From 992f99e553fd6ea2e28e89228417856c2ca939a6 Mon Sep 17 00:00:00 2001
From: Peter Bolla <buci@metacortex.hu>
Date: Sat, 2 Mar 2024 16:16:31 -0500
Subject: [PATCH] Only schedule non-empty username+password for retry

When `doAuthenticate` function fails during connection,
`thread_data.username` and `thread_data.password` variables
are still empty.

Later, when `BruteSocket`'s `checkStatus` is invoked, it tries to save
those values for later retry. However, as both username and password
are still empty at this point, `retry_accounts` will have a `nil, nil`
item.

When this item is picked up in the next invocation of `doAuthenticate`,
as both username and password is `nil`, `initial_accounts_exhausted`
is set to true, and the scanning stops.

This change adds a condition, to only add a new item to `retry_accounts`
in the `checkStatus` function, if either the username or the password
is not `nil`.
---
 nselib/brute.lua | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/nselib/brute.lua b/nselib/brute.lua
index e8b154902..aec9c321d 100644
--- a/nselib/brute.lua
+++ b/nselib/brute.lua
@@ -1532,10 +1532,12 @@ BruteSocket = {
 
       local thread_data = Engine.getThreadData(coroutine.running())
 
-      engine.retry_accounts[#engine.retry_accounts + 1] = {
-        username = thread_data.username,
-        password = thread_data.password,
-      }
+      if thread_data.username or thread_data.password then
+        engine.retry_accounts[#engine.retry_accounts + 1] = {
+          username = thread_data.username,
+          password = thread_data.password,
+        }
+      end
 
       thread_data.connection_error = true
       thread_data.con_error_reason = err