diff options
| author | Cy Schubert <cy@FreeBSD.org> | 2026-08-20 20:34:58 +0000 |
|---|---|---|
| committer | Cy Schubert <cy@FreeBSD.org> | 2026-08-20 20:37:11 +0000 |
| commit | 2fea86703894dd7f898f9752b0aee17b90ce23fb (patch) | |
| tree | 3bf08f4b49226408eb8904553ee92bd8d178ac45 /java/rubygem-rjb/(developers-only) | |
| parent | 3d1e0c8cb163b0bb0b2914b7a399e0cfa592fae3 (diff) | |
Fix mksock_bind_addr EINVAL on FreeBSD in service/connect scans.
From https://github.com/nmap/nmap/pull/3439:
Summary
Fixes #3438 — mksock_bind_addr(): Bind to <IP>:0 failed ... Invalid argument (22)
on FreeBSD when running -sV (service version scan).
Root Cause
After commit eb79c42, nsock_iod_set_localaddr() is called for every service
probe whenever a source address can be determined via routing — not only when
the user explicitly requests source binding via -S or -e.
On FreeBSD, the subsequent bind() call fails with EINVAL because the stored
addrlen may equal sizeof(sockaddr_storage) (128 bytes) rather than the
protocol-specific size the POSIX-strict kernel requires:
sizeof(sockaddr_in) = 16 for AF_INET
sizeof(sockaddr_in6) = 28 for AF_INET6
Linux silently accepts oversized addrlen values, which masked the bug there.
Fix
Recompute the correct protocol-specific length from ss_family immediately
before each call to nsock_iod_set_localaddr() or bind() in:
service_scan.cc
nse_nsock.cc (2 instances)
scan_engine_connect.cc
This preserves the intended behavior of eb79c42 (binding on -e as well as
-S) while making the code correct on all platforms.
Tested on
FreeBSD 15.1-RELEASE amd64 — bug confirmed fixed
nmap -p 22 --open -sV <subnet> produces clean output with no NSOCK errors
Repored by: diizzy
Obtained from: https://github.com/nmap/nmap/pull/3439
Diffstat (limited to 'java/rubygem-rjb/(developers-only)')
0 files changed, 0 insertions, 0 deletions
