Re: Updating scripts

[Martin Holst Swende <martin () swende se>]

On 08/19/2010 06:39 AM, Ron wrote:
> Hi Martin,
>
> I love the idea, and it's something I've been pushing for for awhile. The biggest issue I see is that certain scripts 
> require certain minimum levels of Nmap to run, and the interface between scripts and Nmap is still fairly fluid 
> version to version. For example, we just added pre- and postrule functions. 
>
> For this to work, scripts would have to include the minimum level of Nmap that they require to run. And maybe if a 
> certain number of scripts are disabled due to version issues, it could print a warning that Nmap needs to be updated?
>   
I had not thought of that, but now that I do, I see two possible
solutions. One is like you say, which perhaps would be something like
the scripts having not only action and portrule, but also versionrule:
#pseudo:
function versionrule(ver)
    return ver > 5.20
end
#Or, for a script which is deprecated/replaced for new nmap versions
(but for some reason maintained for old ones):
function versionrule(ver)
    return ver > 5.20 and ver < 6.0
end
#-- Alternate way would be to not use version numbers, instead some kind
of compile-time variables made accessible to nse:
function versionrule(features)
    return features["postrule"] =~nil
end
--

The other solution that could be used could be to use named branches. If
changes that affect NSE does not occur too frequently we could use named
branches to update from. Whenever a major change occurs which makes new
scripts not being able to be used on old nmap versions, the NSE
changeset tree is branched, and the new branch gets a new name. The old
nmap versions still fetch from the old named branch (which can still be
maintained for a period if we wish) and only new nmap versions fetch
from the most recent branch. I have not worked much with named branches
in hg, but afaik this could work.

/Martin

> Ron
>
> On Wed, 18 Aug 2010 19:07:26 +0200 Martin Holst Swende
> <martin () swende se> wrote:
>   
> > Hi list,
> >
> > Thought I would just throw an idea here and see if it sticks...
> >
> > A feature that would be neat would be to update the nse scripts
> > without updating nmap. Why nse in partucular?
> > - It is interpreted, no need to recompile and reinstall nmap after
> > update
> > - it is updated frequently, e.g when vulnerabilitied are released and
> > scripts detecting them are released
> >
> > Also, a nice addition to this feature would be to update from another
> > location, e.g from Patriks nse- repo where he may have some new
> > scripts he wants some help testing.
> >
> > All of this could be easily accomplished if the nse-parts are moved
> > into a distributed moderns rcs, such as git, hg or bazaar. I myself
> > am mostly familiar with hg, but I think they all could be used for
> > this purpose. 
> >
> > There are other benefits aswell, but these above would greatly
> > benefit the nmap user base and not just the developers. For
> > developers, it would make it easier to track changes, submit
> > (publish) new scripts or changes, develop in branches and reduce the
> > load for the person reviewing modified scripts. 
> >
> > Just my 5 cents. 
> >
> > Regards,
> > Martin
> > _______________________________________________
> > Sent through the nmap-dev mailing list
> > http://cgi.insecure.org/mailman/listinfo/nmap-dev
> > Archived at http://seclists.org/nmap-dev/
> >     
>
>   
>
>
> _______________________________________________
> Sent through the nmap-dev mailing list
> http://cgi.insecure.org/mailman/listinfo/nmap-dev
> Archived at http://seclists.org/nmap-dev/

_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://seclists.org/nmap-dev/