diff --git a/osscan2.cc b/osscan2.cc index 78ff04b69..0779d28af 100644 --- a/osscan2.cc +++ b/osscan2.cc @@ -1089,6 +1089,30 @@ void HostOsScanStats::initScanStats() { target->FPR->osscan_opentcpport = openTCPPort; } + /* We should look at a different port if we know that this port is tcpwrapped */ + if (o.servicescan && openTCPPort > 0 && target->ports.isTCPwrapped(openTCPPort)) { + if (o.debugging) { + log_write(LOG_STDOUT, "First choice open TCP port %d is tcpwrapped. ", openTCPPort); + } + /* Keep moving to other ports until we find one which is not tcpwrapped, or until we run out of ports */ + while ((tport = target->ports.nextPort(tport, &port, IPPROTO_TCP, PORT_OPEN))) { + openTCPPort = tport->portno; + if (!target->ports.isTCPwrapped(openTCPPort)) { + break; + } + } + + target->FPR->osscan_opentcpport = openTCPPort; + + if (o.debugging) { + if (target->ports.isTCPwrapped(openTCPPort)) { + log_write(LOG_STDOUT, "All open TCP ports are found to be tcpwrapped. Using %d for OS detection, but results might not be accurate.\n", openTCPPort); + } else { + log_write(LOG_STDOUT, "Using non-tcpwrapped port %d for OS detection.\n", openTCPPort); + } + } + } + /* Now we should find a closed TCP port */ if (target->FPR->osscan_closedtcpport > 0) closedTCPPort = target->FPR->osscan_closedtcpport; diff --git a/portlist.cc b/portlist.cc index 999d3f1ae..0114259ed 100644 --- a/portlist.cc +++ b/portlist.cc @@ -894,6 +894,29 @@ bool PortList::hasOpenPorts() const { getStateCounts(PORT_UNFILTERED) != 0; } +/* Returns true if service scan is done and portno is found to be tcpwrapped, false otherwise */ +bool PortList::isTCPwrapped(u16 portno) const { + const Port *port = lookupPort(portno, IPPROTO_TCP); + if (port == NULL) { + if (o.debugging > 1) { + log_write(LOG_STDOUT, "PortList::isTCPwrapped(%d) requested but port not in list", portno); + } + return false; + } else if (!o.servicescan) { + if (o.debugging > 1) { + log_write(LOG_STDOUT, "PortList::isTCPwrapped(%d) requested but service scan was never asked to be done", portno); + } + return false; + } else if (port->service == NULL) { + if (o.debugging > 1) { + log_write(LOG_STDOUT, "PortList::isTCPwrapped(%d) requested but port has not been service scanned yet", portno); + } + return false; + } else { + return (strcmp(port->service->name,"tcpwrapped")==0); + } +} + int PortList::setStateReason(u16 portno, u8 proto, reason_t reason, u8 ttl, const struct sockaddr_storage *ip_addr) { Port *answer = NULL; diff --git a/portlist.h b/portlist.h index 79ca3e935..9d9feb9fc 100644 --- a/portlist.h +++ b/portlist.h @@ -320,6 +320,9 @@ class PortList { int numPorts() const; bool hasOpenPorts() const; + /* Returns true if service scan is done and portno is found to be tcpwrapped, false otherwise */ + bool isTCPwrapped(u16 portno) const; + private: void mapPort(u16 *portno, u8 *protocol) const; /* Get Port structure from PortList structure.*/