NetBSD Problem Report #60597

From www@netbsd.org  Sat Aug 15 09:01:12 2026
Return-Path: <www@netbsd.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (2048 bits)
	 client-signature RSA-PSS (2048 bits))
	(Client CN "mail.netbsd.org", Issuer "YR2" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id 7E0521A923C
	for <gnats-bugs@gnats.NetBSD.org>; Sat, 15 Aug 2026 09:01:12 +0000 (UTC)
Message-Id: <20260815090111.39D421A923E@mollari.NetBSD.org>
Date: Sat, 15 Aug 2026 09:01:11 +0000 (UTC)
From: rvp@SDF.ORG
Reply-To: rvp@SDF.ORG
To: gnats-bugs@NetBSD.org
Subject: nc(1) UDP port scans are not useful.
X-Send-Pr-Version: www-1.0
X-From4GNATS: "rvp@SDF.ORG via gnats" <gnats-admin@NetBSD.org>

>Number:         60597
>Category:       bin
>Synopsis:       nc(1) UDP port scans are not useful.
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    bin-bug-people
>State:          open
>Class:          change-request
>Submitter-Id:   net
>Arrival-Date:   Sat Aug 15 09:05:00 +0000 2026
>Last-Modified:  Sun Aug 16 10:10:01 +0000 2026
>Originator:     RVP
>Release:        11.99.7
>Organization:
>Environment:
NetBSD CoreBook.local 11.99.7 NetBSD 11.99.7 (COREBOOK_DIAG) #0: Sat Aug 15 04:21:15 UTC 2026  bld@CoreBook.local:/tmp/obj/usr/src/sys/arch/amd64/compile/COREBOOK_DIAG amd64
>Description:
Doing a UDP port scans using nc(1) right now is kinda pointless:

```
$ nc -uvz 192.168.68.1 50-60
Connection to 192.168.68.1 50 port [udp/re-mail-ck] succeeded!
Connection to 192.168.68.1 51 port [udp/*] succeeded!
Connection to 192.168.68.1 52 port [udp/xns-time] succeeded!
Connection to 192.168.68.1 53 port [udp/domain] succeeded!
Connection to 192.168.68.1 54 port [udp/xns-ch] succeeded!
Connection to 192.168.68.1 55 port [udp/isi-gl] succeeded!
Connection to 192.168.68.1 56 port [udp/xns-auth] succeeded!
Connection to 192.168.68.1 57 port [udp/*] succeeded!
Connection to 192.168.68.1 58 port [udp/xns-mail] succeeded!
Connection to 192.168.68.1 59 port [udp/*] succeeded!
Connection to 192.168.68.1 60 port [udp/*] succeeded!
$
```
All ports show up because nc(1) blasts through all the ports, and
expects the write to immediately return an error if a UDP port is
unreachable.

>How-To-Repeat:
As shown above.
>Fix:
Wait a bit for the ICMP port unreachable message to reach us.
Patch is almost the same as in Debian's `netcat-openbsd' package.

```
diff -urN usr.bin/nc.orig/netcat.c usr.bin/nc/netcat.c
--- usr.bin/nc.orig/netcat.c	2026-03-03 03:54:49.716087313 +0000
+++ usr.bin/nc/netcat.c	2026-06-04 11:37:51.676518886 +0000
@@ -1518,6 +1518,8 @@
 	}
 }

+#define UDP_SCAN_TIMEOUT	3	/* seconds */
+
 /*
  * udptest()
  * Do a few writes to see if the UDP port is there.
@@ -1526,15 +1528,23 @@
 int
 udptest(int s)
 {
-	int i, ret;
+	int i, t = (timeout == -1) ? UDP_SCAN_TIMEOUT : (timeout / 1000);
+ 
+ 	/* Only write to the socket in scan mode or interactive mode. */
+ 	if (!zflag && !isatty(STDIN_FILENO))
+ 		return 0;
+ 
+	if ((write(s, "X", 1) != 1) ||
+	    ((write(s, "X", 1) != 1) && (errno == ECONNREFUSED)))
+		return -1;

-	for (i = 0; i <= 3; i++) {
-		if (write(s, "X", 1) == 1)
-			ret = 1;
-		else
-			ret = -1;
-	}
-	return (ret);
+	/* Give the remote host some time to reply. */
+	for (i = 0; i < t; i++) {
+		sleep(1);
+		if ((write(s, "X", 1) != 1) && (errno == ECONNREFUSED))
+			return -1;
+ 	}
+	return 1;
 }

 void
```

>Audit-Trail:
From: "Christos Zoulas" <christos@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/60597 CVS commit: src/usr.bin/nc
Date: Sun, 16 Aug 2026 06:08:34 -0400

 Module Name:	src
 Committed By:	christos
 Date:		Sun Aug 16 10:08:34 UTC 2026

 Modified Files:
 	src/usr.bin/nc: netcat.c

 Log Message:
 PR/60597: RVP: Instead of assuming that writing to a UDP port is an immediate
 success, wait for a bit for the ICMP port unreachable message to reach us.


 To generate a diff of this commit:
 cvs rdiff -u -r1.9 -r1.10 src/usr.bin/nc/netcat.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

Home	PR Database Search