Raw IP NSE Functionality (Was Re: [NSE] Raw ethernet frame questions ...)

[Kris Katterjohn <katterjohn () gmail com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 02/08/2010 08:08 PM, Fyodor wrote:
> On Fri, Feb 05, 2010 at 04:32:33PM -0600, Kris Katterjohn wrote:
> > -----BEGIN PGP SIGNED MESSAGE-----
> > Hash: SHA1
> >
> > On 02/04/2010 04:09 PM, Fyodor wrote:
> > > On Thu, Feb 04, 2010 at 10:58:03AM -0600, Kris Katterjohn wrote:
> > I've added support for this:
>
> Nice!  It's worth noting for people who haven't been paying attention
> that you're talking about your nmap-exp/kris/nse-rawip/ branch.
>
> > But this remains: if ethernet is requested, but Nmap fails to find an ethernet
> > route (but found a route nonetheless), should the raw socket be used instead?
> > Currently the raw socket is always opened and the eth stuff is used instead in
> > ip_send() because I'm not sure how this should work.  This fallback stuff
> > isn't implemented yet, however.
>
> Ideally the ethernet-or-raw-socket decision should be made in exactly
> the same way as the rest of Nmap's raw packet/frame sending
> functionality.

Alright, I like to think my branch is essentially complete.  So here we go:

* ip_open(), ip_send() and ip_close() methods for sending packets starting
with an IPv4 header

* Works with arbitrary (non-Target) hosts using various routing functions and
sends over raw socket or ethernet if preferred and is available

* Fallback: if ethernet is preferred but no (ethernet) route can be found, the
raw socket is used instead.  If an ethernet route is found but an error occurs
then we pass an error to the script.  Keeping in mind your suggestion, I feel
this is similar to how eth vs raw decisions are made elsewhere, even though
those parts use Target information while this is done itself.

* Errors are passed to the script for use with try() exception handling

* Tested on Linux and Windows; kx also verified on Windows earlier

* Docs added to scripting.xml (similar to ethernet_* methods' docs)

* IP ID sequence script with optional probeport arg; recently done up with
NSEDoc (although my NSEDoc-fu is weak as I don't recall ever using it)

Any testing, comments or suggestions are very much appreciated.  It would be
nice to finally have this functionality in trunk, but if it breaks I prefer to
know now rather than after a merge :)

> Cheers,
> -F

Cheers!
Kris Katterjohn

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iQIcBAEBAgAGBQJLdIqFAAoJEEQxgFs5kUfujzwQAKnemL0LAauojCrDvK7cfWpK
M5nf/SUaKtteQMQe8Ki9BqNRRLB+mourdVEfh0+2IB/4jTmgM5EV2xc0awEyM4+X
GutmLZPxQPs6mlQH1ROoiWOeR9Vv2/5dK0hZ3tZP8kzuCFcAHxV7OaVOWBduJ0Hu
/ARaIIlPmxAznXeVwOdgKbeVXg+OYOPOVpi0q+IJYcNiz8/4TEBPfZQa5NFYtbXY
t9tNfsDYGG2d1BRcu4d4MbLECYhUKxpi5nVQ6r7Rt7b2zrLzxXtRbqhoIvHoP1YF
b10r1zSmginPRjTipezRcOxVtR3SFk+v8UzSvbuszVsk9YbSdw2B60huVxSFdtsk
D7P8As8U9gCJ0539aHEV22ERHvOtT4Y/KPKNXKH91gKlDgXKdMVMcnD1G4SFUIAS
2prS3Ptu9xn1RKheMrAk2EeXqf1F5qTHx8CkjQiHbfGd+WWrreY2C4yu9eSHhQqq
1nT1MmDo8+mzmmFTwtxYQIphfy+nV0gQgo39jEiXxnMbruAkCIOCEPhxNFh1DAcX
b+rrGxzYuxHee93sG0E2h610p1bYEPG+Fg8YP9RHedWppvkG5ivdbBtr7o4Pata1
pPrZK4n7qPJRf4eom6SnGYwpYf3mg5dkwAovXKpG/pDwdKDDp/iSkPxWUtuXUNJj
ARZpdGiws30F8zU7Y/z0
=VhKS
-----END PGP SIGNATURE-----
_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://seclists.org/nmap-dev/