Unexpected error in NSE_TYPE_READ callback

[lynnewu]

Describe the bug

Scan terminates unexpectedly with the message:
"Unexpected error in NSE_TYPE_READ callback. Error code: 1234 (No service is operating at the destination network endpoint on the remote system. )

QUITTING!"

To Reproduce
nmap -sS -sU -sV -T3 -v --version-all --script banner --top-ports 50 192.168.57-58.0-255
Expected behavior
Scan should run to completion

Version info (please complete the following information):

• OS: [e.g. Linux 4.15, Windows 10 1909]
  Windows Server 2019 Standard 1809 build 17763.1397

• Output of nmap --version:
  Nmap version 7.90 ( https://nmap.org )
  Platform: i686-pc-windows-windows
  Compiled with: nmap-liblua-5.3.5 openssl-1.1.1h nmap-libssh2-1.9.0 nmap-libz-1.2.11 nmap-libpcre-7.6 Npcap-1.00 nmap-libdnet-1.12 ipv6
  Compiled without:
  Available nsock engines: iocp poll select

• Output of nmap --iflist
  Starting Nmap 7.90 ( https://nmap.org ) at 2020-10-06 10:37 Central Daylight Time
  INTERFACES
  DEV (SHORT) IP/MASK TYPE UP MTU MAC
  eth0 (eth0) 192.168.53.223/22 ethernet up 1500 00:50:56:86:0D:4E
  eth1 (eth1) 192.168.6.223/23 ethernet up 1500 00:50:56:86:74:AE
  eth2 (eth2) 192.168.57.223/24 ethernet up 1500 00:50:56:86:C9:EE
  eth3 (eth3) 192.168.59.223/24 ethernet up 1500 00:50:56:86:7F:C2
  lo0 (lo0) ::1/128 loopback up -1
  lo0 (lo0) 127.0.0.1/8 loopback up -1

DEV WINDEVICE
eth0 \Device\NPF_{6D2BE5DA-D4D7-4EE7-A94D-8068D2780B85}
eth1 \Device\NPF_{41567334-FCDA-4ACF-B927-76E8410D2DA5}
eth2 \Device\NPF_{84E1F408-49C7-4BA7-8EEC-41F1A0800541}
eth3 \Device\NPF_{4EDDACC8-DD7F-40AC-AC29-FB998BB18A08}
lo0 \Device\NPF_Loopback
lo0 \Device\NPF_Loopback
\Device\NPF_{0675240A-CE03-47AE-BBBD-0E468557FA72}
\Device\NPF_{D60D66D5-866A-4639-BC03-712D91BBCD9B}
\Device\NPF_{70686BF5-C31D-4160-9C09-997E61DC700C}

ROUTES
DST/MASK DEV METRIC GATEWAY
192.168.57.255/32 eth2 271
192.168.57.223/32 eth2 271
255.255.255.255/32 eth0 271
255.255.255.255/32 eth1 271
255.255.255.255/32 eth3 271
255.255.255.255/32 eth2 271
192.168.55.255/32 eth0 271
192.168.59.255/32 eth3 271
192.168.6.223/32 eth1 271
192.168.7.255/32 eth1 271
192.168.59.223/32 eth3 271
192.168.53.223/32 eth0 271
127.255.255.255/32 lo0 331
127.0.0.1/32 lo0 331
255.255.255.255/32 lo0 331
192.168.57.0/24 eth2 271
192.168.59.0/24 eth3 271
192.168.6.0/23 eth1 271
192.168.52.0/22 eth0 271
127.0.0.0/8 lo0 331
224.0.0.0/4 eth2 271
224.0.0.0/4 eth3 271
224.0.0.0/4 eth1 271
224.0.0.0/4 eth0 271
224.0.0.0/4 lo0 331
0.0.0.0/0 eth1 15 192.168.6.1
0.0.0.0/0 eth3 271 192.168.59.1
0.0.0.0/0 eth0 271 192.168.52.1
0.0.0.0/0 eth2 271 192.168.57.1
::1/128 lo0 331
ff00::/8 lo0 331

Additional context
Add any other context about the problem here, such as special network type.

[lynnewu]

Was able to narrow things down a bit. The error is not specific to port 67, but it's the only port where I can consistently get 100% failure, regardless of host.

The hosts in question don't have anything running on port 67 (TCP or UDP).

Using: nmap -sS -sU -sV -p 67 -T3 -d4 -v -v -v --version-all --script banner 192.168.57.22

Starting probes against new service: 192.168.57.22:67 (udp)
Service scan sending probe RPCCheck to 192.168.57.22:67 (udp)
Service scan sending probe DNSVersionBindReq to 192.168.57.22:67 (udp)
event #306 (type READ)
NSOCK DEBUG [0.7510s] event_delete(): event_delete (IOD #19) (EID #306)
NSOCK INFO [0.7510s] nsock_iod_delete(): nsock_iod_delete (IOD #20)
NSOCK INFO [0.7510s] nevent_delete(): nevent_delete on event #322 (type READ)
NSOCK DEBUG [0.7510s] event_delete(): event_delete (IOD #20) (EID #322)
NSOCK DEBUG [0.7510s] event_delete(): event_delete (IOD #1) (EID #18)
NSOCK DEBUG [1.0670s] nsock_set_log_function(): Registered external logging function: D897E0
NSOCK DEBUG [1.0670s] nsock_set_loglevel(): Set log level to DEBUG
NSOCK INFO [1.0670s] nsock_iod_new2(): nsock_iod_new (IOD #1)
NSOCK DEBUG [1.0670s] event_new(): event_new (IOD #1) (EID #8)
NSOCK INFO [1.0670s] nsock_connect_udp(): UDP connection requested to 192.168.57.22:67 (IOD #1) EID 8
NSOCK DEBUG [1.0670s] nsock_pool_add_event(): NSE #8: Adding event (timeout in 22503502ms)
NSOCK DEBUG [1.0670s] nsock_loop(): nsock_loop() started (no timeout). 1 events pending
NSOCK INFO [1.0670s] nsock_trace_handler_callback(): Callback: CONNECT SUCCESS for EID 8 [192.168.57.22:67]
NSOCK DEBUG [1.0670s] event_new(): event_new (IOD #1) (EID #19)
NSOCK INFO [1.0670s] nsock_write(): Write request for 40 bytes to IOD #1 EID 19 [192.168.57.22:67]
NSOCK DEBUG [1.0670s] nsock_pool_add_event(): NSE #19: Adding event (timeout in 5000ms)
NSOCK DEBUG [1.0670s] event_new(): event_new (IOD #1) (EID #26)
NSOCK INFO [1.0670s] nsock_read(): Read request from IOD #1 [192.168.57.22:67] (timeout: 5000ms) EID 26
NSOCK DEBUG [1.0670s] nsock_pool_add_event(): NSE #26: Adding event (timeout in 5000ms)
NSOCK DEBUG [1.0670s] event_delete(): event_delete (IOD #1) (EID #8)
NSOCK INFO [1.0670s] nsock_trace_handler_callback(): Callback: WRITE SUCCESS for EID 19 [192.168.57.22:67]
NSOCK DEBUG [1.0670s] event_delete(): event_delete (IOD #1) (EID #19)
NSOCK INFO [6.0790s] nsock_trace_handler_callback(): Callback: READ TIMEOUT for EID 26 [192.168.57.22:67]
NSOCK DEBUG [6.0790s] event_new(): event_new (IOD #1) (EID #35)
NSOCK INFO [6.0790s] nsock_write(): Write request for 30 bytes to IOD #1 EID 35 [192.168.57.22:67]
NSOCK DEBUG [6.0790s] nsock_pool_add_event(): NSE #35: Adding event (timeout in 5000ms)
NSOCK DEBUG [6.0790s] event_new(): event_new (IOD #1) (EID #42)
NSOCK INFO [6.0790s] nsock_read(): Read request from IOD #1 [192.168.57.22:67] (timeout: 5000ms) EID 42
NSOCK DEBUG [6.0790s] nsock_pool_add_event(): NSE #42: Adding event (timeout in 5000ms)
NSOCK DEBUG [6.0790s] event_delete(): event_delete (IOD #1) (EID #26)
NSOCK INFO [6.0790s] nsock_trace_handler_callback(): Callback: WRITE SUCCESS for EID 35 [192.168.57.22:67]
NSOCK DEBUG [6.0790s] event_delete(): event_delete (IOD #1) (EID #35)
NSOCK INFO [6.0790s] nsock_trace_handler_callback(): Callback: READ ERROR [No service is operating at the destination network endpoint on the remote system. (1234)] for EID 42 [192.168.57.22:67]
Unexpected error in NSE_TYPE_READ callback. Error code: 1234 (No service is operating at the destination network endpoint on the remote system. )
QUITTING!

[dmiller-nmap]

Thanks for this report! Apparently, WSARecvFrom() can return ERROR_PORT_UNREACHABLE instead of a more recognizable Winsock error code when an ICMP error packet is received. I just pushed a change to translate this to ECONNREFUSED which should do the right thing.