Re: [NSE] lua 'host' table has wrong ip_src of virtual interface

[David Fifield <david () bamsoftware com>]

On Sat, Jul 03, 2010 at 06:01:23PM -0600, David Fifield wrote:
> On Mon, Jun 07, 2010 at 02:11:47PM +0300, Victor Rudnev wrote:
> > Since 5.30 I noticed that I cannot reach original ip address of virtual
> > interface in lua 'host' table when I'm doing a scan. It looks like a bug.
> >
> >
> > Side A:                                    SideB:
> > eth0 192.168.1.20/24               eth0 192.168.0.4/24
> > eth0:1 192.168.0.5/24
> >
> > # nmap --script ./test.nse -n -sT --open -p 22 192.168.0.4
> >
> > Starting Nmap 5.30BETA1 ( http://nmap.org ) at 2010-06-07 13:55 EEST
> > Nmap scan report for 192.168.0.4
> > Host is up (0.0012s latency).
> > PORT   STATE SERVICE
> > 22/tcp open  ssh
> > | test:
> > | Address: 192.168.1.20
> > |_Interface: eth0
> > MAC Address: 00:15:F2:E0:7A:ED (Asustek Computer)
> >
> > # nmap --script ./test.nse -n -sT --open -p 22 192.168.0.4
> >
> > Starting Nmap 5.21 ( http://nmap.org ) at 2010-06-07 13:56 EEST
> > NSE: Script Scanning completed.
> > Nmap scan report for 192.168.0.4
> > Host is up (0.0016s latency).
> > PORT   STATE SERVICE
> > 22/tcp open  ssh
> > | test:
> > | Address: 192.168.0.5
> > |_Interface: eth0
> > MAC Address: 00:15:F2:E0:7A:ED (Asustek Computer)
>
> Thanks for this excellent bug report. I'm sorry it took so long to
> reply. I can confirm this behavior using 5.21 and current Subversion
> HEAD. I'll check into it.

I think this is fixed as of r18564. The base problem was that the
getsysroutes method was not properly assigning interface alises for
directly connected routes. I always assigned the base interface (eth0)
and never an alias (eth0:0).

The code already had a check for assigning aliases for routes with a
gateway. I extended this match to use the destination address when there
is no gateway given. You will be able to see the difference in --iflist
output now. Before:

DST/MASK       DEV    GATEWAY
192.168.1.0/24 eth0
192.168.0.0/24 eth0

After:

DST/MASK       DEV    GATEWAY
192.168.1.0/24 eth0
192.168.0.0/24 eth0:1

This bug was uncovered by r16970, which I verified to be the revision
where your test script starts failing. This revision was to allow static
route entries to be honored when they conflicted with an interface
address, but it also changed the way interfaces were matched up with
routes. Previously, we had looked directly at the interface list first,
which is why the test script used to find the proper source address. Now
the routing table is preferred over the interface table, and this bug
became visible.

David Fifield
_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://seclists.org/nmap-dev/