Firewall UDP Packet Source Port 53 Ruleset Bypass

#!/usr/bin/env bash
# check_udp53_bypass.sh
# Test for UDP source-port-53 firewall ruleset bypass.
# Usage: sudo ./check_udp53_bypass.sh <target_ip_or_name> <udp_port>
# Exit codes:
#   0 = PATCHED (no bypass observed)
#   1 = VULNERABLE (baseline filtered, source-port-53 less filtered)
#   2 = UNKNOWN (inconclusive / prerequisites missing)

set -euo pipefail

if [[ $# -ne 2 ]]; then
  echo "UNKNOWN: usage: sudo $0 <target_ip_or_name> <udp_port>"
  exit 2
fi

TARGET="$1"
PORT="$2"

if ! command -v nmap >/dev/null 2>&1; then
  echo "UNKNOWN: nmap is required"
  exit 2
fi

if [[ "$PORT" =~ ^[0-9]+$ ]] && (( PORT >= 1 && PORT <= 65535 )); then
  :
else
  echo "UNKNOWN: invalid UDP port '$PORT'"
  exit 2
fi

scan_port_state() {
  local extra_args="$1"
  local out state
  out=$(nmap -n -Pn -sU -p "$PORT" --max-retries 1 --host-timeout 30s $extra_args "$TARGET" 2>/dev/null || true)
  state=$(awk -v p="$PORT/udp" '$1==p {print $2}' <<< "$out" | head -n1)
  if [[ -z "$state" ]]; then
    echo "unknown"
  else
    echo "$state"
  fi
}

BASE_STATE=$(scan_port_state "")
SRC53_STATE=$(scan_port_state "-g 53")

echo "Target: $TARGET"
echo "Test UDP port: $PORT"
echo "Baseline state: $BASE_STATE"
echo "Source-port-53 state: $SRC53_STATE"

# Interpretation guidance:
# - If baseline is filtered/open|filtered but source-port-53 becomes open or closed,
#   the firewall likely treated source port 53 specially and the port became reachable.
# - If both are identical, no bypass was observed.
# - If both are open/open|filtered, choose a different UDP port that is EXPECTED to be blocked.

if [[ "$BASE_STATE" == "filtered" || "$BASE_STATE" == "open|filtered" || "$BASE_STATE" == "unknown" ]]; then
  if [[ "$SRC53_STATE" == "open" || "$SRC53_STATE" == "closed" || "$SRC53_STATE" == "unfiltered" ]]; then
    echo "VULNERABLE"
    exit 1
  fi
fi

if [[ "$BASE_STATE" == "$SRC53_STATE" ]]; then
  if [[ "$BASE_STATE" == "open" || "$BASE_STATE" == "closed" ]]; then
    echo "UNKNOWN"
    echo "Note: chosen UDP port may already be reachable without source-port manipulation; pick a port that should be blocked."
    exit 2
  fi
  echo "PATCHED"
  exit 0
fi

echo "UNKNOWN"
echo "Note: results were inconclusive; validate with a protocol-aware UDP service test and packet capture."
exit 2