Re: nmap sendto in send_ip_packet_sd: sendto => Permission denied

2023-11-17 Thread Stuart Henderson
On 2023/11/16 21:35, Rafael Sadowski wrote: > I stumbled across the following. Maybe only our nmap port is broken. > > $ doas nmap -vvv -sU -sT google.de > Starting Nmap 7.91 ( https://nmap.org ) at 2023-11-16 21:28 CET > Warning: Hostname google.de resolves to 2 IPs. Using 142.250.74.195. >

Re: nmap sendto in send_ip_packet_sd: sendto => Permission denied

2023-11-17 Thread Theo de Raadt
If you check in your syslog (or console), you will probably see a message telling you that build_udp_raw() has performed an 'backwards memcpy' which is not allowed because the result is undefined, therefore we check for this and then log + abort. this code should be using memmove(). Rafael

Re: pflogd spamming syslog

2023-11-17 Thread Alexandr Nedvedicky
Hello, On Fri, Nov 17, 2023 at 10:42:06AM +0100, Claudio Jeker wrote: > On Fri, Nov 17, 2023 at 09:46:56AM +0100, Sebastien Marie wrote: > > Alexandr Nedvedicky writes: > > > > > Hello, > > > > > > diff below seems to make empty log message go way. > > > we have to check if sig_alrm fired here

Re: pflogd spamming syslog

2023-11-17 Thread Sebastien Marie
Claudio Jeker writes: > On Fri, Nov 17, 2023 at 09:46:56AM +0100, Sebastien Marie wrote: > > How about this instead. pcap_dispatch() returns -1 on error and -2 (aka > PCAP_ERROR_BREAK) on interrupt. On interrupt there is no need to print > anything (no matter the signal). pcap_geterr() will only

Re: pflogd spamming syslog

2023-11-17 Thread Claudio Jeker
On Fri, Nov 17, 2023 at 09:46:56AM +0100, Sebastien Marie wrote: > Alexandr Nedvedicky writes: > > > Hello, > > > > diff below seems to make empty log message go way. > > we have to check if sig_alrm fired here in pflogd: > > > > [...] > > > > I believe read at line 92 returns with EINTER, so we

Re: pflogd spamming syslog

2023-11-17 Thread Sebastien Marie
Alexandr Nedvedicky writes: > Hello, > > diff below seems to make empty log message go way. > we have to check if sig_alrm fired here in pflogd: > > [...] > > I believe read at line 92 returns with EINTER, so we jump to > line to 75. If ALARM fires the condition at line 79 is true, > because