busybox/networking/nc_bloaty.c
<<
>>
Prefs
   1/* Based on netcat 1.10 RELEASE 960320 written by hobbit@avian.org.
   2 * Released into public domain by the author.
   3 *
   4 * Copyright (C) 2007 Denys Vlasenko.
   5 *
   6 * Licensed under GPLv2, see file LICENSE in this source tree.
   7 */
   8
   9/* Author's comments from nc 1.10:
  10 * =====================
  11 * Netcat is entirely my own creation, although plenty of other code was used as
  12 * examples.  It is freely given away to the Internet community in the hope that
  13 * it will be useful, with no restrictions except giving credit where it is due.
  14 * No GPLs, Berkeley copyrights or any of that nonsense.  The author assumes NO
  15 * responsibility for how anyone uses it.  If netcat makes you rich somehow and
  16 * you're feeling generous, mail me a check.  If you are affiliated in any way
  17 * with Microsoft Network, get a life.  Always ski in control.  Comments,
  18 * questions, and patches to hobbit@avian.org.
  19 * ...
  20 * Netcat and the associated package is a product of Avian Research, and is freely
  21 * available in full source form with no restrictions save an obligation to give
  22 * credit where due.
  23 * ...
  24 * A damn useful little "backend" utility begun 950915 or thereabouts,
  25 * as *Hobbit*'s first real stab at some sockets programming.  Something that
  26 * should have and indeed may have existed ten years ago, but never became a
  27 * standard Unix utility.  IMHO, "nc" could take its place right next to cat,
  28 * cp, rm, mv, dd, ls, and all those other cryptic and Unix-like things.
  29 * =====================
  30 *
  31 * Much of author's comments are still retained in the code.
  32 *
  33 * Functionality removed (rationale):
  34 * - miltiple-port ranges, randomized port scanning (use nmap)
  35 * - telnet support (use telnet)
  36 * - source routing
  37 * - multiple DNS checks
  38 * Functionalty which is different from nc 1.10:
  39 * - PROG in '-e PROG' can have ARGS (and options).
  40 *   Because of this -e option must be last.
  41//TODO: remove -e incompatibility?
  42 * - we don't redirect stderr to the network socket for the -e PROG.
  43 *   (PROG can do it itself if needed, but sometimes it is NOT wanted!)
  44 * - numeric addresses are printed in (), not [] (IPv6 looks better),
  45 *   port numbers are inside (): (1.2.3.4:5678)
  46 * - network read errors are reported on verbose levels > 1
  47 *   (nc 1.10 treats them as EOF)
  48 * - TCP connects from wrong ip/ports (if peer ip:port is specified
  49 *   on the command line, but accept() says that it came from different addr)
  50 *   are closed, but we don't exit - we continue to listen/accept.
  51 * Since bbox 1.22:
  52 * - nc exits when _both_ stdin and network are closed.
  53 *   This makes these two commands:
  54 *    echo "Yes" | nc 127.0.0.1 1234
  55 *    echo "no" | nc -lp 1234
  56 *   exchange their data _and exit_ instead of being stuck.
  57 */
  58
  59/* done in nc.c: #include "libbb.h" */
  60
  61//usage:#if ENABLE_NC_110_COMPAT
  62//usage:
  63//usage:#define nc_trivial_usage
  64//usage:       "[OPTIONS] HOST PORT  - connect"
  65//usage:        IF_NC_SERVER("\n"
  66//usage:       "nc [OPTIONS] -l -p PORT [HOST] [PORT]  - listen"
  67//usage:        )
  68//usage:#define nc_full_usage "\n\n"
  69//usage:       "        -e PROG Run PROG after connect (must be last)"
  70//usage:        IF_NC_SERVER(
  71//usage:     "\n        -l      Listen mode, for inbound connects"
  72//usage:     "\n        -lk     With -e, provides persistent server"
  73/* -ll does the same as -lk, but its our extension, while -k is BSD'd,
  74 * presumably more widely known. Therefore we advertise it, not -ll.
  75 * I would like to drop -ll support, but our "small" nc supports it,
  76 * and Rob uses it.
  77 */
  78//usage:        )
  79//usage:     "\n        -p PORT Local port"
  80//usage:     "\n        -s ADDR Local address"
  81//usage:     "\n        -w SEC  Timeout for connects and final net reads"
  82//usage:        IF_NC_EXTRA(
  83//usage:     "\n        -i SEC  Delay interval for lines sent" /* ", ports scanned" */
  84//usage:        )
  85//usage:     "\n        -n      Don't do DNS resolution"
  86//usage:     "\n        -u      UDP mode"
  87//usage:     "\n        -b      Allow broadcasts"
  88//usage:     "\n        -v      Verbose"
  89//usage:        IF_NC_EXTRA(
  90//usage:     "\n        -o FILE Hex dump traffic"
  91//usage:     "\n        -z      Zero-I/O mode (scanning)"
  92//usage:        )
  93//usage:#endif
  94
  95/*   "\n        -r              Randomize local and remote ports" */
  96/*   "\n        -g gateway      Source-routing hop point[s], up to 8" */
  97/*   "\n        -G num          Source-routing pointer: 4, 8, 12, ..." */
  98/*   "\nport numbers can be individual or ranges: lo-hi [inclusive]" */
  99
 100/* -e PROG can take ARGS too: "nc ... -e ls -l", but we don't document it
 101 * in help text: nc 1.10 does not allow that. We don't want to entice
 102 * users to use this incompatibility */
 103
 104enum {
 105        SLEAZE_PORT = 31337,               /* for UDP-scan RTT trick, change if ya want */
 106        BIGSIZ = 8192,                     /* big buffers */
 107
 108        netfd = 3,
 109        ofd = 4,
 110};
 111
 112struct globals {
 113        /* global cmd flags: */
 114        unsigned o_verbose;
 115        unsigned o_wait;
 116#if ENABLE_NC_EXTRA
 117        unsigned o_interval;
 118#endif
 119
 120        /*int netfd;*/
 121        /*int ofd;*/                     /* hexdump output fd */
 122#if ENABLE_LFS
 123#define SENT_N_RECV_M "sent %llu, rcvd %llu\n"
 124        unsigned long long wrote_out;          /* total stdout bytes */
 125        unsigned long long wrote_net;          /* total net bytes */
 126#else
 127#define SENT_N_RECV_M "sent %u, rcvd %u\n"
 128        unsigned wrote_out;          /* total stdout bytes */
 129        unsigned wrote_net;          /* total net bytes */
 130#endif
 131        char *proggie0saved;
 132        /* ouraddr is never NULL and goes through three states as we progress:
 133         1 - local address before bind (IP/port possibly zero)
 134         2 - local address after bind (port is nonzero)
 135         3 - local address after connect??/recv/accept (IP and port are nonzero) */
 136        struct len_and_sockaddr *ouraddr;
 137        /* themaddr is NULL if no peer hostname[:port] specified on command line */
 138        struct len_and_sockaddr *themaddr;
 139        /* remend is set after connect/recv/accept to the actual ip:port of peer */
 140        struct len_and_sockaddr remend;
 141
 142        jmp_buf jbuf;                /* timer crud */
 143
 144        char bigbuf_in[BIGSIZ];      /* data buffers */
 145        char bigbuf_net[BIGSIZ];
 146};
 147
 148#define G (*ptr_to_globals)
 149#define wrote_out  (G.wrote_out )
 150#define wrote_net  (G.wrote_net )
 151#define ouraddr    (G.ouraddr   )
 152#define themaddr   (G.themaddr  )
 153#define remend     (G.remend    )
 154#define jbuf       (G.jbuf      )
 155#define bigbuf_in  (G.bigbuf_in )
 156#define bigbuf_net (G.bigbuf_net)
 157#define o_verbose  (G.o_verbose )
 158#define o_wait     (G.o_wait    )
 159#if ENABLE_NC_EXTRA
 160#define o_interval (G.o_interval)
 161#else
 162#define o_interval 0
 163#endif
 164#define INIT_G() do { \
 165        SET_PTR_TO_GLOBALS(xzalloc(sizeof(G))); \
 166} while (0)
 167
 168
 169/* Must match getopt32 call! */
 170enum {
 171        OPT_n = (1 << 0),
 172        OPT_p = (1 << 1),
 173        OPT_s = (1 << 2),
 174        OPT_u = (1 << 3),
 175        OPT_b = (1 << 4),
 176        OPT_v = (1 << 5),
 177        OPT_w = (1 << 6),
 178        OPT_l = (1 << 7) * ENABLE_NC_SERVER,
 179        OPT_k = (1 << 8) * ENABLE_NC_SERVER,
 180        OPT_i = (1 << (7+2*ENABLE_NC_SERVER)) * ENABLE_NC_EXTRA,
 181        OPT_o = (1 << (8+2*ENABLE_NC_SERVER)) * ENABLE_NC_EXTRA,
 182        OPT_z = (1 << (9+2*ENABLE_NC_SERVER)) * ENABLE_NC_EXTRA,
 183};
 184
 185#define o_nflag   (option_mask32 & OPT_n)
 186#define o_udpmode (option_mask32 & OPT_u)
 187#define o_bcmode  (option_mask32 & OPT_b)
 188#if ENABLE_NC_EXTRA
 189#define o_ofile   (option_mask32 & OPT_o)
 190#define o_zero    (option_mask32 & OPT_z)
 191#else
 192#define o_ofile   0
 193#define o_zero    0
 194#endif
 195
 196/* Debug: squirt whatever message and sleep a bit so we can see it go by. */
 197/* Beware: writes to stdOUT... */
 198#if 0
 199#define Debug(...) do { printf(__VA_ARGS__); printf("\n"); fflush_all(); sleep1(); } while (0)
 200#else
 201#define Debug(...) do { } while (0)
 202#endif
 203
 204#define holler_error(msg)  do { if (o_verbose) bb_simple_error_msg(msg); } while (0)
 205#define holler_perror(msg) do { if (o_verbose) bb_simple_perror_msg(msg); } while (0)
 206
 207/* catch: no-brainer interrupt handler */
 208static void catch(int sig)
 209{
 210        if (o_verbose > 1)                /* normally we don't care */
 211                fprintf(stderr, SENT_N_RECV_M, wrote_net, wrote_out);
 212        fprintf(stderr, "punt!\n");
 213        kill_myself_with_sig(sig);
 214}
 215
 216/* unarm  */
 217static void unarm(void)
 218{
 219        signal(SIGALRM, SIG_IGN);
 220        alarm(0);
 221}
 222
 223/* timeout and other signal handling cruft */
 224static void tmtravel(int sig UNUSED_PARAM)
 225{
 226        unarm();
 227        longjmp(jbuf, 1);
 228}
 229
 230/* arm: set the timer.  */
 231static void arm(unsigned secs)
 232{
 233        signal(SIGALRM, tmtravel);
 234        alarm(secs);
 235}
 236
 237/* findline:
 238 find the next newline in a buffer; return inclusive size of that "line",
 239 or the entire buffer size, so the caller knows how much to then write().
 240 Not distinguishing \n vs \r\n for the nonce; it just works as is... */
 241static unsigned findline(char *buf, unsigned siz)
 242{
 243        char * p;
 244        int x;
 245        if (!buf)                        /* various sanity checks... */
 246                return 0;
 247        if (siz > BIGSIZ)
 248                return 0;
 249        x = siz;
 250        for (p = buf; x > 0; x--) {
 251                if (*p == '\n') {
 252                        x = (int) (p - buf);
 253                        x++;                        /* 'sokay if it points just past the end! */
 254Debug("findline returning %d", x);
 255                        return x;
 256                }
 257                p++;
 258        } /* for */
 259Debug("findline returning whole thing: %d", siz);
 260        return siz;
 261} /* findline */
 262
 263/* doexec:
 264 fiddle all the file descriptors around, and hand off to another prog.  Sort
 265 of like a one-off "poor man's inetd".  This is the only section of code
 266 that would be security-critical, which is why it's ifdefed out by default.
 267 Use at your own hairy risk; if you leave shells lying around behind open
 268 listening ports you deserve to lose!! */
 269static int doexec(char **proggie) NORETURN;
 270static int doexec(char **proggie)
 271{
 272        if (G.proggie0saved)
 273                proggie[0] = G.proggie0saved;
 274        xmove_fd(netfd, 0);
 275        dup2(0, 1);
 276        /* dup2(0, 2); - do we *really* want this? NO!
 277         * exec'ed prog can do it yourself, if needed */
 278        BB_EXECVP_or_die(proggie);
 279}
 280
 281/* connect_w_timeout:
 282 return an fd for one of
 283 an open outbound TCP connection, a UDP stub-socket thingie, or
 284 an unconnected TCP or UDP socket to listen on.
 285 Examines various global o_blah flags to figure out what to do.
 286 lad can be NULL, then socket is not bound to any local ip[:port] */
 287static int connect_w_timeout(int fd)
 288{
 289        int rr;
 290
 291        /* wrap connect inside a timer, and hit it */
 292        arm(o_wait);
 293        if (setjmp(jbuf) == 0) {
 294                rr = connect(fd, &themaddr->u.sa, themaddr->len);
 295                unarm();
 296        } else { /* setjmp: connect failed... */
 297                rr = -1;
 298                errno = ETIMEDOUT; /* fake it */
 299        }
 300        return rr;
 301}
 302
 303/* dolisten:
 304 listens for
 305 incoming and returns an open connection *from* someplace.  If we were
 306 given host/port args, any connections from elsewhere are rejected.  This
 307 in conjunction with local-address binding should limit things nicely... */
 308static void dolisten(int is_persistent, char **proggie)
 309{
 310        int rr;
 311
 312        if (!o_udpmode)
 313                xlisten(netfd, 1); /* TCP: gotta listen() before we can get */
 314
 315        /* Various things that follow temporarily trash bigbuf_net, which might contain
 316         a copy of any recvfrom()ed packet, but we'll read() another copy later. */
 317
 318        /* I can't believe I have to do all this to get my own goddamn bound address
 319         and port number.  It should just get filled in during bind() or something.
 320         All this is only useful if we didn't say -p for listening, since if we
 321         said -p we *know* what port we're listening on.  At any rate we won't bother
 322         with it all unless we wanted to see it, although listening quietly on a
 323         random unknown port is probably not very useful without "netstat". */
 324        if (o_verbose) {
 325                char *addr;
 326                getsockname(netfd, &ouraddr->u.sa, &ouraddr->len);
 327                //if (rr < 0)
 328                //      bb_perror_msg_and_die("getsockname after bind");
 329                addr = xmalloc_sockaddr2dotted(&ouraddr->u.sa);
 330                fprintf(stderr, "listening on %s ...\n", addr);
 331                free(addr);
 332        }
 333
 334        if (o_udpmode) {
 335                /* UDP is a speeeeecial case -- we have to do I/O *and* get the calling
 336                 party's particulars all at once, listen() and accept() don't apply.
 337                 At least in the BSD universe, however, recvfrom/PEEK is enough to tell
 338                 us something came in, and we can set things up so straight read/write
 339                 actually does work after all.  Yow.  YMMV on strange platforms!  */
 340
 341                /* I'm not completely clear on how this works -- BSD seems to make UDP
 342                 just magically work in a connect()ed context, but we'll undoubtedly run
 343                 into systems this deal doesn't work on.  For now, we apparently have to
 344                 issue a connect() on our just-tickled socket so we can write() back.
 345                 Again, why the fuck doesn't it just get filled in and taken care of?!
 346                 This hack is anything but optimal.  Basically, if you want your listener
 347                 to also be able to send data back, you need this connect() line, which
 348                 also has the side effect that now anything from a different source or even a
 349                 different port on the other end won't show up and will cause ICMP errors.
 350                 I guess that's what they meant by "connect".
 351                 Let's try to remember what the "U" is *really* for, eh? */
 352
 353                /* If peer address is specified, connect to it */
 354                remend.len = LSA_SIZEOF_SA;
 355                if (themaddr) {
 356                        remend = *themaddr;
 357                        xconnect(netfd, &themaddr->u.sa, themaddr->len);
 358                }
 359                /* peek first packet and remember peer addr */
 360                arm(o_wait);                /* might as well timeout this, too */
 361                if (setjmp(jbuf) == 0) {       /* do timeout for initial connect */
 362                        /* (*ouraddr) is prefilled with "default" address */
 363                        /* and here we block... */
 364                        rr = recv_from_to(netfd, NULL, 0, MSG_PEEK, /*was bigbuf_net, BIGSIZ*/
 365                                &remend.u.sa, &ouraddr->u.sa, ouraddr->len);
 366                        if (rr < 0)
 367                                bb_simple_perror_msg_and_die("recvfrom");
 368                        unarm();
 369                } else
 370                        bb_simple_error_msg_and_die("timeout");
 371/* Now we learned *to which IP* peer has connected, and we want to anchor
 372our socket on it, so that our outbound packets will have correct local IP.
 373Unfortunately, bind() on already bound socket will fail now (EINVAL):
 374        xbind(netfd, &ouraddr->u.sa, ouraddr->len);
 375Need to read the packet, save data, close this socket and
 376create new one, and bind() it. TODO */
 377                if (!themaddr)
 378                        xconnect(netfd, &remend.u.sa, ouraddr->len);
 379        } else {
 380                /* TCP */
 381 another:
 382                arm(o_wait); /* wrap this in a timer, too; 0 = forever */
 383                if (setjmp(jbuf) == 0) {
 384 again:
 385                        remend.len = LSA_SIZEOF_SA;
 386                        rr = accept(netfd, &remend.u.sa, &remend.len);
 387                        if (rr < 0)
 388                                bb_simple_perror_msg_and_die("accept");
 389                        if (themaddr) {
 390                                int sv_port, port, r;
 391
 392                                sv_port = get_nport(&remend.u.sa); /* save */
 393                                port = get_nport(&themaddr->u.sa);
 394                                if (port == 0) {
 395                                        /* "nc -nl -p LPORT RHOST" (w/o RPORT!):
 396                                         * we should accept any remote port */
 397                                        set_nport(&remend.u.sa, 0); /* blot out remote port# */
 398                                }
 399                                r = memcmp(&remend.u.sa, &themaddr->u.sa, remend.len);
 400                                set_nport(&remend.u.sa, sv_port); /* restore */
 401                                if (r != 0) {
 402                                        /* nc 1.10 bails out instead, and its error message
 403                                         * is not suppressed by o_verbose */
 404                                        if (o_verbose) {
 405                                                char *remaddr = xmalloc_sockaddr2dotted(&remend.u.sa);
 406                                                bb_error_msg("connect from wrong ip/port %s ignored", remaddr);
 407                                                free(remaddr);
 408                                        }
 409                                        close(rr);
 410                                        goto again;
 411                                }
 412                        }
 413                        unarm();
 414                } else
 415                        bb_simple_error_msg_and_die("timeout");
 416
 417                if (is_persistent && proggie) {
 418                        /* -l -k -e PROG */
 419                        signal(SIGCHLD, SIG_IGN); /* no zombies please */
 420                        if (xvfork() != 0) {
 421                                /* parent: go back and accept more connections */
 422                                close(rr);
 423                                goto another;
 424                        }
 425                        /* child */
 426                        signal(SIGCHLD, SIG_DFL);
 427                }
 428
 429                xmove_fd(rr, netfd); /* dump the old socket, here's our new one */
 430                /* find out what address the connection was *to* on our end, in case we're
 431                 doing a listen-on-any on a multihomed machine.  This allows one to
 432                 offer different services via different alias addresses, such as the
 433                 "virtual web site" hack. */
 434                getsockname(netfd, &ouraddr->u.sa, &ouraddr->len);
 435                //if (rr < 0)
 436                //      bb_perror_msg_and_die("getsockname after accept");
 437        }
 438
 439        if (o_verbose) {
 440                char *lcladdr, *remaddr, *remhostname;
 441
 442#if ENABLE_NC_EXTRA && defined(IP_OPTIONS)
 443        /* If we can, look for any IP options.  Useful for testing the receiving end of
 444         such things, and is a good exercise in dealing with it.  We do this before
 445         the connect message, to ensure that the connect msg is uniformly the LAST
 446         thing to emerge after all the intervening crud.  Doesn't work for UDP on
 447         any machines I've tested, but feel free to surprise me. */
 448                char optbuf[40];
 449                socklen_t x = sizeof(optbuf);
 450
 451                rr = getsockopt(netfd, IPPROTO_IP, IP_OPTIONS, optbuf, &x);
 452                if (rr >= 0 && x) {    /* we've got options, lessee em... */
 453                        *bin2hex(bigbuf_net, optbuf, x) = '\0';
 454                        fprintf(stderr, "IP options: %s\n", bigbuf_net);
 455                }
 456#endif
 457
 458        /* now check out who it is.  We don't care about mismatched DNS names here,
 459         but any ADDR and PORT we specified had better fucking well match the caller.
 460         Converting from addr to inet_ntoa and back again is a bit of a kludge, but
 461         gethostpoop wants a string and there's much gnarlier code out there already,
 462         so I don't feel bad.
 463         The *real* question is why BFD sockets wasn't designed to allow listens for
 464         connections *from* specific hosts/ports, instead of requiring the caller to
 465         accept the connection and then reject undesirable ones by closing.
 466         In other words, we need a TCP MSG_PEEK. */
 467        /* bbox: removed most of it */
 468                lcladdr = xmalloc_sockaddr2dotted(&ouraddr->u.sa);
 469                remaddr = xmalloc_sockaddr2dotted(&remend.u.sa);
 470                remhostname = o_nflag ? remaddr : xmalloc_sockaddr2host(&remend.u.sa);
 471                fprintf(stderr, "connect to %s from %s (%s)\n",
 472                                lcladdr, remhostname, remaddr);
 473                free(lcladdr);
 474                free(remaddr);
 475                if (!o_nflag)
 476                        free(remhostname);
 477        }
 478
 479        if (proggie)
 480                doexec(proggie);
 481}
 482
 483/* udptest:
 484 fire a couple of packets at a UDP target port, just to see if it's really
 485 there.  On BSD kernels, ICMP host/port-unreachable errors get delivered to
 486 our socket as ECONNREFUSED write errors.  On SV kernels, we lose; we'll have
 487 to collect and analyze raw ICMP ourselves a la satan's probe_udp_ports
 488 backend.  Guess where one could swipe the appropriate code from...
 489
 490 Use the time delay between writes if given, otherwise use the "tcp ping"
 491 trick for getting the RTT.  [I got that idea from pluvius, and warped it.]
 492 Return either the original fd, or clean up and return -1. */
 493#if ENABLE_NC_EXTRA
 494static int udptest(void)
 495{
 496        int rr;
 497
 498        rr = write(netfd, bigbuf_in, 1);
 499        if (rr != 1)
 500                bb_simple_perror_msg("udptest first write");
 501
 502        if (o_wait)
 503                sleep(o_wait); // can be interrupted! while (t) nanosleep(&t)?
 504        else {
 505        /* use the tcp-ping trick: try connecting to a normally refused port, which
 506         causes us to block for the time that SYN gets there and RST gets back.
 507         Not completely reliable, but it *does* mostly work. */
 508        /* Set a temporary connect timeout, so packet filtration doesn't cause
 509         us to hang forever, and hit it */
 510                o_wait = 5;                     /* enough that we'll notice?? */
 511                rr = xsocket(ouraddr->u.sa.sa_family, SOCK_STREAM, 0);
 512                set_nport(&themaddr->u.sa, htons(SLEAZE_PORT));
 513                connect_w_timeout(rr);
 514                /* don't need to restore themaddr's port, it's not used anymore */
 515                close(rr);
 516                o_wait = 0; /* restore */
 517        }
 518
 519        rr = write(netfd, bigbuf_in, 1);
 520        return (rr != 1); /* if rr == 1, return 0 (success) */
 521}
 522#else
 523int udptest(void);
 524#endif
 525
 526/* oprint:
 527 Hexdump bytes shoveled either way to a running logfile, in the format:
 528 D offset       -  - - - --- 16 bytes --- - - -  -     # .... ascii .....
 529 where "which" sets the direction indicator, D:
 530 0 -- sent to network, or ">"
 531 1 -- rcvd and printed to stdout, or "<"
 532 and "buf" and "n" are data-block and length.  If the current block generates
 533 a partial line, so be it; we *want* that lockstep indication of who sent
 534 what when.  Adapted from dgaudet's original example -- but must be ripping
 535 *fast*, since we don't want to be too disk-bound... */
 536#if ENABLE_NC_EXTRA
 537static void oprint(int direction, unsigned char *p, unsigned bc)
 538{
 539        unsigned obc;           /* current "global" offset */
 540        unsigned x;
 541        unsigned char *op;      /* out hexdump ptr */
 542        unsigned char *ap;      /* out asc-dump ptr */
 543        unsigned char stage[100];
 544
 545        if (bc == 0)
 546                return;
 547
 548        obc = wrote_net; /* use the globals! */
 549        if (direction == '<')
 550                obc = wrote_out;
 551        stage[0] = direction;
 552        stage[59] = '#'; /* preload separator */
 553        stage[60] = ' ';
 554
 555        do {    /* for chunk-o-data ... */
 556                x = 16;
 557                if (bc < 16) {
 558                        /* memset(&stage[bc*3 + 11], ' ', 16*3 - bc*3); */
 559                        memset(&stage[11], ' ', 16*3);
 560                        x = bc;
 561                }
 562                sprintf((char *)&stage[1], " %8.8x ", obc);  /* xxx: still slow? */
 563                bc -= x;          /* fix current count */
 564                obc += x;         /* fix current offset */
 565                op = &stage[11];  /* where hex starts */
 566                ap = &stage[61];  /* where ascii starts */
 567
 568                do {  /* for line of dump, however long ... */
 569                        *op++ = 0x20 | bb_hexdigits_upcase[*p >> 4];
 570                        *op++ = 0x20 | bb_hexdigits_upcase[*p & 0x0f];
 571                        *op++ = ' ';
 572                        if ((*p > 31) && (*p < 127))
 573                                *ap = *p;   /* printing */
 574                        else
 575                                *ap = '.';  /* nonprinting, loose def */
 576                        ap++;
 577                        p++;
 578                } while (--x);
 579                *ap++ = '\n';  /* finish the line */
 580                xwrite(ofd, stage, ap - stage);
 581        } while (bc);
 582}
 583#else
 584void oprint(int direction, unsigned char *p, unsigned bc);
 585#endif
 586
 587/* readwrite:
 588 handle stdin/stdout/network I/O.  Bwahaha!! -- the i/o loop from hell.
 589 In this instance, return what might become our exit status. */
 590static int readwrite(void)
 591{
 592        char *zp = zp; /* gcc */  /* stdin buf ptr */
 593        char *np = np;            /* net-in buf ptr */
 594        unsigned rzleft;
 595        unsigned rnleft;
 596        unsigned netretry;              /* net-read retry counter */
 597        unsigned fds_open;
 598
 599        struct pollfd pfds[2];
 600        pfds[0].fd = STDIN_FILENO;
 601        pfds[0].events = POLLIN;
 602        pfds[1].fd = netfd;
 603        pfds[1].events = POLLIN;
 604
 605        fds_open = 2;
 606        netretry = 2;
 607        rzleft = rnleft = 0;
 608        if (o_interval)
 609                sleep(o_interval);                /* pause *before* sending stuff, too */
 610
 611        /* and now the big ol' shoveling loop ... */
 612        /* nc 1.10 has "while (FD_ISSET(netfd)" here */
 613        while (fds_open) {
 614                int rr;
 615                int poll_tmout_ms;
 616                unsigned wretry = 8200;               /* net-write sanity counter */
 617
 618                poll_tmout_ms = -1;
 619                if (o_wait) {
 620                        poll_tmout_ms = INT_MAX;
 621                        if (o_wait < INT_MAX / 1000)
 622                                poll_tmout_ms = o_wait * 1000;
 623                }
 624                rr = poll(pfds, 2, poll_tmout_ms);
 625                if (rr < 0 && errno != EINTR) {                /* might have gotten ^Zed, etc */
 626                        holler_perror("poll");
 627                        close(netfd);
 628                        return 1;
 629                }
 630        /* if we have a timeout AND stdin is closed AND we haven't heard anything
 631         from the net during that time, assume it's dead and close it too. */
 632                if (rr == 0) {
 633                        if (!pfds[0].revents) {
 634                                netretry--;                        /* we actually try a coupla times. */
 635                                if (!netretry) {
 636                                        if (o_verbose > 1)         /* normally we don't care */
 637                                                fprintf(stderr, "net timeout\n");
 638                                        /*close(netfd); - redundant, exit will do it */
 639                                        return 0;                  /* not an error! */
 640                                }
 641                        }
 642                } /* timeout */
 643
 644        /* Ding!!  Something arrived, go check all the incoming hoppers, net first */
 645                if (pfds[1].revents) {                /* net: ding! */
 646                        rr = read(netfd, bigbuf_net, BIGSIZ);
 647                        if (rr <= 0) {
 648                                if (rr < 0 && o_verbose > 1) {
 649                                        /* nc 1.10 doesn't do this */
 650                                        bb_simple_perror_msg("net read");
 651                                }
 652                                pfds[1].fd = -1;                   /* don't poll for netfd anymore */
 653                                fds_open--;
 654                                rzleft = 0;                        /* can't write anymore: broken pipe */
 655                        } else {
 656                                rnleft = rr;
 657                                np = bigbuf_net;
 658                        }
 659Debug("got %d from the net, errno %d", rr, errno);
 660                } /* net:ding */
 661
 662        /* if we're in "slowly" mode there's probably still stuff in the stdin
 663         buffer, so don't read unless we really need MORE INPUT!  MORE INPUT! */
 664                if (rzleft)
 665                        goto shovel;
 666
 667        /* okay, suck more stdin */
 668                if (pfds[0].revents) {                /* stdin: ding! */
 669                        rr = read(STDIN_FILENO, bigbuf_in, BIGSIZ);
 670        /* Considered making reads here smaller for UDP mode, but 8192-byte
 671         mobygrams are kinda fun and exercise the reassembler. */
 672                        if (rr <= 0) {                        /* at end, or fukt, or ... */
 673                                pfds[0].fd = -1;              /* disable stdin */
 674                                /*close(STDIN_FILENO); - not really necessary */
 675                                /* Let peer know we have no more data */
 676                                /* nc 1.10 doesn't do this: */
 677                                shutdown(netfd, SHUT_WR);
 678                                fds_open--;
 679                        } else {
 680                                rzleft = rr;
 681                                zp = bigbuf_in;
 682                        }
 683                } /* stdin:ding */
 684 shovel:
 685        /* now that we've dingdonged all our thingdings, send off the results.
 686         Geez, why does this look an awful lot like the big loop in "rsh"? ...
 687         not sure if the order of this matters, but write net -> stdout first. */
 688
 689                if (rnleft) {
 690                        rr = write(STDOUT_FILENO, np, rnleft);
 691                        if (rr > 0) {
 692                                if (o_ofile) /* log the stdout */
 693                                        oprint('<', (unsigned char *)np, rr);
 694                                np += rr;
 695                                rnleft -= rr;
 696                                wrote_out += rr; /* global count */
 697                        }
 698Debug("wrote %d to stdout, errno %d", rr, errno);
 699                } /* rnleft */
 700                if (rzleft) {
 701                        if (o_interval)                        /* in "slowly" mode ?? */
 702                                rr = findline(zp, rzleft);
 703                        else
 704                                rr = rzleft;
 705                        rr = write(netfd, zp, rr);        /* one line, or the whole buffer */
 706                        if (rr > 0) {
 707                                if (o_ofile) /* log what got sent */
 708                                        oprint('>', (unsigned char *)zp, rr);
 709                                zp += rr;
 710                                rzleft -= rr;
 711                                wrote_net += rr; /* global count */
 712                        }
 713Debug("wrote %d to net, errno %d", rr, errno);
 714                } /* rzleft */
 715                if (o_interval) {                        /* cycle between slow lines, or ... */
 716                        sleep(o_interval);
 717                        continue;                        /* ...with hairy loop... */
 718                }
 719                if (rzleft || rnleft) {                  /* shovel that shit till they ain't */
 720                        wretry--;                        /* none left, and get another load */
 721        /* net write retries sometimes happen on UDP connections */
 722                        if (!wretry) {                   /* is something hung? */
 723                                holler_error("too many output retries");
 724                                return 1;
 725                        }
 726                        goto shovel;
 727                }
 728        } /* while (fds_open) */
 729
 730        /* XXX: maybe want a more graceful shutdown() here, or screw around with
 731         linger times??  I suspect that I don't need to since I'm always doing
 732         blocking reads and writes and my own manual "last ditch" efforts to read
 733         the net again after a timeout.  I haven't seen any screwups yet, but it's
 734         not like my test network is particularly busy... */
 735        close(netfd);
 736        return 0;
 737} /* readwrite */
 738
 739/* main: now we pull it all together... */
 740int nc_main(int argc, char **argv) MAIN_EXTERNALLY_VISIBLE;
 741int nc_main(int argc UNUSED_PARAM, char **argv)
 742{
 743        char *str_p, *str_s;
 744        IF_NC_EXTRA(char *str_i, *str_o;)
 745        char *themdotted = themdotted; /* for compiler */
 746        char **proggie;
 747        int x;
 748        unsigned cnt_l = 0;
 749        unsigned o_lport = 0;
 750
 751        INIT_G();
 752
 753        /* catch a signal or two for cleanup */
 754        bb_signals(0
 755                + (1 << SIGINT)
 756                + (1 << SIGQUIT)
 757                + (1 << SIGTERM)
 758                , catch);
 759        /* and suppress others... */
 760        bb_signals(0
 761#ifdef SIGURG
 762                + (1 << SIGURG)
 763#endif
 764                + (1 << SIGPIPE) /* important! */
 765                , SIG_IGN);
 766
 767        proggie = argv;
 768        while (*++proggie) {
 769                if (strcmp(*proggie, "-e") == 0) {
 770                        *proggie = NULL;
 771                        proggie++;
 772                        goto e_found;
 773                }
 774                /* -<other_opts>e PROG [ARGS] ? */
 775                /* (aboriginal linux uses this form) */
 776                if (proggie[0][0] == '-') {
 777                        char *optpos = *proggie + 1;
 778                        /* Skip all valid opts w/o params */
 779                        optpos = optpos + strspn(optpos, "nuv"IF_NC_SERVER("lk")IF_NC_EXTRA("z"));
 780                        if (*optpos == 'e' && !optpos[1]) {
 781                                *optpos = '\0';
 782                                proggie++;
 783                                G.proggie0saved = *proggie;
 784                                *proggie = NULL; /* terminate argv for getopt32 */
 785                                goto e_found;
 786                        }
 787                }
 788        }
 789        proggie = NULL;
 790 e_found:
 791
 792        // -g -G -t -r deleted, unimplemented -a deleted too
 793        getopt32(argv, "^"
 794                "np:s:ubvw:+"/* -w N */ IF_NC_SERVER("lk")
 795                IF_NC_EXTRA("i:o:z")
 796                        "\0"
 797                        "?2:vv"IF_NC_SERVER(":ll"), /* max 2 params; -v and -l are counters */
 798                &str_p, &str_s, &o_wait
 799                IF_NC_EXTRA(, &str_i, &str_o)
 800                        , &o_verbose IF_NC_SERVER(, &cnt_l)
 801        );
 802        argv += optind;
 803#if ENABLE_NC_EXTRA
 804        if (option_mask32 & OPT_i) /* line-interval time */
 805                o_interval = xatou_range(str_i, 1, 0xffff);
 806#endif
 807#if ENABLE_NC_SERVER
 808        //if (option_mask32 & OPT_l) /* listen mode */
 809        if (option_mask32 & OPT_k) /* persistent server mode */
 810                cnt_l = 2;
 811#endif
 812        //if (option_mask32 & OPT_n) /* numeric-only, no DNS lookups */
 813        //if (option_mask32 & OPT_o) /* hexdump log */
 814        if (option_mask32 & OPT_p) { /* local source port */
 815                o_lport = bb_lookup_port(str_p, o_udpmode ? "udp" : "tcp", 0);
 816        }
 817        //if (option_mask32 & OPT_r) /* randomize various things */
 818        //if (option_mask32 & OPT_u) /* use UDP */
 819        //if (option_mask32 & OPT_v) /* verbose */
 820        //if (option_mask32 & OPT_w) /* wait time */
 821        //if (option_mask32 & OPT_z) /* little or no data xfer */
 822
 823        /* We manage our fd's so that they are never 0,1,2 */
 824        /*bb_sanitize_stdio(); - not needed */
 825
 826        if (argv[0]) {
 827                themaddr = xhost2sockaddr(argv[0],
 828                        bb_lookup_port(argv[1], o_udpmode ? "udp" : "tcp", 0)
 829                );
 830        }
 831
 832        /* create & bind network socket */
 833        x = (o_udpmode ? SOCK_DGRAM : SOCK_STREAM);
 834        if (option_mask32 & OPT_s) { /* local address */
 835                /* if o_lport is still 0, then we will use random port */
 836                ouraddr = xhost2sockaddr(str_s, o_lport);
 837#ifdef BLOAT
 838                /* prevent spurious "UDP listen needs !0 port" */
 839                o_lport = get_nport(ouraddr);
 840                o_lport = ntohs(o_lport);
 841#endif
 842                x = xsocket(ouraddr->u.sa.sa_family, x, 0);
 843        } else {
 844                /* We try IPv6, then IPv4, unless addr family is
 845                 * implicitly set by way of remote addr/port spec */
 846                x = xsocket_type(&ouraddr,
 847                                (themaddr ? themaddr->u.sa.sa_family : AF_UNSPEC),
 848                                x);
 849                if (o_lport)
 850                        set_nport(&ouraddr->u.sa, htons(o_lport));
 851        }
 852        xmove_fd(x, netfd);
 853        setsockopt_reuseaddr(netfd);
 854        if (o_udpmode) {
 855                if (o_bcmode)
 856                        setsockopt_broadcast(netfd);
 857                socket_want_pktinfo(netfd);
 858        }
 859        if (!ENABLE_FEATURE_UNIX_LOCAL
 860         || cnt_l != 0 /* listen */
 861         || ouraddr->u.sa.sa_family != AF_UNIX
 862        ) {
 863                xbind(netfd, &ouraddr->u.sa, ouraddr->len);
 864        }
 865#if 0
 866        setsockopt_SOL_SOCKET_int(netfd, SO_RCVBUF, o_rcvbuf);
 867        setsockopt_SOL_SOCKET_int(netfd, SO_SNDBUF, o_sndbuf);
 868#endif
 869
 870#ifdef BLOAT
 871        if (OPT_l && (option_mask32 & (OPT_u|OPT_l)) == (OPT_u|OPT_l)) {
 872                /* apparently UDP can listen ON "port 0",
 873                 but that's not useful */
 874                if (!o_lport)
 875                        bb_simple_error_msg_and_die("UDP listen needs nonzero -p port");
 876        }
 877#endif
 878
 879        if (proggie) {
 880                close(STDIN_FILENO); /* won't need stdin */
 881                option_mask32 &= ~OPT_o; /* -o with -e is meaningless! */
 882        }
 883#if ENABLE_NC_EXTRA
 884        if (o_ofile)
 885                xmove_fd(xopen(str_o, O_WRONLY|O_CREAT|O_TRUNC), ofd);
 886#endif
 887
 888        if (cnt_l != 0) {
 889                dolisten((cnt_l - 1), proggie);
 890                /* dolisten does its own connect reporting */
 891                x = readwrite(); /* it even works with UDP! */
 892        } else {
 893                /* Outbound connects.  Now we're more picky about args... */
 894                if (!themaddr)
 895                        bb_show_usage();
 896
 897                remend = *themaddr;
 898                if (o_verbose)
 899                        themdotted = xmalloc_sockaddr2dotted(&themaddr->u.sa);
 900
 901                x = connect_w_timeout(netfd);
 902                if (o_zero && x == 0 && o_udpmode)        /* if UDP scanning... */
 903                        x = udptest();
 904                if (x == 0) {                        /* Yow, are we OPEN YET?! */
 905                        if (o_verbose)
 906                                fprintf(stderr, "%s (%s) open\n", argv[0], themdotted);
 907                        if (proggie)                        /* exec is valid for outbound, too */
 908                                doexec(proggie);
 909                        if (!o_zero)
 910                                x = readwrite();
 911                } else { /* connect or udptest wasn't successful */
 912                        x = 1;                                /* exit status */
 913                        /* if we're scanning at a "one -v" verbosity level, don't print refusals.
 914                         Give it another -v if you want to see everything. */
 915                        if (o_verbose > 1 || (o_verbose && errno != ECONNREFUSED))
 916                                bb_perror_msg("%s (%s)", argv[0], themdotted);
 917                }
 918        }
 919        if (o_verbose > 1)                /* normally we don't care */
 920                fprintf(stderr, SENT_N_RECV_M, wrote_net, wrote_out);
 921        return x;
 922}
 923