/* This software was derived from SATAN 1.1.1 by Dan Farmer and Wietse Venema
  (http://www.porcupine.org/satan).
*/
 /*
  * udp-scan - determine available udp services
  * 
  * Author: Wietse Venema.
  */


#include <sys/types.h>
#include <sys/param.h>
#include <sys/socket.h>
#include <sys/time.h>

#include <netinet/in_systm.h>
#include <netinet/in.h>
#include <netinet/ip.h>
#include <netinet/ip_icmp.h> 
#ifdef FAVOR_BSD
#define __FAVOR_BSD
#endif
#include <netinet/udp.h>

#include <errno.h>
#include <netdb.h>
#include <stdio.h>
#include <string.h>

extern int errno;

#ifndef __STDC__
extern char *strerror();
#endif

extern char *optarg;
extern int optind;

#define offsetof(t,m)	(size_t)(&(((t *)0)->m))

#ifndef FD_SET
#include <sys/select.h>
#endif

#ifndef IPPORT_TELNET
#define IPPORT_TELNET   23
#endif

#ifndef ICMP_MINLEN
#define ICMP_MINLEN 8
#endif

#ifndef ICMP_UNREACH
#define ICMP_UNREACH 3
#endif

#ifndef ICMP_UNREACH_PROTOCOL
#define ICMP_UNREACH_PROTOCOL 2
#endif

#ifndef ICMP_UNREACH_NET
#define ICMP_UNREACH_NET 0
#endif

#ifndef ICMP_UNREACH_PORT
#define ICMP_UNREACH_PORT 3
#endif

#ifndef ICMP_UNREACH_HOST
#define ICMP_UNREACH_HOST 1
#endif

#ifndef ICMP_UNREACH_FILTER_PROHIB
#define ICMP_UNREACH_FILTER_PROHIB 13
#endif

#include "lib.h"

#define LOAD_LIMIT	100		/* default max nr of open sockets */
#define AVG_MARGIN	10		/* safety margin */

 /*
  * In order to protect ourselves against dead hosts, we first probe UDP port
  * 1. If we do not get an ICMP error (no listener or host unreachable) we
  * assume this host is dead. If we do get an ICMP error, we have an estimate
  * of the roundtrip time. The test port can be changed with the -p option.
  */
char   *test_port = "1";
int     test_portno;

#define YES     1
#define NO      0

int     verbose = 0;			/* default silent mode */
int     open_file_limit;		/* max nr of open files */

 /*
  * We attempt to send as many probes per roundtrip time as network capacity
  * permits. With UDP we must do our own retransmission and congestion
  * handling.
  */
int     hard_limit = LOAD_LIMIT;	/* max nr of open sockets */
int     soft_limit;			/* slowly-moving load limit */

struct timeval now;			/* global time after select() */
int     ports_busy;			/* number of open sockets */
int     want_err = 0;			/* show reachable/unreachable */
int     show_all = 0;			/* show all ports */

 /*
  * Information about ongoing probes is sorted by time of last transmission.
  */
struct port_info {
    RING    ring;			/* round-robin linkage */
    struct timeval last_probe;		/* time of last probe */
    int     port;			/* port number */
    int     pkts;			/* number of packets sent */
};

struct port_info *port_info = 0;
RING    active_ports;			/* active sockets list head */
RING    dead_ports;			/* dead sockets list head */
struct port_info *find_port_info();	/* retrieve port info */

 /*
  * Performance statistics. These are used to update the transmission window
  * size depending on transmission error rates.
  */
double  avg_irt = 0;			/* inter-reply arrival time */
double  avg_rtt = 0;			/* round-trip time */
double  avg_pkts = 1;			/* number of packets sent per reply */
int     probes_sent = 0;		/* probes sent */
int     probes_done = 0;		/* finished probes */
int     replies;			/* number of good single probes */
struct timeval last_reply;		/* time of last reply */

int     send_sock;			/* send probes here */
int     icmp_sock;			/* read replies here */
fd_set  icmp_sock_mask;			/* select() read mask */
static struct sockaddr_in sin;

 /*
  * Helpers...
  */

#define time_since(t) (now.tv_sec - t.tv_sec + 1e-6 * (now.tv_usec - t.tv_usec))
#define sock_age(sp) time_since(sp->last_probe)
double  average();
struct port_info *add_port();


/* usage - explain command syntax */

void usage(why)
char   *why;
{
    if (why)
	remark(why);
    error("usage: %s [-apuU] [-l load] host ports...", progname);
}

/* drop_port - release port info, update statistics */

void drop_port(sp)
struct port_info *sp;
{
    ports_busy--;
    probes_done++;
    ring_detach((RING *) sp);
    ring_append(&dead_ports, (RING *) sp);

    /*
     * Increase the load when a sufficient number of probes succeeded.
     * Occasional retransmissons will keep the load unchanged.
     */
    if (replies > soft_limit) {
        replies = soft_limit / 2;
        if (soft_limit < hard_limit)
            soft_limit++;
    }
}
/* report_and_drop_port - report what we know about this service */

void report_and_drop_port(sp, err)
struct port_info *sp;
int     err;
{
    struct servent *se;

    if (probes_done == 0) {
        if (err == 0)
            error("are we talking to a dead host or network?");
    } else if (show_all || want_err == err || (want_err < 0 && want_err != ~err)
) {
        printf("%d:%s:", sp->port,
               (se = getservbyport(htons(sp->port), "udp")) ?
               se->s_name : "UNKNOWN");
        if (err && show_all)
            printf("%s", strerror(err));
        printf("\n");
        fflush(stdout);
    }
    drop_port(sp);
}

/* process_reply - process reply */

void process_reply(sp, err)
struct port_info *sp;
int     err;
{
    double  age = sock_age(sp);
    int     pkts = sp->pkts;
    double  irt = time_since(last_reply);

    /*
     * Don't believe everything.
     */
    if (age > 5) {
	age = 5;
    } else if (age < 0) {
	age = 1;
    }
    if (irt > 5) {
	irt = 5;
    } else if (irt < 0) {
	irt = 1;
    }

    /*
     * We jump some hoops for calibration purposes. First we estimate the
     * round-trip time: we use this to decide when to retransmit when network
     * transit time dominates.
     * 
     * Next thing to do is to estimate the inter-reply time, in case the sender
     * has a "dead time" for ICMP replies; I have seen this happen with some
     * Cisco routers and with Solaris 2.4. The first reply will come fast;
     * subsequent probes will be ignored for a period of up to one second.
     * When this happens the retransmission period should be based on the
     * inter-reply time and not on the average round-trip time.
     */
    last_reply = now;
    replies++;
    if (pkts == 1)
	avg_rtt = (avg_rtt == 0 ? age :		/* adopt initial rtt */
		   average(age, avg_rtt));	/* normal processing */
    avg_irt = (avg_irt == 0 ? 1 :		/* prepare for irt
						 * calibration */
	       avg_irt == 1 ? irt :		/* adopt initial irt */
	       average(irt, avg_irt));		/* normal processing */
    avg_pkts = average((double) pkts, avg_pkts);
    if (verbose)
	printf("%d:age %.3f irt %.3f pkt %d ports %2d soft %2d done %2d avrtt %.3f avpkt %.3f avirt %.3f\n",
	       sp->port, age, irt, pkts,
	       ports_busy, soft_limit,
	       probes_done, avg_rtt, avg_pkts, avg_irt);
    report_and_drop_port(sp, err);
}

/* average - quick-rise, slow-decay moving average */

double  average(new, old)
double  new;
double  old;
{
    if (new > old) {				/* quick rise */
	return ((new + old) / 2);
    } else {					/* slow decay */
	return (0.1 * new + 0.9 * old);
    }
}

/* add_port - say this port is being probed */

struct port_info *add_port(port)
int     port;
{
    struct port_info *sp = (struct port_info *) ring_succ(&dead_ports);

    ring_detach((RING *) sp);
    sp->port = port;
    sp->pkts = 0;
    ports_busy++;
    ring_append(&active_ports, (RING *) sp);
    return (sp);
}

/* write_port - write to port, update statistics */

void write_port(sp)
struct port_info *sp;
{
    char    ch = 0;

    ring_detach((RING *) sp);
    sin.sin_port = htons(sp->port);
    sp->last_probe = now;
    sendto(send_sock, &ch, 1, 0, (struct sockaddr *) & sin, sizeof(sin));
    probes_sent++;
    sp->pkts++;
    ring_prepend(&active_ports, (RING *) sp);

    /*
     * Reduce the sending window when the first retransmission happens. Back
     * off when retransmissions dominate. Occasional retransmissons will keep
     * the load unchanged.
     */
    if (sp->pkts > 1) {
	replies--;
	if (soft_limit > hard_limit) {
	    soft_limit = (ports_busy + 1) / 2;
	} else if (replies < 0 && avg_irt) {
	    soft_limit = 0.5 + 0.5 * (soft_limit + avg_rtt / avg_irt);
	    replies = soft_limit / 2;
	}
    }
}

/* find_port_info - lookup port info */

struct port_info *find_port_info(port)
int     port;
{
    struct port_info *sp;

    for (sp = (struct port_info *) ring_succ(&active_ports);
         sp != (struct port_info *) & active_ports;
         sp = (struct port_info *) ring_succ((RING *) sp))
        if (sp->port == port)
            return (sp);
    return (0);
}

/* init_port_info - initialize port info pool */

void init_port_info()
{
    struct port_info *sp;

    port_info = (struct port_info *) mymalloc(hard_limit * sizeof(*port_info));
    ring_init(&active_ports);
    ring_init(&dead_ports);
    for (sp = port_info; sp < port_info + hard_limit; sp++)
	ring_append(&dead_ports, (RING *) sp);
}

/* monitor_ports - watch for socket activity */

void monitor_ports()
{
    do {
	struct port_info *sp;

	/*
	 * When things become quiet, examine the port that we haven't looked
	 * at for the longest period of time.
	 */
	receive_answers();

	if (ports_busy == 0)
	    return;

	sp = (struct port_info *) ring_succ(&active_ports);
	if (sp->pkts > avg_pkts * AVG_MARGIN) {
	    report_and_drop_port(sp, 0);
	} else

	    /*
	     * Strategy depends on whether transit times dominate (probe
	     * multiple ports in parallel, retransmit when no reply was
	     * received for at least one round-trip period) or by dead time
	     * (probe one port at a time, retransmit when no reply was
	     * received for some fraction of the inter-reply period).
	     */
	    if (sock_age(sp) > (avg_rtt == 0 ? 1 :
				2 * avg_rtt < avg_irt ? avg_irt / 4 :
				1.5 * avg_rtt)) {
	    write_port(sp);
	}

	/*
	 * When all ports being probed seem to be active, send a test probe
	 * to see if the host is still alive.
	 */
	if (time_since(last_reply) > 3 * (avg_rtt == 0 ? 1 :
				      avg_rtt < avg_irt ? avg_irt : avg_rtt)
	    && find_port_info(test_portno) == 0) {
	    last_reply = now;
	    write_port(add_port(test_portno));
	}
    } while (ports_busy && (ports_busy >= hard_limit
			    || ports_busy >= probes_done
			    || ports_busy >= soft_limit));
}

/* scan_ports - scan ranges of ports */

void scan_ports(service)
char   *service;
{
    char   *cp;
    int     min_port;
    int     max_port;
    int     port;
    struct port_info *sp;

    if (service == test_port)
	test_portno = atoi(test_port);

    /*
     * Translate service argument to range of port numbers.
     */
    if ((cp = strchr(service, '-')) != 0) {
	*cp++ = 0;
	min_port = (service[0] ? ntohs(find_port(service, "udp")) : 1);
	max_port = (cp[0] ? ntohs(find_port(cp, "udp")) : 65535);
    } else {
	min_port = max_port = ntohs(find_port(service, "udp"));
    }

    /*
     * Iterate over each port in the given range. Adjust the number of
     * simultaneous probes to the capacity of the network.
     */
    for (port = min_port; port <= max_port; port++) {
	sp = add_port(port);
	write_port(sp);
	monitor_ports();
    }
}

/* receive_icmp - receive and decode ICMP message */

void receive_icmp(sock)
int     sock;
{
    union {
	char    chars[BUFSIZ];
	struct ip ip;
    }       buf;
    int     data_len;
    int     hdr_len;
    struct ip *ip;
    struct icmp *icmp;
    struct udphdr *udp;
    struct port_info *sp;

    if ((data_len = recv(sock, (char *) &buf, sizeof(buf), 0)) < 0) {
	error("error: recv: %m");
	return;
    }

    /*
     * Extract the IP header.
     */
    ip = &buf.ip;
    if (ip->ip_p != IPPROTO_ICMP) {
	error("error: not ICMP proto (%d)", ip->ip_p);
	return;
    }

    /*
     * Extract the IP payload.
     */
    hdr_len = ip->ip_hl << 2;
    if (data_len - hdr_len < ICMP_MINLEN) {
	remark("short ICMP packet (%d bytes)", data_len);
	return;
    }
    icmp = (struct icmp *) ((char *) ip + hdr_len);
    data_len -= hdr_len;

    if (icmp->icmp_type != ICMP_UNREACH)
	return;

    /*
     * Extract the offending IP header.
     */
    if (data_len < offsetof(struct icmp, icmp_ip) + sizeof(icmp->icmp_ip)) {
	remark("short IP header in ICMP");
	return;
    }
    ip = &(icmp->icmp_ip);
    if (ip->ip_p != IPPROTO_UDP)
	return;
    if (ip->ip_dst.s_addr != sin.sin_addr.s_addr)
	return;

    /*
     * Extract the offending UDP header.
     */
    hdr_len = ip->ip_hl << 2;
    udp = (struct udphdr *) ((char *) ip + hdr_len);
    data_len -= hdr_len;
    if (data_len < sizeof(struct udphdr)) {
	remark("short UDP header in ICMP");
	return;
    }

    /*
     * Process ICMP subcodes.
     */
    switch (icmp->icmp_code) {
    case ICMP_UNREACH_NET:
	error("error: network unreachable");
	/* NOTREACHED */
    case ICMP_UNREACH_HOST:
	if (sp = find_port_info(ntohs(udp->uh_dport)))
	    process_reply(sp, EHOSTUNREACH);
	break;
    case ICMP_UNREACH_PROTOCOL:
	error("error: protocol unreachable");
	/* NOTREACHED */
    case ICMP_UNREACH_PORT:
	if (sp = find_port_info(ntohs(udp->uh_dport)))
	    process_reply(sp, ECONNREFUSED);
	break;
    }
}

/* main - command-line interface */

main(argc, argv)
int     argc;
char   *argv[];
{
    int     c;
    struct protoent *pe;
    char  **ports;

    progname = argv[0];
    if (geteuid())
	error("This program needs root privileges");

    open_file_limit = open_limit();

    while ((c = getopt(argc, argv, "al:p:uUv")) != EOF) {
	switch (c) {
	case 'a':
	    show_all = 1;
	    break;
	case 'l':
	    if ((hard_limit = atoi(optarg)) <= 0)
		usage("invalid load limit");
	    break;
	case 'p':
	    test_port = optarg;
	    break;
	case 'u':
	    want_err = EHOSTUNREACH;
	    break;
	case 'U':
	    want_err = ~EHOSTUNREACH;
	    break;
	case 'v':
	    verbose = 1;
	    break;
	default:
	    usage((char *) 0);
	    break;
	}
    }
    argc -= (optind - 1);
    argv += (optind - 1);
    if (argc < 3)
	usage("missing argument");

    if (hard_limit > open_file_limit - 10)
	hard_limit = open_file_limit - 10;
    soft_limit = hard_limit + 1;
    init_port_info();

    if ((pe = getprotobyname("icmp")) == 0)
	error("icmp: unknown protocol");
    if ((icmp_sock = socket(AF_INET, SOCK_RAW, pe->p_proto)) < 0)
	error("icmp socket: %m");
    FD_ZERO(&icmp_sock_mask);
    FD_SET(icmp_sock, &icmp_sock_mask);

    if ((send_sock = socket(AF_INET, SOCK_DGRAM, 0)) < 0)
	error("socket: %m");

    /*
     * First do a test probe to see if the host is up, and to establish the
     * round-trip time. This requires that the test port is not used.
     */
    memset((char *) &sin, 0, sizeof(sin));
    sin.sin_addr = find_addr(argv[1]);
    sin.sin_family = AF_INET;

    gettimeofday(&now, (struct timezone *) 0);
    last_reply = now;

    /*
     * Calibrate round-trip time and dead time.
     */
    for (;;) {
	scan_ports(test_port);
	while (ports_busy > 0)
	    monitor_ports();
	if (avg_rtt)
	    break;
	sleep(1);
    }
    scan_ports(test_port);

    /*
     * Scan those ports.
     */
    for (ports = argv + 2; *ports; ports++)
	scan_ports(*ports);

    /*
     * All ports probed, wait for replies to trickle back.
     */
    while (ports_busy > 0)
	monitor_ports();

    return (0);
}


/* receive_answers - receive reactions to probes */

receive_answers()
{
    fd_set  read_mask;
    struct timeval waitsome;
    double  delay;
    int     answers;

    /*
     * The timeout is less than the inter-reply arrival time or we would not
     * be able to increase the load.
     */
    delay = (2 * avg_rtt < avg_irt ? avg_irt / 3 : avg_rtt / (1 + ports_busy * 4));
    waitsome.tv_sec = delay;
    waitsome.tv_usec = (delay - waitsome.tv_sec) * 1000000;

    read_mask = icmp_sock_mask;
    if ((answers = select(icmp_sock + 1, &read_mask, (fd_set *) 0, (fd_set *) 0,
			  &waitsome)) < 0)
	error("select: %m");

    gettimeofday(&now, (struct timezone *) 0);

    /*
     * For each answer that we receive without retransmissions, update the
     * average roundtrip time.
     */
    if (answers > 0) {
	if (FD_ISSET(icmp_sock, &read_mask))
	    receive_icmp(icmp_sock);
    }
    return (answers);
}


