/***************************************************************************
* This thread spews packets as fast as it can
*
* THIS IS WHERE ALL THE EXCITEMENT HAPPENS!!!!
* 90% of CPU cycles are in the function.
*
***************************************************************************/
static void
transmit_thread(void *v) /*aka. scanning_thread() */
{
struct ThreadPair *parms = (struct ThreadPair *)v;
uint64_t i;
uint64_t start;
uint64_t end;
const struct Masscan *masscan = parms->masscan;
unsigned retries = masscan->retries;
unsigned rate = (unsigned)masscan->max_rate;
unsigned r = retries + 1;
uint64_t range;
struct BlackRock blackrock;
uint64_t count_ips = rangelist_count(&masscan->targets);
struct Throttler *throttler = parms->throttler;
struct TemplateSet *pkt_template = parms->tmplset;
unsigned *picker = parms->picker;
struct Adapter *adapter = parms->adapter;
uint64_t packets_sent = 0;
unsigned increment = masscan->shard.of + masscan->nic_count;
LOG(1, "xmit: starting transmit thread #%u\n", parms->nic_index);
/* Lock this thread to a CPU. Transmit threads are on even CPUs,
* receive threads on odd CPUs */
if (pixie_cpu_get_count() > 1) {
unsigned cpu_count = pixie_cpu_get_count();
unsigned cpu = parms->nic_index * 2;
while (cpu >= cpu_count) {
cpu -= cpu_count;
cpu++;
}
pixie_cpu_set_affinity(cpu);
//pixie_cpu_raise_priority();
}
/* Create the shuffler/randomizer. This creates the 'range' variable,
* which is simply the number of IP addresses times the number of
* ports */
range = rangelist_count(&masscan->targets)
* rangelist_count(&masscan->ports);
blackrock_init(&blackrock, range, masscan->seed);
/* Calculate the 'start' and 'end' of a scan. One reason to do this is
* to support --shard, so that multiple machines can co-operate on
* the same scan. Another reason to do this is so that we can bleed
* a little bit past the end when we have --retries. Yet another
* thing to do here is deal with multiple network adapters, which
* is essentially the same logic as shards. */
start = masscan->resume.index + (masscan->shard.one-1) + parms->nic_index;
end = range;
if (masscan->resume.count && end > start + masscan->resume.count)
end = start + masscan->resume.count;
end += retries * rate;
/* "THROTTLER" rate-limits how fast we transmit, set with the
* --max-rate parameter */
throttler_start(throttler, masscan->max_rate/masscan->nic_count);
/* -----------------
* the main loop
* -----------------*/
LOG(3, "xmit: starting main loop: [%llu..%llu]\n", start, end);
for (i=start; i<end; ) {
uint64_t batch_size;
/*
* Do a batch of many packets at a time. That because per-packet
* throttling is expensive at 10-million pps, so we reduce the
* per-packet cost by doing batches. At slower rates, the batch
* size will always be one. (--max-rate)
*/
batch_size = throttler_next_batch(throttler, packets_sent);
packets_sent += batch_size;
while (batch_size && i < end) {
uint64_t xXx;
unsigned ip;
unsigned port;
/*
* RANDOMIZE THE TARGET:
* This is kinda a tricky bit that picks a random IP and port
* number in order to scan. We monotonically increment the
* index 'i' from [0..range]. We then shuffle (randomly transmog)
* that index into some other, but unique/1-to-1, number in the
* same range. That way we visit all targets, but in a random
* order. Then, once we've shuffled the index, we "pick" the
* the IP address and port that the index refers to.
*/
xXx = (i + (r--) * rate);
while (xXx >= range)
xXx -= range;
xXx = blackrock_shuffle(&blackrock, xXx);
ip = rangelist_pick2(&masscan->targets, xXx % count_ips, picker);
port = rangelist_pick(&masscan->ports, xXx / count_ips);
/*
* SEND THE PROBE
* This is sorta the entire point of the program, but little
* exciting happens here. The thing to note that this may
* be a "raw" transmit that bypasses the kernel, meaning
* we can call this function millions of times a second.
*/
rawsock_send_probe(
adapter,
ip,
port,
syn_hash(ip, port),
!batch_size, /* flush queue on last packet in batch */
pkt_template
);
batch_size--;
foo_count++;
/*
* SEQUENTIALLY INCREMENT THROUGH THE RANGE
* Yea, I know this is a puny 'i++' here, but it's a core feature
* of the system that is linearly increments through the range,
* but produces from that a shuffled sequence of targets (as
* described above). Because we are linearly incrementing this
* number, we can do lots of creative stuff, like doing clever
* retransmits and sharding.
*/
if (r == 0) {
i += increment; /* <------ increment by 1 normally, more with shards/nics */
r = retries + 1;
}
} /* end of batch */
/* Transmit packets from other thread, when doing --banners */
flush_packets(adapter, parms->packet_buffers, parms->transmit_queue,
throttler, &packets_sent);
/* If the user pressed <ctrl-c>, then we need to exit. but, in case
* the user wants to --resume the scan later, we save the current
* state in a file */
if (control_c_pressed) {
break;
}
/* save our current location for resuming, if the user pressed
* <ctrl-c> to exit early */
parms->my_index = i;
}
/*
* We are done transmitting. However, response packets will take several
* seconds to arrive. Therefore, sit in short loop waiting for those
* packets to arrive. Pressing <ctrl-c> a second time will exit this
* prematurely.
*/
while (!control_c_pressed_again) {
unsigned k;
for (k=0; k<1000; k++) {
/* Transmit packets from the receive thread */
flush_packets( adapter,
parms->packet_buffers,
parms->transmit_queue,
throttler,
&packets_sent);
pixie_usleep(1000);
}
}
/* Thread is about to exit */
parms->done_transmitting = 1;
LOG(1, "xmit: stopping transmit thread #%u\n", parms->nic_index);
}
void
main_listscan(struct Masscan *masscan)
{
uint64_t count_ips;
uint64_t count_ports;
uint64_t i;
uint64_t range;
uint64_t start;
uint64_t end;
struct BlackRock blackrock;
unsigned increment = masscan->shard.of;
uint64_t seed = masscan->seed;
count_ports = rangelist_count(&masscan->ports);
if (count_ports == 0)
rangelist_add_range(&masscan->ports, 80, 80);
count_ports = rangelist_count(&masscan->ports);
count_ips = rangelist_count(&masscan->targets);
if (count_ips == 0) {
LOG(0, "FAIL: target IP address list empty\n");
LOG(0, " [hint] try something like \"--range 10.0.0.0/8\"\n");
LOG(0, " [hint] try something like \"--range 192.168.0.100-192.168.0.200\"\n");
return;
}
range = count_ips * count_ports;
infinite:
blackrock_init(&blackrock, range, seed, masscan->blackrock_rounds);
start = masscan->resume.index + (masscan->shard.one-1);
end = range;
if (masscan->resume.count && end > start + masscan->resume.count)
end = start + masscan->resume.count;
end += (uint64_t)(masscan->retries * masscan->max_rate);
//printf("start=%llu, end=%llu\n", start, end);
for (i=start; i<end; ) {
uint64_t xXx;
unsigned ip;
unsigned port;
xXx = blackrock_shuffle(&blackrock, i);
ip = rangelist_pick(&masscan->targets, xXx % count_ips);
port = rangelist_pick(&masscan->ports, xXx / count_ips);
if (count_ports == 1) {
if (masscan->is_test_csv) {
/* [KLUDGE] [TEST]
* For testing randomness output, prints last two bytes of
* IP address as CSV format for import into spreadsheet
*/
printf("%u,%u\n",
(ip>>8)&0xFF, (ip>>0)&0xFF
);
} else {
printf("%u.%u.%u.%u\n",
(ip>>24)&0xFF, (ip>>16)&0xFF, (ip>>8)&0xFF, (ip>>0)&0xFF
);
}
} else