1 /* $OpenBSD: traceroute.c,v 1.170 2024/08/21 15:00:25 florian Exp $ */ 2 /* $NetBSD: traceroute.c,v 1.10 1995/05/21 15:50:45 mycroft Exp $ */ 3 4 /* 5 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. 6 * All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 1. Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 3. Neither the name of the project nor the names of its contributors 17 * may be used to endorse or promote products derived from this software 18 * without specific prior written permission. 19 * 20 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND 21 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 22 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 23 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE 24 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 25 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 26 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 27 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 29 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 30 * SUCH DAMAGE. 31 */ 32 33 /*- 34 * Copyright (c) 1990, 1993 35 * The Regents of the University of California. All rights reserved. 36 * 37 * This code is derived from software contributed to Berkeley by 38 * Van Jacobson. 39 * 40 * Redistribution and use in source and binary forms, with or without 41 * modification, are permitted provided that the following conditions 42 * are met: 43 * 1. Redistributions of source code must retain the above copyright 44 * notice, this list of conditions and the following disclaimer. 45 * 2. Redistributions in binary form must reproduce the above copyright 46 * notice, this list of conditions and the following disclaimer in the 47 * documentation and/or other materials provided with the distribution. 48 * 3. Neither the name of the University nor the names of its contributors 49 * may be used to endorse or promote products derived from this software 50 * without specific prior written permission. 51 * 52 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 53 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 54 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 55 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 56 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 57 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 58 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 59 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 60 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 61 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 62 * SUCH DAMAGE. 63 */ 64 65 /* 66 * traceroute host - trace the route ip packets follow going to "host". 67 * 68 * Attempt to trace the route an ip packet would follow to some 69 * internet host. We find out intermediate hops by launching probe 70 * packets with a small ttl (time to live) then listening for an 71 * icmp "time exceeded" reply from a gateway. We start our probes 72 * with a ttl of one and increase by one until we get an icmp "port 73 * unreachable" (which means we got to "host") or hit a max (which 74 * defaults to 64 hops & can be changed with the -m flag). Three 75 * probes (change with -q flag) are sent at each ttl setting and a 76 * line is printed showing the ttl, address of the gateway and 77 * round trip time of each probe. If the probe answers come from 78 * different gateways, the address of each responding system will 79 * be printed. If there is no response within a 5 sec. timeout 80 * interval (changed with the -w flag), a "*" is printed for that 81 * probe. 82 * 83 * Probe packets are UDP format. We don't want the destination 84 * host to process them so the destination port is set to an 85 * unlikely value (if some clod on the destination is using that 86 * value, it can be changed with the -p flag). 87 * 88 * A sample use might be: 89 * 90 * [yak 71]% traceroute nis.nsf.net. 91 * traceroute to nis.nsf.net (35.1.1.48), 64 hops max, 56 byte packet 92 * 1 helios.ee.lbl.gov (128.3.112.1) 19 ms 19 ms 0 ms 93 * 2 lilac-dmc.Berkeley.EDU (128.32.216.1) 39 ms 39 ms 19 ms 94 * 3 lilac-dmc.Berkeley.EDU (128.32.216.1) 39 ms 39 ms 19 ms 95 * 4 ccngw-ner-cc.Berkeley.EDU (128.32.136.23) 39 ms 40 ms 39 ms 96 * 5 ccn-nerif22.Berkeley.EDU (128.32.168.22) 39 ms 39 ms 39 ms 97 * 6 128.32.197.4 (128.32.197.4) 40 ms 59 ms 59 ms 98 * 7 131.119.2.5 (131.119.2.5) 59 ms 59 ms 59 ms 99 * 8 129.140.70.13 (129.140.70.13) 99 ms 99 ms 80 ms 100 * 9 129.140.71.6 (129.140.71.6) 139 ms 239 ms 319 ms 101 * 10 129.140.81.7 (129.140.81.7) 220 ms 199 ms 199 ms 102 * 11 nic.merit.edu (35.1.1.48) 239 ms 239 ms 239 ms 103 * 104 * Note that lines 2 & 3 are the same. This is due to a buggy 105 * kernel on the 2nd hop system -- lbl-csam.arpa -- that forwards 106 * packets with a zero ttl. 107 * 108 * A more interesting example is: 109 * 110 * [yak 72]% traceroute allspice.lcs.mit.edu. 111 * traceroute to allspice.lcs.mit.edu (18.26.0.115), 64 hops max 112 * 1 helios.ee.lbl.gov (128.3.112.1) 0 ms 0 ms 0 ms 113 * 2 lilac-dmc.Berkeley.EDU (128.32.216.1) 19 ms 19 ms 19 ms 114 * 3 lilac-dmc.Berkeley.EDU (128.32.216.1) 39 ms 19 ms 19 ms 115 * 4 ccngw-ner-cc.Berkeley.EDU (128.32.136.23) 19 ms 39 ms 39 ms 116 * 5 ccn-nerif22.Berkeley.EDU (128.32.168.22) 20 ms 39 ms 39 ms 117 * 6 128.32.197.4 (128.32.197.4) 59 ms 119 ms 39 ms 118 * 7 131.119.2.5 (131.119.2.5) 59 ms 59 ms 39 ms 119 * 8 129.140.70.13 (129.140.70.13) 80 ms 79 ms 99 ms 120 * 9 129.140.71.6 (129.140.71.6) 139 ms 139 ms 159 ms 121 * 10 129.140.81.7 (129.140.81.7) 199 ms 180 ms 300 ms 122 * 11 129.140.72.17 (129.140.72.17) 300 ms 239 ms 239 ms 123 * 12 * * * 124 * 13 128.121.54.72 (128.121.54.72) 259 ms 499 ms 279 ms 125 * 14 * * * 126 * 15 * * * 127 * 16 * * * 128 * 17 * * * 129 * 18 ALLSPICE.LCS.MIT.EDU (18.26.0.115) 339 ms 279 ms 279 ms 130 * 131 * (I start to see why I'm having so much trouble with mail to 132 * MIT.) Note that the gateways 12, 14, 15, 16 & 17 hops away 133 * either don't send ICMP "time exceeded" messages or send them 134 * with a ttl too small to reach us. 14 - 17 are running the 135 * MIT C Gateway code that doesn't send "time exceeded"s. God 136 * only knows what's going on with 12. 137 * 138 * The silent gateway 12 in the above may be the result of a bug in 139 * the 4.[23]BSD network code (and its derivatives): 4.x (x <= 3) 140 * sends an unreachable message using whatever ttl remains in the 141 * original datagram. Since, for gateways, the remaining ttl is 142 * zero, the icmp "time exceeded" is guaranteed to not make it back 143 * to us. The behavior of this bug is slightly more interesting 144 * when it appears on the destination system: 145 * 146 * 1 helios.ee.lbl.gov (128.3.112.1) 0 ms 0 ms 0 ms 147 * 2 lilac-dmc.Berkeley.EDU (128.32.216.1) 39 ms 19 ms 39 ms 148 * 3 lilac-dmc.Berkeley.EDU (128.32.216.1) 19 ms 39 ms 19 ms 149 * 4 ccngw-ner-cc.Berkeley.EDU (128.32.136.23) 39 ms 40 ms 19 ms 150 * 5 ccn-nerif35.Berkeley.EDU (128.32.168.35) 39 ms 39 ms 39 ms 151 * 6 csgw.Berkeley.EDU (128.32.133.254) 39 ms 59 ms 39 ms 152 * 7 * * * 153 * 8 * * * 154 * 9 * * * 155 * 10 * * * 156 * 11 * * * 157 * 12 * * * 158 * 13 rip.Berkeley.EDU (128.32.131.22) 59 ms ! 39 ms ! 39 ms ! 159 * 160 * Notice that there are 12 "gateways" (13 is the final 161 * destination) and exactly the last half of them are "missing". 162 * What's really happening is that rip (a Sun-3 running Sun OS3.5) 163 * is using the ttl from our arriving datagram as the ttl in its 164 * icmp reply. So, the reply will time out on the return path 165 * (with no notice sent to anyone since icmp's aren't sent for 166 * icmp's) until we probe with a ttl that's at least twice the path 167 * length. I.e., rip is really only 7 hops away. A reply that 168 * returns with a ttl of 1 is a clue this problem exists. 169 * Traceroute prints a "!" after the time if the ttl is <= 1. 170 * Since vendors ship a lot of obsolete (DEC's Ultrix, Sun 3.x) or 171 * non-standard (HPUX) software, expect to see this problem 172 * frequently and/or take care picking the target host of your 173 * probes. 174 * 175 * Other possible annotations after the time are !H, !N, !P (got a host, 176 * network or protocol unreachable, respectively), !S or !F (source 177 * route failed or fragmentation needed -- neither of these should 178 * ever occur and the associated gateway is busted if you see one). If 179 * almost all the probes result in some kind of unreachable, traceroute 180 * will give up and exit. 181 * 182 * Notes 183 * ----- 184 * This program must be run by root or be setuid. (I suggest that 185 * you *don't* make it setuid -- casual use could result in a lot 186 * of unnecessary traffic on our poor, congested nets.) 187 * 188 * This program requires a kernel mod that does not appear in any 189 * system available from Berkeley: A raw ip socket using proto 190 * IPPROTO_RAW must interpret the data sent as an ip datagram (as 191 * opposed to data to be wrapped in a ip datagram). See the README 192 * file that came with the source to this program for a description 193 * of the mods I made to /sys/netinet/raw_ip.c. Your mileage may 194 * vary. But, again, ANY 4.x (x < 4) BSD KERNEL WILL HAVE TO BE 195 * MODIFIED TO RUN THIS PROGRAM. 196 * 197 * The udp port usage may appear bizarre (well, ok, it is bizarre). 198 * The problem is that an icmp message only contains 8 bytes of 199 * data from the original datagram. 8 bytes is the size of a udp 200 * header so, if we want to associate replies with the original 201 * datagram, the necessary information must be encoded into the 202 * udp header (the ip id could be used but there's no way to 203 * interlock with the kernel's assignment of ip id's and, anyway, 204 * it would have taken a lot more kernel hacking to allow this 205 * code to set the ip id). So, to allow two or more users to 206 * use traceroute simultaneously, we use this task's pid as the 207 * source port (the high bit is set to move the port number out 208 * of the "likely" range). To keep track of which probe is being 209 * replied to (so times and/or hop counts don't get confused by a 210 * reply that was delayed in transit), we increment the destination 211 * port number before each probe. 212 * 213 * Don't use this as a coding example. I was trying to find a 214 * routing problem and this code sort-of popped out after 48 hours 215 * without sleep. I was amazed it ever compiled, much less ran. 216 * 217 * I stole the idea for this program from Steve Deering. Since 218 * the first release, I've learned that had I attended the right 219 * IETF working group meetings, I also could have stolen it from Guy 220 * Almes or Matt Mathis. I don't know (or care) who came up with 221 * the idea first. I envy the originators' perspicacity and I'm 222 * glad they didn't keep the idea a secret. 223 * 224 * Tim Seaver, Ken Adelman and C. Philip Wood provided bug fixes and/or 225 * enhancements to the original distribution. 226 * 227 * I've hacked up a round-trip-route version of this that works by 228 * sending a loose-source-routed udp datagram through the destination 229 * back to yourself. Unfortunately, SO many gateways botch source 230 * routing, the thing is almost worthless. Maybe one day... 231 * 232 * -- Van Jacobson (van@helios.ee.lbl.gov) 233 * Tue Dec 20 03:50:13 PST 1988 234 */ 235 236 #include <sys/socket.h> 237 #include <sys/sysctl.h> 238 #include <sys/time.h> 239 #include <sys/uio.h> 240 241 #include <netinet/in.h> 242 #include <netinet/ip.h> 243 #include <netinet/ip6.h> 244 #include <netinet/ip_icmp.h> 245 #include <netinet/icmp6.h> 246 #include <netinet/udp.h> 247 248 #include <arpa/inet.h> 249 250 #include <err.h> 251 #include <errno.h> 252 #include <event.h> 253 #include <limits.h> 254 #include <netdb.h> 255 #include <pwd.h> 256 #include <stdio.h> 257 #include <stdlib.h> 258 #include <string.h> 259 #include <unistd.h> 260 261 #include "traceroute.h" 262 263 int32_t sec_perturb; 264 int32_t usec_perturb; 265 266 u_char packet[512]; 267 u_char *outpacket; /* last inbound (icmp) packet */ 268 269 int rcvsock; /* receive (icmp) socket file descriptor */ 270 int sndsock; /* send (udp) socket file descriptor */ 271 272 int rcvhlim; 273 struct in6_pktinfo *rcvpktinfo; 274 275 int datalen; /* How much data */ 276 277 char *hostname; 278 279 u_int16_t srcport; 280 281 void usage(void); 282 283 #define TRACEROUTE_USER "_traceroute" 284 285 void sock_read(int, short, void *); 286 void send_timer(int, short, void *); 287 288 struct tr_conf *conf; /* configuration defaults */ 289 struct tr_result *tr_results; 290 struct sockaddr_in from4, to4; 291 struct sockaddr_in6 from6, to6; 292 struct sockaddr *from, *to; 293 struct msghdr rcvmhdr; 294 struct event timer_ev; 295 int v6flag; 296 int *waiting_ttls; 297 int last_tos = 0; 298 299 int 300 main(int argc, char *argv[]) 301 { 302 int mib[4] = { CTL_NET, PF_INET, IPPROTO_IP, IPCTL_DEFTTL }; 303 char hbuf[NI_MAXHOST]; 304 305 struct addrinfo hints, *res; 306 struct ip *ip = NULL; 307 struct iovec rcviov[2]; 308 static u_char *rcvcmsgbuf; 309 struct passwd *pw; 310 struct event sock_ev; 311 struct timeval tv = {0, 0}; 312 313 long l; 314 socklen_t len; 315 size_t size; 316 317 int ch; 318 int on = 1; 319 int error; 320 int headerlen; /* How long packet's header is */ 321 int i; 322 int packetlen; 323 int rcvcmsglen; 324 int rcvsock4, rcvsock6; 325 int sndsock4, sndsock6; 326 u_int32_t tmprnd; 327 int v4sock_errno, v6sock_errno; 328 329 char *dest; 330 const char *errstr; 331 332 uid_t ouid, uid; 333 gid_t gid; 334 335 /* Cannot pledge due to special setsockopt()s below */ 336 if (unveil("/", "r") == -1) 337 err(1, "unveil /"); 338 if (unveil(NULL, NULL) == -1) 339 err(1, "unveil"); 340 341 if ((conf = calloc(1, sizeof(*conf))) == NULL) 342 err(1,NULL); 343 344 conf->first_ttl = 1; 345 conf->proto = IPPROTO_UDP; 346 conf->max_ttl = IPDEFTTL; 347 conf->nprobes = 3; 348 conf->expected_responses = 2; /* icmp + DNS */ 349 350 /* start udp dest port # for probe packets */ 351 conf->port = 32768+666; 352 353 memset(&rcvmhdr, 0, sizeof(rcvmhdr)); 354 memset(&rcviov, 0, sizeof(rcviov)); 355 356 rcvsock4 = rcvsock6 = sndsock4 = sndsock6 = -1; 357 v4sock_errno = v6sock_errno = 0; 358 359 conf->waittime = 3 * 1000; 360 361 if ((rcvsock6 = socket(AF_INET6, SOCK_RAW, IPPROTO_ICMPV6)) == -1) 362 v6sock_errno = errno; 363 else if ((sndsock6 = socket(AF_INET6, SOCK_DGRAM, 0)) == -1) 364 v6sock_errno = errno; 365 366 if ((rcvsock4 = socket(AF_INET, SOCK_RAW, IPPROTO_ICMP)) == -1) 367 v4sock_errno = errno; 368 else if ((sndsock4 = socket(AF_INET, SOCK_RAW, IPPROTO_RAW)) == -1) 369 v4sock_errno = errno; 370 371 /* revoke privs */ 372 ouid = getuid(); 373 if (ouid == 0 && (pw = getpwnam(TRACEROUTE_USER)) != NULL) { 374 uid = pw->pw_uid; 375 gid = pw->pw_gid; 376 } else { 377 uid = getuid(); 378 gid = getgid(); 379 } 380 if (ouid && (setgroups(1, &gid) || 381 setresgid(gid, gid, gid) || 382 setresuid(uid, uid, uid))) 383 err(1, "unable to revoke privs"); 384 385 if (strcmp("traceroute6", __progname) == 0) { 386 v6flag = 1; 387 if (v6sock_errno != 0) 388 errc(5, v6sock_errno, rcvsock6 < 0 ? "socket(ICMPv6)" : 389 "socket(SOCK_DGRAM)"); 390 rcvsock = rcvsock6; 391 sndsock = sndsock6; 392 if (rcvsock4 >= 0) 393 close(rcvsock4); 394 if (sndsock4 >= 0) 395 close(sndsock4); 396 } else { 397 if (v4sock_errno != 0) 398 errc(5, v4sock_errno, rcvsock4 < 0 ? "icmp socket" : 399 "raw socket"); 400 rcvsock = rcvsock4; 401 sndsock = sndsock4; 402 if (rcvsock6 >= 0) 403 close(rcvsock6); 404 if (sndsock6 >= 0) 405 close(sndsock6); 406 } 407 408 if (v6flag) { 409 mib[1] = PF_INET6; 410 mib[2] = IPPROTO_IPV6; 411 mib[3] = IPV6CTL_DEFHLIM; 412 /* specify to tell receiving interface */ 413 if (setsockopt(rcvsock, IPPROTO_IPV6, IPV6_RECVPKTINFO, &on, 414 sizeof(on)) == -1) 415 err(1, "setsockopt(IPV6_RECVPKTINFO)"); 416 417 /* specify to tell hoplimit field of received IP6 hdr */ 418 if (setsockopt(rcvsock, IPPROTO_IPV6, IPV6_RECVHOPLIMIT, &on, 419 sizeof(on)) == -1) 420 err(1, "setsockopt(IPV6_RECVHOPLIMIT)"); 421 } 422 423 size = sizeof(i); 424 if (sysctl(mib, sizeof(mib)/sizeof(mib[0]), &i, &size, NULL, 0) == -1) 425 err(1, "sysctl"); 426 conf->max_ttl = i; 427 428 while ((ch = getopt(argc, argv, v6flag ? "ADdf:Ilm:np:q:Ss:t:w:vV:" : 429 "ADdf:g:Ilm:nP:p:q:Ss:t:V:vw:x")) != -1) 430 switch (ch) { 431 case 'A': 432 conf->Aflag = 1; 433 conf->expected_responses++; 434 break; 435 case 'd': 436 conf->dflag = 1; 437 break; 438 case 'D': 439 conf->dump = 1; 440 break; 441 case 'f': 442 conf->first_ttl = strtonum(optarg, 1, conf->max_ttl, 443 &errstr); 444 if (errstr) 445 errx(1, "min ttl must be 1 to %u.", 446 conf->max_ttl); 447 break; 448 case 'g': 449 if (conf->lsrr >= MAX_LSRR) 450 errx(1, "too many gateways; max %d", MAX_LSRR); 451 memset(&hints, 0, sizeof(hints)); 452 hints.ai_family = AF_INET; 453 454 if (getaddrinfo(optarg, NULL, &hints, &res) != 0) 455 errx(1, "unknown host %s", optarg); 456 457 conf->gateway[conf->lsrr] = 458 ((struct sockaddr_in *)res->ai_addr)->sin_addr; 459 freeaddrinfo(res); 460 461 if (++conf->lsrr == 1) 462 conf->lsrrlen = 4; 463 conf->lsrrlen += 4; 464 break; 465 case 'I': 466 if (conf->protoset) 467 errx(1, "protocol already set with -P"); 468 conf->protoset = 1; 469 conf->proto = IPPROTO_ICMP; 470 break; 471 case 'l': 472 conf->ttl_flag = 1; 473 break; 474 case 'm': 475 conf->max_ttl = strtonum(optarg, conf->first_ttl, 476 MAXTTL, &errstr); 477 if (errstr) 478 errx(1, "max ttl must be %u to %u.", 479 conf->first_ttl, MAXTTL); 480 break; 481 case 'n': 482 conf->nflag = 1; 483 conf->expected_responses--; 484 break; 485 case 'p': 486 conf->port = strtonum(optarg, 1, 65535, &errstr); 487 if (errstr) 488 errx(1, "port must be >0, <65536."); 489 break; 490 case 'P': 491 if (conf->protoset) 492 errx(1, "protocol already set with -I"); 493 conf->protoset = 1; 494 conf->proto = strtonum(optarg, 1, IPPROTO_MAX - 1, 495 &errstr); 496 if (errstr) { 497 struct protoent *pent; 498 499 pent = getprotobyname(optarg); 500 if (pent) 501 conf->proto = pent->p_proto; 502 else 503 errx(1, "proto must be >=1, or a " 504 "name."); 505 } 506 break; 507 case 'q': 508 conf->nprobes = strtonum(optarg, 1, 1024, &errstr); 509 if (errstr) 510 errx(1, "nprobes must be >0."); 511 break; 512 case 's': 513 /* 514 * set the ip source address of the outbound 515 * probe (e.g., on a multi-homed host). 516 */ 517 conf->source = optarg; 518 break; 519 case 'S': 520 conf->sump = 1; 521 break; 522 case 't': 523 if (!map_tos(optarg, &conf->tos)) { 524 if (strlen(optarg) > 1 && optarg[0] == '0' && 525 optarg[1] == 'x') { 526 char *ep; 527 errno = 0; 528 ep = NULL; 529 l = strtol(optarg, &ep, 16); 530 if (errno || !*optarg || *ep || 531 l < 0 || l > 255) 532 errx(1, "illegal tos value %s", 533 optarg); 534 conf->tos = (int)l; 535 } else { 536 conf->tos = strtonum(optarg, 0, 255, 537 &errstr); 538 if (errstr) 539 errx(1, "illegal tos value %s", 540 optarg); 541 } 542 } 543 conf->tflag = 1; 544 last_tos = conf->tos; 545 break; 546 case 'v': 547 conf->verbose = 1; 548 break; 549 case 'V': 550 conf->rtableid = (unsigned int)strtonum(optarg, 0, 551 RT_TABLEID_MAX, &errstr); 552 if (errstr) 553 errx(1, "rtable value is %s: %s", 554 errstr, optarg); 555 if (setsockopt(sndsock, SOL_SOCKET, SO_RTABLE, 556 &conf->rtableid, sizeof(conf->rtableid)) == -1) 557 err(1, "setsockopt SO_RTABLE"); 558 if (setsockopt(rcvsock, SOL_SOCKET, SO_RTABLE, 559 &conf->rtableid, sizeof(conf->rtableid)) == -1) 560 err(1, "setsockopt SO_RTABLE"); 561 break; 562 case 'w': 563 conf->waittime = strtonum(optarg, 1, INT_MAX, &errstr); 564 if (errstr) 565 errx(1, "wait must be >=1 sec."); 566 conf->waittime *= 1000; 567 break; 568 case 'x': 569 conf->xflag = 1; 570 break; 571 default: 572 usage(); 573 } 574 575 if (ouid == 0 && (setgroups(1, &gid) || 576 setresgid(gid, gid, gid) || 577 setresuid(uid, uid, uid))) 578 err(1, "unable to revoke privs"); 579 580 argc -= optind; 581 argv += optind; 582 583 if (argc < 1 || argc > 2) 584 usage(); 585 586 tr_results = calloc(sizeof(struct tr_result), conf->max_ttl * 587 conf->nprobes); 588 if (tr_results == NULL) 589 err(1, NULL); 590 591 waiting_ttls = calloc(sizeof(int), conf->max_ttl); 592 for (i = 0; i < conf->max_ttl; i++) 593 waiting_ttls[i] = conf->nprobes * conf->expected_responses; 594 595 setvbuf(stdout, NULL, _IOLBF, 0); 596 597 conf->ident = (getpid() & 0xffff) | 0x8000; 598 tmprnd = arc4random(); 599 sec_perturb = (tmprnd & 0x80000000) ? -(tmprnd & 0x7ff) : 600 (tmprnd & 0x7ff); 601 usec_perturb = arc4random(); 602 603 memset(&to4, 0, sizeof(to4)); 604 memset(&to6, 0, sizeof(to6)); 605 606 dest = *argv; 607 608 memset(&hints, 0, sizeof(hints)); 609 hints.ai_family = v6flag ? PF_INET6 : PF_INET; 610 hints.ai_socktype = SOCK_RAW; 611 hints.ai_protocol = 0; 612 hints.ai_flags = AI_CANONNAME; 613 if ((error = getaddrinfo(dest, NULL, &hints, &res))) 614 errx(1, "%s", gai_strerror(error)); 615 616 switch (res->ai_family) { 617 case AF_INET: 618 to = (struct sockaddr *)&to4; 619 from = (struct sockaddr *)&from4; 620 break; 621 case AF_INET6: 622 to = (struct sockaddr *)&to6; 623 from = (struct sockaddr *)&from6; 624 break; 625 default: 626 errx(1, "unsupported AF: %d", res->ai_family); 627 break; 628 } 629 630 memcpy(to, res->ai_addr, res->ai_addrlen); 631 632 if (!hostname) { 633 hostname = res->ai_canonname ? strdup(res->ai_canonname) : dest; 634 if (!hostname) 635 errx(1, "malloc"); 636 } 637 638 if (res->ai_next) { 639 if (getnameinfo(res->ai_addr, res->ai_addrlen, hbuf, 640 sizeof(hbuf), NULL, 0, NI_NUMERICHOST) != 0) 641 strlcpy(hbuf, "?", sizeof(hbuf)); 642 warnx("Warning: %s has multiple " 643 "addresses; using %s", hostname, hbuf); 644 } 645 freeaddrinfo(res); 646 647 if (*++argv) { 648 datalen = strtonum(*argv, 0, INT_MAX, &errstr); 649 if (errstr) 650 errx(1, "datalen out of range"); 651 } 652 653 switch (to->sa_family) { 654 case AF_INET: 655 switch (conf->proto) { 656 case IPPROTO_UDP: 657 headerlen = (sizeof(struct ip) + conf->lsrrlen + 658 sizeof(struct udphdr) + sizeof(struct packetdata)); 659 break; 660 case IPPROTO_ICMP: 661 headerlen = (sizeof(struct ip) + conf->lsrrlen + 662 sizeof(struct icmp) + sizeof(struct packetdata)); 663 break; 664 default: 665 headerlen = (sizeof(struct ip) + conf->lsrrlen + 666 sizeof(struct packetdata)); 667 } 668 669 if (datalen < 0 || datalen > IP_MAXPACKET - headerlen) 670 errx(1, "packet size must be 0 to %d.", 671 IP_MAXPACKET - headerlen); 672 673 datalen += headerlen; 674 675 if ((outpacket = calloc(1, datalen)) == NULL) 676 err(1, "calloc"); 677 678 rcviov[0].iov_base = (caddr_t)packet; 679 rcviov[0].iov_len = sizeof(packet); 680 rcvmhdr.msg_name = (caddr_t)&from4; 681 rcvmhdr.msg_namelen = sizeof(from4); 682 rcvmhdr.msg_iov = rcviov; 683 rcvmhdr.msg_iovlen = 1; 684 rcvmhdr.msg_control = NULL; 685 rcvmhdr.msg_controllen = 0; 686 687 ip = (struct ip *)outpacket; 688 if (conf->lsrr != 0) { 689 u_char *p = (u_char *)(ip + 1); 690 691 *p++ = IPOPT_NOP; 692 *p++ = IPOPT_LSRR; 693 *p++ = conf->lsrrlen - 1; 694 *p++ = IPOPT_MINOFF; 695 conf->gateway[conf->lsrr] = to4.sin_addr; 696 for (i = 1; i <= conf->lsrr; i++) { 697 memcpy(p, &conf->gateway[i], 698 sizeof(struct in_addr)); 699 p += sizeof(struct in_addr); 700 } 701 ip->ip_dst = conf->gateway[0]; 702 } else 703 ip->ip_dst = to4.sin_addr; 704 ip->ip_off = htons(0); 705 ip->ip_hl = (sizeof(struct ip) + conf->lsrrlen) >> 2; 706 ip->ip_p = conf->proto; 707 ip->ip_v = IPVERSION; 708 ip->ip_tos = conf->tos; 709 710 if (setsockopt(sndsock, IPPROTO_IP, IP_HDRINCL, 711 &on, sizeof(on)) == -1) 712 err(6, "IP_HDRINCL"); 713 714 if (conf->source) { 715 memset(&from4, 0, sizeof(from4)); 716 from4.sin_family = AF_INET; 717 if (inet_pton(AF_INET, conf->source, &from4.sin_addr) 718 != 1) 719 errx(1, "unknown host %s", conf->source); 720 ip->ip_src = from4.sin_addr; 721 if (ouid != 0 && 722 (ntohl(from4.sin_addr.s_addr) & 0xff000000U) == 723 0x7f000000U && (ntohl(to4.sin_addr.s_addr) & 724 0xff000000U) != 0x7f000000U) 725 errx(1, "source is on 127/8, destination is" 726 " not"); 727 if (ouid && bind(sndsock, (struct sockaddr *)&from4, 728 sizeof(from4)) == -1) 729 err(1, "bind"); 730 } 731 packetlen = datalen; 732 break; 733 case AF_INET6: 734 /* 735 * packetlen is the size of the complete IP packet sent and 736 * reported in the first line of output. 737 * For IPv4 this is equal to datalen since we are constructing 738 * a raw packet. 739 * For IPv6 we need to always add the size of the IP6 header 740 * and for UDP packets the size of the UDP header since they 741 * are prepended to the packet by the kernel 742 */ 743 packetlen = sizeof(struct ip6_hdr); 744 switch (conf->proto) { 745 case IPPROTO_UDP: 746 headerlen = sizeof(struct packetdata); 747 packetlen += sizeof(struct udphdr); 748 break; 749 case IPPROTO_ICMP: 750 headerlen = sizeof(struct icmp6_hdr) + 751 sizeof(struct packetdata); 752 break; 753 default: 754 errx(1, "Unsupported proto: %hhu", conf->proto); 755 break; 756 } 757 758 if (datalen < 0 || datalen > IP_MAXPACKET - headerlen) 759 errx(1, "packet size must be 0 to %d.", 760 IP_MAXPACKET - headerlen); 761 762 datalen += headerlen; 763 packetlen += datalen; 764 765 if ((outpacket = calloc(1, datalen)) == NULL) 766 err(1, "calloc"); 767 768 /* initialize msghdr for receiving packets */ 769 rcviov[0].iov_base = (caddr_t)packet; 770 rcviov[0].iov_len = sizeof(packet); 771 rcvmhdr.msg_name = (caddr_t)&from6; 772 rcvmhdr.msg_namelen = sizeof(from6); 773 rcvmhdr.msg_iov = rcviov; 774 rcvmhdr.msg_iovlen = 1; 775 rcvcmsglen = CMSG_SPACE(sizeof(struct in6_pktinfo)) + 776 CMSG_SPACE(sizeof(int)); 777 778 if ((rcvcmsgbuf = malloc(rcvcmsglen)) == NULL) 779 errx(1, "malloc"); 780 rcvmhdr.msg_control = (caddr_t) rcvcmsgbuf; 781 rcvmhdr.msg_controllen = rcvcmsglen; 782 783 /* 784 * Send UDP or ICMP 785 */ 786 if (conf->proto == IPPROTO_ICMP) { 787 close(sndsock); 788 sndsock = rcvsock; 789 } 790 791 /* 792 * Source selection 793 */ 794 memset(&from6, 0, sizeof(from6)); 795 if (conf->source) { 796 memset(&hints, 0, sizeof(hints)); 797 hints.ai_family = AF_INET6; 798 hints.ai_socktype = SOCK_DGRAM; /*dummy*/ 799 hints.ai_flags = AI_NUMERICHOST; 800 if ((error = getaddrinfo(conf->source, "0", &hints, 801 &res))) 802 errx(1, "%s: %s", conf->source, 803 gai_strerror(error)); 804 memcpy(&from6, res->ai_addr, res->ai_addrlen); 805 freeaddrinfo(res); 806 } else { 807 struct sockaddr_in6 nxt; 808 int dummy; 809 810 nxt = to6; 811 nxt.sin6_port = htons(DUMMY_PORT); 812 if ((dummy = socket(AF_INET6, SOCK_DGRAM, 0)) == -1) 813 err(1, "socket"); 814 if (conf->rtableid > 0 && 815 setsockopt(dummy, SOL_SOCKET, SO_RTABLE, 816 &conf->rtableid, sizeof(conf->rtableid)) == -1) 817 err(1, "setsockopt(SO_RTABLE)"); 818 if (connect(dummy, (struct sockaddr *)&nxt, 819 nxt.sin6_len) == -1) 820 err(1, "connect"); 821 len = sizeof(from6); 822 if (getsockname(dummy, (struct sockaddr *)&from6, 823 &len) == -1) 824 err(1, "getsockname"); 825 close(dummy); 826 } 827 828 from6.sin6_port = htons(0); 829 if (bind(sndsock, (struct sockaddr *)&from6, from6.sin6_len) == -1) 830 err(1, "bind sndsock"); 831 832 if (conf->tflag) { 833 if (setsockopt(sndsock, IPPROTO_IPV6, IPV6_TCLASS, 834 &conf->tos, sizeof(conf->tos)) == -1) 835 err(6, "IPV6_TCLASS"); 836 } 837 838 len = sizeof(from6); 839 if (getsockname(sndsock, (struct sockaddr *)&from6, &len) == -1) 840 err(1, "getsockname"); 841 srcport = ntohs(from6.sin6_port); 842 break; 843 default: 844 errx(1, "unsupported AF: %d", to->sa_family); 845 break; 846 } 847 848 if (conf->dflag) { 849 (void) setsockopt(rcvsock, SOL_SOCKET, SO_DEBUG, 850 &on, sizeof(on)); 851 (void) setsockopt(sndsock, SOL_SOCKET, SO_DEBUG, 852 &on, sizeof(on)); 853 } 854 855 if (setsockopt(sndsock, SOL_SOCKET, SO_SNDBUF, 856 &datalen, sizeof(datalen)) == -1) 857 err(6, "SO_SNDBUF"); 858 859 if (conf->nflag && !conf->Aflag) { 860 if (pledge("stdio inet", NULL) == -1) 861 err(1, "pledge"); 862 } else { 863 if (pledge("stdio inet dns", NULL) == -1) 864 err(1, "pledge"); 865 } 866 867 if (getnameinfo(to, to->sa_len, hbuf, 868 sizeof(hbuf), NULL, 0, NI_NUMERICHOST)) 869 strlcpy(hbuf, "(invalid)", sizeof(hbuf)); 870 fprintf(stderr, "%s to %s (%s)", __progname, hostname, hbuf); 871 if (conf->source) 872 fprintf(stderr, " from %s", conf->source); 873 fprintf(stderr, ", %u hops max, %d byte packets\n", conf->max_ttl, 874 packetlen); 875 (void) fflush(stderr); 876 877 if (conf->first_ttl > 1) 878 printf("Skipping %u intermediate hops\n", conf->first_ttl - 1); 879 880 event_init(); 881 882 event_set(&sock_ev, rcvsock, EV_READ | EV_PERSIST, sock_read, NULL); 883 event_add(&sock_ev, NULL); 884 evtimer_set(&timer_ev, send_timer, &timer_ev); 885 evtimer_add(&timer_ev, &tv); 886 event_dispatch(); 887 } 888 889 void 890 usage(void) 891 { 892 if (v6flag) { 893 fprintf(stderr, "usage: %s " 894 "[-ADdIlnSv] [-f first_hop] [-m max_hop] [-p port]\n" 895 "\t[-q nqueries] [-s sourceaddr] [-t toskeyword] [-V rtable] " 896 "[-w waittime]\n\thost [datalen]\n", __progname); 897 } else { 898 fprintf(stderr, 899 "usage: %s [-ADdIlnSvx] [-f first_ttl] [-g gateway_addr] " 900 "[-m max_ttl]\n" 901 "\t[-P proto] [-p port] [-q nqueries] [-s sourceaddr]\n" 902 "\t[-t toskeyword] " 903 "[-V rtable] [-w waittime] host [datalen]\n", 904 __progname); 905 } 906 exit(1); 907 } 908 909 void 910 sock_read(int fd, short events, void *arg) 911 { 912 struct ip *ip; 913 struct timeval t2, tv = {0, 0}; 914 int pkg_ok, cc, recv_seq, recv_seq_row; 915 char hbuf[NI_MAXHOST]; 916 917 cc = recvmsg(rcvsock, &rcvmhdr, 0); 918 919 if (cc == 0) 920 return; 921 922 evtimer_add(&timer_ev, &tv); 923 924 gettime(&t2); 925 926 pkg_ok = packet_ok(conf, to->sa_family, &rcvmhdr, cc, &recv_seq); 927 928 /* Skip wrong packet */ 929 if (pkg_ok == 0) 930 goto out; 931 932 /* skip corrupt sequence number */ 933 if (recv_seq < 0 || recv_seq >= conf->max_ttl * conf->nprobes) 934 goto out; 935 936 recv_seq_row = recv_seq / conf->nprobes; 937 938 /* skipping dup */ 939 if (tr_results[recv_seq].dup++) 940 goto out; 941 942 switch (to->sa_family) { 943 case AF_INET: 944 ip = (struct ip *)packet; 945 946 print(conf, from, cc - (ip->ip_hl << 2), inet_ntop(AF_INET, 947 &ip->ip_dst, hbuf, sizeof(hbuf)), &tr_results[recv_seq]); 948 break; 949 case AF_INET6: 950 print(conf, from, cc, rcvpktinfo ? inet_ntop(AF_INET6, 951 &rcvpktinfo->ipi6_addr, hbuf, sizeof(hbuf)) : "?", 952 &tr_results[recv_seq]); 953 break; 954 default: 955 errx(1, "unsupported AF: %d", to->sa_family); 956 } 957 958 tr_results[recv_seq].t2 = t2; 959 tr_results[recv_seq].resp_ttl = v6flag ? rcvhlim : ip->ip_ttl; 960 961 waiting_ttls[recv_seq_row]--; 962 963 if (pkg_ok == -2) { 964 if ((v6flag && rcvhlim <= 1) || 965 (!v6flag && ip->ip_ttl <=1)) 966 snprintf(tr_results[recv_seq].icmp_code, 967 sizeof(tr_results[recv_seq].icmp_code), "%s", " !"); 968 tr_results[recv_seq].got_there++; 969 } else { 970 if (to->sa_family == AF_INET && conf->tflag) 971 check_tos(ip, &last_tos, &tr_results[recv_seq]); 972 if (pkg_ok != -1) { 973 icmp_code(to->sa_family, pkg_ok - 1, 974 &tr_results[recv_seq].got_there, 975 &tr_results[recv_seq].unreachable, 976 &tr_results[recv_seq]); 977 } 978 } 979 980 if (cc && ((recv_seq + 1) % conf->nprobes) == 0 && 981 (conf->xflag || conf->verbose)) 982 print_exthdr(packet, cc, &tr_results[recv_seq]); 983 out: 984 catchup_result_rows(tr_results, conf); 985 } 986 987 void 988 send_timer(int fd, short events, void *arg) 989 { 990 static int seq; 991 struct timeval tv = {0, 30000}, t1; 992 struct event *ev = arg; 993 int ttl; 994 995 evtimer_add(ev, &tv); 996 997 ttl = conf->first_ttl + seq / conf->nprobes; 998 if (ttl <= conf->max_ttl) { 999 gettime(&t1); 1000 tr_results[seq].seq = seq; 1001 tr_results[seq].row = seq / conf->nprobes; 1002 tr_results[seq].ttl = ttl; 1003 tr_results[seq].t1 = t1; 1004 send_probe(conf, seq, ttl, to); 1005 seq++; 1006 } 1007 1008 catchup_result_rows(tr_results, conf); 1009 1010 } 1011