1/* Based on netcat 1.10 RELEASE 960320 written by hobbit@avian.org. 2 * Released into public domain by the author. 3 * 4 * Copyright (C) 2007 Denys Vlasenko. 5 * 6 * Licensed under GPLv2, see file LICENSE in this source tree. 7 */ 8 9/* Author's comments from nc 1.10: 10 * ===================== 11 * Netcat is entirely my own creation, although plenty of other code was used as 12 * examples. It is freely given away to the Internet community in the hope that 13 * it will be useful, with no restrictions except giving credit where it is due. 14 * No GPLs, Berkeley copyrights or any of that nonsense. The author assumes NO 15 * responsibility for how anyone uses it. If netcat makes you rich somehow and 16 * you're feeling generous, mail me a check. If you are affiliated in any way 17 * with Microsoft Network, get a life. Always ski in control. Comments, 18 * questions, and patches to hobbit@avian.org. 19 * ... 20 * Netcat and the associated package is a product of Avian Research, and is freely 21 * available in full source form with no restrictions save an obligation to give 22 * credit where due. 23 * ... 24 * A damn useful little "backend" utility begun 950915 or thereabouts, 25 * as *Hobbit*'s first real stab at some sockets programming. Something that 26 * should have and indeed may have existed ten years ago, but never became a 27 * standard Unix utility. IMHO, "nc" could take its place right next to cat, 28 * cp, rm, mv, dd, ls, and all those other cryptic and Unix-like things. 29 * ===================== 30 * 31 * Much of author's comments are still retained in the code. 32 * 33 * Functionality removed (rationale): 34 * - miltiple-port ranges, randomized port scanning (use nmap) 35 * - telnet support (use telnet) 36 * - source routing 37 * - multiple DNS checks 38 * Functionalty which is different from nc 1.10: 39 * - PROG in '-e PROG' can have ARGS (and options). 40 * Because of this -e option must be last. 41//TODO: remove -e incompatibility? 42 * - we don't redirect stderr to the network socket for the -e PROG. 43 * (PROG can do it itself if needed, but sometimes it is NOT wanted!) 44 * - numeric addresses are printed in (), not [] (IPv6 looks better), 45 * port numbers are inside (): (1.2.3.4:5678) 46 * - network read errors are reported on verbose levels > 1 47 * (nc 1.10 treats them as EOF) 48 * - TCP connects from wrong ip/ports (if peer ip:port is specified 49 * on the command line, but accept() says that it came from different addr) 50 * are closed, but we don't exit - we continue to listen/accept. 51 * Since bbox 1.22: 52 * - nc exits when _both_ stdin and network are closed. 53 * This makes these two commands: 54 * echo "Yes" | nc 127.0.0.1 1234 55 * echo "no" | nc -lp 1234 56 * exchange their data _and exit_ instead of being stuck. 57 */ 58 59/* done in nc.c: #include "libbb.h" */ 60 61//usage:#if ENABLE_NC_110_COMPAT 62//usage: 63//usage:#define nc_trivial_usage 64//usage: "[OPTIONS] HOST PORT - connect" 65//usage: IF_NC_SERVER("\n" 66//usage: "nc [OPTIONS] -l -p PORT [HOST] [PORT] - listen" 67//usage: ) 68//usage:#define nc_full_usage "\n\n" 69//usage: " -e PROG Run PROG after connect (must be last)" 70//usage: IF_NC_SERVER( 71//usage: "\n -l Listen mode, for inbound connects" 72//usage: "\n -lk With -e, provides persistent server" 73/* -ll does the same as -lk, but its our extension, while -k is BSD'd, 74 * presumably more widely known. Therefore we advertise it, not -ll. 75 * I would like to drop -ll support, but our "small" nc supports it, 76 * and Rob uses it. 77 */ 78//usage: ) 79//usage: "\n -p PORT Local port" 80//usage: "\n -s ADDR Local address" 81//usage: "\n -w SEC Timeout for connects and final net reads" 82//usage: IF_NC_EXTRA( 83//usage: "\n -i SEC Delay interval for lines sent" /* ", ports scanned" */ 84//usage: ) 85//usage: "\n -n Don't do DNS resolution" 86//usage: "\n -u UDP mode" 87//usage: "\n -b Allow broadcasts" 88//usage: "\n -v Verbose" 89//usage: IF_NC_EXTRA( 90//usage: "\n -o FILE Hex dump traffic" 91//usage: "\n -z Zero-I/O mode (scanning)" 92//usage: ) 93//usage:#endif 94 95/* "\n -r Randomize local and remote ports" */ 96/* "\n -g gateway Source-routing hop point[s], up to 8" */ 97/* "\n -G num Source-routing pointer: 4, 8, 12, ..." */ 98/* "\nport numbers can be individual or ranges: lo-hi [inclusive]" */ 99 100/* -e PROG can take ARGS too: "nc ... -e ls -l", but we don't document it 101 * in help text: nc 1.10 does not allow that. We don't want to entice 102 * users to use this incompatibility */ 103 104enum { 105 SLEAZE_PORT = 31337, /* for UDP-scan RTT trick, change if ya want */ 106 BIGSIZ = 8192, /* big buffers */ 107 108 netfd = 3, 109 ofd = 4, 110}; 111 112struct globals { 113 /* global cmd flags: */ 114 unsigned o_verbose; 115 unsigned o_wait; 116#if ENABLE_NC_EXTRA 117 unsigned o_interval; 118#endif 119 120 /*int netfd;*/ 121 /*int ofd;*/ /* hexdump output fd */ 122#if ENABLE_LFS 123#define SENT_N_RECV_M "sent %llu, rcvd %llu\n" 124 unsigned long long wrote_out; /* total stdout bytes */ 125 unsigned long long wrote_net; /* total net bytes */ 126#else 127#define SENT_N_RECV_M "sent %u, rcvd %u\n" 128 unsigned wrote_out; /* total stdout bytes */ 129 unsigned wrote_net; /* total net bytes */ 130#endif 131 char *proggie0saved; 132 /* ouraddr is never NULL and goes through three states as we progress: 133 1 - local address before bind (IP/port possibly zero) 134 2 - local address after bind (port is nonzero) 135 3 - local address after connect??/recv/accept (IP and port are nonzero) */ 136 struct len_and_sockaddr *ouraddr; 137 /* themaddr is NULL if no peer hostname[:port] specified on command line */ 138 struct len_and_sockaddr *themaddr; 139 /* remend is set after connect/recv/accept to the actual ip:port of peer */ 140 struct len_and_sockaddr remend; 141 142 jmp_buf jbuf; /* timer crud */ 143 144 char bigbuf_in[BIGSIZ]; /* data buffers */ 145 char bigbuf_net[BIGSIZ]; 146}; 147 148#define G (*ptr_to_globals) 149#define wrote_out (G.wrote_out ) 150#define wrote_net (G.wrote_net ) 151#define ouraddr (G.ouraddr ) 152#define themaddr (G.themaddr ) 153#define remend (G.remend ) 154#define jbuf (G.jbuf ) 155#define bigbuf_in (G.bigbuf_in ) 156#define bigbuf_net (G.bigbuf_net) 157#define o_verbose (G.o_verbose ) 158#define o_wait (G.o_wait ) 159#if ENABLE_NC_EXTRA 160#define o_interval (G.o_interval) 161#else 162#define o_interval 0 163#endif 164#define INIT_G() do { \ 165 SET_PTR_TO_GLOBALS(xzalloc(sizeof(G))); \ 166} while (0) 167 168 169/* Must match getopt32 call! */ 170enum { 171 OPT_n = (1 << 0), 172 OPT_p = (1 << 1), 173 OPT_s = (1 << 2), 174 OPT_u = (1 << 3), 175 OPT_b = (1 << 4), 176 OPT_v = (1 << 5), 177 OPT_w = (1 << 6), 178 OPT_l = (1 << 7) * ENABLE_NC_SERVER, 179 OPT_k = (1 << 8) * ENABLE_NC_SERVER, 180 OPT_i = (1 << (7+2*ENABLE_NC_SERVER)) * ENABLE_NC_EXTRA, 181 OPT_o = (1 << (8+2*ENABLE_NC_SERVER)) * ENABLE_NC_EXTRA, 182 OPT_z = (1 << (9+2*ENABLE_NC_SERVER)) * ENABLE_NC_EXTRA, 183}; 184 185#define o_nflag (option_mask32 & OPT_n) 186#define o_udpmode (option_mask32 & OPT_u) 187#define o_bcmode (option_mask32 & OPT_b) 188#if ENABLE_NC_EXTRA 189#define o_ofile (option_mask32 & OPT_o) 190#define o_zero (option_mask32 & OPT_z) 191#else 192#define o_ofile 0 193#define o_zero 0 194#endif 195 196/* Debug: squirt whatever message and sleep a bit so we can see it go by. */ 197/* Beware: writes to stdOUT... */ 198#if 0 199#define Debug(...) do { printf(__VA_ARGS__); printf("\n"); fflush_all(); sleep1(); } while (0) 200#else 201#define Debug(...) do { } while (0) 202#endif 203 204#define holler_error(msg) do { if (o_verbose) bb_simple_error_msg(msg); } while (0) 205#define holler_perror(msg) do { if (o_verbose) bb_simple_perror_msg(msg); } while (0) 206 207/* catch: no-brainer interrupt handler */ 208static void catch(int sig) 209{ 210 if (o_verbose > 1) /* normally we don't care */ 211 fprintf(stderr, SENT_N_RECV_M, wrote_net, wrote_out); 212 fprintf(stderr, "punt!\n"); 213 kill_myself_with_sig(sig); 214} 215 216/* unarm */ 217static void unarm(void) 218{ 219 signal(SIGALRM, SIG_IGN); 220 alarm(0); 221} 222 223/* timeout and other signal handling cruft */ 224static void tmtravel(int sig UNUSED_PARAM) 225{ 226 unarm(); 227 longjmp(jbuf, 1); 228} 229 230/* arm: set the timer. */ 231static void arm(unsigned secs) 232{ 233 signal(SIGALRM, tmtravel); 234 alarm(secs); 235} 236 237/* findline: 238 find the next newline in a buffer; return inclusive size of that "line", 239 or the entire buffer size, so the caller knows how much to then write(). 240 Not distinguishing \n vs \r\n for the nonce; it just works as is... */ 241static unsigned findline(char *buf, unsigned siz) 242{ 243 char * p; 244 int x; 245 if (!buf) /* various sanity checks... */ 246 return 0; 247 if (siz > BIGSIZ) 248 return 0; 249 x = siz; 250 for (p = buf; x > 0; x--) { 251 if (*p == '\n') { 252 x = (int) (p - buf); 253 x++; /* 'sokay if it points just past the end! */ 254Debug("findline returning %d", x); 255 return x; 256 } 257 p++; 258 } /* for */ 259Debug("findline returning whole thing: %d", siz); 260 return siz; 261} /* findline */ 262 263/* doexec: 264 fiddle all the file descriptors around, and hand off to another prog. Sort 265 of like a one-off "poor man's inetd". This is the only section of code 266 that would be security-critical, which is why it's ifdefed out by default. 267 Use at your own hairy risk; if you leave shells lying around behind open 268 listening ports you deserve to lose!! */ 269static int doexec(char **proggie) NORETURN; 270static int doexec(char **proggie) 271{ 272 if (G.proggie0saved) 273 proggie[0] = G.proggie0saved; 274 xmove_fd(netfd, 0); 275 dup2(0, 1); 276 /* dup2(0, 2); - do we *really* want this? NO! 277 * exec'ed prog can do it yourself, if needed */ 278 BB_EXECVP_or_die(proggie); 279} 280 281/* connect_w_timeout: 282 return an fd for one of 283 an open outbound TCP connection, a UDP stub-socket thingie, or 284 an unconnected TCP or UDP socket to listen on. 285 Examines various global o_blah flags to figure out what to do. 286 lad can be NULL, then socket is not bound to any local ip[:port] */ 287static int connect_w_timeout(int fd) 288{ 289 int rr; 290 291 /* wrap connect inside a timer, and hit it */ 292 arm(o_wait); 293 if (setjmp(jbuf) == 0) { 294 rr = connect(fd, &themaddr->u.sa, themaddr->len); 295 unarm(); 296 } else { /* setjmp: connect failed... */ 297 rr = -1; 298 errno = ETIMEDOUT; /* fake it */ 299 } 300 return rr; 301} 302 303/* dolisten: 304 listens for 305 incoming and returns an open connection *from* someplace. If we were 306 given host/port args, any connections from elsewhere are rejected. This 307 in conjunction with local-address binding should limit things nicely... */ 308static void dolisten(int is_persistent, char **proggie) 309{ 310 int rr; 311 312 if (!o_udpmode) 313 xlisten(netfd, 1); /* TCP: gotta listen() before we can get */ 314 315 /* Various things that follow temporarily trash bigbuf_net, which might contain 316 a copy of any recvfrom()ed packet, but we'll read() another copy later. */ 317 318 /* I can't believe I have to do all this to get my own goddamn bound address 319 and port number. It should just get filled in during bind() or something. 320 All this is only useful if we didn't say -p for listening, since if we 321 said -p we *know* what port we're listening on. At any rate we won't bother 322 with it all unless we wanted to see it, although listening quietly on a 323 random unknown port is probably not very useful without "netstat". */ 324 if (o_verbose) { 325 char *addr; 326 getsockname(netfd, &ouraddr->u.sa, &ouraddr->len); 327 //if (rr < 0) 328 // bb_perror_msg_and_die("getsockname after bind"); 329 addr = xmalloc_sockaddr2dotted(&ouraddr->u.sa); 330 fprintf(stderr, "listening on %s ...\n", addr); 331 free(addr); 332 } 333 334 if (o_udpmode) { 335 /* UDP is a speeeeecial case -- we have to do I/O *and* get the calling 336 party's particulars all at once, listen() and accept() don't apply. 337 At least in the BSD universe, however, recvfrom/PEEK is enough to tell 338 us something came in, and we can set things up so straight read/write 339 actually does work after all. Yow. YMMV on strange platforms! */ 340 341 /* I'm not completely clear on how this works -- BSD seems to make UDP 342 just magically work in a connect()ed context, but we'll undoubtedly run 343 into systems this deal doesn't work on. For now, we apparently have to 344 issue a connect() on our just-tickled socket so we can write() back. 345 Again, why the fuck doesn't it just get filled in and taken care of?! 346 This hack is anything but optimal. Basically, if you want your listener 347 to also be able to send data back, you need this connect() line, which 348 also has the side effect that now anything from a different source or even a 349 different port on the other end won't show up and will cause ICMP errors. 350 I guess that's what they meant by "connect". 351 Let's try to remember what the "U" is *really* for, eh? */ 352 353 /* If peer address is specified, connect to it */ 354 remend.len = LSA_SIZEOF_SA; 355 if (themaddr) { 356 remend = *themaddr; 357 xconnect(netfd, &themaddr->u.sa, themaddr->len); 358 } 359 /* peek first packet and remember peer addr */ 360 arm(o_wait); /* might as well timeout this, too */ 361 if (setjmp(jbuf) == 0) { /* do timeout for initial connect */ 362 /* (*ouraddr) is prefilled with "default" address */ 363 /* and here we block... */ 364 rr = recv_from_to(netfd, NULL, 0, MSG_PEEK, /*was bigbuf_net, BIGSIZ*/ 365 &remend.u.sa, &ouraddr->u.sa, ouraddr->len); 366 if (rr < 0) 367 bb_simple_perror_msg_and_die("recvfrom"); 368 unarm(); 369 } else 370 bb_simple_error_msg_and_die("timeout"); 371/* Now we learned *to which IP* peer has connected, and we want to anchor 372our socket on it, so that our outbound packets will have correct local IP. 373Unfortunately, bind() on already bound socket will fail now (EINVAL): 374 xbind(netfd, &ouraddr->u.sa, ouraddr->len); 375Need to read the packet, save data, close this socket and 376create new one, and bind() it. TODO */ 377 if (!themaddr) 378 xconnect(netfd, &remend.u.sa, ouraddr->len); 379 } else { 380 /* TCP */ 381 another: 382 arm(o_wait); /* wrap this in a timer, too; 0 = forever */ 383 if (setjmp(jbuf) == 0) { 384 again: 385 remend.len = LSA_SIZEOF_SA; 386 rr = accept(netfd, &remend.u.sa, &remend.len); 387 if (rr < 0) 388 bb_simple_perror_msg_and_die("accept"); 389 if (themaddr) { 390 int sv_port, port, r; 391 392 sv_port = get_nport(&remend.u.sa); /* save */ 393 port = get_nport(&themaddr->u.sa); 394 if (port == 0) { 395 /* "nc -nl -p LPORT RHOST" (w/o RPORT!): 396 * we should accept any remote port */ 397 set_nport(&remend.u.sa, 0); /* blot out remote port# */ 398 } 399 r = memcmp(&remend.u.sa, &themaddr->u.sa, remend.len); 400 set_nport(&remend.u.sa, sv_port); /* restore */ 401 if (r != 0) { 402 /* nc 1.10 bails out instead, and its error message 403 * is not suppressed by o_verbose */ 404 if (o_verbose) { 405 char *remaddr = xmalloc_sockaddr2dotted(&remend.u.sa); 406 bb_error_msg("connect from wrong ip/port %s ignored", remaddr); 407 free(remaddr); 408 } 409 close(rr); 410 goto again; 411 } 412 } 413 unarm(); 414 } else 415 bb_simple_error_msg_and_die("timeout"); 416 417 if (is_persistent && proggie) { 418 /* -l -k -e PROG */ 419 signal(SIGCHLD, SIG_IGN); /* no zombies please */ 420 if (xvfork() != 0) { 421 /* parent: go back and accept more connections */ 422 close(rr); 423 goto another; 424 } 425 /* child */ 426 signal(SIGCHLD, SIG_DFL); 427 } 428 429 xmove_fd(rr, netfd); /* dump the old socket, here's our new one */ 430 /* find out what address the connection was *to* on our end, in case we're 431 doing a listen-on-any on a multihomed machine. This allows one to 432 offer different services via different alias addresses, such as the 433 "virtual web site" hack. */ 434 getsockname(netfd, &ouraddr->u.sa, &ouraddr->len); 435 //if (rr < 0) 436 // bb_perror_msg_and_die("getsockname after accept"); 437 } 438 439 if (o_verbose) { 440 char *lcladdr, *remaddr, *remhostname; 441 442#if ENABLE_NC_EXTRA && defined(IP_OPTIONS) 443 /* If we can, look for any IP options. Useful for testing the receiving end of 444 such things, and is a good exercise in dealing with it. We do this before 445 the connect message, to ensure that the connect msg is uniformly the LAST 446 thing to emerge after all the intervening crud. Doesn't work for UDP on 447 any machines I've tested, but feel free to surprise me. */ 448 char optbuf[40]; 449 socklen_t x = sizeof(optbuf); 450 451 rr = getsockopt(netfd, IPPROTO_IP, IP_OPTIONS, optbuf, &x); 452 if (rr >= 0 && x) { /* we've got options, lessee em... */ 453 *bin2hex(bigbuf_net, optbuf, x) = '\0'; 454 fprintf(stderr, "IP options: %s\n", bigbuf_net); 455 } 456#endif 457 458 /* now check out who it is. We don't care about mismatched DNS names here, 459 but any ADDR and PORT we specified had better fucking well match the caller. 460 Converting from addr to inet_ntoa and back again is a bit of a kludge, but 461 gethostpoop wants a string and there's much gnarlier code out there already, 462 so I don't feel bad. 463 The *real* question is why BFD sockets wasn't designed to allow listens for 464 connections *from* specific hosts/ports, instead of requiring the caller to 465 accept the connection and then reject undesirable ones by closing. 466 In other words, we need a TCP MSG_PEEK. */ 467 /* bbox: removed most of it */ 468 lcladdr = xmalloc_sockaddr2dotted(&ouraddr->u.sa); 469 remaddr = xmalloc_sockaddr2dotted(&remend.u.sa); 470 remhostname = o_nflag ? remaddr : xmalloc_sockaddr2host(&remend.u.sa); 471 fprintf(stderr, "connect to %s from %s (%s)\n", 472 lcladdr, remhostname, remaddr); 473 free(lcladdr); 474 free(remaddr); 475 if (!o_nflag) 476 free(remhostname); 477 } 478 479 if (proggie) 480 doexec(proggie); 481} 482 483/* udptest: 484 fire a couple of packets at a UDP target port, just to see if it's really 485 there. On BSD kernels, ICMP host/port-unreachable errors get delivered to 486 our socket as ECONNREFUSED write errors. On SV kernels, we lose; we'll have 487 to collect and analyze raw ICMP ourselves a la satan's probe_udp_ports 488 backend. Guess where one could swipe the appropriate code from... 489 490 Use the time delay between writes if given, otherwise use the "tcp ping" 491 trick for getting the RTT. [I got that idea from pluvius, and warped it.] 492 Return either the original fd, or clean up and return -1. */ 493#if ENABLE_NC_EXTRA 494static int udptest(void) 495{ 496 int rr; 497 498 rr = write(netfd, bigbuf_in, 1); 499 if (rr != 1) 500 bb_simple_perror_msg("udptest first write"); 501 502 if (o_wait) 503 sleep(o_wait); // can be interrupted! while (t) nanosleep(&t)? 504 else { 505 /* use the tcp-ping trick: try connecting to a normally refused port, which 506 causes us to block for the time that SYN gets there and RST gets back. 507 Not completely reliable, but it *does* mostly work. */ 508 /* Set a temporary connect timeout, so packet filtration doesn't cause 509 us to hang forever, and hit it */ 510 o_wait = 5; /* enough that we'll notice?? */ 511 rr = xsocket(ouraddr->u.sa.sa_family, SOCK_STREAM, 0); 512 set_nport(&themaddr->u.sa, htons(SLEAZE_PORT)); 513 connect_w_timeout(rr); 514 /* don't need to restore themaddr's port, it's not used anymore */ 515 close(rr); 516 o_wait = 0; /* restore */ 517 } 518 519 rr = write(netfd, bigbuf_in, 1); 520 return (rr != 1); /* if rr == 1, return 0 (success) */ 521} 522#else 523int udptest(void); 524#endif 525 526/* oprint: 527 Hexdump bytes shoveled either way to a running logfile, in the format: 528 D offset - - - - --- 16 bytes --- - - - - # .... ascii ..... 529 where "which" sets the direction indicator, D: 530 0 -- sent to network, or ">" 531 1 -- rcvd and printed to stdout, or "<" 532 and "buf" and "n" are data-block and length. If the current block generates 533 a partial line, so be it; we *want* that lockstep indication of who sent 534 what when. Adapted from dgaudet's original example -- but must be ripping 535 *fast*, since we don't want to be too disk-bound... */ 536#if ENABLE_NC_EXTRA 537static void oprint(int direction, unsigned char *p, unsigned bc) 538{ 539 unsigned obc; /* current "global" offset */ 540 unsigned x; 541 unsigned char *op; /* out hexdump ptr */ 542 unsigned char *ap; /* out asc-dump ptr */ 543 unsigned char stage[100]; 544 545 if (bc == 0) 546 return; 547 548 obc = wrote_net; /* use the globals! */ 549 if (direction == '<') 550 obc = wrote_out; 551 stage[0] = direction; 552 stage[59] = '#'; /* preload separator */ 553 stage[60] = ' '; 554 555 do { /* for chunk-o-data ... */ 556 x = 16; 557 if (bc < 16) { 558 /* memset(&stage[bc*3 + 11], ' ', 16*3 - bc*3); */ 559 memset(&stage[11], ' ', 16*3); 560 x = bc; 561 } 562 sprintf((char *)&stage[1], " %8.8x ", obc); /* xxx: still slow? */ 563 bc -= x; /* fix current count */ 564 obc += x; /* fix current offset */ 565 op = &stage[11]; /* where hex starts */ 566 ap = &stage[61]; /* where ascii starts */ 567 568 do { /* for line of dump, however long ... */ 569 *op++ = 0x20 | bb_hexdigits_upcase[*p >> 4]; 570 *op++ = 0x20 | bb_hexdigits_upcase[*p & 0x0f]; 571 *op++ = ' '; 572 if ((*p > 31) && (*p < 127)) 573 *ap = *p; /* printing */ 574 else 575 *ap = '.'; /* nonprinting, loose def */ 576 ap++; 577 p++; 578 } while (--x); 579 *ap++ = '\n'; /* finish the line */ 580 xwrite(ofd, stage, ap - stage); 581 } while (bc); 582} 583#else 584void oprint(int direction, unsigned char *p, unsigned bc); 585#endif 586 587/* readwrite: 588 handle stdin/stdout/network I/O. Bwahaha!! -- the i/o loop from hell. 589 In this instance, return what might become our exit status. */ 590static int readwrite(void) 591{ 592 char *zp = zp; /* gcc */ /* stdin buf ptr */ 593 char *np = np; /* net-in buf ptr */ 594 unsigned rzleft; 595 unsigned rnleft; 596 unsigned netretry; /* net-read retry counter */ 597 unsigned fds_open; 598 599 struct pollfd pfds[2]; 600 pfds[0].fd = STDIN_FILENO; 601 pfds[0].events = POLLIN; 602 pfds[1].fd = netfd; 603 pfds[1].events = POLLIN; 604 605 fds_open = 2; 606 netretry = 2; 607 rzleft = rnleft = 0; 608 if (o_interval) 609 sleep(o_interval); /* pause *before* sending stuff, too */ 610 611 /* and now the big ol' shoveling loop ... */ 612 /* nc 1.10 has "while (FD_ISSET(netfd)" here */ 613 while (fds_open) { 614 int rr; 615 int poll_tmout_ms; 616 unsigned wretry = 8200; /* net-write sanity counter */ 617 618 poll_tmout_ms = -1; 619 if (o_wait) { 620 poll_tmout_ms = INT_MAX; 621 if (o_wait < INT_MAX / 1000) 622 poll_tmout_ms = o_wait * 1000; 623 } 624 rr = poll(pfds, 2, poll_tmout_ms); 625 if (rr < 0 && errno != EINTR) { /* might have gotten ^Zed, etc */ 626 holler_perror("poll"); 627 close(netfd); 628 return 1; 629 } 630 /* if we have a timeout AND stdin is closed AND we haven't heard anything 631 from the net during that time, assume it's dead and close it too. */ 632 if (rr == 0) { 633 if (!pfds[0].revents) { 634 netretry--; /* we actually try a coupla times. */ 635 if (!netretry) { 636 if (o_verbose > 1) /* normally we don't care */ 637 fprintf(stderr, "net timeout\n"); 638 /*close(netfd); - redundant, exit will do it */ 639 return 0; /* not an error! */ 640 } 641 } 642 } /* timeout */ 643 644 /* Ding!! Something arrived, go check all the incoming hoppers, net first */ 645 if (pfds[1].revents) { /* net: ding! */ 646 rr = read(netfd, bigbuf_net, BIGSIZ); 647 if (rr <= 0) { 648 if (rr < 0 && o_verbose > 1) { 649 /* nc 1.10 doesn't do this */ 650 bb_simple_perror_msg("net read"); 651 } 652 pfds[1].fd = -1; /* don't poll for netfd anymore */ 653 fds_open--; 654 rzleft = 0; /* can't write anymore: broken pipe */ 655 } else { 656 rnleft = rr; 657 np = bigbuf_net; 658 } 659Debug("got %d from the net, errno %d", rr, errno); 660 } /* net:ding */ 661 662 /* if we're in "slowly" mode there's probably still stuff in the stdin 663 buffer, so don't read unless we really need MORE INPUT! MORE INPUT! */ 664 if (rzleft) 665 goto shovel; 666 667 /* okay, suck more stdin */ 668 if (pfds[0].revents) { /* stdin: ding! */ 669 rr = read(STDIN_FILENO, bigbuf_in, BIGSIZ); 670 /* Considered making reads here smaller for UDP mode, but 8192-byte 671 mobygrams are kinda fun and exercise the reassembler. */ 672 if (rr <= 0) { /* at end, or fukt, or ... */ 673 pfds[0].fd = -1; /* disable stdin */ 674 /*close(STDIN_FILENO); - not really necessary */ 675 /* Let peer know we have no more data */ 676 /* nc 1.10 doesn't do this: */ 677 shutdown(netfd, SHUT_WR); 678 fds_open--; 679 } else { 680 rzleft = rr; 681 zp = bigbuf_in; 682 } 683 } /* stdin:ding */ 684 shovel: 685 /* now that we've dingdonged all our thingdings, send off the results. 686 Geez, why does this look an awful lot like the big loop in "rsh"? ... 687 not sure if the order of this matters, but write net -> stdout first. */ 688 689 if (rnleft) { 690 rr = write(STDOUT_FILENO, np, rnleft); 691 if (rr > 0) { 692 if (o_ofile) /* log the stdout */ 693 oprint('<', (unsigned char *)np, rr); 694 np += rr; 695 rnleft -= rr; 696 wrote_out += rr; /* global count */ 697 } 698Debug("wrote %d to stdout, errno %d", rr, errno); 699 } /* rnleft */ 700 if (rzleft) { 701 if (o_interval) /* in "slowly" mode ?? */ 702 rr = findline(zp, rzleft); 703 else 704 rr = rzleft; 705 rr = write(netfd, zp, rr); /* one line, or the whole buffer */ 706 if (rr > 0) { 707 if (o_ofile) /* log what got sent */ 708 oprint('>', (unsigned char *)zp, rr); 709 zp += rr; 710 rzleft -= rr; 711 wrote_net += rr; /* global count */ 712 } 713Debug("wrote %d to net, errno %d", rr, errno); 714 } /* rzleft */ 715 if (o_interval) { /* cycle between slow lines, or ... */ 716 sleep(o_interval); 717 continue; /* ...with hairy loop... */ 718 } 719 if (rzleft || rnleft) { /* shovel that shit till they ain't */ 720 wretry--; /* none left, and get another load */ 721 /* net write retries sometimes happen on UDP connections */ 722 if (!wretry) { /* is something hung? */ 723 holler_error("too many output retries"); 724 return 1; 725 } 726 goto shovel; 727 } 728 } /* while (fds_open) */ 729 730 /* XXX: maybe want a more graceful shutdown() here, or screw around with 731 linger times?? I suspect that I don't need to since I'm always doing 732 blocking reads and writes and my own manual "last ditch" efforts to read 733 the net again after a timeout. I haven't seen any screwups yet, but it's 734 not like my test network is particularly busy... */ 735 close(netfd); 736 return 0; 737} /* readwrite */ 738 739/* main: now we pull it all together... */ 740int nc_main(int argc, char **argv) MAIN_EXTERNALLY_VISIBLE; 741int nc_main(int argc UNUSED_PARAM, char **argv) 742{ 743 char *str_p, *str_s; 744 IF_NC_EXTRA(char *str_i, *str_o;) 745 char *themdotted = themdotted; /* for compiler */ 746 char **proggie; 747 int x; 748 unsigned cnt_l = 0; 749 unsigned o_lport = 0; 750 751 INIT_G(); 752 753 /* catch a signal or two for cleanup */ 754 bb_signals(0 755 + (1 << SIGINT) 756 + (1 << SIGQUIT) 757 + (1 << SIGTERM) 758 , catch); 759 /* and suppress others... */ 760 bb_signals(0 761#ifdef SIGURG 762 + (1 << SIGURG) 763#endif 764 + (1 << SIGPIPE) /* important! */ 765 , SIG_IGN); 766 767 proggie = argv; 768 while (*++proggie) { 769 if (strcmp(*proggie, "-e") == 0) { 770 *proggie = NULL; 771 proggie++; 772 goto e_found; 773 } 774 /* -<other_opts>e PROG [ARGS] ? */ 775 /* (aboriginal linux uses this form) */ 776 if (proggie[0][0] == '-') { 777 char *optpos = *proggie + 1; 778 /* Skip all valid opts w/o params */ 779 optpos = optpos + strspn(optpos, "nuv"IF_NC_SERVER("lk")IF_NC_EXTRA("z")); 780 if (*optpos == 'e' && !optpos[1]) { 781 *optpos = '\0'; 782 proggie++; 783 G.proggie0saved = *proggie; 784 *proggie = NULL; /* terminate argv for getopt32 */ 785 goto e_found; 786 } 787 } 788 } 789 proggie = NULL; 790 e_found: 791 792 // -g -G -t -r deleted, unimplemented -a deleted too 793 getopt32(argv, "^" 794 "np:s:ubvw:+"/* -w N */ IF_NC_SERVER("lk") 795 IF_NC_EXTRA("i:o:z") 796 "\0" 797 "?2:vv"IF_NC_SERVER(":ll"), /* max 2 params; -v and -l are counters */ 798 &str_p, &str_s, &o_wait 799 IF_NC_EXTRA(, &str_i, &str_o) 800 , &o_verbose IF_NC_SERVER(, &cnt_l) 801 ); 802 argv += optind; 803#if ENABLE_NC_EXTRA 804 if (option_mask32 & OPT_i) /* line-interval time */ 805 o_interval = xatou_range(str_i, 1, 0xffff); 806#endif 807#if ENABLE_NC_SERVER 808 //if (option_mask32 & OPT_l) /* listen mode */ 809 if (option_mask32 & OPT_k) /* persistent server mode */ 810 cnt_l = 2; 811#endif 812 //if (option_mask32 & OPT_n) /* numeric-only, no DNS lookups */ 813 //if (option_mask32 & OPT_o) /* hexdump log */ 814 if (option_mask32 & OPT_p) { /* local source port */ 815 o_lport = bb_lookup_port(str_p, o_udpmode ? "udp" : "tcp", 0); 816 } 817 //if (option_mask32 & OPT_r) /* randomize various things */ 818 //if (option_mask32 & OPT_u) /* use UDP */ 819 //if (option_mask32 & OPT_v) /* verbose */ 820 //if (option_mask32 & OPT_w) /* wait time */ 821 //if (option_mask32 & OPT_z) /* little or no data xfer */ 822 823 /* We manage our fd's so that they are never 0,1,2 */ 824 /*bb_sanitize_stdio(); - not needed */ 825 826 if (argv[0]) { 827 themaddr = xhost2sockaddr(argv[0], 828 bb_lookup_port(argv[1], o_udpmode ? "udp" : "tcp", 0) 829 ); 830 } 831 832 /* create & bind network socket */ 833 x = (o_udpmode ? SOCK_DGRAM : SOCK_STREAM); 834 if (option_mask32 & OPT_s) { /* local address */ 835 /* if o_lport is still 0, then we will use random port */ 836 ouraddr = xhost2sockaddr(str_s, o_lport); 837#ifdef BLOAT 838 /* prevent spurious "UDP listen needs !0 port" */ 839 o_lport = get_nport(ouraddr); 840 o_lport = ntohs(o_lport); 841#endif 842 x = xsocket(ouraddr->u.sa.sa_family, x, 0); 843 } else { 844 /* We try IPv6, then IPv4, unless addr family is 845 * implicitly set by way of remote addr/port spec */ 846 x = xsocket_type(&ouraddr, 847 (themaddr ? themaddr->u.sa.sa_family : AF_UNSPEC), 848 x); 849 if (o_lport) 850 set_nport(&ouraddr->u.sa, htons(o_lport)); 851 } 852 xmove_fd(x, netfd); 853 setsockopt_reuseaddr(netfd); 854 if (o_udpmode) { 855 if (o_bcmode) 856 setsockopt_broadcast(netfd); 857 socket_want_pktinfo(netfd); 858 } 859 if (!ENABLE_FEATURE_UNIX_LOCAL 860 || cnt_l != 0 /* listen */ 861 || ouraddr->u.sa.sa_family != AF_UNIX 862 ) { 863 xbind(netfd, &ouraddr->u.sa, ouraddr->len); 864 } 865#if 0 866 setsockopt_SOL_SOCKET_int(netfd, SO_RCVBUF, o_rcvbuf); 867 setsockopt_SOL_SOCKET_int(netfd, SO_SNDBUF, o_sndbuf); 868#endif 869 870#ifdef BLOAT 871 if (OPT_l && (option_mask32 & (OPT_u|OPT_l)) == (OPT_u|OPT_l)) { 872 /* apparently UDP can listen ON "port 0", 873 but that's not useful */ 874 if (!o_lport) 875 bb_simple_error_msg_and_die("UDP listen needs nonzero -p port"); 876 } 877#endif 878 879 if (proggie) { 880 close(STDIN_FILENO); /* won't need stdin */ 881 option_mask32 &= ~OPT_o; /* -o with -e is meaningless! */ 882 } 883#if ENABLE_NC_EXTRA 884 if (o_ofile) 885 xmove_fd(xopen(str_o, O_WRONLY|O_CREAT|O_TRUNC), ofd); 886#endif 887 888 if (cnt_l != 0) { 889 dolisten((cnt_l - 1), proggie); 890 /* dolisten does its own connect reporting */ 891 x = readwrite(); /* it even works with UDP! */ 892 } else { 893 /* Outbound connects. Now we're more picky about args... */ 894 if (!themaddr) 895 bb_show_usage(); 896 897 remend = *themaddr; 898 if (o_verbose) 899 themdotted = xmalloc_sockaddr2dotted(&themaddr->u.sa); 900 901 x = connect_w_timeout(netfd); 902 if (o_zero && x == 0 && o_udpmode) /* if UDP scanning... */ 903 x = udptest(); 904 if (x == 0) { /* Yow, are we OPEN YET?! */ 905 if (o_verbose) 906 fprintf(stderr, "%s (%s) open\n", argv[0], themdotted); 907 if (proggie) /* exec is valid for outbound, too */ 908 doexec(proggie); 909 if (!o_zero) 910 x = readwrite(); 911 } else { /* connect or udptest wasn't successful */ 912 x = 1; /* exit status */ 913 /* if we're scanning at a "one -v" verbosity level, don't print refusals. 914 Give it another -v if you want to see everything. */ 915 if (o_verbose > 1 || (o_verbose && errno != ECONNREFUSED)) 916 bb_perror_msg("%s (%s)", argv[0], themdotted); 917 } 918 } 919 if (o_verbose > 1) /* normally we don't care */ 920 fprintf(stderr, SENT_N_RECV_M, wrote_net, wrote_out); 921 return x; 922} 923