+/*********************************************************************
+ *
+ * Function : translate_socks5_error
+ *
+ * Description : Translates a SOCKS errors to a string.
+ *
+ * Parameters :
+ * 1 : socks_error = The error code to translate.
+ *
+ * Returns : The string translation.
+ *
+ *********************************************************************/
+static const char *translate_socks5_error(int socks_error)
+{
+ switch (socks_error)
+ {
+ /* XXX: these should be more descriptive */
+ case SOCKS5_REQUEST_FAILED:
+ return "SOCKS5 request failed";
+ case SOCKS5_REQUEST_DENIED:
+ return "SOCKS5 request denied";
+ case SOCKS5_REQUEST_NETWORK_UNREACHABLE:
+ return "SOCKS5 network unreachable";
+ case SOCKS5_REQUEST_HOST_UNREACHABLE:
+ return "SOCKS5 destination host unreachable";
+ case SOCKS5_REQUEST_CONNECTION_REFUSED:
+ return "SOCKS5 connection refused";
+ case SOCKS5_REQUEST_TTL_EXPIRED:
+ return "SOCKS5 TTL expired";
+ case SOCKS5_REQUEST_PROTOCOL_ERROR:
+ return "SOCKS5 client protocol error";
+ case SOCKS5_REQUEST_BAD_ADDRESS_TYPE:
+ return "SOCKS5 domain names unsupported";
+ case SOCKS5_REQUEST_GRANTED:
+ return "everything's peachy";
+ default:
+ return "SOCKS5 negotiation protocol error";
+ }
+}
+
+
+/*********************************************************************
+ *
+ * Function : socks5_connect
+ *
+ * Description : Connect to the SOCKS server, and connect through
+ * it to the specified server. This handles
+ * all the SOCKS negotiation, and returns a file
+ * descriptor for a socket which can be treated as a
+ * normal (non-SOCKS) socket.
+ *
+ * Parameters :
+ * 1 : fwd = Specifies the SOCKS proxy to use.
+ * 2 : target_host = The final server to connect to.
+ * 3 : target_port = The final port to connect to.
+ * 4 : csp = Current client state (buffers, headers, etc...)
+ *
+ * Returns : JB_INVALID_SOCKET => failure, else a socket file descriptor.
+ *
+ *********************************************************************/
+static jb_socket socks5_connect(const struct forward_spec *fwd,
+ const char *target_host,
+ int target_port,
+ struct client_state *csp)
+{
+#define SIZE_SOCKS5_REPLY_IPV4 10
+#define SIZE_SOCKS5_REPLY_IPV6 22
+#define SOCKS5_REPLY_DIFFERENCE (SIZE_SOCKS5_REPLY_IPV6 - SIZE_SOCKS5_REPLY_IPV4)
+ int err = 0;
+ char cbuf[300];
+ char sbuf[SIZE_SOCKS5_REPLY_IPV6];
+ size_t client_pos = 0;
+ int server_size = 0;
+ size_t hostlen = 0;
+ jb_socket sfd;
+ const char *errstr = NULL;
+
+ assert(fwd->gateway_host);
+ if ((fwd->gateway_host == NULL) || (*fwd->gateway_host == '\0'))
+ {
+ errstr = "NULL gateway host specified";
+ err = 1;
+ }
+
+ if (fwd->gateway_port <= 0)
+ {
+ /*
+ * XXX: currently this can't happen because in
+ * case of invalid gateway ports we use the defaults.
+ * Of course we really shouldn't do that.
+ */
+ errstr = "invalid gateway port specified";
+ err = 1;
+ }
+
+ hostlen = strlen(target_host);
+ if (hostlen > (size_t)255)
+ {
+ errstr = "target host name is longer than 255 characters";
+ err = 1;
+ }
+
+ if ((fwd->type != SOCKS_5) && (fwd->type != SOCKS_5T))
+ {
+ /* Should never get here */
+ log_error(LOG_LEVEL_FATAL,
+ "SOCKS5 impossible internal error - bad SOCKS type");
+ err = 1;
+ }
+
+ if (err)
+ {
+ errno = EINVAL;
+ assert(errstr != NULL);
+ log_error(LOG_LEVEL_CONNECT, "socks5_connect: %s", errstr);
+ csp->error_message = strdup(errstr);
+ return(JB_INVALID_SOCKET);
+ }
+
+#ifdef FUZZ
+ sfd = 0;
+ if (!err && read_socket(sfd, sbuf, 2) != 2)
+#else
+ /* pass the request to the socks server */
+ sfd = connect_to(fwd->gateway_host, fwd->gateway_port, csp);
+
+ if (sfd == JB_INVALID_SOCKET)
+ {
+ errstr = "socks5 server unreachable";
+ log_error(LOG_LEVEL_CONNECT, "socks5_connect: %s", errstr);
+ /* Free the generic error message provided by connect_to() */
+ freez(csp->error_message);
+ csp->error_message = strdup(errstr);
+ return(JB_INVALID_SOCKET);
+ }
+
+ client_pos = 0;
+ cbuf[client_pos++] = '\x05'; /* Version */
+
+ if (fwd->auth_username && fwd->auth_password)
+ {
+ cbuf[client_pos++] = '\x02'; /* Two authentication methods supported */
+ cbuf[client_pos++] = '\x02'; /* Username/password */
+ }
+ else
+ {
+ cbuf[client_pos++] = '\x01'; /* One authentication method supported */
+ }
+ cbuf[client_pos++] = '\x00'; /* The no authentication authentication method */
+
+ if (write_socket(sfd, cbuf, client_pos))
+ {
+ errstr = "SOCKS5 negotiation write failed";
+ csp->error_message = strdup(errstr);
+ log_error(LOG_LEVEL_CONNECT, "%s", errstr);
+ close_socket(sfd);
+ return(JB_INVALID_SOCKET);
+ }
+ if (!data_is_available(sfd, csp->config->socket_timeout))
+ {
+ if (socket_is_still_alive(sfd))
+ {
+ errstr = "SOCKS5 negotiation timed out";
+ }
+ else
+ {
+ errstr = "SOCKS5 negotiation got aborted by the server";
+ }
+ err = 1;
+ }
+
+ if (!err && read_socket(sfd, sbuf, sizeof(sbuf)) != 2)
+#endif
+ {
+ errstr = "SOCKS5 negotiation read failed";
+ err = 1;
+ }
+
+ if (!err && (sbuf[0] != '\x05'))
+ {
+ errstr = "SOCKS5 negotiation protocol version error";
+ err = 1;
+ }
+
+ if (!err && (sbuf[1] == '\xff'))
+ {
+ errstr = "SOCKS5 authentication required";
+ err = 1;
+ }
+
+ if (!err && (sbuf[1] == '\x02'))
+ {
+ /* check cbuf overflow */
+ size_t auth_len = strlen(fwd->auth_username) + strlen(fwd->auth_password) + 3;
+ if (auth_len > sizeof(cbuf))
+ {
+ errstr = "SOCKS5 username and/or password too long";
+ err = 1;
+ }
+
+ if (!err)
+ {
+ client_pos = 0;
+ cbuf[client_pos++] = '\x01'; /* Version */
+ cbuf[client_pos++] = (char)strlen(fwd->auth_username);
+
+ memcpy(cbuf + client_pos, fwd->auth_username, strlen(fwd->auth_username));
+ client_pos += strlen(fwd->auth_username);
+ cbuf[client_pos++] = (char)strlen(fwd->auth_password);
+ memcpy(cbuf + client_pos, fwd->auth_password, strlen(fwd->auth_password));
+ client_pos += strlen(fwd->auth_password);
+
+ if (write_socket(sfd, cbuf, client_pos))
+ {
+ errstr = "SOCKS5 negotiation auth write failed";
+ csp->error_message = strdup(errstr);
+ log_error(LOG_LEVEL_CONNECT, "%s", errstr);
+ close_socket(sfd);
+ return(JB_INVALID_SOCKET);
+ }
+
+ if (read_socket(sfd, sbuf, sizeof(sbuf)) != 2)
+ {
+ errstr = "SOCKS5 negotiation auth read failed";
+ err = 1;
+ }
+ }
+
+ if (!err && (sbuf[1] != '\x00'))
+ {
+ errstr = "SOCKS5 authentication failed";
+ err = 1;
+ }
+ }
+ else if (!err && (sbuf[1] != '\x00'))
+ {
+ errstr = "SOCKS5 negotiation protocol error";
+ err = 1;
+ }
+
+ if (err)
+ {
+ assert(errstr != NULL);
+ log_error(LOG_LEVEL_CONNECT, "socks5_connect: %s", errstr);
+ csp->error_message = strdup(errstr);
+ close_socket(sfd);
+ errno = EINVAL;
+ return(JB_INVALID_SOCKET);
+ }
+
+ client_pos = 0;
+ cbuf[client_pos++] = '\x05'; /* Version */
+ cbuf[client_pos++] = '\x01'; /* TCP connect */
+ cbuf[client_pos++] = '\x00'; /* Reserved, must be 0x00 */
+ cbuf[client_pos++] = '\x03'; /* Address is domain name */
+ cbuf[client_pos++] = (char)(hostlen & 0xffu);
+ assert(sizeof(cbuf) - client_pos > (size_t)255);
+ /* Using strncpy because we really want the nul byte padding. */
+ strncpy(cbuf + client_pos, target_host, sizeof(cbuf) - client_pos);
+ client_pos += (hostlen & 0xffu);
+ cbuf[client_pos++] = (char)((target_port >> 8) & 0xff);
+ cbuf[client_pos++] = (char)((target_port ) & 0xff);
+
+#ifndef FUZZ
+ if (write_socket(sfd, cbuf, client_pos))
+ {
+ errstr = "SOCKS5 negotiation write failed";
+ csp->error_message = strdup(errstr);
+ log_error(LOG_LEVEL_CONNECT, "%s", errstr);
+ close_socket(sfd);
+ errno = EINVAL;
+ return(JB_INVALID_SOCKET);
+ }
+
+ /*
+ * Optimistically send the HTTP request with the initial
+ * SOCKS request if the user enabled the use of Tor extensions,
+ * the CONNECT method isn't being used (in which case the client
+ * doesn't send data until it gets our 200 response) and the
+ * client request has actually been completely read already.
+ */
+ if ((fwd->type == SOCKS_5T) && (csp->http->ssl == 0)
+ && (csp->flags & CSP_FLAG_CLIENT_REQUEST_COMPLETELY_READ))
+ {
+ char *client_headers = list_to_text(csp->headers);
+ size_t header_length;
+
+ if (client_headers == NULL)
+ {
+ log_error(LOG_LEVEL_FATAL, "Out of memory rebuilding client headers");
+ }
+ list_remove_all(csp->headers);
+ header_length= strlen(client_headers);
+
+ log_error(LOG_LEVEL_CONNECT,
+ "Optimistically sending %lu bytes of client headers intended for %s",
+ header_length, csp->http->hostport);
+
+ if (write_socket(sfd, client_headers, header_length))
+ {
+ log_error(LOG_LEVEL_CONNECT,
+ "optimistically writing header to: %s failed: %E", csp->http->hostport);
+ freez(client_headers);
+ return(JB_INVALID_SOCKET);
+ }
+ freez(client_headers);
+ if (csp->expected_client_content_length != 0)
+ {
+ unsigned long long buffered_request_bytes =
+ (unsigned long long)(csp->client_iob->eod - csp->client_iob->cur);
+ log_error(LOG_LEVEL_CONNECT,
+ "Optimistically sending %llu bytes of client body. Expected %llu",
+ csp->expected_client_content_length, buffered_request_bytes);
+ assert(csp->expected_client_content_length == buffered_request_bytes);
+ if (write_socket(sfd, csp->client_iob->cur, buffered_request_bytes))
+ {
+ log_error(LOG_LEVEL_CONNECT,
+ "optimistically writing %llu bytes of client body to: %s failed: %E",
+ buffered_request_bytes, csp->http->hostport);
+ return(JB_INVALID_SOCKET);
+ }
+ clear_iob(csp->client_iob);
+ }
+ }
+#endif
+
+ server_size = read_socket(sfd, sbuf, SIZE_SOCKS5_REPLY_IPV4);
+ if (server_size != SIZE_SOCKS5_REPLY_IPV4)
+ {
+ errstr = "SOCKS5 negotiation read failed";
+ }
+ else
+ {
+ if (sbuf[0] != '\x05')
+ {
+ errstr = "SOCKS5 negotiation protocol version error";
+ }
+ else if (sbuf[2] != '\x00')
+ {
+ errstr = "SOCKS5 negotiation protocol error";
+ }
+ else if (sbuf[1] != SOCKS5_REQUEST_GRANTED)
+ {
+ errstr = translate_socks5_error(sbuf[1]);
+ }
+ else
+ {
+ if (sbuf[3] == '\x04')
+ {
+ /*
+ * The address field contains an IPv6 address
+ * which means we didn't get the whole reply
+ * yet. Read and discard the rest of it to make
+ * sure it isn't treated as HTTP data later on.
+ */
+ server_size = read_socket(sfd, sbuf, SOCKS5_REPLY_DIFFERENCE);
+ if (server_size != SOCKS5_REPLY_DIFFERENCE)
+ {
+ errstr = "SOCKS5 negotiation read failed (IPv6 address)";
+ }
+ }
+ else if (sbuf[3] != '\x01')
+ {
+ errstr = "SOCKS5 reply contains unsupported address type";
+ }
+ if (errstr == NULL)
+ {
+ return(sfd);
+ }
+ }
+ }
+
+ assert(errstr != NULL);
+ csp->error_message = strdup(errstr);
+ log_error(LOG_LEVEL_CONNECT, "socks5_connect: %s", errstr);
+ close_socket(sfd);
+ errno = EINVAL;
+
+ return(JB_INVALID_SOCKET);
+
+}