package com.it_jaros.jscanner; import java.io.IOException; import java.io.InputStream; import java.net.*; import java.nio.charset.StandardCharsets; import java.time.Duration; import java.util.*; import java.util.concurrent.*; import java.util.concurrent.atomic.AtomicBoolean; import java.util.concurrent.atomic.AtomicInteger; import java.util.concurrent.atomic.AtomicLong; import java.util.function.Consumer; import java.util.function.Function; public class Scanner implements AutoCloseable { private static final int READ_BUFFER_SIZE = 1024; private volatile boolean cancelled = false; private final ExecutorService executor = Executors.newVirtualThreadPerTaskExecutor(); private final Semaphore socketLimit; private final boolean bannerRecognition; private final boolean disableOnlineCheck; private final int maxHostsLimit; private final int maxWorkersPerHost; private final int timeoutInMillis; private final long delayInNanos; public Scanner( int socketLimit, int timeoutInMillis, int delayInMillis, int maxWorkersPerHost, int maxHostsLimit, boolean disableOnlineCheck, boolean bannerRecognition ) { this.delayInNanos = TimeUnit.MILLISECONDS.toNanos(Math.max(0, delayInMillis)); this.bannerRecognition = bannerRecognition; this.disableOnlineCheck = disableOnlineCheck; this.maxHostsLimit = maxHostsLimit; this.maxWorkersPerHost = maxWorkersPerHost; this.socketLimit = new Semaphore(socketLimit); this.timeoutInMillis = timeoutInMillis; } public Scanner(ScanOptions options) { this(options.openSocketLimit(), options.timeoutInMillis(), options.delayInMillis(), options.maxWorkersPerHost(), options.maxHostsLimit(), options.disableHostCheck(), options.bannerRecognition()); } /** * Starts a given scan. * * @param scan */ public void runScan(final Scan scan, final Consumer consumer) { if (scan == null) { throw new IllegalArgumentException("Scan argument cannot be null"); } scan.start(); // start producer thread final ProducerState state = startProducer( scan.getHosts().iterator(), maxHostsLimit, host -> () -> { try { scan.getHostCounter().inc(); return scanHostPorts(host, scan); } finally { scan.getHostCounter().dec(); } }, scan.getThreadCounter() ); // the main thread is the consumer // Let the consumer run as long as the producer runs // or if still tasks are pending in pipeline // we do not listen to canceled here because we want // all results (also partial) collected for the consumer // with whatever is there already while (state.running().get() || state.inPipeline().get() > 0) { try { // let's check for results and give add them to our scan data holder object Future finishedHost = state.completionService().poll(10, TimeUnit.MILLISECONDS); if (finishedHost == null) { continue; } // No matter what happens we have to free the resources after getting ScanResult try { ScanResult result = finishedHost.get(); if (result != null) { consumer.accept(result); } } finally { scan.getHostTotalCounter().inc(); scan.getThreadCounter().dec(); state.activeWorkers().release(); state.inPipeline().decrementAndGet(); } } catch (InterruptedException e) { Thread.currentThread().interrupt(); } catch (ExecutionException e) { System.out.printf("%s -> %s%n", e.getClass().getSimpleName(), e.getMessage()); } } scan.stop(); } /** * Scans the ports of a given host * * @param host * @param scan * @return */ private ScanResult scanHostPorts(final String host, final Scan scan) { PortRange portRange = new PortRange(scan.getPorts()); BitSet openPorts = new BitSet(PortRange.MAX_PORT); BitSet filteredPorts = new BitSet(PortRange.MAX_PORT); HashMap serviceTypes = new HashMap<>(); if (!disableOnlineCheck && !checkHostOnline(host)) { // Unreachable host return new ScanResult(host, openPorts, filteredPorts, serviceTypes); } List errors = new ArrayList<>(); final AtomicLong portSlotFactory = new AtomicLong(System.nanoTime()); // producer thread ProducerState state = startProducer( portRange, maxWorkersPerHost, port -> () -> { waitForSlot(portSlotFactory); if (cancelled) return null; return checkPort(host, port, scan); }, scan.getThreadCounter() ); // consumer is the main thread // we run as long as the producer is running or as long as things are in pipeline to be processed // only exception is when cancelled is set while ((state.running().get() || state.inPipeline().get() > 0) && !cancelled) { try { Future portResultFuture = state.completionService().poll(10, TimeUnit.MILLISECONDS); if (portResultFuture == null) { continue; } try { PortResult portResult = portResultFuture.get(); if (portResult == null) continue; switch (portResult.getState()) { case OPEN -> { // bitset is not thread-safe, so it is set // outside the other virtual threads that update progress openPorts.set(portResult.getPort()); serviceTypes.put(portResult.getPort(), ServiceDetector.detect(portResult.getBanner())); } case FILTERED -> { filteredPorts.set(portResult.getPort()); } default -> { // sonarcube glücklich machen } } } finally { scan.getThreadCounter().dec(); state.activeWorkers().release(); state.inPipeline().decrementAndGet(); } } catch (InterruptedException ignored) { Thread.currentThread().interrupt(); } catch (ExecutionException e) { errors.add(e); } } if (!errors.isEmpty()) { System.out.printf("Errors happened during scan of host %s%nErrors:%s -> %s", host, errors.size(), errors); } return new ScanResult(host, openPorts, filteredPorts, serviceTypes); } /** * This method helps to cleanup the code a bit and remove redundancy * The producer for providing hosts and the one for providing ports * are similar and the small differences can be handled using a function * * @param queue * @param maxWorkers * @param taskFactory * @param * @param * @return */ private ProducerState startProducer(Iterator queue, int maxWorkers, Function> taskFactory, Counter threadCounter) { final AtomicInteger inPipeline = new AtomicInteger(0); final AtomicBoolean running = new AtomicBoolean(true); final Semaphore activeWorkers = new Semaphore(maxWorkers); CompletionService completionService = new ExecutorCompletionService<>(executor); executor.submit(() -> { try { threadCounter.inc(); while (queue.hasNext() && !cancelled) { activeWorkers.acquire(); // remember if we submitted anything // so we can release the semaphore boolean submitted = false; try { // just in case something changed while waiting // for the semaphore if (cancelled) { break; } // get next item and create callable // using lambda expression final INPUT item = queue.next(); Callable task = taskFactory.apply(item); inPipeline.incrementAndGet(); threadCounter.inc(); try { // here we are filling the completion service // host <-> virtual thread completionService.submit(task); submitted = true; } catch (Throwable e) { inPipeline.decrementAndGet(); threadCounter.dec(); throw e; } } finally { if (!submitted) { activeWorkers.release(); } } } } catch (InterruptedException e) { Thread.currentThread().interrupt(); } finally { threadCounter.dec(); running.set(false); } }); return new ProducerState<>(running, inPipeline, activeWorkers, completionService); } private boolean checkHostOnline(String host) { try { return InetAddress.getByName(host).isReachable(timeoutInMillis); } catch (IOException e) { // something went wrong } return false; } private void waitForSlot(AtomicLong scanSlotFactory) throws InterruptedException { if (delayInNanos > 0) { long slot = scanSlotFactory.getAndAdd(delayInNanos); long wait = slot - System.nanoTime(); if (wait > 0) Thread.sleep(Duration.ofNanos(wait)); } } private PortResult checkPort(String host, int port, Scan scan) throws InterruptedException { PortResult result = new PortResult(); result.setPort(port); result.setState(PortState.UNKNOWN); // don't allow more sockets then specified socketLimit.acquire(); // count how many ports are concurrently checked scan.getSocketCounter().inc(); try (Socket socket = new Socket()) { socket.connect(new InetSocketAddress(host, port), timeoutInMillis); result.setState(PortState.OPEN); if (bannerRecognition) { result.setBanner(getBanner(socket)); } } catch (SocketTimeoutException ignored) { result.setState(PortState.FILTERED); } catch (ConnectException ignored) { result.setState(PortState.CLOSED); } catch (IOException ignored) { // NoRouteToHostException: this can be safely ignored because the port is closed if a host is unreachable // Will happen a lot when scanning for open ports, so not needed } finally { scan.getSocketCounter().dec(); socketLimit.release(); } return result; } private String getBanner(Socket socket) { byte[] buffer = new byte[READ_BUFFER_SIZE]; try (InputStream input = socket.getInputStream()) { socket.setSoTimeout(timeoutInMillis); int bytesRead = input.read(buffer); if (bytesRead <= 0) { return null; } return new String(buffer, 0, bytesRead, StandardCharsets.UTF_8).trim(); } catch (IOException e) { // we ignore this failure } return null; } public boolean awaitTermination(Duration duration) throws InterruptedException { return executor.awaitTermination(duration.toMillis(), TimeUnit.MILLISECONDS); } public void cancel() { if (!cancelled) { cancelled = true; } executor.shutdown(); } public void cancelNow() { if (!cancelled) { cancelled = true; } executor.shutdownNow(); } @Override public void close() throws Exception { cancel(); } }