head 1.5; access; symbols pkgsrc-2026Q3:1.4.0.2 pkgsrc-2026Q3-base:1.4 pkgsrc-2026Q2:1.3.0.10 pkgsrc-2026Q2-base:1.3 pkgsrc-2026Q1:1.3.0.8 pkgsrc-2026Q1-base:1.3 pkgsrc-2025Q4:1.3.0.6 pkgsrc-2025Q4-base:1.3 pkgsrc-2025Q3:1.3.0.4 pkgsrc-2025Q3-base:1.3 pkgsrc-2025Q2:1.3.0.2 pkgsrc-2025Q2-base:1.3 pkgsrc-2025Q1:1.2.0.4 pkgsrc-2025Q1-base:1.2 pkgsrc-2024Q4:1.2.0.2 pkgsrc-2024Q4-base:1.2 pkgsrc-2024Q3:1.1.0.72 pkgsrc-2024Q3-base:1.1 pkgsrc-2024Q2:1.1.0.70 pkgsrc-2024Q2-base:1.1 pkgsrc-2024Q1:1.1.0.68 pkgsrc-2024Q1-base:1.1 pkgsrc-2023Q4:1.1.0.66 pkgsrc-2023Q4-base:1.1 pkgsrc-2023Q3:1.1.0.64 pkgsrc-2023Q3-base:1.1 pkgsrc-2023Q2:1.1.0.62 pkgsrc-2023Q2-base:1.1 pkgsrc-2023Q1:1.1.0.60 pkgsrc-2023Q1-base:1.1 pkgsrc-2022Q4:1.1.0.58 pkgsrc-2022Q4-base:1.1 pkgsrc-2022Q3:1.1.0.56 pkgsrc-2022Q3-base:1.1 pkgsrc-2022Q2:1.1.0.54 pkgsrc-2022Q2-base:1.1 pkgsrc-2022Q1:1.1.0.52 pkgsrc-2022Q1-base:1.1 pkgsrc-2021Q4:1.1.0.50 pkgsrc-2021Q4-base:1.1 pkgsrc-2021Q3:1.1.0.48 pkgsrc-2021Q3-base:1.1 pkgsrc-2021Q2:1.1.0.46 pkgsrc-2021Q2-base:1.1 pkgsrc-2021Q1:1.1.0.44 pkgsrc-2021Q1-base:1.1 pkgsrc-2020Q4:1.1.0.42 pkgsrc-2020Q4-base:1.1 pkgsrc-2020Q3:1.1.0.40 pkgsrc-2020Q3-base:1.1 pkgsrc-2020Q2:1.1.0.36 pkgsrc-2020Q2-base:1.1 pkgsrc-2020Q1:1.1.0.16 pkgsrc-2020Q1-base:1.1 pkgsrc-2019Q4:1.1.0.38 pkgsrc-2019Q4-base:1.1 pkgsrc-2019Q3:1.1.0.34 pkgsrc-2019Q3-base:1.1 pkgsrc-2019Q2:1.1.0.32 pkgsrc-2019Q2-base:1.1 pkgsrc-2019Q1:1.1.0.30 pkgsrc-2019Q1-base:1.1 pkgsrc-2018Q4:1.1.0.28 pkgsrc-2018Q4-base:1.1 pkgsrc-2018Q3:1.1.0.26 pkgsrc-2018Q3-base:1.1 pkgsrc-2018Q2:1.1.0.24 pkgsrc-2018Q2-base:1.1 pkgsrc-2018Q1:1.1.0.22 pkgsrc-2018Q1-base:1.1 pkgsrc-2017Q4:1.1.0.20 pkgsrc-2017Q4-base:1.1 pkgsrc-2017Q3:1.1.0.18 pkgsrc-2017Q3-base:1.1 pkgsrc-2017Q2:1.1.0.14 pkgsrc-2017Q2-base:1.1 pkgsrc-2017Q1:1.1.0.12 pkgsrc-2017Q1-base:1.1 pkgsrc-2016Q4:1.1.0.10 pkgsrc-2016Q4-base:1.1 pkgsrc-2016Q3:1.1.0.8 pkgsrc-2016Q3-base:1.1 pkgsrc-2016Q2:1.1.0.6 pkgsrc-2016Q2-base:1.1 pkgsrc-2016Q1:1.1.0.4 pkgsrc-2016Q1-base:1.1 pkgsrc-2015Q4:1.1.0.2 pkgsrc-2015Q4-base:1.1; locks; strict; comment @# @; 1.5 date 2026.10.20.18.31.29; author adam; state Exp; branches; next 1.4; commitid 5CBiwD6bm1Z6if0H; 1.4 date 2026.09.14.22.10.12; author tnn; state Exp; branches; next 1.3; commitid BE2ZB9oJfLKkFDVG; 1.3 date 2025.05.15.15.44.41; author adam; state Exp; branches; next 1.2; commitid ogNfvdLFszyjb1VF; 1.2 date 2024.12.17.13.29.09; author tnn; state Exp; branches; next 1.1; commitid 4FWi0gjzxnl5eRBF; 1.1 date 2015.11.20.15.37.40; author adam; state Exp; branches; next ; commitid hWRJNoWNPxVeuQJy; desc @@ 1.5 log @nmap ndiff zenmap: updated to 7.992 Nmap 7.992 [2026-10-15] o Upgraded included libraries: - Source: libpcap 1.10.7, pcre2 10.49, lua 5.4.9, libdnet 1.18.2 - Binary installers: OpenSSL 3.5.9, Python 3.14.8 o [Windows] Upgraded the included version of Npcap from 1.88 to 1.89, resolving one crash and upgrading to libpcap 1.10.7. See https://npcap.com/changelog o [Security][NSE] Karan Bamal of SentinelOne reported the following issues with NSE scripts and libraries, which have all been fixed: - afp.lua used a hardcoded DH private exponent, so that credentials passed via command line could be decrypted from network traffic. The DHCAST128 UAM is known to be cryptographically broken, and has been replaced in this release with DHX2. - Redirect to unverified URL in anyconnect.lua and upnp.lua - Unbounded memory consumption in rpc.lua, drda.lua, eigrp.lua, msrpctypes.lua, db2-das-info, and dns-zone-transfer - Uninterruptible CPU usage (infinite loop) not subject to --script-timeout or --host-timeout in rdp.lua, tn3270.lua, and ospf.lua - Infinite loop waiting for errored coroutines in tftp.lua, effectively mitigated by --script-timeout o [Security] Zach Hanley of Horizon3.ai, in collaboration with Claude and Anthropic Research, reported three issues, which have all been fixed: - Two distinct use-after-free bugs in massdns parallel DNS resolver. - NSE uses the default seed for Lua's pseudorandom number generator, namely the output of time() and the heap address of the Lua state. A brute-force search based on math.random()-generated network traffic can reveal the ASLR base address of the process. o [Security][NSE] In some non-standard builds (e.g. --without-openssl), NSE scripts were attempting to load missing Lua modules from the current working directory. Fixed by removing Lua's default package searchers, leaving only the existing nselib file fetcher. o Added a libfuzzer-based framework for fuzzing internal functions of Nmap, Ncat, and Nping. So far, 10 functions have been instrumented and 3 minor issues have been fixed. [Daniel Miller] o Fixed an rare false-positive case in TCP Connect scan (-sT) where a failed connect() may leave SO_ERROR set to 0 even though an ICMP error has been received and select() has indicated the socket. o [NSE] Introduced execution time and memory allocation limits for NSE scripts. Script threads that run for more than 5 seconds without yielding (e.g. calling a socket operation) will be killed. Memory allocations beyond 400MB will throw an error. Specific limits may be changed in the future. o [NSE] Added 8 new scripts, for a total of 620 NSE scripts, all for auditing DICOM (medical imaging) services: + dicom-info fingerprints a DICOM SCP via A-ASSOCIATE, reporting its Implementation Class UID and Version Name, accepted SOP classes and transfer syntaxes, max PDU and protocol version; over TLS it also reports the server certificate (key type/size, signature algorithm, with weak- crypto and self-signed flags) and the mutual-TLS / client-certificate posture. [Paulino Calderon] + dicom-cfind-ls performs C-FIND queries to enumerate studies and series and the patient-level metadata an archive returns, flagging unauthenticated query access. [Paulino Calderon] + dicom-cmove exercises C-MOVE to test whether stored studies can be retrieved to an arbitrary destination AE. [Paulino Calderon] + dicom-get retrieves instances over C-GET, performing SCP/SCU role negotiation so the retrieval actually completes, and reports unauthenticated read access. [Paulino Calderon] + dicom-store-fuzzer fuzzes the C-STORE service with a corpus of malformed datasets, classifying each response (accept, reject, timeout, reset, corrupt) and running a periodic C-ECHO health check to detect crashes mid-campaign. [Paulino Calderon] + dicom-store-inject tests whether an archive accepts an unauthenticated C-STORE by uploading a single clearly-synthetic Secondary Capture instance (fake patient, "safe to delete" markers, UIDs under the 2.25 arc) and reporting whether it was stored, refused, or the association was rejected; it prints the stored UIDs for cleanup. [Paulino Calderon] + dicom-web-enum enumerates DICOMweb (PS3.18) services over HTTP(S) -- QIDO-RS, WADO-RS and STOW-RS -- classifying each as open, authentication- required or absent, reporting the study/patient metadata an unauthenticated client can read and flagging an open STOW-RS store (image-injection) surface. [Paulino Calderon] + dicom-slowloris probes for DICOM association-pool exhaustion (a slowloris- style DoS) in idle, C-ECHO keep-alive and partial-handshake modes, measuring a latency baseline, requiring repeated confirmation before declaring exhaustion, and reporting a graded verdict with recovery time. [Paulino Calderon] o [Zenmap] Fixed crashes: - configparser.DuplicateSectionError in Profile Editor - KeyError: 'vl_6_logo' - sqlite3.DatabaseError: database disk image is malformed o [NSE] Expanded the dicom.lua library from a basic A-ASSOCIATE/C-ECHO helper into a full DIMSE toolkit. It now supports C-STORE, C-FIND, C-GET and C-MOVE; A-ASSOCIATE-RQ with multiple presentation contexts and SCP/SCU role negotiation (so C-GET sub-operations work); command-set and dataset build/ parse in implicit and explicit VR; and DICOM-over-TLS transport (PS3.15, port 2762) selectable with the dicom.tls script-arg. [Paulino Calderon] o [Ndiff] Fixed `make check-ndiff` to work with Python 3.12+ [gargamel778] o [NSE] vulners API queries for versions like 4.100 were being truncated on the server, resulting in false positives. Fixed by encoding as string. [huuyafwww] o [Ncat] Ncat in listen mode no longer sends termination signals to its process group. Ncat inherits the group of whatever launched it, so a SIGINT, SIGTERM, SIGHUP, or SIGQUIT could also terminate the caller's shell or test harness. The signal is now forwarded to the children Ncat started for connections when -k and cmdexec are both in effect. [MRX-72] o [Nsock] Nsock no longer calls fatal() when encountering a pcap-related error. Instead, errors are propagated to the caller the same way other socket errors are handled. o Fixed warnings and crashes due to bind() failing on macOS and FreeBSD, as well as Nping probe failures. Error messages similar to: "mksock_bind_addr(): Bind to :0 failed (IOD #3): Invalid argument (22)" [Daniel Miller, MRX-72] o [NSE] Added DHX2 authentication method to afp.lua [Daniel Miller] o [NSE] Function ipOps.isPrivate() was incorrectly treating all IPv4 addresses starting with 192.0.2x or 192.0.2xx as private. [Pasi Abe] o [NSE] Function ipOps.expand_ip() now strips off any leading zeros from IPv4 octets, returning "10.0.0.0", not "010.000.0.0", for input "010.000". This also resolves a bug where "010" was not recognized as a private IP address. [nnposter] o [NSE] Malformed TPKT header could have caused parser infinite loop in library iec61850mms. Truncated data were silently ignored. [Zasnit1, nnposter] o Prevent -iR from running forever if all addresses are excluded or if all available addresses have been scanned with --unique. The underlying addrset trie has been optimized for fast lookup and minimal memory use. o [NSE] IP options parsing by the packet library no longer crashes on incomplete options. IP header data after EOOL are no longer parsed as options. [Ibrahim AlJaafreh, nnposter] o [NSE] Rudimentary support for 802.1Q / 802.1ad VLAN tags [nnposter] - NSE packet.Frame:new() parses VLAN tags and captures the result in list frame.vlans. Each element is a table containing the expected fields: TPID, CPC, DEI, and VID (all in lowercase). - NSE packet.Frame:build_ether_frame() takes an an optional parameter in the form of the list above to build 802.1Q / 802.1ad headers. o [NSE] Script http-config-backup was always failing. [h00die] o [NSE] The rsync library was not correctly parsing server responses for protocol version 32. [h00die] o [NSE] Script iec61850-mms was never executed due to a flawed portrule. [RyugaXhypeR] o [NSE] Scripts http-config-backup and rsync-list-modules now provide XML output. [nnposter] o Fixed a fatal error in traceroute with -sO: "Unknown protocol _: QUITTING." o Made DNS TXID random, not sequential, in massdns.cc. o [NSE] Nmap now tolerates TLS targets that do not send close_notify. [nnposter] @ text @$NetBSD: patch-configure,v 1.4 2026/09/14 22:10:12 tnn Exp $ pcap_version is not portable; use pcap_lib_version(), which returns a string like "libpcap version 1.10.7 (...)", so skip to the first digit before parsing it. External liblinear must be configured later. --- configure.orig 2026-10-12 17:36:47.000000000 +0000 +++ configure @@@@ -7477,13 +7477,16 @@@@ else $as_nop /* end confdefs.h. */ #include -extern char pcap_version[]; +#include int main (void) { - int major, minor1, minor2; + int major = 0, minor1 = 0, minor2 = 0; + const char *pcap_version = pcap_lib_version(); + while (*pcap_version != '\0' && (*pcap_version < '0' || *pcap_version > '9')) + pcap_version++; sscanf(pcap_version,"%d.%d.%d", &major, &minor1, &minor2); if (major > 0) return 0; @@@@ -7520,13 +7523,16 @@@@ else $as_nop #ifdef HAVE_NET_BPF_H #include #endif -extern char pcap_version[]; +#include int main (void) { - int major, minor; + int major = 0, minor = 0; + const char *pcap_version = pcap_lib_version(); + while (*pcap_version != '\0' && (*pcap_version < '0' || *pcap_version > '9')) + pcap_version++; sscanf(pcap_version,"%d.%d", &major, &minor); if ((major == 1 && minor >= 1) || major > 1) return 0; @@@@ -8668,7 +8674,6 @@@@ then : *) CPPFLAGS="-I$with_liblinear/include $CPPFLAGS" LDFLAGS="-L$with_liblinear/lib $LDFLAGS" - have_liblinear=yes ;; esac @ 1.4 log @nmap: make libpcap detection more robust in configure @ text @d1 1 a1 1 $NetBSD: patch-configure,v 1.3 2025/05/15 15:44:41 adam Exp $ d9 1 a9 1 --- configure.orig 2025-05-06 17:33:27.000000000 +0000 d11 1 a11 1 @@@@ -6274,9 +6274,12 @@@@ else d17 5 a21 1 int main() { d30 1 a30 1 @@@@ -6310,9 +6313,12 @@@@ else d36 5 a40 1 int main() { d49 1 a49 1 @@@@ -7196,7 +7202,6 @@@@ if test "${with_liblinear+set}" = set; t @ 1.3 log @nmap ndiff zenmap: updated to 7.97 Nmap 7.97 [2025-05-12] o [Zenmap] Fix a crash when starting a scan on Windows in locales that use non-latin character sets. Also changed Nmap to print the time zone as an offset from UTC instead of as a localized string. [Daniel Miller] o Fixed an issue with the parallel forward DNS resolver: it had not been consulting /etc/hosts, nor did it correctly handle the 'localhost' name. [Daniel Miller] o Mitigate a false-positive detection by replacing a malicious URL in the example output of http-malware-host [nnposter] Nmap 7.96 [2025-05-01] o Upgraded included libraries: OpenSSL 3.0.16, Lua 5.4.7, libssh2 1.11.1, libpcap 1.10.5, libpcre2 10.45 o [Windows] Upgraded the included version of Npcap from version 1.79 to the latest version 1.82, bringing faster packet injection, VLAN header capture, and support for SR-IOV adapters, along with many other bug fixes and feature enhancements described at https://npcap.com/changelog o Nmap now performs forward DNS lookups in parallel, using the same engine that has been reliably performing reverse-DNS lookups for nearly a decade. Scanning large lists of hostnames is now enormously faster and avoids the unresponsive wait for blocking system calls, so progress stats can be shown. In testing, resolving 1 million website names to both IPv4 and IPv6 took just over an hour. The previous system took 49 hours for the same data set! [Daniel Miller] o [Nping] Promoted Nping version number from a 0.7.95 alpha release to the same release version as Nmap. o [Zenmap] Added dark mode, accessed via Profile->Toggle Dark Mode or window::dark_mode in zenmap.conf. [Daniel Miller] o [NSE] Added 3 new scripts, for a total of 612 NSE scripts: + mikrotik-routeros-version queries MikroTik's WinBox router admin service to get the RouterOS version. New service probes were also added for this service. [deauther890, Daniel Miller] + mikrotik-routeros-username-brute brute-forces WinBox usernames for the router using CVE-2024-54772. [deauther890] + targets-ipv6-eui64 generates target IPv6 addresses from a user-provided file of MAC addresses, using the EUI-64 method. [Daniel Miller] o Fixed an issue preventing the Nmap OEM 7.95 uninstaller from correctly uninstalling Nmap OEM. o [Nsock][Windows] Fixed the IOCP Nsock engine, which had been demoted since Nmap 7.91 due to unresolved issues around SSL sockets and IPv6. [Daniel Miller] o Fixed the issue where TCP Connect scans (-sT) on Windows would show 'filtered' instead of 'closed', due to differences in understanding timeouts. o Nmap is now able to scan IP protocol 255. [nnposter] o Nmap will now allow targets to be specified both on the command line and in an input file with -iL. Previously, if targets were provided in both places, only the targets in the input file would be scanned, and no notice was given that the command-line targets were ignored. [Daniel Miller] o [Zenmap] Fixed a Zenmap crash in DiffViewer when Ndiff exits with error. o [Zenmap] Fixed several UnicodeDecodeError or UnicodeEncodeError crashes throughout Zenmap. o [Zenmap] Fixed an issue preventing Zenmap from launching if nmap was not in the PATH. The issue primarily affected macOS users. [Daniel Miller] o Fixed a couple of issues with parsing the argument to the -iR option. o [NSE] Added TLS support to redis.lua and improved -sV detection of redis. o Fix 2 potential crashes in parsing IPv6 extension headers discovered using AFL++ fuzzer. [Domen Puncer Kugler, Daniel Miller] o [Nping] Bind raw socket to device when possible. This was already done for IPv6, but was needed for IPv4 L3 tunnels. [ValdikSS] o [Ncat] Ncat in connect mode no longer defaults to half-closed TCP connections. This makes it more compatible with other netcats. The -k option will enable the old behavior. See https://seclists.org/nmap-dev/2013/q1/188 [Daniel Miller] o [Nsock] Fix an issue affecting Ncat where unread bytes in the SSL layer's buffer could not be read until more data arrived on the socket, which could lead to deadlock. [Daniel Miller] o [Ncat] New Ncat option -q to delay quit after EOF on stdin, the same as traditional netcat's -q option. [Daniel Miller] o [Ncat] Ncat in listen mode with -e or -c correctly handles error and EOF conditions that had not been being delivered to the child process. o [Ncat][Windows] All Nsock engines now work correctly. The default is still 'select', but others can be set with --nsock-engine=iocp or --nsock-engine=poll [Daniel Miller] o [NSE] SSH NSE scripts now catch connection errors thrown by the libssh2 Lua binding, providing useful output instead of a backtrace. [Joshua Rogers, Daniel Miller] o [NSE] Several fixes and extensions to the libssh2 NSE bindings: fixed libssh2.channel_read_stderr, which was reading stdout instead; add binding for libssh2_userauth_publickey_frommemory; allow open_channel to avoid allocating a pty; o [Nsock] Improvements for platforms without selectable pcap handles (e.g. Windows). Interleaved pcap and socket events were favoring pcap reads, possibly resulting in timeouts of the socket events. [Daniel Miller] o [Nsock] Improved memory performance of poll engine on Windows. [Daniel Miller] o [Nsock] Improvements to Nsock event list management, fixing errors like "could not find 1 of the purportedly pending events on that IOD." [Daniel Miller] o When Nmap is used with --disable-arp-ping, a local IP that cannot be ARP-resolved will use the "no-route" reason instead of the "unknown-response" reason, since no response was received. o [NSE] Various bug fixes in the mssql NSE library. [johnjaylward, nnposter] o [NSE] Testing for acceptance of SSH keys for a given username caused heap corruption. [Julijan Nedic, nnposter] o [NSE] Scripts were not able to load SSH public keys. from a file. [nnposter] o [NSE] Encryption/decryption performed by the OpenSSL NSE module did not work correctly when the IV started with a null byte. [nnposter] o [NSE] Arbitrary separator in stdnse.tohex() is now supported. Script smb-protocols now reports SMB dialects correctly. [nnposter] o [NSE] ether_type inconsistency in packet.Frame has been resolved. Both Frame:new() and Frame:build_ether_frame() now use an integer. [nnposter] @ text @d1 1 a1 1 $NetBSD: patch-configure,v 1.2 2024/12/17 13:29:09 tnn Exp $ d3 3 a5 1 pcap_version is not portable. d11 1 a11 1 @@@@ -6274,9 +6274,10 @@@@ else d18 2 a19 1 int major, minor1, minor2; d21 2 d26 1 a26 1 @@@@ -6310,9 +6311,10 @@@@ else d33 5 a37 2 int major, minor; + const char *pcap_version = pcap_lib_version(); d41 1 a41 1 @@@@ -7196,7 +7198,6 @@@@ if test "${with_liblinear+set}" = set; t @ 1.2 log @nmap: fix detection of pkgsrc libpcap @ text @d1 3 a3 1 $NetBSD: patch-configure,v 1.1 2015/11/20 15:37:40 adam Exp $ d7 1 a7 1 --- configure.orig 2024-04-12 17:20:04.000000000 +0000 d9 1 a9 1 @@@@ -7137,9 +7137,11 @@@@ else $as_nop d13 2 a14 2 +#include extern char pcap_version[]; d17 1 a17 1 + exit(0); /* fool it */ d21 13 a33 1 @@@@ -8162,7 +8164,6 @@@@ then : @ 1.1 log @Changes 7.00: * Major Nmap Scripting Engine (NSE) Expansion * Mature IPv6 support * Infrastructure Upgrades * Faster Scans * SSL/TLS scanning solution of choice * Ncat Enhanced * Extreme Portability @ text @d1 1 a1 1 $NetBSD$ d5 1 a5 1 --- configure.orig 2015-11-10 04:26:26.000000000 +0000 d7 5 a11 1 @@@@ -6192,6 +6192,7 @@@@ else d19 1 a19 1 @@@@ -6894,7 +6895,6 @@@@ if test "${with_liblinear+set}" = set; t @