Annotation of src/usr.bin/nc/netcat.c, Revision 1.15
1.15 ! ericj 1: /* $OpenBSD: netcat.c,v 1.14 2000/09/26 05:16:00 ericj Exp $ */
1.11 ericj 2:
1.1 deraadt 3: /* Netcat 1.10 RELEASE 960320
1.7 deraadt 4: *
5: * A damn useful little "backend" utility begun 950915 or thereabouts,
6: * as *Hobbit*'s first real stab at some sockets programming. Something that
7: * should have and indeed may have existed ten years ago, but never became a
8: * standard Unix utility. IMHO, "nc" could take its place right next to cat,
9: * cp, rm, mv, dd, ls, and all those other cryptic and Unix-like things.
10: *
11: * Read the README for the whole story, doc, applications, etc.
12: *
13: * Layout:
14: * conditional includes:
15: * includes:
16: * handy defines:
17: * globals:
18: * malloced globals:
19: * cmd-flag globals:
20: * support routines:
21: * readwrite select loop:
22: * main:
23: *
24: * bluesky:
25: * parse ranges of IP address as well as ports, perhaps
26: * RAW mode!
27: * backend progs to grab a pty and look like a real telnetd?!
28: * backend progs to do various encryption modes??!?!
1.1 deraadt 29: */
30:
31:
32: #define HAVE_BIND /* ASSUMPTION -- seems to work everywhere! */
33:
1.7 deraadt 34: #include <sys/types.h>
35: #include <sys/time.h>
36: #include <sys/select.h>
37: #include <sys/socket.h>
38: #include <netinet/in.h>
39: #include <netinet/in_systm.h>
40: #include <netinet/ip.h>
41: #include <arpa/inet.h>
42: #include <netdb.h> /* hostent, gethostby*, getservby* */
43: #include <stdio.h>
44: #include <string.h>
1.11 ericj 45: #include <err.h>
1.7 deraadt 46: #include <errno.h>
47: #include <setjmp.h>
48: #include <signal.h>
49: #include <fcntl.h>
1.13 ericj 50: #include <stdarg.h>
1.1 deraadt 51: #include <stdlib.h>
1.5 art 52: #include <unistd.h>
1.1 deraadt 53:
1.11 ericj 54: /* Random Numbers aren't too needed here */
55: #define SRAND srandom
56: #define RAND random
1.1 deraadt 57:
58: #define SLEAZE_PORT 31337 /* for UDP-scan RTT trick, change if ya want */
59: #define BIGSIZ 8192 /* big buffers */
60:
1.7 deraadt 61: struct host_info {
1.11 ericj 62: char name[MAXHOSTNAMELEN]; /* DNS name */
63: char addrs[8][24]; /* ascii-format IP addresses */
64: struct in_addr iaddrs[8]; /* in_addr.s_addr: ulong */
1.1 deraadt 65: };
66:
1.7 deraadt 67: struct port_info {
1.6 deraadt 68: char name[64]; /* name in /etc/services */
69: char anum[8]; /* ascii-format number */
1.7 deraadt 70: u_short num; /* real host-order number */
1.1 deraadt 71: };
72:
73: /* globals: */
1.11 ericj 74: jmp_buf jbuf; /* timer jump buffer*/
1.6 deraadt 75: int jval = 0; /* timer crud */
76: int netfd = -1;
77: int ofd = 0; /* hexdump output fd */
1.7 deraadt 78:
1.13 ericj 79: /* extern int h_errno; */
1.7 deraadt 80:
1.6 deraadt 81: int gatesidx = 0; /* LSRR hop count */
82: int gatesptr = 4; /* initial LSRR pointer, settable */
1.7 deraadt 83: u_short Single = 1; /* zero if scanning */
1.1 deraadt 84: unsigned int insaved = 0; /* stdin-buffer size for multi-mode */
85: unsigned int wrote_out = 0; /* total stdout bytes */
86: unsigned int wrote_net = 0; /* total net bytes */
87: static char hexnibs[20] = "0123456789abcdef ";
88:
89: /* will malloc up the following globals: */
1.7 deraadt 90: struct timeval timer1, timer2;
1.11 ericj 91: struct sockaddr_in *lclend = NULL; /* sockaddr_in structs */
1.7 deraadt 92: struct sockaddr_in *remend = NULL;
1.11 ericj 93: struct host_info **gates = NULL; /* LSRR hop hinfo */
94: char *optbuf = NULL; /* LSRR or sockopts */
95: char *bigbuf_in; /* data buffers */
1.6 deraadt 96: char *bigbuf_net;
1.7 deraadt 97: fd_set fds1, fds2;
1.11 ericj 98: struct port_info *pinfo = NULL; /* for getpinfo / getservby* */
99: unsigned char *stage = NULL; /* hexdump line buffer */
1.1 deraadt 100:
101: /* global cmd flags: */
1.7 deraadt 102: u_short o_alla = 0;
1.1 deraadt 103: unsigned int o_interval = 0;
1.7 deraadt 104: u_short o_listen = 0;
105: u_short o_nflag = 0;
106: u_short o_wfile = 0;
107: u_short o_random = 0;
108: u_short o_udpmode = 0;
109: u_short o_verbose = 0;
1.1 deraadt 110: unsigned int o_wait = 0;
1.7 deraadt 111: u_short o_zero = 0;
1.1 deraadt 112:
1.11 ericj 113: /* Function Prototype's */
1.13 ericj 114: void help __P(());
1.11 ericj 115: void usage __P((int));
1.13 ericj 116: void nlog __P((int, char *, ...));
1.11 ericj 117:
118: /*
119: * support routines -- the bulk of this thing. Placed in such an order that
120: * we don't have to forward-declare anything:
121: */
122:
123: /*
124: * catch :
125: * no-brainer interrupt handler
126: */
1.6 deraadt 127: void
128: catch()
1.1 deraadt 129: {
1.6 deraadt 130: errno = 0;
131: if (o_verbose > 1) /* normally we don't care */
1.13 ericj 132: nlog(1, "Sent %i Rcvd %i", wrote_net, wrote_out);
133: nlog(1, " punt!");
1.1 deraadt 134: }
135:
136: /* timeout and other signal handling cruft */
1.6 deraadt 137: void
138: tmtravel()
1.1 deraadt 139: {
1.6 deraadt 140: signal(SIGALRM, SIG_IGN);
141: alarm(0);
142: if (jval == 0)
1.13 ericj 143: nlog(1, "spurious timer interrupt!");
1.6 deraadt 144: longjmp(jbuf, jval);
1.1 deraadt 145: }
146:
1.11 ericj 147: /*
148: * arm :
149: * set the timer. Zero secs arg means unarm
150: */
1.6 deraadt 151: void
152: arm(num, secs)
153: unsigned int num;
154: unsigned int secs;
155: {
1.11 ericj 156: if (secs == 0) {
1.6 deraadt 157: signal(SIGALRM, SIG_IGN);
158: alarm(0);
159: jval = 0;
1.11 ericj 160: } else {
1.6 deraadt 161: signal(SIGALRM, tmtravel);
162: alarm(secs);
163: jval = num;
1.11 ericj 164: }
1.7 deraadt 165: }
1.1 deraadt 166:
1.11 ericj 167: /*
168: * findline :
169: * find the next newline in a buffer; return inclusive size of that "line",
170: * or the entire buffer size, so the caller knows how much to then write().
171: * Not distinguishing \n vs \r\n for the nonce; it just works as is...
172: */
1.6 deraadt 173: unsigned int
174: findline(buf, siz)
175: char *buf;
176: unsigned int siz;
177: {
1.11 ericj 178: char *p;
179: int x;
1.6 deraadt 180: if (!buf) /* various sanity checks... */
181: return (0);
182: if (siz > BIGSIZ)
183: return (0);
184: x = siz;
185: for (p = buf; x > 0; x--) {
186: if (*p == '\n') {
187: x = (int) (p - buf);
188: x++; /* 'sokay if it points just past the end! */
189: return (x);
190: }
191: p++;
1.11 ericj 192: }
1.6 deraadt 193: return (siz);
1.7 deraadt 194: }
1.1 deraadt 195:
1.11 ericj 196: /*
197: * comparehosts :
198: * cross-check the host_info we have so far against new gethostby*() info,
199: * and holler about mismatches. Perhaps gratuitous, but it can't hurt to
200: * point out when someone's DNS is fukt. Returns 1 if mismatch, in case
201: * someone else wants to do something about it.
202: */
1.6 deraadt 203: int
1.11 ericj 204: comparehosts(hinfo, hp)
205: struct host_info *hinfo;
1.6 deraadt 206: struct hostent *hp;
207: {
208: errno = 0;
209: h_errno = 0;
1.11 ericj 210: if (strcasecmp(hinfo->name, hp->h_name) != 0) {
1.13 ericj 211: nlog(0, "DNS fwd/rev mismatch: %s != %s", hinfo->name, hp->h_name);
1.6 deraadt 212: return (1);
213: }
214: return (0);
1.7 deraadt 215: }
1.1 deraadt 216:
1.11 ericj 217: /*
218: * gethinfo:
219: * resolve a host 8 ways from sunday; return a new host_info struct with its
220: * info. The argument can be a name or [ascii] IP address; it will try its
221: * damndest to deal with it. "numeric" governs whether we do any DNS at all,
222: * and we also check o_verbose for what's appropriate work to do.
223: */
1.7 deraadt 224: struct host_info *
1.11 ericj 225: gethinfo(name, numeric)
1.6 deraadt 226: char *name;
1.7 deraadt 227: u_short numeric;
1.6 deraadt 228: {
229: struct hostent *hostent;
230: struct in_addr iaddr;
1.11 ericj 231: struct host_info *hinfo = NULL;
232: int x;
1.1 deraadt 233:
1.6 deraadt 234: errno = 0;
235: h_errno = 0;
236: if (name)
1.11 ericj 237: hinfo = (struct host_info *) calloc(1, sizeof(struct host_info));
238:
239: if (!hinfo)
1.13 ericj 240: nlog(1, "error obtaining host information");
1.11 ericj 241:
242: strlcpy(hinfo->name, "(UNKNOWN)", sizeof(hinfo->name));
1.7 deraadt 243: if (inet_aton(name, &iaddr) == 0) {
1.11 ericj 244: if (numeric)
1.13 ericj 245: nlog(1, "Can't parse %s as an IP address", name);
1.6 deraadt 246:
1.11 ericj 247: /*
248: * failure to look up a name is fatal,
249: * since we can't do anything with it.
250: */
1.6 deraadt 251: hostent = gethostbyname(name);
252: if (!hostent)
1.13 ericj 253: nlog(1, "%s: forward host lookup failed: ", name);
1.11 ericj 254:
255: strlcpy(hinfo->name, hostent->h_name, MAXHOSTNAMELEN);
1.6 deraadt 256: for (x = 0; hostent->h_addr_list[x] && (x < 8); x++) {
1.11 ericj 257: memcpy(&hinfo->iaddrs[x], hostent->h_addr_list[x],
1.7 deraadt 258: sizeof(struct in_addr));
1.11 ericj 259: strlcpy(hinfo->addrs[x], inet_ntoa(hinfo->iaddrs[x]),
260: sizeof(hinfo->addrs[0]));
1.7 deraadt 261: }
1.11 ericj 262: /* Go ahead and return if we don't want to view more */
263: if (!o_verbose)
264: return (hinfo);
265:
266: /*
267: * Do inverse lookups in separate loop based on our collected
268: * forward addrs, since gethostby* tends to crap into the same
269: * buffer over and over.
270: */
271: for (x = 0; hinfo->iaddrs[x].s_addr && (x < 8); x++) {
272: hostent = gethostbyaddr((char *) &hinfo->iaddrs[x],
1.7 deraadt 273: sizeof(struct in_addr), AF_INET);
1.6 deraadt 274: if ((!hostent) || (!hostent->h_name))
1.13 ericj 275: nlog(0, "Warning: inverse host lookup failed for %s: ",
1.11 ericj 276: hinfo->addrs[x]);
1.6 deraadt 277: else
1.11 ericj 278: (void) comparehosts(hinfo, hostent);
279: }
1.6 deraadt 280:
281: } else { /* not INADDR_NONE: numeric addresses... */
1.11 ericj 282: memcpy(hinfo->iaddrs, &iaddr, sizeof(struct in_addr));
283: strlcpy(hinfo->addrs[0], inet_ntoa(iaddr), sizeof(hinfo->addrs));
284: /* If all that's wanted is numeric IP, go ahead and leave */
285: if (numeric)
286: return (hinfo);
287:
288: /* Go ahead and return if we don't want to view more */
289: if (!o_verbose)
290: return (hinfo);
291:
292: hostent = gethostbyaddr((char *) &iaddr,
293: sizeof(struct in_addr), AF_INET);
294:
295: /*
296: * numeric or not, failure to look up a PTR is
297: * *not* considered fatal
298: */
1.6 deraadt 299: if (!hostent)
1.13 ericj 300: nlog(0, "%s: inverse host lookup failed: ", name);
1.6 deraadt 301: else {
1.11 ericj 302: strlcpy(hinfo->name, hostent->h_name, MAXHOSTNAMELEN);
303: hostent = gethostbyname(hinfo->name);
1.6 deraadt 304: if ((!hostent) || (!hostent->h_addr_list[0]))
1.13 ericj 305: nlog(0, "Warning: forward host lookup failed for %s: ",
1.11 ericj 306: hinfo->name);
1.6 deraadt 307: else
1.11 ericj 308: (void) comparehosts(hinfo, hostent);
309: }
310: }
1.1 deraadt 311:
1.11 ericj 312: /*
313: * Whatever-all went down previously, we should now have a host_info
314: * struct with at least one IP address in it.
315: */
1.6 deraadt 316: h_errno = 0;
1.11 ericj 317: return (hinfo);
1.7 deraadt 318: }
1.1 deraadt 319:
1.11 ericj 320: /*
321: * getpinfo:
322: * Same general idea as gethinfo-- look up a port in /etc/services, fill
323: * in global port_info, but return the actual port *number*. Pass ONE of:
324: * pstring to resolve stuff like "23" or "exec";
325: * pnum to reverse-resolve something that's already a number.
326: * If o_nflag is on, fill in what we can but skip the getservby??? stuff.
327: * Might as well have consistent behavior here, and it *is* faster.
328: */
1.7 deraadt 329: u_short
1.11 ericj 330: getpinfo(pstring, pnum)
1.6 deraadt 331: char *pstring;
332: unsigned int pnum;
333: {
334: struct servent *servent;
1.11 ericj 335: int x;
336: int y;
1.7 deraadt 337: char *whichp = "tcp";
1.6 deraadt 338: if (o_udpmode)
1.7 deraadt 339: whichp = "udp";
1.1 deraadt 340:
1.11 ericj 341: pinfo->name[0] = '?';/* fast preload */
342: pinfo->name[1] = '\0';
343:
344: /*
345: * case 1: reverse-lookup of a number; placed first since this case
346: * is much more frequent if we're scanning.
347: */
1.6 deraadt 348: if (pnum) {
1.11 ericj 349: /* Can't be both */
350: if (pstring)
1.6 deraadt 351: return (0);
1.11 ericj 352:
1.6 deraadt 353: x = pnum;
354: if (o_nflag) /* go faster, skip getservbyblah */
355: goto gp_finish;
356: y = htons(x); /* gotta do this -- see Fig.1 below */
357: servent = getservbyport(y, whichp);
358: if (servent) {
359: y = ntohs(servent->s_port);
360: if (x != y) /* "never happen" */
1.13 ericj 361: nlog(0, "Warning: port-bynum mismatch, %d != %d", x, y);
1.11 ericj 362: strlcpy(pinfo->name, servent->s_name,
363: sizeof(pinfo->name));
1.7 deraadt 364: }
1.6 deraadt 365: goto gp_finish;
1.11 ericj 366: }
367: /*
368: * case 2: resolve a string, but we still give preference to numbers
1.6 deraadt 369: * instead of trying to resolve conflicts. None of the entries in *my*
370: * extensive /etc/services begins with a digit, so this should "always
371: * work" unless you're at 3com and have some company-internal services
1.11 ericj 372: * defined.
373: */
1.6 deraadt 374: if (pstring) {
1.11 ericj 375: /* Can't be both */
376: if (pnum)
1.6 deraadt 377: return (0);
1.11 ericj 378:
1.6 deraadt 379: x = atoi(pstring);
380: if (x)
1.11 ericj 381: return (getpinfo(NULL, x)); /* recurse for
1.6 deraadt 382: * numeric-string-arg */
383: if (o_nflag) /* can't use names! */
384: return (0);
385: servent = getservbyname(pstring, whichp);
386: if (servent) {
1.11 ericj 387: strlcpy(pinfo->name, servent->s_name,
388: sizeof(pinfo->name));
1.6 deraadt 389: x = ntohs(servent->s_port);
390: goto gp_finish;
391: } /* if servent */
392: } /* if pstring */
393: return (0); /* catches any problems so far */
1.1 deraadt 394:
395: gp_finish:
1.11 ericj 396: /*
397: * Fall here whether or not we have a valid servent at this point, with
398: * x containing our [host-order and therefore useful, dammit] port number.
399: */
400: sprintf(pinfo->anum, "%d", x); /* always load any numeric
1.6 deraadt 401: * specs! */
1.11 ericj 402: pinfo->num = (x & 0xffff); /* u_short, remember... */
403: return (pinfo->num);
1.7 deraadt 404: }
1.1 deraadt 405:
1.11 ericj 406: /*
407: * nextport :
408: * Come up with the next port to try, be it random or whatever. "block" is
409: * a ptr to randports array, whose bytes [so far] carry these meanings:
410: * 0 ignore
411: * 1 to be tested
412: * 2 tested [which is set as we find them here]
413: * returns a u_short random port, or 0 if all the t-b-t ones are used up.
414: */
1.7 deraadt 415: u_short
1.6 deraadt 416: nextport(block)
417: char *block;
418: {
1.11 ericj 419: unsigned int x;
420: unsigned int y;
1.6 deraadt 421:
1.11 ericj 422: y = 70000; /* high safety count for rnd-tries */
1.6 deraadt 423: while (y > 0) {
424: x = (RAND() & 0xffff);
425: if (block[x] == 1) { /* try to find a not-done one... */
426: block[x] = 2;
427: break;
428: }
1.11 ericj 429: x = 0;
1.6 deraadt 430: y--;
1.11 ericj 431: }
1.6 deraadt 432: if (x)
433: return (x);
434:
435: y = 65535; /* no random one, try linear downsearch */
436: while (y > 0) { /* if they're all used, we *must* be sure! */
437: if (block[y] == 1) {
438: block[y] = 2;
439: break;
440: }
441: y--;
1.11 ericj 442: }
1.6 deraadt 443: if (y)
444: return (y); /* at least one left */
1.1 deraadt 445:
1.11 ericj 446: return (0);
1.7 deraadt 447: }
1.1 deraadt 448:
1.11 ericj 449: /*
450: * loadports :
451: * set "to be tested" indications in BLOCK, from LO to HI. Almost too small
452: * to be a separate routine, but makes main() a little cleaner.
453: */
1.6 deraadt 454: void
455: loadports(block, lo, hi)
456: char *block;
1.7 deraadt 457: u_short lo;
458: u_short hi;
1.6 deraadt 459: {
1.7 deraadt 460: u_short x;
1.6 deraadt 461:
462: if (!block)
1.13 ericj 463: nlog(1, "loadports: no block?!");
1.6 deraadt 464: if ((!lo) || (!hi))
1.13 ericj 465: nlog(1, "loadports: bogus values %d, %d", lo, hi);
1.6 deraadt 466: x = hi;
467: while (lo <= x) {
468: block[x] = 1;
469: x--;
470: }
1.7 deraadt 471: }
472:
1.1 deraadt 473:
1.11 ericj 474: /*
475: * doconnect :
476: * do all the socket stuff, and return an fd for one of
477: * an open outbound TCP connection
478: * a UDP stub-socket thingie
479: * with appropriate socket options set up if we wanted source-routing, or
480: * an unconnected TCP or UDP socket to listen on.
481: * Examines various global o_blah flags to figure out what-all to do.
482: */
1.6 deraadt 483: int
484: doconnect(rad, rp, lad, lp)
1.7 deraadt 485: struct in_addr *rad;
486: u_short rp;
487: struct in_addr *lad;
488: u_short lp;
1.6 deraadt 489: {
1.14 ericj 490: int nnetfd = 0;
1.11 ericj 491: int rr;
1.6 deraadt 492: int x, y;
493: errno = 0;
1.1 deraadt 494:
1.11 ericj 495: /* grab a socket; set opts */
1.14 ericj 496: while (nnetfd == 0) {
497: if (o_udpmode)
498: nnetfd = socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP);
499: else
500: nnetfd = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
501: if (nnetfd < 0)
502: nlog(1, "Can't get socket");
503: }
504:
1.6 deraadt 505: x = 1;
506: rr = setsockopt(nnetfd, SOL_SOCKET, SO_REUSEADDR, &x, sizeof(x));
507: if (rr == -1)
1.13 ericj 508: nlog(1, NULL);
1.6 deraadt 509:
510: /* fill in all the right sockaddr crud */
511: lclend->sin_family = AF_INET;
1.1 deraadt 512:
1.11 ericj 513: /* fill in all the right sockaddr crud */
1.6 deraadt 514: lclend->sin_family = AF_INET;
515: remend->sin_family = AF_INET;
1.1 deraadt 516:
1.11 ericj 517: /* if lad/lp, do appropriate binding */
1.6 deraadt 518: if (lad)
1.7 deraadt 519: memcpy(&lclend->sin_addr.s_addr, lad, sizeof(struct in_addr));
1.6 deraadt 520: if (lp)
521: lclend->sin_port = htons(lp);
1.11 ericj 522:
1.6 deraadt 523: rr = 0;
524: if (lad || lp) {
525: x = (int) lp;
1.11 ericj 526: /* try a few times for the local bind, a la ftp-data-port... */
1.6 deraadt 527: for (y = 4; y > 0; y--) {
1.7 deraadt 528: rr = bind(nnetfd, (struct sockaddr *) lclend,
529: sizeof(struct sockaddr_in));
1.6 deraadt 530: if (rr == 0)
531: break;
532: if (errno != EADDRINUSE)
533: break;
534: else {
1.13 ericj 535: nlog(0, "retrying local %s:%d", inet_ntoa(lclend->sin_addr), lp);
1.6 deraadt 536: sleep(2);
537: errno = 0; /* clear from sleep */
1.11 ericj 538: }
539: }
540: }
1.6 deraadt 541: if (rr)
1.13 ericj 542: nlog(1, "Can't grab %s:%d with bind",
1.6 deraadt 543: inet_ntoa(lclend->sin_addr), lp);
1.1 deraadt 544:
1.6 deraadt 545: if (o_listen)
546: return (nnetfd);/* thanks, that's all for today */
1.1 deraadt 547:
1.7 deraadt 548: memcpy(&remend->sin_addr.s_addr, rad, sizeof(struct in_addr));
1.6 deraadt 549: remend->sin_port = htons(rp);
1.1 deraadt 550:
1.6 deraadt 551: /* wrap connect inside a timer, and hit it */
552: arm(1, o_wait);
553: if (setjmp(jbuf) == 0) {
1.11 ericj 554: rr = connect(nnetfd, (struct sockaddr *) remend,
555: sizeof(struct sockaddr));
556: } else {
1.6 deraadt 557: rr = -1;
1.11 ericj 558: errno = ETIMEDOUT;
1.6 deraadt 559: }
560: arm(0, 0);
561: if (rr == 0)
562: return (nnetfd);
1.11 ericj 563: close(nnetfd);
1.6 deraadt 564: return (-1);
1.7 deraadt 565: }
1.1 deraadt 566:
1.11 ericj 567: /*
568: * dolisten :
569: * just like doconnect, and in fact calls a hunk of doconnect, but listens for
570: * incoming and returns an open connection *from* someplace. If we were
571: * given host/port args, any connections from elsewhere are rejected. This
572: * in conjunction with local-address binding should limit things nicely.
573: */
1.6 deraadt 574: int
575: dolisten(rad, rp, lad, lp)
1.7 deraadt 576: struct in_addr *rad;
577: u_short rp;
578: struct in_addr *lad;
579: u_short lp;
1.6 deraadt 580: {
1.11 ericj 581: int nnetfd;
582: int rr;
1.7 deraadt 583: struct host_info *whozis = NULL;
1.6 deraadt 584: int x;
585: char *cp;
1.7 deraadt 586: u_short z;
1.6 deraadt 587: errno = 0;
1.1 deraadt 588:
1.11 ericj 589: /*
590: * Pass everything off to doconnect,
591: * who in o_listen mode just gets a socket
592: */
1.6 deraadt 593: nnetfd = doconnect(rad, rp, lad, lp);
594: if (nnetfd <= 0)
595: return (-1);
1.11 ericj 596: if (o_udpmode) {
597: if (!lp)
1.13 ericj 598: nlog(1, "UDP listen needs -p arg");
1.6 deraadt 599: } else {
1.11 ericj 600: rr = listen(nnetfd, 1);
601: if (rr < 0)
1.13 ericj 602: nlog(1, "error listening");
1.6 deraadt 603: }
1.1 deraadt 604:
1.6 deraadt 605: if (o_verbose) {
1.11 ericj 606: x = sizeof(struct sockaddr);
1.7 deraadt 607: rr = getsockname(nnetfd, (struct sockaddr *) lclend, &x);
1.6 deraadt 608: if (rr < 0)
1.13 ericj 609: nlog(0, "local getsockname failed");
1.6 deraadt 610: strcpy(bigbuf_net, "listening on ["); /* buffer reuse... */
611: if (lclend->sin_addr.s_addr)
612: strcat(bigbuf_net, inet_ntoa(lclend->sin_addr));
613: else
614: strcat(bigbuf_net, "any");
1.15 ! ericj 615: strcat(bigbuf_net, "] ...");
1.6 deraadt 616: z = ntohs(lclend->sin_port);
1.13 ericj 617: nlog(0, "%s %d", bigbuf_net, z);
1.6 deraadt 618: } /* verbose -- whew!! */
1.11 ericj 619: /*
620: * UDP is a speeeeecial case -- we have to do I/O *and* get the
1.6 deraadt 621: * calling party's particulars all at once, listen() and accept()
622: * don't apply. At least in the BSD universe, however, recvfrom/PEEK
623: * is enough to tell us something came in, and we can set things up so
624: * straight read/write actually does work after all. Yow. YMMV on
1.11 ericj 625: * strange platforms!
626: */
1.6 deraadt 627: if (o_udpmode) {
1.7 deraadt 628: x = sizeof(struct sockaddr); /* retval for recvfrom */
1.6 deraadt 629: arm(2, o_wait); /* might as well timeout this, too */
630: if (setjmp(jbuf) == 0) { /* do timeout for initial
631: * connect */
1.11 ericj 632: rr = recvfrom(nnetfd, bigbuf_net, BIGSIZ, MSG_PEEK,
633: (struct sockaddr *)remend, &x);
1.6 deraadt 634: } else
1.11 ericj 635: goto dol_tmo;
1.6 deraadt 636: arm(0, 0);
1.11 ericj 637: rr = connect(nnetfd, (struct sockaddr *)remend,
638: sizeof(struct sockaddr));
1.6 deraadt 639: goto whoisit;
1.11 ericj 640: }
1.6 deraadt 641: /* fall here for TCP */
1.11 ericj 642: x = sizeof(struct sockaddr);
643: arm(2, o_wait);
1.6 deraadt 644: if (setjmp(jbuf) == 0) {
1.7 deraadt 645: rr = accept(nnetfd, (struct sockaddr *) remend, &x);
1.6 deraadt 646: } else
1.11 ericj 647: goto dol_tmo;
1.6 deraadt 648: arm(0, 0);
649: close(nnetfd); /* dump the old socket */
650: nnetfd = rr; /* here's our new one */
1.1 deraadt 651:
652: whoisit:
1.6 deraadt 653: if (rr < 0)
654: goto dol_err; /* bail out if any errors so far */
1.1 deraadt 655:
1.11 ericj 656: /*
657: * Find out what address the connection was *to* on
658: * our end, in case we're doing a listen-on-any on
659: * a multihomed machine. This allows one to offer
660: * different services via different alias addresses,
661: * such as the "virtual web site" hack.
662: */
1.6 deraadt 663: memset(bigbuf_net, 0, 64);
664: cp = &bigbuf_net[32];
1.7 deraadt 665: x = sizeof(struct sockaddr);
666: rr = getsockname(nnetfd, (struct sockaddr *) lclend, &x);
1.12 ericj 667: if (rr < 0 && o_verbose)
1.13 ericj 668: nlog(0, "post-rcv getsockname failed");
1.6 deraadt 669: strcpy(cp, inet_ntoa(lclend->sin_addr));
1.1 deraadt 670:
1.6 deraadt 671: z = ntohs(remend->sin_port);
672: strcpy(bigbuf_net, inet_ntoa(remend->sin_addr));
1.11 ericj 673: whozis = gethinfo(bigbuf_net, o_nflag);
1.6 deraadt 674: errno = 0;
1.11 ericj 675: x = 0;
1.6 deraadt 676: if (rad) /* xxx: fix to go down the *list* if we have
677: * one? */
1.7 deraadt 678: if (memcmp(rad, whozis->iaddrs, sizeof(struct sockaddr)))
1.6 deraadt 679: x = 1;
1.11 ericj 680: if (rp) {
1.6 deraadt 681: if (z != rp)
682: x = 1;
1.11 ericj 683: }
684: if (x) {
1.13 ericj 685: nlog(1, "invalid connection to [%s] from %s [%s] %d",
1.6 deraadt 686: cp, whozis->name, whozis->addrs[0], z);
1.11 ericj 687: }
1.12 ericj 688: if (o_verbose) {
1.13 ericj 689: nlog(0, "connect to [%s] from %s [%s] %d",
1.12 ericj 690: cp, whozis->name, whozis->addrs[0], z);
691: }
1.11 ericj 692: return (nnetfd);
1.1 deraadt 693:
694: dol_tmo:
1.11 ericj 695: errno = ETIMEDOUT;
1.1 deraadt 696: dol_err:
1.6 deraadt 697: close(nnetfd);
698: return (-1);
1.7 deraadt 699: }
1.1 deraadt 700:
1.11 ericj 701: /*
702: * udptest :
703: * fire a couple of packets at a UDP target port, just to see if it's really
704: * there. On BSD kernels, ICMP host/port-unreachable errors get delivered to
705: * our socket as ECONNREFUSED write errors. On SV kernels, we lose; we'll have
706: * to collect and analyze raw ICMP ourselves a la satan's probe_udp_ports
707: * backend. Guess where one could swipe the appropriate code from...
708: *
709: * Use the time delay between writes if given, otherwise use the "tcp ping"
710: * trick for getting the RTT. [I got that idea from pluvius, and warped it.]
711: * Return either the original fd, or clean up and return -1.
712: */
1.6 deraadt 713: udptest(fd, where)
714: int fd;
1.7 deraadt 715: struct in_addr *where;
1.6 deraadt 716: {
1.11 ericj 717: int rr;
1.6 deraadt 718:
719: rr = write(fd, bigbuf_in, 1);
1.12 ericj 720: if (rr != 1 && o_verbose)
1.13 ericj 721: nlog(0, "udptest first write failed?! errno %d", errno);
1.6 deraadt 722: if (o_wait)
723: sleep(o_wait);
724: else {
1.11 ericj 725: o_udpmode = 0;
726: o_wait = 5;
1.6 deraadt 727: rr = doconnect(where, SLEAZE_PORT, 0, 0);
728: if (rr > 0)
1.11 ericj 729: close(rr);
730: o_wait = 0;
731: o_udpmode++;
732: }
733: errno = 0;
1.6 deraadt 734: rr = write(fd, bigbuf_in, 1);
1.11 ericj 735: if (rr == 1)
1.6 deraadt 736: return (fd);
1.11 ericj 737: close(fd);
1.6 deraadt 738: return (-1);
1.7 deraadt 739: }
740:
1.11 ericj 741: /*
742: * oprint :
743: * Hexdump bytes shoveled either way to a running logfile, in the format:
744: * D offset - - - - --- 16 bytes --- - - - - # .... ascii .....
745: * where "which" sets the direction indicator, D:
746: * 0 -- sent to network, or ">"
747: * 1 -- rcvd and printed to stdout, or "<"
748: * and "buf" and "n" are data-block and length. If the current block generates
749: * a partial line, so be it; we *want* that lockstep indication of who sent
750: * what when. Adapted from dgaudet's original example -- but must be ripping
751: * *fast*, since we don't want to be too disk-bound.
752: */
1.6 deraadt 753: void
754: oprint(which, buf, n)
755: int which;
756: char *buf;
757: int n;
758: {
759: int bc; /* in buffer count */
760: int obc; /* current "global" offset */
761: int soc; /* stage write count */
1.11 ericj 762: unsigned char *p; /* main buf ptr; m.b. unsigned here */
763: unsigned char *op; /* out hexdump ptr */
764: unsigned char *a; /* out asc-dump ptr */
765: int x;
766: unsigned int y;
1.6 deraadt 767:
768: if (!ofd)
1.13 ericj 769: nlog(1, "oprint called with no open fd?!");
1.6 deraadt 770: if (n == 0)
771: return;
772:
773: op = stage;
774: if (which) {
775: *op = '<';
776: obc = wrote_out;/* use the globals! */
777: } else {
778: *op = '>';
779: obc = wrote_net;
780: }
781: op++; /* preload "direction" */
782: *op = ' ';
783: p = (unsigned char *) buf;
784: bc = n;
785: stage[59] = '#'; /* preload separator */
786: stage[60] = ' ';
787:
788: while (bc) { /* for chunk-o-data ... */
789: x = 16;
790: soc = 78; /* len of whole formatted line */
791: if (bc < x) {
792: soc = soc - 16 + bc; /* fiddle for however much is
793: * left */
794: x = (bc * 3) + 11; /* 2 digits + space per, after
795: * D & offset */
796: op = &stage[x];
797: x = 16 - bc;
798: while (x) {
799: *op++ = ' '; /* preload filler spaces */
800: *op++ = ' ';
801: *op++ = ' ';
802: x--;
803: }
804: x = bc; /* re-fix current linecount */
805: } /* if bc < x */
806: bc -= x; /* fix wrt current line size */
807: sprintf(&stage[2], "%8.8x ", obc); /* xxx: still slow? */
808: obc += x; /* fix current offset */
809: op = &stage[11];/* where hex starts */
810: a = &stage[61]; /* where ascii starts */
811:
812: while (x) { /* for line of dump, however long ... */
813: y = (int) (*p >> 4); /* hi half */
814: *op = hexnibs[y];
815: op++;
816: y = (int) (*p & 0x0f); /* lo half */
817: *op = hexnibs[y];
818: op++;
819: *op = ' ';
820: op++;
821: if ((*p > 31) && (*p < 127))
822: *a = *p; /* printing */
823: else
824: *a = '.'; /* nonprinting, loose def */
825: a++;
826: p++;
827: x--;
828: } /* while x */
829: *a = '\n'; /* finish the line */
830: x = write(ofd, stage, soc);
831: if (x < 0)
1.13 ericj 832: nlog(1, "ofd write err");
1.11 ericj 833: }
1.7 deraadt 834: }
835:
1.1 deraadt 836: #ifdef TELNET
1.7 deraadt 837: u_short o_tn = 0; /* global -t option */
1.1 deraadt 838:
1.11 ericj 839: /*
840: * atelnet :
841: * Answer anything that looks like telnet negotiation with don't/won't.
842: * This doesn't modify any data buffers, update the global output count,
843: * or show up in a hexdump -- it just shits into the outgoing stream.
844: * Idea and codebase from Mudge@l0pht.com.
845: */
1.6 deraadt 846: void
847: atelnet(buf, size)
848: unsigned char *buf; /* has to be unsigned here! */
849: unsigned int size;
850: {
851: static unsigned char obuf[4]; /* tiny thing to build responses into */
1.11 ericj 852: int x;
853: unsigned char y;
854: unsigned char *p;
1.6 deraadt 855:
856: y = 0;
857: p = buf;
858: x = size;
859: while (x > 0) {
860: if (*p != 255) /* IAC? */
861: goto notiac;
862: obuf[0] = 255;
863: p++;
864: x--;
865: if ((*p == 251) || (*p == 252)) /* WILL or WONT */
866: y = 254;/* -> DONT */
867: if ((*p == 253) || (*p == 254)) /* DO or DONT */
868: y = 252;/* -> WONT */
869: if (y) {
870: obuf[1] = y;
871: p++;
872: x--;
1.11 ericj 873: obuf[2] = *p;
1.6 deraadt 874: (void) write(netfd, obuf, 3);
1.11 ericj 875: /*
876: * if one wanted to bump wrote_net or do
877: * a hexdump line, here's the place.
878: */
1.6 deraadt 879: y = 0;
1.11 ericj 880: }
1.1 deraadt 881: notiac:
1.6 deraadt 882: p++;
883: x--;
1.11 ericj 884: }
1.7 deraadt 885: }
1.11 ericj 886: #endif /* TELNET */
1.7 deraadt 887:
1.11 ericj 888: /*
889: * readwrite :
890: * handle stdin/stdout/network I/O. Bwahaha!! -- the select loop from hell.
891: * In this instance, return what might become our exit status.
892: */
1.6 deraadt 893: int
894: readwrite(fd)
895: int fd;
896: {
1.11 ericj 897: int rr;
898: char *zp; /* stdin buf ptr */
899: char *np; /* net-in buf ptr */
1.6 deraadt 900: unsigned int rzleft;
901: unsigned int rnleft;
1.7 deraadt 902: u_short netretry; /* net-read retry counter */
1.11 ericj 903: u_short wretry; /* net-write sanity counter */
904: u_short wfirst; /* one-shot flag to skip first net read */
1.1 deraadt 905:
1.11 ericj 906: /*
907: * if you don't have all this FD_* macro hair in sys/types.h,
908: * you'll have to either find it or do your own bit-bashing:
909: * *ds1 |= (1 << fd), etc.
910: */
1.6 deraadt 911: if (fd > FD_SETSIZE) {
1.13 ericj 912: nlog(0, "Preposterous fd value %d", fd);
1.6 deraadt 913: return (1);
914: }
1.11 ericj 915: FD_SET(fd, &fds1);
1.6 deraadt 916: netretry = 2;
917: wfirst = 0;
918: rzleft = rnleft = 0;
919: if (insaved) {
920: rzleft = insaved; /* preload multi-mode fakeouts */
921: zp = bigbuf_in;
922: wfirst = 1;
1.11 ericj 923: /* If not scanning, this is a one-off first */
924: if (Single)
925: insaved = 0;
1.6 deraadt 926: else {
1.11 ericj 927: FD_CLR(0, &fds1);
928: close(0);
929: }
930: }
1.6 deraadt 931: if (o_interval)
1.11 ericj 932: sleep(o_interval);
933: errno = 0;
1.1 deraadt 934:
1.7 deraadt 935: while (FD_ISSET(fd, &fds1)) { /* i.e. till the *net* closes! */
1.9 art 936: struct timeval *tv;
937:
1.11 ericj 938: wretry = 8200; /* more than we'll ever hafta write */
939: if (wfirst) { /* any saved stdin buffer? */
1.6 deraadt 940: wfirst = 0; /* clear flag for the duration */
941: goto shovel; /* and go handle it first */
942: }
1.7 deraadt 943: fds2 = fds1;
1.9 art 944: if (timer1.tv_sec > 0 || timer1.tv_usec > 0) {
945: memcpy(&timer2, &timer1, sizeof(struct timeval));
946: tv = &timer2;
947: } else
948: tv = NULL;
949: rr = select(getdtablesize(), &fds2, 0, 0, tv);
1.6 deraadt 950: if (rr < 0) {
1.11 ericj 951: if (errno != EINTR) {
1.13 ericj 952: nlog(0, "Select Failure");
1.6 deraadt 953: close(fd);
954: return (1);
955: }
1.11 ericj 956: }
1.6 deraadt 957: /* if we have a timeout AND stdin is closed AND we haven't
958: * heard anything from the net during that time, assume it's
959: * dead and close it too. */
960: if (rr == 0) {
1.7 deraadt 961: if (!FD_ISSET(0, &fds1))
1.6 deraadt 962: netretry--; /* we actually try a coupla
963: * times. */
964: if (!netretry) {
1.12 ericj 965: if (o_verbose) /* normally we don't
1.6 deraadt 966: * care */
1.13 ericj 967: nlog(0, "net timeout");
1.6 deraadt 968: close(fd);
969: return (0); /* not an error! */
970: }
971: } /* select timeout */
1.11 ericj 972: /* XXX: should we check the exception fds too? The read fds
1.6 deraadt 973: * seem to give us the right info, and none of the examples I
974: * found bothered. */
975: /* Ding!! Something arrived, go check all the incoming
976: * hoppers, net first */
1.7 deraadt 977: if (FD_ISSET(fd, &fds2)) { /* net: ding! */
1.6 deraadt 978: rr = read(fd, bigbuf_net, BIGSIZ);
979: if (rr <= 0) {
1.7 deraadt 980: FD_CLR(fd, &fds1); /* net closed, we'll
1.6 deraadt 981: * finish up... */
982: rzleft = 0; /* can't write anymore: broken
983: * pipe */
984: } else {
985: rnleft = rr;
986: np = bigbuf_net;
1.1 deraadt 987: #ifdef TELNET
1.6 deraadt 988: if (o_tn)
989: atelnet(np, rr); /* fake out telnet stuff */
1.11 ericj 990: #endif /* TELNET */
991: }
992: }
1.6 deraadt 993: /* if we're in "slowly" mode there's probably still stuff in
994: * the stdin buffer, so don't read unless we really need MORE
995: * INPUT! MORE INPUT! */
996: if (rzleft)
997: goto shovel;
1.1 deraadt 998:
1.11 ericj 999: if (FD_ISSET(0, &fds2)) {
1.6 deraadt 1000: rr = read(0, bigbuf_in, BIGSIZ);
1.11 ericj 1001: if (rr <= 0) {
1002: FD_CLR(0, &fds1); /* disable and close */
1.6 deraadt 1003: close(0);
1004: } else {
1005: rzleft = rr;
1006: zp = bigbuf_in;
1.11 ericj 1007: if (!Single) {
1008: insaved = rr;
1009: FD_CLR(0, &fds1);
1010: close(0);
1011: }
1012: }
1013: }
1.1 deraadt 1014: shovel:
1.11 ericj 1015: /* sanity check. Works because they're both unsigned... */
1.6 deraadt 1016: if ((rzleft > 8200) || (rnleft > 8200)) {
1017: rzleft = rnleft = 0;
1018: }
1.11 ericj 1019: /* net write retries sometimes happen on UDP connections */
1.6 deraadt 1020: if (!wretry) { /* is something hung? */
1.13 ericj 1021: nlog(0, "too many output retries");
1.6 deraadt 1022: return (1);
1023: }
1024: if (rnleft) {
1025: rr = write(1, np, rnleft);
1026: if (rr > 0) {
1027: if (o_wfile)
1.11 ericj 1028: oprint(1, np, rr);
1029: np += rr;
1030: rnleft -= rr;
1.6 deraadt 1031: wrote_out += rr; /* global count */
1032: }
1.11 ericj 1033: }
1.6 deraadt 1034: if (rzleft) {
1.11 ericj 1035: if (o_interval)
1.6 deraadt 1036: rr = findline(zp, rzleft);
1037: else
1038: rr = rzleft;
1.11 ericj 1039: rr = write(fd, zp, rr);
1.6 deraadt 1040: if (rr > 0) {
1041: if (o_wfile)
1.11 ericj 1042: oprint(0, zp, rr);
1.6 deraadt 1043: zp += rr;
1044: rzleft -= rr;
1.11 ericj 1045: wrote_net += rr;
1.6 deraadt 1046: }
1.11 ericj 1047: }
1048: if (o_interval) {
1.6 deraadt 1049: sleep(o_interval);
1.11 ericj 1050: errno = 0;
1051: continue;
1.6 deraadt 1052: }
1.11 ericj 1053: if ((rzleft) || (rnleft)) {
1054: wretry--;
1.6 deraadt 1055: goto shovel;
1056: }
1.11 ericj 1057: }
1.1 deraadt 1058:
1.6 deraadt 1059: close(fd);
1060: return (0);
1.7 deraadt 1061: }
1.1 deraadt 1062:
1063: /* main :
1064: now we pull it all together... */
1.6 deraadt 1065: main(argc, argv)
1066: int argc;
1067: char **argv;
1.1 deraadt 1068: {
1.11 ericj 1069: int x, ch;
1070: char *cp;
1.7 deraadt 1071: struct host_info *gp;
1072: struct host_info *whereto = NULL;
1073: struct host_info *wherefrom = NULL;
1074: struct in_addr *ouraddr = NULL;
1075: struct in_addr *themaddr = NULL;
1076: u_short o_lport = 0;
1077: u_short ourport = 0;
1078: u_short loport = 0; /* for scanning stuff */
1079: u_short hiport = 0;
1080: u_short curport = 0;
1.6 deraadt 1081: char *randports = NULL;
1.1 deraadt 1082:
1083: #ifdef HAVE_BIND
1.6 deraadt 1084: res_init();
1.1 deraadt 1085: #endif
1.7 deraadt 1086: lclend = (struct sockaddr_in *) calloc(1, sizeof(struct sockaddr));
1087: remend = (struct sockaddr_in *) calloc(1, sizeof(struct sockaddr));
1088: bigbuf_in = calloc(1, BIGSIZ);
1089: bigbuf_net = calloc(1, BIGSIZ);
1.11 ericj 1090: pinfo= (struct port_info *) calloc(1, sizeof(struct port_info));
1.6 deraadt 1091:
1092: errno = 0;
1093: gatesptr = 4;
1094: h_errno = 0;
1.1 deraadt 1095:
1.11 ericj 1096: /*
1097: * We want to catch a few of these signals.
1098: * Others we disgard.
1099: */
1.6 deraadt 1100: signal(SIGINT, catch);
1101: signal(SIGQUIT, catch);
1102: signal(SIGTERM, catch);
1103: signal(SIGURG, SIG_IGN);
1104: signal(SIGPIPE, SIG_IGN); /* important! */
1.1 deraadt 1105:
1.11 ericj 1106: /*
1107: * If no args given at all, get 'em from stdin, construct an argv,
1108: * and hand anything left over to readwrite().
1109: */
1.6 deraadt 1110: if (argc == 1) {
1111: cp = argv[0];
1.11 ericj 1112: /* XXX - 128 ? */
1113: argv = (char **) calloc(1, 128 * sizeof(char *));
1.6 deraadt 1114: argv[0] = cp; /* leave old prog name intact */
1.7 deraadt 1115: cp = calloc(1, BIGSIZ);
1.6 deraadt 1116: argv[1] = cp; /* head of new arg block */
1117: fprintf(stderr, "Cmd line: ");
1118: fflush(stderr); /* I dont care if it's unbuffered or not! */
1.10 deraadt 1119: insaved = read(0, cp, BIGSIZ-1); /* we're gonna fake fgets()
1.6 deraadt 1120: * here */
1.10 deraadt 1121: cp[BIGSIZ-1] = '\0';
1.6 deraadt 1122: if (insaved <= 0)
1.13 ericj 1123: nlog(1, "wrong");
1.6 deraadt 1124: x = findline(cp, insaved);
1125: if (x)
1126: insaved -= x; /* remaining chunk size to be sent */
1127: if (insaved) /* which might be zero... */
1128: memcpy(bigbuf_in, &cp[x], insaved);
1129: cp = strchr(argv[1], '\n');
1130: if (cp)
1131: *cp = '\0';
1132: cp = strchr(argv[1], '\r'); /* look for ^M too */
1133: if (cp)
1134: *cp = '\0';
1.1 deraadt 1135:
1.11 ericj 1136: /*
1137: * Find and stash pointers to remaining new "args"
1138: */
1.6 deraadt 1139: cp = argv[1];
1140: cp++; /* skip past first char */
1141: x = 2; /* we know argv 0 and 1 already */
1142: for (; *cp != '\0'; cp++) {
1143: if (*cp == ' ') {
1144: *cp = '\0'; /* smash all spaces */
1145: continue;
1146: } else {
1147: if (*(cp - 1) == '\0') {
1148: argv[x] = cp;
1149: x++;
1150: }
1151: } /* if space */
1152: } /* for cp */
1153: argc = x;
1.11 ericj 1154: }
1155:
1156: while ((ch = getopt(argc, argv, "g:G:hi:lno:p:rs:tuvw:z")) != -1) {
1157: switch (ch) {
1158: case 'G': /* srcrt gateways pointer val */
1.6 deraadt 1159: x = atoi(optarg);
1.11 ericj 1160: /* Mask of bits */
1161: if ((x) && (x == (x & 0x1c)))
1.6 deraadt 1162: gatesptr = x;
1163: else
1.13 ericj 1164: nlog(1, "invalid hop pointer %d, must be multiple of 4 <= 28", x);
1.6 deraadt 1165: break;
1.11 ericj 1166: case 'g': /* srcroute hop[s] */
1.6 deraadt 1167: if (gatesidx > 8)
1.13 ericj 1168: nlog(1, "Too many -g hops!");
1.11 ericj 1169: if (gates == NULL)
1170: gates = (struct host_info **) calloc(1,
1171: sizeof(struct host_info *) * 10);
1172: gp = gethinfo(optarg, o_nflag);
1.6 deraadt 1173: if (gp)
1174: gates[gatesidx] = gp;
1175: gatesidx++;
1176: break;
1177: case 'h':
1.11 ericj 1178: help();
1179: break;
1180: case 'i': /* line-interval time */
1.6 deraadt 1181: o_interval = atoi(optarg) & 0xffff;
1182: if (!o_interval)
1.13 ericj 1183: nlog(1, "invalid interval time %s", optarg);
1.6 deraadt 1184: break;
1.11 ericj 1185: case 'l': /* listen mode */
1.6 deraadt 1186: o_listen++;
1187: break;
1.11 ericj 1188: case 'n': /* numeric-only, no DNS lookups */
1.6 deraadt 1189: o_nflag++;
1190: break;
1.11 ericj 1191: case 'o': /* hexdump log */
1.6 deraadt 1192: stage = (unsigned char *) optarg;
1193: o_wfile++;
1194: break;
1.11 ericj 1195: case 'p': /* local source port */
1196: o_lport = getpinfo(optarg, 0);
1.6 deraadt 1197: if (o_lport == 0)
1.13 ericj 1198: nlog(1, "invalid local port %s", optarg);
1.6 deraadt 1199: break;
1.11 ericj 1200: case 'r': /* randomize various things */
1.6 deraadt 1201: o_random++;
1202: break;
1.11 ericj 1203: /*
1204: * Do a full lookup [since everything else goes through the same
1205: * mill], unless -n was previously specified. In fact, careful
1206: * placement of -n can be useful, so we'll still pass o_nflag
1207: * here instead of forcing numeric.
1208: */
1209: case 's': /* local source address */
1210: wherefrom = gethinfo(optarg, o_nflag);
1.6 deraadt 1211: ouraddr = &wherefrom->iaddrs[0];
1212: break;
1.1 deraadt 1213: #ifdef TELNET
1.11 ericj 1214: case 't': /* do telnet fakeout */
1.6 deraadt 1215: o_tn++;
1216: break;
1.11 ericj 1217: #endif
1218: case 'u': /* use UDP */
1.6 deraadt 1219: o_udpmode++;
1220: break;
1.11 ericj 1221: case 'v': /* verbose */
1.6 deraadt 1222: o_verbose++;
1223: break;
1.11 ericj 1224: case 'w': /* wait time */
1.6 deraadt 1225: o_wait = atoi(optarg);
1226: if (o_wait <= 0)
1.13 ericj 1227: nlog(1, "invalid wait-time %s", optarg);
1.7 deraadt 1228: timer1.tv_sec = o_wait;
1229: timer1.tv_usec = 0;
1.6 deraadt 1230: break;
1.11 ericj 1231: case 'z': /* little or no data xfer */
1.6 deraadt 1232: o_zero++;
1233: break;
1234: default:
1.11 ericj 1235: usage(1);
1236: }
1237: }
1.1 deraadt 1238:
1.11 ericj 1239: /* other misc initialization */
1.7 deraadt 1240: FD_SET(0, &fds1); /* stdin *is* initially open */
1.6 deraadt 1241: if (o_random) {
1242: SRAND(time(0));
1.11 ericj 1243: randports = calloc(1, 65536); /* big flag array for ports */
1.6 deraadt 1244: }
1245: if (o_wfile) {
1246: ofd = open(stage, O_WRONLY | O_CREAT | O_TRUNC, 0664);
1247: if (ofd <= 0) /* must be > extant 0/1/2 */
1.13 ericj 1248: nlog(1, "Can't open %s", stage);
1.7 deraadt 1249: stage = (unsigned char *) calloc(1, 100);
1.6 deraadt 1250: }
1.11 ericj 1251: /* optind is now index of first non -x arg */
1252: if (argv[optind])
1253: whereto = gethinfo(argv[optind], o_nflag);
1.6 deraadt 1254: if (whereto && whereto->iaddrs)
1255: themaddr = &whereto->iaddrs[0];
1256: if (themaddr)
1257: optind++; /* skip past valid host lookup */
1258: errno = 0;
1259: h_errno = 0;
1.1 deraadt 1260:
1.11 ericj 1261: /*
1262: * Handle listen mode here, and exit afterward. Only does one connect;
1263: * this is arguably the right thing to do. A "persistent listen-and-fork"
1264: * mode a la inetd has been thought about, but not implemented. A tiny
1265: * wrapper script can handle such things.
1266: */
1.6 deraadt 1267: if (o_listen) {
1.11 ericj 1268: curport = 0;
1269: if (argv[optind]) {
1270: curport = getpinfo(argv[optind], 0);
1271: if (curport == 0)
1.13 ericj 1272: nlog(1, "invalid port %s", argv[optind]);
1.11 ericj 1273: }
1.6 deraadt 1274: netfd = dolisten(themaddr, curport, ouraddr, o_lport);
1275: if (netfd > 0) {
1.11 ericj 1276: x = readwrite(netfd);
1.12 ericj 1277: if (o_verbose)
1.13 ericj 1278: nlog(0, "Sent %i Rcvd %i", wrote_net, wrote_out);
1.11 ericj 1279: exit(x);
1280: } else
1.13 ericj 1281: nlog(1, "no connection");
1.11 ericj 1282: }
1.6 deraadt 1283: /* fall thru to outbound connects. Now we're more picky about args... */
1284: if (!themaddr)
1.13 ericj 1285: nlog(1, "no destination");
1.6 deraadt 1286: if (argv[optind] == NULL)
1.13 ericj 1287: nlog(1, "no port[s] to connect to");
1.11 ericj 1288: if (argv[optind + 1])
1289: Single = 0;
1290: ourport = o_lport;
1291:
1.6 deraadt 1292: while (argv[optind]) {
1293: hiport = loport = 0;
1.11 ericj 1294: cp = strchr(argv[optind], '-');
1.6 deraadt 1295: if (cp) {
1296: *cp = '\0';
1297: cp++;
1.11 ericj 1298: hiport = getpinfo(cp, 0);
1.6 deraadt 1299: if (hiport == 0)
1.13 ericj 1300: nlog(1, "invalid port %s", cp);
1.6 deraadt 1301: } /* if found a dash */
1.11 ericj 1302: loport = getpinfo(argv[optind], 0);
1.6 deraadt 1303: if (loport == 0)
1.13 ericj 1304: nlog(1, "invalid port %s", argv[optind]);
1.6 deraadt 1305: if (hiport > loport) { /* was it genuinely a range? */
1306: Single = 0; /* multi-mode, case B */
1307: if (o_random) { /* maybe populate the random array */
1308: loadports(randports, loport, hiport);
1309: curport = nextport(randports);
1.11 ericj 1310: } else
1311: curport = hiport;
1.6 deraadt 1312: } else /* not a range, including args like "25-25" */
1313: curport = loport;
1.11 ericj 1314: /*
1315: * Now start connecting to these things.
1316: * curport is already preloaded.
1317: */
1.6 deraadt 1318: while (loport <= curport) {
1.11 ericj 1319: curport = getpinfo(NULL, curport);
1.6 deraadt 1320: netfd = doconnect(themaddr, curport, ouraddr, ourport);
1.11 ericj 1321: if (netfd > 0)
1322: if (o_zero && o_udpmode)
1.6 deraadt 1323: netfd = udptest(netfd, themaddr);
1.11 ericj 1324: if (netfd > 0) {
1325: x = 0;
1326: if (o_verbose) {
1.13 ericj 1327: nlog(0, "%s [%s] %d (%s) open",
1.11 ericj 1328: whereto->name,
1329: whereto->addrs[0], curport,
1330: pinfo->name);
1331: }
1.6 deraadt 1332: if (!o_zero)
1.11 ericj 1333: x = readwrite(netfd);
1334: } else {
1335: x = 1;
1336: if ((Single || (o_verbose > 1))
1337: || (errno != ECONNREFUSED)) {
1.13 ericj 1338: nlog(0, "%s [%s] %d (%s)",
1339: whereto->name, whereto->addrs[0],
1340: curport, pinfo->name);
1.11 ericj 1341: }
1342: }
1343: close(netfd);
1.6 deraadt 1344: if (o_interval)
1.11 ericj 1345: sleep(o_interval);
1.6 deraadt 1346: if (o_random)
1347: curport = nextport(randports);
1348: else
1.11 ericj 1349: curport--;
1350: }
1.6 deraadt 1351: optind++;
1.11 ericj 1352: }
1.6 deraadt 1353:
1354: errno = 0;
1.13 ericj 1355: nlog(0, "Sent %i Rcvd %i", wrote_net, wrote_out);
1.6 deraadt 1356: if (Single)
1.11 ericj 1357: exit(x);
1358: exit(0);
1.13 ericj 1359: }
1360:
1361: /*
1362: * nlog:
1363: * dual purpose function, does both warn() and err()
1364: * and pays attention to o_verbose.
1365: */
1366: void
1367: nlog(doexit, fmt)
1.14 ericj 1368: char *fmt;
1.13 ericj 1369: {
1.14 ericj 1370: va_list args;
1.13 ericj 1371:
1.14 ericj 1372: if (o_verbose || doexit) {
1373: va_start(args, fmt);
1374: vfprintf(stderr, fmt, args);
1375: if (h_errno)
1.13 ericj 1376: herror(NULL);
1.14 ericj 1377: else
1378: putc('\n', stderr);
1379: }
1.13 ericj 1380:
1.14 ericj 1381: if (doexit)
1382: exit(1);
1.7 deraadt 1383: }
1.1 deraadt 1384:
1.11 ericj 1385: void
1386: usage(doexit)
1.1 deraadt 1387: {
1.11 ericj 1388: fprintf(stderr, "netcat - [v1.10]\n");
1389: fprintf(stderr, "nc [-lnrtuvz] [-e command] [-g intermediates]\n");
1390: fprintf(stderr, " [-G hopcount] [-i interval] [-o filename] [-p source port]\n");
1391: fprintf(stderr, " [-s ip address] [-w timeout] [hostname] [port[s...]]\n");
1392: if (doexit)
1393: exit(1);
1394: }
1395:
1396: void
1397: help()
1398: {
1399: usage(0);
1400: fprintf(stderr, "\tCommand Summary:\n\
1401: \t-g gateway source-routing hop point[s], up to 8\n\
1402: \t-G num\t source-routing pointer: 4, 8, 12, ...\n\
1403: \t-h this help text\n\
1404: \t-i secs\t delay interval for lines sent, ports scanned\n\
1405: \t-l listen mode, for inbound connects\n\
1406: \t-n numeric-only IP addresses, no DNS\n\
1407: \t-o file\t hex dump of traffic\n\
1408: \t-r randomize local and remote ports\n\
1409: \t-s addr\t local source address\n");
1.1 deraadt 1410: #ifdef TELNET
1.11 ericj 1411: fprintf(stderr, "\t\t-t answer TELNET negotiation\n");
1.1 deraadt 1412: #endif
1.11 ericj 1413: fprintf(stderr, "\t\t-u UDP mode\n\
1414: \t-v verbose [use twice to be more verbose]\n\
1415: \t-w secs\t timeout for connects and final net reads\n\
1416: \t-z zero-I/O mode [used for scanning]\n\
1417: Port numbers can be individual or ranges: lo-hi [inclusive]\n");
1418: exit(1);
1.7 deraadt 1419: }
![[BACK]](/icons/back.gif){kind=icon}
Return to netcat.c CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [local] / src / usr.bin / nc