Repository navigation
Conversation
The TCP-connect and UDP-unprivileged probe handlers both passed sizeof(sockaddr_storage) (128) as the length of the local address, even though the address itself is a sockaddr_in or a sockaddr_in6. Linux ignores the oversized length, but the BSD socket implementations validate it, so bind() fails with EINVAL and every probe is aborted before a packet goes out: $ nping --tcp-connect -p 18080 127.0.0.1 -c 5 --rate 5 libnsock mksock_bind_addr(): Bind to 0.0.0.0:0 failed (IOD nmap#1): Invalid argument (22) ... TCP connection attempts: 5 | Successful connections: 0 | Failed: 5 (100.00%) That makes --tcp-connect and unprivileged --udp unusable on macOS and the BSDs. Use sslen, which both handlers already derive from the address family a few lines earlier. EchoClient.cc already passes the correct length, so only ProbeMode was affected. With this change the same command reports 5 successful connections, IPv6 targets work against an ::1 listener, and --source-port still binds as requested (confirmed with a listener that prints the client source port).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #3510.
Both probe handlers in nping/ProbeMode.cc pass
sizeof(sockaddr_storage)(128) as the length of the local address, but the address is only a sockaddr_in or a sockaddr_in6.nsock_iod_set_localaddr()stores that length verbatim innsi->locallenandmksock_bind_addr()gives it tobind()unchanged. Linux ignores the extra length, the BSDs validate it and fail with EINVAL, so on macOS and the BSDs every probe dies before anything goes out:Same for unprivileged
nping --udp.This is the same defect as #3438. 84420aa narrowed the length in
NmapOps::setSourceSockAddr(),Target::setSourceSockAddr()andNpingTarget::setSourceSockAddr(), but these two sites hand the length straight to nsock and bypass all three.Both handlers already compute the right length into
sslena few lines earlier for the destination sockaddr, so this just uses that. EchoClient.cc already passes the correct length, so ProbeMode was the only place affected.After the change the same command reports 5 of 5 successful connections. I checked that
--source-portstill binds where asked (listener printing the client source port confirms 44444), and that IPv6 works against an ::1 listener.