openbsd/src/usr.bin/nc, branch OPENBSD_6_8_BASE A mirror of https://github.com/libressl/openbsd.git https://git.lua4.win/openbsd/atom?h=OPENBSD_6_8_BASE 2020-02-12T14:46:36+00:00 Standardize argument naming for "sourceaddr" and unify the wording a bit, 2020-02-12T14:46:36+00:00 schwarze 2020-02-12T14:46:36+00:00 urn:sha1:4970e0155d7f95c3e44ba85c3286257e319af0bb similar to what deraadt@ recently did in other manual pages. revert previous nc loop refactor from 1.211, breaks bluhm's stuff 2020-01-26T23:47:57+00:00 beck 2020-01-26T23:47:57+00:00 urn:sha1:8c378310a509206ba737069320665e6c7be0a6d8 will attempt again later, now that there is new regress If the client provides a TLS certificate and the user specifies a 2020-01-07T17:36:04+00:00 bluhm 2020-01-07T17:36:04+00:00 urn:sha1:b21a4eb78e7b251470d32e7928506abb435895c1 hash value on the nc(1) server command line, the netcat server must use the TLS context of the accepted socket for verification. As the listening socket was used instead, the verification was always successful. If the peer provides a certificate, there must be a hash. Make the hash verification fail safe. OK tb@ The unveil(2) for nc -U -u -l was wrong. The server cannot unveil 2020-01-06T19:39:58+00:00 bluhm 2020-01-06T19:39:58+00:00 urn:sha1:b8844269b96f15a322554b949b65541ae33bd2aa the file system as it has to connect to the UNIX domain client socket. The path of the latter is determined dynamically. Instead add a restrictive pledge(2) after connect(2). OK tb@ When using UNIX domain sockets, always call report_sock() with the 2020-01-06T15:19:12+00:00 bluhm 2020-01-06T15:19:12+00:00 urn:sha1:3e0efdd85eb85916c31deaebdb7a9700525a0347 path name of the socket. This avoids bad errors from getnameinfo(3). Use the same error check for both calls to getnameinfo(3). OK millert@ tb@ fail to usage if extra argv are present 2019-11-17T17:38:33+00:00 deraadt 2019-11-17T17:38:33+00:00 urn:sha1:8b2539a2b3f95b9f86ed943db6de4521726a97f1 noticed by jsing and beck, ok tedu refactor the nc pool loop to not shut down the socket early, and 2019-11-13T04:10:38+00:00 beck 2019-11-13T04:10:38+00:00 urn:sha1:fadef512b562edf09855c18f7b45dccef082b168 to handle tls_shutdown correctly if using TLS, doing tls_shutdown correctly if we are using the -N flag ok sthen@ Fix an out of bound read/write when using a proxy. 2019-11-04T17:33:28+00:00 millert 2019-11-04T17:33:28+00:00 urn:sha1:60144acf12e5265cc7a444c710446700892c899e From Lucas AT sexy DOT is. OK job@ kn@ Service names are still resolved with -n 2019-10-24T17:27:08+00:00 kn 2019-10-24T17:27:08+00:00 urn:sha1:cc296ed627856799a9677fa96ce42ce970107127 Just like pfctl(8)'s -N, this flag only avoid DNS; "nc -vz ::1 socks" still works. Fix documentation by copying pfctl's wording. OK deraadt Print IP address in verbose mode 2019-10-24T12:48:54+00:00 job 2019-10-24T12:48:54+00:00 urn:sha1:d25f6a6259f082732af4c3730fbd47e3b0d53453 OK kn@