19 #include "../misc/network.h"
20 #include "../misc/plugutils.h"
26 #include <gvm/base/logging.h>
27 #include <gvm/base/prefs.h>
32 #include <sys/resource.h>
33 #include <sys/socket.h>
35 #include <sys/types.h>
39 #include <netinet/ip.h>
40 #include <netinet/tcp.h>
45 #if !defined FD_SETSIZE || FD_SETSIZE > 1024
46 #define GRAB_MAX_SOCK 1024
48 #define GRAB_MAX_SOCK FD_SETSIZE
51 #if !defined FD_SETSIZE || FD_SETSIZE > 32
52 #define GRAB_MIN_SOCK 32
54 #define GRAB_MIN_SOCK FD_SETSIZE
55 #warn "FD_SETSIZE is lower than 32"
58 #if !defined FD_SETSIZE || FD_SETSIZE > 128
59 #define GRAB_MAX_SOCK_SAFE 128
61 #define GRAB_MAX_SOCK_SAFE FD_SETSIZE
62 #warn "FD_SETSIZE is lower than 128"
65 #define MAX_PASS_NB 16
68 #define MAXINT 0x7fffffffL
75 #define G_LOG_DOMAIN "lib nasl"
85 #define DIFFTV(t1, t2) \
86 (t1.tv_sec - t2.tv_sec + (t1.tv_usec - t2.tv_usec) / 1000000)
87 #define DIFFTVu(t1, t2) \
88 ((t1.tv_sec - t2.tv_sec) * 1000000.0 + (t1.tv_usec - t2.tv_usec))
90 #define GRAB_SOCKET_UNUSED 0
91 #define GRAB_SOCKET_OPENING 1
92 #define GRAB_SOCKET_OPEN 2
94 #define GRAB_PORT_UNKNOWN 0
95 #define GRAB_PORT_CLOSED 1
96 #define GRAB_PORT_OPEN 2
97 #define GRAB_PORT_SILENT 3
98 #define GRAB_PORT_REJECTED 4
99 #define GRAB_PORT_NOT_TESTED 254
100 #define GRAB_PORT_TESTING 255
111 #define MAX_SANE_RTT 2000000
136 int port, tbd_nb = 0;
138 for (port = 1; port <= 65535; port++)
146 g_message (
"openvas_tcp_scanner: bug in double_check_std_ports!"
147 " Unknown port %d status",
156 const int read_timeout,
int min_cnx,
int max_cnx,
159 char buf[2048], kb[64];
160 int s, tcpproto, pass;
161 struct protoent *proto;
162 fd_set rfs, wfs, efs;
164 struct sockaddr_in sa;
165 struct sockaddr_in6 sa6;
169 int imax, i, j, scanned_ports, x, opt;
172 unsigned char ports_states[65536];
174 int open_sock_nb, open_sock_max, open_sock_max2;
175 int unfiltered_ports_nb, filtered_ports_nb;
176 int dropped_nb, timeout_nb, dropped_flag = 0;
177 int old_filtered = -1, old_opened = -1;
178 int open_ports_nb, closed_ports_nb;
179 int untested_ports_nb, total_ports_nb;
180 int cnx_max[3], rtt_max[3], rtt_min[3], ping_rtt = 0;
181 #if defined COMPUTE_RTT
182 double rtt_sum[3], rtt_sum2[3];
184 static const char *rtt_type[] = {
"unfiltered",
"open",
"closed"};
186 time_t start_time = time (NULL), start_time_1pass, end_time;
187 long diff_time, diff_time1;
188 int rst_rate_limit_flag = 0, doublecheck_flag = 0;
189 #if defined COMPUTE_RTT
190 double mean, sd = -1.0, emax = -1.0;
193 proto = getprotobyname (
"tcp");
199 tcpproto = proto->p_proto;
201 for (i = 0; i < (int) (
sizeof (ports_states) /
sizeof (*ports_states)); i++)
204 for (i = 0; i < 3; i++)
206 #if defined COMPUTE_RTT
207 rtt_sum[i] = rtt_sum2[i] = 0.0;
210 rtt_max[i] = cnx_max[i] = 0;
217 k =
plug_get_key (desc,
"/tmp/ping/RTT", &type, NULL, 0);
221 ping_rtt = GPOINTER_TO_SIZE (k);
223 g_message (
"openvas_tcp_scanner: unknown key type %d", type);
232 p = (
char *) portrange;
233 untested_ports_nb = 0;
243 if (*p ==
'T' && p[1] && p[1] ==
':')
246 else if (*p ==
'U' && p[1] && p[1] ==
':')
254 po2 = strtol (q, &p, 10);
257 g_message (
"openvas_tcp_scanner: Cannot parse '%s'", p);
263 po1 = strtol (p, &q, 10);
266 g_message (
"openvas_tcp_scanner: Cannot parse '%s'", p);
288 po2 = strtol (q + 1, &p, 10);
291 g_message (
"openvas_tcp_scanner: Cannot parse '%s'",
298 for (i = po1; i <= po2; i++)
306 g_message (
"openvas_tcp_scanner: port list empty");
311 for (i = 0; i < max_cnx; i++)
318 open_sock_max = min_cnx;
319 open_sock_max2 = max_cnx;
321 open_ports_nb = closed_ports_nb = filtered_ports_nb = unfiltered_ports_nb = 0;
325 int open_ports_nb1 = 0, closed_ports_nb1 = 0;
326 int wait_sock_nb = 0;
329 start_time_1pass = time (NULL);
334 while (scanned_ports < 65535)
337 unfiltered_ports_nb + filtered_ports_nb + untested_ports_nb;
338 while (open_sock_nb < open_sock_max)
349 if (IN6_IS_ADDR_V4MAPPED (pia))
351 s = socket (PF_INET, SOCK_STREAM, tcpproto);
355 s = socket (PF_INET6, SOCK_STREAM, tcpproto);
361 open_sock_max = open_sock_max2 = open_sock_nb / 2 - 1;
367 else if (errno == EMFILE)
369 x = open_sock_nb / 16;
370 open_sock_max = open_sock_max2 =
371 open_sock_nb - (x > 0 ? x : 1);
383 #if defined FD_SETSIZE
394 if ((x = fcntl (s, F_GETFL)) < 0)
396 perror (
"fcntl(F_GETFL)");
400 if (fcntl (s, F_SETFL, x | O_NONBLOCK) < 0)
402 perror (
"fcntl(F_SETFL)");
413 if (setsockopt (s, SOL_SOCKET, SO_LINGER, &l,
sizeof (l)) < 0)
414 perror (
"setsockopt(SO_LINGER)");
417 #if defined LINUX && defined IPTOS_RELIABILITY
423 x = IPTOS_RELIABILITY;
424 if (setsockopt (s, SOL_IP, IP_TOS, &x,
sizeof (x)) < 0)
425 perror (
"setsockopt(IP_TOS");
427 bzero (&sa,
sizeof (sa));
428 bzero (&sa6,
sizeof (sa6));
429 if (IN6_IS_ADDR_V4MAPPED (pia))
431 sa.sin_addr.s_addr = pia->s6_addr32[3];
432 sa.sin_family = AF_INET;
433 sa.sin_port = htons (port);
434 len =
sizeof (
struct sockaddr_in);
435 retval = connect (s, (
struct sockaddr *) &sa, len);
439 memcpy (&sa6.sin6_addr, pia, sizeof (
struct in6_addr));
440 sa6.sin6_family = AF_INET6;
441 sa6.sin6_port = htons (port);
442 len =
sizeof (
struct sockaddr_in6);
443 retval = connect (s, (
struct sockaddr *) &sa6, len);
451 sockets[open_sock_nb].
fd = s;
452 sockets[open_sock_nb].
port = port;
454 (void) gettimeofday (&sockets[open_sock_nb].tictac, NULL);
462 x = open_sock_nb / 16;
463 open_sock_max = open_sock_max2 =
464 open_sock_nb - (x > 0 ? x : 1);
471 unfiltered_ports_nb++;
492 sockets[open_sock_nb].
fd = s;
493 sockets[open_sock_nb].
port = port;
495 (void) gettimeofday (&sockets[open_sock_nb].tictac, NULL);
498 unfiltered_ports_nb++;
507 timeout.tv_sec = timeout.tv_usec = 0;
508 if (select (imax + 1, NULL, &wfs, NULL, &timeout) > 0)
513 if (open_sock_max2 <= 0)
516 if (open_sock_nb == 0)
524 for (i = 0; i < open_sock_nb; i++)
526 if (sockets[i].fd >= 0)
528 switch (sockets[i].state)
531 FD_SET (sockets[i].fd, &rfs);
534 FD_SET (sockets[i].fd, &wfs);
539 if (sockets[i].fd > imax)
540 imax = sockets[i].
fd;
546 if (untested_ports_nb > 0)
555 #if defined COMPUTE_RTT
561 mean = rtt_sum[0] / (double) rtt_nb[0];
562 if ((
double) rtt_max[0] > mean)
564 sd = sqrt ((rtt_sum2[0] / rtt_nb[0] - mean * mean)
565 * (
double) rtt_nb[0] / (rtt_nb[0] - 1));
566 emax = mean + 3 * sd;
567 em = floor (emax + 0.5);
568 moy = floor (rtt_sum[0] / rtt_nb[0] + 0.5);
574 if (rtt_max[0] < rtt_min[0])
575 rtt_max[0] = rtt_min[0];
583 if (wait_sock_nb == 0)
584 if (rtt_max[0] > 0 || ping_rtt > 0)
591 if (doublecheck_flag)
598 x += (unsigned) (lrand48 () & 0x7FFFFFFF) % 100000;
600 x += (unsigned) (lrand48 () & 0x7FFFFFFF) % 50000;
602 x = 20000 + (unsigned) (lrand48 () & 0x7FFFFFFF) % 20000;
603 timeout.tv_sec = x / 1000000;
604 timeout.tv_usec = x % 1000000;
610 timeout.tv_usec = (unsigned) (lrand48 () & 0x7FFFFFFF) % 250000;
614 timeout.tv_sec = read_timeout;
615 timeout.tv_usec = (unsigned) (lrand48 () & 0x7FFFFFFF) % 500000;
619 x = select (imax + 1, &rfs, &wfs, NULL, &timeout);
620 while (i++ < 10 && x < 0 && errno == EINTR);
629 for (i = 0; i < open_sock_nb; i++)
631 if (sockets[i].fd > 0)
635 switch (sockets[i].state)
653 (void) gettimeofday (&ti, NULL);
654 for (i = 0; i < open_sock_nb; i++)
656 if (sockets[i].fd > 0)
658 if (FD_ISSET (sockets[i].fd, &wfs))
661 optsz =
sizeof (opt);
662 if (getsockopt (sockets[i].fd, SOL_SOCKET, SO_ERROR,
666 perror (
"getsockopt");
670 x =
DIFFTVu (ti, sockets[i].tictac);
682 #if defined COMPUTE_RTT
684 rtt_sum[2] += (double) x;
685 rtt_sum2[2] += (double) x * (
double) x;
698 ports_states[sockets[i].
port] =
705 ports_states[sockets[i].port] =
707 unfiltered_ports_nb++;
724 #if defined COMPUTE_RTT
726 rtt_sum[1] += (double) x;
727 rtt_sum2[1] += (double) x * (
double) x;
731 unfiltered_ports_nb++;
738 snprintf (kb,
sizeof (kb),
739 "TCPScanner/CnxTime1000/%u",
742 GSIZE_TO_POINTER (x / 1000));
743 snprintf (kb,
sizeof (kb),
744 "TCPScanner/CnxTime/%u",
748 GSIZE_TO_POINTER ((x + 500000) / 1000000));
749 sockets[i].tictac = ti;
759 #if defined COMPUTE_RTT
761 rtt_sum[0] += (double) x;
762 rtt_sum2[0] += (double) x * (
double) x;
766 else if (FD_ISSET (sockets[i].fd, &rfs))
768 x = read (sockets[i].fd, buf,
sizeof (buf) - 1);
771 char buf2[
sizeof (buf) * 2 + 1];
774 for (y = 0; y < x; y++)
776 sprintf (buf2 + 2 * y,
"%02x",
777 (
unsigned char) buf[y]);
781 buf2[2 * x - 1] =
'\0';
784 snprintf (kb,
sizeof (kb),
"BannerHex/%u",
790 snprintf (kb,
sizeof (kb),
"Banner/%u",
793 x =
DIFFTVu (ti, sockets[i].tictac) / 1000;
794 snprintf (kb,
sizeof (kb),
795 "TCPScanner/RwTime1000/%u",
798 GSIZE_TO_POINTER (x));
799 snprintf (kb,
sizeof (kb),
"TCPScanner/RwTime/%u",
803 GSIZE_TO_POINTER ((x + 500) / 1000));
814 (void) gettimeofday (&ti, NULL);
815 for (i = 0; i < open_sock_nb; i++)
816 if (sockets[i].fd >= 0
817 &&
DIFFTV (ti, sockets[i].tictac) >= read_timeout)
819 switch (sockets[i].state)
824 snprintf (kb,
sizeof (kb),
"/tmp/NoBanner/%u",
836 "openvas_tcp_scanner: Unhandled case %d at %s:%d",
837 sockets[i].state, __FILE__, __LINE__);
845 if (dropped_nb > 0 && dropped_nb >= (open_sock_nb * 3) / 4
846 && (dropped_nb < filtered_ports_nb
847 || dropped_nb > unfiltered_ports_nb))
850 open_sock_max += dropped_nb;
851 if (open_sock_max2 < max_cnx)
854 else if (dropped_nb > 0)
857 open_sock_max -= (dropped_nb + 2) / 3;
858 if (open_sock_max < min_cnx)
859 open_sock_max = min_cnx;
860 open_sock_max2 = (open_sock_max + 3 * open_sock_max2) / 4;
862 else if (dropped_nb == 0 && dropped_flag)
867 open_sock_max += timeout_nb;
868 if (open_sock_max > open_sock_max2)
870 open_sock_max = open_sock_max2;
872 if (open_sock_max < min_cnx)
873 open_sock_max = min_cnx;
874 for (i = 0; i < open_sock_nb;)
877 for (j = i + 1; j < open_sock_nb
879 || sockets[j].
fd < 0);
882 if (j < open_sock_nb)
883 memmove (sockets + i, sockets + j,
884 sizeof (*sockets) * (max_cnx - j));
885 open_sock_nb -= j - i;
892 end_time = time (NULL);
893 diff_time1 = end_time - start_time_1pass;
894 diff_time = end_time - start_time;
896 || (pass == 1 && filtered_ports_nb > 10 && closed_ports_nb > 10)
897 || (pass > 1 && filtered_ports_nb > 0))
899 if (doublecheck_flag && rst_rate_limit_flag
900 && open_ports_nb == old_opened)
902 old_opened = open_ports_nb;
904 doublecheck_flag = 0;
905 if (filtered_ports_nb == old_filtered)
908 if (pass > 1 && open_ports_nb1 == 0 && closed_ports_nb1 >= min_cnx &&
914 closed_ports_nb1 >= (diff_time1 + 1) * 10
915 && closed_ports_nb1 < (diff_time1 + 1) * 201 &&
917 closed_ports_nb >= (diff_time + 1) * 10
918 && closed_ports_nb < (diff_time + 1) * 201)
923 int tbd = break_flag && !doublecheck_flag
928 doublecheck_flag = 1;
931 rst_rate_limit_flag++;
940 for (port = 1; port <= 65535; port++)
946 untested_ports_nb = old_filtered;
947 filtered_ports_nb = 0;
948 open_sock_max = min_cnx / (pass + 1);
949 if (open_sock_max < 1)
956 else if (rst_rate_limit_flag)
963 else if (open_sock_max2 <= open_sock_max)
964 open_sock_max2 = open_sock_max * 2;
966 else if (filtered_ports_nb > 0)
969 doublecheck_flag = 1;
974 old_filtered = untested_ports_nb = tbd_nb;
975 filtered_ports_nb = 0;
976 open_sock_max = min_cnx / pass;
977 if (open_sock_max2 <= open_sock_max)
978 open_sock_max2 = open_sock_max * 2;
991 filtered_ports_nb = old_filtered;
996 #if defined COMPUTE_RTT
997 for (i = 0; i < 3; i++)
1001 double mean, sd = -1.0, emax = -1.0;
1005 rtt_sum2[i] /= 1e12;
1007 mean = rtt_sum[i] / rtt_nb[i];
1008 snprintf (rep,
sizeof (rep),
"%6g", mean);
1009 snprintf (kb,
sizeof (kb),
"TCPScanner/%s/MeanRTT", rtt_type[i]);
1011 x = floor (mean * 1000 + 0.5);
1012 snprintf (kb,
sizeof (kb),
"TCPScanner/%s/MeanRTT1000", rtt_type[i]);
1015 snprintf (kb,
sizeof (kb),
"TCPScanner/%s/MaxRTT1000", rtt_type[i]);
1017 GSIZE_TO_POINTER ((rtt_max[i] + 500) / 1000));
1018 snprintf (rep,
sizeof (rep),
"%6g",
1019 (rtt_max[i] + 500000.0) / 1000000.0);
1020 snprintf (kb,
sizeof (kb),
"TCPScanner/%s/MaxRTT", rtt_type[i]);
1024 sd = sqrt ((rtt_sum2[i] / rtt_nb[i] - mean * mean) * rtt_nb[i]
1026 emax = mean + 3 * sd;
1027 snprintf (rep,
sizeof (rep),
"%6g", sd);
1028 snprintf (kb,
sizeof (kb),
"TCPScanner/%s/SDRTT", rtt_type[i]);
1030 x = floor (sd * 1000 + 0.5);
1031 snprintf (kb,
sizeof (kb),
"TCPScanner/%s/SDRTT1000", rtt_type[i]);
1033 snprintf (rep,
sizeof (rep),
"%6g", emax);
1034 snprintf (kb,
sizeof (kb),
"TCPScanner/%s/EstimatedMaxRTT",
1037 x = floor (emax * 1000 + 0.5);
1038 snprintf (kb,
sizeof (kb),
"TCPScanner/%s/EstimatedMaxRTT1000",
1045 GSIZE_TO_POINTER (open_ports_nb));
1047 GSIZE_TO_POINTER (closed_ports_nb));
1049 GSIZE_TO_POINTER (filtered_ports_nb));
1051 GSIZE_TO_POINTER (rst_rate_limit_flag));
1052 if (untested_ports_nb <= 0)
1055 GSIZE_TO_POINTER ((total_ports_nb - untested_ports_nb)));
1063 const char *port_range = prefs_get (
"port_range");
1065 struct in6_addr *p_addr;
1066 unsigned int timeout = 0, max_cnx, min_cnx, x;
1069 p = prefs_get (
"checks_read_timeout");
1075 int max_host = 0, max_checks = 0, cur_sys_fd = 0, max_sys_fd = 0;
1079 double loadavg[3], maxloadavg = -1.0;
1080 int stderr_fd = dup (2);
1081 int devnull_fd = open (
"/dev/null", O_WRONLY);
1083 if (devnull_fd <= 0)
1085 if (stderr_fd != -1)
1089 dup2 (devnull_fd, 2);
1091 p = prefs_get (
"max_hosts");
1093 max_host = atoi (p);
1097 p = prefs_get (
"max_checks");
1099 max_checks = atoi (p);
1100 if (max_checks <= 0 || max_checks > 5)
1103 g_debug (
"openvas_tcp_scanner: max_checks forced to %d", max_checks);
1106 min_cnx = 8 * max_checks;
1108 max_cnx = 24 * max_checks;
1110 max_cnx = 80 * max_checks;
1112 getloadavg (loadavg, 3);
1113 for (i = 0; i < 3; i++)
1114 if (loadavg[i] > maxloadavg)
1115 maxloadavg = loadavg[i];
1117 if (max_sys_fd <= 0)
1119 fp = popen (
"sysctl fs.file-nr",
"r");
1122 if (fscanf (fp,
"%*s = %*d %d %d", &cur_sys_fd, &max_sys_fd) == 1)
1123 max_sys_fd -= cur_sys_fd;
1129 if (max_sys_fd <= 0)
1131 fp = popen (
"sysctl fs.file-max",
"r");
1134 if (fscanf (fp,
"%*s = %d", &max_sys_fd) < 1)
1140 if (max_sys_fd <= 0)
1142 fp = popen (
"sysctl kern.maxfiles",
"r");
1145 if (fscanf (fp,
"%*s = %d", &max_sys_fd) < 1)
1153 dup2 (stderr_fd, 2);
1156 if (maxloadavg >= 0.0)
1157 max_cnx /= (1.0 + maxloadavg);
1159 if (max_sys_fd <= 0)
1162 if (max_sys_fd < 1024)
1167 x = max_sys_fd / max_host;
1179 if (getrlimit (RLIMIT_NOFILE, &rlim) < 0)
1180 perror (
"getrlimit(RLIMIT_NOFILE)");
1184 if (rlim.rlim_cur != RLIM_INFINITY && max_cnx >= rlim.rlim_cur)
1185 max_cnx = rlim.rlim_cur - 1;
1189 min_cnx = x > 0 ? x : 1;
1195 if (
banner_grab (p_addr, port_range, timeout, min_cnx, max_cnx, desc) < 0)