NetBSD Problem Report #54429

From www@netbsd.org  Fri Aug  2 00:22:51 2019
Return-Path: <www@netbsd.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
	(Client CN "mail.NetBSD.org", Issuer "mail.NetBSD.org CA" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id 8A2EF7A178
	for <gnats-bugs@gnats.NetBSD.org>; Fri,  2 Aug 2019 00:22:51 +0000 (UTC)
Message-Id: <20190802002250.9E89A7A1D3@mollari.NetBSD.org>
Date: Fri,  2 Aug 2019 00:22:50 +0000 (UTC)
From: uwe@stderr.spb.ru
Reply-To: uwe@stderr.spb.ru
To: gnats-bugs@NetBSD.org
Subject: nc(1) loses TCP urgent data
X-Send-Pr-Version: www-1.0

>Number:         54429
>Category:       bin
>Synopsis:       nc(1) loses TCP urgent data
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    bin-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Fri Aug 02 00:25:00 +0000 2019
>Last-Modified:  Fri Aug 02 00:30:01 +0000 2019
>Originator:     Valery Ushakov
>Release:        NetBSD-8
>Organization:
>Environment:
>Description:
nc(1) does not use SO_OOBINLINE and so it loses any TCP urgent data
sent by the peer.

>How-To-Repeat:
TCP urgent data (MSG_OOB) is virtually unused, so there's no readily
available real-world test case.  Consider the following test server
in python (sorry, I'm lazy :)

import socket

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1);

s.bind(('127.0.0.1', 12345))
s.listen(5)

while True:
    c, peer = s.accept()
    print "Connection from", peer[0] + ":" + str(peer[1])

    c.send('a')
    c.send('b', socket.MSG_OOB)
    c.send('c\n')

    c.close()

Now run nc(1) against it:

$ nc localhost 12345
ac

and you can see that "b", sent as urgent data, is lost.

>Fix:
Add

  setsockopt(s, SOL_SOCKET, SO_OOBINLINE, &x, sizeof(x));

to set_common_sockopts() in netcat.c.  I'm not sure if we can just do
that for all address families.  Since it's at the socket level, it
should be just a no-op for those that don't support MSG_OOB, so it
should be ok to do it indiscriminately I think.

And we probably need to add POLLPRI along with POLLIN to the relevant
poll(2) calls.

>Audit-Trail:
From: Valery Ushakov <uwe@stderr.spb.ru>
To: gnats-bugs@netbsd.org
Cc: 
Subject: Re: bin/54429: nc(1) loses TCP urgent data
Date: Fri, 2 Aug 2019 03:29:19 +0300

 PS: In our tree only rlogin, telnet and ftp (that speaks telnet for
 its control connection) send urgent data.

 -uwe

Home	PR Database Search