xref: /openbsd-src/usr.bin/nc/netcat.c (revision 43003dfe3ad45d1698bed8a37f2b0f5b14f20d4f)
1 /* $OpenBSD: netcat.c,v 1.94 2009/10/08 15:56:46 mpf Exp $ */
2 /*
3  * Copyright (c) 2001 Eric Jackson <ericj@monkey.org>
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  *
9  * 1. Redistributions of source code must retain the above copyright
10  *   notice, this list of conditions and the following disclaimer.
11  * 2. Redistributions in binary form must reproduce the above copyright
12  *   notice, this list of conditions and the following disclaimer in the
13  *   documentation and/or other materials provided with the distribution.
14  * 3. The name of the author may not be used to endorse or promote products
15  *   derived from this software without specific prior written permission.
16  *
17  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
18  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
19  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
20  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
21  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
22  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
23  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
24  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
25  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
26  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
27  */
28 
29 /*
30  * Re-written nc(1) for OpenBSD. Original implementation by
31  * *Hobbit* <hobbit@avian.org>.
32  */
33 
34 #include <sys/types.h>
35 #include <sys/socket.h>
36 #include <sys/time.h>
37 #include <sys/un.h>
38 
39 #include <netinet/in.h>
40 #include <netinet/in_systm.h>
41 #include <netinet/tcp.h>
42 #include <netinet/ip.h>
43 #include <arpa/telnet.h>
44 
45 #include <err.h>
46 #include <errno.h>
47 #include <netdb.h>
48 #include <poll.h>
49 #include <stdarg.h>
50 #include <stdio.h>
51 #include <stdlib.h>
52 #include <string.h>
53 #include <unistd.h>
54 #include <fcntl.h>
55 #include <limits.h>
56 #include "atomicio.h"
57 
58 #ifndef SUN_LEN
59 #define SUN_LEN(su) \
60 	(sizeof(*(su)) - sizeof((su)->sun_path) + strlen((su)->sun_path))
61 #endif
62 
63 #define PORT_MAX	65535
64 #define PORT_MAX_LEN	6
65 
66 /* Command Line Options */
67 int	dflag;					/* detached, no stdin */
68 unsigned int iflag;				/* Interval Flag */
69 int	jflag;					/* use jumbo frames if we can */
70 int	kflag;					/* More than one connect */
71 int	lflag;					/* Bind to local port */
72 int	nflag;					/* Don't do name look up */
73 char   *Pflag;					/* Proxy username */
74 char   *pflag;					/* Localport flag */
75 int	rflag;					/* Random ports flag */
76 char   *sflag;					/* Source Address */
77 int	tflag;					/* Telnet Emulation */
78 int	uflag;					/* UDP - Default to TCP */
79 int	vflag;					/* Verbosity */
80 int	xflag;					/* Socks proxy */
81 int	zflag;					/* Port Scan Flag */
82 int	Dflag;					/* sodebug */
83 int	Iflag;					/* TCP receive buffer size */
84 int	Oflag;					/* TCP send buffer size */
85 int	Sflag;					/* TCP MD5 signature option */
86 int	Tflag = -1;				/* IP Type of Service */
87 u_int	rdomain;
88 
89 int timeout = -1;
90 int family = AF_UNSPEC;
91 char *portlist[PORT_MAX+1];
92 
93 void	atelnet(int, unsigned char *, unsigned int);
94 void	build_ports(char *);
95 void	help(void);
96 int	local_listen(char *, char *, struct addrinfo);
97 void	readwrite(int);
98 int	remote_connect(const char *, const char *, struct addrinfo);
99 int	socks_connect(const char *, const char *, struct addrinfo,
100 	    const char *, const char *, struct addrinfo, int, const char *);
101 int	udptest(int);
102 int	unix_connect(char *);
103 int	unix_listen(char *);
104 void	set_common_sockopts(int);
105 int	parse_iptos(char *);
106 void	usage(int);
107 
108 int
109 main(int argc, char *argv[])
110 {
111 	int ch, s, ret, socksv;
112 	char *host, *uport;
113 	struct addrinfo hints;
114 	struct servent *sv;
115 	socklen_t len;
116 	struct sockaddr_storage cliaddr;
117 	char *proxy;
118 	const char *errstr, *proxyhost = "", *proxyport = NULL;
119 	struct addrinfo proxyhints;
120 
121 	ret = 1;
122 	s = 0;
123 	socksv = 5;
124 	host = NULL;
125 	uport = NULL;
126 	sv = NULL;
127 
128 	while ((ch = getopt(argc, argv,
129 	    "46DdhI:i:jklnO:P:p:rSs:tT:UuV:vw:X:x:z")) != -1) {
130 		switch (ch) {
131 		case '4':
132 			family = AF_INET;
133 			break;
134 		case '6':
135 			family = AF_INET6;
136 			break;
137 		case 'U':
138 			family = AF_UNIX;
139 			break;
140 		case 'X':
141 			if (strcasecmp(optarg, "connect") == 0)
142 				socksv = -1; /* HTTP proxy CONNECT */
143 			else if (strcmp(optarg, "4") == 0)
144 				socksv = 4; /* SOCKS v.4 */
145 			else if (strcmp(optarg, "5") == 0)
146 				socksv = 5; /* SOCKS v.5 */
147 			else
148 				errx(1, "unsupported proxy protocol");
149 			break;
150 		case 'd':
151 			dflag = 1;
152 			break;
153 		case 'h':
154 			help();
155 			break;
156 		case 'i':
157 			iflag = strtonum(optarg, 0, UINT_MAX, &errstr);
158 			if (errstr)
159 				errx(1, "interval %s: %s", errstr, optarg);
160 			break;
161 		case 'j':
162 			jflag = 1;
163 			break;
164 		case 'k':
165 			kflag = 1;
166 			break;
167 		case 'l':
168 			lflag = 1;
169 			break;
170 		case 'n':
171 			nflag = 1;
172 			break;
173 		case 'P':
174 			Pflag = optarg;
175 			break;
176 		case 'p':
177 			pflag = optarg;
178 			break;
179 		case 'r':
180 			rflag = 1;
181 			break;
182 		case 's':
183 			sflag = optarg;
184 			break;
185 		case 't':
186 			tflag = 1;
187 			break;
188 		case 'u':
189 			uflag = 1;
190 			break;
191 		case 'V':
192 			rdomain = (unsigned int)strtonum(optarg, 0,
193 			    RT_TABLEID_MAX, &errstr);
194 			if (errstr)
195 				errx(1, "rdomain %s: %s", errstr, optarg);
196 			break;
197 		case 'v':
198 			vflag = 1;
199 			break;
200 		case 'w':
201 			timeout = strtonum(optarg, 0, INT_MAX / 1000, &errstr);
202 			if (errstr)
203 				errx(1, "timeout %s: %s", errstr, optarg);
204 			timeout *= 1000;
205 			break;
206 		case 'x':
207 			xflag = 1;
208 			if ((proxy = strdup(optarg)) == NULL)
209 				err(1, NULL);
210 			break;
211 		case 'z':
212 			zflag = 1;
213 			break;
214 		case 'D':
215 			Dflag = 1;
216 			break;
217 		case 'I':
218 			Iflag = strtonum(optarg, 1, 65536 << 14, &errstr);
219 			if (errstr != NULL)
220 				errx(1, "TCP receive window %s: %s",
221 				    errstr, optarg);
222 			break;
223 		case 'O':
224 			Oflag = strtonum(optarg, 1, 65536 << 14, &errstr);
225 			if (errstr != NULL)
226 				errx(1, "TCP send window %s: %s",
227 				    errstr, optarg);
228 			break;
229 		case 'S':
230 			Sflag = 1;
231 			break;
232 		case 'T':
233 			Tflag = parse_iptos(optarg);
234 			break;
235 		default:
236 			usage(1);
237 		}
238 	}
239 	argc -= optind;
240 	argv += optind;
241 
242 	/* Cruft to make sure options are clean, and used properly. */
243 	if (argv[0] && !argv[1] && family == AF_UNIX) {
244 		if (uflag)
245 			errx(1, "cannot use -u and -U");
246 		host = argv[0];
247 		uport = NULL;
248 	} else if (argv[0] && !argv[1]) {
249 		if  (!lflag)
250 			usage(1);
251 		uport = argv[0];
252 		host = NULL;
253 	} else if (argv[0] && argv[1]) {
254 		host = argv[0];
255 		uport = argv[1];
256 	} else
257 		usage(1);
258 
259 	if (lflag && sflag)
260 		errx(1, "cannot use -s and -l");
261 	if (lflag && pflag)
262 		errx(1, "cannot use -p and -l");
263 	if (lflag && zflag)
264 		errx(1, "cannot use -z and -l");
265 	if (!lflag && kflag)
266 		errx(1, "must use -l with -k");
267 
268 	/* Initialize addrinfo structure. */
269 	if (family != AF_UNIX) {
270 		memset(&hints, 0, sizeof(struct addrinfo));
271 		hints.ai_family = family;
272 		hints.ai_socktype = uflag ? SOCK_DGRAM : SOCK_STREAM;
273 		hints.ai_protocol = uflag ? IPPROTO_UDP : IPPROTO_TCP;
274 		if (nflag)
275 			hints.ai_flags |= AI_NUMERICHOST;
276 	}
277 
278 	if (xflag) {
279 		if (uflag)
280 			errx(1, "no proxy support for UDP mode");
281 
282 		if (lflag)
283 			errx(1, "no proxy support for listen");
284 
285 		if (family == AF_UNIX)
286 			errx(1, "no proxy support for unix sockets");
287 
288 		/* XXX IPv6 transport to proxy would probably work */
289 		if (family == AF_INET6)
290 			errx(1, "no proxy support for IPv6");
291 
292 		if (sflag)
293 			errx(1, "no proxy support for local source address");
294 
295 		proxyhost = strsep(&proxy, ":");
296 		proxyport = proxy;
297 
298 		memset(&proxyhints, 0, sizeof(struct addrinfo));
299 		proxyhints.ai_family = family;
300 		proxyhints.ai_socktype = SOCK_STREAM;
301 		proxyhints.ai_protocol = IPPROTO_TCP;
302 		if (nflag)
303 			proxyhints.ai_flags |= AI_NUMERICHOST;
304 	}
305 
306 	if (lflag) {
307 		int connfd;
308 		ret = 0;
309 
310 		if (family == AF_UNIX)
311 			s = unix_listen(host);
312 
313 		/* Allow only one connection at a time, but stay alive. */
314 		for (;;) {
315 			if (family != AF_UNIX)
316 				s = local_listen(host, uport, hints);
317 			if (s < 0)
318 				err(1, NULL);
319 			/*
320 			 * For UDP, we will use recvfrom() initially
321 			 * to wait for a caller, then use the regular
322 			 * functions to talk to the caller.
323 			 */
324 			if (uflag) {
325 				int rv, plen;
326 				char buf[8192];
327 				struct sockaddr_storage z;
328 
329 				len = sizeof(z);
330 				plen = jflag ? 8192 : 1024;
331 				rv = recvfrom(s, buf, plen, MSG_PEEK,
332 				    (struct sockaddr *)&z, &len);
333 				if (rv < 0)
334 					err(1, "recvfrom");
335 
336 				rv = connect(s, (struct sockaddr *)&z, len);
337 				if (rv < 0)
338 					err(1, "connect");
339 
340 				connfd = s;
341 			} else {
342 				len = sizeof(cliaddr);
343 				connfd = accept(s, (struct sockaddr *)&cliaddr,
344 				    &len);
345 			}
346 
347 			readwrite(connfd);
348 			close(connfd);
349 			if (family != AF_UNIX)
350 				close(s);
351 
352 			if (!kflag)
353 				break;
354 		}
355 	} else if (family == AF_UNIX) {
356 		ret = 0;
357 
358 		if ((s = unix_connect(host)) > 0 && !zflag) {
359 			readwrite(s);
360 			close(s);
361 		} else
362 			ret = 1;
363 
364 		exit(ret);
365 
366 	} else {
367 		int i = 0;
368 
369 		/* Construct the portlist[] array. */
370 		build_ports(uport);
371 
372 		/* Cycle through portlist, connecting to each port. */
373 		for (i = 0; portlist[i] != NULL; i++) {
374 			if (s)
375 				close(s);
376 
377 			if (xflag)
378 				s = socks_connect(host, portlist[i], hints,
379 				    proxyhost, proxyport, proxyhints, socksv,
380 				    Pflag);
381 			else
382 				s = remote_connect(host, portlist[i], hints);
383 
384 			if (s < 0)
385 				continue;
386 
387 			ret = 0;
388 			if (vflag || zflag) {
389 				/* For UDP, make sure we are connected. */
390 				if (uflag) {
391 					if (udptest(s) == -1) {
392 						ret = 1;
393 						continue;
394 					}
395 				}
396 
397 				/* Don't look up port if -n. */
398 				if (nflag)
399 					sv = NULL;
400 				else {
401 					sv = getservbyport(
402 					    ntohs(atoi(portlist[i])),
403 					    uflag ? "udp" : "tcp");
404 				}
405 
406 				fprintf(stderr,
407 				    "Connection to %s %s port [%s/%s] "
408 				    "succeeded!\n", host, portlist[i],
409 				    uflag ? "udp" : "tcp",
410 				    sv ? sv->s_name : "*");
411 			}
412 			if (!zflag)
413 				readwrite(s);
414 		}
415 	}
416 
417 	if (s)
418 		close(s);
419 
420 	exit(ret);
421 }
422 
423 /*
424  * unix_connect()
425  * Returns a socket connected to a local unix socket. Returns -1 on failure.
426  */
427 int
428 unix_connect(char *path)
429 {
430 	struct sockaddr_un sun;
431 	int s;
432 
433 	if ((s = socket(AF_UNIX, SOCK_STREAM, 0)) < 0)
434 		return (-1);
435 	(void)fcntl(s, F_SETFD, 1);
436 
437 	memset(&sun, 0, sizeof(struct sockaddr_un));
438 	sun.sun_family = AF_UNIX;
439 
440 	if (strlcpy(sun.sun_path, path, sizeof(sun.sun_path)) >=
441 	    sizeof(sun.sun_path)) {
442 		close(s);
443 		errno = ENAMETOOLONG;
444 		return (-1);
445 	}
446 	if (connect(s, (struct sockaddr *)&sun, SUN_LEN(&sun)) < 0) {
447 		close(s);
448 		return (-1);
449 	}
450 	return (s);
451 
452 }
453 
454 /*
455  * unix_listen()
456  * Create a unix domain socket, and listen on it.
457  */
458 int
459 unix_listen(char *path)
460 {
461 	struct sockaddr_un sun;
462 	int s;
463 
464 	/* Create unix domain socket. */
465 	if ((s = socket(AF_UNIX, SOCK_STREAM, 0)) < 0)
466 		return (-1);
467 
468 	memset(&sun, 0, sizeof(struct sockaddr_un));
469 	sun.sun_family = AF_UNIX;
470 
471 	if (strlcpy(sun.sun_path, path, sizeof(sun.sun_path)) >=
472 	    sizeof(sun.sun_path)) {
473 		close(s);
474 		errno = ENAMETOOLONG;
475 		return (-1);
476 	}
477 
478 	if (bind(s, (struct sockaddr *)&sun, SUN_LEN(&sun)) < 0) {
479 		close(s);
480 		return (-1);
481 	}
482 
483 	if (listen(s, 5) < 0) {
484 		close(s);
485 		return (-1);
486 	}
487 	return (s);
488 }
489 
490 /*
491  * remote_connect()
492  * Returns a socket connected to a remote host. Properly binds to a local
493  * port or source address if needed. Returns -1 on failure.
494  */
495 int
496 remote_connect(const char *host, const char *port, struct addrinfo hints)
497 {
498 	struct addrinfo *res, *res0;
499 	int s, error, on = 1;
500 
501 	if ((error = getaddrinfo(host, port, &hints, &res)))
502 		errx(1, "getaddrinfo: %s", gai_strerror(error));
503 
504 	res0 = res;
505 	do {
506 		if ((s = socket(res0->ai_family, res0->ai_socktype,
507 		    res0->ai_protocol)) < 0)
508 			continue;
509 
510 		if (rdomain) {
511 			if (setsockopt(s, IPPROTO_IP, SO_RDOMAIN, &rdomain,
512 			    sizeof(rdomain)) == -1)
513 				err(1, "setsockopt SO_RDOMAIN");
514 		}
515 
516 		/* Bind to a local port or source address if specified. */
517 		if (sflag || pflag) {
518 			struct addrinfo ahints, *ares;
519 
520 			/* try SO_BINDANY, but don't insist */
521 			setsockopt(s, SOL_SOCKET, SO_BINDANY, &on, sizeof(on));
522 			memset(&ahints, 0, sizeof(struct addrinfo));
523 			ahints.ai_family = res0->ai_family;
524 			ahints.ai_socktype = uflag ? SOCK_DGRAM : SOCK_STREAM;
525 			ahints.ai_protocol = uflag ? IPPROTO_UDP : IPPROTO_TCP;
526 			ahints.ai_flags = AI_PASSIVE;
527 			if ((error = getaddrinfo(sflag, pflag, &ahints, &ares)))
528 				errx(1, "getaddrinfo: %s", gai_strerror(error));
529 
530 			if (bind(s, (struct sockaddr *)ares->ai_addr,
531 			    ares->ai_addrlen) < 0)
532 				errx(1, "bind failed: %s", strerror(errno));
533 			freeaddrinfo(ares);
534 		}
535 
536 		set_common_sockopts(s);
537 
538 		if (connect(s, res0->ai_addr, res0->ai_addrlen) == 0)
539 			break;
540 		else if (vflag)
541 			warn("connect to %s port %s (%s) failed", host, port,
542 			    uflag ? "udp" : "tcp");
543 
544 		close(s);
545 		s = -1;
546 	} while ((res0 = res0->ai_next) != NULL);
547 
548 	freeaddrinfo(res);
549 
550 	return (s);
551 }
552 
553 /*
554  * local_listen()
555  * Returns a socket listening on a local port, binds to specified source
556  * address. Returns -1 on failure.
557  */
558 int
559 local_listen(char *host, char *port, struct addrinfo hints)
560 {
561 	struct addrinfo *res, *res0;
562 	int s, ret, x = 1;
563 	int error;
564 
565 	/* Allow nodename to be null. */
566 	hints.ai_flags |= AI_PASSIVE;
567 
568 	/*
569 	 * In the case of binding to a wildcard address
570 	 * default to binding to an ipv4 address.
571 	 */
572 	if (host == NULL && hints.ai_family == AF_UNSPEC)
573 		hints.ai_family = AF_INET;
574 
575 	if ((error = getaddrinfo(host, port, &hints, &res)))
576 		errx(1, "getaddrinfo: %s", gai_strerror(error));
577 
578 	res0 = res;
579 	do {
580 		if ((s = socket(res0->ai_family, res0->ai_socktype,
581 		    res0->ai_protocol)) < 0)
582 			continue;
583 
584 		if (rdomain) {
585 			if (setsockopt(s, IPPROTO_IP, SO_RDOMAIN, &rdomain,
586 			    sizeof(rdomain)) == -1)
587 				err(1, "setsockopt SO_RDOMAIN");
588 		}
589 
590 		ret = setsockopt(s, SOL_SOCKET, SO_REUSEPORT, &x, sizeof(x));
591 		if (ret == -1)
592 			err(1, NULL);
593 
594 		set_common_sockopts(s);
595 
596 		if (bind(s, (struct sockaddr *)res0->ai_addr,
597 		    res0->ai_addrlen) == 0)
598 			break;
599 
600 		close(s);
601 		s = -1;
602 	} while ((res0 = res0->ai_next) != NULL);
603 
604 	if (!uflag && s != -1) {
605 		if (listen(s, 1) < 0)
606 			err(1, "listen");
607 	}
608 
609 	freeaddrinfo(res);
610 
611 	return (s);
612 }
613 
614 /*
615  * readwrite()
616  * Loop that polls on the network file descriptor and stdin.
617  */
618 void
619 readwrite(int nfd)
620 {
621 	struct pollfd pfd[2];
622 	unsigned char buf[8192];
623 	int n, wfd = fileno(stdin);
624 	int lfd = fileno(stdout);
625 	int plen;
626 
627 	plen = jflag ? 8192 : 1024;
628 
629 	/* Setup Network FD */
630 	pfd[0].fd = nfd;
631 	pfd[0].events = POLLIN;
632 
633 	/* Set up STDIN FD. */
634 	pfd[1].fd = wfd;
635 	pfd[1].events = POLLIN;
636 
637 	while (pfd[0].fd != -1) {
638 		if (iflag)
639 			sleep(iflag);
640 
641 		if ((n = poll(pfd, 2 - dflag, timeout)) < 0) {
642 			close(nfd);
643 			err(1, "Polling Error");
644 		}
645 
646 		if (n == 0)
647 			return;
648 
649 		if (pfd[0].revents & POLLIN) {
650 			if ((n = read(nfd, buf, plen)) < 0)
651 				return;
652 			else if (n == 0) {
653 				shutdown(nfd, SHUT_RD);
654 				pfd[0].fd = -1;
655 				pfd[0].events = 0;
656 			} else {
657 				if (tflag)
658 					atelnet(nfd, buf, n);
659 				if (atomicio(vwrite, lfd, buf, n) != n)
660 					return;
661 			}
662 		}
663 
664 		if (!dflag && pfd[1].revents & POLLIN) {
665 			if ((n = read(wfd, buf, plen)) < 0)
666 				return;
667 			else if (n == 0) {
668 				shutdown(nfd, SHUT_WR);
669 				pfd[1].fd = -1;
670 				pfd[1].events = 0;
671 			} else {
672 				if (atomicio(vwrite, nfd, buf, n) != n)
673 					return;
674 			}
675 		}
676 	}
677 }
678 
679 /* Deal with RFC 854 WILL/WONT DO/DONT negotiation. */
680 void
681 atelnet(int nfd, unsigned char *buf, unsigned int size)
682 {
683 	unsigned char *p, *end;
684 	unsigned char obuf[4];
685 
686 	end = buf + size;
687 	obuf[0] = '\0';
688 
689 	for (p = buf; p < end; p++) {
690 		if (*p != IAC)
691 			break;
692 
693 		obuf[0] = IAC;
694 		p++;
695 		if ((*p == WILL) || (*p == WONT))
696 			obuf[1] = DONT;
697 		if ((*p == DO) || (*p == DONT))
698 			obuf[1] = WONT;
699 		if (obuf) {
700 			p++;
701 			obuf[2] = *p;
702 			obuf[3] = '\0';
703 			if (atomicio(vwrite, nfd, obuf, 3) != 3)
704 				warn("Write Error!");
705 			obuf[0] = '\0';
706 		}
707 	}
708 }
709 
710 /*
711  * build_ports()
712  * Build an array or ports in portlist[], listing each port
713  * that we should try to connect to.
714  */
715 void
716 build_ports(char *p)
717 {
718 	const char *errstr;
719 	char *n;
720 	int hi, lo, cp;
721 	int x = 0;
722 
723 	if ((n = strchr(p, '-')) != NULL) {
724 		if (lflag)
725 			errx(1, "Cannot use -l with multiple ports!");
726 
727 		*n = '\0';
728 		n++;
729 
730 		/* Make sure the ports are in order: lowest->highest. */
731 		hi = strtonum(n, 1, PORT_MAX, &errstr);
732 		if (errstr)
733 			errx(1, "port number %s: %s", errstr, n);
734 		lo = strtonum(p, 1, PORT_MAX, &errstr);
735 		if (errstr)
736 			errx(1, "port number %s: %s", errstr, p);
737 
738 		if (lo > hi) {
739 			cp = hi;
740 			hi = lo;
741 			lo = cp;
742 		}
743 
744 		/* Load ports sequentially. */
745 		for (cp = lo; cp <= hi; cp++) {
746 			portlist[x] = calloc(1, PORT_MAX_LEN);
747 			if (portlist[x] == NULL)
748 				err(1, NULL);
749 			snprintf(portlist[x], PORT_MAX_LEN, "%d", cp);
750 			x++;
751 		}
752 
753 		/* Randomly swap ports. */
754 		if (rflag) {
755 			int y;
756 			char *c;
757 
758 			for (x = 0; x <= (hi - lo); x++) {
759 				y = (arc4random() & 0xFFFF) % (hi - lo);
760 				c = portlist[x];
761 				portlist[x] = portlist[y];
762 				portlist[y] = c;
763 			}
764 		}
765 	} else {
766 		hi = strtonum(p, 1, PORT_MAX, &errstr);
767 		if (errstr)
768 			errx(1, "port number %s: %s", errstr, p);
769 		portlist[0] = calloc(1, PORT_MAX_LEN);
770 		if (portlist[0] == NULL)
771 			err(1, NULL);
772 		portlist[0] = p;
773 	}
774 }
775 
776 /*
777  * udptest()
778  * Do a few writes to see if the UDP port is there.
779  * XXX - Better way of doing this? Doesn't work for IPv6.
780  * Also fails after around 100 ports checked.
781  */
782 int
783 udptest(int s)
784 {
785 	int i, ret;
786 
787 	for (i = 0; i <= 3; i++) {
788 		if (write(s, "X", 1) == 1)
789 			ret = 1;
790 		else
791 			ret = -1;
792 	}
793 	return (ret);
794 }
795 
796 void
797 set_common_sockopts(int s)
798 {
799 	int x = 1;
800 
801 	if (Sflag) {
802 		if (setsockopt(s, IPPROTO_TCP, TCP_MD5SIG,
803 			&x, sizeof(x)) == -1)
804 			err(1, NULL);
805 	}
806 	if (Dflag) {
807 		if (setsockopt(s, SOL_SOCKET, SO_DEBUG,
808 			&x, sizeof(x)) == -1)
809 			err(1, NULL);
810 	}
811 	if (jflag) {
812 		if (setsockopt(s, SOL_SOCKET, SO_JUMBO,
813 			&x, sizeof(x)) == -1)
814 			err(1, NULL);
815 	}
816 	if (Tflag != -1) {
817 		if (setsockopt(s, IPPROTO_IP, IP_TOS,
818 		    &Tflag, sizeof(Tflag)) == -1)
819 			err(1, "set IP ToS");
820 	}
821 	if (Iflag) {
822 		if (setsockopt(s, SOL_SOCKET, SO_RCVBUF,
823 		    &Iflag, sizeof(Iflag)) == -1)
824 			err(1, "set TCP receive buffer size");
825 	}
826 	if (Oflag) {
827 		if (setsockopt(s, SOL_SOCKET, SO_SNDBUF,
828 		    &Oflag, sizeof(Oflag)) == -1)
829 			err(1, "set TCP send buffer size");
830 	}
831 }
832 
833 int
834 parse_iptos(char *s)
835 {
836 	int tos = -1;
837 
838 	if (strcmp(s, "lowdelay") == 0)
839 		return (IPTOS_LOWDELAY);
840 	if (strcmp(s, "throughput") == 0)
841 		return (IPTOS_THROUGHPUT);
842 	if (strcmp(s, "reliability") == 0)
843 		return (IPTOS_RELIABILITY);
844 
845 	if (sscanf(s, "0x%x", &tos) != 1 || tos < 0 || tos > 0xff)
846 		errx(1, "invalid IP Type of Service");
847 	return (tos);
848 }
849 
850 void
851 help(void)
852 {
853 	usage(0);
854 	fprintf(stderr, "\tCommand Summary:\n\
855 	\t-4		Use IPv4\n\
856 	\t-6		Use IPv6\n\
857 	\t-D		Enable the debug socket option\n\
858 	\t-d		Detach from stdin\n\
859 	\t-h		This help text\n\
860 	\t-I length	TCP receive buffer length\n\
861 	\t-i secs\t	Delay interval for lines sent, ports scanned\n\
862 	\t-k		Keep inbound sockets open for multiple connects\n\
863 	\t-l		Listen mode, for inbound connects\n\
864 	\t-n		Suppress name/port resolutions\n\
865 	\t-O length	TCP send buffer length\n\
866 	\t-P proxyuser\tUsername for proxy authentication\n\
867 	\t-p port\t	Specify local port for remote connects\n\
868 	\t-r		Randomize remote ports\n\
869 	\t-S		Enable the TCP MD5 signature option\n\
870 	\t-s addr\t	Local source address\n\
871 	\t-T ToS\t	Set IP Type of Service\n\
872 	\t-t		Answer TELNET negotiation\n\
873 	\t-U		Use UNIX domain socket\n\
874 	\t-u		UDP mode\n\
875 	\t-V rdomain	Specify alternate routing domain\n\
876 	\t-v		Verbose\n\
877 	\t-w secs\t	Timeout for connects and final net reads\n\
878 	\t-X proto	Proxy protocol: \"4\", \"5\" (SOCKS) or \"connect\"\n\
879 	\t-x addr[:port]\tSpecify proxy address and port\n\
880 	\t-z		Zero-I/O mode [used for scanning]\n\
881 	Port numbers can be individual or ranges: lo-hi [inclusive]\n");
882 	exit(1);
883 }
884 
885 void
886 usage(int ret)
887 {
888 	fprintf(stderr,
889 	    "usage: nc [-46DdhklnrStUuvz] [-I length] [-i interval] [-O length]\n"
890 	    "\t  [-P proxy_username] [-p source_port] [-s source_ip_address] [-T ToS]\n"
891 	    "\t  [-V rdomain] [-w timeout] [-X proxy_protocol]\n"
892 	    "\t  [-x proxy_address[:port]] [hostname] [port]\n");
893 	if (ret)
894 		exit(1);
895 }
896