On Sat, Sep 05, 2015 at 10:13:14AM -0600, Bob Beck wrote:
> I doodled this into netcat last night, because I got tired of typing openssl
> s_client
> and s_server when testing things.. Still scripts nicely.
>
>
>
> -Bob
>
>
> Index: nc.1
> ===================================================================
> RCS file: /cvs/src/usr.bin/nc/nc.1,v
> retrieving revision 1.68
> diff -u -p -u -p -r1.68 nc.1
> --- nc.1 26 Mar 2015 10:35:04 -0000 1.68
> +++ nc.1 5 Sep 2015 16:03:45 -0000
> @@ -102,6 +102,17 @@ to use IPv6 addresses only.
> Enable debugging on the socket.
> .It Fl d
> Do not attempt to read from stdin.
> +.It Fl c
> +If using a tcp socket to connect or listen, use TLS. This option
> +takes optional numeric argument that can be used to make the TLS
> +connection less secure. specifying 1 disables certificate validity
> +verification, specifying 2 disables the verification of the
> +certificate name against the hostname, and 3 disables all certificate
> +verification.
in code, option 1 and 2 are inversed.
1: tls_config_insecure_noverifyname
2: tls_config_insecure_noverifycert
> Index: netcat.c
> ===================================================================
> RCS file: /cvs/src/usr.bin/nc/netcat.c,v
> retrieving revision 1.129
> diff -u -p -u -p -r1.129 netcat.c
> --- netcat.c 26 Mar 2015 21:22:50 -0000 1.129
> +++ netcat.c 5 Sep 2015 16:03:45 -0000
> @@ -166,6 +177,14 @@ main(int argc, char *argv[])
> else
> errx(1, "unsupported proxy protocol");
> break;
> + case 'c':
> + usetls = 1;
> + if (optarg != NULL) {
> + insecure = strtonum(optarg, 0, 3, &errstr);
does it makes sens to keep `0' as a valid option ? it is valid (as no "less
insecure") but... as you want (maybe it should be documented ?).
> + if (errstr)
> + errx(1, "insecure %s: %s", errstr,
> optarg);
> + }
> + break;
> case 'd':
> dflag = 1;
> break;
> @@ -347,6 +375,33 @@ main(int argc, char *argv[])
> proxyhints.ai_flags |= AI_NUMERICHOST;
> }
>
> + if (usetls) {
> + if (tls_init() == -1)
> + errx(1, "unable to initialize tls");
> + if ((tlsc = tls_config_new()) == NULL)
> + errx(1, "unable allocate tls config");
> + if (Cflag && (tls_config_set_cert_file(tlsc, Cflag) == -1))
> + errx(1, "unable to set TLS certificate file %s", Cflag);
> + if (Kflag && (tls_config_set_key_file(tlsc, Kflag) == -1))
> + errx(1, "unable to set TLS key file %s", Kflag);
> + if (Rflag && (tls_config_set_ca_file(tlsc, Rflag) == -1))
> + errx(1, "unable to set Root CA file %s", Rflag);
> + switch (insecure) {
> + case 1:
> + tls_config_insecure_noverifyname(tlsc);
> + break;
> + case 2:
> + tls_config_insecure_noverifycert(tlsc);
> + break;
> + case 3:
> + tls_config_insecure_noverifyname(tlsc);
> + tls_config_insecure_noverifycert(tlsc);
> + break;
> + default:
> + break;
> + }
> + }
> +
> if (lflag) {
> int connfd;
> ret = 0;
