[BUG] Exclusions directive not honored by NSE version detection

[Tom Sellers <nmap () fadedcode net>]

I have recently come across a bug involving port exclusions when 
performing version
detection.   I plan to work on finding a fix for the issue this weekend, 
but I thought I would go
ahead and send the info to the list now in the event that my work was 
delayed or someone
had an idea of exactly where the issue lay.

Recent scanning shows that the Exclude directive in the 
nmap-service-probes file is being
ignored by NSE version detection if more than one port is scanned on a 
host.  The nmap
built in version detection skips the port, but NSE runs version 
detection scripts against the
port anyway.

Testing indicates:
1.  Scanning 1 port in exclude list = proper behavior
2.  Scanning 2 ports in the exclude list = proper behavior
3.  Scanning 1 or more excluded ports and 1 or more non-excluded ports = 
NSE service
        scan against excluded ports


I have attached a sample of a scan against two excluded open ports 
(9100, 9400) and 1
normal port (80) using the --version-trace flag.  Port 9400 was added to 
my Excludes
directive for testing.

As an aside, if the Exclude values in the nmap-services-probes file are 
not legal then
the following error message is displayed after port discovery:

        Ports to be scanned must be between 0 and 65535 inclusive
        QUITTING!

The error implies that the source of the problem is at the command line. 
 I will try to work
on this as well.

Tom

Attachment: sample.txt
Description:

_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://seclists.org/nmap-dev/