Nmap Development mailing list archives
Re: [nse] bug: a race in broadcast-dhcp-discover.nse
From: David Fifield <david () bamsoftware com>
Date: Mon, 9 Jan 2012 19:30:04 -0800
On Sat, Oct 01, 2011 at 12:01:51PM +0400, Vasiliy Kulikov wrote:
action = function() ... local status, packet = dhcp.dhcp_build(request_type, ip_address, mac, request_options, overrides, lease_time, transaction_id) ... socket:sendto( host, port, packet ) ... -- start a listening thread for each interface for iface, _ in pairs(interfaces) do local co = stdnse.new_thread( dhcp_listener, iface, timeout, transaction_id, result ) threads[co] = true end ... end local function dhcp_listener(iface, timeout, xid, result) ... sock:pcap_open(iface, 1500, false, "ip && udp && port 68") ... end The packet is sent before pcap_open(). If our host is slow and remote host is fast, we'll get a result before we start to listen. IOW the response will be lost.
I think this is fixed now in r27791. David Fifield _______________________________________________ Sent through the nmap-dev mailing list http://cgi.insecure.org/mailman/listinfo/nmap-dev Archived at http://seclists.org/nmap-dev/
Current thread:
- Re: [nse] bug: a race in broadcast-dhcp-discover.nse David Fifield (Jan 09)