103100a63Svk199839 /* $OpenBSD: netcat.c,v 1.89 2007/02/20 14:11:17 jmc Exp $ */ 203100a63Svk199839 /* 303100a63Svk199839 * Copyright (c) 2001 Eric Jackson <ericj@monkey.org> 403100a63Svk199839 * 503100a63Svk199839 * Redistribution and use in source and binary forms, with or without 603100a63Svk199839 * modification, are permitted provided that the following conditions 703100a63Svk199839 * are met: 803100a63Svk199839 * 903100a63Svk199839 * 1. Redistributions of source code must retain the above copyright 1003100a63Svk199839 * notice, this list of conditions and the following disclaimer. 1103100a63Svk199839 * 2. Redistributions in binary form must reproduce the above copyright 1203100a63Svk199839 * notice, this list of conditions and the following disclaimer in the 1303100a63Svk199839 * documentation and/or other materials provided with the distribution. 1403100a63Svk199839 * 3. The name of the author may not be used to endorse or promote products 1503100a63Svk199839 * derived from this software without specific prior written permission. 1603100a63Svk199839 * 1703100a63Svk199839 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 1803100a63Svk199839 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 1903100a63Svk199839 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 2003100a63Svk199839 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 2103100a63Svk199839 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 2203100a63Svk199839 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 2303100a63Svk199839 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 2403100a63Svk199839 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 2503100a63Svk199839 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 2603100a63Svk199839 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 2703100a63Svk199839 */ 2803100a63Svk199839 2903100a63Svk199839 /* 3003100a63Svk199839 * Re-written nc(1) for OpenBSD. Original implementation by 3103100a63Svk199839 * *Hobbit* <hobbit@avian.org>. 3203100a63Svk199839 */ 3303100a63Svk199839 34f8c3982aSvk199839 /* 35f8c3982aSvk199839 * Copyright 2008 Sun Microsystems, Inc. All rights reserved. 36f8c3982aSvk199839 * Use is subject to license terms. 37f8c3982aSvk199839 */ 38f8c3982aSvk199839 3903100a63Svk199839 #pragma ident "%Z%%M% %I% %E% SMI" 4003100a63Svk199839 4103100a63Svk199839 #include <sys/types.h> 4203100a63Svk199839 #include <sys/socket.h> 4303100a63Svk199839 #include <sys/time.h> 4403100a63Svk199839 #include <sys/un.h> 4503100a63Svk199839 4603100a63Svk199839 #include <netinet/in.h> 4703100a63Svk199839 #include <netinet/in_systm.h> 4803100a63Svk199839 #include <netinet/tcp.h> 4903100a63Svk199839 #include <netinet/ip.h> 5003100a63Svk199839 #include <arpa/telnet.h> 5103100a63Svk199839 5203100a63Svk199839 #include <err.h> 5303100a63Svk199839 #include <errno.h> 5403100a63Svk199839 #include <netdb.h> 5503100a63Svk199839 #include <poll.h> 5603100a63Svk199839 #include <stdarg.h> 5703100a63Svk199839 #include <stdio.h> 5803100a63Svk199839 #include <stdlib.h> 5903100a63Svk199839 #include <string.h> 6003100a63Svk199839 #include <unistd.h> 6103100a63Svk199839 #include <fcntl.h> 6203100a63Svk199839 #include <limits.h> 6303100a63Svk199839 #include <signal.h> 6403100a63Svk199839 6503100a63Svk199839 #include "atomicio.h" 6603100a63Svk199839 #include "strtonum.h" 6703100a63Svk199839 6803100a63Svk199839 #ifndef SUN_LEN 6903100a63Svk199839 #define SUN_LEN(su) \ 7003100a63Svk199839 (sizeof (*(su)) - sizeof ((su)->sun_path) + strlen((su)->sun_path)) 7103100a63Svk199839 #endif 7203100a63Svk199839 7303100a63Svk199839 #define PORT_MIN 1 7403100a63Svk199839 #define PORT_MAX 65535 7503100a63Svk199839 #define PORT_MAX_LEN 6 7603100a63Svk199839 7703100a63Svk199839 /* Command Line Options */ 7803100a63Svk199839 int dflag; /* detached, no stdin */ 7903100a63Svk199839 unsigned int iflag; /* Interval Flag */ 8003100a63Svk199839 int kflag; /* More than one connect */ 8103100a63Svk199839 int lflag; /* Bind to local port */ 8203100a63Svk199839 int nflag; /* Don't do name lookup */ 8303100a63Svk199839 char *Pflag; /* Proxy username */ 8403100a63Svk199839 char *pflag; /* Localport flag */ 8503100a63Svk199839 int rflag; /* Random ports flag */ 8603100a63Svk199839 char *sflag; /* Source Address */ 8703100a63Svk199839 int tflag; /* Telnet Emulation */ 8803100a63Svk199839 int uflag; /* UDP - Default to TCP */ 8903100a63Svk199839 int vflag; /* Verbosity */ 9003100a63Svk199839 int xflag; /* Socks proxy */ 9103100a63Svk199839 int Xflag; /* indicator of Socks version set */ 9203100a63Svk199839 int zflag; /* Port Scan Flag */ 9303100a63Svk199839 int Dflag; /* sodebug */ 9403100a63Svk199839 int Tflag = -1; /* IP Type of Service */ 9503100a63Svk199839 9603100a63Svk199839 int timeout = -1; 9703100a63Svk199839 int family = AF_UNSPEC; 9803100a63Svk199839 char *portlist[PORT_MAX+1]; 9903100a63Svk199839 10003100a63Svk199839 void atelnet(int, unsigned char *, unsigned int); 10103100a63Svk199839 void build_ports(char *); 10203100a63Svk199839 void help(void); 10303100a63Svk199839 int local_listen(char *, char *, struct addrinfo); 10403100a63Svk199839 void readwrite(int); 10503100a63Svk199839 int remote_connect(const char *, const char *, struct addrinfo); 10603100a63Svk199839 int socks_connect(const char *, const char *, 10703100a63Svk199839 const char *, const char *, struct addrinfo, int, const char *); 10803100a63Svk199839 int udptest(int); 10903100a63Svk199839 int unix_connect(char *); 11003100a63Svk199839 int unix_listen(char *); 11103100a63Svk199839 void set_common_sockopts(int); 11203100a63Svk199839 int parse_iptos(char *); 11303100a63Svk199839 void usage(int); 114f8c3982aSvk199839 char *print_addr(char *, size_t, struct sockaddr *, int, int); 11503100a63Svk199839 11603100a63Svk199839 int 11703100a63Svk199839 main(int argc, char *argv[]) 11803100a63Svk199839 { 11903100a63Svk199839 int ch, s, ret, socksv; 12003100a63Svk199839 char *host, *uport, *proxy; 12103100a63Svk199839 struct addrinfo hints; 12203100a63Svk199839 struct servent *sv; 12303100a63Svk199839 socklen_t len; 12403100a63Svk199839 struct sockaddr_storage cliaddr; 12503100a63Svk199839 const char *errstr, *proxyhost = "", *proxyport = NULL; 12603100a63Svk199839 struct addrinfo proxyhints; 12703100a63Svk199839 12803100a63Svk199839 ret = 1; 12903100a63Svk199839 s = 0; 13003100a63Svk199839 socksv = 5; 13103100a63Svk199839 host = NULL; 13203100a63Svk199839 uport = NULL; 13303100a63Svk199839 sv = NULL; 13403100a63Svk199839 13503100a63Svk199839 while ((ch = getopt(argc, argv, 13603100a63Svk199839 "46Ddhi:klnP:p:rs:T:tUuvw:X:x:z")) != -1) { 13703100a63Svk199839 switch (ch) { 13803100a63Svk199839 case '4': 13903100a63Svk199839 family = AF_INET; 14003100a63Svk199839 break; 14103100a63Svk199839 case '6': 14203100a63Svk199839 family = AF_INET6; 14303100a63Svk199839 break; 14403100a63Svk199839 case 'U': 14503100a63Svk199839 family = AF_UNIX; 14603100a63Svk199839 break; 14703100a63Svk199839 case 'X': 14803100a63Svk199839 Xflag = 1; 14903100a63Svk199839 if (strcasecmp(optarg, "connect") == 0) 15003100a63Svk199839 socksv = -1; /* HTTP proxy CONNECT */ 15103100a63Svk199839 else if (strcmp(optarg, "4") == 0) 15203100a63Svk199839 socksv = 4; /* SOCKS v.4 */ 15303100a63Svk199839 else if (strcmp(optarg, "5") == 0) 15403100a63Svk199839 socksv = 5; /* SOCKS v.5 */ 15503100a63Svk199839 else 15603100a63Svk199839 errx(1, "unsupported proxy protocol"); 15703100a63Svk199839 break; 15803100a63Svk199839 case 'd': 15903100a63Svk199839 dflag = 1; 16003100a63Svk199839 break; 16103100a63Svk199839 case 'h': 16203100a63Svk199839 help(); 16303100a63Svk199839 break; 16403100a63Svk199839 case 'i': 16503100a63Svk199839 iflag = strtonum(optarg, 0, UINT_MAX, &errstr); 16603100a63Svk199839 if (errstr) 16703100a63Svk199839 errx(1, "interval %s: %s", errstr, optarg); 16803100a63Svk199839 break; 16903100a63Svk199839 case 'k': 17003100a63Svk199839 kflag = 1; 17103100a63Svk199839 break; 17203100a63Svk199839 case 'l': 17303100a63Svk199839 lflag = 1; 17403100a63Svk199839 break; 17503100a63Svk199839 case 'n': 17603100a63Svk199839 nflag = 1; 17703100a63Svk199839 break; 17803100a63Svk199839 case 'P': 17903100a63Svk199839 Pflag = optarg; 18003100a63Svk199839 break; 18103100a63Svk199839 case 'p': 18203100a63Svk199839 pflag = optarg; 18303100a63Svk199839 break; 18403100a63Svk199839 case 'r': 18503100a63Svk199839 rflag = 1; 18603100a63Svk199839 break; 18703100a63Svk199839 case 's': 18803100a63Svk199839 sflag = optarg; 18903100a63Svk199839 break; 19003100a63Svk199839 case 't': 19103100a63Svk199839 tflag = 1; 19203100a63Svk199839 break; 19303100a63Svk199839 case 'u': 19403100a63Svk199839 uflag = 1; 19503100a63Svk199839 break; 19603100a63Svk199839 case 'v': 19703100a63Svk199839 vflag = 1; 19803100a63Svk199839 break; 19903100a63Svk199839 case 'w': 20003100a63Svk199839 timeout = strtonum(optarg, 0, INT_MAX / 1000, &errstr); 20103100a63Svk199839 if (errstr) 20203100a63Svk199839 errx(1, "timeout %s: %s", errstr, optarg); 20303100a63Svk199839 timeout *= 1000; 20403100a63Svk199839 break; 20503100a63Svk199839 case 'x': 20603100a63Svk199839 xflag = 1; 20703100a63Svk199839 if ((proxy = strdup(optarg)) == NULL) 20803100a63Svk199839 err(1, NULL); 20903100a63Svk199839 break; 21003100a63Svk199839 case 'z': 21103100a63Svk199839 zflag = 1; 21203100a63Svk199839 break; 21303100a63Svk199839 case 'D': 21403100a63Svk199839 Dflag = 1; 21503100a63Svk199839 break; 21603100a63Svk199839 case 'T': 21703100a63Svk199839 Tflag = parse_iptos(optarg); 21803100a63Svk199839 break; 21903100a63Svk199839 default: 22003100a63Svk199839 usage(1); 22103100a63Svk199839 } 22203100a63Svk199839 } 22303100a63Svk199839 argc -= optind; 22403100a63Svk199839 argv += optind; 22503100a63Svk199839 22603100a63Svk199839 /* Cruft to make sure options are clean, and used properly. */ 22703100a63Svk199839 if (argv[0] && !argv[1] && family == AF_UNIX) { 22803100a63Svk199839 if (uflag) 22903100a63Svk199839 errx(1, "cannot use -u and -U"); 23003100a63Svk199839 host = argv[0]; 23103100a63Svk199839 uport = NULL; 23203100a63Svk199839 } else if (argv[0] && !argv[1]) { 23303100a63Svk199839 if (!lflag) 23403100a63Svk199839 usage(1); 23503100a63Svk199839 uport = argv[0]; 23603100a63Svk199839 host = NULL; 23703100a63Svk199839 } else if (argv[0] && argv[1]) { 23803100a63Svk199839 if (family == AF_UNIX) 23903100a63Svk199839 usage(1); 24003100a63Svk199839 host = argv[0]; 24103100a63Svk199839 uport = argv[1]; 24203100a63Svk199839 } else { 24303100a63Svk199839 if (!(lflag && pflag)) 24403100a63Svk199839 usage(1); 24503100a63Svk199839 } 24603100a63Svk199839 247*63c99f93Svk199839 if (argc > 2) 248*63c99f93Svk199839 usage(1); 249*63c99f93Svk199839 25003100a63Svk199839 if (lflag && sflag) 25103100a63Svk199839 errx(1, "cannot use -s and -l"); 25203100a63Svk199839 if (lflag && rflag) 25303100a63Svk199839 errx(1, "cannot use -r and -l"); 254*63c99f93Svk199839 if (lflag && (timeout >= 0)) 255*63c99f93Svk199839 warnx("-w has no effect with -l"); 25603100a63Svk199839 if (lflag && pflag) { 25703100a63Svk199839 if (uport) 25803100a63Svk199839 usage(1); 25903100a63Svk199839 uport = pflag; 26003100a63Svk199839 } 26103100a63Svk199839 if (lflag && zflag) 26203100a63Svk199839 errx(1, "cannot use -z and -l"); 26303100a63Svk199839 if (!lflag && kflag) 26403100a63Svk199839 errx(1, "must use -l with -k"); 26503100a63Svk199839 if (lflag && (Pflag || xflag || Xflag)) 26603100a63Svk199839 errx(1, "cannot use -l with -P, -X or -x"); 26703100a63Svk199839 26803100a63Svk199839 /* Initialize addrinfo structure. */ 26903100a63Svk199839 if (family != AF_UNIX) { 27003100a63Svk199839 (void) memset(&hints, 0, sizeof (struct addrinfo)); 27103100a63Svk199839 hints.ai_family = family; 27203100a63Svk199839 hints.ai_socktype = uflag ? SOCK_DGRAM : SOCK_STREAM; 27303100a63Svk199839 hints.ai_protocol = uflag ? IPPROTO_UDP : IPPROTO_TCP; 27403100a63Svk199839 if (nflag) 27503100a63Svk199839 hints.ai_flags |= AI_NUMERICHOST; 27603100a63Svk199839 } 27703100a63Svk199839 27803100a63Svk199839 if (xflag) { 27903100a63Svk199839 if (uflag) 28003100a63Svk199839 errx(1, "no proxy support for UDP mode"); 28103100a63Svk199839 28203100a63Svk199839 if (lflag) 28303100a63Svk199839 errx(1, "no proxy support for listen"); 28403100a63Svk199839 28503100a63Svk199839 if (family == AF_UNIX) 28603100a63Svk199839 errx(1, "no proxy support for unix sockets"); 28703100a63Svk199839 28803100a63Svk199839 if (family == AF_INET6) 28903100a63Svk199839 errx(1, "no proxy support for IPv6"); 29003100a63Svk199839 29103100a63Svk199839 if (sflag) 29203100a63Svk199839 errx(1, "no proxy support for local source address"); 29303100a63Svk199839 29403100a63Svk199839 if ((proxyhost = strtok(proxy, ":")) == NULL) 29503100a63Svk199839 errx(1, "missing port specification"); 29603100a63Svk199839 proxyport = strtok(NULL, ":"); 29703100a63Svk199839 29803100a63Svk199839 (void) memset(&proxyhints, 0, sizeof (struct addrinfo)); 29903100a63Svk199839 proxyhints.ai_family = family; 30003100a63Svk199839 proxyhints.ai_socktype = SOCK_STREAM; 30103100a63Svk199839 proxyhints.ai_protocol = IPPROTO_TCP; 30203100a63Svk199839 if (nflag) 30303100a63Svk199839 proxyhints.ai_flags |= AI_NUMERICHOST; 30403100a63Svk199839 } 30503100a63Svk199839 30603100a63Svk199839 if (lflag) { 30703100a63Svk199839 int connfd; 30803100a63Svk199839 ret = 0; 30903100a63Svk199839 31003100a63Svk199839 if (family == AF_UNIX) 31103100a63Svk199839 s = unix_listen(host); 31203100a63Svk199839 31303100a63Svk199839 /* Allow only one connection at a time, but stay alive. */ 31403100a63Svk199839 for (;;) { 31503100a63Svk199839 if (family != AF_UNIX) 31603100a63Svk199839 s = local_listen(host, uport, hints); 31703100a63Svk199839 if (s < 0) 31803100a63Svk199839 err(1, NULL); 31903100a63Svk199839 /* 32003100a63Svk199839 * For UDP, we will use recvfrom() initially 32103100a63Svk199839 * to wait for a caller, then use the regular 32203100a63Svk199839 * functions to talk to the caller. 32303100a63Svk199839 */ 32403100a63Svk199839 if (uflag) { 32503100a63Svk199839 int rv, plen; 32603100a63Svk199839 char buf[8192]; 32703100a63Svk199839 struct sockaddr_storage z; 32803100a63Svk199839 32903100a63Svk199839 len = sizeof (z); 33003100a63Svk199839 plen = 1024; 33103100a63Svk199839 rv = recvfrom(s, buf, plen, MSG_PEEK, 33203100a63Svk199839 (struct sockaddr *)&z, &len); 33303100a63Svk199839 if (rv < 0) 33403100a63Svk199839 err(1, "recvfrom"); 33503100a63Svk199839 33603100a63Svk199839 rv = connect(s, (struct sockaddr *)&z, len); 33703100a63Svk199839 if (rv < 0) 33803100a63Svk199839 err(1, "connect"); 33903100a63Svk199839 34003100a63Svk199839 connfd = s; 34103100a63Svk199839 } else { 34203100a63Svk199839 len = sizeof (cliaddr); 34303100a63Svk199839 connfd = accept(s, (struct sockaddr *)&cliaddr, 34403100a63Svk199839 &len); 345f8c3982aSvk199839 if ((connfd != -1) && vflag) { 346f8c3982aSvk199839 char ntop[NI_MAXHOST + NI_MAXSERV]; 347f8c3982aSvk199839 (void) fprintf(stderr, 348f8c3982aSvk199839 "Received connection from %s\n", 349f8c3982aSvk199839 print_addr(ntop, sizeof (ntop), 350f8c3982aSvk199839 (struct sockaddr *)&cliaddr, len, 351f8c3982aSvk199839 nflag ? NI_NUMERICHOST : 0)); 352f8c3982aSvk199839 } 35303100a63Svk199839 } 35403100a63Svk199839 35503100a63Svk199839 readwrite(connfd); 35603100a63Svk199839 (void) close(connfd); 35703100a63Svk199839 if (family != AF_UNIX) 35803100a63Svk199839 (void) close(s); 35903100a63Svk199839 36003100a63Svk199839 if (!kflag) 36103100a63Svk199839 break; 36203100a63Svk199839 } 36303100a63Svk199839 } else if (family == AF_UNIX) { 36403100a63Svk199839 ret = 0; 36503100a63Svk199839 36603100a63Svk199839 if ((s = unix_connect(host)) > 0 && !zflag) { 36703100a63Svk199839 readwrite(s); 36803100a63Svk199839 (void) close(s); 36903100a63Svk199839 } else 37003100a63Svk199839 ret = 1; 37103100a63Svk199839 37203100a63Svk199839 exit(ret); 37303100a63Svk199839 37403100a63Svk199839 } else { /* AF_INET or AF_INET6 */ 37503100a63Svk199839 int i = 0; 37603100a63Svk199839 37703100a63Svk199839 /* Construct the portlist[] array. */ 37803100a63Svk199839 build_ports(uport); 37903100a63Svk199839 38003100a63Svk199839 /* Cycle through portlist, connecting to each port. */ 38103100a63Svk199839 for (i = 0; portlist[i] != NULL; i++) { 38203100a63Svk199839 if (s) 38303100a63Svk199839 (void) close(s); 38403100a63Svk199839 38503100a63Svk199839 if (xflag) 38603100a63Svk199839 s = socks_connect(host, portlist[i], 38703100a63Svk199839 proxyhost, proxyport, proxyhints, socksv, 38803100a63Svk199839 Pflag); 38903100a63Svk199839 else 39003100a63Svk199839 s = remote_connect(host, portlist[i], hints); 39103100a63Svk199839 39203100a63Svk199839 if (s < 0) 39303100a63Svk199839 continue; 39403100a63Svk199839 39503100a63Svk199839 ret = 0; 39603100a63Svk199839 if (vflag || zflag) { 39703100a63Svk199839 /* For UDP, make sure we are connected. */ 39803100a63Svk199839 if (uflag) { 39903100a63Svk199839 if (udptest(s) == -1) { 40003100a63Svk199839 ret = 1; 40103100a63Svk199839 continue; 40203100a63Svk199839 } 40303100a63Svk199839 } 40403100a63Svk199839 40503100a63Svk199839 /* Don't look up port if -n. */ 40603100a63Svk199839 if (nflag) 40703100a63Svk199839 sv = NULL; 40803100a63Svk199839 else { 40903100a63Svk199839 sv = getservbyport( 41003100a63Svk199839 ntohs(atoi(portlist[i])), 41103100a63Svk199839 uflag ? "udp" : "tcp"); 41203100a63Svk199839 } 41303100a63Svk199839 414f8c3982aSvk199839 (void) fprintf(stderr, "Connection to %s %s " 41503100a63Svk199839 "port [%s/%s] succeeded!\n", 41603100a63Svk199839 host, portlist[i], uflag ? "udp" : "tcp", 41703100a63Svk199839 sv ? sv->s_name : "*"); 41803100a63Svk199839 } 41903100a63Svk199839 if (!zflag) 42003100a63Svk199839 readwrite(s); 42103100a63Svk199839 } 42203100a63Svk199839 } 42303100a63Svk199839 42403100a63Svk199839 if (s) 42503100a63Svk199839 (void) close(s); 42603100a63Svk199839 42703100a63Svk199839 return (ret); 42803100a63Svk199839 } 42903100a63Svk199839 43003100a63Svk199839 /* 431f8c3982aSvk199839 * print IP address and (optionally) a port 432f8c3982aSvk199839 */ 433f8c3982aSvk199839 char * 434f8c3982aSvk199839 print_addr(char *ntop, size_t ntlen, struct sockaddr *addr, int len, int flags) 435f8c3982aSvk199839 { 436f8c3982aSvk199839 char port[NI_MAXSERV]; 437f8c3982aSvk199839 int e; 438f8c3982aSvk199839 439f8c3982aSvk199839 /* print port always as number */ 440f8c3982aSvk199839 if ((e = getnameinfo(addr, len, ntop, ntlen, 441f8c3982aSvk199839 port, sizeof (port), flags|NI_NUMERICSERV)) != 0) { 442f8c3982aSvk199839 return ((char *)gai_strerror(e)); 443f8c3982aSvk199839 } 444f8c3982aSvk199839 445f8c3982aSvk199839 (void) snprintf(ntop, ntlen, "%s port %s", ntop, port); 446f8c3982aSvk199839 447f8c3982aSvk199839 return (ntop); 448f8c3982aSvk199839 } 449f8c3982aSvk199839 450f8c3982aSvk199839 /* 45103100a63Svk199839 * unix_connect() 45203100a63Svk199839 * Returns a socket connected to a local unix socket. Returns -1 on failure. 45303100a63Svk199839 */ 45403100a63Svk199839 int 45503100a63Svk199839 unix_connect(char *path) 45603100a63Svk199839 { 45703100a63Svk199839 struct sockaddr_un sunaddr; 45803100a63Svk199839 int s; 45903100a63Svk199839 46003100a63Svk199839 if ((s = socket(AF_UNIX, SOCK_STREAM, 0)) < 0) 46103100a63Svk199839 return (-1); 46203100a63Svk199839 46303100a63Svk199839 (void) memset(&sunaddr, 0, sizeof (struct sockaddr_un)); 46403100a63Svk199839 sunaddr.sun_family = AF_UNIX; 46503100a63Svk199839 46603100a63Svk199839 if (strlcpy(sunaddr.sun_path, path, sizeof (sunaddr.sun_path)) >= 46703100a63Svk199839 sizeof (sunaddr.sun_path)) { 46803100a63Svk199839 (void) close(s); 46903100a63Svk199839 errno = ENAMETOOLONG; 47003100a63Svk199839 return (-1); 47103100a63Svk199839 } 47203100a63Svk199839 if (connect(s, (struct sockaddr *)&sunaddr, SUN_LEN(&sunaddr)) < 0) { 47303100a63Svk199839 (void) close(s); 47403100a63Svk199839 return (-1); 47503100a63Svk199839 } 47603100a63Svk199839 return (s); 47703100a63Svk199839 } 47803100a63Svk199839 47903100a63Svk199839 /* 48003100a63Svk199839 * unix_listen() 48103100a63Svk199839 * Create a unix domain socket, and listen on it. 48203100a63Svk199839 */ 48303100a63Svk199839 int 48403100a63Svk199839 unix_listen(char *path) 48503100a63Svk199839 { 48603100a63Svk199839 struct sockaddr_un sunaddr; 48703100a63Svk199839 int s; 48803100a63Svk199839 48903100a63Svk199839 /* Create unix domain socket. */ 49003100a63Svk199839 if ((s = socket(AF_UNIX, SOCK_STREAM, 0)) < 0) 49103100a63Svk199839 return (-1); 49203100a63Svk199839 49303100a63Svk199839 (void) memset(&sunaddr, 0, sizeof (struct sockaddr_un)); 49403100a63Svk199839 sunaddr.sun_family = AF_UNIX; 49503100a63Svk199839 49603100a63Svk199839 if (strlcpy(sunaddr.sun_path, path, sizeof (sunaddr.sun_path)) >= 49703100a63Svk199839 sizeof (sunaddr.sun_path)) { 49803100a63Svk199839 (void) close(s); 49903100a63Svk199839 errno = ENAMETOOLONG; 50003100a63Svk199839 return (-1); 50103100a63Svk199839 } 50203100a63Svk199839 50303100a63Svk199839 if (bind(s, (struct sockaddr *)&sunaddr, SUN_LEN(&sunaddr)) < 0) { 50403100a63Svk199839 (void) close(s); 50503100a63Svk199839 return (-1); 50603100a63Svk199839 } 50703100a63Svk199839 50803100a63Svk199839 if (listen(s, 5) < 0) { 50903100a63Svk199839 (void) close(s); 51003100a63Svk199839 return (-1); 51103100a63Svk199839 } 51203100a63Svk199839 return (s); 51303100a63Svk199839 } 51403100a63Svk199839 51503100a63Svk199839 /* 51603100a63Svk199839 * remote_connect() 51703100a63Svk199839 * Returns a socket connected to a remote host. Properly binds to a local 51803100a63Svk199839 * port or source address if needed. Returns -1 on failure. 51903100a63Svk199839 */ 52003100a63Svk199839 int 52103100a63Svk199839 remote_connect(const char *host, const char *port, struct addrinfo hints) 52203100a63Svk199839 { 52303100a63Svk199839 struct addrinfo *res, *res0; 52403100a63Svk199839 int s, error; 52503100a63Svk199839 52603100a63Svk199839 if ((error = getaddrinfo(host, port, &hints, &res))) 52703100a63Svk199839 errx(1, "getaddrinfo: %s", gai_strerror(error)); 52803100a63Svk199839 52903100a63Svk199839 res0 = res; 53003100a63Svk199839 do { 53103100a63Svk199839 if ((s = socket(res0->ai_family, res0->ai_socktype, 53203100a63Svk199839 res0->ai_protocol)) < 0) { 53303100a63Svk199839 warn("failed to create socket"); 53403100a63Svk199839 continue; 53503100a63Svk199839 } 53603100a63Svk199839 53703100a63Svk199839 /* Bind to a local port or source address if specified. */ 53803100a63Svk199839 if (sflag || pflag) { 53903100a63Svk199839 struct addrinfo ahints, *ares; 54003100a63Svk199839 54103100a63Svk199839 (void) memset(&ahints, 0, sizeof (struct addrinfo)); 54203100a63Svk199839 ahints.ai_family = res0->ai_family; 54303100a63Svk199839 ahints.ai_socktype = uflag ? SOCK_DGRAM : SOCK_STREAM; 54403100a63Svk199839 ahints.ai_protocol = uflag ? IPPROTO_UDP : IPPROTO_TCP; 54503100a63Svk199839 ahints.ai_flags = AI_PASSIVE; 54603100a63Svk199839 if ((error = getaddrinfo(sflag, pflag, &ahints, &ares))) 54703100a63Svk199839 errx(1, "getaddrinfo: %s", gai_strerror(error)); 54803100a63Svk199839 54903100a63Svk199839 if (bind(s, (struct sockaddr *)ares->ai_addr, 55003100a63Svk199839 ares->ai_addrlen) < 0) 55103100a63Svk199839 errx(1, "bind failed: %s", strerror(errno)); 55203100a63Svk199839 freeaddrinfo(ares); 553f8c3982aSvk199839 554f8c3982aSvk199839 if (vflag && !lflag) { 555f8c3982aSvk199839 if (sflag != NULL) 556f8c3982aSvk199839 (void) fprintf(stderr, 557f8c3982aSvk199839 "Using source address: %s\n", 558f8c3982aSvk199839 sflag); 559f8c3982aSvk199839 if (pflag != NULL) 560f8c3982aSvk199839 (void) fprintf(stderr, 561f8c3982aSvk199839 "Using source port: %s\n", pflag); 562f8c3982aSvk199839 } 56303100a63Svk199839 } 56403100a63Svk199839 56503100a63Svk199839 set_common_sockopts(s); 56603100a63Svk199839 56703100a63Svk199839 if (connect(s, res0->ai_addr, res0->ai_addrlen) == 0) 56803100a63Svk199839 break; 569f8c3982aSvk199839 else if (vflag) { 570f8c3982aSvk199839 char ntop[NI_MAXHOST + NI_MAXSERV]; 571f8c3982aSvk199839 warn("connect to %s [host %s] (%s) failed", 572f8c3982aSvk199839 print_addr(ntop, sizeof (ntop), 573f8c3982aSvk199839 res0->ai_addr, res0->ai_addrlen, NI_NUMERICHOST), 574f8c3982aSvk199839 host, uflag ? "udp" : "tcp"); 575f8c3982aSvk199839 } 57603100a63Svk199839 57703100a63Svk199839 (void) close(s); 57803100a63Svk199839 s = -1; 57903100a63Svk199839 } while ((res0 = res0->ai_next) != NULL); 58003100a63Svk199839 58103100a63Svk199839 freeaddrinfo(res); 58203100a63Svk199839 58303100a63Svk199839 return (s); 58403100a63Svk199839 } 58503100a63Svk199839 58603100a63Svk199839 /* 58703100a63Svk199839 * local_listen() 58803100a63Svk199839 * Returns a socket listening on a local port, binds to specified source 58903100a63Svk199839 * address. Returns -1 on failure. 59003100a63Svk199839 */ 59103100a63Svk199839 int 59203100a63Svk199839 local_listen(char *host, char *port, struct addrinfo hints) 59303100a63Svk199839 { 59403100a63Svk199839 struct addrinfo *res, *res0; 59503100a63Svk199839 int s, ret, x = 1; 59603100a63Svk199839 int error; 59703100a63Svk199839 59803100a63Svk199839 /* Allow nodename to be null. */ 59903100a63Svk199839 hints.ai_flags |= AI_PASSIVE; 60003100a63Svk199839 60103100a63Svk199839 if ((error = getaddrinfo(host, port, &hints, &res))) 60203100a63Svk199839 errx(1, "getaddrinfo: %s", gai_strerror(error)); 60303100a63Svk199839 60403100a63Svk199839 res0 = res; 60503100a63Svk199839 do { 60603100a63Svk199839 if ((s = socket(res0->ai_family, res0->ai_socktype, 60703100a63Svk199839 res0->ai_protocol)) < 0) { 60803100a63Svk199839 warn("failed to create socket"); 60903100a63Svk199839 continue; 61003100a63Svk199839 } 61103100a63Svk199839 61203100a63Svk199839 ret = setsockopt(s, SOL_SOCKET, SO_REUSEADDR, &x, sizeof (x)); 61303100a63Svk199839 if (ret == -1) 61403100a63Svk199839 err(1, NULL); 61503100a63Svk199839 61603100a63Svk199839 set_common_sockopts(s); 61703100a63Svk199839 61803100a63Svk199839 if (bind(s, (struct sockaddr *)res0->ai_addr, 61903100a63Svk199839 res0->ai_addrlen) == 0) 62003100a63Svk199839 break; 62103100a63Svk199839 62203100a63Svk199839 (void) close(s); 62303100a63Svk199839 s = -1; 62403100a63Svk199839 } while ((res0 = res0->ai_next) != NULL); 62503100a63Svk199839 62603100a63Svk199839 if (!uflag && s != -1) { 62703100a63Svk199839 if (listen(s, 1) < 0) 62803100a63Svk199839 err(1, "listen"); 62903100a63Svk199839 } 63003100a63Svk199839 63103100a63Svk199839 freeaddrinfo(res); 63203100a63Svk199839 63303100a63Svk199839 return (s); 63403100a63Svk199839 } 63503100a63Svk199839 63603100a63Svk199839 /* 63703100a63Svk199839 * readwrite() 63803100a63Svk199839 * Loop that polls on the network file descriptor and stdin. 63903100a63Svk199839 */ 64003100a63Svk199839 void 64103100a63Svk199839 readwrite(int nfd) 64203100a63Svk199839 { 64303100a63Svk199839 struct pollfd pfd[2]; 64403100a63Svk199839 unsigned char buf[8192]; 64503100a63Svk199839 int n, wfd = fileno(stdin); 64603100a63Svk199839 int lfd = fileno(stdout); 64703100a63Svk199839 int plen; 64803100a63Svk199839 64903100a63Svk199839 plen = 1024; 65003100a63Svk199839 65103100a63Svk199839 /* Setup Network FD */ 65203100a63Svk199839 pfd[0].fd = nfd; 65303100a63Svk199839 pfd[0].events = POLLIN; 65403100a63Svk199839 65503100a63Svk199839 /* Set up STDIN FD. */ 65603100a63Svk199839 pfd[1].fd = wfd; 65703100a63Svk199839 pfd[1].events = POLLIN; 65803100a63Svk199839 65903100a63Svk199839 while (pfd[0].fd != -1) { 66003100a63Svk199839 if (iflag) 66103100a63Svk199839 (void) sleep(iflag); 66203100a63Svk199839 66303100a63Svk199839 if ((n = poll(pfd, 2 - dflag, timeout)) < 0) { 66403100a63Svk199839 (void) close(nfd); 66503100a63Svk199839 err(1, "Polling Error"); 66603100a63Svk199839 } 66703100a63Svk199839 66803100a63Svk199839 if (n == 0) 66903100a63Svk199839 return; 67003100a63Svk199839 67103100a63Svk199839 if (pfd[0].revents & (POLLIN|POLLHUP)) { 67203100a63Svk199839 if ((n = read(nfd, buf, plen)) < 0) 67303100a63Svk199839 return; 67403100a63Svk199839 else if (n == 0) { 67503100a63Svk199839 (void) shutdown(nfd, SHUT_RD); 67603100a63Svk199839 pfd[0].fd = -1; 67703100a63Svk199839 pfd[0].events = 0; 67803100a63Svk199839 } else { 67903100a63Svk199839 if (tflag) 68003100a63Svk199839 atelnet(nfd, buf, n); 68103100a63Svk199839 if (atomicio(vwrite, lfd, buf, n) != n) 68203100a63Svk199839 return; 68303100a63Svk199839 } 68403100a63Svk199839 } 68503100a63Svk199839 68603100a63Svk199839 /* 68703100a63Svk199839 * handle the case of disconnected pipe: after pipe 68803100a63Svk199839 * is closed (indicated by POLLHUP) there may still 68903100a63Svk199839 * be some data lingering (POLLIN). After we read 69003100a63Svk199839 * the data, only POLLHUP remains, read() returns 0 69103100a63Svk199839 * and we are finished. 69203100a63Svk199839 */ 69303100a63Svk199839 if (!dflag && (pfd[1].revents & (POLLIN|POLLHUP))) { 69403100a63Svk199839 if ((n = read(wfd, buf, plen)) < 0) 69503100a63Svk199839 return; 69603100a63Svk199839 else if (n == 0) { 69703100a63Svk199839 (void) shutdown(nfd, SHUT_WR); 69803100a63Svk199839 pfd[1].fd = -1; 69903100a63Svk199839 pfd[1].events = 0; 70003100a63Svk199839 } else { 70103100a63Svk199839 if (atomicio(vwrite, nfd, buf, n) != n) 70203100a63Svk199839 return; 70303100a63Svk199839 } 70403100a63Svk199839 } 70503100a63Svk199839 } 70603100a63Svk199839 } 70703100a63Svk199839 70803100a63Svk199839 /* Deal with RFC 854 WILL/WONT DO/DONT negotiation. */ 70903100a63Svk199839 void 71003100a63Svk199839 atelnet(int nfd, unsigned char *buf, unsigned int size) 71103100a63Svk199839 { 71203100a63Svk199839 unsigned char *p, *end; 71303100a63Svk199839 unsigned char obuf[4]; 71403100a63Svk199839 71503100a63Svk199839 end = buf + size; 71603100a63Svk199839 obuf[0] = '\0'; 71703100a63Svk199839 71803100a63Svk199839 for (p = buf; p < end; p++) { 71903100a63Svk199839 if (*p != IAC) 72003100a63Svk199839 break; 72103100a63Svk199839 72203100a63Svk199839 obuf[0] = IAC; 72303100a63Svk199839 obuf[1] = 0; 72403100a63Svk199839 p++; 72503100a63Svk199839 /* refuse all options */ 72603100a63Svk199839 if ((*p == WILL) || (*p == WONT)) 72703100a63Svk199839 obuf[1] = DONT; 72803100a63Svk199839 if ((*p == DO) || (*p == DONT)) 72903100a63Svk199839 obuf[1] = WONT; 73003100a63Svk199839 if (obuf[1]) { 73103100a63Svk199839 p++; 73203100a63Svk199839 obuf[2] = *p; 73303100a63Svk199839 obuf[3] = '\0'; 73403100a63Svk199839 if (atomicio(vwrite, nfd, obuf, 3) != 3) 73503100a63Svk199839 warn("Write Error!"); 73603100a63Svk199839 obuf[0] = '\0'; 73703100a63Svk199839 } 73803100a63Svk199839 } 73903100a63Svk199839 } 74003100a63Svk199839 74103100a63Svk199839 /* 74203100a63Svk199839 * build_ports() 74303100a63Svk199839 * Build an array of ports in portlist[], listing each port 74403100a63Svk199839 * that we should try to connect to. 74503100a63Svk199839 */ 74603100a63Svk199839 void 74703100a63Svk199839 build_ports(char *p) 74803100a63Svk199839 { 74903100a63Svk199839 const char *errstr; 75003100a63Svk199839 char *n; 75103100a63Svk199839 int hi, lo, cp; 75203100a63Svk199839 int x = 0; 75303100a63Svk199839 75403100a63Svk199839 if ((n = strchr(p, '-')) != NULL) { 75503100a63Svk199839 if (lflag) 75603100a63Svk199839 errx(1, "Cannot use -l with multiple ports!"); 75703100a63Svk199839 75803100a63Svk199839 *n = '\0'; 75903100a63Svk199839 n++; 76003100a63Svk199839 76103100a63Svk199839 /* Make sure the ports are in order: lowest->highest. */ 76203100a63Svk199839 hi = strtonum(n, PORT_MIN, PORT_MAX, &errstr); 76303100a63Svk199839 if (errstr) 76403100a63Svk199839 errx(1, "port number %s: %s", errstr, n); 76503100a63Svk199839 lo = strtonum(p, PORT_MIN, PORT_MAX, &errstr); 76603100a63Svk199839 if (errstr) 76703100a63Svk199839 errx(1, "port number %s: %s", errstr, p); 76803100a63Svk199839 76903100a63Svk199839 if (lo > hi) { 77003100a63Svk199839 cp = hi; 77103100a63Svk199839 hi = lo; 77203100a63Svk199839 lo = cp; 77303100a63Svk199839 } 77403100a63Svk199839 77503100a63Svk199839 /* Load ports sequentially. */ 77603100a63Svk199839 for (cp = lo; cp <= hi; cp++) { 77703100a63Svk199839 portlist[x] = calloc(1, PORT_MAX_LEN); 77803100a63Svk199839 if (portlist[x] == NULL) 77903100a63Svk199839 err(1, NULL); 78003100a63Svk199839 (void) snprintf(portlist[x], PORT_MAX_LEN, "%d", cp); 78103100a63Svk199839 x++; 78203100a63Svk199839 } 78303100a63Svk199839 78403100a63Svk199839 /* Randomly swap ports. */ 78503100a63Svk199839 if (rflag) { 78603100a63Svk199839 int y; 78703100a63Svk199839 char *c; 78803100a63Svk199839 78903100a63Svk199839 srandom(time((time_t *)0)); 79003100a63Svk199839 79103100a63Svk199839 for (x = 0; x <= (hi - lo); x++) { 79203100a63Svk199839 y = (random() & 0xFFFF) % (hi - lo); 79303100a63Svk199839 c = portlist[x]; 79403100a63Svk199839 portlist[x] = portlist[y]; 79503100a63Svk199839 portlist[y] = c; 79603100a63Svk199839 } 79703100a63Svk199839 } 79803100a63Svk199839 } else { 79903100a63Svk199839 hi = strtonum(p, PORT_MIN, PORT_MAX, &errstr); 80003100a63Svk199839 if (errstr) 80103100a63Svk199839 errx(1, "port number %s: %s", errstr, p); 80203100a63Svk199839 portlist[0] = calloc(1, PORT_MAX_LEN); 80303100a63Svk199839 if (portlist[0] == NULL) 80403100a63Svk199839 err(1, NULL); 80503100a63Svk199839 portlist[0] = p; 80603100a63Svk199839 } 80703100a63Svk199839 } 80803100a63Svk199839 80903100a63Svk199839 /* 81003100a63Svk199839 * udptest() 81103100a63Svk199839 * Do a few writes to see if the UDP port is there. 81203100a63Svk199839 * XXX - Better way of doing this? Doesn't work for IPv6. 81303100a63Svk199839 * Also fails after around 100 ports checked. 81403100a63Svk199839 */ 81503100a63Svk199839 int 81603100a63Svk199839 udptest(int s) 81703100a63Svk199839 { 81803100a63Svk199839 int i, ret; 81903100a63Svk199839 82003100a63Svk199839 for (i = 0; i <= 3; i++) { 82103100a63Svk199839 if (write(s, "X", 1) == 1) 82203100a63Svk199839 ret = 1; 82303100a63Svk199839 else 82403100a63Svk199839 ret = -1; 82503100a63Svk199839 } 82603100a63Svk199839 return (ret); 82703100a63Svk199839 } 82803100a63Svk199839 82903100a63Svk199839 void 83003100a63Svk199839 set_common_sockopts(int s) 83103100a63Svk199839 { 83203100a63Svk199839 int x = 1; 83303100a63Svk199839 83403100a63Svk199839 if (Dflag) { 83503100a63Svk199839 if (setsockopt(s, SOL_SOCKET, SO_DEBUG, &x, sizeof (x)) == -1) 83603100a63Svk199839 err(1, NULL); 83703100a63Svk199839 } 83803100a63Svk199839 if (Tflag != -1) { 83903100a63Svk199839 if (setsockopt(s, IPPROTO_IP, IP_TOS, &Tflag, 84003100a63Svk199839 sizeof (Tflag)) == -1) 84103100a63Svk199839 err(1, "set IP ToS"); 84203100a63Svk199839 } 84303100a63Svk199839 } 84403100a63Svk199839 84503100a63Svk199839 int 84603100a63Svk199839 parse_iptos(char *s) 84703100a63Svk199839 { 84803100a63Svk199839 int tos = -1; 84903100a63Svk199839 85003100a63Svk199839 if (strcmp(s, "lowdelay") == 0) 85103100a63Svk199839 return (IPTOS_LOWDELAY); 85203100a63Svk199839 if (strcmp(s, "throughput") == 0) 85303100a63Svk199839 return (IPTOS_THROUGHPUT); 85403100a63Svk199839 if (strcmp(s, "reliability") == 0) 85503100a63Svk199839 return (IPTOS_RELIABILITY); 85603100a63Svk199839 85703100a63Svk199839 if (sscanf(s, "0x%x", (unsigned int *) &tos) != 1 || 85803100a63Svk199839 tos < 0 || tos > 0xff) 85903100a63Svk199839 errx(1, "invalid IP Type of Service"); 86003100a63Svk199839 return (tos); 86103100a63Svk199839 } 86203100a63Svk199839 86303100a63Svk199839 void 86403100a63Svk199839 help(void) 86503100a63Svk199839 { 86603100a63Svk199839 usage(0); 86703100a63Svk199839 (void) fprintf(stderr, "\tCommand Summary:\n\ 86803100a63Svk199839 \t-4 Use IPv4\n\ 86903100a63Svk199839 \t-6 Use IPv6\n\ 87003100a63Svk199839 \t-D Enable the debug socket option\n\ 87103100a63Svk199839 \t-d Detach from stdin\n\ 87203100a63Svk199839 \t-h This help text\n\ 87303100a63Svk199839 \t-i secs\t Delay interval for lines sent, ports scanned\n\ 87403100a63Svk199839 \t-k Keep inbound sockets open for multiple connects\n\ 87503100a63Svk199839 \t-l Listen mode, for inbound connects\n\ 87603100a63Svk199839 \t-n Suppress name/port resolutions\n\ 87703100a63Svk199839 \t-P proxyuser\tUsername for proxy authentication\n\ 87803100a63Svk199839 \t-p port\t Specify local port or listen port\n\ 87903100a63Svk199839 \t-r Randomize remote ports\n\ 88003100a63Svk199839 \t-s addr\t Local source address\n\ 88103100a63Svk199839 \t-T ToS\t Set IP Type of Service\n\ 88203100a63Svk199839 \t-t Answer TELNET negotiation\n\ 88303100a63Svk199839 \t-U Use UNIX domain socket\n\ 88403100a63Svk199839 \t-u UDP mode\n\ 88503100a63Svk199839 \t-v Verbose\n\ 88603100a63Svk199839 \t-w secs\t Timeout for connects and final net reads\n\ 88703100a63Svk199839 \t-X proto Proxy protocol: \"4\", \"5\" (SOCKS) or \"connect\"\n\ 88803100a63Svk199839 \t-x addr[:port]\tSpecify proxy address and port\n\ 88903100a63Svk199839 \t-z Zero-I/O mode [used for scanning]\n\ 89003100a63Svk199839 Port numbers can be individual or ranges: lo-hi [inclusive]\n"); 89103100a63Svk199839 exit(1); 89203100a63Svk199839 } 89303100a63Svk199839 89403100a63Svk199839 void 89503100a63Svk199839 usage(int ret) 89603100a63Svk199839 { 89703100a63Svk199839 (void) fprintf(stderr, 89803100a63Svk199839 "usage: nc [-46DdhklnrtUuvz] [-i interval] [-P proxy_username]" 89903100a63Svk199839 " [-p port]\n"); 90003100a63Svk199839 (void) fprintf(stderr, 90103100a63Svk199839 "\t [-s source_ip_address] [-T ToS] [-w timeout]" 90203100a63Svk199839 " [-X proxy_protocol]\n"); 90303100a63Svk199839 (void) fprintf(stderr, 90403100a63Svk199839 "\t [-x proxy_address[:port]] [hostname]" 90503100a63Svk199839 " [port[s]]\n"); 90603100a63Svk199839 if (ret) 90703100a63Svk199839 exit(1); 90803100a63Svk199839 } 909