add very basic proxy support using socks5 client code from niklas@.

ok ericj@.

4 files changed, 204 insertions, 7 deletions

diff --git a/src/usr.bin/nc/Makefile b/src/usr.bin/nc/Makefile
index 7f761e17ab..150f8295bd 100644
--- a/src/usr.bin/nc/Makefile
+++ b/src/usr.bin/nc/Makefile
@@ -1,6 +1,6 @@
-#       $OpenBSD: Makefile,v 1.5 2001/06/27 03:13:08 smart Exp $
+#       $OpenBSD: Makefile,v 1.6 2001/09/02 18:45:41 jakob Exp $
 
 PROG=   nc
-SRCS=   netcat.c atomicio.c
+SRCS=   netcat.c atomicio.c socks.c
 
 .include <bsd.prog.mk>
diff --git a/src/usr.bin/nc/nc.1 b/src/usr.bin/nc/nc.1
index 53fc6ecfb5..3025e99c4b 100644
--- a/src/usr.bin/nc/nc.1
+++ b/src/usr.bin/nc/nc.1
@@ -1,4 +1,4 @@
-.\"     $OpenBSD: nc.1,v 1.18 2001/08/30 16:31:51 krw Exp $
+.\"     $OpenBSD: nc.1,v 1.19 2001/09/02 18:45:41 jakob Exp $
 .\"
 .\" Copyright (c) 1996 David Sacerdote
 .\" All rights reserved.
@@ -37,6 +37,7 @@
 .Op Fl i Ar interval
 .Op Fl p Ar source port
 .Op Fl s Ar source ip address
+.Op Fl x Ar proxy address Op :port
 .Op Fl w Ar timeout
 .Op Ar hostname
 .Op Ar port[s]
@@ -127,6 +128,13 @@ Use UDP instead of the default option of TCP.
 Have
 .Nm
 give more verbose output.
+.It Fl x Ar proxy address Op :port
+Requests that
+.Nm
+should connect to
+.Ar hostname
+using a socks5 proxy at address and port.
+If port is not specified, port 1080 is used.
 .It Fl z
 Specifies that
 .Nm
diff --git a/src/usr.bin/nc/netcat.c b/src/usr.bin/nc/netcat.c
index 7bd88ad681..f2b7c19c4a 100644
--- a/src/usr.bin/nc/netcat.c
+++ b/src/usr.bin/nc/netcat.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: netcat.c,v 1.33 2001/08/25 21:50:13 ericj Exp $ */
+/* $OpenBSD: netcat.c,v 1.34 2001/09/02 18:45:41 jakob Exp $ */
 /*
  * Copyright (c) 2001 Eric Jackson <ericj@monkey.org>
  *
@@ -61,6 +61,7 @@ char   *sflag;					/* Source Address */
 int     tflag;                                  /* Telnet Emulation */
 int     uflag;                                  /* UDP - Default to TCP */
 int     vflag;                                  /* Verbosity */
+int     xflag;                                  /* Socks proxy */
 int     zflag;                                  /* Port Scan Flag */
 
 int timeout;
@@ -88,6 +89,9 @@ main(argc, argv)
         struct servent *sv;
         socklen_t len;
         struct sockaddr *cliaddr;
+        char *proxy;
+        char *proxyhost, *proxyport;
+        struct addrinfo proxyhints;
 
         ret = 1;
         s = 0;
@@ -96,7 +100,7 @@ main(argc, argv)
         endp = NULL;
         sv = NULL;
 
-        while ((ch = getopt(argc, argv, "46hi:klnp:rs:tuvw:z")) != -1) {
+        while ((ch = getopt(argc, argv, "46hi:klnp:rs:tuvw:x:z")) != -1) {
                 switch (ch) {
                 case '4':
                         family = AF_INET;
@@ -144,6 +148,10 @@ main(argc, argv)
                         if (timeout < 0 || *endp != '\0')
                                 errx(1, "timeout cannot be negative");
                         break;
+                case 'x':
+                        xflag = 1;
+                        proxy = strdup(optarg);
+                        break;
                 case 'z':
                         zflag = 1;
                         break;
@@ -183,6 +191,33 @@ main(argc, argv)
         if (nflag)
                 hints.ai_flags |= AI_NUMERICHOST;
 
+        if (xflag) {
+                char *tmp;
+
+                if (uflag)
+                        errx(1, "no proxy support for UDP mode");
+
+                if (lflag)
+                        errx(1, "no proxy support for listen");
+
+                /* XXX IPv6 transport to proxy would probably work */
+                if (family == AF_INET6)
+                        errx(1, "no proxy support for IPv6");
+
+                if (sflag)
+                        errx(1, "no proxy support for local source address");
+
+                proxyhost = strsep(&proxy, ":");
+                proxyport = proxy;
+
+                memset(&proxyhints, 0, sizeof(struct addrinfo));
+                proxyhints.ai_family = family;
+                proxyhints.ai_socktype = SOCK_STREAM;
+                proxyhints.ai_protocol = IPPROTO_TCP;
+                if (nflag)
+                        proxyhints.ai_flags |= AI_NUMERICHOST;
+        }
+
         if (lflag) {
                 int connfd;
                 ret = 0;
@@ -236,8 +271,14 @@ main(argc, argv)
                         
                         if (s)
                                 close(s);
-        
-                        if ((s = remote_connect(host, portlist[i], hints)) < 0)
+
+                        if (xflag)
+                                s = socks_connect(host, portlist[i], hints,
+                                    proxyhost, proxyport, proxyhints);
+                        else
+                                s = remote_connect(host, portlist[i], hints);
+
+                        if (s < 0)
                                 continue;
 
                         ret = 0;
@@ -326,6 +367,9 @@ remote_connect(host, port, hints)
 
                 if (connect(s, res0->ai_addr, res0->ai_addrlen) == 0)
                         break;
+
+                if (error == 0)
+                        break;
                 
                 close(s);
                 s = -1;
@@ -584,6 +628,7 @@ help()
         \t-u            UDP mode\n\
         \t-v            Verbose\n\
         \t-w secs\t     Timeout for connects and final net reads\n\
+        \t-x addr[:port]\tSpecify socks5 proxy address and port\n\
         \t-z            Zero-I/O mode [used for scanning]\n\
         Port numbers can be individual or ranges: lo-hi [inclusive]\n");
         exit(1);
diff --git a/src/usr.bin/nc/socks.c b/src/usr.bin/nc/socks.c
new file mode 100644
index 0000000000..9189858959
--- /dev/null
+++ b/src/usr.bin/nc/socks.c
@@ -0,0 +1,144 @@
+/*      $OpenBSD: socks.c,v 1.1 2001/09/02 18:45:41 jakob Exp $ */
+
+/*
+ * Copyright (c) 1999 Niklas Hallqvist.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *      This product includes software developed by Niklas Hallqvist.
+ * 4. The name of the author may not be used to endorse or promote products
+ *    derived from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <netinet/in.h>
+#include <arpa/inet.h>
+
+#include <err.h>
+#include <netdb.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+
+#define SOCKS_PORT      "1080"
+#define SOCKS_VERSION   5
+#define SOCKS_NOAUTH    0
+#define SOCKS_NOMETHOD  0xff
+#define SOCKS_CONNECT   1
+#define SOCKS_IPV4      1
+#define SOCKS_MAXCMDSZ  10
+
+static in_addr_t
+decode_addr (const char *s)
+{
+        struct hostent *hp = gethostbyname (s);
+        struct in_addr retval;
+
+        if (hp)
+                return *(in_addr_t *)hp->h_addr_list[0];
+        if (inet_aton (s, &retval))
+                return retval.s_addr;
+        errx (1, "cannot decode address \"%s\"", s);
+}
+
+static in_port_t
+decode_port (const char *s)
+{
+        struct servent *sp;
+        in_port_t port;
+        char *p;
+
+        port = strtol (s, &p, 10);
+        if (s == p) {
+                sp = getservbyname (s, "tcp");
+                if (sp)
+                        return sp->s_port;
+        }
+        if (*s != '\0' && *p == '\0')
+                return htons (port);
+        errx (1, "cannot decode port \"%s\"", s);
+}
+
+int
+socks_connect (char *host, char *port, struct addrinfo hints,
+    char *proxyhost, char *proxyport, struct addrinfo proxyhints)
+{
+        char *proxyport_default;
+        int proxyfd;
+        unsigned char buf[SOCKS_MAXCMDSZ];
+        ssize_t cnt;
+        in_addr_t serveraddr;
+        in_port_t serverport;
+
+        if (proxyport)
+                proxyfd = remote_connect(proxyhost, proxyport, proxyhints);
+        else
+                proxyfd = remote_connect(proxyhost, SOCKS_PORT, proxyhints);
+
+        if (!proxyfd)
+                return -1;
+
+        serveraddr = decode_addr (host);
+        serverport = decode_port (port);
+
+        /* Version 5, one method: no authentication */
+        buf[0] = SOCKS_VERSION;
+        buf[1] = 1;
+        buf[2] = SOCKS_NOAUTH;
+        cnt = write (proxyfd, buf, 3);
+        if (cnt == -1)
+                err (1, "write failed");
+        if (cnt != 3)
+                errx (1, "short write, %d (expected 3)", cnt);
+
+        read (proxyfd, buf, 2);
+        if (buf[1] == SOCKS_NOMETHOD)
+                errx (1, "authentication method negotiation failed");
+
+        /* Version 5, connect: IPv4 address */
+        buf[0] = SOCKS_VERSION;
+        buf[1] = SOCKS_CONNECT;
+        buf[2] = 0;
+        buf[3] = SOCKS_IPV4;
+        memcpy (buf + 4, &serveraddr, sizeof serveraddr);
+        memcpy (buf + 8, &serverport, sizeof serverport);
+
+        /* XXX Handle short writes better */
+        cnt = write (proxyfd, buf, 10);
+        if (cnt == -1)
+                err (1, "write failed");
+        if (cnt != 10)
+                errx (1, "short write, %d (expected 10)", cnt);
+
+        /* XXX Handle short reads better */
+        cnt = read (proxyfd, buf, sizeof buf);
+        if (cnt == -1)
+                err (1, "read failed");
+        if (cnt != 10)
+                errx (1, "unexpected reply size %d (expected 10)", cnt);
+        if (buf[1] != 0)
+                errx (1, "connection failed, SOCKS error %d", buf[1]);
+
+        return proxyfd;
+}