Re: ncat udp

[Marius Sturm <marius.sturm () web de>]

Hello David,

> Now that we allow multiple connections, could you implement the
> --max-conns option in ncat_listen_udp? It just involves updating and
> checking the conn_count variable like in ncat_listen_tcp.
>
> The only remaining difference is UDP is listen mode without an exec
> option. That still only accepts one client. Making that work like TCP
> mode will be more difficult because we will have to maintain a list of
> connected clients and somehow decide when to remove a client from the
> list.

The same problem concerns --max-conns. You have to decide when a child
will be terminated, if it don't terminates by itself, or the conn_count
is never be decremented, e.g. --exec "/bin/cat".

So you can not do things like this,
ncat -l --udp --exec -m 2 "/bin/cat"

ncat --udp localhost
ncat --udp localhost ^C

ncat --udp localhost

Maybe we can kill a child after some idle timeout?

Best regards,

Marius

diff -urNb nmap/ncat/ncat_listen.c nmap-udp/ncat/ncat_listen.c
--- nmap/ncat/ncat_listen.c     2009-03-26 16:57:25.000000000 +0100
+++ nmap-udp/ncat/ncat_listen.c 2009-03-27 11:50:53.000000000 +0100
@@ -324,10 +324,13 @@
             nbytes = Recvfrom(sockfd, buf, sizeof(buf), MSG_PEEK,
                                 (struct sockaddr *) &remotess, &sslen);
 
-            /* check deny list */
-            if (!allow_access(&remotess)) {
+          /* check total connection count and deny list */
+          if (conn_count >= o.conn_limit || !allow_access(&remotess)) {
                 if (verbose_flag > 1)
-                    Fprintf(stderr, "DEBUG: New connection denied: ACL denial\n");
+                  Fprintf(stderr, "DEBUG: New connection denied: %s\n",
+                            (conn_count >= o.conn_limit) ?
+                             "Max connections reached" :
+                             "ACL denial\n");
 
                 /* Dump the current datagram */
                 Recv(sockfd, buf, sizeof(buf), 0);
@@ -338,6 +341,8 @@
             break;
         }
                     
+      conn_count++;
+                    
         /* 
          * We're using connected udp. This has the down side of only
          * being able to handle one udp client at a time


_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://SecLists.Org