From nobody Wed Sep 30 05:50:55 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hvkg406xvz6tnnb for ; Wed, 30 Sep 2026 05:50:56 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hvkg36DFzz4PMr for ; Wed, 30 Sep 2026 05:50:55 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1790747455; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Du3ZvDAKtKT97Pg10PuT3LxXUHUSYZURK1g8xUppmwY=; b=pRKxV9LiWB4XNDXxCcrU6PQQDS6fcg6tMXvdABgDjaojs0zsESW34DVO6ebyZMpuQUm3Kb GcTZw7hg+lDO0HodgFQ8oGbDxhcSoNs/Ga8RtFzL/UIu/DR0jV03/i8JfQCrGkFJaTEFvC W9PUgCuL/44VmROlXsNne7yas2F/dAo5VgN8E9F4umuayl5j5DRKfw5wnIN/56znNodJ2W QO+GCaCMoSTTlhnwQRuBCNkZ+xeelY6t06s8+0zIyPbyma4cKKvRGPbqnD3QfB9j2iw14U klqmUbJD+kJo5iX+i4ZzzIdxPiqwgNjT6/YJXbojwxGVKpaRtW19XFaMRO3uWg== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1790747455; b=KdG+1ag2KnYaFKzigZgKYegBUzyFbnJRG+XdH8JBl53TnUrOz4g58ePFrE0+IuT8Q4HmK8 biV2cWU0kcIrH03whi89xZ+AAYxfNRyK7UT2yRuK9JrV1vHufvozngqKqEWVKexeEkn9+C VDjlQoR/+jITo6GDNPC8zvxzypGhzhHfMWHlAJ/nxGpqKIE0SAG9lW/iRei7uKjUA+216G eCs0KMCaL0BjBkx9zapsQaG+3YB7Pj7MVyNkqKmIIQU8ZfDPmeL3PexsDAv57IAM79s1D4 8CQQGlufNTAgOt7bzxvyvXhPZNR28T6Vb+cjrlBLjtxu+Eq6San0cau3zstxSg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1790747455; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Du3ZvDAKtKT97Pg10PuT3LxXUHUSYZURK1g8xUppmwY=; b=sZCUgOWu0BujK+CJXnU7fPGCat53r8KHYVnteaFMvWWSkQSqYIm4M9v56zGGh3OVtQ8Pmc fcxhVH8eBrQpIx9EdHMPBXdOzY+kf/hvtoraX8VZ5HK8/QVx9BJJttFzk+Taa9QM73xSzO dis/0pp+KZiwRlzrSnxKUO4MAThR2KxGpGZIa+65D6vEYoSuK0eRcFHyVzZ5VzlVO8XeQ4 g/iOpUvNWFzmfR6DhqKg4nS3prMIu1kjf1ouDAxykcA4mbyNYcMWWvuJR0pt2unul+QvH5 r0+z6qpsvcWfctFt5jnDnlltfo32SeaNw8EqE1TElQOmyjWr044H6ht/OZKL9w== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hvkg35HyrzXkS for ; Wed, 30 Sep 2026 05:50:55 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 42bb0 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Wed, 30 Sep 2026 05:50:55 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Eugene Grosbein Subject: git: 6b3d312f28b2 - stable/14 - traceroute6: MFC: implement firewall evasion mode List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: eugen X-Git-Repository: src X-Git-Refname: refs/heads/stable/14 X-Git-Reftype: branch X-Git-Commit: 6b3d312f28b22280cfb668f35cbfe109ce026a0b Auto-Submitted: auto-generated Date: Wed, 30 Sep 2026 05:50:55 +0000 Message-Id: <6abca33f.42bb0.6c8904e1@gitrepo.freebsd.org> The branch stable/14 has been updated by eugen: URL: https://cgit.FreeBSD.org/src/commit/?id=6b3d312f28b22280cfb668f35cbfe109ce026a0b commit 6b3d312f28b22280cfb668f35cbfe109ce026a0b Author: Eugene Grosbein AuthorDate: 2026-08-16 08:29:20 +0000 Commit: Eugene Grosbein CommitDate: 2026-09-30 05:49:53 +0000 traceroute6: MFC: implement firewall evasion mode Merge implementation of "traceroute -e" to traceroute6 for TCP/UDP/SCTP. (cherry picked from commit f1cfcfb2e51ae5afa8941342ad10f650db8279c5) --- usr.sbin/traceroute6/traceroute6.8 | 8 ++++++-- usr.sbin/traceroute6/traceroute6.c | 28 ++++++++++++++++------------ 2 files changed, 22 insertions(+), 14 deletions(-) diff --git a/usr.sbin/traceroute6/traceroute6.8 b/usr.sbin/traceroute6/traceroute6.8 index 13917eb47c7f..2648b0f42955 100644 --- a/usr.sbin/traceroute6/traceroute6.8 +++ b/usr.sbin/traceroute6/traceroute6.8 @@ -27,7 +27,7 @@ .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF .\" SUCH DAMAGE. .\" -.Dd October 25, 2023 +.Dd August 16, 2026 .Dt TRACEROUTE6 8 .Os .\" @@ -38,7 +38,7 @@ .Sh SYNOPSIS .Nm .Bk -words -.Op Fl adEIlnNrSTUv +.Op Fl adeEIlnNrSTUv .Ek .Bk -words .Op Fl f Ar firsthop @@ -94,6 +94,10 @@ Turn on AS# lookups for each hop encountered. Turn on AS# lookups and use the given server instead of the default. .It Fl d Debug mode. +.It Fl e +Firewall evasion mode. +Use fixed destination ports for UDP, TCP and SCTP probes. +The destination port does NOT increment with each packet sent. .It Fl E Detect ECN bleaching. Set the diff --git a/usr.sbin/traceroute6/traceroute6.c b/usr.sbin/traceroute6/traceroute6.c index f2c1999b6ac5..1d1cd002c474 100644 --- a/usr.sbin/traceroute6/traceroute6.c +++ b/usr.sbin/traceroute6/traceroute6.c @@ -345,6 +345,7 @@ static u_long max_hops = 30; static u_int16_t srcport; static u_int16_t port = 32768 + 666; /* start udp dest port # for probe packets */ static u_int16_t ident; +static int fixedPort = 0; /* Use fixed destination port for TCP/UDP/SCTP */ static int tclass = -1; static int options; /* socket options */ static int verbose; @@ -415,7 +416,7 @@ main(int argc, char *argv[]) seq = 0; ident = htons(getpid() & 0xffff); /* same as ping6 */ - while ((ch = getopt(argc, argv, "aA:dEf:g:Ilm:nNp:q:rs:St:TUvw:")) != -1) + while ((ch = getopt(argc, argv, "aA:deEf:g:Ilm:nNp:q:rs:St:TUvw:")) != -1) switch (ch) { case 'a': as_path = 1; @@ -427,6 +428,9 @@ main(int argc, char *argv[]) case 'd': options |= SO_DEBUG; break; + case 'e': + fixedPort = 1; + break; case 'E': ecnflag = 1; break; @@ -1146,8 +1150,8 @@ send_probe(int seq, u_long hops) break; case IPPROTO_UDP: outudp = (struct udphdr *) outpacket; - outudp->uh_sport = htons(ident); - outudp->uh_dport = htons(port + seq); + outudp->uh_sport = htons(ident + (fixedPort ? seq : 0)); + outudp->uh_dport = htons(port + (fixedPort ? 0 : seq)); outudp->uh_ulen = htons(datalen); outudp->uh_sum = 0; outudp->uh_sum = udp_cksum(&Src, &Dst, outpacket, datalen); @@ -1159,7 +1163,7 @@ send_probe(int seq, u_long hops) sctp = (struct sctphdr *)outpacket; sctp->src_port = htons(ident); - sctp->dest_port = htons(port + seq); + sctp->dest_port = htons(port + (fixedPort ? 0 : seq)); if (datalen >= (u_long)(sizeof(struct sctphdr) + sizeof(struct sctp_init_chunk))) { sctp->v_tag = 0; @@ -1225,7 +1229,7 @@ send_probe(int seq, u_long hops) tcp = (struct tcphdr *)outpacket; tcp->th_sport = htons(ident); - tcp->th_dport = htons(port + seq); + tcp->th_dport = htons(port + (fixedPort ? 0 : seq)); tcp->th_seq = (tcp->th_sport << 16) | tcp->th_dport; tcp->th_ack = 0; tcp->th_off = 5; @@ -1433,14 +1437,14 @@ packet_ok(struct msghdr *mhdr, int cc, int seq, u_char *type, u_char *code, break; case IPPROTO_UDP: udp = (struct udphdr *)up; - if (udp->uh_sport == htons(ident) && - udp->uh_dport == htons(port + seq)) + if (ntohs(udp->uh_sport) == ident + (fixedPort ? seq : 0) && + ntohs(udp->uh_dport) == port + (fixedPort ? 0 : seq)) return (1); break; case IPPROTO_SCTP: sctp = (struct sctphdr *)up; - if (sctp->src_port != htons(ident) || - sctp->dest_port != htons(port + seq)) { + if (ntohs(sctp->src_port) != ident || + ntohs(sctp->dest_port) != port + (fixedPort ? 0 : seq)) { break; } if (datalen >= (u_long)(sizeof(struct sctphdr) + @@ -1467,8 +1471,8 @@ packet_ok(struct msghdr *mhdr, int cc, int seq, u_char *type, u_char *code, break; case IPPROTO_TCP: tcp = (struct tcphdr *)up; - if (tcp->th_sport == htons(ident) && - tcp->th_dport == htons(port + seq) && + if (ntohs(tcp->th_sport) == ident && + ntohs(tcp->th_dport) == port + (fixedPort ? 0 : seq) && tcp->th_seq == (tcp_seq)((tcp->th_sport << 16) | tcp->th_dport)) return (1); @@ -1855,7 +1859,7 @@ usage(void) { fprintf(stderr, -"usage: traceroute6 [-adEIlnNrSTUv] [-A as_server] [-f firsthop] [-g gateway]\n" +"usage: traceroute6 [-adeEIlnNrSTUv] [-A as_server] [-f firsthop] [-g gateway]\n" " [-m hoplimit] [-p port] [-q probes] [-s src] [-w waittime] target\n" " [datalen]\n"); exit(1);