3 files changed, 51 insertions, 17 deletions

diff --git a/src/usr.bin/nc/nc.1 b/src/usr.bin/nc/nc.1
index 76b6dc018e..2ffdcd1ea6 100644
--- a/src/usr.bin/nc/nc.1
+++ b/src/usr.bin/nc/nc.1
@@ -1,4 +1,4 @@
-.\"     $OpenBSD: nc.1,v 1.98 2024/04/01 12:40:18 deraadt Exp $
+.\"     $OpenBSD: nc.1,v 1.101 2025/06/24 13:37:39 tb Exp $
 .\"
 .\" Copyright (c) 1996 David Sacerdote
 .\" All rights reserved.
@@ -25,7 +25,7 @@
 .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.Dd $Mdocdate: April 1 2024 $
+.Dd $Mdocdate: June 24 2025 $
 .Dt NC 1
 .Os
 .Sh NAME
@@ -257,6 +257,10 @@ with the handshake.
 The following TLS options specify a value in the form of a
 .Ar key Ns = Ns Ar value
 pair:
+.Cm alpn ,
+which allows the TLS ALPN to be specified (see
+.Xr tls_config_set_alpn 3
+for further details);
 .Cm ciphers ,
 which allows the supported TLS ciphers to be specified (see
 .Xr tls_config_set_ciphers 3
@@ -338,12 +342,18 @@ when talking to the proxy server.
 Supported protocols are
 .Cm 4
 (SOCKS v.4),
+.Cm 4A
+(SOCKS v.4A),
 .Cm 5
 (SOCKS v.5)
 and
 .Cm connect
 (HTTPS proxy).
 If the protocol is not specified, SOCKS version 5 is used.
+Note that the SOCKS v.4 protocol is very limited and can only be used when
+the destination host can be resolved to an IPv4 address.
+The other protocols pass the destination as a string to be interpreted
+by the remote proxy and do not have this limitation.
 .It Fl x Ar proxy_address Ns Op : Ns Ar port
 Connect to
 .Ar destination
diff --git a/src/usr.bin/nc/netcat.c b/src/usr.bin/nc/netcat.c
index 8c60fd1882..e3c9c939e2 100644
--- a/src/usr.bin/nc/netcat.c
+++ b/src/usr.bin/nc/netcat.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: netcat.c,v 1.229 2024/11/02 17:19:27 tb Exp $ */
+/* $OpenBSD: netcat.c,v 1.234 2025/06/24 13:37:11 tb Exp $ */
 /*
  * Copyright (c) 2001 Eric Jackson <ericj@monkey.org>
  * Copyright (c) 2015 Bob Beck.  All rights reserved.
@@ -108,6 +108,7 @@ char	*tls_expectname;			/* required name in peer cert */
 char    *tls_expecthash;                        /* required hash of peer cert */
 char    *tls_ciphers;                           /* TLS ciphers */
 char    *tls_protocols;                         /* TLS protocols */
+char    *tls_alpn;                              /* TLS ALPN */
 FILE    *Zflag;                                 /* file to save peer cert */
 
 int recvcount, recvlimit;
@@ -190,6 +191,8 @@ main(int argc, char *argv[])
                                 socksv = -1; /* HTTP proxy CONNECT */
                         else if (strcmp(optarg, "4") == 0)
                                 socksv = 4; /* SOCKS v.4 */
+                        else if (strcasecmp(optarg, "4A") == 0)
+                                socksv = 44; /* SOCKS v.4A */
                         else if (strcmp(optarg, "5") == 0)
                                 socksv = 5; /* SOCKS v.5 */
                         else
@@ -532,6 +535,8 @@ main(int argc, char *argv[])
                         errx(1, "%s", tls_config_error(tls_cfg));
                 if (tls_config_set_ciphers(tls_cfg, tls_ciphers) == -1)
                         errx(1, "%s", tls_config_error(tls_cfg));
+                if (tls_alpn != NULL && tls_config_set_alpn(tls_cfg, tls_alpn) == -1)
+                        errx(1, "%s", tls_config_error(tls_cfg));
                 if (!lflag && (TLSopt & TLS_CCERT))
                         errx(1, "clientcert is only valid with -l");
                 if (TLSopt & TLS_NONAME)
@@ -1669,11 +1674,12 @@ process_tls_opt(char *s, int *flags)
                 int              flag;
                 char            **value;
         } *t, tlskeywords[] = {
+                { "alpn",               -1,                     &tls_alpn },
                 { "ciphers",            -1,                     &tls_ciphers },
                 { "clientcert",         TLS_CCERT,              NULL },
                 { "muststaple",         TLS_MUSTSTAPLE,         NULL },
-                { "noverify",           TLS_NOVERIFY,           NULL },
                 { "noname",             TLS_NONAME,             NULL },
+                { "noverify",           TLS_NOVERIFY,           NULL },
                 { "protocols",          -1,                     &tls_protocols },
                 { NULL,                 -1,                     NULL },
         };
@@ -1692,6 +1698,8 @@ process_tls_opt(char *s, int *flags)
                                         errx(1, "invalid tls value `%s'", s);
                                 *t->value = v;
                         } else {
+                                if (v != NULL)
+                                        errx(1, "invalid tls value `%s'", s);
                                 *flags |= t->flag;
                         }
                         return 1;
@@ -1718,7 +1726,7 @@ void
 report_tls(struct tls *tls_ctx, char *host)
 {
         time_t t;
-        const char *ocsp_url;
+        const char *alpn_proto, *ocsp_url;
 
         fprintf(stderr, "TLS handshake negotiated %s/%s with host %s\n",
             tls_conn_version(tls_ctx), tls_conn_cipher(tls_ctx), host);
@@ -1770,6 +1778,8 @@ report_tls(struct tls *tls_ctx, char *host)
                     tls_peer_ocsp_result(tls_ctx));
                 break;
         }
+        if ((alpn_proto = tls_conn_alpn_selected(tls_ctx)) != NULL)
+                fprintf(stderr, "Application Layer Protocol: %s\n", alpn_proto);
 }
 
 void
@@ -1842,7 +1852,7 @@ help(void)
         \t-v            Verbose\n\
         \t-W recvlimit  Terminate after receiving a number of packets\n\
         \t-w timeout    Timeout for connects and final net reads\n\
-        \t-X proto      Proxy protocol: \"4\", \"5\" (SOCKS) or \"connect\"\n\
+        \t-X proto      Proxy protocol: \"4\", \"4A\", \"5\" (SOCKS) or \"connect\"\n\
         \t-x addr[:port]\tSpecify proxy address and port\n\
         \t-Z            Peer certificate file\n\
         \t-z            Zero-I/O mode [used for scanning]\n\
diff --git a/src/usr.bin/nc/socks.c b/src/usr.bin/nc/socks.c
index 7c7448c9c5..1f1fb96e2a 100644
--- a/src/usr.bin/nc/socks.c
+++ b/src/usr.bin/nc/socks.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: socks.c,v 1.31 2022/06/08 20:20:26 djm Exp $  */
+/*      $OpenBSD: socks.c,v 1.34 2025/05/22 06:40:26 djm Exp $  */
 
 /*
  * Copyright (c) 1999 Niklas Hallqvist.  All rights reserved.
@@ -293,19 +293,33 @@ socks_connect(const char *host, const char *port,
                 default:
                         errx(1, "connection failed, unsupported address type");
                 }
-        } else if (socksv == 4) {
-                /* This will exit on lookup failure */
-                decode_addrport(host, port, (struct sockaddr *)&addr,
-                    sizeof(addr), 1, 0);
+        } else if (socksv == 4 || socksv == 44) {
+                if (socksv == 4) {
+                        /* This will exit on lookup failure */
+                        decode_addrport(host, port, (struct sockaddr *)&addr,
+                            sizeof(addr), 1, 0);
+                }
 
                 /* Version 4 */
                 buf[0] = SOCKS_V4;
                 buf[1] = SOCKS_CONNECT; /* connect */
                 memcpy(buf + 2, &in4->sin_port, sizeof in4->sin_port);
-                memcpy(buf + 4, &in4->sin_addr, sizeof in4->sin_addr);
+                if (socksv == 4) {
+                        memcpy(buf + 4, &in4->sin_addr, sizeof in4->sin_addr);
+                } else {
+                        /* SOCKS4A uses addr of 0.0.0.x, and hostname later */
+                        buf[4] = buf[5] = buf[6] = 0;
+                        buf[7] = 1;
+                }
                 buf[8] = 0;     /* empty username */
                 wlen = 9;
-
+                if (socksv == 44) {
+                        /* SOCKS4A has nul-terminated hostname after user */
+                        if (strlcpy(buf + 9, host,
+                            sizeof(buf) - 9) >= sizeof(buf) - 9)
+                                errx(1, "hostname too big");
+                        wlen = 9 + strlen(host) + 1;
+                }
                 cnt = atomicio(vwrite, proxyfd, buf, wlen);
                 if (cnt != wlen)
                         err(1, "write failed (%zu/%zu)", cnt, wlen);
@@ -373,16 +387,16 @@ socks_connect(const char *host, const char *port,
                 /* Read status reply */
                 proxy_read_line(proxyfd, buf, sizeof(buf));
                 if (proxyuser != NULL &&
-                    (strncmp(buf, "HTTP/1.0 407 ", 12) == 0 ||
-                    strncmp(buf, "HTTP/1.1 407 ", 12) == 0)) {
+                    (strncmp(buf, "HTTP/1.0 407 ", 13) == 0 ||
+                    strncmp(buf, "HTTP/1.1 407 ", 13) == 0)) {
                         if (authretry > 1) {
                                 fprintf(stderr, "Proxy authentication "
                                     "failed\n");
                         }
                         close(proxyfd);
                         goto again;
-                } else if (strncmp(buf, "HTTP/1.0 200 ", 12) != 0 &&
-                    strncmp(buf, "HTTP/1.1 200 ", 12) != 0)
+                } else if (strncmp(buf, "HTTP/1.0 200 ", 13) != 0 &&
+                    strncmp(buf, "HTTP/1.1 200 ", 13) != 0)
                         errx(1, "Proxy error: \"%s\"", buf);
 
                 /* Headers continue until we hit an empty line */