From nobody Wed Sep 30 05:42:50 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hvkTk5jh6z6tn7K for ; Wed, 30 Sep 2026 05:42:50 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hvkTk2WNNz4MYl for ; Wed, 30 Sep 2026 05:42:50 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1790746970; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Vqk3L/Oih6iUzmDXytcF5uMqHbHwTKYGHv2Ad9ehGw8=; b=nIzQ5fekdhPV+RhCZpAzwSBwZNEtJ+Wi74HcrmvSpBZEnV8YGX73/JHyZj6UE+JAlWqOCR 3YgqoSGgfX/gXVItWwmEr/Z3JlBESR/N0LIsB6z3a7WV1hbTSej0FSk/LJIwzzhFStDPzF 77Ou9Ob9ojbOLmVK39R9vFHK1/KWPDBZtX2WfaSpB1OIntm2AJDWrxIrRgKXxU9PJWFpzA 1xR6pD/D8/Bnq99xjUC98iB0Ia3n0J6fBtSVaoD+LyupwfRoeRX7m6Zz9b0Ufkz+3Q6jmw DeDRhzO+lA1BN5MxBBSgHcW/Vnza625V241A7Pse4h274HfralkzGEVmqyTgFg== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1790746970; b=nk3oG+HfpM83Qy7tHW70s1huK8bVgjXi8pnv2wEwVAXe/3i6VOhy0gpSfZSCtNLYc/klAn QRGdvz/brd7LdpyK9khZEJwuGDE9LtYRVjUsMWokpwKZlOYEzWth9z40WxNuC6P39VTmD0 iWgE7yKqlily2M3ojET72DDLp+sUcnyIv7qNE0hSrEZZf31DofB3bKUMX/M25Ou7ARvk4/ 4w9JEI008kec3jmOt/tfTd/T00z+dqqWtuSIkbyXyN/ZDGmMX2m1UIlYvvpr190YRdTEaX r8W36hPgzam0MYUVDsMXpZXCsAFGPR5aqA9QGKZy0XZ3YZ6OhutZqo9oiUxymw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1790746970; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Vqk3L/Oih6iUzmDXytcF5uMqHbHwTKYGHv2Ad9ehGw8=; b=V0ezpWLiRv1BzJfAcYIMMTUeQGwWmyX0bOrtHKcS2sm331/YZDXJ7bsrkbNkJwjuJrmW6K 7DZjiAZP26AZidrEpPmz1EAV646i4MRLLRVLM/HpNPcqGdnT6cTkpZQ+XR61kmbTEu2K+4 g0YF28FVwpgtvk4LY8kKzcRoia90DKJmXduzJ3J+1vx/n+AZGeonZhq3LGNkg2Xux1B54a SwjH9ti1dTCr7DtmRHQVq1q6beKunOrFTn9cATkfsQM6pfpMriDnXNDADhkKDz3Eg+alfh foWmKWRdxJcy/86eeEMpCjy/jwQLzNIKW7AYVtXnXStJet8zkiKP/4S5mJycCQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hvkTk1ZpxzXkK for ; Wed, 30 Sep 2026 05:42:50 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 400f7 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Wed, 30 Sep 2026 05:42:50 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Eugene Grosbein Subject: git: 42f9573827e9 - stable/15 - traceroute6: MFC: implement firewall evasion mode List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: eugen X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 42f9573827e9642410c4c99e42549ee7a1beca00 Auto-Submitted: auto-generated Date: Wed, 30 Sep 2026 05:42:50 +0000 Message-Id: <6abca15a.400f7.79d032ad@gitrepo.freebsd.org> The branch stable/15 has been updated by eugen: URL: https://cgit.FreeBSD.org/src/commit/?id=42f9573827e9642410c4c99e42549ee7a1beca00 commit 42f9573827e9642410c4c99e42549ee7a1beca00 Author: Eugene Grosbein AuthorDate: 2026-08-16 08:29:20 +0000 Commit: Eugene Grosbein CommitDate: 2026-09-30 05:40:13 +0000 traceroute6: MFC: implement firewall evasion mode Merge implementation of "traceroute -e" to traceroute6 for TCP/UDP/SCTP. (cherry picked from commit f1cfcfb2e51ae5afa8941342ad10f650db8279c5) --- usr.sbin/traceroute6/traceroute6.8 | 8 ++++++-- usr.sbin/traceroute6/traceroute6.c | 28 ++++++++++++++++------------ 2 files changed, 22 insertions(+), 14 deletions(-) diff --git a/usr.sbin/traceroute6/traceroute6.8 b/usr.sbin/traceroute6/traceroute6.8 index 406a96a04424..7c6890d4de6a 100644 --- a/usr.sbin/traceroute6/traceroute6.8 +++ b/usr.sbin/traceroute6/traceroute6.8 @@ -27,7 +27,7 @@ .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF .\" SUCH DAMAGE. .\" -.Dd November 12, 2024 +.Dd August 16, 2026 .Dt TRACEROUTE6 8 .Os .\" @@ -38,7 +38,7 @@ .Sh SYNOPSIS .Nm .Bk -words -.Op Fl adEIlnNrSTUv +.Op Fl adeEIlnNrSTUv .Ek .Bk -words .Op Fl A Ar as_server @@ -92,6 +92,10 @@ Turn on AS# lookups for each hop encountered. Turn on AS# lookups and use the given server instead of the default. .It Fl d Debug mode. +.It Fl e +Firewall evasion mode. +Use fixed destination ports for UDP, TCP and SCTP probes. +The destination port does NOT increment with each packet sent. .It Fl E Detect ECN bleaching. Set the diff --git a/usr.sbin/traceroute6/traceroute6.c b/usr.sbin/traceroute6/traceroute6.c index eb6086706f9f..7b821c11db38 100644 --- a/usr.sbin/traceroute6/traceroute6.c +++ b/usr.sbin/traceroute6/traceroute6.c @@ -333,6 +333,7 @@ static u_long max_hops = 30; static u_int16_t srcport; static u_int16_t port = 32768 + 666; /* start udp dest port # for probe packets */ static u_int16_t ident; +static int fixedPort = 0; /* Use fixed destination port for TCP/UDP/SCTP */ static int tclass = -1; static int options; /* socket options */ static int verbose; @@ -402,7 +403,7 @@ main(int argc, char *argv[]) seq = 0; ident = htons(getpid() & 0xffff); /* same as ping6 */ - while ((ch = getopt(argc, argv, "aA:dEf:g:Ilm:nNp:q:rs:St:TUvw:")) != -1) + while ((ch = getopt(argc, argv, "aA:deEf:g:Ilm:nNp:q:rs:St:TUvw:")) != -1) switch (ch) { case 'a': as_path = 1; @@ -414,6 +415,9 @@ main(int argc, char *argv[]) case 'd': options |= SO_DEBUG; break; + case 'e': + fixedPort = 1; + break; case 'E': ecnflag = 1; break; @@ -1136,8 +1140,8 @@ send_probe(int seq, u_long hops) break; case IPPROTO_UDP: outudp = (struct udphdr *) outpacket; - outudp->uh_sport = htons(ident); - outudp->uh_dport = htons(port + seq); + outudp->uh_sport = htons(ident + (fixedPort ? seq : 0)); + outudp->uh_dport = htons(port + (fixedPort ? 0 : seq)); outudp->uh_ulen = htons(datalen); outudp->uh_sum = 0; outudp->uh_sum = udp_cksum(&Src, &Dst, outpacket, datalen); @@ -1149,7 +1153,7 @@ send_probe(int seq, u_long hops) sctp = (struct sctphdr *)outpacket; sctp->src_port = htons(ident); - sctp->dest_port = htons(port + seq); + sctp->dest_port = htons(port + (fixedPort ? 0 : seq)); if (datalen >= (u_long)(sizeof(struct sctphdr) + sizeof(struct sctp_init_chunk))) { sctp->v_tag = 0; @@ -1215,7 +1219,7 @@ send_probe(int seq, u_long hops) tcp = (struct tcphdr *)outpacket; tcp->th_sport = htons(ident); - tcp->th_dport = htons(port + seq); + tcp->th_dport = htons(port + (fixedPort ? 0 : seq)); tcp->th_seq = (tcp->th_sport << 16) | tcp->th_dport; tcp->th_ack = 0; tcp->th_off = 5; @@ -1423,14 +1427,14 @@ packet_ok(struct msghdr *mhdr, int cc, int seq, u_char *type, u_char *code, break; case IPPROTO_UDP: udp = (struct udphdr *)up; - if (udp->uh_sport == htons(ident) && - udp->uh_dport == htons(port + seq)) + if (ntohs(udp->uh_sport) == ident + (fixedPort ? seq : 0) && + ntohs(udp->uh_dport) == port + (fixedPort ? 0 : seq)) return (1); break; case IPPROTO_SCTP: sctp = (struct sctphdr *)up; - if (sctp->src_port != htons(ident) || - sctp->dest_port != htons(port + seq)) { + if (ntohs(sctp->src_port) != ident || + ntohs(sctp->dest_port) != port + (fixedPort ? 0 : seq)) { break; } if (datalen >= (u_long)(sizeof(struct sctphdr) + @@ -1457,8 +1461,8 @@ packet_ok(struct msghdr *mhdr, int cc, int seq, u_char *type, u_char *code, break; case IPPROTO_TCP: tcp = (struct tcphdr *)up; - if (tcp->th_sport == htons(ident) && - tcp->th_dport == htons(port + seq) && + if (ntohs(tcp->th_sport) == ident && + ntohs(tcp->th_dport) == port + (fixedPort ? 0 : seq) && tcp->th_seq == (tcp_seq)((tcp->th_sport << 16) | tcp->th_dport)) return (1); @@ -1842,7 +1846,7 @@ void usage(void) { fprintf(stderr, -"Usage: traceroute6 [-adEIlnNrSTUv] [-A as_server] [-f firsthop] [-g gateway]\n" +"Usage: traceroute6 [-adeEIlnNrSTUv] [-A as_server] [-f firsthop] [-g gateway]\n" "\t[-m hoplimit] [-p port] [-q probes] [-s src] [-t tclass]\n" "\t[-w waittime] target [datalen]\n"); exit(1);