proto_socks.c 25 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711
  1. /* Copyright (c) 2001 Matej Pfajfar.
  2. * Copyright (c) 2001-2004, Roger Dingledine.
  3. * Copyright (c) 2004-2006, Roger Dingledine, Nick Mathewson.
  4. * Copyright (c) 2007-2017, The Tor Project, Inc. */
  5. /* See LICENSE for licensing information */
  6. #include "or.h"
  7. #include "addressmap.h"
  8. #include "buffers.h"
  9. #include "control.h"
  10. #include "config.h"
  11. #include "crypto_util.h"
  12. #include "ext_orport.h"
  13. #include "proto_socks.h"
  14. #include "reasons.h"
  15. static void socks_request_set_socks5_error(socks_request_t *req,
  16. socks5_reply_status_t reason);
  17. static int parse_socks(const char *data, size_t datalen, socks_request_t *req,
  18. int log_sockstype, int safe_socks, ssize_t *drain_out,
  19. size_t *want_length_out);
  20. static int parse_socks_client(const uint8_t *data, size_t datalen,
  21. int state, char **reason,
  22. ssize_t *drain_out);
  23. /**
  24. * Wait this many seconds before warning the user about using SOCKS unsafely
  25. * again. */
  26. #define SOCKS_WARN_INTERVAL 5
  27. /** Warn that the user application has made an unsafe socks request using
  28. * protocol <b>socks_protocol</b> on port <b>port</b>. Don't warn more than
  29. * once per SOCKS_WARN_INTERVAL, unless <b>safe_socks</b> is set. */
  30. static void
  31. log_unsafe_socks_warning(int socks_protocol, const char *address,
  32. uint16_t port, int safe_socks)
  33. {
  34. static ratelim_t socks_ratelim = RATELIM_INIT(SOCKS_WARN_INTERVAL);
  35. if (safe_socks) {
  36. log_fn_ratelim(&socks_ratelim, LOG_WARN, LD_APP,
  37. "Your application (using socks%d to port %d) is giving "
  38. "Tor only an IP address. Applications that do DNS resolves "
  39. "themselves may leak information. Consider using Socks4A "
  40. "(e.g. via privoxy or socat) instead. For more information, "
  41. "please see https://wiki.torproject.org/TheOnionRouter/"
  42. "TorFAQ#SOCKSAndDNS.%s",
  43. socks_protocol,
  44. (int)port,
  45. safe_socks ? " Rejecting." : "");
  46. }
  47. control_event_client_status(LOG_WARN,
  48. "DANGEROUS_SOCKS PROTOCOL=SOCKS%d ADDRESS=%s:%d",
  49. socks_protocol, address, (int)port);
  50. }
  51. /** Do not attempt to parse socks messages longer than this. This value is
  52. * actually significantly higher than the longest possible socks message. */
  53. #define MAX_SOCKS_MESSAGE_LEN 512
  54. /** Return a new socks_request_t. */
  55. socks_request_t *
  56. socks_request_new(void)
  57. {
  58. return tor_malloc_zero(sizeof(socks_request_t));
  59. }
  60. /** Free all storage held in the socks_request_t <b>req</b>. */
  61. void
  62. socks_request_free_(socks_request_t *req)
  63. {
  64. if (!req)
  65. return;
  66. if (req->username) {
  67. memwipe(req->username, 0x10, req->usernamelen);
  68. tor_free(req->username);
  69. }
  70. if (req->password) {
  71. memwipe(req->password, 0x04, req->passwordlen);
  72. tor_free(req->password);
  73. }
  74. memwipe(req, 0xCC, sizeof(socks_request_t));
  75. tor_free(req);
  76. }
  77. /** There is a (possibly incomplete) socks handshake on <b>buf</b>, of one
  78. * of the forms
  79. * - socks4: "socksheader username\\0"
  80. * - socks4a: "socksheader username\\0 destaddr\\0"
  81. * - socks5 phase one: "version #methods methods"
  82. * - socks5 phase two: "version command 0 addresstype..."
  83. * If it's a complete and valid handshake, and destaddr fits in
  84. * MAX_SOCKS_ADDR_LEN bytes, then pull the handshake off the buf,
  85. * assign to <b>req</b>, and return 1.
  86. *
  87. * If it's invalid or too big, return -1.
  88. *
  89. * Else it's not all there yet, leave buf alone and return 0.
  90. *
  91. * If you want to specify the socks reply, write it into <b>req->reply</b>
  92. * and set <b>req->replylen</b>, else leave <b>req->replylen</b> alone.
  93. *
  94. * If <b>log_sockstype</b> is non-zero, then do a notice-level log of whether
  95. * the connection is possibly leaking DNS requests locally or not.
  96. *
  97. * If <b>safe_socks</b> is true, then reject unsafe socks protocols.
  98. *
  99. * If returning 0 or -1, <b>req->address</b> and <b>req->port</b> are
  100. * undefined.
  101. */
  102. int
  103. fetch_from_buf_socks(buf_t *buf, socks_request_t *req,
  104. int log_sockstype, int safe_socks)
  105. {
  106. int res;
  107. ssize_t n_drain;
  108. size_t want_length = 128;
  109. const char *head = NULL;
  110. size_t datalen = 0;
  111. if (buf_datalen(buf) < 2) /* version and another byte */
  112. return 0;
  113. do {
  114. n_drain = 0;
  115. buf_pullup(buf, want_length, &head, &datalen);
  116. tor_assert(head && datalen >= 2);
  117. want_length = 0;
  118. res = parse_socks(head, datalen, req, log_sockstype,
  119. safe_socks, &n_drain, &want_length);
  120. if (n_drain < 0)
  121. buf_clear(buf);
  122. else if (n_drain > 0)
  123. buf_drain(buf, n_drain);
  124. } while (res == 0 && head && want_length < buf_datalen(buf) &&
  125. buf_datalen(buf) >= 2);
  126. return res;
  127. }
  128. /** Create a SOCKS5 reply message with <b>reason</b> in its REP field and
  129. * have Tor send it as error response to <b>req</b>.
  130. */
  131. static void
  132. socks_request_set_socks5_error(socks_request_t *req,
  133. socks5_reply_status_t reason)
  134. {
  135. req->replylen = 10;
  136. memset(req->reply,0,10);
  137. req->reply[0] = 0x05; // VER field.
  138. req->reply[1] = reason; // REP field.
  139. req->reply[3] = 0x01; // ATYP field.
  140. }
  141. static const char SOCKS_PROXY_IS_NOT_AN_HTTP_PROXY_MSG[] =
  142. "HTTP/1.0 501 Tor is not an HTTP Proxy\r\n"
  143. "Content-Type: text/html; charset=iso-8859-1\r\n\r\n"
  144. "<html>\n"
  145. "<head>\n"
  146. "<title>This is a SOCKS Proxy, Not An HTTP Proxy</title>\n"
  147. "</head>\n"
  148. "<body>\n"
  149. "<h1>This is a SOCKs proxy, not an HTTP proxy.</h1>\n"
  150. "<p>\n"
  151. "It appears you have configured your web browser to use this Tor port as\n"
  152. "an HTTP proxy.\n"
  153. "</p><p>\n"
  154. "This is not correct: This port is configured as a SOCKS proxy, not\n"
  155. "an HTTP proxy. If you need an HTTP proxy tunnel, use the HTTPTunnelPort\n"
  156. "configuration option in place of, or in addition to, SOCKSPort.\n"
  157. "Please configure your client accordingly.\n"
  158. "</p>\n"
  159. "<p>\n"
  160. "See <a href=\"https://www.torproject.org/documentation.html\">"
  161. "https://www.torproject.org/documentation.html</a> for more "
  162. "information.\n"
  163. "</p>\n"
  164. "</body>\n"
  165. "</html>\n";
  166. /** Implementation helper to implement fetch_from_*_socks. Instead of looking
  167. * at a buffer's contents, we look at the <b>datalen</b> bytes of data in
  168. * <b>data</b>. Instead of removing data from the buffer, we set
  169. * <b>drain_out</b> to the amount of data that should be removed (or -1 if the
  170. * buffer should be cleared). Instead of pulling more data into the first
  171. * chunk of the buffer, we set *<b>want_length_out</b> to the number of bytes
  172. * we'd like to see in the input buffer, if they're available. */
  173. static int
  174. parse_socks(const char *data, size_t datalen, socks_request_t *req,
  175. int log_sockstype, int safe_socks, ssize_t *drain_out,
  176. size_t *want_length_out)
  177. {
  178. unsigned int len;
  179. char tmpbuf[TOR_ADDR_BUF_LEN+1];
  180. tor_addr_t destaddr;
  181. uint32_t destip;
  182. uint8_t socksver;
  183. char *next, *startaddr;
  184. unsigned char usernamelen, passlen;
  185. struct in_addr in;
  186. if (datalen < 2) {
  187. /* We always need at least 2 bytes. */
  188. *want_length_out = 2;
  189. return 0;
  190. }
  191. if (req->socks_version == 5 && !req->got_auth) {
  192. /* See if we have received authentication. Strictly speaking, we should
  193. also check whether we actually negotiated username/password
  194. authentication. But some broken clients will send us authentication
  195. even if we negotiated SOCKS_NO_AUTH. */
  196. if (*data == 1) { /* username/pass version 1 */
  197. /* Format is: authversion [1 byte] == 1
  198. usernamelen [1 byte]
  199. username [usernamelen bytes]
  200. passlen [1 byte]
  201. password [passlen bytes] */
  202. usernamelen = (unsigned char)*(data + 1);
  203. if (datalen < 2u + usernamelen + 1u) {
  204. *want_length_out = 2u + usernamelen + 1u;
  205. return 0;
  206. }
  207. passlen = (unsigned char)*(data + 2u + usernamelen);
  208. if (datalen < 2u + usernamelen + 1u + passlen) {
  209. *want_length_out = 2u + usernamelen + 1u + passlen;
  210. return 0;
  211. }
  212. req->replylen = 2; /* 2 bytes of response */
  213. req->reply[0] = 1; /* authversion == 1 */
  214. req->reply[1] = 0; /* authentication successful */
  215. log_debug(LD_APP,
  216. "socks5: Accepted username/password without checking.");
  217. if (usernamelen) {
  218. req->username = tor_memdup(data+2u, usernamelen);
  219. req->usernamelen = usernamelen;
  220. }
  221. if (passlen) {
  222. req->password = tor_memdup(data+3u+usernamelen, passlen);
  223. req->passwordlen = passlen;
  224. }
  225. *drain_out = 2u + usernamelen + 1u + passlen;
  226. req->got_auth = 1;
  227. *want_length_out = 7; /* Minimal socks5 command. */
  228. return 0;
  229. } else if (req->auth_type == SOCKS_USER_PASS) {
  230. /* unknown version byte */
  231. log_warn(LD_APP, "Socks5 username/password version %d not recognized; "
  232. "rejecting.", (int)*data);
  233. return -1;
  234. }
  235. }
  236. socksver = *data;
  237. switch (socksver) { /* which version of socks? */
  238. case 5: /* socks5 */
  239. if (req->socks_version != 5) { /* we need to negotiate a method */
  240. unsigned char nummethods = (unsigned char)*(data+1);
  241. int have_user_pass, have_no_auth;
  242. int r=0;
  243. tor_assert(!req->socks_version);
  244. if (datalen < 2u+nummethods) {
  245. *want_length_out = 2u+nummethods;
  246. return 0;
  247. }
  248. if (!nummethods)
  249. return -1;
  250. req->replylen = 2; /* 2 bytes of response */
  251. req->reply[0] = 5; /* socks5 reply */
  252. have_user_pass = (memchr(data+2, SOCKS_USER_PASS, nummethods) !=NULL);
  253. have_no_auth = (memchr(data+2, SOCKS_NO_AUTH, nummethods) !=NULL);
  254. if (have_user_pass && !(have_no_auth && req->socks_prefer_no_auth)) {
  255. req->auth_type = SOCKS_USER_PASS;
  256. req->reply[1] = SOCKS_USER_PASS; /* tell client to use "user/pass"
  257. auth method */
  258. req->socks_version = 5; /* remember we've already negotiated auth */
  259. log_debug(LD_APP,"socks5: accepted method 2 (username/password)");
  260. r=0;
  261. } else if (have_no_auth) {
  262. req->reply[1] = SOCKS_NO_AUTH; /* tell client to use "none" auth
  263. method */
  264. req->socks_version = 5; /* remember we've already negotiated auth */
  265. log_debug(LD_APP,"socks5: accepted method 0 (no authentication)");
  266. r=0;
  267. } else {
  268. log_warn(LD_APP,
  269. "socks5: offered methods don't include 'no auth' or "
  270. "username/password. Rejecting.");
  271. req->reply[1] = '\xFF'; /* reject all methods */
  272. r=-1;
  273. }
  274. /* Remove packet from buf. Some SOCKS clients will have sent extra
  275. * junk at this point; let's hope it's an authentication message. */
  276. *drain_out = 2u + nummethods;
  277. return r;
  278. }
  279. if (req->auth_type != SOCKS_NO_AUTH && !req->got_auth) {
  280. log_warn(LD_APP,
  281. "socks5: negotiated authentication, but none provided");
  282. return -1;
  283. }
  284. /* we know the method; read in the request */
  285. log_debug(LD_APP,"socks5: checking request");
  286. if (datalen < 7) {/* basic info plus >=1 for addr plus 2 for port */
  287. *want_length_out = 7;
  288. return 0; /* not yet */
  289. }
  290. req->command = (unsigned char) *(data+1);
  291. if (req->command != SOCKS_COMMAND_CONNECT &&
  292. req->command != SOCKS_COMMAND_RESOLVE &&
  293. req->command != SOCKS_COMMAND_RESOLVE_PTR) {
  294. /* not a connect or resolve or a resolve_ptr? we don't support it. */
  295. socks_request_set_socks5_error(req,SOCKS5_COMMAND_NOT_SUPPORTED);
  296. log_warn(LD_APP,"socks5: command %d not recognized. Rejecting.",
  297. req->command);
  298. return -1;
  299. }
  300. switch (*(data+3)) { /* address type */
  301. case 1: /* IPv4 address */
  302. case 4: /* IPv6 address */ {
  303. const int is_v6 = *(data+3) == 4;
  304. const unsigned addrlen = is_v6 ? 16 : 4;
  305. log_debug(LD_APP,"socks5: ipv4 address type");
  306. if (datalen < 6+addrlen) {/* ip/port there? */
  307. *want_length_out = 6+addrlen;
  308. return 0; /* not yet */
  309. }
  310. if (is_v6)
  311. tor_addr_from_ipv6_bytes(&destaddr, data+4);
  312. else
  313. tor_addr_from_ipv4n(&destaddr, get_uint32(data+4));
  314. tor_addr_to_str(tmpbuf, &destaddr, sizeof(tmpbuf), 1);
  315. if (BUG(strlen(tmpbuf)+1 > MAX_SOCKS_ADDR_LEN)) {
  316. /* LCOV_EXCL_START -- This branch is unreachable, given the
  317. * size of tmpbuf and the actual value of MAX_SOCKS_ADDR_LEN */
  318. socks_request_set_socks5_error(req, SOCKS5_GENERAL_ERROR);
  319. log_warn(LD_APP,
  320. "socks5 IP takes %d bytes, which doesn't fit in %d. "
  321. "Rejecting.",
  322. (int)strlen(tmpbuf)+1,(int)MAX_SOCKS_ADDR_LEN);
  323. return -1;
  324. /* LCOV_EXCL_STOP */
  325. }
  326. strlcpy(req->address,tmpbuf,sizeof(req->address));
  327. req->port = ntohs(get_uint16(data+4+addrlen));
  328. *drain_out = 6+addrlen;
  329. if (req->command != SOCKS_COMMAND_RESOLVE_PTR &&
  330. !addressmap_have_mapping(req->address,0)) {
  331. log_unsafe_socks_warning(5, req->address, req->port, safe_socks);
  332. if (safe_socks) {
  333. socks_request_set_socks5_error(req, SOCKS5_NOT_ALLOWED);
  334. return -1;
  335. }
  336. }
  337. return 1;
  338. }
  339. case 3: /* fqdn */
  340. log_debug(LD_APP,"socks5: fqdn address type");
  341. if (req->command == SOCKS_COMMAND_RESOLVE_PTR) {
  342. socks_request_set_socks5_error(req,
  343. SOCKS5_ADDRESS_TYPE_NOT_SUPPORTED);
  344. log_warn(LD_APP, "socks5 received RESOLVE_PTR command with "
  345. "hostname type. Rejecting.");
  346. return -1;
  347. }
  348. len = (unsigned char)*(data+4);
  349. if (datalen < 7+len) { /* addr/port there? */
  350. *want_length_out = 7+len;
  351. return 0; /* not yet */
  352. }
  353. if (BUG(len+1 > MAX_SOCKS_ADDR_LEN)) {
  354. /* LCOV_EXCL_START -- unreachable, since len is at most 255,
  355. * and MAX_SOCKS_ADDR_LEN is 256. */
  356. socks_request_set_socks5_error(req, SOCKS5_GENERAL_ERROR);
  357. log_warn(LD_APP,
  358. "socks5 hostname is %d bytes, which doesn't fit in "
  359. "%d. Rejecting.", len+1,MAX_SOCKS_ADDR_LEN);
  360. return -1;
  361. /* LCOV_EXCL_STOP */
  362. }
  363. memcpy(req->address,data+5,len);
  364. req->address[len] = 0;
  365. req->port = ntohs(get_uint16(data+5+len));
  366. *drain_out = 5+len+2;
  367. if (!string_is_valid_dest(req->address)) {
  368. socks_request_set_socks5_error(req, SOCKS5_GENERAL_ERROR);
  369. log_warn(LD_PROTOCOL,
  370. "Your application (using socks5 to port %d) gave Tor "
  371. "a malformed hostname: %s. Rejecting the connection.",
  372. req->port, escaped_safe_str_client(req->address));
  373. return -1;
  374. }
  375. if (log_sockstype)
  376. log_notice(LD_APP,
  377. "Your application (using socks5 to port %d) instructed "
  378. "Tor to take care of the DNS resolution itself if "
  379. "necessary. This is good.", req->port);
  380. return 1;
  381. default: /* unsupported */
  382. socks_request_set_socks5_error(req,
  383. SOCKS5_ADDRESS_TYPE_NOT_SUPPORTED);
  384. log_warn(LD_APP,"socks5: unsupported address type %d. Rejecting.",
  385. (int) *(data+3));
  386. return -1;
  387. }
  388. tor_assert(0);
  389. break;
  390. case 4: { /* socks4 */
  391. enum {socks4, socks4a} socks4_prot = socks4a;
  392. const char *authstart, *authend;
  393. /* http://ss5.sourceforge.net/socks4.protocol.txt */
  394. /* http://ss5.sourceforge.net/socks4A.protocol.txt */
  395. req->socks_version = 4;
  396. if (datalen < SOCKS4_NETWORK_LEN) {/* basic info available? */
  397. *want_length_out = SOCKS4_NETWORK_LEN;
  398. return 0; /* not yet */
  399. }
  400. // buf_pullup(buf, 1280);
  401. req->command = (unsigned char) *(data+1);
  402. if (req->command != SOCKS_COMMAND_CONNECT &&
  403. req->command != SOCKS_COMMAND_RESOLVE) {
  404. /* not a connect or resolve? we don't support it. (No resolve_ptr with
  405. * socks4.) */
  406. log_warn(LD_APP,"socks4: command %d not recognized. Rejecting.",
  407. req->command);
  408. return -1;
  409. }
  410. req->port = ntohs(get_uint16(data+2));
  411. destip = ntohl(get_uint32(data+4));
  412. if ((!req->port && req->command!=SOCKS_COMMAND_RESOLVE) || !destip) {
  413. log_warn(LD_APP,"socks4: Port or DestIP is zero. Rejecting.");
  414. return -1;
  415. }
  416. if (destip >> 8) {
  417. log_debug(LD_APP,"socks4: destip not in form 0.0.0.x.");
  418. in.s_addr = htonl(destip);
  419. tor_inet_ntoa(&in,tmpbuf,sizeof(tmpbuf));
  420. if (BUG(strlen(tmpbuf)+1 > MAX_SOCKS_ADDR_LEN)) {
  421. /* LCOV_EXCL_START -- This branch is unreachable, given the
  422. * size of tmpbuf and the actual value of MAX_SOCKS_ADDR_LEN */
  423. log_debug(LD_APP,"socks4 addr (%d bytes) too long. Rejecting.",
  424. (int)strlen(tmpbuf));
  425. return -1;
  426. /* LCOV_EXCL_STOP */
  427. }
  428. log_debug(LD_APP,
  429. "socks4: successfully read destip (%s)",
  430. safe_str_client(tmpbuf));
  431. socks4_prot = socks4;
  432. }
  433. authstart = data + SOCKS4_NETWORK_LEN;
  434. next = memchr(authstart, 0,
  435. datalen-SOCKS4_NETWORK_LEN);
  436. if (!next) {
  437. if (datalen >= 1024) {
  438. log_debug(LD_APP, "Socks4 user name too long; rejecting.");
  439. return -1;
  440. }
  441. log_debug(LD_APP,"socks4: Username not here yet.");
  442. *want_length_out = datalen+1024; /* More than we need, but safe */
  443. return 0;
  444. }
  445. authend = next;
  446. tor_assert(next < data+datalen);
  447. startaddr = NULL;
  448. if (socks4_prot != socks4a &&
  449. !addressmap_have_mapping(tmpbuf,0)) {
  450. log_unsafe_socks_warning(4, tmpbuf, req->port, safe_socks);
  451. if (safe_socks)
  452. return -1;
  453. }
  454. if (socks4_prot == socks4a) {
  455. if (next+1 == data+datalen) {
  456. log_debug(LD_APP,"socks4: No part of destaddr here yet.");
  457. *want_length_out = datalen + 1024; /* More than we need, but safe */
  458. return 0;
  459. }
  460. startaddr = next+1;
  461. next = memchr(startaddr, 0, data + datalen - startaddr);
  462. if (!next) {
  463. if (datalen >= 1024) {
  464. log_debug(LD_APP,"socks4: Destaddr too long.");
  465. return -1;
  466. }
  467. log_debug(LD_APP,"socks4: Destaddr not all here yet.");
  468. *want_length_out = datalen + 1024; /* More than we need, but safe */
  469. return 0;
  470. }
  471. if (MAX_SOCKS_ADDR_LEN <= next-startaddr) {
  472. log_warn(LD_APP,"socks4: Destaddr too long. Rejecting.");
  473. return -1;
  474. }
  475. // tor_assert(next < buf->cur+buf_datalen(buf));
  476. if (log_sockstype)
  477. log_notice(LD_APP,
  478. "Your application (using socks4a to port %d) instructed "
  479. "Tor to take care of the DNS resolution itself if "
  480. "necessary. This is good.", req->port);
  481. }
  482. log_debug(LD_APP,"socks4: Everything is here. Success.");
  483. strlcpy(req->address, startaddr ? startaddr : tmpbuf,
  484. sizeof(req->address));
  485. if (!string_is_valid_dest(req->address)) {
  486. log_warn(LD_PROTOCOL,
  487. "Your application (using socks4 to port %d) gave Tor "
  488. "a malformed hostname: %s. Rejecting the connection.",
  489. req->port, escaped_safe_str_client(req->address));
  490. return -1;
  491. }
  492. if (authend != authstart) {
  493. req->got_auth = 1;
  494. req->usernamelen = authend - authstart;
  495. req->username = tor_memdup(authstart, authend - authstart);
  496. }
  497. /* next points to the final \0 on inbuf */
  498. *drain_out = next - data + 1;
  499. return 1;
  500. }
  501. case 'G': /* get */
  502. case 'H': /* head */
  503. case 'P': /* put/post */
  504. case 'C': /* connect */
  505. strlcpy((char*)req->reply, SOCKS_PROXY_IS_NOT_AN_HTTP_PROXY_MSG,
  506. MAX_SOCKS_REPLY_LEN);
  507. req->replylen = strlen((char*)req->reply)+1;
  508. /* fall through */
  509. default: /* version is not socks4 or socks5 */
  510. log_warn(LD_APP,
  511. "Socks version %d not recognized. (This port is not an "
  512. "HTTP proxy; did you want to use HTTPTunnelPort?)",
  513. *(data));
  514. {
  515. /* Tell the controller the first 8 bytes. */
  516. char *tmp = tor_strndup(data, datalen < 8 ? datalen : 8);
  517. control_event_client_status(LOG_WARN,
  518. "SOCKS_UNKNOWN_PROTOCOL DATA=\"%s\"",
  519. escaped(tmp));
  520. tor_free(tmp);
  521. }
  522. return -1;
  523. }
  524. }
  525. /** Inspect a reply from SOCKS server stored in <b>buf</b> according
  526. * to <b>state</b>, removing the protocol data upon success. Return 0 on
  527. * incomplete response, 1 on success and -1 on error, in which case
  528. * <b>reason</b> is set to a descriptive message (free() when finished
  529. * with it).
  530. *
  531. * As a special case, 2 is returned when user/pass is required
  532. * during SOCKS5 handshake and user/pass is configured.
  533. */
  534. int
  535. fetch_from_buf_socks_client(buf_t *buf, int state, char **reason)
  536. {
  537. ssize_t drain = 0;
  538. int r;
  539. const char *head = NULL;
  540. size_t datalen = 0;
  541. if (buf_datalen(buf) < 2)
  542. return 0;
  543. buf_pullup(buf, MAX_SOCKS_MESSAGE_LEN, &head, &datalen);
  544. tor_assert(head && datalen >= 2);
  545. r = parse_socks_client((uint8_t*)head, datalen,
  546. state, reason, &drain);
  547. if (drain > 0)
  548. buf_drain(buf, drain);
  549. else if (drain < 0)
  550. buf_clear(buf);
  551. return r;
  552. }
  553. /** Implementation logic for fetch_from_*_socks_client. */
  554. static int
  555. parse_socks_client(const uint8_t *data, size_t datalen,
  556. int state, char **reason,
  557. ssize_t *drain_out)
  558. {
  559. unsigned int addrlen;
  560. *drain_out = 0;
  561. if (datalen < 2)
  562. return 0;
  563. switch (state) {
  564. case PROXY_SOCKS4_WANT_CONNECT_OK:
  565. /* Wait for the complete response */
  566. if (datalen < 8)
  567. return 0;
  568. if (data[1] != 0x5a) {
  569. *reason = tor_strdup(socks4_response_code_to_string(data[1]));
  570. return -1;
  571. }
  572. /* Success */
  573. *drain_out = 8;
  574. return 1;
  575. case PROXY_SOCKS5_WANT_AUTH_METHOD_NONE:
  576. /* we don't have any credentials */
  577. if (data[1] != 0x00) {
  578. *reason = tor_strdup("server doesn't support any of our "
  579. "available authentication methods");
  580. return -1;
  581. }
  582. log_info(LD_NET, "SOCKS 5 client: continuing without authentication");
  583. *drain_out = -1;
  584. return 1;
  585. case PROXY_SOCKS5_WANT_AUTH_METHOD_RFC1929:
  586. /* we have a username and password. return 1 if we can proceed without
  587. * providing authentication, or 2 otherwise. */
  588. switch (data[1]) {
  589. case 0x00:
  590. log_info(LD_NET, "SOCKS 5 client: we have auth details but server "
  591. "doesn't require authentication.");
  592. *drain_out = -1;
  593. return 1;
  594. case 0x02:
  595. log_info(LD_NET, "SOCKS 5 client: need authentication.");
  596. *drain_out = -1;
  597. return 2;
  598. /* fall through */
  599. }
  600. *reason = tor_strdup("server doesn't support any of our available "
  601. "authentication methods");
  602. return -1;
  603. case PROXY_SOCKS5_WANT_AUTH_RFC1929_OK:
  604. /* handle server reply to rfc1929 authentication */
  605. if (data[1] != 0x00) {
  606. *reason = tor_strdup("authentication failed");
  607. return -1;
  608. }
  609. log_info(LD_NET, "SOCKS 5 client: authentication successful.");
  610. *drain_out = -1;
  611. return 1;
  612. case PROXY_SOCKS5_WANT_CONNECT_OK:
  613. /* response is variable length. BND.ADDR, etc, isn't needed
  614. * (don't bother with buf_pullup()), but make sure to eat all
  615. * the data used */
  616. /* wait for address type field to arrive */
  617. if (datalen < 4)
  618. return 0;
  619. switch (data[3]) {
  620. case 0x01: /* ip4 */
  621. addrlen = 4;
  622. break;
  623. case 0x04: /* ip6 */
  624. addrlen = 16;
  625. break;
  626. case 0x03: /* fqdn (can this happen here?) */
  627. if (datalen < 5)
  628. return 0;
  629. addrlen = 1 + data[4];
  630. break;
  631. default:
  632. *reason = tor_strdup("invalid response to connect request");
  633. return -1;
  634. }
  635. /* wait for address and port */
  636. if (datalen < 6 + addrlen)
  637. return 0;
  638. if (data[1] != 0x00) {
  639. *reason = tor_strdup(socks5_response_code_to_string(data[1]));
  640. return -1;
  641. }
  642. *drain_out = 6 + addrlen;
  643. return 1;
  644. }
  645. /* LCOV_EXCL_START */
  646. /* shouldn't get here if the input state is one we know about... */
  647. tor_assert(0);
  648. return -1;
  649. /* LCOV_EXCL_STOP */
  650. }