It looks like a big Nmap update came out today and still having the root system route issue.

Also of note, IPv6 is also having the routing issue:

[ben@SCSUbsd1 ~]$ nmap -6 ::1
Starting Nmap 7.92SVN ( https://nmap.org ) at 2021-11-23 20:32 UTC
Nmap scan report for localhost (::1)
Host is up (0.00011s latency).
Not shown: 997 closed tcp ports (conn-refused)
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
3128/tcp open squid-http

Nmap done: 1 IP address (1 host up) scanned in 6.29 seconds

[ben@SCSUbsd1 ~]$ sudo nmap -6 ::1
Starting Nmap 7.92SVN ( https://nmap.org ) at 2021-11-23 20:32 UTC
route_dst_generic: Failed to obtain system routes: getsysroutes_dnet: route_open() failed

I just tried nping and had the same issue:

root@SCSUbsd1:~ # nping google.com
route_dst_generic: Failed to obtain system routes: getsysroutes_dnet: route_open() failed
root@SCSUbsd1:~ # nping -V

Nping version 0.7.92SVN ( https://nmap.org/nping )
root@SCSUbsd1:~ #

After some more digging I've determined that the commit of libdnet-stripped code on 2020-10-13 in revision 38110 appears to be what broke root's ability to run Nmap on FreeBSD. Running 'svn up -r38109' then compiling allows root to run 'nmap localhost' but 'svn up -r38110' results in the error previously mentioned.

Here's the info on the commit:

[ben@freebsd13 ~/nmap]$ svn up -r38110
Updating '.':
U libdnet-stripped/acconfig.h
U libdnet-stripped/libdnet-stripped.vcxproj
U libdnet-stripped/configure
U libdnet-stripped/include/config.h.in
U libdnet-stripped/include/dnet_winconfig.h
U libdnet-stripped/configure.in
D libdnet-stripped/src/strlcat.c
U libdnet-stripped/src/Makefile.in
Updated to revision 38110.

[ben@freebsd13 ~/nmap]$ svn info
Path: .
Working Copy Root Path: /usr/home/ben/nmap
URL: https://svn.nmap.org/nmap
Relative URL: ^/nmap
Repository Root: https://svn.nmap.org
Repository UUID: e0a8ed71-7df4-0310-8962-fdc924857419
Revision: 38110
Node Kind: directory
Schedule: normal
Last Changed Author: dmiller
Last Changed Rev: 38110
Last Changed Date: 2020-10-13 15:13:38 -0500 (Tue, 13 Oct 2020)

Thanks for hunting this down. The commit ID on github is a5cca6f and it removes an implementation of strlcat that I believed to be unused in the source. We'll look into it.

I've been able to do a bit more digging, and a lot of learning, and have created a patch which appears to resolve the issue. I am unsure what the consequences of this patch are but applying the attached diff file (attached as a .txt) to libdnet-stripped/configure allows me to run Nmap as root.

2379-Patch.txt

Edit: After a bit more digging it looks like the patch adds back some code that is documented a manual on gnu.org so I'm guessing adding it back should have little negative consequences.

Here is my quick guess about what is going on:

• Commit a5cca6f did not intentionally/explicitly remove #ifdef HAVE_SYS_TYPES_H from libdnet-stripped/configure. It merely regenerated the file from libdnet-stripped/configure.in, which did not include this code even before this commit.
• The real issue comes from a much earlier commit, 4c3450c, which somehow pushed inconsistent code, where both #ifdef HAVE_SYS_TYPES_H and the adjacent #ifdef HAVE_SYS_SOCKET_H were added to libdnet-stripped/configure, but only the latter was added to libdnet-stripped/configure.in.

In summary, the fix could be to retrofit libdnet-stripped/configure.in accordingly, which seems safe to do:

--- a/libdnet-stripped/configure.in	2020-10-14 21:08:09.275534843 -0600
+++ b/libdnet-stripped/configure.in	2022-03-23 18:02:44.842111434 -0600
@@ -177,6 +177,9 @@
 	AC_CHECK_HEADERS(hpsecurity.h stropts.h)
 	AC_CHECK_HEADERS(net/route.h, [], [],
    [
+#ifdef HAVE_SYS_TYPES_H
+#include <sys/types.h>
+#endif
 #ifdef HAVE_SYS_SOCKET_H
 #include <sys/socket.h>
 #endif

Or, perhaps even cleaner, would be to leverage AC_INCLUDES_DEFAULT instead:

--- a/libdnet-stripped/configure.in	2020-10-14 21:08:09.275534843 -0600
+++ b/libdnet-stripped/configure.in	2022-03-23 18:02:44.842111434 -0600
@@ -177,6 +177,7 @@
 	AC_CHECK_HEADERS(hpsecurity.h stropts.h)
 	AC_CHECK_HEADERS(net/route.h, [], [],
    [
+AC_INCLUDES_DEFAULT
 #ifdef HAVE_SYS_SOCKET_H
 #include <sys/socket.h>
 #endif

Either of these two patches should rectify the issue.

@benpratt I do not have a FreeBSD environment readily available. Could you please test the second patch, the one with AC_INCLUDES_DEFAULT? (Do not forget to regenerate libdnet-stripped/configure before running it.)

@benpratt I do not have a FreeBSD environment readily available. Could you please test the second patch, the one with AC_INCLUDES_DEFAULT? (Do not forget to regenerate libdnet-stripped/configure before running it.)

I certainly can. How do I regenerate 'libdnet-stripped/configure'? Is there a command I can run?

Just running autoconf in that directory should do it.

I'm sorry for the delayed response. The second patch appears to have worked. To ensure I did everything properly my process was:

1. Create a file called patch.diff with the following code:

--- a/libdnet-stripped/configure.in 2020-10-14 21:08:09.275534843 -0600
+++ b/libdnet-stripped/configure.in 2022-03-23 18:02:44.842111434 -0600
@@ -177,6 +177,7 @@
AC_CHECK_HEADERS(hpsecurity.h stropts.h)
AC_CHECK_HEADERS(net/route.h, [], [],
[
+AC_INCLUDES_DEFAULT
#ifdef HAVE_SYS_SOCKET_H
#include <sys/socket.h>
#endif

2. Patch the file

patch nmap/libdnet-stripped/configure.in < patch.diff

3. In nmap/libdnet-stripped run autoconf. This did produce a warning about me using a different version of autoconf but appeared to finish successfully.

4. In nmap/ run .configure, gmake, sudo gmake install.

5. Test with 'sudo nmap localhost'.

Thank you @nnposter for your help in developing this patch.

This patch will be committed after April 15 unless concerns are raised.

The full scope of the update will be:

• Applying the second patch from above to libdnet-stripped/configure.in
• Adding the change to tracking file libdnet-stripped/NMAP_MODIFICATIONS
• Regenerating libdnet-stripped/configure

The fix has been committed as r38374. Thank you for reporting the issue and tracking down the root cause.