Read & Write

Once the connection is established, it is time to transfer data. The readwrite is the core function of netcat, and thankfully, it is well-commented, and refrain you from losing. In this post, I will only cherry-pick code snippets that I think is important.

(1) There is a -d option that if set, your netcat program can not send data inputted from stdin: 

  1. ......
  2. int    dflag;                    /* detached, no stdin */
  4. /* don't read from stdin if requested */
  5. if (dflag)
  6.     stdin_fd = -1;

(2) readwrite uses poll to manage 3 file descriptors: stdin, stdout, and network socket, and monitor whether there is data from stdin or network socket. If there is no need for “high-priority” (e.g., out-of-band) data, POLLIN is enough, otherwise the monitor events should be POLLIN|POLLPRI. This is similar for POLLOUT and POLLWRBAND: 

  1. ......
  2. /* stdin */
  3. pfd[POLL_STDIN].fd = stdin_fd;
  4. pfd[POLL_STDIN].events = POLLIN;
  6. /* network out */
  7. pfd[POLL_NETOUT].fd = net_fd;
  8. pfd[POLL_NETOUT].events = 0;
  10. /* network in */
  11. pfd[POLL_NETIN].fd = net_fd;
  12. pfd[POLL_NETIN].events = POLLIN;
  14. /* stdout */
  15. pfd[POLL_STDOUT].fd = stdout_fd;
  16. pfd[POLL_STDOUT].events = 0;
  17. ......
  19. /* poll */
  20. num_fds = poll(pfd, 4, timeout);
  22. /* treat poll errors */
  23. if (num_fds == -1)
  24.     err(1, "polling error");
  26. /* timeout happened */
  27. if (num_fds == 0)
  28.     return;

There are 3 values(POLLERR, POLLNVAL and POLLHUP) which are only used in struct pollfd‘s revents. If POLLERR or POLLNVAL is detected, it’s not necessary to poll this file descriptor furthermore: 

  1. /* treat socket error conditions */
  2. for (n = 0; n < 4; n++) {
  3.     if (pfd[n].revents & (POLLERR|POLLNVAL)) {
  4.         pfd[n].fd = -1;
  5.     }
  6. }

POLLHUP means the device or network socket has been disconnected, and it is exclusive with POLLOUT, but not input events:POLLIN, POLLRDNORM, POLLRDBAND, and POLLPRI. That’s because the buffer may still has data to be read: 

  1. /* reading is possible after HUP */
  2. if (pfd[POLL_STDIN].events & POLLIN &&
  3.     pfd[POLL_STDIN].revents & POLLHUP &&
  4.     !(pfd[POLL_STDIN].revents & POLLIN))
  5.         pfd[POLL_STDIN].fd = -1;
  6. ......
  7. if (pfd[POLL_NETOUT].revents & POLLHUP) {
  8.     if (Nflag)
  9.         shutdown(pfd[POLL_NETOUT].fd, SHUT_WR);
  10.     pfd[POLL_NETOUT].fd = -1;
  11. }

BTW, the Nflag is set through -N option, which means shutting down the network socket if there is no any input or the network connection is already disconnected: 

  1. int    Nflag;                    /* shutdown() network socket */
  2. ......
  3. /* stdin gone and queue empty? */
  4. if (pfd[POLL_STDIN].fd == -1 && stdinbufpos == 0) {
  5.     if (pfd[POLL_NETOUT].fd != -1 && Nflag)
  6.         shutdown(pfd[POLL_NETOUT].fd, SHUT_WR);
  7.     pfd[POLL_NETOUT].fd = -1;
  8. }

(3) The following code shows how to read from stdin and send data to remote:

  1. ......
  2. #define BUFSIZE        16384
  3. .....
  4. unsigned char stdinbuf[BUFSIZE];
  5. size_t stdinbufpos = 0;
  7. ......
  9. /* try to read from stdin */
  10. if (pfd[POLL_STDIN].revents & POLLIN && stdinbufpos < BUFSIZE) {
  11.     ret = fillbuf(pfd[POLL_STDIN].fd, stdinbuf,
  12.          &stdinbufpos, NULL);
  13.     if (ret == TLS_WANT_POLLIN)
  14.         pfd[POLL_STDIN].events = POLLIN;
  15.     else if (ret == TLS_WANT_POLLOUT)
  16.         pfd[POLL_STDIN].events = POLLOUT;
  17.     else if (ret == 0 || ret == -1)
  18.         pfd[POLL_STDIN].fd = -1;
  19.     /* read something - poll net out */
  20.     if (stdinbufpos > 0)
  21.         pfd[POLL_NETOUT].events = POLLOUT;
  22.     /* filled buffer - remove self from polling */
  23.     if (stdinbufpos == BUFSIZE)
  24.         pfd[POLL_STDIN].events = 0;
  25. }
  26. /* try to write to network */
  27. if (pfd[POLL_NETOUT].revents & POLLOUT && stdinbufpos > 0) {
  28.     ret = drainbuf(pfd[POLL_NETOUT].fd, stdinbuf,
  29.          &stdinbufpos, tls_ctx);
  30.     if (ret == TLS_WANT_POLLIN)
  31.         pfd[POLL_NETOUT].events = POLLIN;
  32.     else if (ret == TLS_WANT_POLLOUT)
  33.         pfd[POLL_NETOUT].events = POLLOUT;
  34.     else if (ret == -1)
  35.         pfd[POLL_NETOUT].fd = -1;
  36.     /* buffer empty - remove self from polling */
  37.     if (stdinbufpos == 0)
  38.         pfd[POLL_NETOUT].events = 0;
  39.     /* buffer no longer full - poll stdin again */
  40.     if (stdinbufpos < BUFSIZE)
  41.         pfd[POLL_STDIN].events = POLLIN;
  42. }

Please ignore all TLS* stuff now. It just means using libtls instead of traditional read/write APIs to receive/send data, and I will cover libtls in future. stdinbufpos denotes the first empty position in buffer, therefore, netcat knows how many bytes could be sent.

fillbuf and drainbuf code is like following:

  1. ssize_t
  2. fillbuf(int fd, unsigned char *buf, size_t *bufpos, struct tls *tls)
  3. {
  4.     size_t num = BUFSIZE - *bufpos;
  5.     ssize_t n;
  7.     if (tls)
  8.         n = tls_read(tls, buf + *bufpos, num);
  9.     else {
  10.         n = read(fd, buf + *bufpos, num);
  11.         /* don't treat EAGAIN, EINTR as error */
  12.         if (n == -1 && (errno == EAGAIN || errno == EINTR))
  13.             n = TLS_WANT_POLLIN;
  14.     }
  15.     if (n <= 0)
  16.         return n;
  17.     *bufpos += n;
  18.     return n;
  19. }
  21. ssize_t
  22. drainbuf(int fd, unsigned char *buf, size_t *bufpos, struct tls *tls)
  23. {
  24.     ssize_t n;
  25.     ssize_t adjust;
  27.     if (tls)
  28.         n = tls_write(tls, buf, *bufpos);
  29.     else {
  30.         n = write(fd, buf, *bufpos);
  31.         /* don't treat EAGAIN, EINTR as error */
  32.         if (n == -1 && (errno == EAGAIN || errno == EINTR))
  33.             n = TLS_WANT_POLLOUT;
  34.     }
  35.     if (n <= 0)
  36.         return n;
  37.     /* adjust buffer */
  38.     adjust = *bufpos - n;
  39.     if (adjust > 0)
  40.         memmove(buf, buf + n, adjust);
  41.     *bufpos -= n;
  42.     return n;
  43. }

You should get 2 takeaways from preceding code:
a) EAGAIN and EINTR are not considered as real errors;
b) Don’t forget to adjust bufpos and buf, i.e., stdinbufpos and stdinbuf accordingly.

As for reading data from network socket and outputting it to stdout flow, it is very similar, so there is no need to say more here.

(4) There is a -W recvlimit option which specifies after receiving how many packets, the program should terminate: 

  1. ......
  2. int recvcount, recvlimit;
  3. ......
  4. /* try to read from network */
  5. if (pfd[POLL_NETIN].revents & POLLIN && netinbufpos < BUFSIZE) {
  6.     ......
  7.     if (recvlimit > 0 && ++recvcount >= recvlimit) {
  8.         if (pfd[POLL_NETIN].fd != -1)
  9.             shutdown(pfd[POLL_NETIN].fd, SHUT_RD);
  10.         pfd[POLL_NETIN].fd = -1;
  11.         pfd[POLL_STDIN].fd = -1;
  12.     }
  13.     ......
  14. }