mirror of
https://github.com/openembedded/meta-openembedded.git
synced 2026-10-18 07:17:13 +00:00
Leon Anavi
628df95735
Upgrade to release 7.991:
- Upgraded included OpenSSL t- version 3.0.21 on all platforms.
- Fixed a memory-consumption hang in Ncat's HTTP proxy code that
affected both connect and listen modes, reported by kumama_nui.
- Patched our included libssh2 source with upstream fixes for
CVE-2025-15661, CVE-2026-7598, CVE-2026-55199, CVE-2026-55200,
CVE-2026-58050, and CVE-2026-58051. The version number has been
annotated as 1.11.1_NMAP1
- [Zenmap][GH#3347] Fixed several issues leading t- crashes when
parsing, editing, or saving command profiles containing '%'
characters.
- [NSE][GH#2272] smb-enum-shares failed t- produce output for valid
shares when an error was encountered on one share.
- [GH#3410] Fixed an issue where DNS resolution would incorrectly
fail t- match the same name in a different case.
- [NSE][GH#1066] Added service names for SSL-protected services
like amt-soap-https t- portrules for several scripts, ensuring
they run on these as well as the standard unencrypted services.
- Audited and converted most instances of strcat, strcpy, and
sprintf t- use bounded functions instead.
- [NSE][GH#2221] mysql-dump-hashes now uses the correct column name
for MySQL 5.7+
- [NSE][GH#2238] http-referer-checker was incorrectly fetching
off-host URLs. Now only URLs on the target are fetched.
- [GH#2122] When an interface is specified with -e, als- bind t-
the IP address for that device s- that it works for non-Linux
systems and non-root users.
- [Nsock][GH#1939] When nsock_iod_set_localaddr() is used,
nsock_connect_*() will now treat errors in bind(2) as connection
failure.
- [GH#2732] Fix a potential crash on 32-bit platforms in debug mode
due to incorrect format specifier for 64-bit integer type.
[Christopher Chavez]
- [GH#3201][GH#3367] Increase line length limit for
nmap-service-probes and correctly handle lines that are to- long.
[@liquidpele, Ashutosh Kumar Singh]
- [GH#3414] Avoid out-of-bounds read when parsing PTR domain names.
[@toor11 (Juri)]
- [GH#2245] Ensure variables updated by signal handlers are
volatile sig_atomic_t.
- [Ncat][GH#1410] Fix an assertion failure (count <= INT_MAX) in
ncat -lk in some cases where stdin or a listening socket produces
an error.
- [NSE][GH#1946] Fix a cryptic error in smb-enum-services, "Server
returned less data than needed for header" when smb.start_smb()
failed.
- Fixed an issue with parsing nmap-service-probes that could cause
a corrupted file t- crash Nmap. Reported by Muhammed Hussein.
- [NSE][GH#2016] Removed hostmap-bfk.nse, since the service it used
shut down.
- Fixed several issues reported by Himanshu Anand: infinite loop in
TCP options parsing and out-of-bounds memory read in IPv4 OS
detection; integer underflow in IPv6 extension header processing;
and undefined behavior in DNS label parsing.
- [GH#2721] Added checks for returned pointers from OpenSSL
allocation functions.
- [GH#1546] Fix an incorrect assertion "timeout / 1000 <= (long)
o.scan_delay" in traceroute which failed for timeouts greater
than 1 second when there was n- scan delay.
- [GH#3175] The --stats-every option can now be used in conjunction
with --noninteractive. Previously, n- stats messages were printed
if a TTY was not attached.
- [GH#3375] Nmap can now be built with OpenSSL 4.0
- [Nping][GH#1751] The --rate option will not accept a rate higher
than 1000 packets per second, since Nsock timers have millisecond
resolution. Use --delay 0 for unlimited rate.
- [Nping] Fixed several issues with Nping in IPv6 mode including:
+ [GH#1261] Incorrect BPF generated leading t- "expression
rejects all packets"
+ [GH#3215] Incorrect constant used t- check for IP version in
Ech- Server
- [NSE][GH#3368] Fixed an out-of-memory issue in packet.lua when
parsing a zero-length TCP header option. [Maxim Suhanov]
- Fixed an issue where Nmap OS scan trusts a packet's ip_len t-
size a CRC32 computation over TCP RST payload data, which may
result in reading arbitrary heap data. Reported by Michael
Bommarito.
- [Ncat][GH#3005] Correctly report listening port number. `ncat -l
-p 0` will cause Ncat t- listen on an ephemeral port, but it was
reporting itself as listening on port 0.
- [Ncat][GH#1672] Fixed an issue where Ncat in server mode would
quit without printing the last received data on a connection,
particularly affecting SCTP.
- [Ncat][GH#2827] Fixed an issue where Ncat in --send-only mode
would ignore disconnects and crash when it tries t- send data t-
a disconnected client.
- [Ncat][GH#3291] Fixed an issue where Ncat on Windows would quit
after 2 minutes due t- an OS-enforced timeout on the half-open
TCP socket used to emulate STDIN.
- [Nping][GH#564] Allow Nping t- fall back t- TCP Connect mode on
Windows when Npcap is not installed.
- [Ncat] Fixed several issues reported by Muhammed Hussein
involving crashes in Ncat's server-mode HTTP proxy, as well as
one code-quality issue with its Telnet negotiation code.
- [Nsock][GH#2595] Fix an issue where Nsock's SOCKS4 proxy code
would send additional null bytes on Windows and other platforms
where the compiler does not understand __attribute__((packed)).
[Daniel Miller]
- The --release-memory option is now a no-op. Nmap will always run
finalization routines that release allocated memory before
closing.
- Fixed an integer underflow in service_scan.cc that would cause
little-endian integers extracted from the beginning of a service
banner t- be interpreted as 0. Discovered with AFL++ by Malek
Althubiany.
- [Nsock][GH#583] Use OpenSSL security levels and callbacks t-
prevent errors connecting t- certain insecure targets when using
NSOCK_SSL_MAX_SPEED. The default, as used in Ncat, now uses
stricter-than-default security level.
- [GH#410] If a target times out due t- --host-timeout, d- not
perform traceroute.
- [Nping][GH#380] Disallow combining Ethernet-related options like
--dest-mac with --send-ip
- [NSE][GH#3250][GH#3206] Fix assertion failures in cases where
connect or send returns immediately with a status other than
ERROR, e.g. TIMEOUT or CANCELED. [Daniel Miller]
- [Ncat][GH#290] Enable ncat -l --ssl t- use DHE and ECDHE cipher
suites for perfect forward secrecy.
- Fix a crash when writing long CPE strings t- output. Reported by
Harshit Gupta. [Daniel Miller]
- [Ncat] Fix several cases where Ncat's SOCKS5 client could
interpret uninitialized data as protocol data, triggered by a
malicious SOCKS5 proxy server. N- code execution or application
crash is possible. Reported by Govind Pratap Singh. [Daniel
Miller]
- [Nping] Fix a out-of-bounds access in Nping Ech- client allowing
a malicious Nping EchoServer t- zer- 32 bytes of memory outside
the packet buffer. Reported by Harshit Gupta. [Daniel Miller]
- Fix a 1-byte overrun (read) while reading certain crafted DNS
labels, reported by Peter Parker. [Daniel Miller]
- [NSE][GH#3317] Function url.build_path was mangling special
characters in URL path segments. [nnposter]
Drop 0004-libdnet-fix-PF_PACKET-conftest-nested-function.patch
because the check for PF_PACKET that failed with clang has been
fixed with commit 33c39cd38 in the upstream of nmap.
Set OEQA_BUILDPATHS_SKIP to ignore upstream HOME path match and
avoid buildpaths QA error.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
74 lines
3.1 KiB
BlitzBasic
74 lines
3.1 KiB
BlitzBasic
SUMMARY = "network auditing tool"
|
|
DESCRIPTION = "Nmap (Network Mapper) is a free and open source (license) utility for network discovery and security auditing.\nGui support via appending to IMAGE_FEATURES x11-base in local.conf"
|
|
SECTION = "security"
|
|
LICENSE = "LicenseRef-NPSL"
|
|
|
|
LIC_FILES_CHKSUM = "file://LICENSE;md5=895af8527fe4bcb72f271fd1841fd2f6"
|
|
|
|
SRC_URI = "http://nmap.org/dist/${BP}.tar.bz2 \
|
|
file://nmap-replace-shtool-mkdir-with-coreutils-mkdir-command.patch \
|
|
file://0001-Include-time.h-header-to-pass-clang-compilation.patch \
|
|
file://0002-Fix-building-with-libc.patch \
|
|
file://0001-fix-racing-between-build-ncat-and-build-lua.patch \
|
|
"
|
|
SRC_URI[sha256sum] = "a5d507f29437bef3bedd4771ff9aaa8fc1c2a109ddba1f5b1cf12027456929be"
|
|
|
|
UPSTREAM_CHECK_REGEX = "nmap-(?P<pver>\d+(\.\d+)+)\.tar"
|
|
|
|
inherit autotools-brokensep pkgconfig python3native
|
|
|
|
PACKAGECONFIG ?= "pcre ncat nping pcap"
|
|
|
|
PACKAGECONFIG[pcap] = "--with-pcap=linux, --without-pcap, libpcap, libpcap"
|
|
PACKAGECONFIG[pcre] = "--with-libpcre=${STAGING_LIBDIR}/.., --with-libpcre=included, libpcre2"
|
|
PACKAGECONFIG[ssl] = "--with-openssl=${STAGING_LIBDIR}/.., --without-openssl, openssl, openssl"
|
|
PACKAGECONFIG[ssh2] = "--with-openssh2=${STAGING_LIBDIR}/.., --without-openssh2, libssh2, libssh2"
|
|
PACKAGECONFIG[libz] = "--with-libz=${STAGING_LIBDIR}/.., --without-libz, zlib, zlib"
|
|
|
|
#disable/enable packages
|
|
PACKAGECONFIG[nping] = ",--without-nping,"
|
|
PACKAGECONFIG[ncat] = ",--without-ncat,"
|
|
PACKAGECONFIG[ndiff] = "--with-ndiff=yes,--without-ndiff,python3 python3-setuptools-native"
|
|
PACKAGECONFIG[update] = ",--without-nmap-update,"
|
|
|
|
EXTRA_OECONF = "--with-libdnet=included --with-liblinear=included --without-subversion --with-liblua=included"
|
|
|
|
# zenmap needs python-pygtk which has been removed
|
|
# it also only works with python2
|
|
# disable for now until py3 is supported
|
|
EXTRA_OECONF += "--without-zenmap"
|
|
|
|
# nmap links the bundled libdnet statically (libdnet-stripped/src/.libs/libdnet.a),
|
|
# but OE's default --disable-static propagates into that libtool sub-package
|
|
# (last on the command line, so it wins) and only the shared library is built.
|
|
# Drop --disable-static so libtool also produces libdnet.a.
|
|
DISABLE_STATIC = ""
|
|
|
|
# nmap's top-level Makefile does not order the link of nmap/nping after the
|
|
# recursive build of the bundled libdnet, so a parallel build can try to link
|
|
# against libdnet-stripped/src/.libs/libdnet.a before it exists. Serialize.
|
|
PARALLEL_MAKE = ""
|
|
|
|
export PYTHON_SITEPACKAGES_DIR
|
|
|
|
do_configure() {
|
|
autoconf
|
|
install -m 0755 ${STAGING_DATADIR_NATIVE}/gnu-config/config.guess ${S}
|
|
install -m 0755 ${STAGING_DATADIR_NATIVE}/gnu-config/config.sub ${S}
|
|
oe_runconf
|
|
}
|
|
|
|
do_install:append() {
|
|
for f in ndiff uninstall_ndiff; do
|
|
if [ -f ${D}${bindir}/$f ]; then
|
|
sed -i 's@^#!.*$@#!/usr/bin/env python3@g' ${D}${bindir}/$f
|
|
fi
|
|
done
|
|
}
|
|
|
|
FILES:${PN} += "${PYTHON_SITEPACKAGES_DIR} ${datadir}/ncat"
|
|
|
|
RDEPENDS:${PN} += "${@bb.utils.contains('PACKAGECONFIG', 'ndiff', 'python3-difflib python3-asyncio python3-xml', '', d)}"
|
|
|
|
OEQA_BUILDPATHS_SKIP = "${HOME}"
|