unspecified and causes a segmentation fault on Android Bionic libc.
Vlatko fixed the bug in his Android binaries and it was first reported
by @alexismm2.
socket support to NSE, with updates in scripts and libraries.
o [NSE] Added the ability to send and receive on unconnected sockets.
This can be used, for example, to receive UDP broadcasts without
using pcap. A number of scripts have been changed so that they can
work as prerule scripts to discover services by UDP broadcasting,
optionally add the discovered targets to the scanning queue:
- ms-sql-info
- upnp-info
- dns-service-discovery
The nmap.new_socket function can now optionally take a default
protocol and address family, which will be used if the socket is not
connected. There is a new nmap.sendto function to be used with
unconnected UDP sockets. [David, Patrik]
This is a maintenance fix for the NSE Nsock library binding. The patch focuses
on code correctness and simplicity. The patch also brings some initial updates
with an eye towards the upcoming Lua 5.2 release. See [1] for a post concerning
this branch.
[1] http://seclists.org/nmap-dev/2010/q3/710
point seconds since the epoch, and add clock_ms() and clock_us() to stdnse
for convenience (millisecond and microsecond).
qscan.nse now provides microsecond resolution.
is now available to scripts as an additional return value from
pcap_receive(). It is returned as the floating point number of
seconds since the epoch. The qscan.nse script was updated to use
this more accurate data instead of using the clock_ms() function
(which returns the current time). [Kris]
entries:
o [NSE] Raw packet sending at the IP layer is now supported, in addition to
the Ethernet sending functionality. Packets to send start with an IPv4
header and can be sent to arbitrary hosts. [Kris]
o [NSE] Added the ipidseq script to classify a host's IP ID sequence numbers
in the same way Nmap does. This can be used to test hosts' suitability for
Nmap's Idle Scan (-sI), i.e. check if a host is an idle zombie. This is
the first script to use the new raw IP sending functionality in NSE. [Kris]
o [NSE] Added the function nmap.is_privileged() to tell a script if, as far
as Nmap's concerned, it can do privileged operations. For instance, this
can be used to see if a script should be able to open a raw socket or
Ethernet interface. [Kris]
o [NSE] Added the function nmap.get_ports() to allow a script to iterate
over a host's port tables matching a certain protocol and state. [Kris,
Patrick]
relinquishes its lock. We expect only one of them to be able to grab the
newly freed lock, and the rest to go back to waiting. This seems to have
helped with a deadlock in running a large-scale favicon survey.
to be the cause of a segfault reported by Ron Bowes.
nmap -PN -p4567 -sV --script=http-* x.x.x.x
Program received signal SIGSEGV, Segmentation fault.
nsock_connect_tcp (nsp=0x83b8b38, ms_iod=0x0, handler=0x80b5cf0
<l_nsock_connect_handler(void*, void*, void*)>, timeout_msecs=10000,
userdata=0x8729308, saddr=0x871a6f8, sslen=16, port=4567)
at nsock_connect.c:154
instead of waiting until a request is made to connect. This eliminates a
little bit of bookkeeping that needed to be done to retain state on the
NSE socket. Unfortunately this alone doesn't allow binding a socket to a
source address to receive UDP data, because Nsock doesn't create the
physical socket until a connection is made.
sockaddr instead of sockaddr_storage so it got only a fraction of the
address and the inet_ntop function would look outside of the structure
into adjacent memory. A scan of localhost would look like this:
NSE: TCP ::a00:0:600:0:1234 > ::a00:4d2:0:0:25 | CONNECT
Here, for example, that 4d2 is the port number 1234 from the other
structure. Now it prints correctly:
NSE: TCP ::1:1234 > ::1:25 | CONNECT
to reconnect a socket with SSL because the initial communication on the socket
is done without SSL. See this thread [1] for more details.
[1] http://seclists.org/nmap-dev/2009/q4/3
nse_nsock_get_ssl. In older versions of OpenSSL (I don't know how old)
the argument to SSL_get_peer_certificate is not const and it caused a
compiler error reported by Ron Bowes.
GC for collecting socket locks [1].
If a thread does not close any sockets it creates, and then
returns (or errors), the thread and sockets will keep their "lock" until
garbage collected. This would be the same situation as before in this
particular case (reliance on GC).
To fix this, I have changed the socket unlock system to close all the sockets
of a thread not yielded and remove its "lock".
[1] http://seclists.org/nmap-dev/2009/q2/0624.html
again. Here are the items which were merged:
------------------------------------------------------------------------
r13971 | jah | 2009-06-29 14:30:27 -0700 (Mon, 29 Jun 2009) | 2 lines
Improved a pattern for matching HTTP status-line, tidy away some variables and
fix a typo.
------------------------------------------------------------------------
r13967 | daniel | 2009-06-29 13:47:04 -0700 (Mon, 29 Jun 2009) | 5 lines
o Added a convenience top-level BSD makefile redirecting BSD make
to GNU make on BSD systems. This should help prevent bogus
error reports when users run "make" instead of "gmake" on BSD
systems. [Daniel Roethlisberger]
------------------------------------------------------------------------
r13965 | batrick | 2009-06-29 06:50:11 -0700 (Mon, 29 Jun 2009) | 14 lines
[NSE] The NSE Nsock Library binding no longer relies on garbage collection to
monitor the use of socket "slots". A thread (script) attempting to connect must
first obtain one of a limited number of available socket locks (usually 10 or
--max-parallelism). The binding would use garbage collection of sockets to
determine when a thread has finished using its allocated sockets. This is
unfortunately slow and requires us to constantly run the garbage collector to
cause timely reallocation. I have changed the binding to now regularly inspect
allocated sockets in the nsock_loop function. Available sockets slots are now
immediately reallocated and done with far less execution time.
See [1] for benchmarks and further explanation.
[1] http://seclists.org/nmap-dev/2009/q2/0624.html
------------------------------------------------------------------------
r13964 | batrick | 2009-06-29 06:37:49 -0700 (Mon, 29 Jun 2009) | 10 lines
[NSE] Fixed a rare (and usually undetectable) bug that can cause a SEGFAULT.
The NSE nsock library binding may attempt to push values on the stack of
a thread that ended due to an error. It is possible that the internal
Lua stack was completely full and any further pushed values would result
in a segmentation memory violation.
This bug is very hard to reproduce with a SEGFAULT but is usually visible
when Lua assertion checks are turned on. A socket handler routine must be
called AFTER a thread has ended in error.
------------------------------------------------------------------------
r13963 | batrick | 2009-06-29 05:51:20 -0700 (Mon, 29 Jun 2009) | 3 lines
Fixed some global scoped variables to be local. This caused a many scripts to
overwrite each others' sockets, options, etc.
------------------------------------------------------------------------
r13939 | joao | 2009-06-27 16:07:35 -0700 (Sat, 27 Jun 2009) | 2 lines
Fixed port rule to include ssl pop3 port, now that pop3.lua supports SSL connections in function capabilities
------------------------------------------------------------------------
r13938 | joao | 2009-06-27 16:06:28 -0700 (Sat, 27 Jun 2009) | 2 lines
Added transparent SSL support using comm.tryssl
------------------------------------------------------------------------
r13937 | joao | 2009-06-27 16:05:19 -0700 (Sat, 27 Jun 2009) | 2 lines
Added transparent SSL support using comm.tryssl
------------------------------------------------------------------------
r13936 | joao | 2009-06-27 16:03:50 -0700 (Sat, 27 Jun 2009) | 2 lines
Added SSL transparent support using comm.tryssl
------------------------------------------------------------------------
r13935 | joao | 2009-06-27 16:02:39 -0700 (Sat, 27 Jun 2009) | 2 lines
Added SSL transparent support using comm.tryssl
------------------------------------------------------------------------
r13934 | joao | 2009-06-27 16:01:38 -0700 (Sat, 27 Jun 2009) | 2 lines
Added SSL transparent support using comm.tryssl
------------------------------------------------------------------------
r13933 | joao | 2009-06-27 16:00:27 -0700 (Sat, 27 Jun 2009) | 2 lines
SSL transparent support using comm.tryssl
------------------------------------------------------------------------
r13932 | joao | 2009-06-27 15:19:58 -0700 (Sat, 27 Jun 2009) | 2 lines
Included transparent ssl support to function pop3.capabilities using comm.tryssl
------------------------------------------------------------------------
r13931 | joao | 2009-06-27 15:19:06 -0700 (Sat, 27 Jun 2009) | 3 lines
New version of comm.lua with function tryssl, that transparently adds support to ssl connections
------------------------------------------------------------------------
r13930 | joao | 2009-06-27 14:50:38 -0700 (Sat, 27 Jun 2009) | 6 lines
Fixed buffering problem exposed by david on nmap-dev list.
The problem was solved using a buffer to receive the data, making the script work fine in cases where the ssh packets are fragmented.
A very similar solution was applied to ssh1.lua.
------------------------------------------------------------------------
r13928 | batrick | 2009-06-27 04:43:12 -0700 (Sat, 27 Jun 2009) | 18 lines
[NSE] We now propogate a NSE initiated yield on a script through all user
coroutines so that NSE may resume control. Previously, scripts that would yield
in a child coroutine (e.g. a script's child coroutine generated by Lua's
coroutine.create function) would give control back to the script. A script
would yield in this way by making a blocking socket operation. NSE would be
unable to correctly resume child coroutine when the socket operation is
finished processing.
By yielding the chain of coroutines a script has operating, we allow to NSE to
handle the socket operation properly. NSE would then resume the entire chain so
execution may correctly resume at the coroutine which initiated the socket
operation. This restores the "illusion" that a script executes without
interruption.
See [1] for more information, further explanation, and some use cases.
[1] http://seclists.org/nmap-dev/2009/q2/0586.html
------------------------------------------------------------------------
r13817 | david | 2009-06-18 15:57:29 -0700 (Thu, 18 Jun 2009) | 3 lines
Improve an OS fingerprint with a model number and broader matching.
Based on a follow-up report from a submitter.
------------------------------------------------------------------------
r13814 | josh | 2009-06-17 21:34:15 -0700 (Wed, 17 Jun 2009) | 3 lines
[zenmap] Added support to zenmap for the new SCTP options: -PY, -sY and -sZ
------------------------------------------------------------------------
r13797 | ron | 2009-06-17 11:02:18 -0700 (Wed, 17 Jun 2009) | 1 line
Applied a patch from Mak Kolibabi that enhances the output of smb-enum-processes. The output is now modeled after the output of the 'ps' tool for higher verbosity levels.
------------------------------------------------------------------------
r13795 | david | 2009-06-17 09:05:21 -0700 (Wed, 17 Jun 2009) | 6 lines
The configure script now allows cross-compiling by assuming that
libpcap is recent enough. Previously it would quit because a test
program could not be run. libpcap will always be recent enough when
the included copy is used. The patch was contributed by Mike
Frysinger.
Here is a mostly exhaustive list of the changes:
o Removes the SCRIPT_ENGINE_* status defines and replaces the
instances with regular boolean integer returns or changes the
procedure to return void. The latter case is better generally because
the caller ignores any status return (e.g. nmap.cc calling open_nse)
and/or the procedure raises a fatal error when unsuccessful.
o Moves the SCRIPT_ENGINE_LUA_DIR and the like to the nse_main.h header file.
o Removes the use of the SCRIPT_ENGINE_TRY (there was only one left)
and thus changes the call to l_dnet_open to a void function called
directly by luaopen_nsock (in nse_nsock.cc) instead of luaopen_nmap
(in nse_nmaplib.cc). I felt moving the function was also an
appropriate (but somewhat unrelated to the intent of the patch) change
as opening the dnet metatable is very related to opening up the
nsock library. This confines errors in opening the nsock library, including
opening the dnet metatable, to the call to luaopen_nsock.
o The FILES and DIRS defines are moved in to nse_fs.h where they are
more appropriate and localalized.
a layer 4 protocol used mostly for telephony related applications.
This brings the following new features:
o SCTP INIT chunk port scan (-sY): open ports return an INIT-ACK
chunk, closed ones an ABORT chunk. This is the SCTP equivalent
of a TCP SYN stealth scan.
o SCTP COOKIE-ECHO chunk port scan (-sZ): open ports are silent,
closed ports return an ABORT chunk.
o SCTP INIT chunk ping probes (-PY): host discovery using SCTP
INIT chunk packets.
o SCTP-specific IP protocol scan (-sO -p sctp).
o SCTP-specific traceroute support (--traceroute).
o The ability to use the deprecated Adler32 algorithm as specified
in RFC 2960 instead of CRC32C from RFC 4960 (--adler32).
o 42 well-known SCTP ports were added to the nmap-services file.
Part of the work on SCTP support was kindly sponsored by
Compass Security AG, Switzerland. [Daniel Roethlisberger]
an invalid Lua state if the thread was collected due to timeout or other even
more rare reasons. Essentially, the callbacks from the nsock library
were using a collected Lua state. I have solved this by maintaining a
reference to the Lua State Thread in the nsock userdata's environment table.
This is a temporary patch for the stable release pending a more detailed
review of the NSE nsock library binding.
with it). The whitespace was various styles in often confusing places.
The whitespace also had many evil tabs. I used the indent program and
tried to follow the whitespace of the rest of NSE C code as closely as
possible.
allowing other pending socket connections to succeed sooner. This change
only slightly speeds up the process as these sockets will be collected
eventually, causing the slots to be unlocked.
