1 /* $OpenBSD: netcat.c,v 1.89 2007/02/20 14:11:17 jmc Exp $ */
2 /*
3  * Copyright (c) 2001 Eric Jackson <ericj@monkey.org>
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  *
9  * 1. Redistributions of source code must retain the above copyright
10  *   notice, this list of conditions and the following disclaimer.
11  * 2. Redistributions in binary form must reproduce the above copyright
12  *   notice, this list of conditions and the following disclaimer in the
13  *   documentation and/or other materials provided with the distribution.
14  * 3. The name of the author may not be used to endorse or promote products
15  *   derived from this software without specific prior written permission.
16  *
17  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
18  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
19  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
20  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
21  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
22  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
23  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
24  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
25  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
26  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
27  */
28 
29 /*
30  * Re-written nc(1) for OpenBSD. Original implementation by
31  * *Hobbit* <hobbit@avian.org>.
32  */
33 
34 /*
35  * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
36  * Use is subject to license terms.
37  */
38 
39 /*
40  * Portions Copyright 2008 Erik Trauschke
41  */
42 
43 #include <sys/types.h>
44 #include <sys/socket.h>
45 #include <sys/time.h>
46 #include <sys/un.h>
47 
48 #include <netinet/in.h>
49 #include <netinet/in_systm.h>
50 #include <netinet/tcp.h>
51 #include <netinet/ip.h>
52 #include <arpa/telnet.h>
53 
54 #include <err.h>
55 #include <errno.h>
56 #include <netdb.h>
57 #include <poll.h>
58 #include <stdarg.h>
59 #include <stdio.h>
60 #include <stdlib.h>
61 #include <string.h>
62 #include <unistd.h>
63 #include <fcntl.h>
64 #include <limits.h>
65 #include <signal.h>
66 
67 #include "atomicio.h"
68 
69 #ifndef	SUN_LEN
70 #define	SUN_LEN(su) \
71 	(sizeof (*(su)) - sizeof ((su)->sun_path) + strlen((su)->sun_path))
72 #endif
73 
74 #define	PORT_MIN	1
75 #define	PORT_MAX	65535
76 #define	PORT_MAX_LEN	6
77 #define	PLIST_SZ	32	/* initial capacity of the portlist */
78 
79 /* Command Line Options */
80 int	dflag;		/* detached, no stdin */
81 unsigned int iflag;	/* Interval Flag */
82 int	kflag;		/* More than one connect */
83 int	lflag;		/* Bind to local port */
84 int	nflag;		/* Don't do name lookup */
85 char	*Pflag;		/* Proxy username */
86 char	*pflag;		/* Localport flag */
87 int	rflag;		/* Random ports flag */
88 char	*sflag;		/* Source Address */
89 int	tflag;		/* Telnet Emulation */
90 int	uflag;		/* UDP - Default to TCP */
91 int	vflag;		/* Verbosity */
92 int	xflag;		/* Socks proxy */
93 int	Xflag;		/* indicator of Socks version set */
94 int	zflag;		/* Port Scan Flag */
95 int	Dflag;		/* sodebug */
96 int	Tflag = -1;	/* IP Type of Service */
97 
98 int	timeout = -1;
99 int	family = AF_UNSPEC;
100 
101 /*
102  * portlist structure
103  * Used to store a list of ports given by the user and maintaining
104  * information about the number of ports stored.
105  */
106 struct {
107 	uint16_t *list; /* list containing the ports */
108 	uint_t listsize;   /* capacity of the list (number of entries) */
109 	uint_t numports;   /* number of ports in the list */
110 } ports;
111 
112 void	atelnet(int, unsigned char *, unsigned int);
113 void	build_ports(char *);
114 void	help(void);
115 int	local_listen(char *, char *, struct addrinfo);
116 void	readwrite(int);
117 int	remote_connect(const char *, const char *, struct addrinfo);
118 int	socks_connect(const char *, const char *,
119 	    const char *, const char *, struct addrinfo, int, const char *);
120 int	udptest(int);
121 int	unix_connect(char *);
122 int	unix_listen(char *);
123 void	set_common_sockopts(int);
124 int	parse_iptos(char *);
125 void	usage(int);
126 char	*print_addr(char *, size_t, struct sockaddr *, int, int);
127 
128 int
129 main(int argc, char *argv[])
130 {
131 	int ch, s, ret, socksv;
132 	char *host, *uport, *proxy;
133 	struct addrinfo hints;
134 	struct servent *sv;
135 	socklen_t len;
136 	struct sockaddr_storage cliaddr;
137 	const char *errstr, *proxyhost = "", *proxyport = NULL;
138 	struct addrinfo proxyhints;
139 	char port[PORT_MAX_LEN];
140 
141 	ret = 1;
142 	s = -1;
143 	socksv = 5;
144 	host = NULL;
145 	uport = NULL;
146 	sv = NULL;
147 
148 	while ((ch = getopt(argc, argv,
149 	    "46Ddhi:klnP:p:rs:T:tUuvw:X:x:z")) != -1) {
150 		switch (ch) {
151 		case '4':
152 			family = AF_INET;
153 			break;
154 		case '6':
155 			family = AF_INET6;
156 			break;
157 		case 'U':
158 			family = AF_UNIX;
159 			break;
160 		case 'X':
161 			Xflag = 1;
162 			if (strcasecmp(optarg, "connect") == 0)
163 				socksv = -1; /* HTTP proxy CONNECT */
164 			else if (strcmp(optarg, "4") == 0)
165 				socksv = 4; /* SOCKS v.4 */
166 			else if (strcmp(optarg, "5") == 0)
167 				socksv = 5; /* SOCKS v.5 */
168 			else
169 				errx(1, "unsupported proxy protocol");
170 			break;
171 		case 'd':
172 			dflag = 1;
173 			break;
174 		case 'h':
175 			help();
176 			break;
177 		case 'i':
178 			iflag = strtonum(optarg, 0, UINT_MAX, &errstr);
179 			if (errstr)
180 				errx(1, "interval %s: %s", errstr, optarg);
181 			break;
182 		case 'k':
183 			kflag = 1;
184 			break;
185 		case 'l':
186 			lflag = 1;
187 			break;
188 		case 'n':
189 			nflag = 1;
190 			break;
191 		case 'P':
192 			Pflag = optarg;
193 			break;
194 		case 'p':
195 			pflag = optarg;
196 			break;
197 		case 'r':
198 			rflag = 1;
199 			break;
200 		case 's':
201 			sflag = optarg;
202 			break;
203 		case 't':
204 			tflag = 1;
205 			break;
206 		case 'u':
207 			uflag = 1;
208 			break;
209 		case 'v':
210 			vflag = 1;
211 			break;
212 		case 'w':
213 			timeout = strtonum(optarg, 0, INT_MAX / 1000, &errstr);
214 			if (errstr)
215 				errx(1, "timeout %s: %s", errstr, optarg);
216 			timeout *= 1000;
217 			break;
218 		case 'x':
219 			xflag = 1;
220 			if ((proxy = strdup(optarg)) == NULL)
221 				err(1, NULL);
222 			break;
223 		case 'z':
224 			zflag = 1;
225 			break;
226 		case 'D':
227 			Dflag = 1;
228 			break;
229 		case 'T':
230 			Tflag = parse_iptos(optarg);
231 			break;
232 		default:
233 			usage(1);
234 		}
235 	}
236 	argc -= optind;
237 	argv += optind;
238 
239 	/* Cruft to make sure options are clean, and used properly. */
240 	if (argv[0] && !argv[1] && family == AF_UNIX) {
241 		if (uflag)
242 			errx(1, "cannot use -u and -U");
243 		host = argv[0];
244 		uport = NULL;
245 	} else if (argv[0] && !argv[1]) {
246 		if (!lflag)
247 			usage(1);
248 		uport = argv[0];
249 		host = NULL;
250 	} else if (argv[0] && argv[1]) {
251 		if (family == AF_UNIX)
252 			usage(1);
253 		host = argv[0];
254 		uport = argv[1];
255 	} else {
256 		if (!(lflag && pflag))
257 			usage(1);
258 	}
259 
260 	if (argc > 2)
261 		usage(1);
262 
263 	if (lflag && sflag)
264 		errx(1, "cannot use -s and -l");
265 	if (lflag && rflag)
266 		errx(1, "cannot use -r and -l");
267 	if (lflag && (timeout >= 0))
268 		warnx("-w has no effect with -l");
269 	if (lflag && pflag) {
270 		if (uport)
271 			usage(1);
272 		uport = pflag;
273 	}
274 	if (lflag && zflag)
275 		errx(1, "cannot use -z and -l");
276 	if (!lflag && kflag)
277 		errx(1, "must use -l with -k");
278 	if (lflag && (Pflag || xflag || Xflag))
279 		errx(1, "cannot use -l with -P, -X or -x");
280 
281 	/* Initialize addrinfo structure. */
282 	if (family != AF_UNIX) {
283 		(void) memset(&hints, 0, sizeof (struct addrinfo));
284 		hints.ai_family = family;
285 		hints.ai_socktype = uflag ? SOCK_DGRAM : SOCK_STREAM;
286 		hints.ai_protocol = uflag ? IPPROTO_UDP : IPPROTO_TCP;
287 		if (nflag)
288 			hints.ai_flags |= AI_NUMERICHOST;
289 	}
290 
291 	if (xflag) {
292 		if (uflag)
293 			errx(1, "no proxy support for UDP mode");
294 
295 		if (lflag)
296 			errx(1, "no proxy support for listen");
297 
298 		if (family == AF_UNIX)
299 			errx(1, "no proxy support for unix sockets");
300 
301 		if (family == AF_INET6)
302 			errx(1, "no proxy support for IPv6");
303 
304 		if (sflag)
305 			errx(1, "no proxy support for local source address");
306 
307 		if ((proxyhost = strtok(proxy, ":")) == NULL)
308 			errx(1, "missing port specification");
309 		proxyport = strtok(NULL, ":");
310 
311 		(void) memset(&proxyhints, 0, sizeof (struct addrinfo));
312 		proxyhints.ai_family = family;
313 		proxyhints.ai_socktype = SOCK_STREAM;
314 		proxyhints.ai_protocol = IPPROTO_TCP;
315 		if (nflag)
316 			proxyhints.ai_flags |= AI_NUMERICHOST;
317 	}
318 
319 	if (lflag) {
320 		int connfd;
321 		ret = 0;
322 
323 		if (family == AF_UNIX) {
324 			if (host == NULL)
325 				usage(1);
326 			s = unix_listen(host);
327 		}
328 
329 		/* Allow only one connection at a time, but stay alive. */
330 		for (;;) {
331 			if (family != AF_UNIX) {
332 				/* check if uport is valid */
333 				if (strtonum(uport, PORT_MIN, PORT_MAX,
334 				    &errstr) == 0)
335 					errx(1, "port number %s: %s",
336 					    uport, errstr);
337 				s = local_listen(host, uport, hints);
338 			}
339 			if (s < 0)
340 				err(1, NULL);
341 			/*
342 			 * For UDP, we will use recvfrom() initially
343 			 * to wait for a caller, then use the regular
344 			 * functions to talk to the caller.
345 			 */
346 			if (uflag) {
347 				int rv, plen;
348 				char buf[8192];
349 				struct sockaddr_storage z;
350 
351 				len = sizeof (z);
352 				plen = 1024;
353 				rv = recvfrom(s, buf, plen, MSG_PEEK,
354 				    (struct sockaddr *)&z, &len);
355 				if (rv < 0)
356 					err(1, "recvfrom");
357 
358 				rv = connect(s, (struct sockaddr *)&z, len);
359 				if (rv < 0)
360 					err(1, "connect");
361 
362 				connfd = s;
363 			} else {
364 				len = sizeof (cliaddr);
365 				connfd = accept(s, (struct sockaddr *)&cliaddr,
366 				    &len);
367 				if ((connfd != -1) && vflag) {
368 					char ntop[NI_MAXHOST + NI_MAXSERV];
369 					(void) fprintf(stderr,
370 					    "Received connection from %s\n",
371 					    print_addr(ntop, sizeof (ntop),
372 					    (struct sockaddr *)&cliaddr, len,
373 					    nflag ? NI_NUMERICHOST : 0));
374 				}
375 			}
376 
377 			readwrite(connfd);
378 			(void) close(connfd);
379 			if (family != AF_UNIX)
380 				(void) close(s);
381 
382 			if (!kflag)
383 				break;
384 		}
385 	} else if (family == AF_UNIX) {
386 		ret = 0;
387 
388 		if ((s = unix_connect(host)) > 0 && !zflag) {
389 			readwrite(s);
390 			(void) close(s);
391 		} else
392 			ret = 1;
393 
394 		exit(ret);
395 
396 	} else {	/* AF_INET or AF_INET6 */
397 		int i;
398 
399 		/* Construct the portlist. */
400 		build_ports(uport);
401 
402 		/* Cycle through portlist, connecting to each port. */
403 		for (i = 0; i < ports.numports; i++) {
404 			(void) snprintf(port, sizeof (port), "%u",
405 			    ports.list[i]);
406 
407 			if (s != -1)
408 				(void) close(s);
409 
410 			if (xflag)
411 				s = socks_connect(host, port,
412 				    proxyhost, proxyport, proxyhints, socksv,
413 				    Pflag);
414 			else
415 				s = remote_connect(host, port, hints);
416 
417 			if (s < 0)
418 				continue;
419 
420 			ret = 0;
421 			if (vflag || zflag) {
422 				/* For UDP, make sure we are connected. */
423 				if (uflag) {
424 					if (udptest(s) == -1) {
425 						ret = 1;
426 						continue;
427 					}
428 				}
429 
430 				/* Don't look up port if -n. */
431 				if (nflag)
432 					sv = NULL;
433 				else {
434 					sv = getservbyport(
435 					    ntohs(ports.list[i]),
436 					    uflag ? "udp" : "tcp");
437 				}
438 
439 				(void) fprintf(stderr, "Connection to %s %s "
440 				    "port [%s/%s] succeeded!\n",
441 				    host, port, uflag ? "udp" : "tcp",
442 				    sv ? sv->s_name : "*");
443 			}
444 			if (!zflag)
445 				readwrite(s);
446 		}
447 		free(ports.list);
448 	}
449 
450 	if (s != -1)
451 		(void) close(s);
452 
453 	return (ret);
454 }
455 
456 /*
457  * print IP address and (optionally) a port
458  */
459 char *
460 print_addr(char *ntop, size_t ntlen, struct sockaddr *addr, int len, int flags)
461 {
462 	char port[NI_MAXSERV];
463 	int e;
464 
465 	/* print port always as number */
466 	if ((e = getnameinfo(addr, len, ntop, ntlen,
467 	    port, sizeof (port), flags|NI_NUMERICSERV)) != 0) {
468 		return ((char *)gai_strerror(e));
469 	}
470 
471 	(void) snprintf(ntop, ntlen, "%s port %s", ntop, port);
472 
473 	return (ntop);
474 }
475 
476 /*
477  * unix_connect()
478  * Returns a socket connected to a local unix socket. Returns -1 on failure.
479  */
480 int
481 unix_connect(char *path)
482 {
483 	struct sockaddr_un sunaddr;
484 	int s;
485 
486 	if ((s = socket(AF_UNIX, SOCK_STREAM, 0)) < 0)
487 		return (-1);
488 
489 	(void) memset(&sunaddr, 0, sizeof (struct sockaddr_un));
490 	sunaddr.sun_family = AF_UNIX;
491 
492 	if (strlcpy(sunaddr.sun_path, path, sizeof (sunaddr.sun_path)) >=
493 	    sizeof (sunaddr.sun_path)) {
494 		(void) close(s);
495 		errno = ENAMETOOLONG;
496 		return (-1);
497 	}
498 	if (connect(s, (struct sockaddr *)&sunaddr, SUN_LEN(&sunaddr)) < 0) {
499 		(void) close(s);
500 		return (-1);
501 	}
502 	return (s);
503 }
504 
505 /*
506  * unix_listen()
507  * Create a unix domain socket, and listen on it.
508  */
509 int
510 unix_listen(char *path)
511 {
512 	struct sockaddr_un sunaddr;
513 	int s;
514 
515 	/* Create unix domain socket. */
516 	if ((s = socket(AF_UNIX, SOCK_STREAM, 0)) < 0)
517 		return (-1);
518 
519 	(void) memset(&sunaddr, 0, sizeof (struct sockaddr_un));
520 	sunaddr.sun_family = AF_UNIX;
521 
522 	if (strlcpy(sunaddr.sun_path, path, sizeof (sunaddr.sun_path)) >=
523 	    sizeof (sunaddr.sun_path)) {
524 		(void) close(s);
525 		errno = ENAMETOOLONG;
526 		return (-1);
527 	}
528 
529 	if (bind(s, (struct sockaddr *)&sunaddr, SUN_LEN(&sunaddr)) < 0) {
530 		(void) close(s);
531 		return (-1);
532 	}
533 
534 	if (listen(s, 5) < 0) {
535 		(void) close(s);
536 		return (-1);
537 	}
538 	return (s);
539 }
540 
541 /*
542  * remote_connect()
543  * Returns a socket connected to a remote host. Properly binds to a local
544  * port or source address if needed. Returns -1 on failure.
545  */
546 int
547 remote_connect(const char *host, const char *port, struct addrinfo hints)
548 {
549 	struct addrinfo *res, *res0;
550 	int s, error;
551 
552 	if ((error = getaddrinfo(host, port, &hints, &res)))
553 		errx(1, "getaddrinfo: %s", gai_strerror(error));
554 
555 	res0 = res;
556 	do {
557 		if ((s = socket(res0->ai_family, res0->ai_socktype,
558 		    res0->ai_protocol)) < 0) {
559 			warn("failed to create socket");
560 			continue;
561 		}
562 
563 		/* Bind to a local port or source address if specified. */
564 		if (sflag || pflag) {
565 			struct addrinfo ahints, *ares;
566 
567 			(void) memset(&ahints, 0, sizeof (struct addrinfo));
568 			ahints.ai_family = res0->ai_family;
569 			ahints.ai_socktype = uflag ? SOCK_DGRAM : SOCK_STREAM;
570 			ahints.ai_protocol = uflag ? IPPROTO_UDP : IPPROTO_TCP;
571 			ahints.ai_flags = AI_PASSIVE;
572 			if ((error = getaddrinfo(sflag, pflag, &ahints, &ares)))
573 				errx(1, "getaddrinfo: %s", gai_strerror(error));
574 
575 			if (bind(s, (struct sockaddr *)ares->ai_addr,
576 			    ares->ai_addrlen) < 0)
577 				errx(1, "bind failed: %s", strerror(errno));
578 			freeaddrinfo(ares);
579 
580 			if (vflag && !lflag) {
581 				if (sflag != NULL)
582 					(void) fprintf(stderr,
583 					    "Using source address: %s\n",
584 					    sflag);
585 				if (pflag != NULL)
586 					(void) fprintf(stderr,
587 					    "Using source port: %s\n", pflag);
588 			}
589 		}
590 
591 		set_common_sockopts(s);
592 
593 		if (connect(s, res0->ai_addr, res0->ai_addrlen) == 0)
594 			break;
595 		else if (vflag) {
596 			char ntop[NI_MAXHOST + NI_MAXSERV];
597 			warn("connect to %s [host %s] (%s) failed",
598 			    print_addr(ntop, sizeof (ntop),
599 			    res0->ai_addr, res0->ai_addrlen, NI_NUMERICHOST),
600 			    host, uflag ? "udp" : "tcp");
601 		}
602 
603 		(void) close(s);
604 		s = -1;
605 	} while ((res0 = res0->ai_next) != NULL);
606 
607 	freeaddrinfo(res);
608 
609 	return (s);
610 }
611 
612 /*
613  * local_listen()
614  * Returns a socket listening on a local port, binds to specified source
615  * address. Returns -1 on failure.
616  */
617 int
618 local_listen(char *host, char *port, struct addrinfo hints)
619 {
620 	struct addrinfo *res, *res0;
621 	int s, ret, x = 1;
622 	int error;
623 
624 	/* Allow nodename to be null. */
625 	hints.ai_flags |= AI_PASSIVE;
626 
627 	if ((error = getaddrinfo(host, port, &hints, &res)))
628 		errx(1, "getaddrinfo: %s", gai_strerror(error));
629 
630 	res0 = res;
631 	do {
632 		if ((s = socket(res0->ai_family, res0->ai_socktype,
633 		    res0->ai_protocol)) < 0) {
634 			warn("failed to create socket");
635 			continue;
636 		}
637 
638 		ret = setsockopt(s, SOL_SOCKET, SO_REUSEADDR, &x, sizeof (x));
639 		if (ret == -1)
640 			err(1, NULL);
641 
642 		set_common_sockopts(s);
643 
644 		if (bind(s, (struct sockaddr *)res0->ai_addr,
645 		    res0->ai_addrlen) == 0)
646 			break;
647 
648 		(void) close(s);
649 		s = -1;
650 	} while ((res0 = res0->ai_next) != NULL);
651 
652 	if (!uflag && s != -1) {
653 		if (listen(s, 1) < 0)
654 			err(1, "listen");
655 	}
656 
657 	freeaddrinfo(res);
658 
659 	return (s);
660 }
661 
662 /*
663  * readwrite()
664  * Loop that polls on the network file descriptor and stdin.
665  */
666 void
667 readwrite(int nfd)
668 {
669 	struct pollfd pfd[2];
670 	unsigned char buf[8192];
671 	int n, wfd = fileno(stdin);
672 	int lfd = fileno(stdout);
673 	int plen;
674 
675 	plen = 1024;
676 
677 	/* Setup Network FD */
678 	pfd[0].fd = nfd;
679 	pfd[0].events = POLLIN;
680 
681 	/* Set up STDIN FD. */
682 	pfd[1].fd = wfd;
683 	pfd[1].events = POLLIN;
684 
685 	while (pfd[0].fd != -1) {
686 		if (iflag)
687 			(void) sleep(iflag);
688 
689 		if ((n = poll(pfd, 2 - dflag, timeout)) < 0) {
690 			(void) close(nfd);
691 			err(1, "Polling Error");
692 		}
693 
694 		if (n == 0)
695 			return;
696 
697 		if (pfd[0].revents & (POLLIN|POLLHUP)) {
698 			if ((n = read(nfd, buf, plen)) < 0)
699 				return;
700 			else if (n == 0) {
701 				(void) shutdown(nfd, SHUT_RD);
702 				pfd[0].fd = -1;
703 				pfd[0].events = 0;
704 			} else {
705 				if (tflag)
706 					atelnet(nfd, buf, n);
707 				if (atomicio(vwrite, lfd, buf, n) != n)
708 					return;
709 			}
710 		}
711 
712 		/*
713 		 * handle the case of disconnected pipe: after pipe
714 		 * is closed (indicated by POLLHUP) there may still
715 		 * be some data lingering (POLLIN). After we read
716 		 * the data, only POLLHUP remains, read() returns 0
717 		 * and we are finished.
718 		 */
719 		if (!dflag && (pfd[1].revents & (POLLIN|POLLHUP))) {
720 			if ((n = read(wfd, buf, plen)) < 0)
721 				return;
722 			else if (n == 0) {
723 				(void) shutdown(nfd, SHUT_WR);
724 				pfd[1].fd = -1;
725 				pfd[1].events = 0;
726 			} else {
727 				if (atomicio(vwrite, nfd, buf, n) != n)
728 					return;
729 			}
730 		}
731 	}
732 }
733 
734 /* Deal with RFC 854 WILL/WONT DO/DONT negotiation. */
735 void
736 atelnet(int nfd, unsigned char *buf, unsigned int size)
737 {
738 	unsigned char *p, *end;
739 	unsigned char obuf[4];
740 
741 	end = buf + size;
742 	obuf[0] = '\0';
743 
744 	for (p = buf; p < end; p++) {
745 		if (*p != IAC)
746 			break;
747 
748 		obuf[0] = IAC;
749 		obuf[1] = 0;
750 		p++;
751 		/* refuse all options */
752 		if ((*p == WILL) || (*p == WONT))
753 			obuf[1] = DONT;
754 		if ((*p == DO) || (*p == DONT))
755 			obuf[1] = WONT;
756 		if (obuf[1]) {
757 			p++;
758 			obuf[2] = *p;
759 			obuf[3] = '\0';
760 			if (atomicio(vwrite, nfd, obuf, 3) != 3)
761 				warn("Write Error!");
762 			obuf[0] = '\0';
763 		}
764 	}
765 }
766 
767 /*
768  * build_ports()
769  * Build an array of ports in ports.list[], listing each port
770  * that we should try to connect to.
771  */
772 void
773 build_ports(char *p)
774 {
775 	const char *errstr;
776 	const char *token;
777 	char *n;
778 	int lo, hi, cp;
779 	int i;
780 
781 	/* Set up initial portlist. */
782 	ports.list = malloc(PLIST_SZ * sizeof (uint16_t));
783 	if (ports.list == NULL)
784 		err(1, NULL);
785 	ports.listsize = PLIST_SZ;
786 	ports.numports = 0;
787 
788 	/* Cycle through list of given ports sep. by "," */
789 	while ((token = strsep(&p, ",")) != NULL) {
790 		if (*token == '\0')
791 			errx(1, "Invalid port/portlist format: "
792 			    "zero length port");
793 
794 		/* check if it is a range */
795 		if ((n = strchr(token, '-')) != NULL)
796 			*n++ = '\0';
797 
798 		lo = strtonum(token, PORT_MIN, PORT_MAX, &errstr);
799 		if (errstr)
800 			errx(1, "port number %s: %s", errstr, token);
801 
802 		if (n == NULL) {
803 			hi = lo;
804 		} else {
805 			hi = strtonum(n, PORT_MIN, PORT_MAX, &errstr);
806 			if (errstr)
807 				errx(1, "port number %s: %s", errstr, n);
808 			if (lo > hi) {
809 				cp = hi;
810 				hi = lo;
811 				lo = cp;
812 			}
813 		}
814 
815 		/*
816 		 * Grow the portlist if needed.
817 		 * We double the size and add size of current range
818 		 * to make sure we don't have to resize that often.
819 		 */
820 		if (hi - lo + ports.numports + 1 >= ports.listsize) {
821 			ports.listsize = ports.listsize * 2 + hi - lo;
822 			ports.list = realloc(ports.list,
823 			    ports.listsize * sizeof (uint16_t));
824 			if (ports.list == NULL)
825 				err(1, NULL);
826 		}
827 
828 		/* Load ports sequentially. */
829 		for (i = lo; i <= hi; i++)
830 			ports.list[ports.numports++] = i;
831 	}
832 
833 	/* Randomly swap ports. */
834 	if (rflag) {
835 		int y;
836 		uint16_t u;
837 
838 		if (ports.numports < 2) {
839 			warnx("can not swap %d port randomly",
840 			    ports.numports);
841 			return;
842 		}
843 		srandom(time(NULL));
844 		for (i = 0; i < ports.numports; i++) {
845 			y = random() % (ports.numports - 1);
846 			u = ports.list[i];
847 			ports.list[i] = ports.list[y];
848 			ports.list[y] = u;
849 		}
850 	}
851 }
852 
853 /*
854  * udptest()
855  * Do a few writes to see if the UDP port is there.
856  * XXX - Better way of doing this? Doesn't work for IPv6.
857  * Also fails after around 100 ports checked.
858  */
859 int
860 udptest(int s)
861 {
862 	int i, ret;
863 
864 	for (i = 0; i <= 3; i++) {
865 		if (write(s, "X", 1) == 1)
866 			ret = 1;
867 		else
868 			ret = -1;
869 	}
870 	return (ret);
871 }
872 
873 void
874 set_common_sockopts(int s)
875 {
876 	int x = 1;
877 
878 	if (Dflag) {
879 		if (setsockopt(s, SOL_SOCKET, SO_DEBUG, &x, sizeof (x)) == -1)
880 			err(1, NULL);
881 	}
882 	if (Tflag != -1) {
883 		if (setsockopt(s, IPPROTO_IP, IP_TOS, &Tflag,
884 		    sizeof (Tflag)) == -1)
885 			err(1, "set IP ToS");
886 	}
887 }
888 
889 int
890 parse_iptos(char *s)
891 {
892 	int tos = -1;
893 
894 	if (strcmp(s, "lowdelay") == 0)
895 		return (IPTOS_LOWDELAY);
896 	if (strcmp(s, "throughput") == 0)
897 		return (IPTOS_THROUGHPUT);
898 	if (strcmp(s, "reliability") == 0)
899 		return (IPTOS_RELIABILITY);
900 
901 	if (sscanf(s, "0x%x", (unsigned int *) &tos) != 1 ||
902 	    tos < 0 || tos > 0xff)
903 		errx(1, "invalid IP Type of Service");
904 	return (tos);
905 }
906 
907 void
908 help(void)
909 {
910 	usage(0);
911 	(void) fprintf(stderr, "\tCommand Summary:\n\
912 	\t-4		Use IPv4\n\
913 	\t-6		Use IPv6\n\
914 	\t-D		Enable the debug socket option\n\
915 	\t-d		Detach from stdin\n\
916 	\t-h		This help text\n\
917 	\t-i secs\t	Delay interval for lines sent, ports scanned\n\
918 	\t-k		Keep inbound sockets open for multiple connects\n\
919 	\t-l		Listen mode, for inbound connects\n\
920 	\t-n		Suppress name/port resolutions\n\
921 	\t-P proxyuser\tUsername for proxy authentication\n\
922 	\t-p port\t	Specify local port or listen port\n\
923 	\t-r		Randomize remote ports\n\
924 	\t-s addr\t	Local source address\n\
925 	\t-T ToS\t	Set IP Type of Service\n\
926 	\t-t		Answer TELNET negotiation\n\
927 	\t-U		Use UNIX domain socket\n\
928 	\t-u		UDP mode\n\
929 	\t-v		Verbose\n\
930 	\t-w secs\t	Timeout for connects and final net reads\n\
931 	\t-X proto	Proxy protocol: \"4\", \"5\" (SOCKS) or \"connect\"\n\
932 	\t-x addr[:port]\tSpecify proxy address and port\n\
933 	\t-z		Zero-I/O mode [used for scanning]\n\
934 	Port numbers can be individuals, ranges (lo-hi; inclusive) and\n\
935 	combinations of both separated by comma (e.g. 10,22-25,80)\n");
936 	exit(1);
937 }
938 
939 void
940 usage(int ret)
941 {
942 	(void) fprintf(stderr,
943 	    "usage: nc [-46DdhklnrtUuvz] [-i interval] [-P proxy_username]"
944 	    " [-p port]\n");
945 	(void) fprintf(stderr,
946 	    "\t  [-s source_ip_address] [-T ToS] [-w timeout]"
947 	    " [-X proxy_protocol]\n");
948 	(void) fprintf(stderr,
949 	    "\t  [-x proxy_address[:port]] [hostname]"
950 	    " [port[s]]\n");
951 	if (ret)
952 		exit(1);
953 }
954