memset(&this->nsp, 0, sizeof(nsock_pool));

memset(&this->pcap_nsi, 0, sizeof(pcap_nsi));

memset(&this->pcap_ev_id, 0, sizeof(nsock_event_id));

this->nsock_init = false;

this->rawsd = -1;

this->probes_sent = 0;

this->responses_recv = 0;

this->probes_timedout = 0;

this->cc_cwnd = 0;

this->cc_ssthresh = 0;

/* Init congestion control parameters */

this->cc_init();

/* If there was a previous nsock pool, delete it */

if (this->pcap_nsi) {

nsock_iod_delete(this->pcap_nsi, NSOCK_PENDING_SILENT);

}

if (this->nsock_init) {

nsock_event_cancel(this->nsp, this->pcap_ev_id, 0);

nsock_pool_delete(this->nsp);

}

/* Create a new nsock pool */

if ((this->nsp = nsock_pool_new(NULL)) == NULL)

fatal("Unable to obtain an Nsock pool");

nmap_set_nsock_logger();

nmap_adjust_loglevel(o.packetTrace());

if (*o.device)

nsock_pool_set_device(nsp, o.device);

if (o.proxy_chain)

nsock_pool_set_proxychain(this->nsp, o.proxy_chain);

/* Allow broadcast addresses */

nsock_pool_set_broadcast(this->nsp, 1);

/* Allocate an NSI for packet capture */

this->pcap_nsi = nsock_iod_new(this->nsp, NULL);

this->first_pcap_scheduled = false;

/* Flag it as already initialized so we free this nsp next time */

this->nsock_init = true;

/* We don't need to store the eth handle because FPProbes come with a

netutil_eth_t *ethsd = NULL;

/* Obtain raw socket or check that we can obtain an eth descriptor. */

if (!raw_socket_or_eth(o.sendpref, ifname, iftype, &this->rawsd, &ethsd)) {

fatal("Couldn't obtain raw socket or eth handle in %s", __func__);

}

/* De-register existing callers */

while (this->callers.size() > 0) {

this->callers.pop_back();

}

return;

this->probes_sent = 0;

this->responses_recv = 0;

this->probes_timedout = 0;

this->cc_cwnd = OSSCAN_INITIAL_CWND;

this->cc_ssthresh = OSSCAN_INITIAL_SSTHRESH;

return OP_SUCCESS;

if (pkts <= 0)

return OP_FAILURE;

this->probes_sent+=pkts;

return OP_SUCCESS;

int probes_outstanding = this->probes_sent - this->responses_recv - this->probes_timedout;

this->cc_ssthresh = (float)MAX(probes_outstanding, OSSCAN_INITIAL_CWND);

this->cc_cwnd = OSSCAN_INITIAL_CWND;

return OP_SUCCESS;

this->responses_recv++;

/* If we are in Slow Start, increment congestion window by one packet.

if (this->cc_cwnd < this->cc_ssthresh) {

this->cc_cwnd += 1;

/* Otherwise we are in Congestion Avoidance and CWND is incremented slowly,

} else {

this->cc_cwnd = this->cc_cwnd + 1/this->cc_cwnd;

}

if (o.debugging > 3) {

log_write(LOG_PLAIN, "[FPNetworkControl] Congestion Control Parameters: cwnd=%f ssthresh=%f sent=%d recv=%d tout=%d outstanding=%d\n",

this->cc_cwnd, this->cc_ssthresh, this->probes_sent, this->responses_recv, this->probes_timedout,

this->probes_sent - this->responses_recv - this->probes_timedout);

}

return OP_SUCCESS;

int probes_outstanding = this->probes_sent - this->responses_recv - this->probes_timedout;

if (o.debugging > 3)

log_write(LOG_PLAIN, "[FPNetworkControl] Slot request for %u packets. ProbesOutstanding=%d cwnd=%f ssthresh=%f\n",

(unsigned int)num_packets, probes_outstanding, this->cc_cwnd, this->cc_ssthresh);

/* If we still have room for more outstanding probes, let the caller

if ((probes_outstanding + num_packets) <= this->cc_cwnd) {

this->cc_update_sent(num_packets);

return true;

}

return false;

for (size_t i = 0; i < this->callers.size(); i++) {

if (this->callers[i] == oldcaller) {

this->callers.erase(this->callers.begin() + i);

return OP_SUCCESS;

}

}

return OP_FAILURE;

char pcapdev[128];

int rc;

#ifdef WIN32

/* Nmap normally uses device names obtained through dnet for interfaces, but

if (!DnetName2PcapName(iface, pcapdev, sizeof(pcapdev))) {

/* Oh crap -- couldn't find the corresponding dev apparently. Let's just go

Strncpy(pcapdev, iface, sizeof(pcapdev));

}

#else

Strncpy(pcapdev, iface, sizeof(pcapdev));

#endif

/* Obtain a pcap descriptor */

rc = nsock_pcap_open(this->nsp, this->pcap_nsi, pcapdev, 8192, 0, bpf_filter);

if (rc)

fatal("Error opening capture device %s\n", pcapdev);

/* Store the pcap NSI inside the pool so we can retrieve it inside a callback */

nsock_pool_set_udata(this->nsp, (void *)&(this->pcap_nsi));

return OP_SUCCESS;

assert(nsock_pool_get_udata(nsp) != NULL);

nsock_iod nsi_pcap = *((nsock_iod *)nsock_pool_get_udata(nsp));

enum nse_status status = nse_status(nse);

enum nse_type type = nse_type(nse);

FPProbe *myprobe = (FPProbe *)arg;

u8 *buf;

size_t len;

int result;

if (status == NSE_STATUS_SUCCESS) {

switch(type) {

/* Timer events mean that we need to send a packet. */

case NSE_TYPE_TIMER:

/* The first time a packet is sent, we schedule a pcap event. After that

if (!this->first_pcap_scheduled) {

this->pcap_ev_id = nsock_pcap_read_packet(nsp, nsi_pcap, response_reception_handler_wrapper, -1, NULL);

this->first_pcap_scheduled = true;

}

/* Send the packet*/

for (int decoy = 0; decoy < o.numdecoys; decoy++) {

result = myprobe->changeSourceAddress(&((struct sockaddr_in6 *)&o.decoys[decoy])->sin6_addr);

assert(result == OP_SUCCESS);

assert(myprobe->host != NULL);

buf = myprobe->getPacketBuffer(&len);

if (send_ip_packet(this->rawsd, myprobe->getEthernet(), myprobe->host->getTargetAddress(), buf, len) == -1) {

if (decoy == o.decoyturn) {

myprobe->setFailed();

this->cc_report_final_timeout();

myprobe->host->fail_one_probe();

gh_perror("Unable to send packet in %s", __func__);

}

}

if (decoy == o.decoyturn) {

myprobe->setTimeSent();

}

free(buf);

}

/* Reset the address to the original one if decoys were present and original Address wasn't last one */

if ( o.numdecoys != o.decoyturn+1 ) {

result = myprobe->changeSourceAddress(&((struct sockaddr_in6 *)&o.decoys[o.decoyturn])->sin6_addr);

assert(result == OP_SUCCESS);

}

break;

default:

fatal("Unexpected Nsock event in probe_transmission_handler()");

break;

} /* switch(type) */

} else if (status == NSE_STATUS_EOF) {

if (o.debugging)

log_write(LOG_PLAIN, "probe_transmission_handler(): EOF\n");

} else if (status == NSE_STATUS_ERROR || status == NSE_STATUS_PROXYERROR) {

if (o.debugging)

log_write(LOG_PLAIN, "probe_transmission_handler(): %s failed: %s\n", nse_type2str(type), strerror(socket_errno()));

} else if (status == NSE_STATUS_TIMEOUT) {

if (o.debugging)

log_write(LOG_PLAIN, "probe_transmission_handler(): %s timeout: %s\n", nse_type2str(type), strerror(socket_errno()));

} else if (status == NSE_STATUS_CANCELLED) {

if (o.debugging)

log_write(LOG_PLAIN, "probe_transmission_handler(): %s canceled: %s\n", nse_type2str(type), strerror(socket_errno()));

} else if (status == NSE_STATUS_KILL) {

if (o.debugging)

log_write(LOG_PLAIN, "probe_transmission_handler(): %s killed: %s\n", nse_type2str(type), strerror(socket_errno()));

} else {

if (o.debugging)

log_write(LOG_PLAIN, "probe_transmission_handler(): Unknown status code %d\n", status);

}

return;

nsock_iod nsi = nse_iod(nse);

enum nse_status status = nse_status(nse);

enum nse_type type = nse_type(nse);

const u8 *rcvd_pkt = NULL; /* Points to the captured packet */

size_t rcvd_pkt_len = 0; /* Length of the captured packet */

struct timeval pcaptime; /* Time the packet was captured */

struct sockaddr_storage sent_ss;

struct sockaddr_storage rcvd_ss;

struct sockaddr_in *rcvd_ss4 = (struct sockaddr_in *)&rcvd_ss;

struct sockaddr_in6 *rcvd_ss6 = (struct sockaddr_in6 *)&rcvd_ss;

memset(&rcvd_ss, 0, sizeof(struct sockaddr_storage));

IPv4Header ip4;

IPv6Header ip6;

int res = -1;

struct timeval tv;

gettimeofday(&tv, NULL);

if (status == NSE_STATUS_SUCCESS) {

switch(type) {

case NSE_TYPE_PCAP_READ:

/* Schedule a new pcap read operation */

this->pcap_ev_id = nsock_pcap_read_packet(nsp, nsi, response_reception_handler_wrapper, -1, NULL);

/* Get captured packet */

nse_readpcap(nse, NULL, NULL, &rcvd_pkt, &rcvd_pkt_len, NULL, &pcaptime);

/* Extract the packet's source address */

ip4.storeRecvData(rcvd_pkt, rcvd_pkt_len);

if (ip4.validate() != OP_FAILURE && ip4.getVersion() == 4) {

ip4.getSourceAddress(&(rcvd_ss4->sin_addr));

rcvd_ss4->sin_family = AF_INET;

} else {

ip6.storeRecvData(rcvd_pkt, rcvd_pkt_len);

if (ip6.validate() != OP_FAILURE && ip6.getVersion() == 6) {

ip6.getSourceAddress(&(rcvd_ss6->sin6_addr));

rcvd_ss6->sin6_family = AF_INET6;

} else {

/* If we get here it means that the received packet is not

return;

}

}

/* Check if we have a caller that expects packets from this sender */

for (size_t i = 0; i < this->callers.size(); i++) {

/* Obtain the target address */

sent_ss = *this->callers[i]->getTargetAddress();

/* Check that the received packet is of the same address family */

if (sent_ss.ss_family != rcvd_ss.ss_family)

continue;

/* Check that the captured packet's source address matches the

if (sockaddr_storage_equal(&rcvd_ss, &sent_ss)) {

if ((res = this->callers[i]->callback(rcvd_pkt, rcvd_pkt_len, &tv)) >= 0) {

/* If callback() returns >=0 it means that the packet we've just

if (res > 0)

this->cc_update_received();

/* When the callback returns more than 1 it means that the packet

if (res > 1) {

this->cc_report_drop();

}

}

return;

}

}

break;

default:

fatal("Unexpected Nsock event in response_reception_handler()");

break;

} /* switch(type) */

} else if (status == NSE_STATUS_EOF) {

if (o.debugging)

log_write(LOG_PLAIN, "response_reception_handler(): EOF\n");

} else if (status == NSE_STATUS_ERROR || status == NSE_STATUS_PROXYERROR) {

if (o.debugging)

log_write(LOG_PLAIN, "response_reception_handler(): %s failed: %s\n", nse_type2str(type), strerror(socket_errno()));

} else if (status == NSE_STATUS_TIMEOUT) {

if (o.debugging)

log_write(LOG_PLAIN, "response_reception_handler(): %s timeout: %s\n", nse_type2str(type), strerror(socket_errno()));

} else if (status == NSE_STATUS_CANCELLED) {

if (o.debugging)

log_write(LOG_PLAIN, "response_reception_handler(): %s canceled: %s\n", nse_type2str(type), strerror(socket_errno()));

} else if (status == NSE_STATUS_KILL) {

if (o.debugging)

log_write(LOG_PLAIN, "response_reception_handler(): %s killed: %s\n", nse_type2str(type), strerror(socket_errno()));

} else {

if (o.debugging)

log_write(LOG_PLAIN, "response_reception_handler(): Unknown status code %d\n", status);

}

return;

if (eth != NULL)

return true;

#if HAVE_IPV6_IPPROTO_RAW

return true;

#else

return false;

#endif

unsigned int i;

FPR->begin_time = this->begin_time;

for (i = 0; i < sizeof(this->fp_responses) / sizeof(this->fp_responses[0]); i++) {

const FPResponse *resp;

resp = this->fp_responses[i];

if (resp != NULL) {

FPR->fp_responses[i] = new FPResponse(resp->probe_id, resp->buf, resp->len,

resp->senttime, resp->rcvdtime);

}

}

/* Were we actually able to set the flow label? */

FPR->flow_label = 0;

for (i = 0; i < sizeof(this->fp_probes) / sizeof(this->fp_probes[0]); i++) {

const FPProbe& probe = fp_probes[0];

if (probe.is_set()) {

if (can_set_flow_label(probe.getEthernet()))

FPR->flow_label = OSDETECT_FLOW_LABEL;

break;

}

}

/* Did we fail to send some probe? */

FPR->incomplete = this->incomplete_fp;

const IPv6Header *ipv6;

ipv6 = find_ipv6(pe);

if (ipv6 == NULL)

return -1;

else

return ipv6->getPayloadLength();

const IPv6Header *ipv6;

ipv6 = find_ipv6(pe);

if (ipv6 == NULL)

return -1;

else

return ipv6->getTrafficClass();

const IPv6Header *ipv6;

int hlim;

int er_lim;

ipv6 = find_ipv6(pe);

if (ipv6 == NULL)

return -1;

hlim = ipv6->getHopLimit();

if (method != DIST_METHOD_NONE) {

if (method == DIST_METHOD_TRACEROUTE || method == DIST_METHOD_ICMP) {

if (target_distance > 0)

hlim += target_distance - 1;

}

er_lim = 5;

} else

er_lim = 20;

if (32 - er_lim <= hlim && hlim <= 32+ 5 )

hlim = 32;

else if (64 - er_lim <= hlim && hlim <= 64+ 5 )

hlim = 64;

else if (128 - er_lim <= hlim && hlim <= 128+ 5 )

hlim = 128;

else if (255 - er_lim <= hlim && hlim <= 255+ 5 )

hlim = 255;

else

hlim = -1;

return hlim;

const char * const SEQ_PROBE_NAMES[] = {"S1", "S2", "S3", "S4", "S5", "S6"};

u32 seqs[NELEMS(SEQ_PROBE_NAMES)];

struct timeval times[NELEMS(SEQ_PROBE_NAMES)];

unsigned int i, j;

double sum, t;

j = 0;

for (i = 0; i < NELEMS(SEQ_PROBE_NAMES); i++) {

const char *probe_name;

const FPPacket *fp;

const TCPHeader *tcp;

std::map<std::string, FPPacket>::const_iterator it;

probe_name = SEQ_PROBE_NAMES[i];

it = resps.find(probe_name);

if (it == resps.end())

continue;

fp = &it->second;

tcp = find_tcp(fp->getPacket());

if (tcp == NULL)

continue;

seqs[j] = tcp->getSeq();

times[j] = fp->getTime();

j++;

}

if (j < 2)

return -1;

sum = 0.0;

for (i = 0; i < j - 1; i++)

sum += seqs[i + 1] - seqs[i];

t = TIMEVAL_FSEC_SUBTRACT(times[j - 1], times[0]);

return sum / t;

const ICMPv6Header *icmpv6;

icmpv6 = find_icmpv6(pe);

if (icmpv6 == NULL)

return -1;

return icmpv6->getType();

const ICMPv6Header *icmpv6;

icmpv6 = find_icmpv6(pe);

if (icmpv6 == NULL)

return -1;

return icmpv6->getCode();

const double (*scale)[2]) {

unsigned int i;

for (i = 0; i < num_features; i++) {

double val = features[i].value;

if (val < 0)

continue;

val = (val + scale[i][0]) * scale[i][1];

features[i].value = val;

}

const struct label_prob *la, *lb;

la = (struct label_prob *) a;

lb = (struct label_prob *) b;

/* Sort descending. */

if (la->prob > lb->prob)

return -1;

else if (la->prob < lb->prob)

return 1;

else

return 0;