Download raw body.
nmap update + security fix
2026-07-29T15:45:53+0100 Stuart Henderson <stu@spacehopper.org>:
> re https://www.openwall.com/lists/oss-security/2026/07/29/4
> but also we don't have 7.99 yet, here's an update + patch.
>
> ok?
Built and tested runtime lightly. ok jtt@
> Index: Makefile
> ===================================================================
> RCS file: /cvs/ports/net/nmap/Makefile,v
> diff -u -p -r1.155 Makefile
> --- Makefile 10 Mar 2026 15:33:11 -0000 1.155
> +++ Makefile 29 Jul 2026 14:44:28 -0000
> @@ -1,9 +1,9 @@
> COMMENT= scan ports and fingerprint stack of network hosts
>
> -DISTNAME= nmap-7.98
> +DISTNAME= nmap-7.99
>
> # "grep version ndiff/pyproject.toml" (used in ndiff-x.yz.dist-info files)
> -MODPY_DISTV= 7.96
> +MODPY_DISTV= 7.99
>
> CATEGORIES= net security
> EXTRACT_SUFX= .tgz
> Index: distinfo
> ===================================================================
> RCS file: /cvs/ports/net/nmap/distinfo,v
> diff -u -p -r1.43 distinfo
> --- distinfo 10 Mar 2026 15:33:11 -0000 1.43
> +++ distinfo 29 Jul 2026 14:44:28 -0000
> @@ -1,2 +1,2 @@
> -SHA256 (nmap-7.98.tgz) = jC8l0RwqKirnZEHL45b/p/CtcY21oUXZlnJp8cqDE3A=
> -SIZE (nmap-7.98.tgz) = 14987565
> +SHA256 (nmap-7.99.tgz) = kzwRrGR9wQmt3RyumHpOSQNtJECBS+7PD8N6h29btdY=
> +SIZE (nmap-7.99.tgz) = 15862050
> Index: patches/patch-nmap_dns_cc
> ===================================================================
> RCS file: /cvs/ports/net/nmap/patches/patch-nmap_dns_cc,v
> diff -u -p -r1.4 patch-nmap_dns_cc
> --- patches/patch-nmap_dns_cc 10 Mar 2026 15:33:11 -0000 1.4
> +++ patches/patch-nmap_dns_cc 29 Jul 2026 14:44:28 -0000
> @@ -5,7 +5,7 @@ https://github.com/nmap/nmap/commit/3ada
> Index: nmap_dns.cc
> --- nmap_dns.cc.orig
> +++ nmap_dns.cc
> -@@ -1671,7 +1671,7 @@ bool DNS::Factory::ptrToIp(const std::string &ptr, soc
> +@@ -1679,7 +1679,7 @@ bool DNS::Factory::ptrToIp(const std::string &ptr, soc
> memset(&ip, 0, sizeof(sockaddr_storage));
>
> // Check whether the name ends with the IPv4 PTR domain
> @@ -14,7 +14,7 @@ Index: nmap_dns.cc
> {
> struct sockaddr_in *ip4 = (struct sockaddr_in *)&ip;
> static const u8 place_value[] = {1, 10, 100};
> -@@ -1706,7 +1706,7 @@ bool DNS::Factory::ptrToIp(const std::string &ptr, soc
> +@@ -1714,7 +1714,7 @@ bool DNS::Factory::ptrToIp(const std::string &ptr, soc
> ip.ss_family = AF_INET;
> }
> // If not, check IPv6
> Index: patches/patch-nping_Crypto_cc
> ===================================================================
> RCS file: patches/patch-nping_Crypto_cc
> diff -N patches/patch-nping_Crypto_cc
> --- patches/patch-nping_Crypto_cc 10 Mar 2026 15:33:11 -0000 1.3
> +++ /dev/null 1 Jan 1970 00:00:00 -0000
> @@ -1,12 +0,0 @@
> -Index: nping/Crypto.cc
> ---- nping/Crypto.cc.orig
> -+++ nping/Crypto.cc
> -@@ -69,7 +69,7 @@
> - #include <openssl/evp.h>
> - #include <openssl/err.h>
> -
> --#if (OPENSSL_VERSION_NUMBER >= 0x10100000L) && !defined LIBRESSL_VERSION_NUMBER
> -+#if (OPENSSL_VERSION_NUMBER >= 0x10100000L)
> - #define HAVE_OPAQUE_EVP_PKEY 1
> - #else
> - #define EVP_MD_CTX_new EVP_MD_CTX_create
> Index: patches/patch-nse_openssl_cc
> ===================================================================
> RCS file: patches/patch-nse_openssl_cc
> diff -N patches/patch-nse_openssl_cc
> --- patches/patch-nse_openssl_cc 10 Mar 2026 15:33:11 -0000 1.6
> +++ /dev/null 1 Jan 1970 00:00:00 -0000
> @@ -1,14 +0,0 @@
> -Fake amd64 RC4_options() output to avoid more intrusive patch.
> -
> -Index: nse_openssl.cc
> ---- nse_openssl.cc.orig
> -+++ nse_openssl.cc
> -@@ -13,7 +13,7 @@
> - #include <openssl/hmac.h>
> - #include <openssl/rand.h>
> -
> --#if (OPENSSL_VERSION_NUMBER >= 0x10100000L) && !defined LIBRESSL_VERSION_NUMBER
> -+#if (OPENSSL_VERSION_NUMBER >= 0x10100000L)
> - #define HAVE_OPAQUE_STRUCTS 1
> - #if OPENSSL_VERSION_NUMBER >= 0x30000000L
> - # include <openssl/provider.h>
> Index: patches/patch-nse_ssl_cert_cc
> ===================================================================
> RCS file: patches/patch-nse_ssl_cert_cc
> diff -N patches/patch-nse_ssl_cert_cc
> --- patches/patch-nse_ssl_cert_cc 10 Mar 2026 15:33:11 -0000 1.3
> +++ /dev/null 1 Jan 1970 00:00:00 -0000
> @@ -1,30 +0,0 @@
> -Index: nse_ssl_cert.cc
> ---- nse_ssl_cert.cc.orig
> -+++ nse_ssl_cert.cc
> -@@ -79,7 +79,7 @@
> - #include <openssl/evp.h>
> - #include <openssl/err.h>
> -
> --#if (OPENSSL_VERSION_NUMBER >= 0x10100000L) && !defined LIBRESSL_VERSION_NUMBER
> -+#if (OPENSSL_VERSION_NUMBER >= 0x10100000L)
> - /* Technically some of these things were added in 0x10100006
> - * but that was pre-release. */
> - #define HAVE_OPAQUE_STRUCTS 1
> -@@ -488,6 +488,9 @@ int lua_push_ecdhparams(lua_State *L, EVP_PKEY *pubkey
> - lua_setfield(L, -2, "ec_curve_type");
> - }
> - else {
> -+#if defined(LIBRESSL_VERSION_NUMBER)
> -+ lua_pushstring(L, "explicit_prime");
> -+#else
> - /* According to RFC 5480 section 2.1.1, explicit curves must not be used with
> - X.509. This may change in the future, but for now it doesn't seem worth it
> - to add in code to extract the extra parameters. */
> -@@ -502,6 +505,7 @@ int lua_push_ecdhparams(lua_State *L, EVP_PKEY *pubkey
> - /* Something weird happened. */
> - lua_pushstring(L, "UNKNOWN");
> - }
> -+#endif
> - lua_setfield(L, -2, "ec_curve_type");
> - }
> - lua_setfield(L, -2, "curve_params");
> Index: patches/patch-nselib_packet_lua
> ===================================================================
> RCS file: patches/patch-nselib_packet_lua
> diff -N patches/patch-nselib_packet_lua
> --- /dev/null 1 Jan 1970 00:00:00 -0000
> +++ patches/patch-nselib_packet_lua 29 Jul 2026 14:44:28 -0000
> @@ -0,0 +1,33 @@
> +From 7ef4ee030a0023fe22616387a000032e1a678b6a Mon Sep 17 00:00:00 2001
> +From: dmiller <dmiller@e0a8ed71-7df4-0310-8962-fdc924857419>
> +Date: Thu, 11 Jun 2026 18:31:31 +0000
> +Subject: [PATCH] Stop parsing on a zero-length packet option
> +
> +Fixes #3368. Closes #3373.
> +
> +Index: nselib/packet.lua
> +--- nselib/packet.lua.orig
> ++++ nselib/packet.lua
> +@@ -686,10 +686,7 @@ function Packet:parse_options(offset, length)
> + local opt_ptr = 0
> + while opt_ptr < length do
> + local t, l, d
> +- options[op] = {}
> +-
> + t = self:u8(offset + opt_ptr)
> +- options[op].type = t
> + if t==0 or t==1 then
> + l = 1
> + d = nil
> +@@ -699,6 +696,11 @@ function Packet:parse_options(offset, length)
> + d = self:raw(offset + opt_ptr + 2, l-2)
> + end
> + end
> ++ if l==0 then
> ++ break
> ++ end
> ++ options[op] = {}
> ++ options[op].type = t
> + options[op].len = l
> + options[op].data = d
> + opt_ptr = opt_ptr + l
> Index: patches/patch-scan-engine_cc
> ===================================================================
> RCS file: /cvs/ports/net/nmap/patches/patch-scan-engine_cc,v
> diff -u -p -r1.16 patch-scan-engine_cc
> --- patches/patch-scan-engine_cc 10 Mar 2026 15:33:11 -0000 1.16
> +++ patches/patch-scan-engine_cc 29 Jul 2026 14:44:28 -0000
> @@ -3,7 +3,7 @@ Fix for 64-bit time_t on 32-bit archs
> Index: scan_engine.cc
> --- scan_engine.cc.orig
> +++ scan_engine.cc
> -@@ -2030,7 +2030,7 @@ void ultrascan_host_probe_update(UltraScanInfo *USI, H
> +@@ -2038,7 +2038,7 @@ void ultrascan_host_probe_update(UltraScanInfo *USI, H
> struct timeval tv;
>
> gettimeofday(&tv, NULL);
>
nmap update + security fix