X-Git-Url: http://www.privoxy.org/gitweb/?p=privoxy.git;a=blobdiff_plain;f=gateway.c;h=683048ac05435ec09eb6eee4b7d2e17c24ef0f3d;hp=f5d15a56732c3fc6207e1dc0b8ceb75d3e5c555a;hb=ef48c7439a6041aa6148ccac53da507a75a24040;hpb=767afb7f5d7062d75385b9ab3afdad47d0249a39

diff --git a/gateway.c b/gateway.c
index f5d15a56..683048ac 100644
--- a/gateway.c
+++ b/gateway.c
@@ -6,7 +6,7 @@
  *                using a "forwarder" (i.e. HTTP proxy and/or a SOCKS4
  *                or SOCKS5 proxy).
  *
- * Copyright   :  Written by and Copyright (C) 2001-2017 the
+ * Copyright   :  Written by and Copyright (C) 2001-2020 the
  *                Privoxy team. https://www.privoxy.org/
  *
  *                Based on the Internet Junkbuster originally written
@@ -55,10 +55,6 @@
 #include <netdb.h>
 #endif /* def __BEOS__ */
 
-#ifdef __OS2__
-#include <utils.h>
-#endif /* def __OS2__ */
-
 #include "project.h"
 #include "jcc.h"
 #include "errlog.h"
@@ -78,8 +74,8 @@
 #endif /* HAVE_POLL */
 #endif /* def FEATURE_CONNECTION_KEEP_ALIVE */
 
-static jb_socket socks4_connect(const struct forward_spec * fwd,
-                                const char * target_host,
+static jb_socket socks4_connect(const struct forward_spec *fwd,
+                                const char *target_host,
                                 int target_port,
                                 struct client_state *csp);
 
@@ -129,6 +125,9 @@ struct socks_reply {
 static const char socks_userid[] = "anonymous";
 
 #ifdef FEATURE_CONNECTION_SHARING
+#ifndef FEATURE_CONNECTION_KEEP_ALIVE
+#error Using FEATURE_CONNECTION_SHARING without FEATURE_CONNECTION_KEEP_ALIVE is impossible
+#endif
 
 #define MAX_REUSABLE_CONNECTIONS 100
 
@@ -218,6 +217,7 @@ void remember_connection(const struct reusable_connection *connection)
       return;
    }
 
+   assert(slot < SZ(reusable_connection));
    assert(NULL != connection->host);
    reusable_connection[slot].host = strdup_or_die(connection->host);
    reusable_connection[slot].sfd = connection->sfd;
@@ -231,6 +231,8 @@ void remember_connection(const struct reusable_connection *connection)
 
    assert(reusable_connection[slot].gateway_host == NULL);
    assert(reusable_connection[slot].gateway_port == 0);
+   assert(reusable_connection[slot].auth_username == NULL);
+   assert(reusable_connection[slot].auth_password == NULL);
    assert(reusable_connection[slot].forwarder_type == SOCKS_NONE);
    assert(reusable_connection[slot].forward_host == NULL);
    assert(reusable_connection[slot].forward_port == 0);
@@ -245,6 +247,22 @@ void remember_connection(const struct reusable_connection *connection)
       reusable_connection[slot].gateway_host = NULL;
    }
    reusable_connection[slot].gateway_port = connection->gateway_port;
+   if (NULL != connection->auth_username)
+   {
+      reusable_connection[slot].auth_username = strdup_or_die(connection->auth_username);
+   }
+   else
+   {
+      reusable_connection[slot].auth_username = NULL;
+   }
+   if (NULL != connection->auth_password)
+   {
+      reusable_connection[slot].auth_password = strdup_or_die(connection->auth_password);
+   }
+   else
+   {
+      reusable_connection[slot].auth_password = NULL;
+   }
 
    if (NULL != connection->forward_host)
    {
@@ -287,6 +305,8 @@ void mark_connection_closed(struct reusable_connection *closed_connection)
    closed_connection->forwarder_type = SOCKS_NONE;
    freez(closed_connection->gateway_host);
    closed_connection->gateway_port = 0;
+   freez(closed_connection->auth_username);
+   freez(closed_connection->auth_password);
    freez(closed_connection->forward_host);
    closed_connection->forward_port = 0;
 }
@@ -336,6 +356,62 @@ void forget_connection(jb_socket sfd)
 
 
 #ifdef FEATURE_CONNECTION_KEEP_ALIVE
+/*********************************************************************
+ *
+ * Function    :  string_or_none
+ *
+ * Description :  Returns a given string or "none" if a NULL pointer
+ *                is given.
+ *                Helper function for connection_destination_matches().
+ *
+ * Parameters  :
+ *          1  :  string = The string to check.
+ *
+ * Returns     :  The string if non-NULL, "none" otherwise.
+ *
+ *********************************************************************/
+static const char *string_or_none(const char *string)
+{
+   return(string != NULL ? string : "none");
+}
+
+
+/*********************************************************************
+ *
+ * Function    :  connection_detail_matches
+ *
+ * Description :  Helper function for connection_destination_matches().
+ *                Compares strings which can be NULL.
+ *
+ * Parameters  :
+ *          1  :  connection_detail = The connection detail to compare.
+ *          2  :  fowarder_detail = The forwarder detail to compare.
+ *
+ * Returns     :  TRUE for yes, FALSE otherwise.
+ *
+ *********************************************************************/
+static int connection_detail_matches(const char *connection_detail,
+                                     const char *forwarder_detail)
+{
+   if (connection_detail == NULL && forwarder_detail == NULL)
+   {
+      /* Both details are unset. */
+      return TRUE;
+   }
+
+   if ((connection_detail == NULL && forwarder_detail != NULL)
+    || (connection_detail != NULL && forwarder_detail == NULL))
+   {
+      /* Only one detail isn't set. */
+      return FALSE;
+   }
+
+   /* Both details are set, but do they match? */
+   return(!strcmpic(connection_detail, forwarder_detail));
+
+}
+
+
 /*********************************************************************
  *
  * Function    :  connection_destination_matches
@@ -364,25 +440,39 @@ int connection_destination_matches(const struct reusable_connection *connection,
       return FALSE;
    }
 
-   if ((    (NULL != connection->gateway_host)
-         && (NULL != fwd->gateway_host)
-         && strcmpic(connection->gateway_host, fwd->gateway_host))
-       && (connection->gateway_host != fwd->gateway_host))
+   if (!connection_detail_matches(connection->gateway_host, fwd->gateway_host))
    {
       log_error(LOG_LEVEL_CONNECT,
          "Gateway mismatch. Previous gateway: %s. Current gateway: %s",
-         connection->gateway_host, fwd->gateway_host);
+         string_or_none(connection->gateway_host),
+         string_or_none(fwd->gateway_host));
       return FALSE;
    }
 
-   if ((    (NULL != connection->forward_host)
-         && (NULL != fwd->forward_host)
-         && strcmpic(connection->forward_host, fwd->forward_host))
-      && (connection->forward_host != fwd->forward_host))
+   if (!connection_detail_matches(connection->auth_username, fwd->auth_username))
+   {
+      log_error(LOG_LEVEL_CONNECT, "Socks user name mismatch. "
+         "Previous user name: %s. Current user name: %s",
+         string_or_none(connection->auth_username),
+         string_or_none(fwd->auth_username));
+      return FALSE;
+   }
+
+   if (!connection_detail_matches(connection->auth_password, fwd->auth_password))
+   {
+      log_error(LOG_LEVEL_CONNECT, "Socks user name mismatch. "
+         "Previous password: %s. Current password: %s",
+         string_or_none(connection->auth_password),
+         string_or_none(fwd->auth_password));
+      return FALSE;
+   }
+
+   if (!connection_detail_matches(connection->forward_host, fwd->forward_host))
    {
       log_error(LOG_LEVEL_CONNECT,
          "Forwarding proxy mismatch. Previous proxy: %s. Current proxy: %s",
-         connection->forward_host, fwd->forward_host);
+         string_or_none(connection->forward_host),
+         string_or_none(fwd->forward_host));
       return FALSE;
    }
 
@@ -425,7 +515,7 @@ int close_unusable_connections(void)
          {
             log_error(LOG_LEVEL_CONNECT,
                "The connection to %s:%d in slot %d timed out. "
-               "Closing socket %d. Timeout is: %d. Assumed latency: %d.",
+               "Closing socket %d. Timeout is: %d. Assumed latency: %ld.",
                reusable_connection[slot].host,
                reusable_connection[slot].port, slot,
                reusable_connection[slot].sfd,
@@ -493,7 +583,7 @@ static jb_socket get_reusable_connection(const struct http_request *http,
             reusable_connection[slot].in_use = TRUE;
             sfd = reusable_connection[slot].sfd;
             log_error(LOG_LEVEL_CONNECT,
-               "Found reusable socket %d for %s:%d in slot %d. Timestamp made %d "
+               "Found reusable socket %d for %s:%d in slot %d. Timestamp made %ld "
                "seconds ago. Timeout: %d. Latency: %d. Requests served: %d",
                sfd, reusable_connection[slot].host, reusable_connection[slot].port,
                slot, time(NULL) - reusable_connection[slot].timestamp,
@@ -574,11 +664,11 @@ static int mark_connection_unused(const struct reusable_connection *connection)
  * Returns     :  JB_INVALID_SOCKET => failure, else it is the socket file descriptor.
  *
  *********************************************************************/
-jb_socket forwarded_connect(const struct forward_spec * fwd,
+jb_socket forwarded_connect(const struct forward_spec *fwd,
                             struct http_request *http,
                             struct client_state *csp)
 {
-   const char * dest_host;
+   const char *dest_host;
    int dest_port;
    jb_socket sfd = JB_INVALID_SOCKET;
 
@@ -709,8 +799,8 @@ extern jb_err socks_fuzz(struct client_state *csp)
  * Returns     :  JB_INVALID_SOCKET => failure, else a socket file descriptor.
  *
  *********************************************************************/
-static jb_socket socks4_connect(const struct forward_spec * fwd,
-                                const char * target_host,
+static jb_socket socks4_connect(const struct forward_spec *fwd,
+                                const char *target_host,
                                 int target_port,
                                 struct client_state *csp)
 {
@@ -939,6 +1029,53 @@ static const char *translate_socks5_error(int socks_error)
 }
 
 
+/*********************************************************************
+ *
+ * Function    :  convert_ipv4_address_to_bytes
+ *
+ * Description :  Converts an IPv4 address from string to bytes.
+ *
+ * Parameters  :
+ *          1  :  address = The IPv4 address string to convert.
+ *          2  :  buf = The buffer to write the bytes to.
+ *                      Must be at least four bytes long.
+ *
+ * Returns     :  JB_ERR_OK on success, JB_ERR_PARSE otherwise.
+ *
+ *********************************************************************/
+static jb_err convert_ipv4_address_to_bytes(const char *address, char *buf)
+{
+   int i;
+   const char *p = address;
+
+   for (i = 0; i < 4; i++)
+   {
+      unsigned byte;
+      if (1 != sscanf(p, "%u", &byte))
+      {
+         return JB_ERR_PARSE;
+      }
+      if (byte > 255)
+      {
+         return JB_ERR_PARSE;
+      }
+      buf[i] = (char)byte;
+      if (i < 3)
+      {
+         p = strstr(p, ".");
+         if (p == NULL)
+         {
+            return JB_ERR_PARSE;
+         }
+         p++;
+      }
+   }
+
+   return JB_ERR_OK;
+
+}
+
+
 /*********************************************************************
  *
  * Function    :  socks5_connect
@@ -965,10 +1102,11 @@ static jb_socket socks5_connect(const struct forward_spec *fwd,
 {
 #define SIZE_SOCKS5_REPLY_IPV4 10
 #define SIZE_SOCKS5_REPLY_IPV6 22
+#define SIZE_SOCKS5_REPLY_DOMAIN 300
 #define SOCKS5_REPLY_DIFFERENCE (SIZE_SOCKS5_REPLY_IPV6 - SIZE_SOCKS5_REPLY_IPV4)
    int err = 0;
    char cbuf[300];
-   char sbuf[SIZE_SOCKS5_REPLY_IPV6];
+   char sbuf[SIZE_SOCKS5_REPLY_DOMAIN];
    size_t client_pos = 0;
    int server_size = 0;
    size_t hostlen = 0;
@@ -1090,11 +1228,20 @@ static jb_socket socks5_connect(const struct forward_spec *fwd,
 
    if (!err && (sbuf[1] == '\x02'))
    {
-      /* check cbuf overflow */
-      size_t auth_len = strlen(fwd->auth_username) + strlen(fwd->auth_password) + 3;
-      if (auth_len > sizeof(cbuf))
+      if (fwd->auth_username && fwd->auth_password)
+      {
+         /* check cbuf overflow */
+         size_t auth_len = strlen(fwd->auth_username) + strlen(fwd->auth_password) + 3;
+         if (auth_len > sizeof(cbuf))
+         {
+            errstr = "SOCKS5 username and/or password too long";
+            err = 1;
+         }
+      }
+      else
       {
-         errstr = "SOCKS5 username and/or password too long";
+         errstr = "SOCKS5 server requested authentication while "
+            "no credentials are configured";
          err = 1;
       }
 
@@ -1152,12 +1299,32 @@ static jb_socket socks5_connect(const struct forward_spec *fwd,
    cbuf[client_pos++] = '\x05'; /* Version */
    cbuf[client_pos++] = '\x01'; /* TCP connect */
    cbuf[client_pos++] = '\x00'; /* Reserved, must be 0x00 */
-   cbuf[client_pos++] = '\x03'; /* Address is domain name */
-   cbuf[client_pos++] = (char)(hostlen & 0xffu);
-   assert(sizeof(cbuf) - client_pos > (size_t)255);
-   /* Using strncpy because we really want the nul byte padding. */
-   strncpy(cbuf + client_pos, target_host, sizeof(cbuf) - client_pos);
-   client_pos += (hostlen & 0xffu);
+   if (host_is_ip_address(target_host) && NULL == strstr(target_host, ":"))
+   {
+      cbuf[client_pos++] = '\x01'; /* Address is IPv4 address. */
+      if (JB_ERR_OK != convert_ipv4_address_to_bytes(target_host, &cbuf[client_pos]))
+      {
+         errstr = "SOCKS5 error. Failed to convert target address to IP address";
+         csp->error_message = strdup(errstr);
+         log_error(LOG_LEVEL_CONNECT, "%s", errstr);
+         close_socket(sfd);
+         errno = EINVAL;
+         return(JB_INVALID_SOCKET);
+      }
+      client_pos += 4;
+   }
+   else
+   {
+      /*
+       * XXX: This branch is currently also used for IPv6 addresses
+       */
+      cbuf[client_pos++] = '\x03'; /* Address is domain name. */
+      cbuf[client_pos++] = (char)(hostlen & 0xffu);
+      assert(sizeof(cbuf) - client_pos > (size_t)255);
+      /* Using strncpy because we really want the nul byte padding. */
+      strncpy(cbuf + client_pos, target_host, sizeof(cbuf) - client_pos - 1);
+      client_pos += (hostlen & 0xffu);
+   }
    cbuf[client_pos++] = (char)((target_port >> 8) & 0xff);
    cbuf[client_pos++] = (char)((target_port     ) & 0xff);
 
@@ -1193,7 +1360,7 @@ static jb_socket socks5_connect(const struct forward_spec *fwd,
       header_length= strlen(client_headers);
 
       log_error(LOG_LEVEL_CONNECT,
-         "Optimistically sending %d bytes of client headers intended for %s",
+         "Optimistically sending %lu bytes of client headers intended for %s",
          header_length, csp->http->hostport);
 
       if (write_socket(sfd, client_headers, header_length))
@@ -1259,9 +1426,32 @@ static jb_socket socks5_connect(const struct forward_spec *fwd,
                errstr = "SOCKS5 negotiation read failed (IPv6 address)";
             }
          }
+         else if (sbuf[3] == '\x03')
+         {
+            /*
+             * The address field contains a domain name
+             * which means we didn't get the whole reply
+             * yet. Read and discard the rest of it to make
+             * sure it isn't treated as HTTP data later on.
+             */
+            unsigned domain_length = (unsigned)sbuf[4];
+            int bytes_left_to_read = 5 + (int)domain_length + 2 - SIZE_SOCKS5_REPLY_IPV4;
+            if (bytes_left_to_read <= 0 || sizeof(sbuf) < bytes_left_to_read)
+            {
+               errstr = "SOCKS5 negotiation read failed (Invalid domain length)";
+            }
+            else
+            {
+               server_size = read_socket(sfd, sbuf, bytes_left_to_read);
+               if (server_size != bytes_left_to_read)
+               {
+                  errstr = "SOCKS5 negotiation read failed (Domain name)";
+               }
+            }
+         }
          else if (sbuf[3] != '\x01')
          {
-             errstr = "SOCKS5 reply contains unsupported address type";
+            errstr = "SOCKS5 reply contains unsupported address type";
          }
          if (errstr == NULL)
          {