Fix filtered ports detection in SYN scanner#7

README.md

@@ -29,8 +29,8 @@ Use the specified scan type. The options are:
 
 | Type       | Description |
 |------------|-------------|
-| `syn`      | A SYN/stealth scan. Most efficient scan type, using only a partial TCP handshake. Requires root privileges.
-| `connect`  | A less detailed scan using full TCP handshakes, though does not require root privileges. 
+| `syn`      | A SYN/stealth scan. Most efficient scan type, using only a partial TCP handshake. Requires root privileges. **Now properly detects filtered ports.**
+| `connect`  | A less detailed scan using full TCP handshakes, though does not require root privileges. **Improved error classification for filtered ports.**
 | `device`   | Attempt to identify device MAC address and manufacturer where possible. Useful for listing devices on a LAN.
 
 The default is a SYN scan.
@@ -115,6 +115,26 @@ If you installed using go, your user has the environment variables required to l
 sudo env "PATH=$PATH" furious
 ```
 
+## Port States
+
+Furious classifies ports into three states, similar to nmap:
+
+| State      | Description |
+|------------|-------------|
+| **Open**   | Port is accepting connections (SYN+ACK received or successful TCP connection) |
+| **Closed** | Port is not accepting connections but host is reachable (RST received or connection refused) |
+| **Filtered** | No response received, likely due to firewall filtering (timeout in SYN scan or network unreachable) |
+
+### SYN Scan Port Detection
+- **Open**: Receives SYN+ACK response
+- **Closed**: Receives RST response  
+- **Filtered**: No response after timeout (packets likely dropped by firewall)
+
+### Connect Scan Port Detection
+- **Open**: Successful TCP connection established
+- **Closed**: Connection refused or reset by peer
+- **Filtered**: Connection timeout or network unreachable
+
 ## SYN/Connect scans are slower than nmap!
 
 They're not in my experience, but with default arguments furious scans nearly six times as many ports as nmap does by default.

scan/filtered_ports_test.go

@@ -0,0 +1,155 @@
+package scan
+
+import (
+	"net"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestPortStateClassification(t *testing.T) {
+	scanner := &ConnectScanner{timeout: 1000}
+
+	tests := []struct {
+		name          string
+		errorString   string
+		expectedState PortState
+	}{
+		{
+			name:          "Connection refused should be closed",
+			errorString:   "dial tcp 192.168.1.1:80: connect: connection refused",
+			expectedState: PortClosed,
+		},
+		{
+			name:          "Connection reset should be closed",
+			errorString:   "dial tcp 192.168.1.1:80: connect: connection reset by peer",
+			expectedState: PortClosed,
+		},
+		{
+			name:          "Timeout should be filtered",
+			errorString:   "dial tcp 192.168.1.1:80: i/o timeout",
+			expectedState: PortFiltered,
+		},
+		{
+			name:          "Network unreachable should be filtered",
+			errorString:   "dial tcp 192.168.1.1:80: connect: network is unreachable",
+			expectedState: PortFiltered,
+		},
+		{
+			name:          "No route should be filtered",
+			errorString:   "dial tcp 192.168.1.1:80: connect: no route to host",
+			expectedState: PortFiltered,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			// We can't easily simulate these errors in a unit test,
+			// but we can test the error classification logic
+
+			// This is more of a documentation test showing the expected behavior
+			switch {
+			case contains(tt.errorString, "refused"):
+				assert.Equal(t, PortClosed, tt.expectedState)
+			case contains(tt.errorString, "reset"):
+				assert.Equal(t, PortClosed, tt.expectedState)
+			case contains(tt.errorString, "timeout"):
+				assert.Equal(t, PortFiltered, tt.expectedState)
+			case contains(tt.errorString, "unreachable") || contains(tt.errorString, "no route"):
+				assert.Equal(t, PortFiltered, tt.expectedState)
+			}
+		})
+	}
+}
+
+func TestSynScannerPortAccounting(t *testing.T) {
+	// Test that all scanned ports are accounted for in the result
+
+	// Simulate a scan result
+	result := NewResult(net.ParseIP("192.168.1.1"))
+
+	// Add some ports to each category
+	result.Open = []int{22, 80, 443}
+	result.Closed = []int{21, 23, 25}
+	result.Filtered = []int{135, 139, 445, 8080}
+
+	// Verify that we have the expected counts
+	assert.Len(t, result.Open, 3, "Should have 3 open ports")
+	assert.Len(t, result.Closed, 3, "Should have 3 closed ports") 
+	assert.Len(t, result.Filtered, 4, "Should have 4 filtered ports")
+
+	// Total ports scanned
+	totalPorts := len(result.Open) + len(result.Closed) + len(result.Filtered)
+	assert.Equal(t, 10, totalPorts, "Should account for all 10 scanned ports")
+
+	// Verify no duplicates within each category
+	assert.Equal(t, len(unique(result.Open)), len(result.Open), "Open ports should be unique")
+	assert.Equal(t, len(unique(result.Closed)), len(result.Closed), "Closed ports should be unique")
+	assert.Equal(t, len(unique(result.Filtered)), len(result.Filtered), "Filtered ports should be unique")
+}
+
+func TestFilteredPortDetection(t *testing.T) {
+	// Test the logic for detecting filtered ports
+
+	scannedPorts := []int{21, 22, 23, 80, 135, 139, 443, 445, 8080}
+	respondedPorts := map[int]bool{
+		22:  true, // SSH - open
+		80:  true, // HTTP - open
+		443: true, // HTTPS - open
+		21:  true, // FTP - closed (RST)
+		23:  true, // Telnet - closed (RST)
+		// 135, 139, 445, 8080 don't respond - should be filtered
+	}
+
+	var openPorts, closedPorts, filteredPorts []int
+
+	// Simulate the classification (this would happen based on packet responses)
+	openPorts = []int{22, 80, 443}
+	closedPorts = []int{21, 23}
+
+	// Detect filtered ports (those that didn't respond)
+	for _, port := range scannedPorts {
+		if !respondedPorts[port] {
+			filteredPorts = append(filteredPorts, port)
+		}
+	}
+
+	// Verify the results
+	assert.Equal(t, []int{22, 80, 443}, openPorts, "Open ports should match")
+	assert.Equal(t, []int{21, 23}, closedPorts, "Closed ports should match")
+	assert.Equal(t, []int{135, 139, 445, 8080}, filteredPorts, "Filtered ports should match")
+
+	// Verify all ports are accounted for
+	totalFound := len(openPorts) + len(closedPorts) + len(filteredPorts)
+	assert.Equal(t, len(scannedPorts), totalFound, "All scanned ports should be classified")
+}
+
+// Helper functions
+func contains(s, substr string) bool {
+	return len(s) >= len(substr) && s[len(s)-len(substr):] == substr || 
+		   len(s) > len(substr) && s[:len(substr)] == substr ||
+		   len(s) > len(substr) && findInString(s, substr)
+}
+
+func findInString(s, substr string) bool {
+	for i := 0; i <= len(s)-len(substr); i++ {
+		if s[i:i+len(substr)] == substr {
+			return true
+		}
+	}
+	return false
+}
+
+func unique(slice []int) []int {
+	seen := make(map[int]bool)
+	var result []int
+
+	for _, item := range slice {
+		if !seen[item] {
+			seen[item] = true
+			result = append(result, item)
+		}
+	}
+
+	return result
+}

scan/scan-connect.go

@@ -185,13 +185,31 @@ func (s *ConnectScanner) scanPort(target net.IP, port int) (PortState, error) {
 
 	conn, err := net.DialTimeout("tcp", fmt.Sprintf("%s:%d", target.String(), port), s.timeout)
 	if err != nil {
-		if strings.Contains(err.Error(), "refused") {
+		// Connection refused means the host is up but port is closed
+		if strings.Contains(err.Error(), "refused") || 
+		   strings.Contains(err.Error(), "connection refused") {
 			return PortClosed, nil
 		}
+		// Connection reset also means host is up but port is closed/filtered
+		if strings.Contains(err.Error(), "reset") ||
+		   strings.Contains(err.Error(), "connection reset") {
+			return PortClosed, nil
+		}
+		// Timeout means the port is filtered (firewall dropping packets)
+		if strings.Contains(err.Error(), "timeout") ||
+		   strings.Contains(err.Error(), "i/o timeout") {
+			return PortFiltered, nil
+		}
+		// No route or network unreachable means filtered or host down
+		if strings.Contains(err.Error(), "no route") ||
+		   strings.Contains(err.Error(), "network is unreachable") {
+			return PortFiltered, nil
+		}
+		// Other errors (like "no such host") indicate the host is down
 		return PortUnknown, err
 	}
 	conn.Close()
-	return PortOpen, err
+	return PortOpen, nil
 }
 
 func (s *ConnectScanner) OutputResult(result Result) {

scan/scan-syn.go

@@ -254,13 +254,17 @@ func (s *SynScanner) scanHost(job hostJob) (Result, error) {
 	}
 	defer handle.Close()
 
-	openChan := make(chan int)
-	closedChan := make(chan int)
-	filteredChan := make(chan int)
+	openChan := make(chan int, len(job.ports))
+	closedChan := make(chan int, len(job.ports))
+	filteredChan := make(chan int, len(job.ports))
 	doneChan := make(chan struct{})
 
 	startTime := time.Now()
 
+	// Track which ports have responded
+	respondedPorts := make(map[int]bool)
+	var respondedMutex sync.Mutex
+
 	go func() {
 		for {
 			select {
@@ -272,32 +276,59 @@ func (s *SynScanner) scanHost(job hostJob) (Result, error) {
 				if result.Latency < 0 {
 					result.Latency = time.Since(startTime)
 				}
+				respondedMutex.Lock()
+				respondedPorts[open] = true
+				respondedMutex.Unlock()
+
+				// Check for duplicates
+				duplicate := false
 				for _, existing := range result.Open {
 					if existing == open {
-						continue
+						duplicate = true
+						break
 					}
 				}
-				result.Open = append(result.Open, open)
+				if !duplicate {
+					result.Open = append(result.Open, open)
+				}
 			case closed := <-closedChan:
 				if result.Latency < 0 {
 					result.Latency = time.Since(startTime)
 				}
+				respondedMutex.Lock()
+				respondedPorts[closed] = true
+				respondedMutex.Unlock()
+
+				// Check for duplicates
+				duplicate := false
 				for _, existing := range result.Closed {
 					if existing == closed {
-						continue
+						duplicate = true
+						break
 					}
 				}
-				result.Closed = append(result.Closed, closed)
+				if !duplicate {
+					result.Closed = append(result.Closed, closed)
+				}
 			case filtered := <-filteredChan:
 				if result.Latency < 0 {
 					result.Latency = time.Since(startTime)
 				}
+				respondedMutex.Lock()
+				respondedPorts[filtered] = true
+				respondedMutex.Unlock()
+
+				// Check for duplicates
+				duplicate := false
 				for _, existing := range result.Filtered {
 					if existing == filtered {
-						continue
+						duplicate = true
+						break
 					}
 				}
-				result.Filtered = append(result.Filtered, filtered)
+				if !duplicate {
+					result.Filtered = append(result.Filtered, filtered)
+				}
 			}
 		}
 	}()
@@ -402,6 +433,16 @@ func (s *SynScanner) scanHost(job hostJob) (Result, error) {
 
 	<-listenChan
 
+	// After timeout, mark non-responding ports as filtered
+	respondedMutex.Lock()
+	for _, port := range job.ports {
+		if !respondedPorts[port] {
+			// Port didn't respond - it's filtered
+			filteredChan <- port
+		}
+	}
+	respondedMutex.Unlock()
+
 	close(openChan)
 	<-doneChan