951                 *ptr2 = 0;
 952                 cfg->whois = xstrdup(ptr);
 953                 ptr = ptr2 + 1;
 954                 if (ptr >= &tmp[sizeof(tmp) - 1])
 955                         panic("Parser error!\n");
 956                 ptr = skips(ptr);
 957                 ptr[strlen(ptr) - 1] = 0;
 958                 cfg->whois_port = xstrdup(ptr);
 959                 break;
 960         }
 961
 962         close(fd);
 963 }
 964
 965 int main(int argc, char **argv)
 966 {
 967         int c, opt_index, ret;
 968         struct ash_cfg cfg;
 969         char *path_city_db = NULL, *path_country_db = NULL;
 970
 971         check_for_root_maybe_die();
 972
 973         memset(&cfg, 0, sizeof(cfg));
 974         cfg.init_ttl = 1;
 975         cfg.max_ttl = 30;
 976         cfg.queries = 3;
 977         cfg.timeout = 3;
 978         cfg.ip = 4;
 979         cfg.payload = NULL;
 980         cfg.dev = xstrdup("eth0");
 981         cfg.port = xstrdup("80");
 982
 983         while ((c = getopt_long(argc, argv, short_options, long_options,
 984                 &opt_index)) != EOF) {
 985                 switch (c) {
 986                 case 'h':
 987                         help();
 988                         break;
 989                 case 'v':
 990                         version();
 991                         break;
 992                 case 'H':
 993                         cfg.host = xstrdup(optarg);
 994                         break;
 995                 case 'p':
 996                         if (cfg.port)
 997                                 xfree(cfg.port);
 998                         cfg.port = xstrdup(optarg);
 999                         break;
1000                 case 'n':
1001                         cfg.dns_resolv = 0;
1002                         break;
1003                 case '4':
1004                         cfg.ip = 4;
1005                         break;
1006                 case '6':
1007                         cfg.ip = 6;
1008                         break;
1009                 case 'Z':
1010                         show_pkt = 1;
1011                         break;
1012                 case 'N':
1013                         cfg.dns_resolv = 1;
1014                         break;
1015                 case 'f':
1016                         cfg.init_ttl = atoi(optarg);
1017                         if (cfg.init_ttl <= 0)
1018                                 help();
1019                         break;
1020                 case 'm':
1021                         cfg.max_ttl = atoi(optarg);
1022                         if (cfg.max_ttl <= 0)
1023                                 help();
1024                         break;
1025                 case 'i':
1026                 case 'd':
1027                         if (cfg.dev)
1028                                 xfree(cfg.dev);
1029                         cfg.dev = xstrdup(optarg);
1030                         break;
1031                 case 'q':
1032                         cfg.queries = atoi(optarg);
1033                         if (cfg.queries <= 0)
1034                                 help();
1035                         break;
1036                 case 'x':
1037                         cfg.timeout = atoi(optarg);
1038                         if (cfg.timeout <= 0)
1039                                 help();
1040                         break;
1041                 case 'S':
1042                         cfg.syn = 1;
1043                         break;
1044                 case 'A':
1045                         cfg.ack = 1;
1046                         break;
1047                 case 'F':
1048                         cfg.fin = 1;
1049                         break;
1050                 case 'U':
1051                         cfg.urg = 1;
1052                         break;
1053                 case 'P':
1054                         cfg.psh = 1;
1055                         break;
1056                 case 'R':
1057                         cfg.rst = 1;
1058                         break;
1059                 case 'E':
1060                         cfg.syn = 1;
1061                         cfg.ecn = 1;
1062                         break;
1063                 case 't':
1064                         cfg.tos = atoi(optarg);
1065                         if (cfg.tos < 0)
1066                                 help();
1067                         break;
1068                 case 'G':
1069                         cfg.nofrag = 1;
1070                         break;
1071                 case 'X':
1072                         cfg.payload = xstrdup(optarg);
1073                         break;
1074                 case 'l':
1075                         cfg.totlen = atoi(optarg);
1076                         if (cfg.totlen <= 0)
1077                                 help();
1078                         break;
1079                 case 'w':
1080                         cfg.whois = xstrdup(optarg);
1081                         break;
1082                 case 'W':
1083                         cfg.whois_port = xstrdup(optarg);
1084                         break;
1085                 case 'L':
1086                         path_city_db = xstrdup(optarg);
1087                         break;
1088                 case 'K':
1089                         path_country_db = xstrdup(optarg);
1090                         break;
1091                 case '?':
1092                         switch (optopt) {
1093                         case 'H':
1094                         case 'p':
1095                         case 'L':
1096                         case 'K':
1097                         case 'f':
1098                         case 'm':
1099                         case 'i':
1100                         case 'd':
1101                         case 'q':
1102                         case 'x':
1103                         case 'X':
1104                         case 't':
1105                         case 'l':
1106                         case 'w':
1107                         case 'W':
1108                                 panic("Option -%c requires an argument!\n",
1109                                       optopt);
1110                         default:
1111                                 if (isprint(optopt))
1112                                         whine("Unknown option character "
1113                                               "`0x%X\'!\n", optopt);
1114                                 die();
1115                 }
1116                 default:
1117                         break;
1118                 }
1119         }
1120
1121         if (argc < 3 ||
1122             !cfg.host || !cfg.port ||
1123             cfg.init_ttl > cfg.max_ttl ||
1124             cfg.init_ttl > MAXTTL ||
1125             cfg.max_ttl > MAXTTL)
1126                 help();
1127
1128         if (!device_up_and_running(cfg.dev))
1129                 panic("Networking device not up and running!\n");
1130         if (!cfg.whois || !cfg.whois_port)
1131                 parse_whois_or_die(&cfg);
1132         if (device_mtu(cfg.dev) <= cfg.totlen)
1133                 panic("Packet larger than device MTU!\n");
1134
1135         register_signal(SIGHUP, signal_handler);
1136
1137         header();
1138
1139         tprintf_init();
1140
1141         ret = aslookup_prepare(cfg.whois, cfg.whois_port);
1142         if (ret < 0)
1143                 panic("Cannot resolve whois server!\n");
1144
1145         if (path_country_db)
1146                 gi_country = GeoIP_open(path_country_db, GEOIP_MMAP_CACHE);
1147         else
1148                 gi_country = GeoIP_open_type(GEOIP_COUNTRY_EDITION,
1149                                              GEOIP_MMAP_CACHE);
1150
1151         if (path_city_db)
1152                 gi_city = GeoIP_open(path_city_db, GEOIP_MMAP_CACHE);
1153         else
1154                 gi_city = GeoIP_open_type(GEOIP_CITY_EDITION_REV1,
1155                                           GEOIP_MMAP_CACHE);
1156
1157         if (!gi_country || !gi_city)
1158                 panic("Cannot open GeoIP database! Wrong path?!\n");
1159
1160         GeoIP_set_charset(gi_country, GEOIP_CHARSET_UTF8);
1161         GeoIP_set_charset(gi_city, GEOIP_CHARSET_UTF8);
1162
1163         ret = do_trace(&cfg);
1164
1165         GeoIP_delete(gi_city);
1166         GeoIP_delete(gi_country);
1167
1168         tprintf_cleanup();
1169
1170         if (cfg.whois_port)
1171                 xfree(cfg.whois_port);
1172         if (cfg.whois)
1173                 xfree(cfg.whois);
1174         if (cfg.dev)
1175                 xfree(cfg.dev);
1176         if (cfg.host)
1177                 xfree(cfg.host);
1178         if (cfg.port)
1179                 xfree(cfg.port);
1180         if (cfg.payload)
1181                 xfree(cfg.payload);
1182         if (path_city_db)
1183                 xfree(path_city_db);
1184         if (path_country_db)
1185                 xfree(path_country_db);
1186
1187         return ret;
1188 }