Re: [NSE][PATCH] only show script errors in verbose mode

[David Fifield <david () bamsoftware com>]

On Wed, Sep 24, 2008 at 10:03:07AM +0200, Sven Klemm wrote:
> |> I think this is an acceptable solution, though of course others are
> |> welcome to share their opinion. I do think that this needs to be
> |> documented in scripting.xml, that require errors are a special case of
> |> errors that are silently ignored.
> |
> | Hi David.  I agree that this patch looks promising.  Though I have a
> | concern which as expressed in a post by Diman last night related to a
> | different proposed solution.  If someone tries to run a script, and
> | the required libraries can't be found (like bit, or shortport, or
> | maybe a more specific one like pop3 related to their script), they
> | probably won't notice the problem.  Ignoring errors is a bit
> | dangerous, so I think we should tailor the ignore rule pretty closely.
> |
> | Yesterday Sven checked in some code to his nmap-exp which modified
> | SSH-hostkey like this:
> |
> | -portrule = shortport.port_or_service(22, "ssh")
> | +if nmap.have_ssl() then
> | +  require("openssl")
> | +  portrule = shortport.port_or_service(22, "ssh")
> | +else
> | +  portrule = function() return false end
> | +end
> |
> | I think this approach warrants some consideration since it is
> | specifically targetted, and does not rely on special case "magic"
> | behavior.  On the other hand, it puts more of a burden on script
> | writers than Patrick's patch.  So I'm fine with whatever solution
> | David decides on.  I agree that the ignore-require-errors approach
> | needs to be documented if we use that.
>
> I am wondering whether we need to suppress those error messages at
> all. Since --script-updatedb now skips scripts it cannot load the user
> can get rid of those error messages by regenerating script.db.

That's a good point. I think it's not common, though, for users to run
--script-updatedb. The scripts.db we ship should include the openssl
scripts.

Sven, is there a way to check if require("openssl") failed by actually
trying it, rather than predicting it will fail with nmap.have_ssl? I
mean, run require("openssl") and somehow catch any error. That would
make the technique more general and it could become the recommended way
to handle scripts which use any optional modules.

David Fifield

_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://SecLists.Org