PenTest/nmap
1
0
Fork 0
mirror of https://github.com/nmap/nmap.git synced 2025-12-14 19:59:02 +00:00
Code Issues Projects Releases Wiki Activity

Spellcheck on Nmap, Nsock, Nbase source files

Browse Source
This commit is contained in:
dmiller
2014-02-20 18:44:12 +00:00
parent b8873f42cd
commit 3f0d0c16f9
52 changed files with 145 additions and 145 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
FPEngine.cc
View File

@@ -511,7 +511,7 @@ void FPNetworkControl::response_reception_handler(nsock_pool nsp, nsock_event ns
enum nse_status status = nse_status(nse); enum nse_status status = nse_status(nse);
enum nse_type type = nse_type(nse); enum nse_type type = nse_type(nse);
const u8 *rcvd_pkt = NULL; /* Points to the captured packet */ const u8 *rcvd_pkt = NULL; /* Points to the captured packet */
size_t rcvd_pkt_len = 0; /* Lenght of the captured packet */ size_t rcvd_pkt_len = 0; /* Length of the captured packet */
struct timeval pcaptime; /* Time the packet was captured */ struct timeval pcaptime; /* Time the packet was captured */
struct sockaddr_storage sent_ss; struct sockaddr_storage sent_ss;
struct sockaddr_storage rcvd_ss; struct sockaddr_storage rcvd_ss;
@@ -1240,7 +1240,7 @@ void FPHost::__reset() {
/* Returns the IP address of the target associated with the FPHost in /* Returns the IP address of the target associated with the FPHost in
* stuct sockaddr_storage format. */ * struct sockaddr_storage format. */
const struct sockaddr_storage *FPHost::getTargetAddress() { const struct sockaddr_storage *FPHost::getTargetAddress() {
return this->target_host->TargetSockAddr(); return this->target_host->TargetSockAddr();
} }
@@ -1253,7 +1253,7 @@ const struct sockaddr_storage *FPHost::getTargetAddress() {
* - A closed TCP port. * - A closed TCP port.
* - A closed UDP port. * - A closed UDP port.
* *
* When not enough information is found in the Target, the neccessary port * When not enough information is found in the Target, the necessary port
* numbers are generated randomly. */ * numbers are generated randomly. */
int FPHost::choose_osscan_ports() { int FPHost::choose_osscan_ports() {
Port *tport = NULL; Port *tport = NULL;
@@ -1356,7 +1356,7 @@ int FPHost::update_RTO(int measured_rtt_usecs, bool retransmission) {
if (this->srtt == -1 && this->rttvar == -1) { if (this->srtt == -1 && this->rttvar == -1) {
this->srtt = measured_rtt_usecs; this->srtt = measured_rtt_usecs;
this->rttvar = measured_rtt_usecs/2; this->rttvar = measured_rtt_usecs/2;
this->rto = this->srtt + MAX(500000, 4*this->rttvar); /* Asume a granularity of 1/2 sec */ this->rto = this->srtt + MAX(500000, 4*this->rttvar); /* Assume a granularity of 1/2 sec */
} else { } else {
/* RFC 2988: When a subsequent RTT measurement R' is made, a host MUST set /* RFC 2988: When a subsequent RTT measurement R' is made, a host MUST set
@@ -1424,7 +1424,7 @@ void FPHost6::init(Target *tgt, FPNetworkControl *fpnc) {
this->target_host->FPR = new FingerPrintResultsIPv6; this->target_host->FPR = new FingerPrintResultsIPv6;
this->target_host->osscanSetFlag(OS_PERF); this->target_host->osscanSetFlag(OS_PERF);
/* Choose TCP/UDP ports for the prbes. */ /* Choose TCP/UDP ports for the probes. */
this->choose_osscan_ports(); this->choose_osscan_ports();
/* Build the list of OS detection probes */ /* Build the list of OS detection probes */
@@ -2537,7 +2537,7 @@ void FPProbe::reset() {
free(this->probe_id); free(this->probe_id);
this->probe_id = NULL; this->probe_id = NULL;
/* Also call FPPacket::__reset() to free any exising packet information */ /* Also call FPPacket::__reset() to free any existing packet information */
this->__reset(); this->__reset();
} }
@@ -2586,7 +2586,7 @@ int FPProbe::incrementRetransmissions() {
/* Returns the number of times the probe has been replied. This applies for /* Returns the number of times the probe has been replied. This applies for
* timed probes, which may be retransmitted even if we got a reply (becase * timed probes, which may be retransmitted even if we got a reply (because
* another timed probe timeout and we had to retransmit all of them to keep * another timed probe timeout and we had to retransmit all of them to keep
* the timing accurate). */ * the timing accurate). */
int FPProbe::getReplies() const { int FPProbe::getReplies() const {

2
FPEngine.h
View File

@@ -429,7 +429,7 @@ class FPHost {
}; };
/* This class represents IPv6 hosts to be fingerprinted. The class performs /* This class represents IPv6 hosts to be fingerprinted. The class performs
* OS detection asynchronously. To use it, shedule() must be called at regular * OS detection asynchronously. To use it, schedule() must be called at regular
* intervals until done() returns true. After that, status() will indicate * intervals until done() returns true. After that, status() will indicate
* whether the host was successfully matched with a particular OS or not. */ * whether the host was successfully matched with a particular OS or not. */
class FPHost6 : public FPHost { class FPHost6 : public FPHost {

2
FingerPrintResults.cc
View File

@@ -313,7 +313,7 @@ static bool strnulleq(const char *s, const char *t) {
return strcmp(s, t) == 0; return strcmp(s, t) == 0;
} }
// Go through any previously enterted classes to see if this is a dupe; // Go through any previously entered classes to see if this is a dupe;
bool FingerPrintResults::classAlreadyExistsInResults(struct OS_Classification *OSC) { bool FingerPrintResults::classAlreadyExistsInResults(struct OS_Classification *OSC) {
int i; int i;

8
FingerPrintResults.h
View File

@@ -166,11 +166,11 @@ class FingerPrintResults {
returned */ returned */
const struct OS_Classification_Results *getOSClassification(); const struct OS_Classification_Results *getOSClassification();
int osscan_opentcpport; /* Open TCP port used for scannig (if one found -- int osscan_opentcpport; /* Open TCP port used for scanning (if one found --
otherwise -1) */ otherwise -1) */
int osscan_closedtcpport; /* Closed TCP port used for scannig (if one found -- int osscan_closedtcpport; /* Closed TCP port used for scanning (if one found --
otherwise -1) */ otherwise -1) */
int osscan_closedudpport; /* Closed UDP port used for scannig (if one found -- int osscan_closedudpport; /* Closed UDP port used for scanning (if one found --
otherwise -1) */ otherwise -1) */
int distance; /* How "far" is this FP gotten from? */ int distance; /* How "far" is this FP gotten from? */
int distance_guess; /* How "far" is this FP gotten from? by guessing based on ttl. */ int distance_guess; /* How "far" is this FP gotten from? by guessing based on ttl. */
@@ -179,7 +179,7 @@ class FingerPrintResults {
between sending 1st tseq probe and sending first ICMP echo probe. between sending 1st tseq probe and sending first ICMP echo probe.
Zero means we didn't see any ratios (the tseq probes weren't Zero means we didn't see any ratios (the tseq probes weren't
sent), 1 is ideal, and larger values are undesirable from a sent), 1 is ideal, and larger values are undesirable from a
consistancy standpoint. */ consistency standpoint. */
double maxTimingRatio; double maxTimingRatio;
/* If the fingerprint is of potentially poor quality, we don't want to /* If the fingerprint is of potentially poor quality, we don't want to

2
MACLookup.cc
View File

@@ -227,7 +227,7 @@ const char *MACPrefix2Corp(const u8 *prefix) {
contains that string. Sets the first three bytes in mac_data and contains that string. Sets the first three bytes in mac_data and
returns true for the first matching entry found. If no entries returns true for the first matching entry found. If no entries
match, leaves mac_data untouched and returns false. Note that this match, leaves mac_data untouched and returns false. Note that this
is not particularly efficient and so should be rewriteen if it is is not particularly efficient and so should be rewritten if it is
called often */ called often */
bool MACCorp2Prefix(const char *vendorstr, u8 *mac_data) { bool MACCorp2Prefix(const char *vendorstr, u8 *mac_data) {
std::map<int, char *>::iterator i; std::map<int, char *>::iterator i;

2
MACLookup.h
View File

@@ -140,7 +140,7 @@ const char *MACPrefix2Corp(const u8 *prefix);
contains that string. Sets the first three bytes in mac_data and contains that string. Sets the first three bytes in mac_data and
returns true for the first matching entry found. If no entries returns true for the first matching entry found. If no entries
match, leaves mac_data untouched and returns false. Note that this match, leaves mac_data untouched and returns false. Note that this
is not particularly efficient and so should be rewriteen if it is is not particularly efficient and so should be rewritten if it is
called often */ called often */
bool MACCorp2Prefix(const char *vendorstr, u8 *mac_data); bool MACCorp2Prefix(const char *vendorstr, u8 *mac_data);

2
NmapOps.cc
View File

@@ -418,7 +418,7 @@ void NmapOps::ValidateOptions() {
privreq = "WinPcap version 3.1 or higher and\n\ privreq = "WinPcap version 3.1 or higher and\n\
iphlpapi.dll. You seem to be missing one or both of these. Winpcap is\n\ iphlpapi.dll. You seem to be missing one or both of these. Winpcap is\n\
available from http://www.winpcap.org. iphlpapi.dll comes with Win98 and\n\ available from http://www.winpcap.org. iphlpapi.dll comes with Win98 and\n\
later operating sytems and NT 4.0 with SP4 or greater. For previous windows\n\ later operating systems and NT 4.0 with SP4 or greater. For previous Windows\n\
versions, you may be able to take iphlpapi.dll from another system and place\n\ versions, you may be able to take iphlpapi.dll from another system and place\n\
it in your system32 dir (e.g. c:\\windows\\system32).\n\ it in your system32 dir (e.g. c:\\windows\\system32).\n\
On Windows Vista and Windows 7, The WinPcap NPF service must be started by an\n\ On Windows Vista and Windows 7, The WinPcap NPF service must be started by an\n\

6
NmapOps.h
View File

@@ -167,7 +167,7 @@ class NmapOps {
is not necessarily used. */ is not necessarily used. */
bool RawScan(); bool RawScan();
void ValidateOptions(); /* Checks that the options given are void ValidateOptions(); /* Checks that the options given are
reasonable and consistant. If they aren't, the reasonable and consistent. If they aren't, the
function may bail out of Nmap or make small function may bail out of Nmap or make small
adjustments (quietly or with a warning to the adjustments (quietly or with a warning to the
user). */ user). */
@@ -241,7 +241,7 @@ class NmapOps {
/* These functions retrieve and set the Round Trip Time timeouts, in /* These functions retrieve and set the Round Trip Time timeouts, in
milliseconds. The set versions do extra processing to insure sane milliseconds. The set versions do extra processing to insure sane
values and to adjust each other to insure consistance (e.g. that values and to adjust each other to insure consistence (e.g. that
max is always at least as high as min) */ max is always at least as high as min) */
int maxRttTimeout() { return max_rtt_timeout; } int maxRttTimeout() { return max_rtt_timeout; }
int minRttTimeout() { return min_rtt_timeout; } int minRttTimeout() { return min_rtt_timeout; }
@@ -289,7 +289,7 @@ class NmapOps {
bool open_only; bool open_only;
int scanflags; /* if not -1, this value should dictate the TCP flags int scanflags; /* if not -1, this value should dictate the TCP flags
for the core portscaning routine (eg to change a for the core portscanning routine (eg to change a
FIN scan into a PSH scan. Sort of a hack, but can FIN scan into a PSH scan. Sort of a hack, but can
be very useful sometimes. */ be very useful sometimes. */

2
Target.h
View File

@@ -325,7 +325,7 @@ class Target {
unsigned int flags; /* HOST_UNKNOWN, HOST_UP, or HOST_DOWN. */ unsigned int flags; /* HOST_UNKNOWN, HOST_UP, or HOST_DOWN. */
struct timeout_info to; struct timeout_info to;
char *hostname; // Null if unable to resolve or unset char *hostname; // Null if unable to resolve or unset
char * targetname; // The name of the target host given on the commmand line if it is a named host char * targetname; // The name of the target host given on the command line if it is a named host
struct probespec traceroute_probespec; struct probespec traceroute_probespec;
std::list <TracerouteHop> traceroute_hops; std::list <TracerouteHop> traceroute_hops;

2
TargetGroup.h
View File

@@ -238,7 +238,7 @@ private:
* Nmap will pop future targets from this queue. */ * Nmap will pop future targets from this queue. */
std::queue<std::string> queue; std::queue<std::string> queue;
/* A cache to save scanned targets specifiactions. /* A cache to save scanned targets specifications.
* (These are targets that were pushed to Nmap scan queue) */ * (These are targets that were pushed to Nmap scan queue) */
std::set<std::string> history; std::set<std::string> history;

2
global_structures.h
View File

@@ -162,7 +162,7 @@ struct udpprobeinfo {
struct in_addr target; struct in_addr target;
}; };
/* The runtime statistics used to decide how fast to proced and how /* The runtime statistics used to decide how fast to proceed and how
many ports we can try at once */ many ports we can try at once */
struct scanstats { struct scanstats {
int packet_incr; int packet_incr;

30
idle_scan.cc
View File

@@ -182,7 +182,7 @@ struct idle_proxy_info {
int senddelay; /* Delay between sending pr0be SYN packets to target int senddelay; /* Delay between sending pr0be SYN packets to target
(in microseconds) */ (in microseconds) */
int max_senddelay; /* Maximum time we are allowed to wait between int max_senddelay; /* Maximum time we are allowed to wait between
sending pr0bes (when we send a bunch in a row. sending probes (when we send a bunch in a row.
In microseconds. */ In microseconds. */
pcap_t *pd; /* A Pcap descriptor which (starting in pcap_t *pd; /* A Pcap descriptor which (starting in
@@ -295,7 +295,7 @@ static int ipid_proxy_probe(struct idle_proxy_info *proxy, int *probes_sent,
proxy->host.TargetSockAddr(&ss, &sslen); proxy->host.TargetSockAddr(&ss, &sslen);
res = send_ip_packet(proxy->rawsd, proxy->ethptr, &ss, ipv6_packet, packetlen); res = send_ip_packet(proxy->rawsd, proxy->ethptr, &ss, ipv6_packet, packetlen);
if (res == -1) if (res == -1)
fatal("Error occured while trying to send IPv6 packet"); fatal("Error occurred while trying to send IPv6 packet");
free(ipv6_packet); free(ipv6_packet);
} }
sent++; sent++;
@@ -453,7 +453,7 @@ static void ipv6_force_fragmentation(struct idle_proxy_info *proxy, Target *targ
ipv6_packet = build_icmpv6_raw(proxy->host.v6sourceip(), proxy->host.v6hostip(), 0x00, 0x0000, o.ttl, seq , pingid, ICMPV6_ECHO, 0x00, data, sizeof(data) , &packetlen); ipv6_packet = build_icmpv6_raw(proxy->host.v6sourceip(), proxy->host.v6hostip(), 0x00, 0x0000, o.ttl, seq , pingid, ICMPV6_ECHO, 0x00, data, sizeof(data) , &packetlen);
res = send_ip_packet(proxy->rawsd, proxy->ethptr, &ss, ipv6_packet, packetlen); res = send_ip_packet(proxy->rawsd, proxy->ethptr, &ss, ipv6_packet, packetlen);
if (res == -1) if (res == -1)
fatal("Error occured while trying to send ICMPv6 Echo Request to the idle host"); fatal("Error occurred while trying to send ICMPv6 Echo Request to the idle host");
free(ipv6_packet); free(ipv6_packet);
gettimeofday(&ipv6_packet_send_time, NULL); gettimeofday(&ipv6_packet_send_time, NULL);
@@ -493,7 +493,7 @@ static void ipv6_force_fragmentation(struct idle_proxy_info *proxy, Target *targ
ipv6_packet = build_icmpv6_raw(proxy->host.v6sourceip(), proxy->host.v6hostip(), 0x00, 0x0000, o.ttl, 0x00 , 0x00, 0x02, 0x00, data, sizeof(data) , &packetlen); ipv6_packet = build_icmpv6_raw(proxy->host.v6sourceip(), proxy->host.v6hostip(), 0x00, 0x0000, o.ttl, 0x00 , 0x00, 0x02, 0x00, data, sizeof(data) , &packetlen);
res = send_ip_packet(proxy->rawsd, proxy->ethptr, &ss, ipv6_packet, packetlen); res = send_ip_packet(proxy->rawsd, proxy->ethptr, &ss, ipv6_packet, packetlen);
if (res == -1) if (res == -1)
fatal("Error occured while trying to send spoofed ICMPv6 Echo Request to the idle host"); fatal("Error occurred while trying to send spoofed ICMPv6 Echo Request to the idle host");
free(ipv6_packet); free(ipv6_packet);
@@ -506,7 +506,7 @@ static void ipv6_force_fragmentation(struct idle_proxy_info *proxy, Target *targ
ipv6_packet = build_icmpv6_raw(target->v6hostip(), proxy->host.v6hostip(), 0x00, 0x0000, o.ttl, seq , pingid, ICMPV6_ECHO, 0x00, data, sizeof(data) , &packetlen); ipv6_packet = build_icmpv6_raw(target->v6hostip(), proxy->host.v6hostip(), 0x00, 0x0000, o.ttl, seq , pingid, ICMPV6_ECHO, 0x00, data, sizeof(data) , &packetlen);
res = send_ip_packet(proxy->rawsd, proxy->ethptr, &ss, ipv6_packet, packetlen); res = send_ip_packet(proxy->rawsd, proxy->ethptr, &ss, ipv6_packet, packetlen);
if (res == -1) if (res == -1)
fatal("Error occured while trying to send ICMPv6 Echo Request to the idle host"); fatal("Error occurred while trying to send ICMPv6 Echo Request to the idle host");
free(ipv6_packet); free(ipv6_packet);
@@ -521,7 +521,7 @@ static void ipv6_force_fragmentation(struct idle_proxy_info *proxy, Target *targ
usleep(10000); usleep(10000);
res = send_ip_packet(proxy->rawsd, proxy->ethptr, &ss, ipv6_packet, packetlen); res = send_ip_packet(proxy->rawsd, proxy->ethptr, &ss, ipv6_packet, packetlen);
if (res == -1) if (res == -1)
fatal("Error occured while trying to send ICMPv6 PTB to the idle host"); fatal("Error occurred while trying to send ICMPv6 PTB to the idle host");
free(ipv6_packet); free(ipv6_packet);
} }
@@ -628,7 +628,7 @@ static void initialize_idleproxy(struct idle_proxy_info *proxy, char *proxyName,
proxy->host.setTargetSockAddr(&ss, sslen); proxy->host.setTargetSockAddr(&ss, sslen);
/* Lets figure out the appropriate source address to use when sending /* Lets figure out the appropriate source address to use when sending
the pr0bez */ the probes */
proxy->host.TargetSockAddr(&ss, &sslen); proxy->host.TargetSockAddr(&ss, &sslen);
if (!nmap_route_dst(&ss, &rnfo)) if (!nmap_route_dst(&ss, &rnfo))
fatal("Unable to find appropriate source address and device interface to use when sending packets to %s", proxyName); fatal("Unable to find appropriate source address and device interface to use when sending packets to %s", proxyName);
@@ -698,7 +698,7 @@ static void initialize_idleproxy(struct idle_proxy_info *proxy, char *proxyName,
sequence_base = get_random_u32(); sequence_base = get_random_u32();
/* Yahoo! It is finally time to send our pr0beZ! */ /* Yahoo! It is finally time to send our probes! */
while (probes_sent < NUM_IPID_PROBES) { while (probes_sent < NUM_IPID_PROBES) {
if (o.scan_delay) if (o.scan_delay)
@@ -732,7 +732,7 @@ static void initialize_idleproxy(struct idle_proxy_info *proxy, char *proxyName,
&packetlen); &packetlen);
res = send_ip_packet(proxy->rawsd, proxy->ethptr, &ss, ipv6_packet, packetlen); res = send_ip_packet(proxy->rawsd, proxy->ethptr, &ss, ipv6_packet, packetlen);
if (res == -1) if (res == -1)
fatal("Error occured while trying to send IPv6 packet"); fatal("Error occurred while trying to send IPv6 packet");
free(ipv6_packet); free(ipv6_packet);
} }
@@ -875,7 +875,7 @@ static void initialize_idleproxy(struct idle_proxy_info *proxy, char *proxyName,
log_write(LOG_PLAIN, "Idle scan using zombie %s (%s:%hu); Class: %s\n", proxy->host.HostName(), proxy->host.targetipstr(), proxy->probe_port, ipidclass2ascii(proxy->seqclass)); log_write(LOG_PLAIN, "Idle scan using zombie %s (%s:%hu); Class: %s\n", proxy->host.HostName(), proxy->host.targetipstr(), proxy->probe_port, ipidclass2ascii(proxy->seqclass));
break; break;
default: default:
fatal("Idle scan zombie %s (%s) port %hu cannot be used because IP ID sequencability class is: %s. Try another proxy.", proxy->host.HostName(), proxy->host.targetipstr(), proxy->probe_port, ipidclass2ascii(proxy->seqclass)); fatal("Idle scan zombie %s (%s) port %hu cannot be used because IP ID sequence class is: %s. Try another proxy.", proxy->host.HostName(), proxy->host.targetipstr(), proxy->probe_port, ipidclass2ascii(proxy->seqclass));
} }
proxy->latestid = ipids[probes_returned - 1]; proxy->latestid = ipids[probes_returned - 1];
@@ -926,7 +926,7 @@ static void initialize_idleproxy(struct idle_proxy_info *proxy, char *proxyName,
&packetlen); &packetlen);
res = send_ip_packet(proxy->rawsd, proxy->ethptr, &ss, ipv6_packet, packetlen); res = send_ip_packet(proxy->rawsd, proxy->ethptr, &ss, ipv6_packet, packetlen);
if (res == -1) if (res == -1)
fatal("Error occured while trying to send IPv6 packet "); fatal("Error occurred while trying to send IPv6 packet ");
free(ipv6_packet); free(ipv6_packet);
} }
} }
@@ -1071,7 +1071,7 @@ static int idlescan_countopen2(struct idle_proxy_info *proxy,
fatal("%s: Failed to open ethernet device (%s)", __func__, target->deviceName()); fatal("%s: Failed to open ethernet device (%s)", __func__, target->deviceName());
} else eth.ethsd = NULL; } else eth.ethsd = NULL;
/* I start by sending out the SYN pr0bez */ /* I start by sending out the SYN probes */
for (pr0be = 0; pr0be < numports; pr0be++) { for (pr0be = 0; pr0be < numports; pr0be++) {
if (o.scan_delay) if (o.scan_delay)
enforce_scan_delay(NULL); enforce_scan_delay(NULL);
@@ -1099,7 +1099,7 @@ static int idlescan_countopen2(struct idle_proxy_info *proxy,
&packetlen); &packetlen);
res = send_ip_packet(proxy->rawsd, eth.ethsd ? &eth : NULL, &ss, packet, packetlen); res = send_ip_packet(proxy->rawsd, eth.ethsd ? &eth : NULL, &ss, packet, packetlen);
if (res == -1) if (res == -1)
fatal("Error occured while trying to send IPv6 packet"); fatal("Error occurred while trying to send IPv6 packet");
free(packet); free(packet);
} }
} }
@@ -1348,7 +1348,7 @@ static int idle_treescan(struct idle_proxy_info *proxy, Target *target,
adjust_idle_timing(proxy, target, retry2, retrycount); adjust_idle_timing(proxy, target, retry2, retrycount);
} else { } else {
if (o.debugging) if (o.debugging)
error("Adjusting timing because my first scan of %d ports, starting with %hu found %d open, while second scan yeilded %d", secondHalfSz, ports[firstHalfSz], flatcount2, retrycount); error("Adjusting timing because my first scan of %d ports, starting with %hu found %d open, while second scan yielded %d", secondHalfSz, ports[firstHalfSz], flatcount2, retrycount);
adjust_idle_timing(proxy, target, flatcount2, retrycount); adjust_idle_timing(proxy, target, flatcount2, retrycount);
} }
@@ -1432,7 +1432,7 @@ void idle_scan(Target *target, u16 *portarray, int numports,
scan is sort of tree structured (we scan a group and then divide scan is sort of tree structured (we scan a group and then divide
it up and drill down in subscans of the group), we split the port it up and drill down in subscans of the group), we split the port
space into smaller groups and then call a recursive space into smaller groups and then call a recursive
divide-and-counquer function to find the open ports */ divide-and-conquer function to find the open ports */
while (portidx < numports) { while (portidx < numports) {
portsleft = numports - portidx; portsleft = numports - portidx;
/* current_groupsz is doubled below because idle_subscan cuts in half */ /* current_groupsz is doubled below because idle_subscan cuts in half */

2
idle_scan.h
View File

@@ -137,7 +137,7 @@
class Target; class Target;
/* Handles the scan types where no positive-acknowledgement of open /* Handles the scan types where no positive-acknowledgment of open
port is received (those scans are in pos_scan). Super_scan port is received (those scans are in pos_scan). Super_scan
includes scans such as FIN/XMAS/NULL/Maimon/UDP and IP Proto scans */ includes scans such as FIN/XMAS/NULL/Maimon/UDP and IP Proto scans */
void idle_scan(Target *target, u16 *portarray, int numports, void idle_scan(Target *target, u16 *portarray, int numports,

2
nbase/getopt.c
View File

@@ -55,7 +55,7 @@ int getopt_reset(void)
/* this is the plain old UNIX getopt, with GNU-style extensions. */ /* this is the plain old UNIX getopt, with GNU-style extensions. */
/* if you're porting some piece of UNIX software, this is all you need. */ /* if you're porting some piece of UNIX software, this is all you need. */
/* this supports GNU-style permution and optional arguments */ /* this supports GNU-style permutation and optional arguments */
static int _getopt(int argc, char * argv[], const char *opts) static int _getopt(int argc, char * argv[], const char *opts)
{ {

10
nbase/nbase.h
View File

@@ -1,7 +1,7 @@
/*************************************************************************** /***************************************************************************
* nbase.h -- The main include file exposing the external API for * * nbase.h -- The main include file exposing the external API for *
* libnbase, a library of base (often compatability) routines. Programs * * libnbase, a library of base (often compatibility) routines. Programs *
* using libnbase can guarantee the availability of functions like * * using libnbase can guarantee the availability of functions like *
* (v)snprintf and inet_pton. This library also provides consistency and * * (v)snprintf and inet_pton. This library also provides consistency and *
* extended features for some functions. It was originally written for * * extended features for some functions. It was originally written for *
@@ -134,7 +134,7 @@
/* NOTE -- libnbase offers the following features that you should probably /* NOTE -- libnbase offers the following features that you should probably
* be aware of: * be aware of:
* *
* * 'inline' is defined to what is neccessary for the C compiler being * * 'inline' is defined to what is necessary for the C compiler being
* used (which may be nothing) * used (which may be nothing)
* *
* * snprintf, inet_pton, memcpy, and bzero are * * snprintf, inet_pton, memcpy, and bzero are
@@ -155,7 +155,7 @@
* * IPv6 structures like 'sockaddr_storage' are provided if they do * * IPv6 structures like 'sockaddr_storage' are provided if they do
* not already exist. * not already exist.
* *
* * Various Windows -> UNIX compatability definitions are added (such as defining EMSGSIZE to WSAEMSGSIZE) * * Various Windows -> UNIX compatibility definitions are added (such as defining EMSGSIZE to WSAEMSGSIZE)
*/ */
#if HAVE_CONFIG_H #if HAVE_CONFIG_H
@@ -234,7 +234,7 @@ typedef int32_t s32;
typedef uint64_t u64; typedef uint64_t u64;
typedef int64_t s64; typedef int64_t s64;
/* Mathematicial MIN/MAX/ABS (absolute value) macros */ /* Mathematical MIN/MAX/ABS (absolute value) macros */
#ifndef MAX #ifndef MAX
#define MAX(x,y) (((x)>(y))?(x):(y)) #define MAX(x,y) (((x)>(y))?(x):(y))
#endif #endif
@@ -488,7 +488,7 @@ char *format_bytecount(unsigned long long bytes, char *buf, size_t buflen);
/* Compare a canonical option name (e.g. "max-scan-delay") with a /* Compare a canonical option name (e.g. "max-scan-delay") with a
user-generated option such as "max_scan_delay" and returns 0 if the user-generated option such as "max_scan_delay" and returns 0 if the
two values are considered equivalant (for example, - and _ are two values are considered equivalent (for example, - and _ are
considered to be the same), nonzero otherwise. */ considered to be the same), nonzero otherwise. */
int optcmp(const char *a, const char *b); int optcmp(const char *a, const char *b);

2
nbase/nbase_ipv6.h
View File

@@ -202,7 +202,7 @@ int sockaddr_storage_equal(const struct sockaddr_storage *a,
/* This function is an easier version of inet_ntop because you don't /* This function is an easier version of inet_ntop because you don't
need to pass a dest buffer. Instead, it returns a static buffer that need to pass a dest buffer. Instead, it returns a static buffer that
you can use until the function is called again (by the same or another you can use until the function is called again (by the same or another
thread in the process). If there is a wierd error (like sslen being thread in the process). If there is a weird error (like sslen being
too short) then NULL will be returned. */ too short) then NULL will be returned. */
const char *inet_ntop_ez(const struct sockaddr_storage *ss, size_t sslen); const char *inet_ntop_ez(const struct sockaddr_storage *ss, size_t sslen);

10
nbase/nbase_misc.c
View File

@@ -1,6 +1,6 @@
/*************************************************************************** /***************************************************************************
* nbase_misc.c -- Some small miscelaneous utility/compatability * * nbase_misc.c -- Some small miscellaneous utility/compatibility *
* functions. * * functions. *
* * * *
***********************IMPORTANT NMAP LICENSE TERMS************************ ***********************IMPORTANT NMAP LICENSE TERMS************************
@@ -222,7 +222,7 @@ int sockaddr_storage_equal(const struct sockaddr_storage *a,
/* This function is an easier version of inet_ntop because you don't /* This function is an easier version of inet_ntop because you don't
need to pass a dest buffer. Instead, it returns a static buffer that need to pass a dest buffer. Instead, it returns a static buffer that
you can use until the function is called again (by the same or another you can use until the function is called again (by the same or another
thread in the process). If there is a wierd error (like sslen being thread in the process). If there is a weird error (like sslen being
too short) then NULL will be returned. */ too short) then NULL will be returned. */
const char *inet_ntop_ez(const struct sockaddr_storage *ss, size_t sslen) { const char *inet_ntop_ez(const struct sockaddr_storage *ss, size_t sslen) {
@@ -606,7 +606,7 @@ unsigned long nbase_crc32(unsigned char *buf, int len)
* CRC-32C (Castagnoli) Cyclic Redundancy Check. * CRC-32C (Castagnoli) Cyclic Redundancy Check.
* Taken straight from Appendix C of RFC 4960 (SCTP), with the difference that * Taken straight from Appendix C of RFC 4960 (SCTP), with the difference that
* the remainder register (crc32) is initialized to 0xffffffffL rather than ~0L, * the remainder register (crc32) is initialized to 0xffffffffL rather than ~0L,
* for correct operation on platforms where unisigned long is longer than 32 * for correct operation on platforms where unsigned long is longer than 32
* bits. * bits.
*/ */
@@ -695,13 +695,13 @@ unsigned long nbase_adler32(unsigned char *buf, int len)
* that the caller is supposed to free(). * that the caller is supposed to free().
* */ * */
char *hexdump(const u8 *cp, u32 length){ char *hexdump(const u8 *cp, u32 length){
static char asciify[257]; /* Stores cha6acter table */ static char asciify[257]; /* Stores character table */
int asc_init=0; /* Flag to generate table only once */ int asc_init=0; /* Flag to generate table only once */
u32 i=0, hex=0, asc=0; /* Array indexes */ u32 i=0, hex=0, asc=0; /* Array indexes */
u32 line_count=0; /* For byte count at line start */ u32 line_count=0; /* For byte count at line start */
char *current_line=NULL; /* Current line to write */ char *current_line=NULL; /* Current line to write */
char *buffer=NULL; /* Dynamic buffer we return */ char *buffer=NULL; /* Dynamic buffer we return */
#define LINE_LEN 74 /* Lenght of printed line */ #define LINE_LEN 74 /* Length of printed line */
char line2print[LINE_LEN]; /* Stores current line */ char line2print[LINE_LEN]; /* Stores current line */
char printbyte[16]; /* For byte conversion */ char printbyte[16]; /* For byte conversion */
int bytes2alloc; /* For buffer */ int bytes2alloc; /* For buffer */

2
nbase/nbase_str.c
View File

@@ -1,6 +1,6 @@
/*************************************************************************** /***************************************************************************
* nbase_str.c -- string related functings in the nbase library. These * * nbase_str.c -- string related functions in the nbase library. These *
* were written by fyodor@nmap.org . * * were written by fyodor@nmap.org . *
* * * *
***********************IMPORTANT NMAP LICENSE TERMS************************ ***********************IMPORTANT NMAP LICENSE TERMS************************

2
nbase/nbase_time.c
View File

@@ -1,6 +1,6 @@
/*************************************************************************** /***************************************************************************
* nbase_time.c -- Some small time-related utility/compatability * * nbase_time.c -- Some small time-related utility/compatibility *
* functions. * * functions. *
* * * *
***********************IMPORTANT NMAP LICENSE TERMS************************ ***********************IMPORTANT NMAP LICENSE TERMS************************

4
nbase/nbase_winunix.h
View File

@@ -1,5 +1,5 @@
/*************************************************************************** /***************************************************************************
* nbase_winunix.h -- Misc. compatability routines that generally try to * * nbase_winunix.h -- Misc. compatibility routines that generally try to *
* reproduce UNIX-centric concepts on Windows. * * reproduce UNIX-centric concepts on Windows. *
* * * *
***********************IMPORTANT NMAP LICENSE TERMS************************ ***********************IMPORTANT NMAP LICENSE TERMS************************
@@ -159,7 +159,7 @@
<system_error> doesn't compile, so we pretend not to have C++0x to <system_error> doesn't compile, so we pretend not to have C++0x to
avoid it. */ avoid it. */
#define _INC_ERRNO /* suppress errno.h */ #define _INC_ERRNO /* suppress errno.h */
#define _ERRNO_H_ /* Also for errno.h suppresion */ #define _ERRNO_H_ /* Also for errno.h suppression */
#define _SYSTEM_ERROR_ #define _SYSTEM_ERROR_
#undef _HAS_CPP0X #undef _HAS_CPP0X
#define _HAS_CPP0X 0 #define _HAS_CPP0X 0

2
nbase/snprintf.c
View File

@@ -1,6 +1,6 @@
/* Note -- this file was obtained from tcpdump-2000-9-17 CVS snapshot * /* Note -- this file was obtained from tcpdump-2000-9-17 CVS snapshot *
* ( www.tcpdump.org). It has been modified slightly for * * ( www.tcpdump.org). It has been modified slightly for *
* compatability with libnbase. Modification details may be in the * * compatibility with libnbase. Modification details may be in the *
* nbase CHANGELOG - fyodor@nmap.org */ * nbase CHANGELOG - fyodor@nmap.org */

2
nmap-update/nmap-update.c
View File

@@ -692,7 +692,7 @@ Updates system-independent Nmap files. By default the new files are installed to
-r, --repo REPO use REPO as SVN repository and path (default %s).\n\ -r, --repo REPO use REPO as SVN repository and path (default %s).\n\
-v, --verbose be more verbose.\n\ -v, --verbose be more verbose.\n\
--username USERNAME use this username.\n\ --username USERNAME use this username.\n\
--password PASSWORE use this password.\n\ --password PASSWORD use this password.\n\
", program_name, install_dir, install_dir, DEFAULT_SVN_REPO); ", program_name, install_dir, install_dir, DEFAULT_SVN_REPO);
free(install_dir); free(install_dir);
} }

6
nmap.cc
View File

@@ -275,7 +275,7 @@ static void printusage(int rc) {
" --script-trace: Show all data sent and received\n" " --script-trace: Show all data sent and received\n"
" --script-updatedb: Update the script database.\n" " --script-updatedb: Update the script database.\n"
" --script-help=<Lua scripts>: Show help about scripts.\n" " --script-help=<Lua scripts>: Show help about scripts.\n"
" <Lua scripts> is a comma separted list of script-files or\n" " <Lua scripts> is a comma-separated list of script-files or\n"
" script-categories.\n" " script-categories.\n"
#endif #endif
"OS DETECTION:\n" "OS DETECTION:\n"
@@ -575,8 +575,8 @@ void parse_options(int argc, char **argv) {
{"proxy", required_argument, 0, 0}, {"proxy", required_argument, 0, 0},
{"osscan_limit", no_argument, 0, 0}, /* skip OSScan if no open ports */ {"osscan_limit", no_argument, 0, 0}, /* skip OSScan if no open ports */
{"osscan-limit", no_argument, 0, 0}, /* skip OSScan if no open ports */ {"osscan-limit", no_argument, 0, 0}, /* skip OSScan if no open ports */
{"osscan_guess", no_argument, 0, 0}, /* More guessing flexability */ {"osscan_guess", no_argument, 0, 0}, /* More guessing flexibility */
{"osscan-guess", no_argument, 0, 0}, /* More guessing flexability */ {"osscan-guess", no_argument, 0, 0}, /* More guessing flexibility */
{"fuzzy", no_argument, 0, 0}, /* Alias for osscan_guess */ {"fuzzy", no_argument, 0, 0}, /* Alias for osscan_guess */
{"packet_trace", no_argument, 0, 0}, /* Display all packets sent/rcv */ {"packet_trace", no_argument, 0, 0}, /* Display all packets sent/rcv */
{"packet-trace", no_argument, 0, 0}, /* Display all packets sent/rcv */ {"packet-trace", no_argument, 0, 0}, /* Display all packets sent/rcv */

2
nmap.h
View File

@@ -315,7 +315,7 @@ void *realloc();
#endif #endif
/* Maximum number of extra hostnames, OSs, and devices, we /* Maximum number of extra hostnames, OSs, and devices, we
consider when outputing the extra service info fields */ consider when outputting the extra service info fields */
#define MAX_SERVICE_INFO_FIELDS 5 #define MAX_SERVICE_INFO_FIELDS 5
/* We wait at least 100 ms for a response by default - while that /* We wait at least 100 ms for a response by default - while that

4
nmap_dns.cc
View File

@@ -168,7 +168,7 @@
// http://www.hcsw.org // http://www.hcsw.org
/* /*
* DNS Caching and ageing added by Eddie Bell ejlbell@gmail.com 2007 * DNS Caching and aging added by Eddie Bell ejlbell@gmail.com 2007
*/ */
// TODO: // TODO:
@@ -581,7 +581,7 @@ static int process_result(u32 ia, char *result, int action, u16 id) {
do_possible_writes(); do_possible_writes();
// Close DNS servers if we're all done so that we kill // Close DNS servers if we're all done so that we kill
// all events and return from nsock_loop immediatley // all events and return from nsock_loop immediateley
if (total_reqs == 0) if (total_reqs == 0)
close_dns_servers(); close_dns_servers();
return 1; return 1;

2
nmap_ftp.cc
View File

@@ -325,7 +325,7 @@ void bounce_scan(Target *target, u16 *portarray, int numports,
error("Your FTP bounce server doesn't allow privileged ports, skipping them."); error("Your FTP bounce server doesn't allow privileged ports, skipping them.");
while (i < numports && portarray[i] < 1024) i++; while (i < numports && portarray[i] < 1024) i++;
if (!portarray[i]) { if (!portarray[i]) {
fatal("And you didn't want to scan any unpriviliged ports. Giving up."); fatal("And you didn't want to scan any unprivileged ports. Giving up.");
} }
} }
} else { /* Not an error message */ } else { /* Not an error message */

8
nse_main.lua
View File

@@ -13,7 +13,7 @@
-- --
-- A few notes about the safety of the engine, that is, the ability for -- A few notes about the safety of the engine, that is, the ability for
-- a script developer to crash or otherwise stall NSE. The purpose of noting -- a script developer to crash or otherwise stall NSE. The purpose of noting
-- these attack vectors is more to show the difficulty in accidently -- these attack vectors is more to show the difficulty in accidentally
-- breaking the system than to indicate a user may wish to break the -- breaking the system than to indicate a user may wish to break the
-- system through these means. -- system through these means.
-- - A script writer can use the undocumented Lua function newproxy -- - A script writer can use the undocumented Lua function newproxy
@@ -125,7 +125,7 @@ local unpack = table.unpack;
do -- Add loader to look in nselib/?.lua (nselib/ can be in multiple places) do -- Add loader to look in nselib/?.lua (nselib/ can be in multiple places)
local function loader (lib) local function loader (lib)
lib = lib:gsub("%.", "/"); -- change Lua "module seperator" to directory separator lib = lib:gsub("%.", "/"); -- change Lua "module separator" to directory separator
local name = "nselib/"..lib..".lua"; local name = "nselib/"..lib..".lua";
local type, path = cnse.fetchfile_absolute(name); local type, path = cnse.fetchfile_absolute(name);
if type == "file" then if type == "file" then
@@ -162,7 +162,7 @@ local NSE_YIELD_VALUE = {};
do do
-- This is the method by which we allow a script to have nested -- This is the method by which we allow a script to have nested
-- coroutines. If a sub-thread yields in an NSE function such as -- coroutines. If a sub-thread yields in an NSE function such as
-- nsock.connect, then we propogate the yield up. These replacements -- nsock.connect, then we propagate the yield up. These replacements
-- to the coroutine library are used only by Script Threads, not the engine. -- to the coroutine library are used only by Script Threads, not the engine.
local function handle (co, status, ...) local function handle (co, status, ...)
@@ -1176,7 +1176,7 @@ do -- Load script arguments (--script-args)
return "", eqj-1; return "", eqj-1;
else else
error("Value around '"..sub(str, start, start+10).. error("Value around '"..sub(str, start, start+10)..
"' is invalid or is unterminated by a valid seperator"); "' is invalid or is unterminated by a valid separator");
end end
end end
-- Takes 'str' at index 'start' and parses a table. -- Takes 'str' at index 'start' and parses a table.

2
nse_openssl.cc
View File

@@ -1,7 +1,7 @@
/* OpenSSL library for lua /* OpenSSL library for lua
* adapted from lmd5 library (http://www.tecgraf.puc-rio.br/~lhf/ftp/lua/) * adapted from lmd5 library (http://www.tecgraf.puc-rio.br/~lhf/ftp/lua/)
* Original code written by Luiz Henrique de Figueiredo <lhf@tecgraf.puc-rio.br> * Original code written by Luiz Henrique de Figueiredo <lhf@tecgraf.puc-rio.br>
* Adapted for NMap by Thomas Buchanan <tbuchanan@thecompassgrp.net> * Adapted for Nmap by Thomas Buchanan <tbuchanan@thecompassgrp.net>
* bignum and rand_bytes functions added by Sven Klemm <sven@c3d2.de> * bignum and rand_bytes functions added by Sven Klemm <sven@c3d2.de>
*/ */

8
nse_ssl_cert.cc
View File

@@ -298,7 +298,7 @@ static int time_to_tm(const ASN1_TIME *t, struct tm *result)
/* "In coming up with the worlds least efficient machine-readable time /* "In coming up with the worlds least efficient machine-readable time
encoding format, the ISO nevertheless decided to forgo the encoding of encoding format, the ISO nevertheless decided to forgo the encoding of
centuries, a problem which has been kludged around by redefining the time centuries, a problem which has been kludged around by redefining the time
as UTCTime if the date is 2049 or ealier, and GeneralizedTime if the date as UTCTime if the date is 2049 or earlier, and GeneralizedTime if the date
is 2050 or later." is 2050 or later."
http://www.cs.auckland.ac.nz/~pgut001/pubs/x509guide.txt */ http://www.cs.auckland.ac.nz/~pgut001/pubs/x509guide.txt */
if (year < 50) if (year < 50)
@@ -357,8 +357,8 @@ static void tm_to_table(lua_State *L, const struct tm *tm)
/* Omit tm_wday and tm_yday. */ /* Omit tm_wday and tm_yday. */
} }
/* This is a helper function for x509_validity_to_table. It takes teh given /* This is a helper function for x509_validity_to_table. It takes the given
ASN1_TIME and covnerts it to a value on the stack, which is one of ASN1_TIME and converts it to a value on the stack, which is one of
nil, if the time is NULL; nil, if the time is NULL;
a date table, if the date can be parsed; and a date table, if the date can be parsed; and
a string of the raw bytes, if the date cannot be parsed. */ a string of the raw bytes, if the date cannot be parsed. */
@@ -375,7 +375,7 @@ static void asn1_time_to_obj(lua_State *L, const ASN1_TIME *s)
} }
} }
/* This is a helper functino for x509_validity_to_table. It builds a table with /* This is a helper function for x509_validity_to_table. It builds a table with
the two members "notBefore" and "notAfter", whose values are what is returned the two members "notBefore" and "notAfter", whose values are what is returned
from asn1_time_to_obj. */ from asn1_time_to_obj. */
static void x509_validity_to_table(lua_State *L, const X509 *cert) static void x509_validity_to_table(lua_State *L, const X509 *cert)

2
nsock/include/nsock.h
View File

@@ -567,7 +567,7 @@ nsock_event_id nsock_reconnect_ssl(nsock_pool nsp, nsock_iod nsiod,
/* Read up to nlines lines (terminated with \n, which of course inclues \r\n), /* Read up to nlines lines (terminated with \n, which of course inclues \r\n),
* or until EOF, or until the timeout, whichever comes first. Note that * or until EOF, or until the timeout, whichever comes first. Note that
* NSE_STATUS_SUCCESS will be returned in the case of EOF or tiemout if at least * NSE_STATUS_SUCCESS will be returned in the case of EOF or timeout if at least
* 1 char has been read. Also note that you may get more than 'nlines' back -- * 1 char has been read. Also note that you may get more than 'nlines' back --
* we just stop once "at least" 'nlines' is read */ * we just stop once "at least" 'nlines' is read */
nsock_event_id nsock_readlines(nsock_pool nsp, nsock_iod nsiod, nsock_event_id nsock_readlines(nsock_pool nsp, nsock_iod nsiod,

2
nsock/src/nsock_core.c
View File

@@ -1015,7 +1015,7 @@ void process_event(mspool *nsp, gh_list_t *evlist, msevent *nse, int ev) {
do_actual_pcap_read(nse); do_actual_pcap_read(nse);
} }
/* if already received smth */ /* if already received something */
if (fs_length(&(nse->iobuf)) > 0) if (fs_length(&(nse->iobuf)) > 0)
handle_pcap_read_result(nsp, nse, NSE_STATUS_SUCCESS); handle_pcap_read_result(nsp, nse, NSE_STATUS_SUCCESS);

2
nsock/src/nsock_event.c
View File

@@ -487,7 +487,7 @@ void msevent_delete(mspool *nsp, msevent *nse) {
else else
nsock_log_debug(nsp, "msevent_delete (IOD #%li) (EID #%li)", nse->iod->id, nse->id); nsock_log_debug(nsp, "msevent_delete (IOD #%li) (EID #%li)", nse->iod->id, nse->id);
/* First free the IOBuf inside it if neccessary */ /* First free the IOBuf inside it if necessary */
if (nse->type == NSE_TYPE_READ || nse->type == NSE_TYPE_WRITE) { if (nse->type == NSE_TYPE_READ || nse->type == NSE_TYPE_WRITE) {
fs_free(&nse->iobuf); fs_free(&nse->iobuf);
} }

2
nsock/src/nsock_internal.h
View File

@@ -1,6 +1,6 @@
/*************************************************************************** /***************************************************************************
* nsock_internal.h -- PRIVATE interface definitions for the guts of the * * nsock_internal.h -- PRIVATE interface definitions for the guts of the *
* nsock paralle socket event library. Applications calling this library * * nsock parallel socket event library. Applications calling this library *
* should NOT include this. even LOOK at these :). * * should NOT include this. even LOOK at these :). *
* * * *
***********************IMPORTANT NSOCK LICENSE TERMS*********************** ***********************IMPORTANT NSOCK LICENSE TERMS***********************

2
nsock/src/nsock_iod.c
View File

@@ -1,6 +1,6 @@
/*************************************************************************** /***************************************************************************
* nsock_iod.c -- This contains the functions relating to nsock_iod (and * * nsock_iod.c -- This contains the functions relating to nsock_iod (and *
* its nsock internal manifistation -- nsockiod. This is is similar to a * * its nsock internal manifestation -- nsockiod. This is is similar to a *
* file descriptor in that you create it and then use it to initiate * * file descriptor in that you create it and then use it to initiate *
* connections, read/write data, etc. * * connections, read/write data, etc. *
* * * *

2
nsock/src/nsock_pcap.c
View File

@@ -213,7 +213,7 @@ static int nsock_pcap_try_open(mspool *nsp, mspcap *mp, const char *dev,
/* Convert new nsiod to pcap descriptor. Other parameters have /* Convert new nsiod to pcap descriptor. Other parameters have
* the same meaning as for pcap_open_live in pcap(3). * the same meaning as for pcap_open_live in pcap(3).
* device : pcap-style device name * device : pcap-style device name
* snaplen : size of packet to be copied to hanler * snaplen : size of packet to be copied to handler
* promisc : whether to open device in promiscuous mode * promisc : whether to open device in promiscuous mode
* bpf_fmt : berkeley filter * bpf_fmt : berkeley filter
* return value: NULL if everything was okay, or error string * return value: NULL if everything was okay, or error string

2
nsock/src/nsock_read.c
View File

@@ -63,7 +63,7 @@
/* Read up to nlines lines (terminated with \n, which of course includes \r\n), /* Read up to nlines lines (terminated with \n, which of course includes \r\n),
* or until EOF, or until the timeout, whichever comes first. Note that * or until EOF, or until the timeout, whichever comes first. Note that
* NSE_STATUS_SUCCESS will be returned in the case of EOF or tiemout if at least * NSE_STATUS_SUCCESS will be returned in the case of EOF or timeout if at least
* 1 char has been read. Also note that you may get more than 'nlines' back -- * 1 char has been read. Also note that you may get more than 'nlines' back --
* we just stop once "at least" 'nlines' is read */ * we just stop once "at least" 'nlines' is read */
nsock_event_id nsock_readlines(nsock_pool nsp, nsock_iod ms_iod, nsock_event_id nsock_readlines(nsock_pool nsp, nsock_iod ms_iod,

2
nsock/src/nsock_ssl.h
View File

@@ -72,7 +72,7 @@
#include <openssl/rand.h> #include <openssl/rand.h>
struct sslinfo { struct sslinfo {
/* SSL_ERROR_NONE, SSL_ERROR_WANT_CONNECT, SSL_ERROR_WAINT_READ, or /* SSL_ERROR_NONE, SSL_ERROR_WANT_CONNECT, SSL_ERROR_WANT_READ, or
* SSL_ERROR_WANT_WRITE */ * SSL_ERROR_WANT_WRITE */
int ssl_desire; int ssl_desire;
}; };

4
osscan.cc
View File

@@ -254,7 +254,7 @@ void FingerPrint::sort() {
/* Compare an observed value (e.g. "45") against an OS DB expression (e.g. /* Compare an observed value (e.g. "45") against an OS DB expression (e.g.
"3B-47" or "8|A" or ">10"). Return true iff there's a match. The syntax uses "3B-47" or "8|A" or ">10"). Return true iff there's a match. The syntax uses
< (less than) < (less than)
> (greather than) > (greater than)
+ (non-zero) + (non-zero)
| (or) | (or)
- (range) - (range)
@@ -536,7 +536,7 @@ double compare_fingerprints(const FingerPrint *referenceFP, const FingerPrint *o
reference fingerprint DB. The results are stored in in FPR (which reference fingerprint DB. The results are stored in in FPR (which
must point to an instantiated FingerPrintResultsIPv4 class) -- results must point to an instantiated FingerPrintResultsIPv4 class) -- results
will be reverse-sorted by accuracy. No results below will be reverse-sorted by accuracy. No results below
accuracy_threshhold will be included. The max matches returned is accuracy_threshold will be included. The max matches returned is
the maximum that fits in a FingerPrintResultsIPv4 class. */ the maximum that fits in a FingerPrintResultsIPv4 class. */
void match_fingerprint(const FingerPrint *FP, FingerPrintResultsIPv4 *FPR, void match_fingerprint(const FingerPrint *FP, FingerPrintResultsIPv4 *FPR,
const FingerPrintDB *DB, double accuracy_threshold) { const FingerPrintDB *DB, double accuracy_threshold) {

2
osscan.h
View File

@@ -180,7 +180,7 @@ double compare_fingerprints(const FingerPrint *referenceFP, const FingerPrint *o
reference fingerprint DB. The results are stored in in FPR (which reference fingerprint DB. The results are stored in in FPR (which
must point to an instantiated FingerPrintResultsIPv4 class) -- results must point to an instantiated FingerPrintResultsIPv4 class) -- results
will be reverse-sorted by accuracy. No results below will be reverse-sorted by accuracy. No results below
accuracy_threshhold will be included. The max matches returned is accuracy_threshold will be included. The max matches returned is
the maximum that fits in a FingerPrintResultsIPv4 class. */ the maximum that fits in a FingerPrintResultsIPv4 class. */
void match_fingerprint(const FingerPrint *FP, FingerPrintResultsIPv4 *FPR, void match_fingerprint(const FingerPrint *FP, FingerPrintResultsIPv4 *FPR,
const FingerPrintDB *DB, double accuracy_threshold); const FingerPrintDB *DB, double accuracy_threshold);

8
osscan2.cc
View File

@@ -244,7 +244,7 @@ int get_initial_ttl_guess(u8 ttl) {
/* This function takes an array of "numSamples" IP IDs and analyzes /* This function takes an array of "numSamples" IP IDs and analyzes
them to determine their sequenceability classification. It returns them to determine their sequence classification. It returns
one of the IPID_SEQ_* classifications defined in nmap.h . If the one of the IPID_SEQ_* classifications defined in nmap.h . If the
function cannot determine the sequence, IPID_SEQ_UNKNOWN is returned. function cannot determine the sequence, IPID_SEQ_UNKNOWN is returned.
This islocalhost argument is a boolean specifying whether these This islocalhost argument is a boolean specifying whether these
@@ -3197,7 +3197,7 @@ bool HostOsScan::processTIcmpResp(HostOsScanStats *hss, struct ip *ip, int reply
hss->storedIcmpReply = replyNo; hss->storedIcmpReply = replyNo;
return true; return true;
} else if (hss->storedIcmpReply == replyNo) { } else if (hss->storedIcmpReply == replyNo) {
/* This is a dunplicated icmp reply. */ /* This is a duplicated icmp reply. */
return false; return false;
} }
@@ -3295,7 +3295,7 @@ bool HostOsScan::get_tcpopt_string(struct tcp_hdr *tcp, int mss, char *result, i
* MSS, Sack Permitted, Timestamp with both value not zero, Nop, WScale with value 2 * MSS, Sack Permitted, Timestamp with both value not zero, Nop, WScale with value 2
*/ */
/* Be aware of the max increament value for p in parsing, /* Be aware of the max increment value for p in parsing,
* now is 5 = strlen("Mxxxx") <-> MSS Option * now is 5 = strlen("Mxxxx") <-> MSS Option
*/ */
while (length > 0 && (p - result) < (maxlen - 5)) { while (length > 0 && (p - result) < (maxlen - 5)) {
@@ -3708,7 +3708,7 @@ int OSScan::os_scan(std::vector<Target *> &Targets) {
if (ip6_targets.size() > 0) if (ip6_targets.size() > 0)
res6 = this->os_scan_ipv6(ip6_targets); res6 = this->os_scan_ipv6(ip6_targets);
/* If both scans were succesful, return OK */ /* If both scans were successful, return OK */
if (res4 == OP_SUCCESS && res6 == OP_SUCCESS) if (res4 == OP_SUCCESS && res6 == OP_SUCCESS)
return OP_SUCCESS; return OP_SUCCESS;
else else

2
osscan2.h
View File

@@ -293,7 +293,7 @@ class HostOsScanStats {
std::list<OFProbe *> probesActive; std::list<OFProbe *> probesActive;
/* A record of total number of probes that have been sent to this /* A record of total number of probes that have been sent to this
* host, including restranmited ones. */ * host, including retransmitted ones. */
unsigned int num_probes_sent; unsigned int num_probes_sent;
/* Delay between two probes. */ /* Delay between two probes. */
unsigned int sendDelayMs; unsigned int sendDelayMs;

10
output.cc
View File

@@ -2,7 +2,7 @@
/*************************************************************************** /***************************************************************************
* output.cc -- Handles the Nmap output system. This currently involves * * output.cc -- Handles the Nmap output system. This currently involves *
* console-style human readable output, XML output, Script |<iddi3 * * console-style human readable output, XML output, Script |<iddi3 *
* output, and the legacy greppable output (used to be called "machine * * output, and the legacy grepable output (used to be called "machine *
* readable"). I expect that future output forms (such as HTML) may be * * readable"). I expect that future output forms (such as HTML) may be *
* created by a different program, library, or script using the XML * * created by a different program, library, or script using the XML *
* output. * * output. *
@@ -529,7 +529,7 @@ static char *formatScriptOutput(ScriptResult sr) {
#endif /* NOLUA */ #endif /* NOLUA */
/* Prints the familiar Nmap tabular output showing the "interesting" /* Prints the familiar Nmap tabular output showing the "interesting"
ports found on the machine. It also handles the Machine/Greppable ports found on the machine. It also handles the Machine/Grepable
output and the XML output. It is pretty ugly -- in particular I output and the XML output. It is pretty ugly -- in particular I
should write helper functions to handle the table creation */ should write helper functions to handle the table creation */
void printportoutput(Target *currenths, PortList *plist) { void printportoutput(Target *currenths, PortList *plist) {
@@ -817,7 +817,7 @@ void printportoutput(Target *currenths, PortList *plist) {
#ifndef NOLUA #ifndef NOLUA
if (o.script) { if (o.script) {
ScriptResults::const_iterator ssr_iter; ScriptResults::const_iterator ssr_iter;
//Sort the results before outputing them on the screen //Sort the results before outputting them on the screen
current->scriptResults.sort(scriptid_lessthan); current->scriptResults.sort(scriptid_lessthan);
for (ssr_iter = current->scriptResults.begin(); for (ssr_iter = current->scriptResults.begin();
ssr_iter != current->scriptResults.end(); ssr_iter++) { ssr_iter != current->scriptResults.end(); ssr_iter++) {
@@ -939,7 +939,7 @@ char *logfilename(const char *str, struct tm *tm) {
/* This is the workhorse of the logging functions. Usually it is /* This is the workhorse of the logging functions. Usually it is
called through log_write(), but it can be called directly if you are dealing called through log_write(), but it can be called directly if you are dealing
with a vfprintf-style va_list. YOU MUST SANDWHICH EACH EXECUTION IF THIS CALL with a vfprintf-style va_list. YOU MUST SANDWICH EACH EXECUTION OF THIS CALL
BETWEEN va_start() AND va_end() calls. */ BETWEEN va_start() AND va_end() calls. */
void log_vwrite(int logt, const char *fmt, va_list ap) { void log_vwrite(int logt, const char *fmt, va_list ap) {
char *writebuf; char *writebuf;
@@ -2090,7 +2090,7 @@ void printserviceinfooutput(Target *currenths) {
// The following 2 lines (from portlist.h) tell us that we don't need to // The following 2 lines (from portlist.h) tell us that we don't need to
// worry about free()ing anything in the serviceDeductions struct. pass in // worry about free()ing anything in the serviceDeductions struct. pass in
// an allocated struct serviceDeductions (don't wory about initializing, and // an allocated struct serviceDeductions (don't worry about initializing, and
// you don't have to free any internal ptrs. // you don't have to free any internal ptrs.
currenths->ports.getServiceDeductions(p->portno, p->proto, &sd); currenths->ports.getServiceDeductions(p->portno, p->proto, &sd);

8
output.h
View File

@@ -2,7 +2,7 @@
/*************************************************************************** /***************************************************************************
* output.h -- Handles the Nmap output system. This currently involves * * output.h -- Handles the Nmap output system. This currently involves *
* console-style human readable output, XML output, Script |<iddi3 * * console-style human readable output, XML output, Script |<iddi3 *
* output, and the legacy greppable output (used to be called "machine * * output, and the legacy grepable output (used to be called "machine *
* readable"). I expect that future output forms (such as HTML) may be * * readable"). I expect that future output forms (such as HTML) may be *
* created by a different program, library, or script using the XML * * created by a different program, library, or script using the XML *
* output. * * output. *
@@ -132,7 +132,7 @@
#define OUTPUT_H #define OUTPUT_H
#define LOG_NUM_FILES 4 /* # of values that actual files (they must come first */ #define LOG_NUM_FILES 4 /* # of values that actual files (they must come first */
#define LOG_FILE_MASK 15 /* The mask for log typs in the file array */ #define LOG_FILE_MASK 15 /* The mask for log types in the file array */
#define LOG_NORMAL 1 #define LOG_NORMAL 1
#define LOG_MACHINE 2 #define LOG_MACHINE 2
#define LOG_SKID 4 #define LOG_SKID 4
@@ -177,7 +177,7 @@ void win32_fatal_raw_sockets(const char *devname);
#endif #endif
/* Prints the familiar Nmap tabular output showing the "interesting" /* Prints the familiar Nmap tabular output showing the "interesting"
ports found on the machine. It also handles the Machine/Greppable ports found on the machine. It also handles the Machine/Grepable
output and the XML output. It is pretty ugly -- in particular I output and the XML output. It is pretty ugly -- in particular I
should write helper functions to handle the table creation */ should write helper functions to handle the table creation */
void printportoutput(Target *currenths, PortList *plist); void printportoutput(Target *currenths, PortList *plist);
@@ -200,7 +200,7 @@ void log_write(int logt, const char *fmt, ...)
called through log_write(), but it can be called directly if you called through log_write(), but it can be called directly if you
are dealing with a vfprintf-style va_list. Unlike log_write, YOU are dealing with a vfprintf-style va_list. Unlike log_write, YOU
CAN ONLY CALL THIS WITH ONE LOG TYPE (not a bitmask full of them). CAN ONLY CALL THIS WITH ONE LOG TYPE (not a bitmask full of them).
In addition, YOU MUST SANDWHICH EACH EXECUTION IF THIS CALL BETWEEN In addition, YOU MUST SANDWICH EACH EXECUTION OF THIS CALL BETWEEN
va_start() AND va_end() calls. */ va_start() AND va_end() calls. */
void log_vwrite(int logt, const char *fmt, va_list ap); void log_vwrite(int logt, const char *fmt, va_list ap);

12
portlist.cc
View File

@@ -293,7 +293,7 @@ void serviceDeductions::populateFullVersionString(char *buf, size_t n) const {
strncat(dst, " ", spaceleft); strncat(dst, " ", spaceleft);
spaceleft--; spaceleft--;
} }
// This time we need to trucate inside of the () so we have spaceleft - 2 // This time we need to truncate inside of the () so we have spaceleft - 2
strncat(dst, "(", spaceleft); strncat(dst, "(", spaceleft);
if (spaceleft - 2 < strlen(extrainfo)) { if (spaceleft - 2 < strlen(extrainfo)) {
strncat(dst, extrainfo, spaceleft - 5); strncat(dst, extrainfo, spaceleft - 5);
@@ -567,7 +567,7 @@ int PortList::getPortState(u16 portno, u8 protocol) {
} }
/* Return true if nothing special is known about this port; i.e., it's in the /* Return true if nothing special is known about this port; i.e., it's in the
default state as defiend by setDefaultPortState and every other data field is default state as defined by setDefaultPortState and every other data field is
unset. */ unset. */
bool PortList::portIsDefault(u16 portno, u8 protocol) { bool PortList::portIsDefault(u16 portno, u8 protocol) {
return lookupPort(portno, protocol) == NULL; return lookupPort(portno, protocol) == NULL;
@@ -617,7 +617,7 @@ Port *PortList::nextPort(const Port *cur, Port *next,
if (cur) { if (cur) {
proto = INPROTO2PORTLISTPROTO(cur->proto); proto = INPROTO2PORTLISTPROTO(cur->proto);
assert(port_map[proto]!=NULL); // Hmm, it's not posible to handle port that doesn't have anything in map assert(port_map[proto]!=NULL); // Hmm, it's not possible to handle port that doesn't have anything in map
assert(cur->proto!=IPPROTO_IP || cur->portno<256); assert(cur->proto!=IPPROTO_IP || cur->portno<256);
mapped_pno = port_map[proto][cur->portno]; mapped_pno = port_map[proto][cur->portno];
mapped_pno++; // we're interested in next port after current mapped_pno++; // we're interested in next port after current
@@ -759,8 +759,8 @@ u16 *PortList::port_map[PORTLIST_PROTO_MAX];
u16 *PortList::port_map_rev[PORTLIST_PROTO_MAX]; u16 *PortList::port_map_rev[PORTLIST_PROTO_MAX];
int PortList::port_list_count[PORTLIST_PROTO_MAX]; int PortList::port_list_count[PORTLIST_PROTO_MAX];
/* This function must be runned before any PortList object is created. /* This function must be run before any PortList object is created.
* It must be runned for every used protocol. The data in "ports" * It must be run for every used protocol. The data in "ports"
* should be sorted. */ * should be sorted. */
void PortList::initializePortMap(int protocol, u16 *ports, int portcount) { void PortList::initializePortMap(int protocol, u16 *ports, int portcount) {
int i; int i;
@@ -789,7 +789,7 @@ void PortList::initializePortMap(int protocol, u16 *ports, int portcount) {
/* Cycles through the 0 or more "ignored" ports which should be /* Cycles through the 0 or more "ignored" ports which should be
consolidated for Nmap output. They are returned sorted by the consolidated for Nmap output. They are returned sorted by the
number of prots in the state, starting with the most common. It number of ports in the state, starting with the most common. It
should first be called with PORT_UNKNOWN to obtain the most popular should first be called with PORT_UNKNOWN to obtain the most popular
ignored state (if any). Then call with that state to get the next ignored state (if any). Then call with that state to get the next
most popular one. Returns the state if there is one, but returns most popular one. Returns the state if there is one, but returns

4
portlist.h
View File

@@ -278,7 +278,7 @@ class PortList {
// will be NULL if unavailable. Note that this function makes its // will be NULL if unavailable. Note that this function makes its
// own copy of sname and product/version/extrainfo. This function // own copy of sname and product/version/extrainfo. This function
// also takes care of truncating the version strings to a // also takes care of truncating the version strings to a
// 'reasonable' length if necessary, and cleaning up any unprinable // 'reasonable' length if necessary, and cleaning up any unprintable
// chars. (these tests are to avoid annoying DOS (or other) attacks // chars. (these tests are to avoid annoying DOS (or other) attacks
// by malicious services). The fingerprint should be NULL unless // by malicious services). The fingerprint should be NULL unless
// one is available and the user should submit it. tunnel must be // one is available and the user should submit it. tunnel must be
@@ -304,7 +304,7 @@ class PortList {
/* Cycles through the 0 or more "ignored" ports which should be /* Cycles through the 0 or more "ignored" ports which should be
consolidated for Nmap output. They are returned sorted by the consolidated for Nmap output. They are returned sorted by the
number of prots in the state, starting with the most common. It number of ports in the state, starting with the most common. It
should first be called with PORT_UNKNOWN to obtain the most popular should first be called with PORT_UNKNOWN to obtain the most popular
ignored state (if any). Then call with that state to get the next ignored state (if any). Then call with that state to get the next
most popular one. Returns the state if there is one, but returns most popular one. Returns the state if there is one, but returns

2
portreasons.cc
View File

@@ -422,7 +422,7 @@ static int update_state_summary(state_reason_summary_t *head, reason_t reason_id
return 0; return 0;
} }
/* Converts Port objects and their corrosponsing state_reason structures into /* Converts Port objects and their corresponding state_reason structures into
* state_reason_summary structures using update_state_summary */ * state_reason_summary structures using update_state_summary */
static unsigned int get_state_summary(state_reason_summary_t *head, PortList *Ports, int state) { static unsigned int get_state_summary(state_reason_summary_t *head, PortList *Ports, int state) {
Port *current = NULL; Port *current = NULL;

30
scan_engine.cc
View File

@@ -1,7 +1,7 @@
/*************************************************************************** /***************************************************************************
* scan_engine.cc -- Includes much of the "engine" functions for scanning, * * scan_engine.cc -- Includes much of the "engine" functions for scanning, *
* such as ultra_scan. It also includes dependant functions such as those * * such as ultra_scan. It also includes dependent functions such as those *
* for collecting SYN/connect scan responses. * * for collecting SYN/connect scan responses. *
* * * *
***********************IMPORTANT NMAP LICENSE TERMS************************ ***********************IMPORTANT NMAP LICENSE TERMS************************
@@ -287,7 +287,7 @@ public:
enum UPType { UP_UNSET, UP_IP, UP_CONNECT, UP_ARP, UP_ND } type; /* The type of probe this is */ enum UPType { UP_UNSET, UP_IP, UP_CONNECT, UP_ARP, UP_ND } type; /* The type of probe this is */
/* Sets this UltraProbe as type UP_IP and creates & initializes the /* Sets this UltraProbe as type UP_IP and creates & initializes the
internal IPProbe. The relevent probespec is necessary for setIP internal IPProbe. The relevant probespec is necessary for setIP
because pspec.type is ambiguous with just the ippacket (e.g. a because pspec.type is ambiguous with just the ippacket (e.g. a
tcp packet could be PS_PROTO or PS_TCP). */ tcp packet could be PS_PROTO or PS_TCP). */
void setIP(u8 *ippacket, u32 iplen, const probespec *pspec); void setIP(u8 *ippacket, u32 iplen, const probespec *pspec);
@@ -358,7 +358,7 @@ public:
} }
u8 tryno; /* Try (retransmission) number of this probe */ u8 tryno; /* Try (retransmission) number of this probe */
u8 pingseq; /* 0 if this is not a scanping. Otherwise a posative ping seq#. */ u8 pingseq; /* 0 if this is not a scanping. Otherwise a positive ping seq#. */
/* If true, probe is considered no longer active due to timeout, but it /* If true, probe is considered no longer active due to timeout, but it
may be kept around a while, just in case a reply comes late */ may be kept around a while, just in case a reply comes late */
bool timedout; bool timedout;
@@ -483,7 +483,7 @@ public:
HostScanStats(Target *t, UltraScanInfo *UltraSI); HostScanStats(Target *t, UltraScanInfo *UltraSI);
~HostScanStats(); ~HostScanStats();
int freshPortsLeft(); /* Returns the number of ports remaining to probe */ int freshPortsLeft(); /* Returns the number of ports remaining to probe */
int next_portidx; /* Index of the next port to probe in the relevent int next_portidx; /* Index of the next port to probe in the relevant
ports array in USI.ports */ ports array in USI.ports */
bool sent_arp; /* Has an ARP probe been sent for the target yet? */ bool sent_arp; /* Has an ARP probe been sent for the target yet? */
@@ -578,7 +578,7 @@ public:
probespec) that have met the current maximum tryno, and are on probespec) that have met the current maximum tryno, and are on
ice until that tryno increases (so we can retransmit again), or ice until that tryno increases (so we can retransmit again), or
solidifies (so we can mark the port firewalled or whatever). The solidifies (so we can mark the port firewalled or whatever). The
tryno of benh members is bench_tryno. If the maximum tryno tryno of bench members is bench_tryno. If the maximum tryno
increases, everyone on the bench is moved to the retry_stack. increases, everyone on the bench is moved to the retry_stack.
*/ */
std::vector<probespec> probe_bench; std::vector<probespec> probe_bench;
@@ -628,7 +628,7 @@ public:
and marking of remaining timedout ports firewalled or whatever is and marking of remaining timedout ports firewalled or whatever is
appropriate. If mayincrease is non-NULL, it is set to whether appropriate. If mayincrease is non-NULL, it is set to whether
the allowedTryno may increase again. If it is false, any probes the allowedTryno may increase again. If it is false, any probes
which have reached the given limit may be dealth with. */ which have reached the given limit may be dealt with. */
unsigned int allowedTryno(bool *capped, bool *mayincrease); unsigned int allowedTryno(bool *capped, bool *mayincrease);
@@ -910,7 +910,7 @@ void UltraProbe::setND(u8 *ndpkt, u32 ndlen) {
} }
/* Sets this UltraProbe as type UP_IP and creates & initializes the /* Sets this UltraProbe as type UP_IP and creates & initializes the
internal IPProbe. The relevent probespec is necessary for setIP internal IPProbe. The relevant probespec is necessary for setIP
because pspec.type is ambiguous with just the ippacket (e.g. a because pspec.type is ambiguous with just the ippacket (e.g. a
tcp packet could be PS_PROTO or PS_TCP). */ tcp packet could be PS_PROTO or PS_TCP). */
void UltraProbe::setIP(u8 *ippacket, u32 len, const probespec *pspec) { void UltraProbe::setIP(u8 *ippacket, u32 len, const probespec *pspec) {
@@ -1135,7 +1135,7 @@ bool GroupScanStats::sendOK(struct timeval *when) {
return false; return false;
/* We need to stop sending if it has been a long time since /* We need to stop sending if it has been a long time since
the last listen call, at least for systems such as Windoze that the last listen call, at least for systems such as Windows that
don't give us a proper pcap time. Also for connect scans, since don't give us a proper pcap time. Also for connect scans, since
we don't get an exact response time with them either. */ we don't get an exact response time with them either. */
recentsends = USI->gstats->probes_sent - USI->gstats->probes_sent_at_last_wait; recentsends = USI->gstats->probes_sent - USI->gstats->probes_sent_at_last_wait;
@@ -1465,7 +1465,7 @@ bool HostScanStats::nextTimeout(struct timeval *when) {
and marking of remaining timedout ports firewalled or whatever is and marking of remaining timedout ports firewalled or whatever is
appropriate. If mayincrease is non-NULL, it is set to whether appropriate. If mayincrease is non-NULL, it is set to whether
the allowedTryno may increase again. If it is false, any probes the allowedTryno may increase again. If it is false, any probes
which have reached the given limit may be dealth with. */ which have reached the given limit may be dealt with. */
unsigned int HostScanStats::allowedTryno(bool *capped, bool *mayincrease) { unsigned int HostScanStats::allowedTryno(bool *capped, bool *mayincrease) {
std::list<UltraProbe *>::iterator probeI; std::list<UltraProbe *>::iterator probeI;
UltraProbe *probe = NULL; UltraProbe *probe = NULL;
@@ -1747,7 +1747,7 @@ void UltraScanInfo::Init(std::vector<Target *> &Targets, struct scan_lists *pts,
rawsd = nmap_raw_socket(); rawsd = nmap_raw_socket();
if (rawsd < 0) if (rawsd < 0)
pfatal("socket troubles in %s", __func__); pfatal("socket troubles in %s", __func__);
/* We do not wan't to unblock the socket since we want to wait /* We do not want to unblock the socket since we want to wait
if kernel send buffers fill up rather than get ENOBUF, and if kernel send buffers fill up rather than get ENOBUF, and
we won't be receiving on the socket anyway we won't be receiving on the socket anyway
unblock_socket(rawsd);*/ unblock_socket(rawsd);*/
@@ -2824,7 +2824,7 @@ static bool ultrascan_port_pspec_update(UltraScanInfo *USI,
if (newstate != PORT_OPEN) { if (newstate != PORT_OPEN) {
if (noresp_open_scan) { if (noresp_open_scan) {
hss->target->ports.setPortState(portno, proto, newstate); hss->target->ports.setPortState(portno, proto, newstate);
} /* Otherwise The old open takes precendence */ } /* Otherwise The old open takes precedence */
} }
break; break;
case PORT_CLOSED: case PORT_CLOSED:
@@ -3202,7 +3202,7 @@ static UltraProbe *sendConnectScanProbe(UltraScanInfo *USI, HostScanStats *hss,
hss->num_probes_active++; hss->num_probes_active++;
/* It would be convenient if the connect() call would never succeed /* It would be convenient if the connect() call would never succeed
or permanantly fail here, so related code cood all be localized or permanently fail here, so related code cood all be localized
elsewhere. But the reality is that connect() MAY be finished now. */ elsewhere. But the reality is that connect() MAY be finished now. */
if (rc != -1) { if (rc != -1) {
@@ -4642,7 +4642,7 @@ static bool get_pcap_result(UltraScanInfo *USI, struct timeval *stime) {
/* UDP hdr, or TCP hdr up to seq #, or SCTP hdr up to vtag */ /* UDP hdr, or TCP hdr up to seq #, or SCTP hdr up to vtag */
((USI->tcp_scan || USI->udp_scan || USI->sctp_scan) && encaps_len < 8) ((USI->tcp_scan || USI->udp_scan || USI->sctp_scan) && encaps_len < 8)
/* prot scan has no headers coming back, so we don't reserve the /* prot scan has no headers coming back, so we don't reserve the
8 xtra bytes */ 8 extra bytes */
) { ) {
if (o.debugging) if (o.debugging)
error("Received short ICMP packet (%u bytes)", datalen); error("Received short ICMP packet (%u bytes)", datalen);
@@ -4771,7 +4771,7 @@ static bool get_pcap_result(UltraScanInfo *USI, struct timeval *stime) {
/* UDP hdr, or TCP hdr up to seq #, or SCTP hdr up to vtag */ /* UDP hdr, or TCP hdr up to seq #, or SCTP hdr up to vtag */
((USI->tcp_scan || USI->udp_scan || USI->sctp_scan) && encaps_len < 8) ((USI->tcp_scan || USI->udp_scan || USI->sctp_scan) && encaps_len < 8)
/* prot scan has no headers coming back, so we don't reserve the /* prot scan has no headers coming back, so we don't reserve the
8 xtra bytes */ 8 extra bytes */
) { ) {
if (o.debugging) if (o.debugging)
error("Received short ICMPv6 packet (%u bytes)", datalen); error("Received short ICMPv6 packet (%u bytes)", datalen);
@@ -5161,7 +5161,7 @@ static int get_ping_pcap_result(UltraScanInfo *USI, struct timeval *stime) {
/* UDP hdr, or TCP hdr up to seq #, or SCTP hdr up to vtag */ /* UDP hdr, or TCP hdr up to seq #, or SCTP hdr up to vtag */
((USI->tcp_scan || USI->udp_scan || USI->sctp_scan) && encaps_len < 8) ((USI->tcp_scan || USI->udp_scan || USI->sctp_scan) && encaps_len < 8)
/* prot scan has no headers coming back, so we don't reserve the /* prot scan has no headers coming back, so we don't reserve the
8 xtra bytes */ 8 extra bytes */
) { ) {
if (o.debugging) if (o.debugging)
error("Received short ICMP or ICMPv6 packet (%u bytes)", datalen); error("Received short ICMP or ICMPv6 packet (%u bytes)", datalen);

24
service_scan.cc
View File

@@ -429,7 +429,7 @@ void ServiceProbeMatch::InitMatch(const char *matchtext, int lineno) {
// The next part is a perl style regular expression specifier, like: // The next part is a perl style regular expression specifier, like:
// m/^220 .*smtp/i Where 'm' means a normal regular expressions is // m/^220 .*smtp/i Where 'm' means a normal regular expressions is
// used, the char after m can be anything (within reason, slash in // used, the char after m can be anything (within reason, slash in
// this case) and tells us what delieates the end of the regex. // this case) and tells us what delineates the end of the regex.
// After the delineating character are any single-character // After the delineating character are any single-character
// options. ('i' means "case insensitive", 's' means that . matches // options. ('i' means "case insensitive", 's' means that . matches
// newlines (both are just as in perl) // newlines (both are just as in perl)
@@ -517,9 +517,9 @@ void ServiceProbeMatch::InitMatch(const char *matchtext, int lineno) {
// ServiceProbeMatch, returns the details of the match (service // ServiceProbeMatch, returns the details of the match (service
// name, version number if applicable, and whether this is a "soft" // name, version number if applicable, and whether this is a "soft"
// match. If the buf doesn't match, the serviceName field in the // match. If the buf doesn't match, the serviceName field in the
// structure will be NULL. The MatchDetails sructure returned is // structure will be NULL. The MatchDetails structure returned is
// only valid until the next time this function is called. The only // only valid until the next time this function is called. The only
// exception is that the serviceName field can be saved throughought // exception is that the serviceName field can be saved throughout
// program execution. If no version matched, that field will be // program execution. If no version matched, that field will be
// NULL. // NULL.
const struct MatchDetails *ServiceProbeMatch::testMatch(const u8 *buf, int buflen) { const struct MatchDetails *ServiceProbeMatch::testMatch(const u8 *buf, int buflen) {
@@ -1397,7 +1397,7 @@ int AllProbes::check_excluded_port(unsigned short portno, int proto)
// If the buf doesn't match, the serviceName field in the structure // If the buf doesn't match, the serviceName field in the structure
// will be NULL. The MatchDetails returned is only valid until the // will be NULL. The MatchDetails returned is only valid until the
// next time this function is called. The only exception is that the // next time this function is called. The only exception is that the
// serviceName field can be saved throughought program execution. If // serviceName field can be saved throughout program execution. If
// no version matched, that field will be NULL. This function may // no version matched, that field will be NULL. This function may
// return NULL if there are no match lines at all in this probe. // return NULL if there are no match lines at all in this probe.
const struct MatchDetails *ServiceProbe::testMatch(const u8 *buf, int buflen, int n = 0) { const struct MatchDetails *ServiceProbe::testMatch(const u8 *buf, int buflen, int n = 0) {
@@ -1996,7 +1996,7 @@ static void startNextProbe(nsock_pool nsp, nsock_iod nsi, ServiceGroup *SG,
end_svcprobe(nsp, (svc->softMatchFound)? PROBESTATE_FINISHED_SOFTMATCHED : PROBESTATE_FINISHED_NOMATCH, SG, svc, NULL); end_svcprobe(nsp, (svc->softMatchFound)? PROBESTATE_FINISHED_SOFTMATCHED : PROBESTATE_FINISHED_NOMATCH, SG, svc, NULL);
} }
} else { } else {
// The finisehd probe was not a NULL probe. So we close the // The finished probe was not a NULL probe. So we close the
// connection, and if further probes are available, we launch the // connection, and if further probes are available, we launch the
// next one. // next one.
if (!isInitial) if (!isInitial)
@@ -2059,7 +2059,7 @@ static void startNextProbe(nsock_pool nsp, nsock_iod nsi, ServiceGroup *SG,
should end the service with its successful match. If the tunnel should end the service with its successful match. If the tunnel
results can be determined with no more effort, 0 is also returned. results can be determined with no more effort, 0 is also returned.
For example, a service that already matched as "ssl/ldap" will be For example, a service that already matched as "ssl/ldap" will be
chaned to "ldap" with the tunnel being SSL and 0 will be returned. changed to "ldap" with the tunnel being SSL and 0 will be returned.
That is a special case. That is a special case.
*/ */
@@ -2299,7 +2299,7 @@ static void servicescan_connect_handler(nsock_pool nsp, nsock_event nse, void *m
break; break;
case NSE_STATUS_KILL: case NSE_STATUS_KILL:
/* User probablby specified host_timeout and so the service scan is /* User probably specified host_timeout and so the service scan is
* shutting down */ * shutting down */
end_svcprobe(nsp, PROBESTATE_INCOMPLETE, SG, svc, nsi); end_svcprobe(nsp, PROBESTATE_INCOMPLETE, SG, svc, nsi);
return; return;
@@ -2308,7 +2308,7 @@ static void servicescan_connect_handler(nsock_pool nsp, nsock_event nse, void *m
fatal("Unexpected nsock status (%d) returned for connection attempt", (int)status); fatal("Unexpected nsock status (%d) returned for connection attempt", (int)status);
} }
} }
// We may have room for more pr0bes! // We may have room for more probes!
launchSomeServiceProbes(nsp, SG); launchSomeServiceProbes(nsp, SG);
return; return;
} }
@@ -2340,7 +2340,7 @@ static void servicescan_write_handler(nsock_pool nsp, nsock_event nse, void *myd
return; return;
if (status == NSE_STATUS_KILL) { if (status == NSE_STATUS_KILL) {
/* User probablby specified host_timeout and so the service scan is /* User probably specified host_timeout and so the service scan is
shutting down */ shutting down */
end_svcprobe(nsp, PROBESTATE_INCOMPLETE, SG, svc, nsi); end_svcprobe(nsp, PROBESTATE_INCOMPLETE, SG, svc, nsi);
return; return;
@@ -2357,7 +2357,7 @@ static void servicescan_write_handler(nsock_pool nsp, nsock_event nse, void *myd
error("Got nsock WRITE response with status %s - aborting this service", nse_status2str(status)); error("Got nsock WRITE response with status %s - aborting this service", nse_status2str(status));
end_svcprobe(nsp, PROBESTATE_INCOMPLETE, SG, svc, nsi); end_svcprobe(nsp, PROBESTATE_INCOMPLETE, SG, svc, nsi);
// We may have room for more pr0bes! // We may have room for more probes!
launchSomeServiceProbes(nsp, SG); launchSomeServiceProbes(nsp, SG);
return; return;
@@ -2537,7 +2537,7 @@ static void servicescan_read_handler(nsock_pool nsp, nsock_event nse, void *myda
socket_strerror(err)); socket_strerror(err));
} }
} else if (status == NSE_STATUS_KILL) { } else if (status == NSE_STATUS_KILL) {
/* User probablby specified host_timeout and so the service scan is /* User probably specified host_timeout and so the service scan is
shutting down */ shutting down */
end_svcprobe(nsp, PROBESTATE_INCOMPLETE, SG, svc, nsi); end_svcprobe(nsp, PROBESTATE_INCOMPLETE, SG, svc, nsi);
return; return;
@@ -2545,7 +2545,7 @@ static void servicescan_read_handler(nsock_pool nsp, nsock_event nse, void *myda
fatal("Unexpected status (%d) in NSE_TYPE_READ callback.", (int) status); fatal("Unexpected status (%d) in NSE_TYPE_READ callback.", (int) status);
} }
// We may have room for more pr0bes! // We may have room for more probes!
launchSomeServiceProbes(nsp, SG); launchSomeServiceProbes(nsp, SG);
return; return;
} }

6
service_scan.h
View File

@@ -161,7 +161,7 @@ struct MatchDetails {
// The line number of this match in nmap-service-probes. // The line number of this match in nmap-service-probes.
int lineno; int lineno;
// The product/verson/info for the service that was matched (Or NULL) // The product/version/info for the service that was matched (Or NULL)
// zero-terminated. // zero-terminated.
const char *product; const char *product;
const char *version; const char *version;
@@ -199,7 +199,7 @@ class ServiceProbeMatch {
// match. If the buf doesn't match, the serviceName field in the // match. If the buf doesn't match, the serviceName field in the
// structure will be NULL. The MatchDetails returned is only valid // structure will be NULL. The MatchDetails returned is only valid
// until the next time this function is called. The only exception // until the next time this function is called. The only exception
// is that the serviceName field can be saved throughought program // is that the serviceName field can be saved throughout program
// execution. If no version matched, that field will be NULL. // execution. If no version matched, that field will be NULL.
const struct MatchDetails *testMatch(const u8 *buf, int buflen); const struct MatchDetails *testMatch(const u8 *buf, int buflen);
// Returns the service name this matches // Returns the service name this matches
@@ -327,7 +327,7 @@ class ServiceProbe {
// If the buf doesn't match, the serviceName field in the structure // If the buf doesn't match, the serviceName field in the structure
// will be NULL. The MatchDetails returned is only valid until the // will be NULL. The MatchDetails returned is only valid until the
// next time this function is called. The only exception is that the // next time this function is called. The only exception is that the
// serviceName field can be saved throughought program execution. If // serviceName field can be saved throughout program execution. If
// no version matched, that field will be NULL. This function may // no version matched, that field will be NULL. This function may
// return NULL if there are no match lines at all in this probe. // return NULL if there are no match lines at all in this probe.
const struct MatchDetails *testMatch(const u8 *buf, int buflen, int n); const struct MatchDetails *testMatch(const u8 *buf, int buflen, int n);

2
struct_ip.h
View File

@@ -73,7 +73,7 @@ struct ip
u_short ip_id; /* identification */ u_short ip_id; /* identification */
u_short ip_off; /* fragment offset field */ u_short ip_off; /* fragment offset field */
#define IP_RF 0x8000 /* reserved fragment flag */ #define IP_RF 0x8000 /* reserved fragment flag */
#define IP_DF 0x4000 /* dont fragment flag */ #define IP_DF 0x4000 /* don't fragment flag */
#define IP_MF 0x2000 /* more fragments flag */ #define IP_MF 0x2000 /* more fragments flag */
#define IP_OFFMASK 0x1fff /* mask for fragmenting bits */ #define IP_OFFMASK 0x1fff /* mask for fragmenting bits */
u_int8_t ip_ttl; /* time to live */ u_int8_t ip_ttl; /* time to live */

2
tcpip.cc
View File

@@ -2083,7 +2083,7 @@ void broadcast_socket(int sd) {
len) into buf . Give up after 'seconds'. Returns the number of len) into buf . Give up after 'seconds'. Returns the number of
bytes read (or -1 in the case of an error. It only does one recv bytes read (or -1 in the case of an error. It only does one recv
(it will not keep going until len bytes are read). If timedout is (it will not keep going until len bytes are read). If timedout is
not NULL, it will be set to zero (no timeout occured) or 1 (it not NULL, it will be set to zero (no timeout occurred) or 1 (it
did). */ did). */
int recvtime(int sd, char *buf, int len, int seconds, int *timedout) { int recvtime(int sd, char *buf, int len, int seconds, int *timedout) {

8
tcpip.h
View File

@@ -459,7 +459,7 @@ u8 *build_igmp_raw(const struct in_addr *source, const struct in_addr *victim,
const char *data, u16 datalen, u32 *packetlen); const char *data, u16 datalen, u32 *packetlen);
// Returns whether the packet receive time value obtaned from libpcap // Returns whether the packet receive time value obtained from libpcap
// (and thus by readip_pcap()) should be considered valid. When // (and thus by readip_pcap()) should be considered valid. When
// invalid (Windows and Amiga), readip_pcap returns the time you called it. // invalid (Windows and Amiga), readip_pcap returns the time you called it.
bool pcap_recv_timeval_valid(); bool pcap_recv_timeval_valid();
@@ -520,7 +520,7 @@ bool getNextHopMAC(const char *iface, const u8 *srcmac, const struct sockaddr_st
int get_link_offset(char *device); int get_link_offset(char *device);
/* If rcvdtime is non-null and a packet is returned, rcvd will be /* If rcvdtime is non-null and a packet is returned, rcvd will be
filled with the time that packet was captured from the wire by filled with the time that packet was captured from the wire by
pcap. If linknfo is not NULL, lnknfo->headerlen and pcap. If linknfo is not NULL, lnkinfo->headerlen and
lnkinfo->header will be filled with the appropriate values. */ lnkinfo->header will be filled with the appropriate values. */
char *readipv4_pcap(pcap_t *pd, unsigned int *len, long to_usec, char *readipv4_pcap(pcap_t *pd, unsigned int *len, long to_usec,
struct timeval *rcvdtime, struct link_header *linknfo, bool validate); struct timeval *rcvdtime, struct link_header *linknfo, bool validate);
@@ -537,7 +537,7 @@ int read_na_pcap(pcap_t *pd, u8 *sendermac, struct sockaddr_in6 *senderIP, long
and returns 1. If it times out and reads no arp requests, returns and returns 1. If it times out and reads no arp requests, returns
0. to_usec is the timeout period in microseconds. Use 0 to avoid 0. to_usec is the timeout period in microseconds. Use 0 to avoid
blocking to the extent possible, and -1 to block forever. Returns blocking to the extent possible, and -1 to block forever. Returns
-1 or exits if ther is an error. */ -1 or exits if there is an error. */
int read_arp_reply_pcap(pcap_t *pd, u8 *sendermac, struct in_addr *senderIP, int read_arp_reply_pcap(pcap_t *pd, u8 *sendermac, struct in_addr *senderIP,
long to_usec, struct timeval *rcvdtime); long to_usec, struct timeval *rcvdtime);
@@ -563,7 +563,7 @@ void broadcast_socket(int sd);
len) into buf . Give up after 'seconds'. Returns the number of len) into buf . Give up after 'seconds'. Returns the number of
bytes read (or -1 in the case of an error. It only does one recv bytes read (or -1 in the case of an error. It only does one recv
(it will not keep going until len bytes are read). If timedout is (it will not keep going until len bytes are read). If timedout is
not NULL, it will be set to zero (no timeout occured) or 1 (it not NULL, it will be set to zero (no timeout occurred) or 1 (it
did). */ did). */
int recvtime(int sd, char *buf, int len, int seconds, int *timedout); int recvtime(int sd, char *buf, int len, int seconds, int *timedout);