24 #include <sys/types.h> 25 #include <sys/socket.h> 28 #include <sys/resource.h> 33 #include "../misc/arglists.h" 34 #include "../misc/plugutils.h" 35 #include "../misc/prefs.h" 36 #include "../misc/openvas_logging.h" 37 #include "../misc/network.h" 42 #include <netinet/tcp.h> 43 #include <netinet/ip.h> 48 #if ! defined FD_SETSIZE || FD_SETSIZE > 1024 49 #define GRAB_MAX_SOCK 1024 51 #define GRAB_MAX_SOCK FD_SETSIZE 54 #if ! defined FD_SETSIZE || FD_SETSIZE > 32 55 #define GRAB_MIN_SOCK 32 57 #define GRAB_MIN_SOCK FD_SETSIZE 58 #warn "FD_SETSIZE is lower than 32" 61 #if ! defined FD_SETSIZE || FD_SETSIZE > 128 62 #define GRAB_MAX_SOCK_SAFE 128 64 #define GRAB_MAX_SOCK_SAFE FD_SETSIZE 65 #warn "FD_SETSIZE is lower than 128" 68 #define MAX_PASS_NB 16 71 #define MAXINT 0x7fffffffL 81 #define DIFFTV(t1,t2) (t1.tv_sec - t2.tv_sec + (t1.tv_usec - t2.tv_usec) / 1000000) 82 #define DIFFTVu(t1,t2) ((t1.tv_sec - t2.tv_sec) * 1000000.0 + (t1.tv_usec - t2.tv_usec)) 84 #define GRAB_SOCKET_UNUSED 0 85 #define GRAB_SOCKET_OPENING 1 86 #define GRAB_SOCKET_OPEN 2 88 #define GRAB_PORT_UNKNOWN 0 89 #define GRAB_PORT_CLOSED 1 90 #define GRAB_PORT_OPEN 2 91 #define GRAB_PORT_SILENT 3 92 #define GRAB_PORT_REJECTED 4 93 #define GRAB_PORT_NOT_TESTED 254 94 #define GRAB_PORT_TESTING 255 111 #define MAX_SANE_RTT 2000000 114 my_socket_close(
int s)
117 if (shutdown(s, 2) < 0)
126 static int std_port(
int port)
136 double_check_std_ports(
unsigned char* ports_states)
138 int port, tbd_nb = 0;
140 for (port = 1; port <= 65535; port ++)
149 " Unknown port %d status", port);
154 " filtered standard ports\n", tbd_nb);
160 banner_grab(
const struct in6_addr *pia,
const char* portrange,
161 const int read_timeout,
166 char buf[2048],
kb[64];
167 int s, tcpproto, pass;
168 struct protoent *proto;
169 fd_set rfs, wfs, efs;
174 struct sockaddr_in sa;
175 struct sockaddr_in6 sa6;
179 int imax, i, j, scanned_ports, x, opt;
182 unsigned char ports_states[65536];
184 int open_sock_nb, open_sock_max, open_sock_max2;
185 int unfiltered_ports_nb, filtered_ports_nb;
186 int dropped_nb, timeout_nb, dropped_flag = 0;
187 int old_filtered = -1, old_opened = -1;
188 int open_ports_nb, closed_ports_nb;
189 int untested_ports_nb, total_ports_nb;
193 int cnx_max[3], rtt_max[3], rtt_min[3], ping_rtt = 0;
194 #if defined COMPUTE_RTT 195 double rtt_sum[3], rtt_sum2[3];
197 static const char *rtt_type[] = {
"unfiltered",
"open",
"closed" };
199 time_t start_time = time(NULL), start_time_1pass, end_time;
200 long diff_time, diff_time1;
201 int rst_rate_limit_flag = 0, doublecheck_flag = 0;
202 #if defined COMPUTE_RTT 203 double mean, sd = -1.0, emax = -1.0;
206 proto = getprotobyname(
"tcp");
212 tcpproto = proto->p_proto;
214 for (i = 0; i <
sizeof(ports_states) /
sizeof(*ports_states); i ++)
217 for (i = 0; i < 3; i ++)
219 #if defined COMPUTE_RTT 220 rtt_sum[i] = rtt_sum2[i] = 0.0;
223 rtt_max[i] = cnx_max[i] = 0;
235 ping_rtt = GPOINTER_TO_SIZE(k);
244 inet_ntoa(*pia), ping_rtt / 1e6);
251 p = (
char*)portrange;
252 untested_ports_nb = 0;
262 if (*p ==
'T' && p[1] && p[1] ==
':')
265 else if (*p ==
'U' && p[1] && p[1] ==
':')
273 po2 = strtol(q, &p, 10);
283 po1 = strtol(p, &q, 10);
309 po2 = strtol(q+1, &p, 10);
313 (
"openvas_tcp_scanner: Cannot parse '%s'", p);
319 for (i = po1; i <= po2; i ++)
322 untested_ports_nb ++;
332 for (i = 0; i < max_cnx; i ++)
339 open_sock_max = min_cnx; open_sock_max2 = max_cnx;
341 open_ports_nb = closed_ports_nb = filtered_ports_nb = unfiltered_ports_nb = 0;
345 int open_ports_nb1 = 0, closed_ports_nb1 = 0;
346 int wait_sock_nb = 0;
349 start_time_1pass = time(NULL);
351 log_legacy_write (
"openvas_tcp_scanner(%s): pass #%d: open_sock_max=%d\topen_sock_max2=%d\n", inet_ntoa(*pia), pass, open_sock_max, open_sock_max2);
354 FD_ZERO(&rfs); FD_ZERO(&wfs); imax = -1;
356 while (scanned_ports < 65535)
358 total_ports_nb = unfiltered_ports_nb + filtered_ports_nb + untested_ports_nb;
360 log_legacy_write (
"openvas_tcp_scanner(%s): %d / %d = %02d%% - %d ports remaining\n",
362 unfiltered_ports_nb + filtered_ports_nb,
364 (unfiltered_ports_nb + filtered_ports_nb) * 100 /
365 (total_ports_nb > 0 ? total_ports_nb : 1),
368 while (open_sock_nb < open_sock_max)
370 for (port = minport; port <= 65535 && ports_states[port] !=
GRAB_PORT_UNKNOWN; port ++)
378 log_legacy_write (
"openvas_tcp_scanner: Trying %s:%d\n", inet_ntoa(*pia), port);
380 if(IN6_IS_ADDR_V4MAPPED(pia))
382 s = socket(PF_INET, SOCK_STREAM, tcpproto);
386 s = socket(PF_INET6, SOCK_STREAM, tcpproto);
392 open_sock_max = open_sock_max2 = open_sock_nb / 2 - 1;
397 log_legacy_write (
"openvas_tcp_scanner(%s): Reducing the number of maximum open connections to %d [ENFILE]\n", inet_ntoa(*pia), open_sock_max);
401 else if (errno == EMFILE)
403 x = open_sock_nb / 16;
404 open_sock_max = open_sock_max2 =
405 open_sock_nb - (x > 0 ? x : 1);
410 log_legacy_write (
"openvas_tcp_scanner(%s): Reducing the number of maximum open connections to %d [EMFILE]\n", inet_ntoa(*pia), open_sock_max);
420 #if defined FD_SETSIZE 426 log_legacy_write (
"openvas_tcp_scanner(%s): socket=%d > FD_SETSIZE=%d - reducing the number of maximum open connections to %d\n", inet_ntoa(*pia), s, FD_SETSIZE, open_sock_max);
434 if ((x = fcntl(s, F_GETFL)) < 0)
436 perror(
"fcntl(F_GETFL)");
439 if (fcntl(s, F_SETFL, x | O_NONBLOCK) < 0)
441 perror(
"fcntl(F_SETFL)");
449 l.l_onoff = 0; l.l_linger = 0;
450 if (setsockopt(s, SOL_SOCKET, SO_LINGER, &l,
sizeof(l)) < 0)
451 perror(
"setsockopt(SO_LINGER)");
456 if (setsockopt(s, SOL_TCP, TCP_NODELAY, &x,
sizeof(x)) < 0)
457 perror(
"setsockopt(TCP_NODELAY");
461 if (setsockopt(s, SOL_TCP, TCP_QUICKACK, &x,
sizeof(x)) < 0)
462 perror(
"setsockopt(TCP_QUICKACK");
464 #if defined LINUX && defined IPTOS_RELIABILITY 470 x = IPTOS_RELIABILITY;
471 if (setsockopt(s, SOL_IP, IP_TOS, &x,
sizeof(x)) < 0)
472 perror(
"setsockopt(IP_TOS");
474 if(IN6_IS_ADDR_V4MAPPED(pia))
476 sa.sin_addr.s_addr = pia->s6_addr32[3];
477 sa.sin_family = AF_INET;
478 sa.sin_port = htons(port);
479 len =
sizeof(
struct sockaddr_in);
480 retval = connect(s, (
struct sockaddr*)&sa, len);
484 memcpy(&sa6.sin6_addr, pia,
sizeof(
struct in6_addr));
485 sa6.sin6_family = AF_INET6;
486 sa6.sin6_port = htons(port);
487 len =
sizeof(
struct sockaddr_in6);
488 retval = connect(s, (
struct sockaddr*)&sa6, len);
496 sockets[open_sock_nb].
fd = s;
497 sockets[open_sock_nb].
port = port;
499 (void) gettimeofday(&sockets[open_sock_nb].tictac, NULL);
502 if (s > imax) imax = s;
506 x = open_sock_nb / 16;
507 open_sock_max = open_sock_max2 =
508 open_sock_nb - (x > 0 ? x : 1);
511 log_legacy_write (
"openvas_tcp_scanner(%s): Reducing the number of maximum open connections to %d [EAGAIN]\n", inet_ntoa(*pia), open_sock_max);
518 printf(
">>> %d: CLOSED\n", sockets[i].port);
521 unfiltered_ports_nb ++;
524 untested_ports_nb --;
531 printf(
">>> %d: FILTERED\n", sockets[i].port);
534 filtered_ports_nb ++;
535 untested_ports_nb --;
545 sockets[open_sock_nb].
fd = s;
546 sockets[open_sock_nb].
port = port;
549 printf(
">>> %d: OPEN\n", sockets[i].port);
551 (void) gettimeofday(&sockets[open_sock_nb].tictac, NULL);
554 unfiltered_ports_nb ++;
558 untested_ports_nb --;
563 timeout.tv_sec = timeout.tv_usec = 0;
564 if (select(imax + 1, NULL, &wfs, NULL, &timeout) > 0)
567 log_legacy_write (
"openvas_tcp_scanner(%s): select! Breaking loop (open_sock_nb=%d / %d)\n", inet_ntoa(*pia), open_sock_nb, open_sock_max);
574 if (open_sock_max2 <= 0)
577 if (open_sock_nb == 0)
580 log_legacy_write (
"openvas_tcp_scanner(%s): No more open socket\n", inet_ntoa(*pia));
585 FD_ZERO(&rfs); FD_ZERO(&wfs); FD_ZERO(&efs); imax = -1;
587 for (i = 0; i < open_sock_nb; i ++)
589 if (sockets[i].fd >= 0)
591 switch (sockets[i].state)
594 FD_SET(sockets[i].fd, &rfs);
597 FD_SET(sockets[i].fd, &wfs);
602 if (sockets[i].fd > imax)
603 imax = sockets[i].
fd;
609 if (untested_ports_nb > 0)
612 log_legacy_write (
"openvas_tcp_scanner(%s): No socket! %d ports remaining\n", inet_ntoa(*pia), untested_ports_nb);
619 log_legacy_write (
"openvas_tcp_scanner(%s): No socket! No port remaining\n", inet_ntoa(*pia));
625 timeout_nb = 0; dropped_nb = 0; dropped_flag = 0;
626 #if defined COMPUTE_RTT 632 mean = rtt_sum[0] / (double)rtt_nb[0];
633 if ((
double)rtt_max[0] > mean)
635 sd = sqrt((rtt_sum2[0] / rtt_nb[0] - mean * mean) * (
double)rtt_nb[0] / (rtt_nb[0] - 1));
636 emax = mean + 3 * sd;
637 em = floor(emax + 0.5);
638 moy = floor(rtt_sum[0] / rtt_nb[0] + 0.5);
642 log_legacy_write (
"openvas_tcp_scanner: arithmetic overflow: %g -> %d\n", emax, em);
649 log_legacy_write (
"openvas_tcp_scanner(%s): rtt_nb=%d rtt_max = %g > %g (M=%g, SD=%g)\n", inet_ntoa(*pia), rtt_nb[0], (
double)rtt_max[0] / 1e6, emax / 1e6, mean / 1e6, sd / 1e6);
655 log_legacy_write (
"openvas_tcp_scanner(%s): rtt_nb=%d rtt_max = %g < %g\n", inet_ntoa(*pia), rtt_nb[0], (
double)rtt_max[0] / 1e6, emax / 1e6);
658 if (rtt_max[0] < rtt_min[0])
661 log_legacy_write (
"openvas_tcp_scanner(%s): absurdly low rtt_max=%g < rtt_min = %g\n", inet_ntoa(*pia), (
double)rtt_max[0] / 1e6, (
double)rtt_min[0] / 1e6);
663 rtt_max[0] = rtt_min[0];
672 if (wait_sock_nb == 0)
673 if (rtt_max[0] > 0 || ping_rtt > 0)
686 if (doublecheck_flag)
691 log_legacy_write (
"openvas_tcp_scanner(%s): basic timeout increased from %g to %g because of \"double check\"\n", inet_ntoa(*pia), y/1e6, x/1e6);
695 x += (unsigned)(lrand48() & 0x7FFFFFFF) % 100000;
697 x += (unsigned)(lrand48() & 0x7FFFFFFF) % 50000;
699 x = 20000 + (unsigned)(lrand48() & 0x7FFFFFFF) % 20000;
700 timeout.tv_sec = x / 1000000;
701 timeout.tv_usec = x % 1000000;
704 inet_ntoa(*pia), y/1e6, x/1e6);
711 timeout.tv_usec = (unsigned)(lrand48() & 0x7FFFFFFF) % 250000;
715 timeout.tv_sec = read_timeout;
716 timeout.tv_usec = (unsigned)(lrand48() & 0x7FFFFFFF) % 500000;
720 log_legacy_write (
"openvas_tcp_scanner(%s): wait_sock_nb=%d - timeout=%u.%06u - RTT=%f/%f/%f/%f\n", inet_ntoa(*pia), wait_sock_nb, timeout.tv_sec, timeout.tv_usec, (
double)rtt_min[0] / 1e6, rtt_sum[0] / 1e6 / (rtt_nb[0] > 0 ? rtt_nb[0] : 1), (
double)rtt_max[0] / 1e6, (
double)cnx_max[0] / 1e6);
722 log_legacy_write (
"openvas_tcp_scanner(%s): wait_sock_nb=%d - timeout=%d.%06d\n", inet_ntoa(*pia), wait_sock_nb, timeout.tv_sec, timeout.tv_usec);
725 gettimeofday(&ti1, NULL);
730 x = select(imax + 1, &rfs, &wfs, NULL, &timeout);
733 log_legacy_write (
"openvas_tcp_scanner(%s): select interrupted (i=%d)\n", inet_ntoa(*pia), i);
736 while (i ++ < 10 && x < 0 && errno == EINTR);
746 log_legacy_write (
"openvas_tcp_scanner(%s): select: timeout on all (%d) sockets!\n", inet_ntoa(*pia), imax - 1);
748 for (i = 0; i < open_sock_nb; i ++)
750 if (sockets[i].fd > 0)
752 my_socket_close(sockets[i].fd);
754 switch (sockets[i].state)
758 printf(
">> %d: TIMEOUT\n", sockets[i].port);
761 filtered_ports_nb ++;
763 untested_ports_nb --;
767 printf(
">> %d: NO BANNER\n", sockets[i].port);
778 (void) gettimeofday(&ti, NULL);
780 log_legacy_write (
"openvas_tcp_scanner(%s): select replied in %f s [time=%d.%06d]\n", inet_ntoa(*pia),
DIFFTVu(ti, ti1) / 1e6, ti.tv_sec, ti.tv_usec);
782 for (i = 0; i < open_sock_nb; i ++)
784 if (sockets[i].fd > 0) {
785 if (FD_ISSET(sockets[i].fd, &wfs))
787 opt = 0; optsz =
sizeof(opt);
788 if (getsockopt(sockets[i].fd, SOL_SOCKET, SO_ERROR, &opt, &optsz) < 0)
790 perror(
"getsockopt");
794 x =
DIFFTVu(ti, sockets[i].tictac);
797 inet_ntoa(*pia), sockets[i].port, x / 1e6);
803 perror(
"select->getsockopt");
805 if (x > cnx_max[2]) cnx_max[2] = x;
806 if (x < rtt_min[2]) rtt_min[2] = x;
809 if (x > rtt_max[2]) rtt_max[2] = x;
810 #if defined COMPUTE_RTT 812 rtt_sum[2] += (double)x;
813 rtt_sum2[2] += (double)x * (
double)x;
817 my_socket_close(sockets[i].fd);
821 untested_ports_nb --;
827 filtered_ports_nb ++;
829 printf(
">> %d: FILTERED\n", sockets[i].port);
836 unfiltered_ports_nb ++;
840 printf(
">> %d: CLOSED\n", sockets[i].port);
849 printf(
">> %d: OPEN\n", sockets[i].port);
851 if (x > cnx_max[1]) cnx_max[1] = x;
852 if (x < rtt_min[1]) rtt_min[1] = x;
855 if (x > rtt_max[1]) rtt_max[1] = x;
856 #if defined COMPUTE_RTT 858 rtt_sum[1] += (double)x;
859 rtt_sum2[1] += (double)x * (
double)x;
863 unfiltered_ports_nb ++;
866 untested_ports_nb --;
870 snprintf(
kb,
sizeof(
kb),
"TCPScanner/CnxTime1000/%u", sockets[i].port);
872 snprintf(
kb,
sizeof(
kb),
"TCPScanner/CnxTime/%u", sockets[i].port);
874 sockets[i].tictac = ti;
876 if (x > cnx_max[0]) cnx_max[0] = x;
877 if (x < rtt_min[0]) rtt_min[0] = x;
880 if (x > rtt_max[0]) rtt_max[0] = x;
881 #if defined COMPUTE_RTT 883 rtt_sum[0] += (double)x;
884 rtt_sum2[0] += (double)x * (
double)x;
888 else if (FD_ISSET(sockets[i].fd, &rfs))
890 x = read(sockets[i].fd, buf,
sizeof(buf)-1);
893 char buf2[
sizeof(buf)*2+1];
896 for (y = 0; y < x; y ++)
898 sprintf(buf2 + 2*y,
"%02x", (
unsigned char) buf[y]);
899 if (buf[y] ==
'\0') flag = 1;
901 buf2[2 * x - 1] =
'\0';
904 snprintf(
kb,
sizeof(
kb),
"BannerHex/%u", sockets[i].port);
909 snprintf(
kb,
sizeof(
kb),
"Banner/%u", sockets[i].port);
912 printf(
"Banner for port %u: %s\n", sockets[i].port, buf);
914 x =
DIFFTVu(ti, sockets[i].tictac) / 1000;
915 snprintf(
kb,
sizeof(
kb),
"TCPScanner/RwTime1000/%u", sockets[i].port);
917 snprintf(
kb,
sizeof(
kb),
"TCPScanner/RwTime/%u", sockets[i].port);
925 my_socket_close(sockets[i].fd);
933 (void) gettimeofday(&ti, NULL);
934 for (i = 0; i < open_sock_nb; i ++)
935 if (sockets[i].fd >= 0 &&
DIFFTV(ti, sockets[i].tictac) >= read_timeout)
938 log_legacy_write (
"openvas_tcp_scanner(%s): pass #%d: timeout on port %u: %d\n", inet_ntoa(*pia), pass, sockets[i].port,
DIFFTV(ti, sockets[i].tictac));
940 switch(sockets[i].state)
944 printf(
">> %u: NO BANNER\n", sockets[i].port);
948 snprintf(
kb,
sizeof(
kb),
"/tmp/NoBanner/%u", sockets[i].port);
953 printf(
">> %d: TIMEOUT\n", sockets[i].port);
956 filtered_ports_nb ++;
958 untested_ports_nb --;
961 log_legacy_write (
"openvas_tcp_scanner: Unhandled case %d at %s:%d\n", sockets[i].state, __FILE__, __LINE__);
964 my_socket_close(sockets[i].fd); sockets[i].fd = -1;
970 log_legacy_write (
"openvas_tcp_scanner(%s): open_sock_max=%d timeout_nb=%d dropped_nb=%d\n", inet_ntoa(*pia), open_sock_max, timeout_nb, dropped_nb);
971 done_ports_nb = unfiltered_ports_nb + filtered_ports_nb;
972 if (done_ports_nb > 0 && total_ports_nb > 0)
974 int dt = time(NULL) - start_time_1pass;
975 log_legacy_write (
"openvas_tcp_scanner(%s): pass #%d: time spent so far = %d s - estimated total time = %d s - estimated time remaining = %d s\n",
976 inet_ntoa(*pia), pass,
978 dt * total_ports_nb / done_ports_nb,
979 dt * (total_ports_nb - done_ports_nb) / done_ports_nb);
982 if (dropped_nb > 0 &&
983 dropped_nb >= (open_sock_nb * 3) / 4 &&
984 (dropped_nb < filtered_ports_nb
985 || dropped_nb > unfiltered_ports_nb))
989 log_legacy_write (
"openvas_tcp_scanner(%s): %d connections dropped. Firewall?\n", inet_ntoa(*pia), dropped_nb);
991 open_sock_max += dropped_nb;
992 if (open_sock_max2 < max_cnx) open_sock_max2 ++;
997 else if (dropped_nb > 0)
1000 open_sock_max -= (dropped_nb + 2) / 3;
1001 if (open_sock_max < min_cnx) open_sock_max = min_cnx;
1002 open_sock_max2 = (open_sock_max + 3 * open_sock_max2) / 4;
1004 if (open_sock_max2 <= min_cnx)
1005 if (open_sock_max2 > 0)
1006 min_cnx = open_sock_max2;
1008 open_sock_max2 = min_cnx;
1011 if (min_cnx < open_sock_max)
1012 log_legacy_write (
"openvas_tcp_scanner(%s): %d connections dropped. Slowing down - min_cnx=%d - open_sock_nb=%d - open_sock_max=%d - open_sock_max2=%d\n", inet_ntoa(*pia), dropped_nb, min_cnx, open_sock_nb, open_sock_max, open_sock_max2);
1015 else if (dropped_nb == 0 && dropped_flag)
1023 open_sock_max += timeout_nb;
1024 if (open_sock_max > open_sock_max2)
1028 inet_ntoa(*pia), open_sock_max, open_sock_max2);
1030 open_sock_max = open_sock_max2;
1032 if (open_sock_max < min_cnx)
1036 inet_ntoa(*pia), open_sock_max, min_cnx);
1038 open_sock_max = min_cnx;
1041 if (x != open_sock_max)
1042 log_legacy_write (
"openvas_tcp_scanner(%s): open_sock_max=%d (old value %d)\n", inet_ntoa(*pia), open_sock_max, x);
1044 for (i = 0; i < open_sock_nb; )
1051 if (j < open_sock_nb)
1052 memmove(sockets+i, sockets+j,
sizeof(*sockets) * (max_cnx - j));
1053 open_sock_nb -= j - i;
1060 end_time = time(NULL);
1061 diff_time1 = end_time - start_time_1pass;
1062 diff_time = end_time - start_time;
1064 log_legacy_write (
"openvas_tcp_scanner(%s): pass #%d ran in %d s - filtered_ports_nb=%d closed_ports_nb=%d open_ports_nb=%d\n", inet_ntoa(*pia), pass, diff_time1, filtered_ports_nb, closed_ports_nb, open_ports_nb);
1067 (pass == 1 && filtered_ports_nb > 10 && closed_ports_nb > 10) ||
1068 (pass > 1 && filtered_ports_nb > 0))
1070 if (doublecheck_flag && rst_rate_limit_flag && open_ports_nb == old_opened)
1073 log_legacy_write (
"openvas_tcp_scanner(%s): Same number of open ports! Stopping now\n", inet_ntoa(*pia));
1077 old_opened = open_ports_nb;
1079 doublecheck_flag = 0;
1081 log_legacy_write (
"openvas_tcp_scanner(%s): pass #%d: Suspicious number of filtered ports (%d) or closed ports (%d) - running another time\n", inet_ntoa(*pia), pass, filtered_ports_nb, closed_ports_nb);
1083 if (filtered_ports_nb == old_filtered)
1086 log_legacy_write (
"openvas_tcp_scanner(%s): Same number of filtered ports! Stopping now\n", inet_ntoa(*pia));
1091 if (pass > 1 && open_ports_nb1 == 0 &&
1092 closed_ports_nb1 >= min_cnx &&
1098 closed_ports_nb1 >= (diff_time1 + 1) * 10 &&
1099 closed_ports_nb1 < (diff_time1 + 1) * 201 &&
1101 closed_ports_nb >= (diff_time + 1) * 10 &&
1102 closed_ports_nb < (diff_time + 1) * 201)
1106 int tbd = break_flag && !doublecheck_flag ? double_check_std_ports(ports_states) : 0;
1109 doublecheck_flag = 1;
1113 log_legacy_write (
"openvas_tcp_scanner(%s): system seems to be limiting RST rate - %s - min_cnx=%d - closed_ports_nb1=%d - diff_time1=%d - closed_ports_nb=%d - diff_time=%d\n", inet_ntoa(*pia), break_flag ?
"Stopping immediately" : doublecheck_flag ?
"Double checking standard ports" :
"Running one last pass", min_cnx, closed_ports_nb1, diff_time1, closed_ports_nb, diff_time);
1115 rst_rate_limit_flag ++ ;
1116 if (break_flag)
break;
1119 log_legacy_write (
"openvas_tcp_scanner(%s): min_cnx=%d - open_ports_nb1=%d - closed_ports_nb1=%d - diff_time1=%d - closed_ports_nb=%d - diff_time=%d\n", inet_ntoa(*pia), min_cnx, open_ports_nb1, closed_ports_nb1, diff_time1, closed_ports_nb, diff_time);
1127 for (port = 1; port <= 65535; port ++)
1134 if (old_filtered != filtered_ports_nb)
1135 log_legacy_write (
"openvas_tcp_scanner(%s): old_filtered=%d filtered_ports_nb=%d\n", inet_ntoa(*pia), old_filtered, filtered_ports_nb);
1137 untested_ports_nb = old_filtered;
1138 filtered_ports_nb = 0;
1139 open_sock_max = min_cnx / (pass + 1);
1140 if (open_sock_max < 1)
1144 open_sock_max2 *= 2;
1145 open_sock_max2 /= 3;
1147 else if (rst_rate_limit_flag)
1155 if (open_sock_max2 <= open_sock_max)
1156 open_sock_max2 = open_sock_max * 2;
1158 else if (filtered_ports_nb > 0)
1161 doublecheck_flag = 1;
1164 if ((tbd_nb = double_check_std_ports(ports_states)) == 0)
1167 log_legacy_write (
"openvas_tcp_scanner(%s): pass #%d - No filtered standard ports - stopping\n", inet_ntoa(*pia), pass);
1173 log_legacy_write (
"openvas_tcp_scanner(%s): pass #%d - Double checking %d standard ports\n", inet_ntoa(*pia), pass, tbd_nb);
1175 old_filtered = untested_ports_nb = tbd_nb;
1176 filtered_ports_nb = 0;
1177 open_sock_max = min_cnx / pass;
1178 if (open_sock_max2 <= open_sock_max)
1179 open_sock_max2 = open_sock_max * 2;
1195 filtered_ports_nb = old_filtered;
1201 log_legacy_write (
"openvas_tcp_scanner(%s): ran in %d pass(es) in %d s - min_cnx=%d max_cnx=%d read_timeout=%d - open_ports_nb=%d closed_ports_nb=%d filtered_ports_nb=%d - rtt_min=%f rtt_max=%f cnx_max=%f\n", inet_ntoa(*pia), pass, diff_time, min_cnx, max_cnx, read_timeout, open_ports_nb, closed_ports_nb, filtered_ports_nb, rtt_min[0] / 1e6, rtt_max[0] / 1e6, cnx_max[0] / 1e6);
1204 #if defined COMPUTE_RTT 1205 for (i = 0; i < 3; i ++)
1209 double mean, sd = -1.0, emax = -1.0;
1212 rtt_sum[i] /= 1e6; rtt_sum2[i] /= 1e12;
1214 mean = rtt_sum[i] / rtt_nb[i];
1216 snprintf(rep,
sizeof(rep),
"%6g", mean);
1217 snprintf(
kb,
sizeof(
kb),
"TCPScanner/%s/MeanRTT", rtt_type[i]);
1219 x = floor(mean * 1000 + 0.5);
1220 snprintf(
kb,
sizeof(
kb),
"TCPScanner/%s/MeanRTT1000", rtt_type[i]);
1223 snprintf(
kb,
sizeof(
kb),
"TCPScanner/%s/MaxRTT1000", rtt_type[i]);
1225 snprintf(rep,
sizeof(rep),
"%6g", (rtt_max[i] + 500000.0) / 1000000.0);
1226 snprintf(
kb,
sizeof(
kb),
"TCPScanner/%s/MaxRTT", rtt_type[i]);
1231 sd = sqrt((rtt_sum2[i] / rtt_nb[i] - mean * mean) * rtt_nb[i] / (rtt_nb[i] - 1));
1232 emax = mean + 3 * sd;
1234 snprintf(rep,
sizeof(rep),
"%6g", sd);
1235 snprintf(
kb,
sizeof(
kb),
"TCPScanner/%s/SDRTT", rtt_type[i]);
1237 x = floor(sd * 1000 + 0.5);
1238 snprintf(
kb,
sizeof(
kb),
"TCPScanner/%s/SDRTT1000", rtt_type[i]);
1240 snprintf(rep,
sizeof(rep),
"%6g", emax);
1241 snprintf(
kb,
sizeof(
kb),
"TCPScanner/%s/EstimatedMaxRTT", rtt_type[i]);
1243 x = floor(emax * 1000 + 0.5);
1244 snprintf(
kb,
sizeof(
kb),
"TCPScanner/%s/EstimatedMaxRTT1000", rtt_type[i]);
1250 log_legacy_write (
"openvas_tcp_scanner: Mean RTT to %s = %g - [%g, %g] - SD = %g - +3SD = %g [%d %s ports]\n",
1251 inet_ntoa(*pia), mean,
1252 rtt_min[i] / 1e6, cnx_max[i] / 1e6,
1253 sd, emax, rtt_nb[i], rtt_type[i]);
1258 plug_set_key(desc,
"TCPScanner/ClosedPortsNb",
ARG_INT, GSIZE_TO_POINTER(closed_ports_nb));
1259 plug_set_key(desc,
"TCPScanner/FilteredPortsNb",
ARG_INT, GSIZE_TO_POINTER(filtered_ports_nb));
1260 plug_set_key(desc,
"TCPScanner/RSTRateLimit",
ARG_INT, GSIZE_TO_POINTER( rst_rate_limit_flag));
1261 if (untested_ports_nb <= 0)
1264 GSIZE_TO_POINTER((total_ports_nb - untested_ports_nb)));
1273 const char * port_range =
prefs_get (
"port_range");
1275 struct in6_addr *p_addr;
1276 int timeout = 0, max_cnx, min_cnx, x;
1280 if (p != NULL) timeout = atoi(p);
1288 int max_host = 0, max_checks = 0, cur_sys_fd = 0, max_sys_fd = 0;
1292 double loadavg[3], maxloadavg = -1.0;
1294 int stderr_fd = dup(2);
1295 int devnull_fd = open(
"/dev/null", O_WRONLY);
1297 dup2(devnull_fd, 2);
1301 if (p != NULL) max_host = atoi(p);
1302 if (max_host <= 0) max_host = 15;
1305 if (p != NULL) max_checks = atoi(p);
1306 if (max_checks <= 0 || max_checks > 5)
1310 log_legacy_write (
"openvas_tcp_scanner: max_checks forced to %d\n", max_checks);
1314 min_cnx = 8 * max_checks;
1316 max_cnx = 24 * max_checks;
1318 max_cnx = 80 * max_checks;
1320 getloadavg(loadavg, 3);
1321 for (i = 0; i < 3; i ++)
1322 if (loadavg[i] > maxloadavg) maxloadavg = loadavg[i];
1324 if (max_sys_fd <= 0)
1327 fp = popen(
"sysctl fs.file-nr",
"r");
1333 if (fscanf(fp,
"%*s = %*d %d %d", &cur_sys_fd, &max_sys_fd) == 1)
1334 max_sys_fd -= cur_sys_fd;
1340 if (max_sys_fd <= 0)
1343 fp = popen(
"sysctl fs.file-max",
"r");
1349 if (fscanf(fp,
"%*s = %d", &max_sys_fd) < 1)
1355 if (max_sys_fd <= 0)
1358 fp = popen(
"sysctl kern.maxfiles",
"r");
1364 if (fscanf(fp,
"%*s = %d", &max_sys_fd) < 1)
1377 if (maxloadavg >= 0.0)
1382 max_cnx /= (1.0 + maxloadavg);
1385 log_legacy_write (
"openvas_tcp_scanner: max_cnx reduced from %d to %d because of maxloadavg=%f\n", x, max_cnx, maxloadavg);
1394 if (max_sys_fd <= 0) max_sys_fd = 16384;
1396 if (max_sys_fd < 1024)
1401 x = max_sys_fd / max_host;
1403 if (max_cnx > x) max_cnx = x;
1413 if (getrlimit(RLIMIT_NOFILE, &rlim) < 0)
1414 perror(
"getrlimit(RLIMIT_NOFILE)");
1418 if (rlim.rlim_cur !=
RLIM_INFINITY && max_cnx >= rlim.rlim_cur)
1419 max_cnx = rlim.rlim_cur - 1;
1422 if (min_cnx > x) min_cnx = x > 0 ? x : 1;
1424 log_legacy_write (
"openvas_tcp_scanner: min_cnx = %d ; max_cnx = %d\n", min_cnx, max_cnx);
1428 p_addr = hostinfo->
ip;
1429 if( p_addr == NULL )
1431 if (banner_grab(p_addr, port_range, timeout, min_cnx, max_cnx, desc) < 0)
#define GRAB_PORT_REJECTED
void plug_set_key(struct arglist *args, char *name, int type, const void *value)
void * plug_get_key(struct arglist *args, char *name, int *type, int single)
#define GRAB_MAX_SOCK_SAFE
void log_legacy_write(const char *format,...)
Legacy function to write a log message.
const gchar * prefs_get(const gchar *key)
Get a string preference value via a key.
#define GRAB_SOCKET_UNUSED
Top-level KB. This is to be inherited by KB implementations.
tree_cell * safe_checks(lex_ctxt *lexic)
#define GRAB_PORT_NOT_TESTED
char * find_in_path(char *name, int safe)
void scanner_add_port(struct arglist *args, int port, char *proto)
tree_cell * plugin_run_openvas_tcp_scanner(lex_ctxt *lexic)
struct timeval timeval(unsigned long val)
#define GRAB_PORT_TESTING
#define GRAB_PORT_UNKNOWN
#define GRAB_SOCKET_OPENING
struct arglist * script_infos
void * arg_get_value(struct arglist *args, const char *name)
int prefs_get_bool(const gchar *key)
Get a boolean expression of a preference value via a key.