Re: [NSE] Reflection facilities for better verbose/debug output

[Patrick Donnelly <batrick () batbytes com>]

Hi Fyodor,

On Wed, Sep 26, 2012 at 5:33 PM, Fyodor <fyodor () insecure org> wrote:
> On Mon, Sep 24, 2012 at 01:48:08AM -0400, Patrick Donnelly wrote:
> > a shorter version might also be:
> >
> > NSE: [http-default-accounts W:0xdeadbeef] ...
> >
> > compared to
> >
> > NSE: [http-default-accounts M:0xdeadbee] ...
> >
> > where M and W are respectively Master and Worker, naturally.
> >
> > A version that would include the parent might look like:
> >
> > NSE: [http-default-accounts M:0xdeadbee:W:0xdeadbeef] ...
> >
> > Thoughts?
> >
> > > Even that is quite long; maybe the thread id should only be there for
> > > -d2 or higher.
> >
> > That's one possibility.
>
> Thanks Patrick, this looks like great functionality!  As far as
> whether to print the thread ID, let's look at how scripts are
> reference (in debug mode) now.  When scripts start or stop, we print
> out lines like:
>
> NSE: Starting ssh-hostkey against 74.207.244.221:22
> NSE: Finished ssh-hostkey against 74.207.244.221:22.
>
> So if we were to use the thread ID in debug messages, we'd need to
> include it in the lines above too so users can follow what is going
> on.

It's there for debugging >=2:

NSE: Starting 'http-title' (thread: 0xe0be50) against 127.0.0.1:80.
NSE: Finished 'http-title' (thread: 0xe0be50) against 127.0.0.1:80.

>  But given that a thread ID like 0x38472a17 isn't a whole lot
> shorter than "74.207.244.221:22", and given that the latter is a lot
> more meaningful for end users, maybe we should stick to printing the
> target IP (and port number if it is a portrule).  So the debug lines
> could look like:
>
> NSE [http-headers, 74.207.244.221:80] HTTP: Host supports HEAD.
> NSE [http-default-accounts, 64.211.144.177:80] 5 fingerprints were loaded

That's a reasonable idea. Maybe include the thread ID when debugging
> =2 to be consistent? [Edit: Okay, you suggested this later.] The
thread id should be standard for some debug level because worker
threads would have the same target host:port as the parent, making
them indistinguishable.

> And verbose lines could be like:
>
> NSE [firewalk] not running due to lack of privileges.
>
> (If a verbose line needs the target IP and/or port, it can include it
> in the text itself).

Maybe make this automatic for verbose >=2?


> For higher debug levels (e.g. at least 2), also including the thread
> ID with debug messages seems reasonable.

Okay. Thanks for your input!


So how about this:

For debugging == 1:

NSE: [http-title 127.0.0.1:80] ...

For debugging >= 2:

NSE: [http-title M:0xdeadbeef 127.0.0.1:80] ...

or for worker threads (stdnse.new_thread):

NSE: [http-title W:0xdeadbeef 127.0.0.1:80] ...

For verbosity == 1:

NSE: [http-title] ...

For verbosity >= 2:

NSE: [http-title 127.0.0.1:80] ...


What do you all think?

-- 
- Patrick Donnelly
_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://seclists.org/nmap-dev/