2 * Pscan is a mini port scanner implementation for busybox
4 * Copyright 2007 Tito Ragusa <farmatito@tiscali.it>
6 * Licensed under the GPL v2 or later, see the file LICENSE in this tarball.
13 #define DMSG(...) bb_error_msg(__VA_ARGS__)
14 #define DERR(...) bb_perror_msg(__VA_ARGS__)
16 #define DMSG(...) ((void)0)
17 #define DERR(...) ((void)0)
20 static const char *port_name(unsigned port
)
22 struct servent
*server
;
24 server
= getservbyport(htons(port
), NULL
);
26 return server
->s_name
;
30 /* We don't expect to see 1000+ seconds delay, unsigned is enough */
31 #define MONOTONIC_US() ((unsigned)monotonic_us())
33 int pscan_main(int argc
, char **argv
) MAIN_EXTERNALLY_VISIBLE
;
34 int pscan_main(int argc UNUSED_PARAM
, char **argv
)
36 const char *opt_max_port
= "1024"; /* -P: default max port */
37 const char *opt_min_port
= "1"; /* -p: default min port */
38 const char *opt_timeout
= "5000"; /* -t: default timeout in msec */
39 /* We estimate rtt and wait rtt*4 before concluding that port is
40 * totally blocked. min rtt of 5 ms may be too low if you are
41 * scanning an Internet host behind saturated/traffic shaped link.
42 * Rule of thumb: with min_rtt of N msec, scanning 1000 ports
43 * will take N seconds at absolute minimum */
44 const char *opt_min_rtt
= "5"; /* -T: default min rtt in msec */
45 const char *result_str
;
46 len_and_sockaddr
*lsap
;
49 unsigned port
, max_port
, nports
;
50 unsigned closed_ports
= 0;
51 unsigned open_ports
= 0;
58 opt_complementary
= "=1"; /* exactly one non-option */
59 opt
= getopt32(argv
, "cbp:P:t:T:", &opt_min_port
, &opt_max_port
, &opt_timeout
, &opt_min_rtt
);
61 max_port
= xatou_range(opt_max_port
, 1, 65535);
62 port
= xatou_range(opt_min_port
, 1, max_port
);
63 nports
= max_port
- port
+ 1;
64 min_rtt
= xatou_range(opt_min_rtt
, 1, INT_MAX
/1000 / 4) * 1000;
65 timeout
= xatou_range(opt_timeout
, 1, INT_MAX
/1000 / 4) * 1000;
66 /* Initial rtt is BIG: */
69 DMSG("min_rtt %u timeout %u", min_rtt
, timeout
);
71 lsap
= xhost2sockaddr(*argv
, port
);
72 printf("Scanning %s ports %u to %u\n Port\tProto\tState\tService\n",
73 *argv
, port
, max_port
);
75 for (; port
<= max_port
; port
++) {
76 DMSG("rtt %u", rtt_4
);
78 /* The SOCK_STREAM socket type is implemented on the TCP/IP protocol. */
79 set_nport(lsap
, htons(port
));
80 s
= xsocket(lsap
->u
.sa
.sa_family
, SOCK_STREAM
, 0);
81 /* We need unblocking socket so we don't need to wait for ETIMEOUT. */
82 /* Nonblocking connect typically "fails" with errno == EINPROGRESS */
85 DMSG("connect to port %u", port
);
87 start
= MONOTONIC_US();
88 if (connect(s
, &lsap
->u
.sa
, lsap
->len
) == 0) {
89 /* Unlikely, for me even localhost fails :) */
90 DMSG("connect succeeded");
93 /* Check for untypical errors... */
94 if (errno
!= EAGAIN
&& errno
!= EINPROGRESS
95 && errno
!= ECONNREFUSED
97 bb_perror_nomsg_and_die();
102 if (errno
== ECONNREFUSED
) {
103 if (opt
& 1) /* -c: show closed too */
104 result_str
= "closed";
108 DERR("port %u errno %d @%u", port
, errno
, diff
);
111 if (opt
& 2) /* -b: show blocked too */
112 result_str
= "blocked";
115 /* Can sleep (much) longer than specified delay.
116 * We check rtt BEFORE we usleep, otherwise
117 * on localhost we'll have no writes done (!)
118 * before we exceed (rather small) rtt */
121 diff
= MONOTONIC_US() - start
;
122 DMSG("write to port %u @%u", port
, diff
- start
);
123 if (write(s
, " ", 1) >= 0) { /* We were able to write to the socket */
129 DMSG("out of loop @%u", diff
);
131 printf("%5u" "\t" "tcp" "\t" "%s" "\t" "%s" "\n",
132 port
, result_str
, port_name(port
));
134 /* Estimate new rtt - we don't want to wait entire timeout
135 * for each port. *4 allows for rise in net delay.
136 * We increase rtt quickly (rtt_4*4), decrease slowly
137 * (diff is at least rtt_4/8, *4 == rtt_4/2)
138 * because we don't want to accidentally miss ports. */
147 if (ENABLE_FEATURE_CLEAN_UP
) free(lsap
);
149 printf("%d closed, %d open, %d timed out (or blocked) ports\n",
152 nports
- (closed_ports
+ open_ports
));