mirror of
https://github.com/nmap/nmap.git
synced 2026-01-05 22:19:03 +00:00
Re-indent some NSE libraries.
https://secwiki.org/w/Nmap/Code_Standards
This commit is contained in:
dmiller
@@ -16,229 +16,229 @@ _ENV = stdnse.module("sslcert", stdnse.seeall)
|
||||
|
||||
StartTLS = {
|
||||
|
||||
ftp_prepare_tls_without_reconnect = function(host, port)
|
||||
local s = nmap.new_socket()
|
||||
-- Attempt to negotiate TLS over FTP for services that support it
|
||||
-- Works for FTP (21)
|
||||
ftp_prepare_tls_without_reconnect = function(host, port)
|
||||
local s = nmap.new_socket()
|
||||
-- Attempt to negotiate TLS over FTP for services that support it
|
||||
-- Works for FTP (21)
|
||||
|
||||
-- Open a standard TCP socket
|
||||
local status, error = s:connect(host, port, "tcp")
|
||||
local result
|
||||
if not status then
|
||||
return false, "Failed to connect to FTP server"
|
||||
else
|
||||
-- Open a standard TCP socket
|
||||
local status, error = s:connect(host, port, "tcp")
|
||||
local result
|
||||
if not status then
|
||||
return false, "Failed to connect to FTP server"
|
||||
else
|
||||
|
||||
-- Loop until the service presents a banner to deal with server
|
||||
-- load and timing issues. There may be a better way to handle this.
|
||||
local i = 0
|
||||
repeat
|
||||
status, result = s:receive_lines(1)
|
||||
i = i + 1
|
||||
until string.match(result, "^220") or i == 5
|
||||
-- Loop until the service presents a banner to deal with server
|
||||
-- load and timing issues. There may be a better way to handle this.
|
||||
local i = 0
|
||||
repeat
|
||||
status, result = s:receive_lines(1)
|
||||
i = i + 1
|
||||
until string.match(result, "^220") or i == 5
|
||||
|
||||
-- Send AUTH TLS command, ask the service to start encryption
|
||||
local query = "AUTH TLS\r\n"
|
||||
status = s:send(query)
|
||||
status, result = s:receive_lines(1)
|
||||
-- Send AUTH TLS command, ask the service to start encryption
|
||||
local query = "AUTH TLS\r\n"
|
||||
status = s:send(query)
|
||||
status, result = s:receive_lines(1)
|
||||
|
||||
if not (string.match(result, "^234")) then
|
||||
stdnse.print_debug("1","%s",result)
|
||||
stdnse.print_debug("1","AUTH TLS failed or unavailable. Enable --script-trace to see what is happening.")
|
||||
if not (string.match(result, "^234")) then
|
||||
stdnse.print_debug("1","%s",result)
|
||||
stdnse.print_debug("1","AUTH TLS failed or unavailable. Enable --script-trace to see what is happening.")
|
||||
|
||||
-- Send QUIT to clean up server side connection
|
||||
local query = "QUIT\r\n"
|
||||
status = s:send(query)
|
||||
result = ""
|
||||
-- Send QUIT to clean up server side connection
|
||||
local query = "QUIT\r\n"
|
||||
status = s:send(query)
|
||||
result = ""
|
||||
|
||||
return false, "Failed to connect to FTP server"
|
||||
end
|
||||
end
|
||||
-- Should have a solid TLS over FTP session now...
|
||||
return true, s
|
||||
end,
|
||||
return false, "Failed to connect to FTP server"
|
||||
end
|
||||
end
|
||||
-- Should have a solid TLS over FTP session now...
|
||||
return true, s
|
||||
end,
|
||||
|
||||
ftp_prepare_tls = function(host, port)
|
||||
local err
|
||||
local status, s = StartTLS.ftp_prepare_tls_without_reconnect(host, port)
|
||||
if status then
|
||||
status,err = s:reconnect_ssl()
|
||||
if not status then
|
||||
stdnse.print_debug("1","Could not establish SSL session after STARTTLS command.")
|
||||
s:close()
|
||||
return false, "Failed to connect to SMTP server"
|
||||
else
|
||||
return true,s
|
||||
end
|
||||
end
|
||||
return false, "Failed to connect to FTP server"
|
||||
end,
|
||||
ftp_prepare_tls = function(host, port)
|
||||
local err
|
||||
local status, s = StartTLS.ftp_prepare_tls_without_reconnect(host, port)
|
||||
if status then
|
||||
status,err = s:reconnect_ssl()
|
||||
if not status then
|
||||
stdnse.print_debug("1","Could not establish SSL session after STARTTLS command.")
|
||||
s:close()
|
||||
return false, "Failed to connect to SMTP server"
|
||||
else
|
||||
return true,s
|
||||
end
|
||||
end
|
||||
return false, "Failed to connect to FTP server"
|
||||
end,
|
||||
|
||||
smtp_prepare_tls_without_reconnect = function(host, port)
|
||||
local s = nmap.new_socket()
|
||||
-- Attempt to negotiate TLS over SMTP for services that support it
|
||||
-- Works for SMTP (25) and SMTP Submission (587)
|
||||
smtp_prepare_tls_without_reconnect = function(host, port)
|
||||
local s = nmap.new_socket()
|
||||
-- Attempt to negotiate TLS over SMTP for services that support it
|
||||
-- Works for SMTP (25) and SMTP Submission (587)
|
||||
|
||||
-- Open a standard TCP socket
|
||||
local status, error = s:connect(host, port, "tcp")
|
||||
-- Open a standard TCP socket
|
||||
local status, error = s:connect(host, port, "tcp")
|
||||
|
||||
if not status then
|
||||
return nil
|
||||
else
|
||||
local resultEHLO
|
||||
-- Loop until the service presents a banner to deal with server
|
||||
-- load and timing issues. There may be a better way to handle this.
|
||||
local i = 0
|
||||
repeat
|
||||
status, resultEHLO = s:receive_lines(1)
|
||||
i = i + 1
|
||||
until string.match(resultEHLO, "^220") or i == 5
|
||||
if not status then
|
||||
return nil
|
||||
else
|
||||
local resultEHLO
|
||||
-- Loop until the service presents a banner to deal with server
|
||||
-- load and timing issues. There may be a better way to handle this.
|
||||
local i = 0
|
||||
repeat
|
||||
status, resultEHLO = s:receive_lines(1)
|
||||
i = i + 1
|
||||
until string.match(resultEHLO, "^220") or i == 5
|
||||
|
||||
-- Send EHLO because the the server expects it
|
||||
-- We are not going to check for STARTTLS in the capabilities
|
||||
-- list, sometimes it is not advertised.
|
||||
local query = "EHLO example.org\r\n"
|
||||
status = s:send(query)
|
||||
status, resultEHLO = s:receive_lines(1)
|
||||
-- Send EHLO because the the server expects it
|
||||
-- We are not going to check for STARTTLS in the capabilities
|
||||
-- list, sometimes it is not advertised.
|
||||
local query = "EHLO example.org\r\n"
|
||||
status = s:send(query)
|
||||
status, resultEHLO = s:receive_lines(1)
|
||||
|
||||
if not (string.match(resultEHLO, "^250")) then
|
||||
stdnse.print_debug("1","%s",resultEHLO)
|
||||
stdnse.print_debug("1","EHLO with errors or timeout. Enable --script-trace to see what is happening.")
|
||||
return false, "Failed to connect to SMTP server"
|
||||
end
|
||||
if not (string.match(resultEHLO, "^250")) then
|
||||
stdnse.print_debug("1","%s",resultEHLO)
|
||||
stdnse.print_debug("1","EHLO with errors or timeout. Enable --script-trace to see what is happening.")
|
||||
return false, "Failed to connect to SMTP server"
|
||||
end
|
||||
|
||||
resultEHLO = ""
|
||||
resultEHLO = ""
|
||||
|
||||
-- Send STARTTLS command ask the service to start encryption
|
||||
local query = "STARTTLS\r\n"
|
||||
status = s:send(query)
|
||||
status, resultEHLO = s:receive_lines(1)
|
||||
-- Send STARTTLS command ask the service to start encryption
|
||||
local query = "STARTTLS\r\n"
|
||||
status = s:send(query)
|
||||
status, resultEHLO = s:receive_lines(1)
|
||||
|
||||
if not (string.match(resultEHLO, "^220")) then
|
||||
stdnse.print_debug("1","%s",resultEHLO)
|
||||
stdnse.print_debug("1","STARTTLS failed or unavailable. Enable --script-trace to see what is happening.")
|
||||
if not (string.match(resultEHLO, "^220")) then
|
||||
stdnse.print_debug("1","%s",resultEHLO)
|
||||
stdnse.print_debug("1","STARTTLS failed or unavailable. Enable --script-trace to see what is happening.")
|
||||
|
||||
-- Send QUIT to clean up server side connection
|
||||
local query = "QUIT\r\n"
|
||||
status = s:send(query)
|
||||
resultEHLO = ""
|
||||
-- Send QUIT to clean up server side connection
|
||||
local query = "QUIT\r\n"
|
||||
status = s:send(query)
|
||||
resultEHLO = ""
|
||||
|
||||
return false, "Failed to connect to SMTP server"
|
||||
end
|
||||
end
|
||||
-- Should have a solid TLS over SMTP session now...
|
||||
return true, s
|
||||
end,
|
||||
return false, "Failed to connect to SMTP server"
|
||||
end
|
||||
end
|
||||
-- Should have a solid TLS over SMTP session now...
|
||||
return true, s
|
||||
end,
|
||||
|
||||
smtp_prepare_tls = function(host, port)
|
||||
local err
|
||||
local status,s = StartTLS.smtp_prepare_tls_without_reconnect(host, port)
|
||||
if status then
|
||||
status,err = s:reconnect_ssl()
|
||||
if not status then
|
||||
stdnse.print_debug("1","Could not establish SSL session after STARTTLS command.")
|
||||
s:close()
|
||||
return false, "Failed to connect to SMTP server"
|
||||
else
|
||||
return true,s
|
||||
end
|
||||
end
|
||||
return false, "Failed to connect to SMTP server"
|
||||
end,
|
||||
smtp_prepare_tls = function(host, port)
|
||||
local err
|
||||
local status,s = StartTLS.smtp_prepare_tls_without_reconnect(host, port)
|
||||
if status then
|
||||
status,err = s:reconnect_ssl()
|
||||
if not status then
|
||||
stdnse.print_debug("1","Could not establish SSL session after STARTTLS command.")
|
||||
s:close()
|
||||
return false, "Failed to connect to SMTP server"
|
||||
else
|
||||
return true,s
|
||||
end
|
||||
end
|
||||
return false, "Failed to connect to SMTP server"
|
||||
end,
|
||||
|
||||
xmpp_prepare_tls_without_reconnect = function(host,port)
|
||||
local sock,status,err,result
|
||||
local xmppStreamStart = string.format("<?xml version='1.0' ?>\r\n<stream:stream xmlns:stream='http://etherx.jabber.org/streams' xmlns='jabber:client' to='%s' version='1.0'>\r\n",host.name)
|
||||
local xmppStartTLS = "<starttls xmlns='urn:ietf:params:xml:ns:xmpp-tls'/>\r\n"
|
||||
sock = nmap.new_socket()
|
||||
sock:set_timeout(5000)
|
||||
status, err = sock:connect(host, port)
|
||||
if not status then
|
||||
sock:close()
|
||||
stdnse.print_debug("Can't send: %s", err)
|
||||
return false, "Failed to connect to XMPP server"
|
||||
end
|
||||
status, err = sock:send(xmppStreamStart)
|
||||
if not status then
|
||||
stdnse.print_debug("Couldn't send: %s", err)
|
||||
sock:close()
|
||||
return false, "Failed to connect to XMPP server"
|
||||
end
|
||||
status, result = sock:receive()
|
||||
if not status then
|
||||
stdnse.print_debug("Couldn't receive: %s", err)
|
||||
sock:close()
|
||||
return false, "Failed to connect to XMPP server"
|
||||
end
|
||||
status, err = sock:send(xmppStartTLS)
|
||||
if not status then
|
||||
stdnse.print_debug("Couldn't send: %s", err)
|
||||
sock:close()
|
||||
return false, "Failed to connect to XMPP server"
|
||||
end
|
||||
status, result = sock:receive()
|
||||
if not status then
|
||||
stdnse.print_debug("Couldn't receive: %s", err)
|
||||
sock:close()
|
||||
return false, "Failed to connect to XMPP server"
|
||||
end
|
||||
if string.find(result,"proceed") then
|
||||
return true,sock
|
||||
end
|
||||
xmpp_prepare_tls_without_reconnect = function(host,port)
|
||||
local sock,status,err,result
|
||||
local xmppStreamStart = string.format("<?xml version='1.0' ?>\r\n<stream:stream xmlns:stream='http://etherx.jabber.org/streams' xmlns='jabber:client' to='%s' version='1.0'>\r\n",host.name)
|
||||
local xmppStartTLS = "<starttls xmlns='urn:ietf:params:xml:ns:xmpp-tls'/>\r\n"
|
||||
sock = nmap.new_socket()
|
||||
sock:set_timeout(5000)
|
||||
status, err = sock:connect(host, port)
|
||||
if not status then
|
||||
sock:close()
|
||||
stdnse.print_debug("Can't send: %s", err)
|
||||
return false, "Failed to connect to XMPP server"
|
||||
end
|
||||
status, err = sock:send(xmppStreamStart)
|
||||
if not status then
|
||||
stdnse.print_debug("Couldn't send: %s", err)
|
||||
sock:close()
|
||||
return false, "Failed to connect to XMPP server"
|
||||
end
|
||||
status, result = sock:receive()
|
||||
if not status then
|
||||
stdnse.print_debug("Couldn't receive: %s", err)
|
||||
sock:close()
|
||||
return false, "Failed to connect to XMPP server"
|
||||
end
|
||||
status, err = sock:send(xmppStartTLS)
|
||||
if not status then
|
||||
stdnse.print_debug("Couldn't send: %s", err)
|
||||
sock:close()
|
||||
return false, "Failed to connect to XMPP server"
|
||||
end
|
||||
status, result = sock:receive()
|
||||
if not status then
|
||||
stdnse.print_debug("Couldn't receive: %s", err)
|
||||
sock:close()
|
||||
return false, "Failed to connect to XMPP server"
|
||||
end
|
||||
if string.find(result,"proceed") then
|
||||
return true,sock
|
||||
end
|
||||
|
||||
status, result = sock:receive() -- might not be in the first reply
|
||||
if not status then
|
||||
stdnse.print_debug("Couldn't receive: %s", err)
|
||||
sock:close()
|
||||
return false, "Failed to connect to XMPP server"
|
||||
end
|
||||
if string.find(result,"proceed") then
|
||||
return true,sock
|
||||
else
|
||||
return false, "Failed to connect to XMPP server"
|
||||
end
|
||||
end,
|
||||
status, result = sock:receive() -- might not be in the first reply
|
||||
if not status then
|
||||
stdnse.print_debug("Couldn't receive: %s", err)
|
||||
sock:close()
|
||||
return false, "Failed to connect to XMPP server"
|
||||
end
|
||||
if string.find(result,"proceed") then
|
||||
return true,sock
|
||||
else
|
||||
return false, "Failed to connect to XMPP server"
|
||||
end
|
||||
end,
|
||||
|
||||
xmpp_prepare_tls = function(host, port)
|
||||
local ls = xmpp.XMPP:new(host, port, { starttls = true } )
|
||||
ls.socket = nmap.new_socket()
|
||||
ls.socket:set_timeout(ls.options.timeout * 1000)
|
||||
xmpp_prepare_tls = function(host, port)
|
||||
local ls = xmpp.XMPP:new(host, port, { starttls = true } )
|
||||
ls.socket = nmap.new_socket()
|
||||
ls.socket:set_timeout(ls.options.timeout * 1000)
|
||||
|
||||
local status, err = ls.socket:connect(host, port)
|
||||
if not status then
|
||||
return nil
|
||||
end
|
||||
local status, err = ls.socket:connect(host, port)
|
||||
if not status then
|
||||
return nil
|
||||
end
|
||||
|
||||
status, err = ls:connect()
|
||||
if not(status) then
|
||||
return false, "Failed to connected"
|
||||
end
|
||||
return true, ls.socket
|
||||
end
|
||||
status, err = ls:connect()
|
||||
if not(status) then
|
||||
return false, "Failed to connected"
|
||||
end
|
||||
return true, ls.socket
|
||||
end
|
||||
}
|
||||
|
||||
-- A table mapping port numbers to specialized SSL negotiation functions.
|
||||
local SPECIALIZED_PREPARE_TLS = {
|
||||
[21] = StartTLS.ftp_prepare_tls,
|
||||
[25] = StartTLS.smtp_prepare_tls,
|
||||
[587] = StartTLS.smtp_prepare_tls,
|
||||
[5222] = StartTLS.xmpp_prepare_tls,
|
||||
[5269] = StartTLS.xmpp_prepare_tls
|
||||
[21] = StartTLS.ftp_prepare_tls,
|
||||
[25] = StartTLS.smtp_prepare_tls,
|
||||
[587] = StartTLS.smtp_prepare_tls,
|
||||
[5222] = StartTLS.xmpp_prepare_tls,
|
||||
[5269] = StartTLS.xmpp_prepare_tls
|
||||
}
|
||||
|
||||
local SPECIALIZED_PREPARE_TLS_WITHOUT_RECONNECT = {
|
||||
[21] = StartTLS.ftp_prepare_tls_without_reconnect,
|
||||
[25] = StartTLS.smtp_prepare_tls_without_reconnect,
|
||||
[587] = StartTLS.smtp_prepare_tls_without_reconnect,
|
||||
[5222] = StartTLS.xmpp_prepare_tls_without_reconnect,
|
||||
[5269] = StartTLS.xmpp_prepare_tls_without_reconnect
|
||||
[21] = StartTLS.ftp_prepare_tls_without_reconnect,
|
||||
[25] = StartTLS.smtp_prepare_tls_without_reconnect,
|
||||
[587] = StartTLS.smtp_prepare_tls_without_reconnect,
|
||||
[5222] = StartTLS.xmpp_prepare_tls_without_reconnect,
|
||||
[5269] = StartTLS.xmpp_prepare_tls_without_reconnect
|
||||
}
|
||||
|
||||
function getPrepareTLSWithoutReconnect(port)
|
||||
return SPECIALIZED_PREPARE_TLS_WITHOUT_RECONNECT[port.number]
|
||||
return SPECIALIZED_PREPARE_TLS_WITHOUT_RECONNECT[port.number]
|
||||
end
|
||||
|
||||
function isPortSupported(port)
|
||||
return SPECIALIZED_PREPARE_TLS[port.number]
|
||||
return SPECIALIZED_PREPARE_TLS[port.number]
|
||||
end
|
||||
|
||||
--- Gets a certificate for the given host and port
|
||||
@@ -249,44 +249,44 @@ end
|
||||
-- @return cert userdata containing the SSL certificate, or error message on
|
||||
-- failure.
|
||||
function getCertificate(host, port)
|
||||
local mutex = nmap.mutex("sslcert-cache-mutex")
|
||||
mutex "lock"
|
||||
local mutex = nmap.mutex("sslcert-cache-mutex")
|
||||
mutex "lock"
|
||||
|
||||
if ( host.registry["ssl-cert"] and
|
||||
host.registry["ssl-cert"][port.number] ) then
|
||||
stdnse.print_debug(2, "sslcert: Returning cached SSL certificate")
|
||||
mutex "done"
|
||||
return true, host.registry["ssl-cert"][port.number]
|
||||
end
|
||||
if ( host.registry["ssl-cert"] and
|
||||
host.registry["ssl-cert"][port.number] ) then
|
||||
stdnse.print_debug(2, "sslcert: Returning cached SSL certificate")
|
||||
mutex "done"
|
||||
return true, host.registry["ssl-cert"][port.number]
|
||||
end
|
||||
|
||||
-- Is there a specialized function for this port?
|
||||
local specialized = SPECIALIZED_PREPARE_TLS[port.number]
|
||||
local status
|
||||
local socket = nmap.new_socket()
|
||||
if specialized then
|
||||
status, socket = specialized(host, port)
|
||||
if not status then
|
||||
mutex "done"
|
||||
return false, "Failed to connect to server"
|
||||
end
|
||||
else
|
||||
local status
|
||||
status = socket:connect(host, port, "ssl")
|
||||
if ( not(status) ) then
|
||||
mutex "done"
|
||||
return false, "Failed to connect to server"
|
||||
end
|
||||
-- Is there a specialized function for this port?
|
||||
local specialized = SPECIALIZED_PREPARE_TLS[port.number]
|
||||
local status
|
||||
local socket = nmap.new_socket()
|
||||
if specialized then
|
||||
status, socket = specialized(host, port)
|
||||
if not status then
|
||||
mutex "done"
|
||||
return false, "Failed to connect to server"
|
||||
end
|
||||
local cert = socket:get_ssl_certificate()
|
||||
if ( cert == nil ) then
|
||||
return false, "Unable to get cert"
|
||||
end
|
||||
else
|
||||
local status
|
||||
status = socket:connect(host, port, "ssl")
|
||||
if ( not(status) ) then
|
||||
mutex "done"
|
||||
return false, "Failed to connect to server"
|
||||
end
|
||||
end
|
||||
local cert = socket:get_ssl_certificate()
|
||||
if ( cert == nil ) then
|
||||
return false, "Unable to get cert"
|
||||
end
|
||||
|
||||
host.registry["ssl-cert"] = host.registry["ssl-cert"] or {}
|
||||
host.registry["ssl-cert"][port.number] = host.registry["ssl-cert"][port.number] or {}
|
||||
host.registry["ssl-cert"][port.number] = cert
|
||||
mutex "done"
|
||||
return true, cert
|
||||
host.registry["ssl-cert"] = host.registry["ssl-cert"] or {}
|
||||
host.registry["ssl-cert"][port.number] = host.registry["ssl-cert"][port.number] or {}
|
||||
host.registry["ssl-cert"][port.number] = cert
|
||||
mutex "done"
|
||||
return true, cert
|
||||
end
|
||||
|
||||
|
||||
|
||||
Reference in New Issue
Block a user