Nping: wrong sockaddr length passed to nsock_iod_set_localaddr breaks --tcp-connect and unprivileged --udp on macOS/BSD
Describe the bug
On macOS and the BSDs nping --tcp-connect fails on every single probe, and unprivileged nping --udp has the same problem. Nothing ever gets sent.
Both probe handlers in nping/ProbeMode.cc pass sizeof(sockaddr_storage), i.e. 128, as the length of the local address:
nping/ProbeMode.cc:1874 nsock_iod_set_localaddr(fds[packetno%max_iods], o.getSourceSockAddr(&ss), sizeof(sockaddr_storage));
nping/ProbeMode.cc:2083 nsock_iod_set_localaddr(fds[packetno%max_iods], o.getSourceSockAddr(&ss), sizeof(sockaddr_storage));The address itself is only a sockaddr_in or a sockaddr_in6. nsock_iod_set_localaddr() copies that length into nsi->locallen as given (nsock/src/nsock_iod.c:392) and mksock_bind_addr() hands it to bind() unchanged. Linux doesn't mind the oversized length, but the BSD stacks validate it and return EINVAL, so the bind fails and the connection attempt goes nowhere.
This looks like the same defect as #3438. 84420aa3 corrected the length in NmapOps::setSourceSockAddr(), Target::setSourceSockAddr() and NpingTarget::setSourceSockAddr(), but these two call sites pass the length straight into nsock, so none of those three apply to them.
To Reproduce
Have something listening on 18080, then:
$ nping --tcp-connect -p 18080 127.0.0.1 -c 5 --rate 5
Starting Nping 7.991SVN ( https://nmap.org/nping )
libnsock mksock_bind_addr(): Bind to 0.0.0.0:0 failed (IOD #1): Invalid argument (22)
RCVD (0.0012s) Possible TCP RST received from 0.0.0.0:0 --> Invalid argument
SENT (0.0013s) Starting TCP Handshake > 127.0.0.1:18080
...
TCP connection attempts: 5 | Successful connections: 0 | Failed: 5 (100.00%)nping --udp -p 18080 127.0.0.1 without root hits the same bind failure.
Expected behavior
The handshakes should complete. Both handlers already work out the correct length into sslen a few lines earlier for the destination sockaddr, and using that gives:
TCP connection attempts: 5 | Successful connections: 5 | Failed: 0 (0.00%)I also checked that --source-port still binds where you ask it to afterwards, using a listener that prints the client's source port, and that IPv6 works against an ::1 listener.
Version info (please complete the following information):
- OS: macOS 26.3 (Darwin 25.3.0, arm64)
- Output of
nping --version: Nping version 7.991SVN ( https://nmap.org/nping ), built from master at d70c2d9 - Output of
nmap --version: n/a, I only built nping out of the tree - Output of
nmap --iflist: n/a
Additional context
This is easy to miss because the bind error only appears in the nsock log line. At normal verbosity you just see every connect fail, which reads like the target refusing you rather than something going wrong locally. #1939 covers that side of it.
I have a patch and will send a PR.
Source: nmap/nmap