nmap update + security fix

re https://www.openwall.com/lists/oss-security/2026/07/29/4
but also we don't have 7.99 yet, here's an update + patch.

ok?


Index: Makefile
===================================================================
RCS file: /cvs/ports/net/nmap/Makefile,v
diff -u -p -r1.155 Makefile
--- Makefile	10 Mar 2026 15:33:11 -0000	1.155
+++ Makefile	29 Jul 2026 14:44:28 -0000
@@ -1,9 +1,9 @@
 COMMENT=	scan ports and fingerprint stack of network hosts
 
-DISTNAME=	nmap-7.98
+DISTNAME=	nmap-7.99
 
 # "grep version ndiff/pyproject.toml" (used in ndiff-x.yz.dist-info files)
-MODPY_DISTV=	7.96
+MODPY_DISTV=	7.99
 
 CATEGORIES=	net security
 EXTRACT_SUFX=	.tgz
Index: distinfo
===================================================================
RCS file: /cvs/ports/net/nmap/distinfo,v
diff -u -p -r1.43 distinfo
--- distinfo	10 Mar 2026 15:33:11 -0000	1.43
+++ distinfo	29 Jul 2026 14:44:28 -0000
@@ -1,2 +1,2 @@
-SHA256 (nmap-7.98.tgz) = jC8l0RwqKirnZEHL45b/p/CtcY21oUXZlnJp8cqDE3A=
-SIZE (nmap-7.98.tgz) = 14987565
+SHA256 (nmap-7.99.tgz) = kzwRrGR9wQmt3RyumHpOSQNtJECBS+7PD8N6h29btdY=
+SIZE (nmap-7.99.tgz) = 15862050
Index: patches/patch-nmap_dns_cc
===================================================================
RCS file: /cvs/ports/net/nmap/patches/patch-nmap_dns_cc,v
diff -u -p -r1.4 patch-nmap_dns_cc
--- patches/patch-nmap_dns_cc	10 Mar 2026 15:33:11 -0000	1.4
+++ patches/patch-nmap_dns_cc	29 Jul 2026 14:44:28 -0000
@@ -5,7 +5,7 @@ https://github.com/nmap/nmap/commit/3ada
 Index: nmap_dns.cc
 --- nmap_dns.cc.orig
 +++ nmap_dns.cc
-@@ -1671,7 +1671,7 @@ bool DNS::Factory::ptrToIp(const std::string &ptr, soc
+@@ -1679,7 +1679,7 @@ bool DNS::Factory::ptrToIp(const std::string &ptr, soc
    memset(&ip, 0, sizeof(sockaddr_storage));
  
    // Check whether the name ends with the IPv4 PTR domain
@@ -14,7 +14,7 @@ Index: nmap_dns.cc
    {
      struct sockaddr_in *ip4 = (struct sockaddr_in *)&ip;
      static const u8 place_value[] = {1, 10, 100};
-@@ -1706,7 +1706,7 @@ bool DNS::Factory::ptrToIp(const std::string &ptr, soc
+@@ -1714,7 +1714,7 @@ bool DNS::Factory::ptrToIp(const std::string &ptr, soc
      ip.ss_family = AF_INET;
    }
    // If not, check IPv6
Index: patches/patch-nping_Crypto_cc
===================================================================
RCS file: patches/patch-nping_Crypto_cc
diff -N patches/patch-nping_Crypto_cc
--- patches/patch-nping_Crypto_cc	10 Mar 2026 15:33:11 -0000	1.3
+++ /dev/null	1 Jan 1970 00:00:00 -0000
@@ -1,12 +0,0 @@
-Index: nping/Crypto.cc
---- nping/Crypto.cc.orig
-+++ nping/Crypto.cc
-@@ -69,7 +69,7 @@
- #include <openssl/evp.h>
- #include <openssl/err.h>
- 
--#if (OPENSSL_VERSION_NUMBER >= 0x10100000L) && !defined LIBRESSL_VERSION_NUMBER
-+#if (OPENSSL_VERSION_NUMBER >= 0x10100000L)
- #define HAVE_OPAQUE_EVP_PKEY 1
- #else
- #define EVP_MD_CTX_new EVP_MD_CTX_create
Index: patches/patch-nse_openssl_cc
===================================================================
RCS file: patches/patch-nse_openssl_cc
diff -N patches/patch-nse_openssl_cc
--- patches/patch-nse_openssl_cc	10 Mar 2026 15:33:11 -0000	1.6
+++ /dev/null	1 Jan 1970 00:00:00 -0000
@@ -1,14 +0,0 @@
-Fake amd64 RC4_options() output to avoid more intrusive patch.
-
-Index: nse_openssl.cc
---- nse_openssl.cc.orig
-+++ nse_openssl.cc
-@@ -13,7 +13,7 @@
- #include <openssl/hmac.h>
- #include <openssl/rand.h>
- 
--#if (OPENSSL_VERSION_NUMBER >= 0x10100000L) && !defined LIBRESSL_VERSION_NUMBER
-+#if (OPENSSL_VERSION_NUMBER >= 0x10100000L)
- #define HAVE_OPAQUE_STRUCTS 1
- #if OPENSSL_VERSION_NUMBER >= 0x30000000L
- # include <openssl/provider.h>
Index: patches/patch-nse_ssl_cert_cc
===================================================================
RCS file: patches/patch-nse_ssl_cert_cc
diff -N patches/patch-nse_ssl_cert_cc
--- patches/patch-nse_ssl_cert_cc	10 Mar 2026 15:33:11 -0000	1.3
+++ /dev/null	1 Jan 1970 00:00:00 -0000
@@ -1,30 +0,0 @@
-Index: nse_ssl_cert.cc
---- nse_ssl_cert.cc.orig
-+++ nse_ssl_cert.cc
-@@ -79,7 +79,7 @@
- #include <openssl/evp.h>
- #include <openssl/err.h>
- 
--#if (OPENSSL_VERSION_NUMBER >= 0x10100000L) && !defined LIBRESSL_VERSION_NUMBER
-+#if (OPENSSL_VERSION_NUMBER >= 0x10100000L)
- /* Technically some of these things were added in 0x10100006
-  * but that was pre-release. */
- #define HAVE_OPAQUE_STRUCTS 1
-@@ -488,6 +488,9 @@ int lua_push_ecdhparams(lua_State *L, EVP_PKEY *pubkey
-     lua_setfield(L, -2, "ec_curve_type");
-   }
-   else {
-+#if defined(LIBRESSL_VERSION_NUMBER)
-+    lua_pushstring(L, "explicit_prime");
-+#else
-     /* According to RFC 5480 section 2.1.1, explicit curves must not be used with
-        X.509. This may change in the future, but for now it doesn't seem worth it
-        to add in code to extract the extra parameters. */
-@@ -502,6 +505,7 @@ int lua_push_ecdhparams(lua_State *L, EVP_PKEY *pubkey
-       /* Something weird happened. */
-       lua_pushstring(L, "UNKNOWN");
-     }
-+#endif
-     lua_setfield(L, -2, "ec_curve_type");
-   }
-   lua_setfield(L, -2, "curve_params");
Index: patches/patch-nselib_packet_lua
===================================================================
RCS file: patches/patch-nselib_packet_lua
diff -N patches/patch-nselib_packet_lua
--- /dev/null	1 Jan 1970 00:00:00 -0000
+++ patches/patch-nselib_packet_lua	29 Jul 2026 14:44:28 -0000
@@ -0,0 +1,33 @@
+From 7ef4ee030a0023fe22616387a000032e1a678b6a Mon Sep 17 00:00:00 2001
+From: dmiller <dmiller@e0a8ed71-7df4-0310-8962-fdc924857419>
+Date: Thu, 11 Jun 2026 18:31:31 +0000
+Subject: [PATCH] Stop parsing on a zero-length packet option
+
+Fixes #3368. Closes #3373.
+
+Index: nselib/packet.lua
+--- nselib/packet.lua.orig
++++ nselib/packet.lua
+@@ -686,10 +686,7 @@ function Packet:parse_options(offset, length)
+   local opt_ptr = 0
+   while opt_ptr < length do
+     local t, l, d
+-    options[op] = {}
+-
+     t = self:u8(offset + opt_ptr)
+-    options[op].type = t
+     if t==0 or t==1 then
+       l = 1
+       d = nil
+@@ -699,6 +696,11 @@ function Packet:parse_options(offset, length)
+         d = self:raw(offset + opt_ptr + 2, l-2)
+       end
+     end
++    if l==0 then
++      break
++    end
++    options[op] = {}
++    options[op].type = t
+     options[op].len  = l
+     options[op].data = d
+     opt_ptr = opt_ptr + l
Index: patches/patch-scan-engine_cc
===================================================================
RCS file: /cvs/ports/net/nmap/patches/patch-scan-engine_cc,v
diff -u -p -r1.16 patch-scan-engine_cc
--- patches/patch-scan-engine_cc	10 Mar 2026 15:33:11 -0000	1.16
+++ patches/patch-scan-engine_cc	29 Jul 2026 14:44:28 -0000
@@ -3,7 +3,7 @@ Fix for 64-bit time_t on 32-bit archs
 Index: scan_engine.cc
 --- scan_engine.cc.orig
 +++ scan_engine.cc
-@@ -2030,7 +2030,7 @@ void ultrascan_host_probe_update(UltraScanInfo *USI, H
+@@ -2038,7 +2038,7 @@ void ultrascan_host_probe_update(UltraScanInfo *USI, H
      struct timeval tv;
  
      gettimeofday(&tv, NULL);