Re: DNS bug in nmap-4.00 on PPC and SPARC

[Andrew Lutomirski <luto () myrealbox com>]

The old code looks doubly-broken -- it wrote the octets high-to-low (should
have been low-to-high), but it also forgot to ntohl the IP address, so it
was reversed again on little-endian machines and thus worked by accident.

This patch compiles, but I haven't tested it at all (and I don't have a
big-endian machine, so I couldn't do a good job of it anyway).

--Andy


On 1/31/06, E. Seth Miller <esmiller () umich edu> wrote:
> Greetings-
>         I seem to have found a bug with nmap-4.00 when running on PowerPC
> and SPARC systems.  The new DNS resolution looks up the reverse of the
> correct IP, eg. nmap 141.213.30.72 gives you the domain name belonging to
> 72.30.213.141.
>         I've tested this on MacOS 10.4.4, MacOS 10.3.9, Solaris 2.8, and
> Gentoo Linux PPC (system details appear below) and found this result.  I
> also tested it on Gentoo Linux x86 (2.4 and 2.6 kernels), where it works
> fine.  I'm guessing it is a problem on all big-endian systems.  (If you
> really want, I can dig up NetBSD/mac68k machine to test on as well.
> Yeah, I didn't think so.)
>         I don't have a patch for this, and, realistically, I doubt I can
> come up with one -- I can't code to save my life.  Hopefully this helps
> anyway, and hopefully this hasn't already been reported and I just missed
> it.  Let me know if I can do anything else to assist.
>
>         -Seth Miller
>
> Sample run (note that the correct DNS for this IP is
> beast.dmc.dc.umich.edu):
> [dc-at-3dmac:~] root# /usr/local/bin/nmap -sS 141.213.30.72
>
> Starting Nmap 4.00 ( http://www.insecure.org/nmap/ ) at 2006-01-31 18:57
> EST
> Interesting ports on dc501007.inktomisearch.com (141.213.30.72):
> (The 1671 ports scanned but not shown below are in state: closed)
> PORT   STATE SERVICE
> 22/tcp open  ssh
> MAC Address: 00:04:AC:CB:61:02 (IBM)
>
> Nmap finished: 1 IP address (1 host up) scanned in 0.964 seconds
> [dc-at-3dmac:~] root#
>
> Machine details:
>
> weird-al:willy willy$ gcc --version
> powerpc-apple-darwin8-gcc-4.0.0 (GCC) 4.0.0 (Apple Computer, Inc. build
> 5026)
> weird-al:willy willy$ uname -a
> Darwin weird-al.local 8.3.0 Darwin Kernel Version 8.3.0: Mon Oct  3
> 20:04:04 PDT 2005; root:xnu-792.6.22.obj~2/RELEASE_PPC Power Macintosh
> powerpc
> [12" PowerBook 1GHz running MacOS 10.4.4]
>
> [dc-at-3dmac:~] root# gcc --version
> powerpc-apple-darwin8-gcc-4.0.1 (GCC) 4.0.1 (Apple Computer, Inc. build
> 5250)
> [dc-at-3dmac:~] root# uname -a
> Darwin dc-at-3dmac.dmc.dc.umich.edu 8.4.0 Darwin Kernel Version 8.4.0: Tue
> Jan  3 18:22:10 PST 2006; root:xnu-792.6.56.obj~1/RELEASE_PPC Power
> Macintosh powerpc
> [PowerMac G4 (Quicksilver 2002 DP) running MacOS 10.4.4]
>
> [TiFighter:~] esmiller% gcc --version
> gcc (GCC) 3.3 20030304 (Apple Computer, Inc. build 1671)
> [TiFighter:~] esmiller% uname -a
> Darwin dhcp4.public.dc.umich.edu 7.9.0 Darwin Kernel Version 7.9.0: Wed
> Mar 30 20:11:17 PST 2005; root:xnu/xnu-517.12.7.obj~1/RELEASE_PPC  Power
> Macintosh powerpc
> [15" Titanium PowerBook 1GHz running MacOS 10.3.9]
>
> [aerfs:~] esmiller% gcc --version
> gcc (GCC) 3.3 20030304 (Apple Computer, Inc. build 1671)
> [aerfs:~] esmiller% uname -a
> Darwin aerfs.dmc.dc.umich.edu 7.9.0 Darwin Kernel Version 7.9.0: Wed Mar
> 30 20:11:17 PST 2005; root:xnu/xnu-517.12.7.obj~1/RELEASE_PPC  Power
> Macintosh powerpc
> [PowerMac G4 (Gigabit Ethernet DP) running MacOS 10.3.9]
>
> willy@ltg-pmac2 ~/nmap-4.00 $ gcc --version
> gcc (GCC) 3.4.4 (Gentoo 3.4.4-r1, ssp-3.4.4-1.0, pie-8.7.8)
> willy@ltg-pmac2 ~/nmap-4.00 $ uname -a
> Linux ltg-pmac2.dmc.dc.umich.edu 2.4.26-ppc #6 Mon Jun 7 08:59:48 EDT 2004
> ppc 740/750 PowerMac1,1 GNU/Linux
> [PowerMac G3 (B&W) running Gentoo Linux]
>
> hap% gcc --version
> 3.0.3
> hap% uname -a
> SunOS hap.lsa.umich.edu 5.8 Generic_117000-03 sun4u sparc
> SUNW,Sun-Fire-280R
> [SunFire 280R running Solaris 2.8]
>
> esmiller@angevin ~ $ gcc --version
> gcc (GCC) 3.3.6 (Gentoo 3.3.6, ssp-3.3.6-1.0, pie-8.7.8)
> esmiller@angevin ~ $ uname -a
> Linux angevin 2.6.12-gentoo-r9 #1 SMP Mon Aug 22 07:24:08 EDT 2005 i686
> Pentium III (Coppermine) GenuineIntel GNU/Linux
> [Dell Precision 420 running Gentoo Linux]
> [works correctly on this box -- included for completeness.]
>
>
> _______________________________________________
> Sent through the nmap-dev mailing list
> http://cgi.insecure.org/mailman/listinfo/nmap-dev

Attachment: nmap_dns_endian_fix.txt
Description:

_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev