If the scanning system's OS does not send a RST for unsolicited SYN/ACK,
the target port will stay in the SYN-RECEIVED state and will not
acknowledge any new SYN from the same port number. Windows in particular
does this, making retries basically useless. Solution: change source
port number for each run of the osscan engine.
Since the number, names, and preferred order of OS detection tests are
known, we can use fixed indices to put each test/value type in a
predictable location. Previously, we would insert the tests in an
arbitrary order, sort them, and then use strcmp() in each comparison to
ensure the sort order holds and any missing tests are skipped over.
Keeping test names in one location (MatchPoints) saves memory and keeps
the string pool small, which improves performance by reducing lookups
and making existing lookups faster.
Using a dedicated class (FingerPrintDef) for MatchPoints avoids calling
strtol() to obtain the points value for every comparison.
The formats has been tested and verified on Mac OS X 10.8.5,
Mac OS X 10.11.5 and Ubuntu 14.04 LTS, all on x86_64 machines
and OSs. It mainly silences warnings. There were no warnings on
Ubuntu but a few on Mac OS, so the fix is intended to silence
warnings on Mac OS whithout triggering new warnings on other OSs.
Example of warnings previously encountered:
netutil.cc:2828:74: warning: format specifies type 'unsigned short'
but the argument has type 'int' [-Wformat]
Fixes#275.
This results in fewer casts and less subtraction than the previous
method, and should still be portable. Only division and subtraction and
difftime are performed on the value, so it will not overflow. And the
TCP timestamp itself is a 32-bit value, so it can't refer to a time
farther in the past than the 32-bit epoch. One explicit cast (to long
long) is used in order to ensure the format string can handle any
conceivable value according to the compiler and avoid a warning message.
