This connect should be side effect–free except for calling socket_lock,
which prevents the creation of an excessive number of sockets. Not using
the lock was causing "Too many open files" errors.
We should have a cleaner general solution for this, and not require
scripts to "connect" their unconnected UDP sockets. I seem to remember
that there was a good reason for not enforcing the lock on socket
creation, but only on connect, as we do.
http://seclists.org/nmap-dev/2012/q4/435
commit fb1fa9373592e81ee004b99cf813e07bf253fbe1
Author: Patrik Karlsson <patrik@cqure.net>
Date: Sun Dec 16 11:49:36 2012 -0500
Fix bug where brute library failed to report error on invalid iterators
commit e5cb0a18d5474730310f1797016e1106c33ca059
Author: Patrik Karlsson <patrik@cqure.net>
Date: Sun Oct 7 10:47:35 2012 +0200
compatibility fixes to spnego authentication in smb and smbauth libraries
the spnego authentication blob now decodes properly in wireshark
fixes in spnego authentication for both Window 2003 and Windows 7
commit 5de9e4fa623f88a9b48ef0704244ff843005573a
Author: Patrik Karlsson <patrik@cqure.net>
Date: Sat Oct 6 21:19:08 2012 +0200
Applied patch from Dhiru Kholia adding oracle-brute-stealth and needed changes
reworked the patch slightly and added;
- support for specifying account on command line
- johnfile argument for writing hashes directly to file
rpc.Comm.Connect was trying to bind to 424 reserved ports, which is
overkill. Since nsock doesn't do an actual bind(2) call until
socket:connect for TCP, that meant up to 424 connect calls, each of
which is currently leaking a socket. This commit contains 3 fixes:
1. Add nmap.new_socket calls for non-privileged code path that were
moved inside the privileged loop to originally address the leak.
2. Check for TIMEOUT on each of the TCP connect calls and abandon the
Connect, avoiding many timeouts.
3. Try 10 random reserved ports (from 1 to 1024) instead of 400+.
Should be good odds of finding one unused, even when lots of threads are
trying (though empirical results would be helpful). Also, this should
reduce load since thread n won't need to fail n-1 bind attempts.
It appears that connecting more than one with the same nse_nsock socket
leaks socket descriptor. For example,
local s = nmap.new_socket()
s:connect(host, port) --> TIMEOUT
s:connect(host, port) --> TIMEOUT
s:close()
leaks a socket descriptor, the one used in the first connect. Nsock
should really take care of this, but let's do this workaround because
rpc-grind has been causing problems due to using the above pattern:
http://seclists.org/nmap-dev/2012/q3/864http://seclists.org/nmap-dev/2012/q3/872http://seclists.org/nmap-dev/2012/q3/949
The difficulty is that the rpc library will tolerate around 400 of those
timeouts per RPC connection, which leads to rapidly running out of
descriptors.
There was a reverse table that was meant to map keys to their position
in the order table, to make it easy to table.remove an entry from order.
But removing something from order would shift the indices of all
following elements by 1, and those elements were not updated
correspondingly in the reverse table. Instead, do a linear lookup for
the the element to remove from order, after checking that the element
exists at all.
http://seclists.org/nmap-dev/2012/q3/905
Previously we always took the destination address from the packet
buffer, which failed for IPv6 link-local addresses because the packet
buffer does not contain the scope id.
This takes a broken-down date table, as produced by os.date("*t"), and
converts it into an integer number of seconds since the epoch UTC,
interpreting it as a time in a given time zone. Simply passing a date
table to os.time is not good enough, because os.time always assumes the
date table represents a local time; i.e., you will get different results
from running os.time({year=2012,month=1,day=1,hour=12,min=0,sec=0})
depending on what time zone you run it in.
