From nobody Sun Aug 16 08:32:59 2026 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hN8Nr3f47z6njM4 for ; Sun, 16 Aug 2026 08:33:00 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hN8Nr1V19z3HnZ for ; Sun, 16 Aug 2026 08:33:00 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1786869180; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=XC//NzEWVFkMl6QqCToyTMrp40TsEcYG8WvqruqCn9U=; b=UPFF+XgTuE+sCi2Hhx5x0Hffh5DKKsVBATNFvZiIe8kzp3HKkBbsjlIhsvjp0kTh6EEaCd ZgAf4u0MrTVac967Y2Fw+HTOx80UdtMKzRtBrsrnTWh5DPRuQJiApMZ+JK7G7gpsALjxgs 0hHoQI/b86+eDyBC3qFDe/jRxk2UQBTf6ZjsWTD+xcLXdrx1jD3uacKc2XrvtWjhT3fuQ5 VvigXUfy+38wjGoYaj1V1XRB1uGirwyT3orkvJ5SK46uJEMutSaTp+/2q0DoaXJHqDn5a3 6ZJVoUY9Tj99Jkfj39exy8OP9Tja/6ACOfRwbAD2Ng9VPojpEod+QeyLixmWaA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1786869180; a=rsa-sha256; cv=none; b=h2UwDC6zjLew3Dm+GPAEgPtG5sB9saoevCgdl/WI3sY89xHrRDITucLTHWIoDOfZCT97OY Kl3eSCIFkh49t/xr1QBizz4qtFuqhjEKSzmCSS0UbEFaHKY/QcZIKsS1OFUUhkJ+6hNmhS HjjdLV/5Ub8pGa9k08KB1Jo7PTfdyerKgYNt1Bk6Gz4oMcK06eebGAp8VjlaxCOg0da8kW mtqq410nhisw0KeJdkrUUrdSyF/qxe61tncjJihd9Xdkxr0Rm9h9XHNYmTMU5AKGsfpoKl Py1jqmasByiHLQ4K3RuTCpbX/5aCIV4578nvdwno+6vPf76u2Ge8FUN6mObKgg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1786869180; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=XC//NzEWVFkMl6QqCToyTMrp40TsEcYG8WvqruqCn9U=; b=gz/VXv8mqeqANv6yITLplyOD4wL+W6IQ3wggWBWijaSRj9O5lGso4zlRd0PtqYrOCzSdMf rszihhEFYN6nSLjawC8eQSFmBkiYGiOq9+dzg2fMGi710OVpSxhkvYuQriAB8Bu/Aiw8Ci OrLc3XheCyD2VLRpq7MeoT860IxAOvBGofK/ykj9Y+T5ucxP4XBUND4xCWfxSa0yGglWAR k4XZ04EbfsbtgaB2ii1xDsdM4dVJ/yA8K0ShQfVHIZnZtoC/0wU406ulRR2mRQD/TbmiwF E9dI/aGiO47GIX0B4NUjsTmwHTWBA8RDMAJn9IOqE0L/WX3Y5DofFhggJEjsxA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hN8Nq6x1jz5Ml for ; Sun, 16 Aug 2026 08:32:59 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 19eff by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Sun, 16 Aug 2026 08:32:59 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Eugene Grosbein Subject: git: f1cfcfb2e51a - main - traceroute6: implement firewall evasion mode List-Id: Commit messages for the main branch of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-main@freebsd.org Sender: owner-dev-commits-src-main@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: eugen X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: f1cfcfb2e51ae5afa8941342ad10f650db8279c5 Auto-Submitted: auto-generated Date: Sun, 16 Aug 2026 08:32:59 +0000 Message-Id: <6a8175bb.19eff.2d84038a@gitrepo.freebsd.org> The branch main has been updated by eugen: URL: https://cgit.FreeBSD.org/src/commit/?id=f1cfcfb2e51ae5afa8941342ad10f650db8279c5 commit f1cfcfb2e51ae5afa8941342ad10f650db8279c5 Author: Eugene Grosbein AuthorDate: 2026-08-16 08:29:20 +0000 Commit: Eugene Grosbein CommitDate: 2026-08-16 08:31:57 +0000 traceroute6: implement firewall evasion mode Merge implementation of "traceroute -e" to traceroute6 for TCP/UDP/SCTP. MFC-after: 2 weeks --- usr.sbin/traceroute6/traceroute6.8 | 8 ++++++-- usr.sbin/traceroute6/traceroute6.c | 28 ++++++++++++++++------------ 2 files changed, 22 insertions(+), 14 deletions(-) diff --git a/usr.sbin/traceroute6/traceroute6.8 b/usr.sbin/traceroute6/traceroute6.8 index 406a96a04424..7c6890d4de6a 100644 --- a/usr.sbin/traceroute6/traceroute6.8 +++ b/usr.sbin/traceroute6/traceroute6.8 @@ -27,7 +27,7 @@ .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF .\" SUCH DAMAGE. .\" -.Dd November 12, 2024 +.Dd August 16, 2026 .Dt TRACEROUTE6 8 .Os .\" @@ -38,7 +38,7 @@ .Sh SYNOPSIS .Nm .Bk -words -.Op Fl adEIlnNrSTUv +.Op Fl adeEIlnNrSTUv .Ek .Bk -words .Op Fl A Ar as_server @@ -92,6 +92,10 @@ Turn on AS# lookups for each hop encountered. Turn on AS# lookups and use the given server instead of the default. .It Fl d Debug mode. +.It Fl e +Firewall evasion mode. +Use fixed destination ports for UDP, TCP and SCTP probes. +The destination port does NOT increment with each packet sent. .It Fl E Detect ECN bleaching. Set the diff --git a/usr.sbin/traceroute6/traceroute6.c b/usr.sbin/traceroute6/traceroute6.c index eb6086706f9f..7b821c11db38 100644 --- a/usr.sbin/traceroute6/traceroute6.c +++ b/usr.sbin/traceroute6/traceroute6.c @@ -333,6 +333,7 @@ static u_long max_hops = 30; static u_int16_t srcport; static u_int16_t port = 32768 + 666; /* start udp dest port # for probe packets */ static u_int16_t ident; +static int fixedPort = 0; /* Use fixed destination port for TCP/UDP/SCTP */ static int tclass = -1; static int options; /* socket options */ static int verbose; @@ -402,7 +403,7 @@ main(int argc, char *argv[]) seq = 0; ident = htons(getpid() & 0xffff); /* same as ping6 */ - while ((ch = getopt(argc, argv, "aA:dEf:g:Ilm:nNp:q:rs:St:TUvw:")) != -1) + while ((ch = getopt(argc, argv, "aA:deEf:g:Ilm:nNp:q:rs:St:TUvw:")) != -1) switch (ch) { case 'a': as_path = 1; @@ -414,6 +415,9 @@ main(int argc, char *argv[]) case 'd': options |= SO_DEBUG; break; + case 'e': + fixedPort = 1; + break; case 'E': ecnflag = 1; break; @@ -1136,8 +1140,8 @@ send_probe(int seq, u_long hops) break; case IPPROTO_UDP: outudp = (struct udphdr *) outpacket; - outudp->uh_sport = htons(ident); - outudp->uh_dport = htons(port + seq); + outudp->uh_sport = htons(ident + (fixedPort ? seq : 0)); + outudp->uh_dport = htons(port + (fixedPort ? 0 : seq)); outudp->uh_ulen = htons(datalen); outudp->uh_sum = 0; outudp->uh_sum = udp_cksum(&Src, &Dst, outpacket, datalen); @@ -1149,7 +1153,7 @@ send_probe(int seq, u_long hops) sctp = (struct sctphdr *)outpacket; sctp->src_port = htons(ident); - sctp->dest_port = htons(port + seq); + sctp->dest_port = htons(port + (fixedPort ? 0 : seq)); if (datalen >= (u_long)(sizeof(struct sctphdr) + sizeof(struct sctp_init_chunk))) { sctp->v_tag = 0; @@ -1215,7 +1219,7 @@ send_probe(int seq, u_long hops) tcp = (struct tcphdr *)outpacket; tcp->th_sport = htons(ident); - tcp->th_dport = htons(port + seq); + tcp->th_dport = htons(port + (fixedPort ? 0 : seq)); tcp->th_seq = (tcp->th_sport << 16) | tcp->th_dport; tcp->th_ack = 0; tcp->th_off = 5; @@ -1423,14 +1427,14 @@ packet_ok(struct msghdr *mhdr, int cc, int seq, u_char *type, u_char *code, break; case IPPROTO_UDP: udp = (struct udphdr *)up; - if (udp->uh_sport == htons(ident) && - udp->uh_dport == htons(port + seq)) + if (ntohs(udp->uh_sport) == ident + (fixedPort ? seq : 0) && + ntohs(udp->uh_dport) == port + (fixedPort ? 0 : seq)) return (1); break; case IPPROTO_SCTP: sctp = (struct sctphdr *)up; - if (sctp->src_port != htons(ident) || - sctp->dest_port != htons(port + seq)) { + if (ntohs(sctp->src_port) != ident || + ntohs(sctp->dest_port) != port + (fixedPort ? 0 : seq)) { break; } if (datalen >= (u_long)(sizeof(struct sctphdr) + @@ -1457,8 +1461,8 @@ packet_ok(struct msghdr *mhdr, int cc, int seq, u_char *type, u_char *code, break; case IPPROTO_TCP: tcp = (struct tcphdr *)up; - if (tcp->th_sport == htons(ident) && - tcp->th_dport == htons(port + seq) && + if (ntohs(tcp->th_sport) == ident && + ntohs(tcp->th_dport) == port + (fixedPort ? 0 : seq) && tcp->th_seq == (tcp_seq)((tcp->th_sport << 16) | tcp->th_dport)) return (1); @@ -1842,7 +1846,7 @@ void usage(void) { fprintf(stderr, -"Usage: traceroute6 [-adEIlnNrSTUv] [-A as_server] [-f firsthop] [-g gateway]\n" +"Usage: traceroute6 [-adeEIlnNrSTUv] [-A as_server] [-f firsthop] [-g gateway]\n" "\t[-m hoplimit] [-p port] [-q probes] [-s src] [-t tclass]\n" "\t[-w waittime] target [datalen]\n"); exit(1);