Merge branch 'nmap:master' into master

.github/workflows/build.yml

@@ -0,0 +1,206 @@
+name: nmap multiplatform autobuilds
+
+on:
+  push:
+    paths:
+      - ".github/workflows/build.yml"
+      - "**/*.c"
+      - "**/*.cc"
+      - "**/*.cpp"
+      - "**/*.h"
+      - "**/*.H"
+      - "**/*.in"
+      - "**/*.am"
+      - "**/*.ac"
+      - "**/*.lua"
+      - "**/*.cmakein"
+      - "**/configure"
+      - "**/*.pl"
+      - "**/*.py"
+      - "**/*.awk"
+      - "**/*.sh"
+      - "**/*.toml"
+    branches:
+      - master
+  pull_request:
+  workflow_dispatch:
+    inputs:
+      deploymentName:
+        description: "Name for this deployment"
+        required: true
+        default: "Manual Deployment"
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  MAKEFLAGS: -j3
+
+jobs:
+  build:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - name: ubuntu-latest-gcc
+            os: ubuntu-latest
+            cc: gcc
+          - name: ubuntu-latest-gcc-arm64
+            os: ubuntu-latest
+            cc: gcc
+            arch: arm64
+          - name: ubuntu-latest-clang
+            os: ubuntu-latest
+            cc: clang
+          - name: macos-15-clang
+            os: macos-15
+            cc: clang
+          - name: macos-26-clang
+            os: macos-26
+            cc: clang
+          - name: freebsd-15-gcc
+            os: ubuntu-latest
+            cc: gcc
+          - name: freebsd-15-clang
+            os: ubuntu-latest
+            cc: clang
+          - name: openbsd-7-gcc
+            os: ubuntu-latest
+            cc: egcc
+          - name: openbsd-7-clang
+            os: ubuntu-latest
+            cc: clang
+          - name: netbsd-10-gcc
+            os: ubuntu-latest
+            cc: gcc
+          - name: netbsd-10-clang
+            os: ubuntu-latest
+            cc: clang
+          - name: solaris-11-gcc
+            os: ubuntu-latest
+            cc: gcc
+          - name: solaris-11-clang
+            os: ubuntu-latest
+            cc: clang
+          - name: windows-latest-msvc
+            os: windows-latest
+            cc: msvc
+
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up QEMU for ARM64
+        if: matrix.arch == 'arm64'
+        uses: docker/setup-qemu-action@v3
+        with:
+          platforms: linux/arm64
+
+      - name: Build Linux
+        if: startsWith(matrix.name,'ubuntu') && matrix.arch != 'arm64'
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y build-essential clang tree libpcap-dev libnet-dev libpcre2-dev
+          ./configure
+          make
+          make install DESTDIR=/tmp
+          tree /tmp/usr
+
+      - name: Build Linux ARM64
+        if: startsWith(matrix.name,'ubuntu') && matrix.arch == 'arm64'
+        run: |
+          docker run --rm --platform linux/arm64 -v $PWD:/work -w /work ubuntu:latest bash -c "
+            apt-get update -q -y &&
+            apt-get install -q -y build-essential tree libpcap-dev libnet-dev libpcre2-dev autoconf automake &&
+            ./configure
+            make &&
+            make install DESTDIR=/tmp &&
+            tree /tmp/usr
+          "
+
+      - name: Build MacOS
+        if: startsWith(matrix.name,'macos')
+        run: |
+          brew update
+          # PCRE2 is already installed
+          brew install tree libpcap libnet
+          ./configure
+          make
+          make install DESTDIR=/tmp
+          tree /tmp/usr
+
+      - name: Build FreeBSD
+        if: startsWith(matrix.name,'freebsd')
+        uses: vmactions/freebsd-vm@v1
+        with:
+          release: "15.0"
+          usesh: true
+          prepare: |
+            # OS has libpcap already installed (and adding puts a second in /usr/local)
+            pkg install -y gcc llvm autotools tree pkgconf libnet pcre2 gmake dbus
+          run: |
+            ./configure
+            gmake
+            gmake install DESTDIR=/tmp
+            tree /tmp/usr
+
+      - name: Build OpenBSD
+        if: startsWith(matrix.name,'openbsd')
+        uses: vmactions/openbsd-vm@v1
+        with:
+          usesh: true
+          prepare: |
+            export PKG_PATH=https://cdn.openbsd.org/pub/OpenBSD/$(uname -r)/packages/$(uname -m)/
+            pkg_add -I -U autoconf%2.72 automake%1.17 gcc%11 llvm%19 tree pkgconf libnet%1.1 pcre2 gmake dbus
+          run: |
+            export AUTOCONF_VERSION=2.72
+            export AUTOMAKE_VERSION=1.17
+            ./configure
+            gmake
+            gmake install DESTDIR=/tmp
+            tree /tmp/usr
+
+      - name: Build NetBSD
+        if: startsWith(matrix.name,'netbsd')
+        uses: vmactions/netbsd-vm@v1
+        with:
+          usesh: true
+          prepare: |
+            export PATH=/usr/sbin:/usr/pkg/sbin:/usr/pkg/bin:$PATH
+            export PKG_PATH="http://cdn.netbsd.org/pub/pkgsrc/packages/NetBSD/$(uname -p)/$(uname -r | cut -d_ -f1)/All"
+            pkg_add -u gcc13 clang autoconf automake pkgconf libpcap libnet gmake dbus
+          run: |
+            ./configure
+            gmake
+            gmake install DESTDIR=/tmp
+            tree /tmp/usr
+
+      - name: Build Solaris
+        if: startsWith(matrix.name,'solaris')
+        uses: vmactions/solaris-vm@v1
+        with:
+          usesh: true
+          prepare: |
+            pkg install gcc-c clang autoconf automake pcre2 libpcap libnet developer/build/gnu-make
+          run: |
+            ./configure
+            gmake
+            gmake install DESTDIR=/tmp
+            tree /tmp/usr
+
+      - name: Install Subversion
+        if: startsWith(matrix.name,'windows')
+        shell: powershell
+        run: |
+          choco install svn -y --no-progress
+          $env:PATH = "C:\Program Files (x86)\Subversion\bin;C:\Program Files\Subversion\bin;$env:PATH"
+          echo "C:\Program Files (x86)\Subversion\bin" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
+          echo "C:\Program Files\Subversion\bin" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
+
+      - name: Build Windows
+        if: startsWith(matrix.name,'windows')
+        shell: cmd
+        run: |
+          cd mswin32
+          Build.bat

CHANGELOG

@@ -1,9 +1,110 @@
 #Nmap Changelog ($Id$); -*-text-*-
 
-o [GH#3194] RPC-based scripts were sporadically failing due to privileged
+o [Ncat] Fix several cases where Ncat's SOCKS5 client could interpret
+  uninitialized data as protocol data, triggered by a malicious SOCKS5 proxy
+  server. No code execution or application crash is possible.
+  Reported by Govind Pratap Singh. [Daniel Miller]
+
+o Fix a out-of-bounds access in Nping Echo client allowing a malicious Nping
+  EchoServer to zero 32 bytes of memory outside the packet buffer. Reported by
+  Harshit Gupta. [Daniel Miller]
+
+o Fix a 1-byte overrun (read) while reading certain crafted DNS labels,
+  reported by Peter Parker. [Daniel Miller]
+
+o [NSE][GH#3317] Function url.build_path was mangling special characters in URL
+  path segments. [nnposter]
+
+Nmap 7.99 [2026-03-26]
+
+o Integrated many of the most-frequently-submitted IPv4 and IPv6 OS
+  fingerprints, as well as dozens of updated service fingerprints.
+
+o Upgraded included libraries: OpenSSL 3.0.19, libpcap 1.10.6, libpcre2 10.47,
+  liblinear 2.50, zlib 1.3.2
+
+o [Windows] Upgraded the included version of Npcap from 1.83 to 1.87, resolving
+  several crashes and stability-related issues. See https://npcap.com/changelog
+
+o [Zenmap][GH#3182] Zenmap is now distributed as a universal wheel
+  (zenmap-7.99-py3-none-any.whl) instead of an RPM package so that it can be
+  installed on any system with Python 3. [Daniel Miller]
+
+o [Ncat][Windows] Limited the number of handles inherited by subprocesses
+  launched with -e, preventing interference between clients when -e and
+  --keep-open are used. Reported by Nimish Verma.
+
+o [Ncat] Several fixes for regressions or longstanding failure cases in
+  ncat-test.pl [Daniel Miller]:
+
+  + [Windows] Fixed handling of socket EOF with --exec
+
+  + Fixed the -i (idle timeout) option for listen mode, which was broken
+    when adding the -q option in Ncat 7.96
+
+  + Fixed HTTP proxy server when SSL is used.
+
+  + DTLS (SSL over UDP) shutdown connection on stdin EOF.
+
+o [Windows][GH#2711] Nmap now supports scanning over various VPN virtual
+  adapters like OpenVPN TAP adapters. [Daniel Miller]
+
+o [GH#3280] Fix a performance regression in reverse-DNS in Nmap 7.98. The fix
+  for #3130 had caused Nmap to send requests too slowly. [Daniel Miller]
+
+o [macOS][GH#3289] Fixed a configure-time failure in libdnet that resulted in
+  incorrect MAC addresses being reported. [Daniel Miller]
+
+o [Zenmap][GH#3189] Fix a crash in Zenmap topology and hosts viewer:
+  "TypeError: format requires a mapping" [Daniel Miller]
+
+o [GH#2955] Fix a routing issue with -e and -S related to #2206
+  causing error "setup_target: failed to determine route" [Daniel Miller]
+
+o [GH#3214] Improve compatibility of build process on various platforms and add
+  multiplatform autobuilds in Github workflow. [Jordan Ritter]
+
+o [NSE][GH#2183][GH#3239] Script hostmap-crtsh now reports only true subdomains
+  of a given target hostname by default. In the past, it was reporting any
+  DNS name that included the target hostname as a substring (but not
+  necessarily as a suffix). The old behavior can be enabled by setting script
+  argument hostmap-crtsh.lax. [Sweekar-cmd, nnposter]
+
+o [NSE] Function url.parse_query was not interpreting plus signs as spaces.
+  [nnposter]
+
+o [NSE] Function url.parse was not properly parsing URLs with query strings
+  but empty paths. [nnposter]
+
+o [NSE][GH#3287] Functions tableaux.tcopy and tableaux.shallow_tcopy were
+  not behaving the same when the input table had a custom __pairs metamethod.
+  Both functions now perform a raw copy, ignoring the metamethod. [nnposter]
+
+o [NSE] Function tableaux.shallow_tcopy did not work correctly for tables
+  with Boolean keys. [nnposter]
+
+o [NSE] IPP print queue job details were not getting populated, having
+  a hard dependency on Apple-specific attributes. [nnposter]
+
+o [NSE][GH#3245] Functions connect and close have been removed from the IPP
+  library, as they served no purpose. [nnposter]
+
+o [NSE] ipOps.expand_ip was crashing upon malformed IPv6 addresses. [nnposter]
+
+o [NSE][GH#3262] FTP banner parsing is now more closely aligned with RFC 959,
+  section 4.2. [nnposter]
+
+o [NSE][GH#3253] Function stdnse.make_buffer now accepts an extra parameter
+  that allows preloading the newly created buffer with data. [nnposter]
+
+o [NSE][GH#3191][GH#3218] Script http-internal-ip-disclosure has been enhanced,
+  including added support for IPv6 and HTTPS and more accurate processing
+  of target responses. [nnposter]
+
+o [NSE][GH#3194] RPC-based scripts were sporadically failing due to privileged
   port conflicts. [nnposter]
 
-o [GH#3196] Script rlogin-brute was sporadically failing due to using
+o [NSE][GH#3196] Script rlogin-brute was sporadically failing due to using
   an off-by-one range for privileged ports and not handling potential
   port conflicts. [nnposter]
 

FPEngine.cc

@@ -6,7 +6,7 @@
  *                                                                         *
  ***********************IMPORTANT NMAP LICENSE TERMS************************
  *
- * The Nmap Security Scanner is (C) 1996-2025 Nmap Software LLC ("The Nmap
+ * The Nmap Security Scanner is (C) 1996-2026 Nmap Software LLC ("The Nmap
  * Project"). Nmap is also a registered trademark of the Nmap Project.
  *
  * This program is distributed under the terms of the Nmap Public Source
@@ -1767,7 +1767,6 @@ int FPHost6::build_probe_list() {
   routing = new RoutingHeader();
   hopbyhop2 = new HopByHopHeader();
   icmp6 = new ICMPv6Header();
-  payload = new RawData();
   ss6 = (const sockaddr_in6 *) this->target_host->SourceSockAddr();
   ip6->setSourceAddress(ss6->sin6_addr);
   ss6 = (const sockaddr_in6 *) this->target_host->TargetSockAddr();
@@ -2493,29 +2492,8 @@ size_t FPPacket::getLength() const {
  * Otherwise, pass the source address, the next hop address and the name of
  * the network interface the packet should be injected through. */
 int FPPacket::setEthernet(const Target *target) {
-  const char *devname = target->deviceName();
-  this->link_eth = false;
-  if (devname != NULL) {
-    netutil_eth_t *ethsd = eth_open_cached(devname);
-    if (ethsd == NULL) {
-      error("%s: Failed to open ethernet device (%s)", __func__, devname);
-    }
-    else if (netutil_eth_can_send(ethsd)) {
-      this->link_eth = true;
-      Strncpy(this->eth_hdr.devname, devname, sizeof(this->eth_hdr.devname));
-      if (netutil_eth_datalink(ethsd) == DLT_EN10MB){
-        const u8 *src_mac = target->SrcMACAddress();
-        const u8 *dst_mac = target->NextHopMACAddress();
-        if (src_mac == NULL || dst_mac == NULL) {
-          this->link_eth = false;
-        }
-        else {
-          memcpy(this->eth_hdr.srcmac, src_mac, 6);
-          memcpy(this->eth_hdr.dstmac, dst_mac, 6);
-        }
-      }
-    }
-  }
+  eth_nfo *eth = target->FillEthNfo(&this->eth_hdr, NULL);
+  this->link_eth = (eth != NULL);
 
   if (!this->link_eth) {
    memset(&(this->eth_hdr), 0, sizeof(struct eth_nfo));

FPEngine.h

@@ -6,7 +6,7 @@
  *                                                                         *
  ***********************IMPORTANT NMAP LICENSE TERMS************************
  *
- * The Nmap Security Scanner is (C) 1996-2025 Nmap Software LLC ("The Nmap
+ * The Nmap Security Scanner is (C) 1996-2026 Nmap Software LLC ("The Nmap
  * Project"). Nmap is also a registered trademark of the Nmap Project.
  *
  * This program is distributed under the terms of the Nmap Public Source

FingerPrintResults.cc

@@ -5,7 +5,7 @@
  *                                                                         *
  ***********************IMPORTANT NMAP LICENSE TERMS************************
  *
- * The Nmap Security Scanner is (C) 1996-2025 Nmap Software LLC ("The Nmap
+ * The Nmap Security Scanner is (C) 1996-2026 Nmap Software LLC ("The Nmap
  * Project"). Nmap is also a registered trademark of the Nmap Project.
  *
  * This program is distributed under the terms of the Nmap Public Source

FingerPrintResults.h

@@ -5,7 +5,7 @@
  *                                                                         *
  ***********************IMPORTANT NMAP LICENSE TERMS************************
  *
- * The Nmap Security Scanner is (C) 1996-2025 Nmap Software LLC ("The Nmap
+ * The Nmap Security Scanner is (C) 1996-2026 Nmap Software LLC ("The Nmap
  * Project"). Nmap is also a registered trademark of the Nmap Project.
  *
  * This program is distributed under the terms of the Nmap Public Source

MACLookup.cc

@@ -6,7 +6,7 @@
  *                                                                         *
  ***********************IMPORTANT NMAP LICENSE TERMS************************
  *
- * The Nmap Security Scanner is (C) 1996-2025 Nmap Software LLC ("The Nmap
+ * The Nmap Security Scanner is (C) 1996-2026 Nmap Software LLC ("The Nmap
  * Project"). Nmap is also a registered trademark of the Nmap Project.
  *
  * This program is distributed under the terms of the Nmap Public Source

MACLookup.h

@@ -6,7 +6,7 @@
  *                                                                         *
  ***********************IMPORTANT NMAP LICENSE TERMS************************
  *
- * The Nmap Security Scanner is (C) 1996-2025 Nmap Software LLC ("The Nmap
+ * The Nmap Security Scanner is (C) 1996-2026 Nmap Software LLC ("The Nmap
  * Project"). Nmap is also a registered trademark of the Nmap Project.
  *
  * This program is distributed under the terms of the Nmap Public Source

Makefile.in

@@ -256,6 +256,7 @@ clean-zenmap:
 	rm -f $(ZENMAPDIR)/zenmapCore/Name.pyc
 
 clean-ndiff:
+	rm -f $(NDIFFDIR)/Version.pyc
 
 clean-nping:
 	-cd $(NPINGDIR) && $(MAKE) clean
@@ -312,7 +313,7 @@ distclean-%: clean-%
 	-cd $* && $(MAKE) distclean
 
 install-nmap: $(TARGET)
-	$(INSTALL) -d $(DESTDIR)$(bindir) $(DESTDIR)$(mandir)/man1 $(DESTDIR)$(nmapdatadir)
+	mkdir -p $(DESTDIR)$(bindir) $(DESTDIR)$(mandir)/man1 $(DESTDIR)$(nmapdatadir)
 	$(INSTALL) -c -m 755 nmap $(DESTDIR)$(bindir)/nmap
 # Use strip -x to avoid stripping dynamically loaded NSE functions. See
 # http://seclists.org/nmap-dev/2007/q4/0272.html.
@@ -320,7 +321,7 @@ install-nmap: $(TARGET)
 	$(INSTALL) -c -m 644 docs/$(TARGET).1 $(DESTDIR)$(mandir)/man1/
 	if [ "$(USE_NLS)" = "yes" ]; then \
 	  for ll in $(filter $(ALL_LINGUAS),$(LINGUAS)); do \
-	    $(INSTALL) -d $(DESTDIR)$(mandir)/$$ll/man1; \
+	    mkdir -p $(DESTDIR)$(mandir)/$$ll/man1; \
 	    $(INSTALL) -c -m 644 docs/man-xlate/$(TARGET)-$$ll.1 $(DESTDIR)$(mandir)/$$ll/man1/$(TARGET).1; \
 	  done; \
 	fi
@@ -354,7 +355,7 @@ build-zenmap: $(ZENMAPDIR)/pyproject.toml $(ZENMAPDIR)/zenmapCore/Version.py
 	$(PYTHON) -m build $(ZENMAPDIR)/
 
 install-zenmap: $(ZENMAPDIR)/pyproject.toml
-	$(INSTALL) -d $(DESTDIR)$(bindir) $(DESTDIR)$(mandir)/man1 $(DESTDIR)$(deskdir)
+	mkdir -p $(DESTDIR)$(bindir) $(DESTDIR)$(mandir)/man1 $(DESTDIR)$(deskdir)
 	$(PYTHON) -m pip install $(ZENMAPDIR)/ $(if $(DESTDIR),--root "$(DESTDIR)")
 	$(INSTALL) -c -m 644 docs/zenmap.1 $(DESTDIR)$(mandir)/man1/
 	$(INSTALL) -c -m 644 $(ZENMAPDIR)/install_scripts/unix/*.desktop $(DESTDIR)$(deskdir)
@@ -366,14 +367,17 @@ install-zenmap: $(ZENMAPDIR)/pyproject.toml
 # Create a symlink from xnmap to zenmap unconditionally.
 	ln -sf zenmap $(DESTDIR)$(bindir)/xnmap
 
-build-ndiff:
+$(NDIFFDIR)/Version.py: $(ZENMAPDIR)/zenmapCore/Version.py
+	cp $^ $@
+
+build-ndiff: $(NDIFFDIR)/pyproject.toml $(NDIFFDIR)/Version.py
 	$(PYTHON) -m build $(NDIFFDIR)/
 
 build-nping: $(NPINGDIR)/Makefile build-nbase build-nsock build-netutil $(NPINGDIR)/nping.h @DNET_BUILD@ @PCAP_BUILD@
 	@cd $(NPINGDIR) && $(MAKE)
 
 install-ndiff:
-	$(INSTALL) -d $(DESTDIR)$(bindir) $(DESTDIR)$(mandir)/man1
+	mkdir -p $(DESTDIR)$(bindir) $(DESTDIR)$(mandir)/man1
 	$(PYTHON) -m pip install $(NDIFFDIR)/ $(if $(DESTDIR),--root "$(DESTDIR)")
 	$(INSTALL) -c -m 644 $(NDIFFDIR)/docs/ndiff.1 $(DESTDIR)$(mandir)/man1/
 
@@ -381,8 +385,8 @@ NSE_FILES = scripts/script.db scripts/*.nse
 NSE_LIB_LUA_FILES = nselib/*.lua nselib/*.luadoc
 
 install-nse: $(TARGET)
-	$(INSTALL) -d $(DESTDIR)$(nmapdatadir)/scripts
-	$(INSTALL) -d $(DESTDIR)$(nmapdatadir)/nselib
+	mkdir -p $(DESTDIR)$(nmapdatadir)/scripts
+	mkdir -p $(DESTDIR)$(nmapdatadir)/nselib
 
 # Remove obsolete scripts from a previous installation.
 	(cd $(DESTDIR)$(nmapdatadir)/scripts && rm -f $(OLD_SCRIPT_NAMES))
@@ -390,9 +394,9 @@ install-nse: $(TARGET)
 	$(INSTALL) -c -m 644 nse_main.lua $(DESTDIR)$(nmapdatadir)/
 	$(INSTALL) -c -m 644 $(NSE_FILES) $(DESTDIR)$(nmapdatadir)/scripts
 	$(INSTALL) -c -m 644 $(NSE_LIB_LUA_FILES) $(DESTDIR)$(nmapdatadir)/nselib
-	$(INSTALL) -d $(DESTDIR)$(nmapdatadir)/nselib/data
+	mkdir -p $(DESTDIR)$(nmapdatadir)/nselib/data
 	for f in `find nselib/data -name .svn -prune -o -type d -print`; do \
-		$(INSTALL) -d $(DESTDIR)$(nmapdatadir)/$$f; \
+		mkdir -p $(DESTDIR)$(nmapdatadir)/$$f; \
 	done
 	for f in `find nselib/data -name .svn -prune -o -type f -print`; do \
 		$(INSTALL) -c -m 644 $$f $(DESTDIR)$(nmapdatadir)/$$f; \
@@ -434,7 +438,7 @@ uninstall-nping:
 	@cd $(NPINGDIR) && $(MAKE) uninstall
 
 check-nse:
-	./nmap -d --datadir . --script=unittest --script-args=unittest.run
+	./nmap -d --datadir . --script=unittest --script-args=unittest.run --release-mem
 
 check-ncat:
 	@cd $(NCATDIR) && $(MAKE) check

NewTargets.cc

@@ -3,7 +3,7 @@
  * targets to the scan queue.                                              *
  ***********************IMPORTANT NMAP LICENSE TERMS************************
  *
- * The Nmap Security Scanner is (C) 1996-2025 Nmap Software LLC ("The Nmap
+ * The Nmap Security Scanner is (C) 1996-2026 Nmap Software LLC ("The Nmap
  * Project"). Nmap is also a registered trademark of the Nmap Project.
  *
  * This program is distributed under the terms of the Nmap Public Source

NewTargets.h

@@ -3,7 +3,7 @@
  * targets to the scan queue.                                              *
  ***********************IMPORTANT NMAP LICENSE TERMS************************
  *
- * The Nmap Security Scanner is (C) 1996-2025 Nmap Software LLC ("The Nmap
+ * The Nmap Security Scanner is (C) 1996-2026 Nmap Software LLC ("The Nmap
  * Project"). Nmap is also a registered trademark of the Nmap Project.
  *
  * This program is distributed under the terms of the Nmap Public Source

NmapOps.cc

@@ -5,7 +5,7 @@
  *                                                                         *
  ***********************IMPORTANT NMAP LICENSE TERMS************************
  *
- * The Nmap Security Scanner is (C) 1996-2025 Nmap Software LLC ("The Nmap
+ * The Nmap Security Scanner is (C) 1996-2026 Nmap Software LLC ("The Nmap
  * Project"). Nmap is also a registered trademark of the Nmap Project.
  *
  * This program is distributed under the terms of the Nmap Public Source

NmapOps.h

@@ -5,7 +5,7 @@
  *                                                                         *
  ***********************IMPORTANT NMAP LICENSE TERMS************************
  *
- * The Nmap Security Scanner is (C) 1996-2025 Nmap Software LLC ("The Nmap
+ * The Nmap Security Scanner is (C) 1996-2026 Nmap Software LLC ("The Nmap
  * Project"). Nmap is also a registered trademark of the Nmap Project.
  *
  * This program is distributed under the terms of the Nmap Public Source

NmapOutputTable.cc

@@ -5,7 +5,7 @@
  *                                                                         *
  ***********************IMPORTANT NMAP LICENSE TERMS************************
  *
- * The Nmap Security Scanner is (C) 1996-2025 Nmap Software LLC ("The Nmap
+ * The Nmap Security Scanner is (C) 1996-2026 Nmap Software LLC ("The Nmap
  * Project"). Nmap is also a registered trademark of the Nmap Project.
  *
  * This program is distributed under the terms of the Nmap Public Source

NmapOutputTable.h

@@ -5,7 +5,7 @@
  *                                                                         *
  ***********************IMPORTANT NMAP LICENSE TERMS************************
  *
- * The Nmap Security Scanner is (C) 1996-2025 Nmap Software LLC ("The Nmap
+ * The Nmap Security Scanner is (C) 1996-2026 Nmap Software LLC ("The Nmap
  * Project"). Nmap is also a registered trademark of the Nmap Project.
  *
  * This program is distributed under the terms of the Nmap Public Source

README.md

@@ -1,4 +1,4 @@
-Nmap [![Build Status](https://travis-ci.org/nmap/nmap.svg?branch=master)](https://travis-ci.org/nmap/nmap) [![Language grade: C/C++](https://img.shields.io/lgtm/grade/cpp/g/nmap/nmap.svg?logo=lgtm&logoWidth=18)](https://lgtm.com/projects/g/nmap/nmap/context:cpp) [![Language grade: Python](https://img.shields.io/lgtm/grade/python/g/nmap/nmap.svg?logo=lgtm&logoWidth=18)](https://lgtm.com/projects/g/nmap/nmap/context:python) [![Total alerts](https://img.shields.io/lgtm/alerts/g/nmap/nmap.svg?logo=lgtm&logoWidth=18)](https://lgtm.com/projects/g/nmap/nmap/alerts/)
+Nmap [![Build Status](https://github.com/nmap/nmap/actions/workflows/build.yml/badge.svg)](https://github.com/nmap/nmap/actions/workflows/build.yml)
 ====
 
 Nmap is released under a custom license, which is based on (but not compatible

Target.cc

@@ -6,7 +6,7 @@
  *                                                                         *
  ***********************IMPORTANT NMAP LICENSE TERMS************************
  *
- * The Nmap Security Scanner is (C) 1996-2025 Nmap Software LLC ("The Nmap
+ * The Nmap Security Scanner is (C) 1996-2026 Nmap Software LLC ("The Nmap
  * Project"). Nmap is also a registered trademark of the Nmap Project.
  *
  * This program is distributed under the terms of the Nmap Public Source
@@ -497,6 +497,46 @@ const u8 *Target::NextHopMACAddress() const {
   return (NextHopMACaddress_set)? NextHopMACaddress : NULL;
 }
 
+eth_nfo *Target::FillEthNfo(eth_nfo *eth, netutil_eth_t *ethsd) const {
+  assert(eth != NULL);
+  const char *devname = this->deviceName();
+  if (devname == NULL) {
+    return NULL;
+  }
+  if (ethsd == NULL) {
+    ethsd = eth_open_cached(devname);
+  }
+  else {
+    eth->ethsd = ethsd;
+  }
+  if (ethsd == NULL) {
+    error("%s: Failed to open device (%s)", __func__, devname);
+    return NULL;
+  }
+  if (!netutil_eth_can_send(ethsd)) {
+    error("%s: Cannot send on device (%s)", __func__, devname);
+    return NULL;
+  }
+  if (netutil_eth_datalink(ethsd) == DLT_EN10MB){
+    const u8 *src_mac = this->SrcMACAddress();
+    if (src_mac == NULL) {
+      error("%s: Cannot determine source MAC for %s", __func__, this->targetipstr());
+      return NULL;
+    }
+    const u8 *dst_mac = this->NextHopMACAddress();
+    if (dst_mac == NULL) {
+      error("%s: Cannot determine next hop MAC for %s", __func__, this->targetipstr());
+      return NULL;
+    }
+    assert(eth->srcmac != NULL && eth->dstmac != NULL);
+    memcpy(eth->srcmac, src_mac, 6);
+    memcpy(eth->dstmac, dst_mac, 6);
+  }
+
+  Strncpy(eth->devname, devname, sizeof(eth->devname));
+  return eth;
+}
+
 int Target::osscanPerformed(void) const {
         return osscan_flag;
 }

Target.h

@@ -6,7 +6,7 @@
  *                                                                         *
  ***********************IMPORTANT NMAP LICENSE TERMS************************
  *
- * The Nmap Security Scanner is (C) 1996-2025 Nmap Software LLC ("The Nmap
+ * The Nmap Security Scanner is (C) 1996-2026 Nmap Software LLC ("The Nmap
  * Project"). Nmap is also a registered trademark of the Nmap Project.
  *
  * This program is distributed under the terms of the Nmap Public Source
@@ -237,6 +237,7 @@ class Target {
   const u8 *MACAddress() const;
   const u8 *SrcMACAddress() const;
   const u8 *NextHopMACAddress() const;
+  eth_nfo *FillEthNfo(eth_nfo *eth, netutil_eth_t *ethsd) const;
 
 /* Set the device names so that they can be returned by deviceName()
    and deviceFullName().  The normal name may not include alias

TargetGroup.cc

@@ -7,7 +7,7 @@
  *                                                                         *
  ***********************IMPORTANT NMAP LICENSE TERMS************************
  *
- * The Nmap Security Scanner is (C) 1996-2025 Nmap Software LLC ("The Nmap
+ * The Nmap Security Scanner is (C) 1996-2026 Nmap Software LLC ("The Nmap
  * Project"). Nmap is also a registered trademark of the Nmap Project.
  *
  * This program is distributed under the terms of the Nmap Public Source

TargetGroup.h

@@ -7,7 +7,7 @@
  *                                                                         *
  ***********************IMPORTANT NMAP LICENSE TERMS************************
  *
- * The Nmap Security Scanner is (C) 1996-2025 Nmap Software LLC ("The Nmap
+ * The Nmap Security Scanner is (C) 1996-2026 Nmap Software LLC ("The Nmap
  * Project"). Nmap is also a registered trademark of the Nmap Project.
  *
  * This program is distributed under the terms of the Nmap Public Source

charpool.cc

@@ -5,7 +5,7 @@
  *                                                                         *
  ***********************IMPORTANT NMAP LICENSE TERMS************************
  *
- * The Nmap Security Scanner is (C) 1996-2025 Nmap Software LLC ("The Nmap
+ * The Nmap Security Scanner is (C) 1996-2026 Nmap Software LLC ("The Nmap
  * Project"). Nmap is also a registered trademark of the Nmap Project.
  *
  * This program is distributed under the terms of the Nmap Public Source
@@ -64,6 +64,7 @@
 #include <stddef.h>
 #undef NDEBUG
 #include <assert.h>
+#include <climits>
 
 #include "nbase.h"
 

charpool.h

@@ -5,7 +5,7 @@
  *                                                                         *
  ***********************IMPORTANT NMAP LICENSE TERMS************************
  *
- * The Nmap Security Scanner is (C) 1996-2025 Nmap Software LLC ("The Nmap
+ * The Nmap Security Scanner is (C) 1996-2026 Nmap Software LLC ("The Nmap
  * Project"). Nmap is also a registered trademark of the Nmap Project.
  *
  * This program is distributed under the terms of the Nmap Public Source

configure

@@ -7258,6 +7258,7 @@ fi
 fi
 
 if test $have_libpcap != yes; then
+  ac_configure_args="$ac_configure_args '--disable-dbus'"
   subdirs="$subdirs libpcap"
 
   if test "${LIBPCAP_INC+set}" = "set"; then
@@ -7275,6 +7276,48 @@ printf "%s\n" "#define PCAP_INCLUDED 1" >>confdefs.h
 
 printf "%s\n" "#define HAVE_PCAP_SET_IMMEDIATE_MODE 1" >>confdefs.h
 
+  # Check if D-Bus is available (in case --disable-dbus didn't work)
+  # and add it to LIBS if needed for static linking
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for dbus_connection_read_write in -ldbus-1" >&5
+printf %s "checking for dbus_connection_read_write in -ldbus-1... " >&6; }
+if test ${ac_cv_lib_dbus_1_dbus_connection_read_write+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
+  ac_check_lib_save_LIBS=$LIBS
+LIBS="-ldbus-1  $LIBS"
+cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+
+/* Override any GCC internal prototype to avoid an error.
+   Use char because int might match the return type of a GCC
+   builtin and then its argument prototype would still apply.  */
+char dbus_connection_read_write ();
+int
+main (void)
+{
+return dbus_connection_read_write ();
+  ;
+  return 0;
+}
+_ACEOF
+if ac_fn_c_try_link "$LINENO"
+then :
+  ac_cv_lib_dbus_1_dbus_connection_read_write=yes
+else $as_nop
+  ac_cv_lib_dbus_1_dbus_connection_read_write=no
+fi
+rm -f core conftest.err conftest.$ac_objext conftest.beam \
+    conftest$ac_exeext conftest.$ac_ext
+LIBS=$ac_check_lib_save_LIBS
+fi
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_dbus_1_dbus_connection_read_write" >&5
+printf "%s\n" "$ac_cv_lib_dbus_1_dbus_connection_read_write" >&6; }
+if test "x$ac_cv_lib_dbus_1_dbus_connection_read_write" = xyes
+then :
+  LIBS="$LIBS -ldbus-1"
+fi
+
 else
   # We assume our included libpcap doesn't need this check-and-define
   # link with -lpcap for the purposes of this test
@@ -7997,8 +8040,6 @@ ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $
 ac_compiler_gnu=$ac_cv_c_compiler_gnu
 
     # We need Lua 5.4 exactly
-    { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for lua version == 504" >&5
-printf %s "checking for lua version == 504... " >&6; }
     ac_ext=c
 ac_cpp='$CPP $CPPFLAGS'
 ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5'
@@ -8165,6 +8206,10 @@ else $as_nop
   have_lua=no
 fi
 rm -f conftest.err conftest.i conftest.$ac_ext
+    { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for lua version == 504" >&5
+printf %s "checking for lua version == 504... " >&6; }
+    { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $have_lua" >&5
+printf "%s\n" "$have_lua" >&6; }
     ac_ext=c
 ac_cpp='$CPP $CPPFLAGS'
 ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5'
@@ -8178,9 +8223,11 @@ ac_compiler_gnu=$ac_cv_c_compiler_gnu
   fi
 
   # if we didn't find we use our own
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether lua was found" >&5
+printf %s "checking whether lua was found... " >&6; }
   if test $have_lua != yes; then
-    { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
-printf "%s\n" "no" >&6; }
+    { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no, will use our own" >&5
+printf "%s\n" "no, will use our own" >&6; }
     CPPFLAGS="-I\$(top_srcdir)/$LIBLUADIR $CPPFLAGS"
     LIBLUA_LIBS="\$(top_srcdir)/$LIBLUADIR/liblua.a"
     LUA_BUILD="build-lua"
@@ -8298,9 +8345,11 @@ done
 fi
 
 # if we didn't find we use our own
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether liblinear was found" >&5
+printf %s "checking whether liblinear was found... " >&6; }
 if test $have_liblinear != yes; then
-  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
-printf "%s\n" "no" >&6; }
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no, will use our own" >&5
+printf "%s\n" "no, will use our own" >&6; }
   CPPFLAGS="-I\$(top_srcdir)/$LIBLINEARDIR $CPPFLAGS"
   LIBLINEAR_LIBS="\$(top_srcdir)/$LIBLINEARDIR/liblinear.a"
   LIBLINEAR_BUILD="build-liblinear"

configure.ac

@@ -495,6 +495,9 @@ if test $have_libpcap != yes; then
   PCAP_DIST_CLEAN="distclean-pcap"
   AC_DEFINE(PCAP_INCLUDED, 1, [Using included libpcap])
   AC_DEFINE(HAVE_PCAP_SET_IMMEDIATE_MODE, 1, [Included libpcap has pcap_set_immediate_mode])
+  # Check if D-Bus is available (in case --disable-dbus didn't work)
+  # and add it to LIBS if needed for static linking
+  AC_CHECK_LIB([dbus-1], [dbus_connection_read_write], [LIBS="$LIBS -ldbus-1"])
 else
   # We assume our included libpcap doesn't need this check-and-define
   # link with -lpcap for the purposes of this test

docs/man-xlate/nmap-es.1

@@ -2,12 +2,12 @@
 .\"     Title: nmap
 .\"    Author: [see the "Autor" section]
 .\" Generator: DocBook XSL Stylesheets v1.79.1 <http://docbook.sf.net/>
-.\"      Date: 06/08/2025
+.\"      Date: 19/03/2026
 .\"    Manual: Guía de referencia de Nmap
 .\"    Source: Nmap
 .\"  Language: Spanish
 .\"
-.TH "NMAP" "1" "06/08/2025" "Nmap" "Guía de referencia de Nmap"
+.TH "NMAP" "1" "19/03/2026" "Nmap" "Guía de referencia de Nmap"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------

docs/man-xlate/nmap-fr.1

@@ -2,12 +2,12 @@
 .\"     Title: nmap
 .\"    Author: [see the "Auteur" section]
 .\" Generator: DocBook XSL Stylesheets v1.79.1 <http://docbook.sf.net/>
-.\"      Date: 06/08/2025
+.\"      Date: 19/03/2026
 .\"    Manual: Guide de référence Nmap
 .\"    Source: Nmap
 .\"  Language: French
 .\"
-.TH "NMAP" "1" "06/08/2025" "Nmap" "Guide de référence Nmap"
+.TH "NMAP" "1" "19/03/2026" "Nmap" "Guide de référence Nmap"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------

docs/man-xlate/nmap-hr.1

@@ -2,12 +2,12 @@
 .\"     Title: nmap
 .\"    Author: [see the "Author" section]
 .\" Generator: DocBook XSL Stylesheets v1.79.1 <http://docbook.sf.net/>
-.\"      Date: 04/12/2024
+.\"      Date: 03/19/2026
 .\"    Manual: Nmap vodič
 .\"    Source: Nmap
 .\"  Language: Croatian
 .\"
-.TH "NMAP" "1" "04/12/2024" "Nmap" "Nmap vodič"
+.TH "NMAP" "1" "03/19/2026" "Nmap" "Nmap vodič"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------

docs/man-xlate/nmap-hu.1

@@ -2,12 +2,12 @@
 .\"     Title: nmap
 .\"    Author: [FIXME: author] [see http://docbook.sf.net/el/author]
 .\" Generator: DocBook XSL Stylesheets v1.79.1 <http://docbook.sf.net/>
-.\"      Date: 12/04/2024
+.\"      Date: 19/03/2026
 .\"    Manual: Nmap Referencia Útmutató
 .\"    Source: Nmap
 .\"  Language: Hungarian
 .\"
-.TH "NMAP" "1" "12/04/2024" "Nmap" "Nmap Referencia Útmutató"
+.TH "NMAP" "1" "19/03/2026" "Nmap" "Nmap Referencia Útmutató"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------

docs/man-xlate/nmap-id.1

@@ -2,12 +2,12 @@
 .\"     Title: nmap
 .\"    Author: [see the "Penulis" section]
 .\" Generator: DocBook XSL Stylesheets v1.79.1 <http://docbook.sf.net/>
-.\"      Date: 04/12/2024
+.\"      Date: 03/27/2026
 .\"    Manual: Panduan Referensi Nmap
 .\"    Source: Nmap
 .\"  Language: Indonesian
 .\"
-.TH "NMAP" "1" "04/12/2024" "Nmap" "Panduan Referensi Nmap"
+.TH "NMAP" "1" "03/27/2026" "Nmap" "Panduan Referensi Nmap"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------

docs/man-xlate/nmap-it.1

@@ -2,12 +2,12 @@
 .\"     Title: nmap
 .\"    Author: [see the "Autore" section]
 .\" Generator: DocBook XSL Stylesheets v1.79.1 <http://docbook.sf.net/>
-.\"      Date: 12/04/2024
+.\"      Date: 19/03/2026
 .\"    Manual: Guida di riferimento di Nmap
 .\"    Source: Nmap
 .\"  Language: Italian
 .\"
-.TH "NMAP" "1" "12/04/2024" "Nmap" "Guida di riferimento di Nmap"
+.TH "NMAP" "1" "19/03/2026" "Nmap" "Guida di riferimento di Nmap"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------

docs/man-xlate/nmap-ja.1

@@ -2,12 +2,12 @@
 .\"     Title: nmap
 .\"    Author: [FIXME: author] [see http://docbook.sf.net/el/author]
 .\" Generator: DocBook XSL Stylesheets v1.79.1 <http://docbook.sf.net/>
-.\"      Date: 06/08/2025
+.\"      Date: 27/03/2026
 .\"    Manual: Nmap リファレンスガイド
 .\"    Source: Nmap
 .\"  Language: Japanese
 .\"
-.TH "NMAP" "1" "06/08/2025" "Nmap" "Nmap リファレンスガイド"
+.TH "NMAP" "1" "27/03/2026" "Nmap" "Nmap リファレンスガイド"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------
@@ -93,7 +93,7 @@ Nmapの最新バージョンは、\m[blue]\fB\%https://nmap.org\fR\m[]から入
 .RS 4
 .\}
 .nf
-Nmap 7\&.98 ( https://nmap\&.org )
+Nmap 7\&.99SVN ( https://nmap\&.org )
 Usage: nmap [Scan Type(s)] [Options] {target specification}
 TARGET SPECIFICATION:
   Can pass hostnames, IP addresses, networks, etc\&.

docs/man-xlate/nmap-pl.1

@@ -2,12 +2,12 @@
 .\"     Title: nmap
 .\"    Author: [see the "Autor" section]
 .\" Generator: DocBook XSL Stylesheets v1.79.1 <http://docbook.sf.net/>
-.\"      Date: 04/12/2024
+.\"      Date: 03/19/2026
 .\"    Manual: Opis programu Nmap
 .\"    Source: Nmap
 .\"  Language: Polish
 .\"
-.TH "NMAP" "1" "04/12/2024" "Nmap" "Opis programu Nmap"
+.TH "NMAP" "1" "03/19/2026" "Nmap" "Opis programu Nmap"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------

docs/man-xlate/nmap-pt_BR.1

@@ -2,12 +2,12 @@
 .\"     Title: nmap
 .\"    Author: [see the "Autor" section]
 .\" Generator: DocBook XSL Stylesheets v1.79.1 <http://docbook.sf.net/>
-.\"      Date: 06/08/2025
+.\"      Date: 19/03/2026
 .\"    Manual: Guia de Referência do Nmap
 .\"    Source: Nmap
 .\"  Language: Portuguese (Brazil)
 .\"
-.TH "NMAP" "1" "06/08/2025" "Nmap" "Guia de Referência do Nmap"
+.TH "NMAP" "1" "19/03/2026" "Nmap" "Guia de Referência do Nmap"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------

docs/man-xlate/nmap-pt_PT.1

@@ -2,12 +2,12 @@
 .\"     Title: nmap
 .\"    Author: [see the "Autor" section]
 .\" Generator: DocBook XSL Stylesheets v1.79.1 <http://docbook.sf.net/>
-.\"      Date: 06/08/2025
+.\"      Date: 19/03/2026
 .\"    Manual: Guia de Referência do Nmap
 .\"    Source: Nmap
 .\"  Language: Portuguese
 .\"
-.TH "NMAP" "1" "06/08/2025" "Nmap" "Guia de Referência do Nmap"
+.TH "NMAP" "1" "19/03/2026" "Nmap" "Guia de Referência do Nmap"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------

docs/man-xlate/nmap-ro.1

@@ -2,12 +2,12 @@
 .\"     Title: nmap
 .\"    Author: [FIXME: author] [see http://docbook.sf.net/el/author]
 .\" Generator: DocBook XSL Stylesheets v1.79.1 <http://docbook.sf.net/>
-.\"      Date: 05/17/2023
+.\"      Date: 03/19/2026
 .\"    Manual: Ghid de referinta Nmap
 .\"    Source: Nmap
 .\"  Language: Romanian
 .\"
-.TH "NMAP" "1" "05/17/2023" "Nmap" "Ghid de referinta Nmap"
+.TH "NMAP" "1" "03/19/2026" "Nmap" "Ghid de referinta Nmap"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------

docs/man-xlate/nmap-ru.1

@@ -2,12 +2,12 @@
 .\"     Title: nmap
 .\"    Author: [see the "Автор" section]
 .\" Generator: DocBook XSL Stylesheets v1.79.1 <http://docbook.sf.net/>
-.\"      Date: 08/06/2025
+.\"      Date: 03/19/2026
 .\"    Manual: Справочное руководство Nmap
 .\"    Source: Nmap
 .\"  Language: Russian
 .\"
-.TH "nmap" "1" "08/06/2025" "Nmap" "Справочное руководство Nmap"
+.TH "nmap" "1" "03/19/2026" "Nmap" "Справочное руководство Nmap"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------

docs/man-xlate/nmap-sk.1

@@ -2,12 +2,12 @@
 .\"     Title: nmap
 .\"    Author: [FIXME: author] [see http://docbook.sf.net/el/author]
 .\" Generator: DocBook XSL Stylesheets v1.79.1 <http://docbook.sf.net/>
-.\"      Date: 12. apríla 2024
+.\"      Date: 19. marca 2026
 .\"    Manual: Nmap - Referencna prirucka
 .\"    Source: Nmap
 .\"  Language: Slovak
 .\"
-.TH "NMAP" "1" "12. apríla 2024" "Nmap" "Nmap \- Referencna prirucka"
+.TH "NMAP" "1" "19. marca 2026" "Nmap" "Nmap \- Referencna prirucka"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------

docs/man-xlate/nmap-zh.1

@@ -2,12 +2,12 @@
 .\"     Title: nmap
 .\"    Author: [see the "作者" section]
 .\" Generator: DocBook XSL Stylesheets v1.79.1 <http://docbook.sf.net/>
-.\"      Date: 2023-03-31
+.\"      Date: 2026-03-19
 .\"    Manual: Nmap参考指南
 .\"    Source: Nmap
 .\"  Language: Chinese
 .\"
-.TH "NMAP" "1" "2023-03-31" "Nmap" "Nmap参考指南"
+.TH "NMAP" "1" "2026-03-19" "Nmap" "Nmap参考指南"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------

docs/nmap-install.xml

@@ -534,35 +534,45 @@ for the most common distributions.</para>
 <indexterm><primary>SUSE (Linux distribution)</primary><secondary>installing on, with RPM</secondary></indexterm>
 <indexterm><primary>Fedora (Linux distribution)</primary><secondary>installing on, with RPM</secondary></indexterm>
 
-<para>I build RPM packages for every release of Nmap and post them to
-the Nmap download page at <ulink url="https://nmap.org/download.html" />.
-I build two packages:  The <literal>nmap</literal> package contains
-just the command-line executable and data files, while the
-<literal>zenmap</literal> package contains the optional <application>Zenmap</application>
-graphical frontend (see <xref linkend="zenmap"/>).
-The <literal>zenmap</literal> package requires
-that the <literal>nmap</literal> package be installed first.</para>
+<para>Nmap, Ncat, and Nping are available as RPM packages on
+the Nmap download page at <ulink url="https://nmap.org/download#linux-rpm" />.
+Zenmap is available as a Python wheel instead of an RPM. To install it, download
+the wheel from the same page and install it with your system Python 3 using
+<command>pip install zenmap-*.whl</command>. Any required dependencies will be
+downloaded and installed automatically.</para>
 
 <para>
 <indexterm><primary>RPM</primary><secondary>installing from</secondary></indexterm>
 Installing via <application>RPM</application> is quite easy&mdash;it
-even downloads the package for you when given the proper URLs.  The following example downloads and installs Nmap 4.68, including the frontend.  Of course you should use the latest version at the download site above instead.  Any existing RPM-installed versions are
+even downloads the package for you when given the proper URLs.  The following example downloads and installs Nmap 7.98.  Of course you should use the latest version at the download site above instead.  Any existing RPM-installed versions are
 upgraded. <xref linkend="ex-nmap-install-from-rpms" xrefstyle="select: label nopage" /> demonstrates this installation process.</para>
 
 <example id="ex-nmap-install-from-rpms"><title>Installing Nmap from binary RPMs</title>
 <screen>
-# <userinput>rpm -vhU https://nmap.org/dist/nmap-4.68-1.i386.rpm</userinput>
-Retrieving https://nmap.org/dist/nmap-4.68-1.i386.rpm
-Preparing...                ########################################### [100%]
-   1:nmap                   ########################################### [100%]
-# <userinput>rpm -vhU https://nmap.org/dist/zenmap-4.68-1.noarch.rpm</userinput>
-Retrieving https://nmap.org/dist/zenmap-4.68-1.noarch.rpm
-Preparing...                ########################################### [100%]
-   1:zenmap                 ########################################### [100%]
+$ <userinput>sudo rpm -vhU https://nmap.org/dist/nmap-7.98-1.x86_64.rpm</userinput>
+Retrieving https://nmap.org/dist/nmap-7.98-1.x86_64.rpm
+Verifying...                          ################################# [100%]
+Preparing...                          ################################# [100%]
+Updating / installing...
+   1:nmap-1:7.98-1                    ################################# [100%]
 </screen>
 </example>
 
-<para>As the filenames above imply, these binary RPMs were created for normal PCs (x86 architecture).<indexterm><primary>x86 architecture</primary></indexterm>  I also distribute x86_64<indexterm><primary>x86_64 architecture</primary></indexterm> binaries for 64-bit Linux users.  These binaries won't work for the relatively few Linux users on other platforms such as SPARC, Alpha, or PowerPC.  They also may refuse to install if your library versions are sufficiently different from what the RPMs were initially built on.  One option in these cases would be to find binary RPMs prepared by your Linux vendor for your specific distribution.  The original install CDs or DVD are a good place to start.  Unfortunately, those may not be current or available.  Another option is to install Nmap from source code as described previously, though you lose the binary package maintenance consistency benefits.  A third option is to build and install your own binary RPMs from the source RPMs distributed from the download page above.  <xref linkend="ex-nmap-install-from-srpms" xrefstyle="select: label nopage" /> demonstrates this technique with Nmap 4.68.</para>
+<para>As the filenames above imply, these binary RPMs were created for normal
+  PCs (x86_64 architecture).<indexterm><primary>x86_64
+      architecture</primary></indexterm>.  These binaries won't work for the
+  Linux users on other platforms such as ARM64, x86, or PowerPC.  They also
+  may refuse to install if your library versions are sufficiently different
+  from what the RPMs were initially built on.  One option in these cases would
+  be to find binary RPMs prepared by your Linux vendor for your specific
+  distribution.  The original install CDs or DVD are a good place to start.
+  Unfortunately, those may not be current or available.  Another option is to
+  install Nmap from source code as described previously, though you lose the
+  binary package maintenance consistency benefits.  A third option is to build
+  and install your own binary RPMs from the source RPMs distributed from the
+  download page above.  <xref linkend="ex-nmap-install-from-srpms"
+    xrefstyle="select: label nopage" /> demonstrates this technique with Nmap
+  4.68.</para>
 
 <example id="ex-nmap-install-from-srpms"><title>Building and installing Nmap from source RPMs</title>
 <screen>
@@ -579,11 +589,7 @@ Preparing...                ########################################### [100%]
 </screen>
 </example>
 
-<para>It is not necessary to rebuild Zenmap in this fashion because the
-Zenmap RPM is architecture-independent (<quote>noarch</quote>). For that
-reason there are no Zenmap source RPMs.</para>
-
-<para>Removing RPM packages is as easy as <command>rpm -e nmap zenmap</command>.</para>
+<para>Removing RPM packages is as easy as <command>rpm -e nmap ncat</command>.</para>
 </sect2>
 
 <sect2 id="inst-yum"><title>Updating Red Hat, Fedora, Mandrake, and Yellow Dog Linux with Yum</title>
@@ -793,6 +799,52 @@ Install System</ulink>.  After it completes, read <xref
 linkend="inst-win-exec"/> for instructions on executing Nmap on the
 command-line or through Zenmap.</para>
 
+<sect3 id="inst-win-exe-options">
+  <title>Installer options</title>
+  <para>
+    The installer accepts several command-line options to change the installer
+    behavior or the selection of some of the components of the installation. By
+    default, all components are selected. The options are:
+  </para>
+<variablelist>
+  <varlistentry>
+    <term><option>/NMAP=NO</option></term>
+    <listitem>Don't install Nmap</listitem>
+  </varlistentry>
+  <varlistentry>
+    <term><option>/NPCAP=NO</option></term>
+    <listitem>Don't install Npcap. Unless Npcap is installed separately, some
+      features of Nmap and Nping will not work.</listitem>
+  </varlistentry>
+  <varlistentry>
+    <term><option>/NCAT=NO</option></term>
+    <listitem>Don't install Ncat.</listitem>
+  </varlistentry>
+  <varlistentry>
+    <term><option>/NPING=NO</option></term>
+    <listitem>Don't install Nping.</listitem>
+  </varlistentry>
+  <varlistentry>
+    <term><option>/ZENMAP=NO</option></term>
+    <listitem>Don't install Zenmap. Nmap OEM does not include Zenmap.</listitem>
+  </varlistentry>
+  <varlistentry>
+    <term><option>/NDIFF=NO</option></term>
+    <listitem>Don't install Ndiff. Nmap OEM does not include Ndiff.</listitem>
+  </varlistentry>
+  <varlistentry>
+    <term><option>/REGISTRYMODS=NO</option></term>
+    <listitem>Don't install performance-related registry modifications.</listitem>
+  </varlistentry>
+  <varlistentry>
+    <term><option>/REGISTERPATH=NO</option></term>
+    <listitem>Don't add the installation directory to <envar>PATH</envar>.</listitem>
+  </varlistentry>
+</variablelist>
+  <para>Additionally, the <option>/D</option> can be used to change the
+    installation directory. Nmap OEM installers also accept <option>/S</option>
+    for silent installation.</para>
+</sect3>
 </sect2>
 
 <sect2 id="inst-win-zip"><title>Command-line Zip Binaries</title>

docs/nmap.1

@@ -2,12 +2,12 @@
 .\"     Title: nmap
 .\"    Author: [see the "Authors" section]
 .\" Generator: DocBook XSL Stylesheets v1.79.1 <http://docbook.sf.net/>
-.\"      Date: 08/21/2025
+.\"      Date: 03/27/2026
 .\"    Manual: Nmap Reference Guide
 .\"    Source: Nmap
 .\"  Language: English
 .\"
-.TH "NMAP" "1" "08/21/2025" "Nmap" "Nmap Reference Guide"
+.TH "NMAP" "1" "03/27/2026" "Nmap" "Nmap Reference Guide"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------
@@ -119,7 +119,7 @@ This options summary is printed when Nmap is run with no arguments, and the late
 .RS 4
 .\}
 .nf
-Nmap 7\&.98SVN ( https://nmap\&.org )
+Nmap 7\&.99SVN ( https://nmap\&.org )
 Usage: nmap [Scan Type(s)] [Options] {target specification}
 TARGET SPECIFICATION:
   Can pass hostnames, IP addresses, networks, etc\&.
@@ -1380,10 +1380,11 @@ http\-\&.
 Lets you provide arguments to NSE scripts\&. Arguments are a comma\-separated list of
 name=value
 pairs\&. Names and values may be strings not containing whitespace or the characters \(oq{\(cq, \(oq}\(cq, \(oq=\(cq, or \(oq,\(cq\&. To include one of these characters in a string, enclose the string in single or double quotes\&. Within a quoted string, \(oq\e\(cq escapes a quote\&. A backslash is only used to escape quotation marks in this special case; in all other cases a backslash is interpreted literally\&. Values may also be tables enclosed in
-{}, just as in Lua\&. A table may contain simple string values or more name\-value pairs, including nested tables\&. Many scripts qualify their arguments with the script name, as in
-xmpp\-info\&.server_name\&. You may use that full qualified version to affect just the specified script, or you may pass the unqualified version (server_name
-in this case) to affect all scripts using that argument name\&. A script will first check for its fully qualified argument name (the name specified in its documentation) before it accepts an unqualified argument name\&. A complex example of script arguments is
-\fB\-\-script\-args \*(Aquser=foo,pass=",{}=bar",whois={whodb=nofollow+ripe},xmpp\-info\&.server_name=localhost\*(Aq\fR\&. The online NSE Documentation Portal at
+{}, just as in Lua\&. A table may contain simple string values or more name\-value pairs, including nested tables\&. A complex example of script arguments is
+\fB\-\-script\-args \*(Aquser=foo,pass=",{}=bar",whois={whodb=nofollow+ripe},xmpp\-info\&.server_name=localhost\*(Aq\fR\&. Many scripts qualify their arguments with the script name, as in
+xmpp\-info\&.server_name\&. A script will first check for its fully qualified argument name (the name specified in its documentation) before it accepts an unqualified argument name (server_name
+in this case)\&. Some arguments are not specific to one script\&. They typically effect behavior of a library and therefore potentially all the scripts that use the library\&. (One such example is
+http\&.useragent, which sets the default HTTP User\-Agent header for every web request, regardless which script sends it\&.) It is not possible for the exact same argument to be given different values for diferent scripts\&. The online NSE Documentation Portal at
 \m[blue]\fB\%https://nmap.org/nsedoc/\fR\m[]
 lists the arguments that each script accepts\&.
 .RE

docs/nmap.usage.txt

@@ -1,4 +1,4 @@
-Nmap 7.98SVN ( https://nmap.org )
+Nmap 7.99SVN ( https://nmap.org )
 Usage: nmap [Scan Type(s)] [Options] {target specification}
 TARGET SPECIFICATION:
   Can pass hostnames, IP addresses, networks, etc.

docs/refguide.xml

@@ -309,6 +309,8 @@ you would expect.</para>
           wish to scan includes untouchable mission-critical servers,
           systems that are known to react adversely to port scans,
           or subnets administered by other people.</para>
+          <para>If an excluded name cannot be resolved to a network address, Nmap
+          will quit without performing scanning.</para>
         </listitem>
       </varlistentry>
 
@@ -2480,9 +2482,20 @@ escapes a quote. A backslash is only used to escape quotation marks in this
 special case; in all other cases a backslash is interpreted literally. Values
 may also be tables enclosed in <literal>{}</literal>, just as in Lua. A table
 may contain simple string values or more name-value pairs, including nested
-tables.  Many scripts qualify their arguments with the script name, as in <literal>xmpp-info.server_name</literal>.  You may use that full qualified version to affect just the specified script, or you may pass the unqualified version (<literal>server_name</literal> in this case) to affect all scripts using that argument name.  A script will first check for its fully qualified argument name (the name specified in its documentation) before it accepts an unqualified argument name.  A complex example of script arguments is
-<option>--script-args 'user=foo,pass=",{}=bar",whois={whodb=nofollow+ripe},xmpp-info.server_name=localhost'</option>.  The online NSE Documentation Portal at <ulink url="https://nmap.org/nsedoc/"/>
-lists the arguments that each script accepts.
+tables.  A complex example of script arguments is
+<option>--script-args 'user=foo,pass=",{}=bar",whois={whodb=nofollow+ripe},xmpp-info.server_name=localhost'</option>.
+Many scripts qualify their arguments with the script name, as in
+<literal>xmpp-info.server_name</literal>.  A script will first check for its
+fully qualified argument name (the name specified in its documentation) before
+it accepts an unqualified argument name (<literal>server_name</literal> in this
+case).  Some arguments are not specific to one script. They typically effect
+behavior of a library and therefore potentially all the scripts that use the
+library.  (One such example is <literal>http.useragent</literal>, which sets
+the default HTTP User-Agent header for every web request, regardless which
+script sends it.)  It is not possible for the exact same argument to be given
+different values for diferent scripts.  The online NSE Documentation Portal at
+<ulink url="https://nmap.org/nsedoc/"/> lists the arguments that each script
+accepts.
 </para>
 </listitem>
 </varlistentry>

docs/zenmap.1

@@ -2,12 +2,12 @@
 .\"     Title: zenmap
 .\"    Author: [see the "Authors" section]
 .\" Generator: DocBook XSL Stylesheets v1.79.1 <http://docbook.sf.net/>
-.\"      Date: 08/21/2025
+.\"      Date: 03/27/2026
 .\"    Manual: Zenmap Reference Guide
 .\"    Source: Zenmap
 .\"  Language: English
 .\"
-.TH "ZENMAP" "1" "08/21/2025" "Zenmap" "Zenmap Reference Guide"
+.TH "ZENMAP" "1" "03/27/2026" "Zenmap" "Zenmap Reference Guide"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------

idle_scan.cc

@@ -9,7 +9,7 @@
  *                                                                         *
  ***********************IMPORTANT NMAP LICENSE TERMS************************
  *
- * The Nmap Security Scanner is (C) 1996-2025 Nmap Software LLC ("The Nmap
+ * The Nmap Security Scanner is (C) 1996-2026 Nmap Software LLC ("The Nmap
  * Project"). Nmap is also a registered trademark of the Nmap Project.
  *
  * This program is distributed under the terms of the Nmap Public Source
@@ -136,19 +136,20 @@ struct idle_proxy_info {
 /* Finds the IPv6 extension header for fragmentation in an IPv6 packet, and returns
  * the identification value of the fragmentation header
 */
-int ipv6_get_fragment_id(const struct ip6_hdr *ip6, unsigned int len) {
-  const unsigned char *p, *end;
+int ipv6_get_fragment_id(const u8 *pkt, unsigned int len) {
+  const u8 *p, *end;
   u8 hdr;
-  struct ip6_ext_data_fragment *frag_header = NULL;
 
-  if (len < sizeof(*ip6))
+  struct ip6_hdr ip6;
+  if (len < sizeof(ip6))
     return -1;
+  memcpy(&ip6, pkt, sizeof(ip6));
 
-  p = (unsigned char *) ip6;
+  p = pkt;
   end = p + len;
 
-  hdr = ip6->ip6_nxt;
-  p += sizeof(*ip6);
+  hdr = ip6.ip6_nxt;
+  p += sizeof(ip6);
 
   /* If the first extension header is not the fragmentation, we search our way
    * through the extension headers until we find the fragmentation header */
@@ -162,9 +163,10 @@ int ipv6_get_fragment_id(const struct ip6_hdr *ip6, unsigned int len) {
   if (hdr != IP_PROTO_FRAGMENT ||  (p + 2 + sizeof(ip6_ext_data_fragment)) > end)
     return -1;
 
-  frag_header = (struct ip6_ext_data_fragment *)( p + 2 );
+  struct ip6_ext_data_fragment frag_header;
+  memcpy(&frag_header, p + 2, sizeof(frag_header));
 
-  return (ntohl(frag_header->ident));
+  return (ntohl(frag_header.ident));
 
 }
 
@@ -183,19 +185,13 @@ static int ipid_proxy_probe(struct idle_proxy_info *proxy, int *probes_sent,
   struct timeval tv_sent[3], rcvdtime;
   int ipid = -1;
   int to_usec;
-  unsigned int bytes;
   int base_port;
-  struct ip *ip;
-  struct tcp_hdr *tcp = NULL;
   static u32 seq_base = 0;
   static u32 ack = 0;
   static int packet_send_count = 0; /* Total # of probes sent by this program -- to ensure that our sequence # always changes */
   u32 packetlen = 0;
   u8 *ipv6_packet = NULL;
   const struct sockaddr_storage *ss;
-  struct ip6_hdr *ip6 = NULL;
-  const void *ipv6_data;
-  u8 hdr;
   int res;
 
   if (o.magic_port_set)
@@ -248,56 +244,53 @@ static int ipid_proxy_probe(struct idle_proxy_info *proxy, int *probes_sent,
       to_usec = proxy->host.to.timeout - TIMEVAL_SUBTRACT(tv_end, tv_sent[tries - 1]);
       if (to_usec < 0)
         to_usec = 0; // Final no-block poll
-      ip = (struct ip *) readip_pcap(proxy->pd, &bytes, to_usec, &rcvdtime, NULL, true);
+      unsigned int bytes = 0;
+      const u8 *pkt = readip_pcap(proxy->pd, &bytes, to_usec, &rcvdtime, NULL, true);
       gettimeofday(&tv_end, NULL);
-      if (ip) {
-        if (o.af() == AF_INET) {
-          if (bytes < (4 * ip->ip_hl) + 14U)
-            continue;
-          if (ip->ip_p == IPPROTO_TCP)
-            tcp = ((struct tcp_hdr *) (((char *) ip) + 4 * ip->ip_hl));
-        } else if (o.af() == AF_INET6) {
-          if (ip->ip_v != 6) {
-            error("IPv6 packet with a version field != 6 received");
-          } else {
-            ip6 = (struct ip6_hdr *) ip;
-            ipv6_data = ipv6_get_data(ip6, &packetlen, &hdr);
-            if (hdr == IPPROTO_TCP && ipv6_data != NULL) {
-              tcp = (struct tcp_hdr *) ipv6_data;
-            }
-          }
-        }
-        if (tcp) {
-          if (ntohs(tcp->th_dport) < base_port || ntohs(tcp->th_dport) - base_port >= tries  || ntohs(tcp->th_sport) != proxy->probe_port || ((tcp->th_flags & TH_RST) == 0)) {
-            if (ntohs(tcp->th_dport) > o.magic_port && ntohs(tcp->th_dport) < (o.magic_port + 260)) {
-              if (o.debugging) {
-                error("Received IP ID zombie probe response which probably came from an earlier prober instance ... increasing rttvar from %d to %d",
-                      proxy->host.to.rttvar, (int) (proxy->host.to.rttvar * 1.2));
-              }
-              proxy->host.to.rttvar = (int) (proxy->host.to.rttvar * 1.2);
-              rcvd++;
-            } else if (o.debugging > 1) {
-              char straddr[INET6_ADDRSTRLEN];
-              if (o.af() == AF_INET)
-                inet_ntop(AF_INET, &(ip->ip_src), straddr, sizeof(straddr));
-              else if (o.af() == AF_INET6)
-                inet_ntop(AF_INET6, &(ip6->ip6_src), straddr, sizeof(straddr));
-              error("Received unexpected response packet from %s during IP ID zombie probing:", straddr);
-              readtcppacket((unsigned char *) ip, MIN(ntohs(ip->ip_len), bytes));
-            }
-            continue;
-          }
-
-          trynum = ntohs(tcp->th_dport) - base_port;
-          rcvd++;
-
-          if (o.af() == AF_INET)
-            ipid = ntohs(ip->ip_id);
-          else if (o.af() == AF_INET6)
-            ipid = ipv6_get_fragment_id(ip6, bytes);
-          adjust_timeouts2(&(tv_sent[trynum]), &rcvdtime, &(proxy->host.to));
-        }
+      if (!pkt || bytes < 20) {
+        continue;
       }
+      struct abstract_ip_hdr hdr;
+
+      unsigned int tcpbytes = bytes;
+      const u8 *tcppkt = ip_get_data(pkt, &tcpbytes, &hdr);
+      if (!tcppkt || hdr.proto != IPPROTO_TCP) {
+        continue;
+      }
+
+      if ((o.af() == AF_INET && hdr.version != 4) ||
+          (o.af() == AF_INET6 && hdr.version != 6)) {
+        continue;
+      }
+      struct tcp_hdr tcp;
+      if (tcpbytes < sizeof(tcp))
+        continue;
+      memcpy(&tcp, tcppkt, sizeof(tcp));
+
+      if (ntohs(tcp.th_dport) < base_port || ntohs(tcp.th_dport) - base_port >= tries  || ntohs(tcp.th_sport) != proxy->probe_port || ((tcp.th_flags & TH_RST) == 0)) {
+        if (ntohs(tcp.th_dport) > o.magic_port && ntohs(tcp.th_dport) < (o.magic_port + 260)) {
+          if (o.debugging) {
+            error("Received IP ID zombie probe response which probably came from an earlier prober instance ... increasing rttvar from %d to %d",
+                proxy->host.to.rttvar, (int) (proxy->host.to.rttvar * 1.2));
+          }
+          proxy->host.to.rttvar = (int) (proxy->host.to.rttvar * 1.2);
+          rcvd++;
+        } else if (o.debugging > 1) {
+          error("Received unexpected response packet from %s during IP ID zombie probing:",
+              inet_socktop(&hdr.src));
+          readtcppacket(pkt, 0);
+        }
+        continue;
+      }
+
+      trynum = ntohs(tcp.th_dport) - base_port;
+      rcvd++;
+
+      if (o.af() == AF_INET)
+        ipid = hdr.ipid;
+      else if (o.af() == AF_INET6)
+        ipid = ipv6_get_fragment_id(pkt, bytes);
+      adjust_timeouts2(&(tv_sent[trynum]), &rcvdtime, &(proxy->host.to));
     }
   } while (ipid == -1 && tries < maxtries);
 
@@ -354,7 +347,7 @@ static void initialize_proxy_struct(struct idle_proxy_info *proxy) {
 static void ipv6_force_fragmentation(struct idle_proxy_info *proxy, Target *target) {
   int hardtimeout = 9000000; /* Generally don't wait more than 9 secs total */
   char filter[512]; /* Libpcap filter string */
-  struct ip *ip;
+  const u8 *pkt;
   /* The maximum data size we can create without fragmenting, considering that the headers also need place */
   char data[IP6_MTU_MIN - IPv6_HEADER_LEN - ETH_HDR_LEN - ICMPv6_MIN_HEADER_LEN];
   unsigned int datalen, bytes;
@@ -398,8 +391,8 @@ static void ipv6_force_fragmentation(struct idle_proxy_info *proxy, Target *targ
   /* Now let's wait for the answer */
   while (!response_received) {
     gettimeofday(&tmptv, NULL);
-    ip = (struct ip *) readip_pcap(proxy->pd, &bytes, proxy_reply_timeout, &rcvdtime, NULL, true);
-    if (!ip) {
+    pkt = readip_pcap(proxy->pd, &bytes, proxy_reply_timeout, &rcvdtime, NULL, true);
+    if (!pkt) {
       if (TIMEVAL_SUBTRACT(tmptv, ipv6_packet_send_time) >= hardtimeout) {
             fatal("Idle scan zombie %s (%s) port %hu cannot be used because it has not returned any of our ICMPv6 Echo Requests -- perhaps it is down or firewalled.",
                   proxy->host.HostName(), proxy->host.targetipstr(),
@@ -408,7 +401,7 @@ static void ipv6_force_fragmentation(struct idle_proxy_info *proxy, Target *targ
       continue;
     }
     datalen = bytes;
-    rdata = ip_get_data(ip, &datalen, &hdr);
+    rdata = ip_get_data(pkt, &datalen, &hdr);
     if (hdr.version == 6 && hdr.proto == IPPROTO_ICMPV6) {
       icmp6_header = (struct icmpv6_hdr *) rdata;
       if (icmp6_header->icmpv6_type == ICMPV6_ECHOREPLY) {
@@ -426,7 +419,7 @@ static void ipv6_force_fragmentation(struct idle_proxy_info *proxy, Target *targ
   /* Now we can tell the idle host that its reply was too big, we want it smaller than the IPV6 minimum MTU */
   /* the data contains first the MTU we want, and then the received IPv6 package */
   *(uint32_t *)&data = ntohl(IP6_MTU_MIN - 2);
-  memcpy(&data[4], ip, sizeof(data)-4);
+  memcpy(&data[4], pkt, sizeof(data)-4);
 
   ipv6_packet = build_icmpv6_raw(proxy->host.v6sourceip(), proxy->host.v6hostip(), 0x00, 0x0000, o.ttl, 0x00 , 0x00, 0x02, 0x00, data, sizeof(data) , &packetlen);
   res = send_ip_packet(proxy->rawsd, proxy->ethptr, ss, ipv6_packet, packetlen);
@@ -487,8 +480,6 @@ static void initialize_idleproxy(struct idle_proxy_info *proxy, char *proxyName,
   u32 ack = 0;
   struct timeval probe_send_times[NUM_IPID_PROBES], tmptv, rcvdtime;
   u32 lastipid = 0;
-  struct ip *ip;
-  struct tcp_hdr *tcp;
   int distance;
   u32 ipids[NUM_IPID_PROBES];
   u8 probe_returned[NUM_IPID_PROBES];
@@ -496,7 +487,6 @@ static void initialize_idleproxy(struct idle_proxy_info *proxy, char *proxyName,
   assert(proxyName);
   u8 *ipv6_packet = NULL;
   u32 packetlen = 0;
-  const struct ip6_hdr *ip6;
   u8 ip6hdr;
   const void *ip6data;
   bool retried_forcing_fragmentation = false;
@@ -606,9 +596,7 @@ static void initialize_idleproxy(struct idle_proxy_info *proxy, char *proxyName,
   if (proxy->eth.ethsd != NULL) {
     if (!setTargetNextHopMAC(&proxy->host))
       fatal("%s: Failed to determine dst MAC address for Idle proxy", __func__);
-    memcpy(proxy->eth.srcmac, proxy->host.SrcMACAddress(), 6);
-    memcpy(proxy->eth.dstmac, proxy->host.NextHopMACAddress(), 6);
-    proxy->ethptr = &proxy->eth;
+    proxy->ethptr = proxy->host.FillEthNfo(&proxy->eth, proxy->eth.ethsd);
   }
   else {
     unblock_socket(proxy->rawsd);
@@ -682,11 +670,11 @@ static void initialize_idleproxy(struct idle_proxy_info *proxy, char *proxyName,
     while (probes_returned < probes_sent && !timedout) {
 
       to_usec = (probes_sent == NUM_IPID_PROBES) ? hardtimeout : 1000;
-      ip = (struct ip *) readip_pcap(proxy->pd, &bytes, to_usec, &rcvdtime, NULL, true);
+      const u8 *pkt = readip_pcap(proxy->pd, &bytes, to_usec, &rcvdtime, NULL, true);
 
       gettimeofday(&tmptv, NULL);
 
-      if (!ip) {
+      if (!pkt || bytes < 20) {
         if (probes_sent < NUM_IPID_PROBES)
           break;
         if (TIMEVAL_SUBTRACT(tmptv, probe_send_times[probes_sent - 1]) >= hardtimeout) {
@@ -697,28 +685,37 @@ static void initialize_idleproxy(struct idle_proxy_info *proxy, char *proxyName,
         timedout = 1;
       }
 
+      u8 ip_v = pkt[0] >> 4;
+
       if (o.af() == AF_INET) {
-        if (ip->ip_v != 4) {
+        if (ip_v != 4) {
           error("Received a packet with version field != 4");
           continue;
         }
-        if (lastipid != 0 && ip->ip_id == lastipid) {
+
+        struct ip ip;
+        if (bytes < sizeof(ip))
+          continue;
+        memcpy(&ip, pkt, sizeof(ip));
+
+        if (lastipid != 0 && ip.ip_id == lastipid) {
           continue; /* probably a duplicate */
         }
-        lastipid = ip->ip_id;
-        if (bytes < (4 * ip->ip_hl) + 14U)
+        lastipid = ip.ip_id;
+        if (bytes < (4 * ip.ip_hl) + 14U)
           continue;
 
-        if (ip->ip_p == IPPROTO_TCP) {
-          tcp = ((struct tcp_hdr *) (((char *) ip) + 4 * ip->ip_hl));
+        if (ip.ip_p == IPPROTO_TCP) {
+          struct tcp_hdr tcp;
+          memcpy(&tcp, pkt + 4 * ip.ip_hl, sizeof(tcp));
           /* Checking now for the source port, which we were not able to do in the libpcap filter */
-          if (ntohs(tcp->th_sport) != proxy->probe_port) {
+          if (ntohs(tcp.th_sport) != proxy->probe_port) {
              continue;
           }
 
-          if (ntohs(tcp->th_dport) < (o.magic_port + 1) || ntohs(tcp->th_dport) - o.magic_port > NUM_IPID_PROBES || ((tcp->th_flags & TH_RST) == 0)) {
+          if (ntohs(tcp.th_dport) < (o.magic_port + 1) || ntohs(tcp.th_dport) - o.magic_port > NUM_IPID_PROBES || ((tcp.th_flags & TH_RST) == 0)) {
             if (o.debugging > 1)
-              error("Received unexpected response packet from %s during initial IP ID zombie testing", inet_ntoa(ip->ip_src));
+              error("Received unexpected response packet from %s during initial IP ID zombie testing", inet_ntoa(ip.ip_src));
             continue;
           }
 
@@ -729,17 +726,19 @@ static void initialize_idleproxy(struct idle_proxy_info *proxy, char *proxyName,
              of sneaking through the firewall.  Plus SYN|ACK is what they will
              be receiving back from the target */
           probes_returned++;
-          ipids[seq_response_num] = ntohs(ip->ip_id);
+          ipids[seq_response_num] = ntohs(ip.ip_id);
           probe_returned[seq_response_num] = 1;
           adjust_timeouts2(&probe_send_times[seq_response_num], &rcvdtime, &(proxy->host.to));
         }
       } else if (o.af() == AF_INET6) {
-        if (ip->ip_v != 6) {
+        if (ip_v != 6) {
           error("Received a packet with version field != 6");
           continue;
         } else {
-          ip6 = (struct ip6_hdr *) ip;
-          newipid = ipv6_get_fragment_id(ip6, bytes);
+          struct ip6_hdr ip6;
+          if (bytes < sizeof(ip6))
+            continue;
+          newipid = ipv6_get_fragment_id(pkt, bytes);
           if (newipid < 0 ) {
             /* ok, the idle host does not seem to append the extension header for fragmentation. Let's try this once more,
             * maybe the idle host just adjusted its Path MTU. If we keep on having the problem, we quit */
@@ -755,22 +754,27 @@ static void initialize_idleproxy(struct idle_proxy_info *proxy, char *proxyName,
           }
           lastipid = newipid;
 
-          ip6data = ipv6_get_data(ip6, &packetlen, &ip6hdr);
-          if (ip6hdr == IPPROTO_TCP && ip6data != NULL) {
-              tcp = (struct tcp_hdr *) ip6data;
-              /* Checking now for the source port, which we were not able to do in the libpcap filter */
-              if (ntohs(tcp->th_sport) != proxy->probe_port) {
-                continue;
-              }
-          }else
-          {
+          ip6data = ipv6_get_data(pkt, &packetlen, &ip6hdr);
+          if (ip6data == NULL || ip6hdr != IPPROTO_TCP) {
             error("Malformed packet received");
             continue;
           }
 
-          if (ntohs(tcp->th_dport) < (o.magic_port + 1) || ntohs(tcp->th_dport) - o.magic_port > NUM_IPID_PROBES  || ((tcp->th_flags & TH_RST) == 0)) {
-            if (o.debugging > 1)
-              error("Received unexpected response packet from %s during initial IP ID zombie testing", inet_ntoa(ip->ip_src));
+          struct tcp_hdr tcp;
+          if (packetlen < sizeof(tcp)) {
+            continue;
+          }
+          memcpy(&tcp, ip6data, sizeof(tcp));
+          /* Checking now for the source port, which we were not able to do in the libpcap filter */
+          if (ntohs(tcp.th_sport) != proxy->probe_port) {
+            continue;
+          }
+
+          if (ntohs(tcp.th_dport) < (o.magic_port + 1) || ntohs(tcp.th_dport) - o.magic_port > NUM_IPID_PROBES  || ((tcp.th_flags & TH_RST) == 0)) {
+            if (o.debugging > 1) {
+              memcpy(&ip6, pkt, sizeof(ip6));
+              error("Received unexpected response packet from %s during initial IP ID zombie testing", ip6_ntoa(&ip6.ip6_src));
+            }
             continue;
           }
 
@@ -1000,10 +1004,8 @@ static int idlescan_countopen2(struct idle_proxy_info *proxy,
   if (proxy->rawsd < 0) {
     if (!setTargetNextHopMAC(target))
       fatal("%s: Failed to determine dst MAC address for Idle proxy", __func__);
-    memcpy(eth.srcmac, target->SrcMACAddress(), 6);
-    memcpy(eth.dstmac, target->NextHopMACAddress(), 6);
     eth.ethsd = eth_open_cached(target->deviceName());
-    if (eth.ethsd == NULL)
+    if (eth.ethsd == NULL || target->FillEthNfo(&eth, eth.ethsd) == NULL)
       fatal("%s: Failed to open ethernet device (%s)", __func__, target->deviceName());
   } else eth.ethsd = NULL;
 

idle_scan.h

@@ -9,7 +9,7 @@
  *                                                                         *
  ***********************IMPORTANT NMAP LICENSE TERMS************************
  *
- * The Nmap Security Scanner is (C) 1996-2025 Nmap Software LLC ("The Nmap
+ * The Nmap Security Scanner is (C) 1996-2026 Nmap Software LLC ("The Nmap
  * Project"). Nmap is also a registered trademark of the Nmap Project.
  *
  * This program is distributed under the terms of the Nmap Public Source

libdnet-stripped/configure

@@ -14475,6 +14475,12 @@ if test "x$ac_cv_header_sys_sockio_h" = xyes
 then :
   printf "%s\n" "#define HAVE_SYS_SOCKIO_H 1" >>confdefs.h
 
+fi
+ac_fn_c_check_header_compile "$LINENO" "sys/ioccom.h" "ac_cv_header_sys_ioccom_h" "$ac_includes_default"
+if test "x$ac_cv_header_sys_ioccom_h" = xyes
+then :
+  printf "%s\n" "#define HAVE_SYS_IOCCOM_H 1" >>confdefs.h
+
 fi
 ac_fn_c_check_header_compile "$LINENO" "sys/sysctl.h" "ac_cv_header_sys_sysctl_h" "$ac_includes_default"
 if test "x$ac_cv_header_sys_sysctl_h" = xyes
@@ -14560,6 +14566,12 @@ if test "x$ac_cv_header_netinet_in6_var_h" = xyes
 then :
   printf "%s\n" "#define HAVE_NETINET_IN6_VAR_H 1" >>confdefs.h
 
+fi
+ac_fn_c_check_header_compile "$LINENO" "linux/netlink.h" "ac_cv_header_linux_netlink_h" "$ac_includes_default"
+if test "x$ac_cv_header_linux_netlink_h" = xyes
+then :
+  printf "%s\n" "#define HAVE_LINUX_NETLINK_H 1" >>confdefs.h
+
 fi
 ac_fn_c_check_header_compile "$LINENO" "net/if_tun.h" "ac_cv_header_net_if_tun_h" "$ac_includes_default"
 if test "x$ac_cv_header_net_if_tun_h" = xyes
@@ -14662,6 +14674,7 @@ then :
 fi
 
 fi
+
 ac_fn_c_check_header_compile "$LINENO" "bsd/string.h" "ac_cv_header_bsd_string_h" "$ac_includes_default"
 if test "x$ac_cv_header_bsd_string_h" = xyes
 then :
@@ -15137,11 +15150,35 @@ printf %s "checking for Berkeley Packet Filter... " >&6; }
 then :
   printf %s "(cached) " >&6
 else case e in #(
-  e) if test -c /dev/bpf -o -c /dev/bpf0 ; then
-        ac_cv_dnet_bsd_bpf=yes
-    else
-        ac_cv_dnet_bsd_bpf=no
-    fi ;;
+  e) cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+
+#include <sys/types.h>
+#include <sys/time.h>
+#include <sys/ioctl.h>
+#include <sys/socket.h>
+#ifdef HAVE_SYS_IOCCOM_H
+#include <sys/ioccom.h>
+#endif
+#include <net/bpf.h>
+#include <net/if.h>
+
+int
+main (void)
+{
+u_int i = BIOCSETIF;
+  ;
+  return 0;
+}
+_ACEOF
+if ac_fn_c_try_compile "$LINENO"
+then :
+  ac_cv_dnet_bsd_bpf=yes
+else case e in #(
+  e) ac_cv_dnet_bsd_bpf=no ;;
+esac
+fi
+rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext ;;
 esac
 fi
 
@@ -15158,7 +15195,7 @@ printf %s "checking for Linux proc filesystem... " >&6; }
 then :
   printf %s "(cached) " >&6
 else case e in #(
-  e) if test "x`cat /proc/sys/kernel/ostype 2>&-`" = "xLinux" ; then
+  e) if test "$ac_cv_header_linux_netlink_h" = yes ; then
         ac_cv_dnet_linux_procfs=yes
     else
         ac_cv_dnet_linux_procfs=no
@@ -15182,7 +15219,7 @@ printf %s "checking for Linux PF_PACKET sockets... " >&6; }
 int
 main (void)
 {
-int foo() { return ETH_P_ALL; }
+int foo = ETH_P_ALL;
   ;
   return 0;
 }
@@ -15459,6 +15496,7 @@ else
  ;;
 esac
 
+	as_fn_error $? "\"Ethernet support not found for this system.\"" "$LINENO" 5
 fi
 
 case " $LIBOBJS " in
@@ -15542,6 +15580,7 @@ else
  ;;
 esac
 
+	as_fn_error $? "\"Routing interface not found for this system.\"" "$LINENO" 5
 fi
 
 if test "$ac_cv_dnet_linux_procfs" = yes ; then

libdnet-stripped/configure.ac

@@ -109,11 +109,11 @@ else
 	AC_CHECK_HEADERS(fcntl.h unistd.h)
 	AC_CHECK_HEADERS(sys/bufmod.h sys/dlpi.h sys/dlpihdr.h sys/dlpi_ext.h \
 	    sys/ioctl.h sys/mib.h sys/ndd_var.h sys/socket.h sys/sockio.h \
-	    sys/sysctl.h sys/time.h sys/types.h)
+	    sys/ioccom.h sys/sysctl.h sys/time.h sys/types.h)
 	AC_CHECK_HEADERS(net/bpf.h net/if.h net/if_var.h \
 	    net/if_arp.h net/if_dl.h net/pfilt.h \
 	    net/pfvar.h net/radix.h net/raw.h netinet/in_var.h \
-	    netinet/in6_var.h \
+	    netinet/in6_var.h linux/netlink.h \
 	    net/if_tun.h linux/if_tun.h netinet/ip_fw.h linux/ip_fw.h \
 	    linux/ip_fwchains.h linux/netfilter_ipv4/ipchains_core.h)
 	AC_CHECK_HEADERS(ip_fil_compat.h netinet/ip_fil_compat.h ip_compat.h \
@@ -127,6 +127,7 @@ AC_INCLUDES_DEFAULT
 #endif
     ])
 fi
+
 AC_CHECK_HEADERS(bsd/string.h)
 if test "$ac_cv_header_bsd_string_h" = yes; then
     STRLCPY_HEADER="bsd/string.h"
@@ -201,6 +202,7 @@ elif test "$ac_cv_header_sys_dlpi_h" = yes || \
 	AC_LIBOBJ([eth-dlpi])
 else
 	AC_LIBOBJ([eth-none])
+	AC_MSG_ERROR("Ethernet support not found for this system.")
 fi
 
 AC_LIBOBJ([fw-none])
@@ -232,6 +234,7 @@ elif test "$ac_cv_header_hpsecurity_h" = yes ; then
 	AC_LIBOBJ([route-hpux])
 else
 	AC_LIBOBJ([route-none])
+	AC_MSG_ERROR("Routing interface not found for this system.")
 fi
 
 dnl Check for ndisc interface.

libdnet-stripped/include/dnet/addr.h

@@ -28,6 +28,7 @@ struct addr {
 		uint16_t	__data16[8];
 		uint32_t	__data32[4];
 	} __addr_u;
+	uint32_t scope_id;
 };
 #define addr_eth	__addr_u.__eth
 #define addr_ip		__addr_u.__ip

libdnet-stripped/m4/acinclude.m4

@@ -91,14 +91,25 @@ dnl
 dnl usage:	AC_DNET_BSD_BPF
 dnl results:	HAVE_BSD_BPF
 dnl
+dnl Copied from libpcap's configure.ac
 AC_DEFUN([AC_DNET_BSD_BPF],
     [AC_MSG_CHECKING(for Berkeley Packet Filter)
     AC_CACHE_VAL(ac_cv_dnet_bsd_bpf,
-    if test -c /dev/bpf -o -c /dev/bpf0 ; then
-        ac_cv_dnet_bsd_bpf=yes
-    else
-        ac_cv_dnet_bsd_bpf=no
-    fi)
+			AC_TRY_COMPILE(
+[
+#include <sys/types.h>
+#include <sys/time.h>
+#include <sys/ioctl.h>
+#include <sys/socket.h>
+#ifdef HAVE_SYS_IOCCOM_H
+#include <sys/ioccom.h>
+#endif
+#include <net/bpf.h>
+#include <net/if.h>
+],
+			[u_int i = BIOCSETIF;],
+			ac_cv_dnet_bsd_bpf=yes,
+			ac_cv_dnet_bsd_bpf=no))
     AC_MSG_RESULT($ac_cv_dnet_bsd_bpf)
     if test $ac_cv_dnet_bsd_bpf = yes ; then
     AC_DEFINE(HAVE_BSD_BPF, 1,
@@ -114,7 +125,7 @@ dnl
 AC_DEFUN([AC_DNET_LINUX_PROCFS],
     [AC_MSG_CHECKING(for Linux proc filesystem)
     AC_CACHE_VAL(ac_cv_dnet_linux_procfs,
-    if test "x`cat /proc/sys/kernel/ostype 2>&-`" = "xLinux" ; then
+    if test "$ac_cv_header_linux_netlink_h" = yes ; then
         ac_cv_dnet_linux_procfs=yes
     else
         ac_cv_dnet_linux_procfs=no
@@ -138,7 +149,7 @@ AC_DEFUN([AC_DNET_LINUX_PF_PACKET],
     [AC_MSG_CHECKING(for Linux PF_PACKET sockets)
     AC_TRY_COMPILE([#include <netpacket/packet.h>
                     #include <linux/if_ether.h>],
-                   [int foo() { return ETH_P_ALL; }],
+                   [int foo = ETH_P_ALL;],
     ac_cv_dnet_linux_pf_packet=yes,
     ac_cv_dnet_linux_pf_packet=no)
     AC_MSG_RESULT($ac_cv_dnet_linux_pf_packet)

libdnet-stripped/src/addr.c

@@ -60,6 +60,8 @@ addr_cmp(const struct addr *a, const struct addr *b)
 	/* XXX */
 	if ((i = a->addr_type - b->addr_type) != 0)
 		return (i);
+	if ((i = a->scope_id - b->scope_id) != 0)
+		return (i);
 	
 	/* XXX - 10.0.0.1 is "smaller" than 10.0.0.0/8? */
 	if ((i = a->addr_bits - b->addr_bits) != 0)
@@ -274,6 +276,7 @@ addr_ntos(const struct addr *a, struct sockaddr *sa)
 		so->sin6.sin6_len = sizeof(so->sin6);
 #endif
 		so->sin6.sin6_family = AF_INET6;
+		so->sin6.sin6_scope_id = a->scope_id;
 		memcpy(&so->sin6.sin6_addr, &a->addr_ip6, IP6_ADDR_LEN);
 		break;
 #endif
@@ -336,6 +339,7 @@ addr_ston(const struct sockaddr *sa, struct addr *a)
 	case AF_INET6:
 		a->addr_type = ADDR_TYPE_IP6;
 		a->addr_bits = IP6_ADDR_BITS;
+		a->scope_id = so->sin6.sin6_scope_id;
 		memcpy(&a->addr_ip6, &so->sin6.sin6_addr, IP6_ADDR_LEN);
 		break;
 #endif

libdnet-stripped/src/arp-bsd.c

@@ -35,6 +35,39 @@
 
 #include "dnet.h"
 
+/* NetBSD 10+ removed RTF_LLINFO */
+#ifndef RTF_LLINFO
+#define RTF_LLINFO 0
+#endif
+
+#if defined(RT_ROUNDUP) && defined(__NetBSD__)
+/* NetBSD defines this macro rounding to 64-bit boundaries.
+   http://fxr.watson.org/fxr/ident?v=NETBSD;i=RT_ROUNDUP */
+#define ROUNDUP(a) RT_ROUNDUP(a)
+#else
+/* Unix Network Programming, 3rd edition says that sockaddr structures in
+   rt_msghdr should be padded so their addresses start on a multiple of
+   sizeof(u_long). But on 64-bit Mac OS X 10.6 at least, this is false. Apple's
+   netstat code uses 4-byte padding, not 8-byte. This is relevant for IPv6
+   addresses, for which sa_len == 28.
+   http://www.opensource.apple.com/source/network_cmds/network_cmds-329.2.2/netstat.tproj/route.c */
+#ifdef __APPLE__
+#define RT_MSGHDR_ALIGNMENT sizeof(uint32_t)
+#else
+#define RT_MSGHDR_ALIGNMENT sizeof(unsigned long)
+#endif
+#define ROUNDUP(a) \
+	((a) > 0 ? (1 + (((a) - 1) | (RT_MSGHDR_ALIGNMENT - 1))) : RT_MSGHDR_ALIGNMENT)
+#endif
+
+#ifdef HAVE_SOCKADDR_SA_LEN
+#define SA_LEN(s) ((s)->sa_len)
+#else
+#define SA_LEN(s) (sizeof(*(s)))
+#endif
+#define NEXTSA(s) \
+	((struct sockaddr *)((u_char *)(s) + ROUNDUP(SA_LEN(s))))
+
 struct arp_handle {
 	int	fd;
 	int	seq;
@@ -42,7 +75,7 @@ struct arp_handle {
 
 struct arpmsg {
 	struct rt_msghdr	rtm;
-	u_char			addrs[256];
+	u_char			addrs[512];
 };
 
 arp_t *
@@ -106,45 +139,63 @@ arp_msg(arp_t *arp, struct arpmsg *msg)
 #endif
 }
 
+static int sockaddr_equal_addr(const struct sockaddr *sa, const struct addr *b)
+{
+	if (sa->sa_family == AF_INET) {
+		return (b->addr_type == ADDR_TYPE_IP && 
+				((struct sockaddr_in *)sa)->sin_addr.s_addr == b->addr_ip);
+	}
+	else if (sa->sa_family == AF_INET6) {
+		return (b->addr_type == ADDR_TYPE_IP6 &&
+				0 == memcmp(
+					((struct sockaddr_in6 *)sa)->sin6_addr.s6_addr,
+					b->addr_ip6.data,
+					IP6_ADDR_LEN));
+	}
+	return 0;
+}
+
 int
 arp_add(arp_t *arp, const struct arp_entry *entry)
 {
 	struct arpmsg msg;
-	struct sockaddr_in *sin;
+	struct sockaddr *sin;
 	struct sockaddr *sa;
 	int index, type;
 	
-	if (entry->arp_pa.addr_type != ADDR_TYPE_IP ||
+	if ((entry->arp_pa.addr_type != ADDR_TYPE_IP && 
+	     entry->arp_pa.addr_type != ADDR_TYPE_IP6) ||
 	    entry->arp_ha.addr_type != ADDR_TYPE_ETH) {
 		errno = EAFNOSUPPORT;
 		return (-1);
 	}
-	sin = (struct sockaddr_in *)msg.addrs;
-	sa = (struct sockaddr *)(sin + 1);
+	sin = (struct sockaddr *)msg.addrs;
 	
 	if (addr_ntos(&entry->arp_pa, (struct sockaddr *)sin) < 0)
 		return (-1);
 	
+	sa = NEXTSA(sin);
 	memset(&msg.rtm, 0, sizeof(msg.rtm));
 	msg.rtm.rtm_type = RTM_GET;
 	msg.rtm.rtm_addrs = RTA_DST;
-	msg.rtm.rtm_msglen = sizeof(msg.rtm) + sizeof(*sin);
+	msg.rtm.rtm_msglen = sizeof(msg.rtm) + ROUNDUP(SA_LEN(sin));
+	msg.rtm.rtm_msglen = ((char *)sin - (char *)&msg) + ROUNDUP(SA_LEN(sin));
 	
 	if (arp_msg(arp, &msg) < 0)
 		return (-1);
 	
 	if (msg.rtm.rtm_msglen < (int)sizeof(msg.rtm) +
-	    sizeof(*sin) + sizeof(*sa)) {
+	    ROUNDUP(SA_LEN(sin)) + SA_LEN(sa)) {
 		errno = EADDRNOTAVAIL;
 		return (-1);
 	}
-	if (sin->sin_addr.s_addr == entry->arp_pa.addr_ip) {
-		if ((msg.rtm.rtm_flags & RTF_LLINFO) == 0 ||
-		    (msg.rtm.rtm_flags & RTF_GATEWAY) != 0) {
-			errno = EADDRINUSE;
-			return (-1);
-		}
-	}
+    if (sockaddr_equal_addr(sin, &entry->arp_pa)) {
+        if ((RTF_LLINFO && ((msg.rtm.rtm_flags & RTF_LLINFO) == 0)) ||
+            (msg.rtm.rtm_flags & RTF_GATEWAY) != 0) {
+            errno = EADDRINUSE;
+            return (-1);
+        }
+    }
 	if (sa->sa_family != AF_LINK) {
 		errno = EADDRNOTAVAIL;
 		return (-1);
@@ -164,11 +215,8 @@ arp_add(arp_t *arp, const struct arp_entry *entry)
 	msg.rtm.rtm_addrs = RTA_DST | RTA_GATEWAY;
 	msg.rtm.rtm_inits = RTV_EXPIRE;
 	msg.rtm.rtm_flags = RTF_HOST | RTF_STATIC;
-#ifdef HAVE_SOCKADDR_SA_LEN
-	msg.rtm.rtm_msglen = sizeof(msg.rtm) + sin->sin_len + sa->sa_len;
-#else
-	msg.rtm.rtm_msglen = sizeof(msg.rtm) + sizeof(*sin) + sizeof(*sa);
-#endif
+	msg.rtm.rtm_msglen = sizeof(msg.rtm) + ROUNDUP(SA_LEN(sin)) + ROUNDUP(SA_LEN(sa));
+
 	return (arp_msg(arp, &msg));
 }
 
@@ -176,33 +224,34 @@ int
 arp_delete(arp_t *arp, const struct arp_entry *entry)
 {
 	struct arpmsg msg;
-	struct sockaddr_in *sin;
+	struct sockaddr *sin;
 	struct sockaddr *sa;
 
-	if (entry->arp_pa.addr_type != ADDR_TYPE_IP) {
+	if (entry->arp_pa.addr_type != ADDR_TYPE_IP && 
+	    entry->arp_pa.addr_type != ADDR_TYPE_IP6) {
 		errno = EAFNOSUPPORT;
 		return (-1);
 	}
-	sin = (struct sockaddr_in *)msg.addrs;
-	sa = (struct sockaddr *)(sin + 1);
+	sin = (struct sockaddr *)msg.addrs;
 
 	if (addr_ntos(&entry->arp_pa, (struct sockaddr *)sin) < 0)
 		return (-1);
 
+	sa = NEXTSA(sin);
 	memset(&msg.rtm, 0, sizeof(msg.rtm));
 	msg.rtm.rtm_type = RTM_GET;
 	msg.rtm.rtm_addrs = RTA_DST;
-	msg.rtm.rtm_msglen = sizeof(msg.rtm) + sizeof(*sin);
+	msg.rtm.rtm_msglen = sizeof(msg.rtm) + ROUNDUP(SA_LEN(sin));
 	
 	if (arp_msg(arp, &msg) < 0)
 		return (-1);
 	
 	if (msg.rtm.rtm_msglen < (int)sizeof(msg.rtm) +
-	    sizeof(*sin) + sizeof(*sa)) {
+	    ROUNDUP(SA_LEN(sin)) + SA_LEN(sa)) {
 		errno = ESRCH;
 		return (-1);
 	}
-	if (sin->sin_addr.s_addr == entry->arp_pa.addr_ip) {
+	if (sockaddr_equal_addr(sin, &entry->arp_pa)) {
 		if ((msg.rtm.rtm_flags & RTF_LLINFO) == 0 ||
 		    (msg.rtm.rtm_flags & RTF_GATEWAY) != 0) {
 			errno = EADDRINUSE;
@@ -222,31 +271,31 @@ int
 arp_get(arp_t *arp, struct arp_entry *entry)
 {
 	struct arpmsg msg;
-	struct sockaddr_in *sin;
+	struct sockaddr *sin;
 	struct sockaddr *sa;
 	
-	if (entry->arp_pa.addr_type != ADDR_TYPE_IP) {
+	if (entry->arp_pa.addr_type != ADDR_TYPE_IP && 
+	    entry->arp_pa.addr_type != ADDR_TYPE_IP6) {
 		errno = EAFNOSUPPORT;
 		return (-1);
 	}
-	sin = (struct sockaddr_in *)msg.addrs;
-	sa = (struct sockaddr *)(sin + 1);
+	sin = (struct sockaddr *)msg.addrs;
 	
 	if (addr_ntos(&entry->arp_pa, (struct sockaddr *)sin) < 0)
 		return (-1);
-	
+
+	sa = NEXTSA(sin);
 	memset(&msg.rtm, 0, sizeof(msg.rtm));
 	msg.rtm.rtm_type = RTM_GET;
 	msg.rtm.rtm_addrs = RTA_DST;
 	msg.rtm.rtm_flags = RTF_LLINFO;
-	msg.rtm.rtm_msglen = sizeof(msg.rtm) + sizeof(*sin);
+	msg.rtm.rtm_msglen = sizeof(msg.rtm) + ROUNDUP(SA_LEN(sin));
 	
 	if (arp_msg(arp, &msg) < 0)
 		return (-1);
 	
 	if (msg.rtm.rtm_msglen < (int)sizeof(msg.rtm) +
-	    sizeof(*sin) + sizeof(*sa) ||
-	    sin->sin_addr.s_addr != entry->arp_pa.addr_ip ||
+	    ROUNDUP(SA_LEN(sin)) + SA_LEN(sa) ||
 	    sa->sa_family != AF_LINK) {
 		errno = ESRCH;
 		return (-1);
@@ -263,7 +312,7 @@ arp_loop(arp_t *arp, arp_handler callback, void *arg)
 {
 	struct arp_entry entry;
 	struct rt_msghdr *rtm;
-	struct sockaddr_in *sin;
+	struct sockaddr *sin;
 	struct sockaddr *sa;
 	char *buf, *lim, *next;
 	size_t len;
@@ -288,8 +337,8 @@ arp_loop(arp_t *arp, arp_handler callback, void *arg)
 	
 	for (next = buf; next < lim; next += rtm->rtm_msglen) {
 		rtm = (struct rt_msghdr *)next;
-		sin = (struct sockaddr_in *)(rtm + 1);
-		sa = (struct sockaddr *)(sin + 1);
+		sin = (struct sockaddr *)(rtm + 1);
+		sa = NEXTSA(sin);
 		
 		if (addr_ston((struct sockaddr *)sin, &entry.arp_pa) < 0 ||
 		    addr_ston(sa, &entry.arp_ha) < 0)

libdnet-stripped/src/intf.c

@@ -177,9 +177,14 @@ intf_open(void)
 
 #if defined(SIOCGLIFCONF) || defined(SIOCGIFNETMASK_IN6) || defined(SIOCGIFNETMASK6)
 		if ((intf->fd6 = socket(AF_INET6, SOCK_DGRAM, 0)) < 0) {
+			if (1
 #  ifdef EPROTONOSUPPORT
-			if (errno != EPROTONOSUPPORT)
+					&& errno != EPROTONOSUPPORT
 #endif
+#  ifdef EAFNOSUPPORT
+					&& errno != EAFNOSUPPORT
+#endif
+					)
 				return (intf_close(intf));
 		}
 #endif
@@ -904,7 +909,7 @@ intf_get_src(intf_t *intf, struct intf_entry *entry, struct addr *src)
 int
 intf_get_dst(intf_t *intf, struct intf_entry *entry, struct addr *dst)
 {
-	union sockunion sun;
+	union sockunion su;
 	socklen_t n;
 
 	int fd;
@@ -913,19 +918,19 @@ intf_get_dst(intf_t *intf, struct intf_entry *entry, struct addr *dst)
 		errno = EINVAL;
 		return (-1);
 	}
-	addr_ntos(dst, (struct sockaddr *)&sun);
-	sun.sin.sin_port = htons(666);
+	addr_ntos(dst, (struct sockaddr *)&su);
+	su.sin.sin_port = htons(666);
 
 	fd = dst->addr_type == ADDR_TYPE_IP6 ? intf->fd6 : intf->fd;
-	if (connect(fd, (struct sockaddr *)&sun, sizeof(sun)) < 0)
+	if (connect(fd, (struct sockaddr *)&su, sizeof(su)) < 0)
 		return (-1);
-	
-	n = sizeof(sun);
-	if (getsockname(fd, (struct sockaddr *)&sun, &n) < 0)
+
+	n = sizeof(su);
+	if (getsockname(fd, (struct sockaddr *)&su, &n) < 0)
 		return (-1);
-	
-	addr_ston((struct sockaddr *)&sun, &entry->intf_addr);
-	
+
+	addr_ston((struct sockaddr *)&su, &entry->intf_addr);
+
 	if (intf_loop(intf, _match_intf_src, entry) != 1)
 		return (-1);
 	

liblinear/Makefile

@@ -3,7 +3,7 @@ CC ?= gcc
 CFLAGS = -Wall -Wconversion -O3 -fPIC
 LIBS = blas/blas.a
 #LIBS = -lblas
-SHVER = 5
+SHVER = 6
 AR = ar
 RANLIB = ranlib
 OS = $(shell uname)
@@ -35,9 +35,8 @@ linear.o: linear.cpp linear.h
 	$(CXX) $(CFLAGS) -c -o linear.o linear.cpp
 
 blas/blas.a: blas/*.c blas/*.h
-	make -C blas OPTFLAGS='$(CFLAGS)' CC='$(CC)';
+	$(MAKE) -C blas OPTFLAGS='$(CFLAGS)' CC='$(CC)';
 
 clean:
-	make -C blas clean
-	make -C matlab clean
+	$(MAKE) -C blas clean
 	rm -f *~ newton.o linear.o train predict liblinear.so.$(SHVER)

liblinear/README

@@ -81,8 +81,7 @@ On Unix systems, type `make' to build the `train', `predict',
 and `svm-scale' programs. Run them without arguments to show the usages.
 
 On other systems, consult `Makefile' to build them (e.g., see
-'Building Windows binaries' in this file) or use the pre-built
-binaries (Windows binaries are in the directory `windows').
+'Building Windows binaries' in this file).
 
 This software uses some level-1 BLAS subroutines. The needed functions are
 included in this package.  If a BLAS library is available on your
@@ -398,6 +397,8 @@ in linear.h, so you can check the version number.
                 double* weight;
                 double p;
                 double *init_sol;
+                int regularize_bias;
+                bool w_recalc;  /* for -s 1, 3; may be extended to -s 12, 13, 21 */
         };
 
     solver_type can be one of L2R_LR, L2R_L2LOSS_SVC_DUAL, L2R_L2LOSS_SVC, L2R_L1LOSS_SVC_DUAL, MCSVM_CS, L1R_L2LOSS_SVC, L1R_LR, L2R_LR_DUAL, L2R_L2LOSS_SVR, L2R_L2LOSS_SVR_DUAL, L2R_L1LOSS_SVR_DUAL, ONECLASS_SVM.
@@ -438,6 +439,16 @@ in linear.h, so you can check the version number.
     solvers). See the explanation of the vector w in the model
     structure.
 
+    regularize_bias is the flag for bias regularization. By default it is set
+    to be 1. If you don't want to regularize the bias, set it to 0 with
+    specifying the bias in the problem structure to be 1. (DON'T use it unless
+    you know what it is.)
+
+    w_recalc is the flag for recalculating w after optimization
+    with a dual-based solver. This may further reduces the weight density
+    when the data is sparse. The default value is set as false for time
+    efficiency. Currently it only takes effect in -s 1 and 3.
+
     *NOTE* To avoid wrong parameters, check_parameter() should be
     called before train().
 
@@ -643,11 +654,32 @@ in linear.h, so you can check the version number.
         set_print_string_function(NULL);
     for default printing to stdout.
 
+    Please note that this function is not thread-safe. When multiple threads load or
+    use the same dynamic library (for example, liblinear.so.6), they actually share the
+    same memory space of the dynamic library, which results in all threads modifying
+    the same static function pointer, liblinear_print_string, in linear.cpp when they
+    call this function.
+
+    For example, suppose we have threads A and B. They call this function sequentially
+    and pass their own thread-local print_func into it. After that, they both call (*liblinear_print_string)(str)
+    once. When the last thread finishes setting it (say B), liblinear_print_string
+    is set to B.print_func. Now, if thread A wants to access liblinear_print_string,
+    it is actually accessing B.print_func rather than A.print_func, which is incorrect
+    since we expect to use the functionality of A.print_func.
+
+    Even if A.print_func and B.print_func have identical functionality, it is still risky.
+    Suppose liblinear_print_string is now set to B.print_func, and B deletes B.print_func
+    after finishing its work. Later, thread A calls liblinear_print_string, but the address
+    points to, which is B.print_func, has already been deleted. This invalid memory access
+    will crash the program. To mitigate this issue, in this example, you should ensure that
+    A.print_func and B.print_func remain valid after threads finish their work. For example,
+    in Python, you can assign them as global variables.
+
 Building Windows Binaries
 =========================
 
-Windows binaries are available in the directory `windows'. To re-build
-them via Visual C++, use the following steps:
+Starting from version 2.48, we no longer provide pre-built Windows binaries, 
+to build them via Visual C++, use the following steps:
 
 1. Open a dos command box and change to liblinear directory. If
 environment variables of VC++ have not been set, type

liblinear/linear.cpp

@@ -1064,6 +1064,21 @@ static int solve_l2r_l1l2_svc(const problem *prob, const parameter *param, doubl
 	info("Objective value = %lf\n",v/2);
 	info("nSV = %d\n",nSV);
 
+	// Reconstruct w from the primal-dual relationship w=sum(\alpha_i y_i x_i)
+	// This may reduce the weight density. Some zero weights become non-zeros
+	// due to the numerical update w <- w + (alpha[i] - alpha_old) y_i x_i.
+	if (param->w_recalc)
+	{
+		for(i=0; i<w_size; i++)
+			w[i] = 0;
+		for(i=0; i<l; i++)
+		{
+			feature_node * const xi = prob->x[i];
+			if(alpha[i] > 0)
+				sparse_operator::axpy(y[i]*alpha[i], xi, w);
+		}
+	}
+
 	delete [] QD;
 	delete [] alpha;
 	delete [] y;
@@ -2194,11 +2209,14 @@ static int partition(feature_node *nodes, int low, int high)
 	return index;
 }
 
-// rearrange nodes so that nodes[:k] contains nodes with the k smallest values.
+// rearrange nodes so that
+// nodes[i] <= nodes[k] for all i < k
+// nodes[k] <= nodes[j] for all j > k
+// low and high are the bounds of the index range during the rearranging process
 static void quick_select_min_k(feature_node *nodes, int low, int high, int k)
 {
 	int pivot;
-	if(low == high)
+	if(low == high || high < k)
 		return;
 	pivot = partition(nodes, low, high);
 	if(pivot == k)
@@ -3718,6 +3736,11 @@ const char *check_parameter(const problem *prob, const parameter *param)
 		&& param->solver_type != L2R_L2LOSS_SVR)
 		return "Initial-solution specification supported only for solvers L2R_LR, L2R_L2LOSS_SVC, and L2R_L2LOSS_SVR";
 
+	if(param->w_recalc == true
+		&& param->solver_type != L2R_L2LOSS_SVC_DUAL
+		&& param->solver_type != L2R_L1LOSS_SVC_DUAL)
+		return "Recalculating w in the end is only for dual solvers for L2-regularized L1/L2-loss SVM";
+
 	return NULL;
 }
 

liblinear/linear.h

@@ -1,7 +1,8 @@
+#include <stdbool.h>
 #ifndef _LIBLINEAR_H
 #define _LIBLINEAR_H
 
-#define LIBLINEAR_VERSION 247
+#define LIBLINEAR_VERSION 250
 
 #ifdef __cplusplus
 extern "C" {
@@ -39,6 +40,7 @@ struct parameter
 	double nu;
 	double *init_sol;
 	int regularize_bias;
+	bool w_recalc;		/* for -s 1, 3; may be extended to -s 12, 13, 21 */
 };
 
 struct model

liblinear/train.c

@@ -224,6 +224,7 @@ void parse_command_line(int argc, char **argv, char *input_file_name, char *mode
 	param.weight_label = NULL;
 	param.weight = NULL;
 	param.init_sol = NULL;
+	param.w_recalc = false;
 	flag_cross_validation = 0;
 	flag_C_specified = 0;
 	flag_p_specified = 0;

libnetutil/ARPHeader.cc

@@ -5,7 +5,7 @@
  *                                                                         *
  ***********************IMPORTANT NMAP LICENSE TERMS************************
  *
- * The Nmap Security Scanner is (C) 1996-2025 Nmap Software LLC ("The Nmap
+ * The Nmap Security Scanner is (C) 1996-2026 Nmap Software LLC ("The Nmap
  * Project"). Nmap is also a registered trademark of the Nmap Project.
  *
  * This program is distributed under the terms of the Nmap Public Source

libnetutil/ARPHeader.h

@@ -5,7 +5,7 @@
  *                                                                         *
  ***********************IMPORTANT NMAP LICENSE TERMS************************
  *
- * The Nmap Security Scanner is (C) 1996-2025 Nmap Software LLC ("The Nmap
+ * The Nmap Security Scanner is (C) 1996-2026 Nmap Software LLC ("The Nmap
  * Project"). Nmap is also a registered trademark of the Nmap Project.
  *
  * This program is distributed under the terms of the Nmap Public Source

libnetutil/ApplicationLayerElement.h

@@ -5,7 +5,7 @@
  *                                                                         *
  ***********************IMPORTANT NMAP LICENSE TERMS************************
  *
- * The Nmap Security Scanner is (C) 1996-2025 Nmap Software LLC ("The Nmap
+ * The Nmap Security Scanner is (C) 1996-2026 Nmap Software LLC ("The Nmap
  * Project"). Nmap is also a registered trademark of the Nmap Project.
  *
  * This program is distributed under the terms of the Nmap Public Source

libnetutil/DataLinkLayerElement.h

@@ -5,7 +5,7 @@
  *                                                                         *
  ***********************IMPORTANT NMAP LICENSE TERMS************************
  *
- * The Nmap Security Scanner is (C) 1996-2025 Nmap Software LLC ("The Nmap
+ * The Nmap Security Scanner is (C) 1996-2026 Nmap Software LLC ("The Nmap
  * Project"). Nmap is also a registered trademark of the Nmap Project.
  *
  * This program is distributed under the terms of the Nmap Public Source

libnetutil/DestOptsHeader.cc

@@ -3,7 +3,7 @@
  * Destination Options extension header.                                   *
  ***********************IMPORTANT NMAP LICENSE TERMS************************
  *
- * The Nmap Security Scanner is (C) 1996-2025 Nmap Software LLC ("The Nmap
+ * The Nmap Security Scanner is (C) 1996-2026 Nmap Software LLC ("The Nmap
  * Project"). Nmap is also a registered trademark of the Nmap Project.
  *
  * This program is distributed under the terms of the Nmap Public Source

libnetutil/DestOptsHeader.h

@@ -3,7 +3,7 @@
  * Destination Options extension header.                                   *
  ***********************IMPORTANT NMAP LICENSE TERMS************************
  *
- * The Nmap Security Scanner is (C) 1996-2025 Nmap Software LLC ("The Nmap
+ * The Nmap Security Scanner is (C) 1996-2026 Nmap Software LLC ("The Nmap
  * Project"). Nmap is also a registered trademark of the Nmap Project.
  *
  * This program is distributed under the terms of the Nmap Public Source

libnetutil/EthernetHeader.cc

@@ -6,7 +6,7 @@
  *                                                                         *
  ***********************IMPORTANT NMAP LICENSE TERMS************************
  *
- * The Nmap Security Scanner is (C) 1996-2025 Nmap Software LLC ("The Nmap
+ * The Nmap Security Scanner is (C) 1996-2026 Nmap Software LLC ("The Nmap
  * Project"). Nmap is also a registered trademark of the Nmap Project.
  *
  * This program is distributed under the terms of the Nmap Public Source

libnetutil/EthernetHeader.h

@@ -6,7 +6,7 @@
  *                                                                         *
  ***********************IMPORTANT NMAP LICENSE TERMS************************
  *
- * The Nmap Security Scanner is (C) 1996-2025 Nmap Software LLC ("The Nmap
+ * The Nmap Security Scanner is (C) 1996-2026 Nmap Software LLC ("The Nmap
  * Project"). Nmap is also a registered trademark of the Nmap Project.
  *
  * This program is distributed under the terms of the Nmap Public Source

libnetutil/FragmentHeader.cc

@@ -3,7 +3,7 @@
  * Hop-by-Hop extension header.                                            *
  ***********************IMPORTANT NMAP LICENSE TERMS************************
  *
- * The Nmap Security Scanner is (C) 1996-2025 Nmap Software LLC ("The Nmap
+ * The Nmap Security Scanner is (C) 1996-2026 Nmap Software LLC ("The Nmap
  * Project"). Nmap is also a registered trademark of the Nmap Project.
  *
  * This program is distributed under the terms of the Nmap Public Source

libnetutil/FragmentHeader.h

@@ -3,7 +3,7 @@
  * Hop-by-Hop extension header.                                            *
  ***********************IMPORTANT NMAP LICENSE TERMS************************
  *
- * The Nmap Security Scanner is (C) 1996-2025 Nmap Software LLC ("The Nmap
+ * The Nmap Security Scanner is (C) 1996-2026 Nmap Software LLC ("The Nmap
  * Project"). Nmap is also a registered trademark of the Nmap Project.
  *
  * This program is distributed under the terms of the Nmap Public Source

libnetutil/HopByHopHeader.cc

@@ -3,7 +3,7 @@
  * Hop-by-Hop extension header.                                            *
  ***********************IMPORTANT NMAP LICENSE TERMS************************
  *
- * The Nmap Security Scanner is (C) 1996-2025 Nmap Software LLC ("The Nmap
+ * The Nmap Security Scanner is (C) 1996-2026 Nmap Software LLC ("The Nmap
  * Project"). Nmap is also a registered trademark of the Nmap Project.
  *
  * This program is distributed under the terms of the Nmap Public Source

libnetutil/HopByHopHeader.h

@@ -3,7 +3,7 @@
  * Hop-by-Hop extension header.                                            *
  ***********************IMPORTANT NMAP LICENSE TERMS************************
  *
- * The Nmap Security Scanner is (C) 1996-2025 Nmap Software LLC ("The Nmap
+ * The Nmap Security Scanner is (C) 1996-2026 Nmap Software LLC ("The Nmap
  * Project"). Nmap is also a registered trademark of the Nmap Project.
  *
  * This program is distributed under the terms of the Nmap Public Source

libnetutil/ICMPHeader.h

@@ -6,7 +6,7 @@
  *                                                                         *
  ***********************IMPORTANT NMAP LICENSE TERMS************************
  *
- * The Nmap Security Scanner is (C) 1996-2025 Nmap Software LLC ("The Nmap
+ * The Nmap Security Scanner is (C) 1996-2026 Nmap Software LLC ("The Nmap
  * Project"). Nmap is also a registered trademark of the Nmap Project.
  *
  * This program is distributed under the terms of the Nmap Public Source

libnetutil/ICMPv4Header.cc

@@ -5,7 +5,7 @@
  *                                                                         *
  ***********************IMPORTANT NMAP LICENSE TERMS************************
  *
- * The Nmap Security Scanner is (C) 1996-2025 Nmap Software LLC ("The Nmap
+ * The Nmap Security Scanner is (C) 1996-2026 Nmap Software LLC ("The Nmap
  * Project"). Nmap is also a registered trademark of the Nmap Project.
  *
  * This program is distributed under the terms of the Nmap Public Source

libnetutil/ICMPv4Header.h

@@ -5,7 +5,7 @@
  *                                                                         *
  ***********************IMPORTANT NMAP LICENSE TERMS************************
  *
- * The Nmap Security Scanner is (C) 1996-2025 Nmap Software LLC ("The Nmap
+ * The Nmap Security Scanner is (C) 1996-2026 Nmap Software LLC ("The Nmap
  * Project"). Nmap is also a registered trademark of the Nmap Project.
  *
  * This program is distributed under the terms of the Nmap Public Source

libnetutil/ICMPv6Header.cc

@@ -5,7 +5,7 @@
  *                                                                         *
  ***********************IMPORTANT NMAP LICENSE TERMS************************
  *
- * The Nmap Security Scanner is (C) 1996-2025 Nmap Software LLC ("The Nmap
+ * The Nmap Security Scanner is (C) 1996-2026 Nmap Software LLC ("The Nmap
  * Project"). Nmap is also a registered trademark of the Nmap Project.
  *
  * This program is distributed under the terms of the Nmap Public Source

libnetutil/ICMPv6Header.h

@@ -5,7 +5,7 @@
  *                                                                         *
  ***********************IMPORTANT NMAP LICENSE TERMS************************
  *
- * The Nmap Security Scanner is (C) 1996-2025 Nmap Software LLC ("The Nmap
+ * The Nmap Security Scanner is (C) 1996-2026 Nmap Software LLC ("The Nmap
  * Project"). Nmap is also a registered trademark of the Nmap Project.
  *
  * This program is distributed under the terms of the Nmap Public Source

libnetutil/ICMPv6Option.cc

@@ -5,7 +5,7 @@
  *                                                                         *
  ***********************IMPORTANT NMAP LICENSE TERMS************************
  *
- * The Nmap Security Scanner is (C) 1996-2025 Nmap Software LLC ("The Nmap
+ * The Nmap Security Scanner is (C) 1996-2026 Nmap Software LLC ("The Nmap
  * Project"). Nmap is also a registered trademark of the Nmap Project.
  *
  * This program is distributed under the terms of the Nmap Public Source

libnetutil/ICMPv6Option.h

@@ -5,7 +5,7 @@
  *                                                                         *
  ***********************IMPORTANT NMAP LICENSE TERMS************************
  *
- * The Nmap Security Scanner is (C) 1996-2025 Nmap Software LLC ("The Nmap
+ * The Nmap Security Scanner is (C) 1996-2026 Nmap Software LLC ("The Nmap
  * Project"). Nmap is also a registered trademark of the Nmap Project.
  *
  * This program is distributed under the terms of the Nmap Public Source

libnetutil/ICMPv6RRBody.cc

@@ -6,7 +6,7 @@
  *                                                                         *
  ***********************IMPORTANT NMAP LICENSE TERMS************************
  *
- * The Nmap Security Scanner is (C) 1996-2025 Nmap Software LLC ("The Nmap
+ * The Nmap Security Scanner is (C) 1996-2026 Nmap Software LLC ("The Nmap
  * Project"). Nmap is also a registered trademark of the Nmap Project.
  *
  * This program is distributed under the terms of the Nmap Public Source

libnetutil/ICMPv6RRBody.h

@@ -6,7 +6,7 @@
  *                                                                         *
  ***********************IMPORTANT NMAP LICENSE TERMS************************
  *
- * The Nmap Security Scanner is (C) 1996-2025 Nmap Software LLC ("The Nmap
+ * The Nmap Security Scanner is (C) 1996-2026 Nmap Software LLC ("The Nmap
  * Project"). Nmap is also a registered trademark of the Nmap Project.
  *
  * This program is distributed under the terms of the Nmap Public Source

libnetutil/IPv4Header.cc

@@ -5,7 +5,7 @@
  *                                                                         *
  ***********************IMPORTANT NMAP LICENSE TERMS************************
  *
- * The Nmap Security Scanner is (C) 1996-2025 Nmap Software LLC ("The Nmap
+ * The Nmap Security Scanner is (C) 1996-2026 Nmap Software LLC ("The Nmap
  * Project"). Nmap is also a registered trademark of the Nmap Project.
  *
  * This program is distributed under the terms of the Nmap Public Source

libnetutil/IPv4Header.h

@@ -5,7 +5,7 @@
  *                                                                         *
  ***********************IMPORTANT NMAP LICENSE TERMS************************
  *
- * The Nmap Security Scanner is (C) 1996-2025 Nmap Software LLC ("The Nmap
+ * The Nmap Security Scanner is (C) 1996-2026 Nmap Software LLC ("The Nmap
  * Project"). Nmap is also a registered trademark of the Nmap Project.
  *
  * This program is distributed under the terms of the Nmap Public Source

libnetutil/IPv6ExtensionHeader.h

@@ -4,7 +4,7 @@
  * Hop-by-Hop or Routing) inherit from this class.                         *
  ***********************IMPORTANT NMAP LICENSE TERMS************************
  *
- * The Nmap Security Scanner is (C) 1996-2025 Nmap Software LLC ("The Nmap
+ * The Nmap Security Scanner is (C) 1996-2026 Nmap Software LLC ("The Nmap
  * Project"). Nmap is also a registered trademark of the Nmap Project.
  *
  * This program is distributed under the terms of the Nmap Public Source

libnetutil/IPv6Header.cc

@@ -5,7 +5,7 @@
  *                                                                         *
  ***********************IMPORTANT NMAP LICENSE TERMS************************
  *
- * The Nmap Security Scanner is (C) 1996-2025 Nmap Software LLC ("The Nmap
+ * The Nmap Security Scanner is (C) 1996-2026 Nmap Software LLC ("The Nmap
  * Project"). Nmap is also a registered trademark of the Nmap Project.
  *
  * This program is distributed under the terms of the Nmap Public Source

libnetutil/IPv6Header.h

@@ -5,7 +5,7 @@
  *                                                                         *
  ***********************IMPORTANT NMAP LICENSE TERMS************************
  *
- * The Nmap Security Scanner is (C) 1996-2025 Nmap Software LLC ("The Nmap
+ * The Nmap Security Scanner is (C) 1996-2026 Nmap Software LLC ("The Nmap
  * Project"). Nmap is also a registered trademark of the Nmap Project.
  *
  * This program is distributed under the terms of the Nmap Public Source

libnetutil/NetworkLayerElement.cc

@@ -5,7 +5,7 @@
  *                                                                         *
  ***********************IMPORTANT NMAP LICENSE TERMS************************
  *
- * The Nmap Security Scanner is (C) 1996-2025 Nmap Software LLC ("The Nmap
+ * The Nmap Security Scanner is (C) 1996-2026 Nmap Software LLC ("The Nmap
  * Project"). Nmap is also a registered trademark of the Nmap Project.
  *
  * This program is distributed under the terms of the Nmap Public Source

libnetutil/NetworkLayerElement.h

@@ -5,7 +5,7 @@
  *                                                                         *
  ***********************IMPORTANT NMAP LICENSE TERMS************************
  *
- * The Nmap Security Scanner is (C) 1996-2025 Nmap Software LLC ("The Nmap
+ * The Nmap Security Scanner is (C) 1996-2026 Nmap Software LLC ("The Nmap
  * Project"). Nmap is also a registered trademark of the Nmap Project.
  *
  * This program is distributed under the terms of the Nmap Public Source

libnetutil/PacketElement.cc

@@ -6,7 +6,7 @@
  *                                                                         *
  ***********************IMPORTANT NMAP LICENSE TERMS************************
  *
- * The Nmap Security Scanner is (C) 1996-2025 Nmap Software LLC ("The Nmap
+ * The Nmap Security Scanner is (C) 1996-2026 Nmap Software LLC ("The Nmap
  * Project"). Nmap is also a registered trademark of the Nmap Project.
  *
  * This program is distributed under the terms of the Nmap Public Source

libnetutil/PacketElement.h

@@ -6,7 +6,7 @@
  *                                                                         *
  ***********************IMPORTANT NMAP LICENSE TERMS************************
  *
- * The Nmap Security Scanner is (C) 1996-2025 Nmap Software LLC ("The Nmap
+ * The Nmap Security Scanner is (C) 1996-2026 Nmap Software LLC ("The Nmap
  * Project"). Nmap is also a registered trademark of the Nmap Project.
  *
  * This program is distributed under the terms of the Nmap Public Source

libnetutil/PacketParser.cc

@@ -6,7 +6,7 @@
  *                                                                         *
  ***********************IMPORTANT NMAP LICENSE TERMS************************
  *
- * The Nmap Security Scanner is (C) 1996-2025 Nmap Software LLC ("The Nmap
+ * The Nmap Security Scanner is (C) 1996-2026 Nmap Software LLC ("The Nmap
  * Project"). Nmap is also a registered trademark of the Nmap Project.
  *
  * This program is distributed under the terms of the Nmap Public Source
@@ -1126,24 +1126,28 @@ bool PacketParser::is_response(PacketElement *sent, PacketElement *rcvd){
       /* So far we've verified that the ICMP error contains an IP datagram that matches
        * what we sent. Now, let's find the upper layer ICMP header (skip extension
        * headers until we find ICMP) */
-      ICMPHeader *inner_icmp=(ICMPHeader *)iperror->getNextElement();
-      while(inner_icmp!=NULL){
-        if(inner_icmp->protocol_id()==HEADER_TYPE_ICMPv4 || inner_icmp->protocol_id()==HEADER_TYPE_ICMPv6 ){
+
+      iperror = dynamic_cast<NetworkLayerElement *>(iperror->getNextElement());
+      while(iperror!=NULL){
+        if(iperror->protocol_id()==HEADER_TYPE_ICMPv4 || iperror->protocol_id()==HEADER_TYPE_ICMPv6 ){
             break;
         }else{
-            inner_icmp=(ICMPHeader *)inner_icmp->getNextElement();
+          iperror = dynamic_cast<NetworkLayerElement *>(iperror->getNextElement());
         }
       }
-      if(inner_icmp==NULL)
+      if(iperror==NULL)
         return false;
 
       /* If we get here it means that we've found an ICMP header inside the
        * ICMP error message that we received. First of all, check that the
        * ICMP version matches what we sent. */
-      if(sent_layer4->protocol_id() != inner_icmp->protocol_id())
+      if(sent_layer4->protocol_id() != iperror->protocol_id())
         return false;
 
       /* Make sure ICMP type and code match  */
+      ICMPHeader *inner_icmp = dynamic_cast<ICMPHeader *>(iperror);
+      if (inner_icmp == NULL)
+        return false;
       if( ((ICMPHeader*)sent_layer4)->getType() != inner_icmp->getType() )
         return false;
       if( ((ICMPHeader*)sent_layer4)->getCode() != inner_icmp->getCode() )
@@ -1706,18 +1710,21 @@ bool PacketParser::is_response(PacketElement *sent, PacketElement *rcvd){
         /* So far we've verified that the ICMP error contains an IP datagram that matches
          * what we sent. Now, let's find the upper layer protocol (skip extension
          * headers and the like until we find some transport protocol). */
-        TransportLayerElement *layer4error=(TransportLayerElement *)iperror->getNextElement();
-        while(layer4error!=NULL){
-          if(layer4error->protocol_id()==HEADER_TYPE_UDP || layer4error->protocol_id()==HEADER_TYPE_TCP ){
+        iperror = dynamic_cast<NetworkLayerElement *>(iperror->getNextElement());
+        while(iperror!=NULL){
+          if(iperror->protocol_id()==HEADER_TYPE_UDP || iperror->protocol_id()==HEADER_TYPE_TCP ){
               break;
           }else{
-              layer4error=(TransportLayerElement *)layer4error->getNextElement();
+            iperror = dynamic_cast<NetworkLayerElement *>(iperror->getNextElement());
           }
         }
-        if(layer4error==NULL)
+        if(iperror==NULL)
           return false;
 
         /* Now make sure we see the same port numbers */
+        TransportLayerElement *layer4error = dynamic_cast<TransportLayerElement *>(iperror);
+        if (layer4error == NULL)
+          return false;
         if( layer4error->getSourcePort() != ((TransportLayerElement *)sent_layer4)->getSourcePort() )
           return false;
         if( layer4error->getDestinationPort() != ((TransportLayerElement *)sent_layer4)->getDestinationPort() )

libnetutil/PacketParser.h

@@ -6,7 +6,7 @@
  *                                                                         *
  ***********************IMPORTANT NMAP LICENSE TERMS************************
  *
- * The Nmap Security Scanner is (C) 1996-2025 Nmap Software LLC ("The Nmap
+ * The Nmap Security Scanner is (C) 1996-2026 Nmap Software LLC ("The Nmap
  * Project"). Nmap is also a registered trademark of the Nmap Project.
  *
  * This program is distributed under the terms of the Nmap Public Source

libnetutil/RawData.cc

@@ -6,7 +6,7 @@
  *                                                                         *
  ***********************IMPORTANT NMAP LICENSE TERMS************************
  *
- * The Nmap Security Scanner is (C) 1996-2025 Nmap Software LLC ("The Nmap
+ * The Nmap Security Scanner is (C) 1996-2026 Nmap Software LLC ("The Nmap
  * Project"). Nmap is also a registered trademark of the Nmap Project.
  *
  * This program is distributed under the terms of the Nmap Public Source

libnetutil/RawData.h

@@ -6,7 +6,7 @@
  *                                                                         *
  ***********************IMPORTANT NMAP LICENSE TERMS************************
  *
- * The Nmap Security Scanner is (C) 1996-2025 Nmap Software LLC ("The Nmap
+ * The Nmap Security Scanner is (C) 1996-2026 Nmap Software LLC ("The Nmap
  * Project"). Nmap is also a registered trademark of the Nmap Project.
  *
  * This program is distributed under the terms of the Nmap Public Source

libnetutil/RoutingHeader.cc

@@ -3,7 +3,7 @@
  * extension header.                                                       *
  ***********************IMPORTANT NMAP LICENSE TERMS************************
  *
- * The Nmap Security Scanner is (C) 1996-2025 Nmap Software LLC ("The Nmap
+ * The Nmap Security Scanner is (C) 1996-2026 Nmap Software LLC ("The Nmap
  * Project"). Nmap is also a registered trademark of the Nmap Project.
  *
  * This program is distributed under the terms of the Nmap Public Source

libnetutil/RoutingHeader.h

@@ -3,7 +3,7 @@
  * extension header.                                                       *
  ***********************IMPORTANT NMAP LICENSE TERMS************************
  *
- * The Nmap Security Scanner is (C) 1996-2025 Nmap Software LLC ("The Nmap
+ * The Nmap Security Scanner is (C) 1996-2026 Nmap Software LLC ("The Nmap
  * Project"). Nmap is also a registered trademark of the Nmap Project.
  *
  * This program is distributed under the terms of the Nmap Public Source

libnetutil/TCPHeader.cc

@@ -6,7 +6,7 @@
  *                                                                         *
  ***********************IMPORTANT NMAP LICENSE TERMS************************
  *
- * The Nmap Security Scanner is (C) 1996-2025 Nmap Software LLC ("The Nmap
+ * The Nmap Security Scanner is (C) 1996-2026 Nmap Software LLC ("The Nmap
  * Project"). Nmap is also a registered trademark of the Nmap Project.
  *
  * This program is distributed under the terms of the Nmap Public Source

libnetutil/TCPHeader.h

@@ -5,7 +5,7 @@
  *                                                                         *
  ***********************IMPORTANT NMAP LICENSE TERMS************************
  *
- * The Nmap Security Scanner is (C) 1996-2025 Nmap Software LLC ("The Nmap
+ * The Nmap Security Scanner is (C) 1996-2026 Nmap Software LLC ("The Nmap
  * Project"). Nmap is also a registered trademark of the Nmap Project.
  *
  * This program is distributed under the terms of the Nmap Public Source

libnetutil/TransportLayerElement.cc

@@ -5,7 +5,7 @@
  *                                                                         *
  ***********************IMPORTANT NMAP LICENSE TERMS************************
  *
- * The Nmap Security Scanner is (C) 1996-2025 Nmap Software LLC ("The Nmap
+ * The Nmap Security Scanner is (C) 1996-2026 Nmap Software LLC ("The Nmap
  * Project"). Nmap is also a registered trademark of the Nmap Project.
  *
  * This program is distributed under the terms of the Nmap Public Source

libnetutil/TransportLayerElement.h

@@ -5,7 +5,7 @@
  *                                                                         *
  ***********************IMPORTANT NMAP LICENSE TERMS************************
  *
- * The Nmap Security Scanner is (C) 1996-2025 Nmap Software LLC ("The Nmap
+ * The Nmap Security Scanner is (C) 1996-2026 Nmap Software LLC ("The Nmap
  * Project"). Nmap is also a registered trademark of the Nmap Project.
  *
  * This program is distributed under the terms of the Nmap Public Source

libnetutil/UDPHeader.cc

@@ -6,7 +6,7 @@
  *                                                                         *
  ***********************IMPORTANT NMAP LICENSE TERMS************************
  *
- * The Nmap Security Scanner is (C) 1996-2025 Nmap Software LLC ("The Nmap
+ * The Nmap Security Scanner is (C) 1996-2026 Nmap Software LLC ("The Nmap
  * Project"). Nmap is also a registered trademark of the Nmap Project.
  *
  * This program is distributed under the terms of the Nmap Public Source

libnetutil/UDPHeader.h

@@ -5,7 +5,7 @@
  *                                                                         *
  ***********************IMPORTANT NMAP LICENSE TERMS************************
  *
- * The Nmap Security Scanner is (C) 1996-2025 Nmap Software LLC ("The Nmap
+ * The Nmap Security Scanner is (C) 1996-2026 Nmap Software LLC ("The Nmap
  * Project"). Nmap is also a registered trademark of the Nmap Project.
  *
  * This program is distributed under the terms of the Nmap Public Source