0", 9)) {
/* This request is an unrecognized version, or it includes an Arti RPC
* object ID (which we do not recognize). */
res = SOCKS_RESULT_INVALID;
goto end;
}
}
if (usernamelen && username) {
tor_free(req->username);
req->username = tor_memdup_nulterm(username, usernamelen);
req->usernamelen = usernamelen;
}
if (passwordlen && password) {
tor_free(req->password);
req->password = tor_memdup_nulterm(password, passwordlen);
req->passwordlen = passwordlen;
}
/**
* Yes, we allow username and/or password to be empty. Yes, that does
* violate RFC 1929. However, some client software can send a username/
* password message with these fields being empty and we want to allow them
* to be used with Tor.
*/
req->got_auth = 1;
end:
socks5_client_userpass_auth_free(trunnel_req);
return res;
}
/**
* Validate and respond to SOCKS5 username/password request we
* parsed in parse_socks5_userpass_auth (corresponding to req.
* Set req->reply to appropriate response. Return
* SOCKS_RESULT_DONE on success or SOCKS_RESULT_INVALID on failure.
*/
static socks_result_t
process_socks5_userpass_auth(socks_request_t *req)
{
socks_result_t res = SOCKS_RESULT_DONE;
socks5_server_userpass_auth_t *trunnel_resp =
socks5_server_userpass_auth_new();
tor_assert(trunnel_resp);
if (req->socks_version != SOCKS_VER_5) {
res = SOCKS_RESULT_INVALID;
goto end;
}
if (req->auth_type != SOCKS_USER_PASS &&
req->auth_type != SOCKS_NO_AUTH) {
res = SOCKS_RESULT_INVALID;
goto end;
}
socks5_server_userpass_auth_set_version(trunnel_resp, SOCKS_AUTH);
socks5_server_userpass_auth_set_status(trunnel_resp, 0); // auth OK
const char *errmsg = socks5_server_userpass_auth_check(trunnel_resp);
if (errmsg) {
log_warn(LD_APP, "socks5: server userpass auth validation failed: %s",
errmsg);
res = SOCKS_RESULT_INVALID;
goto end;
}
ssize_t encoded = socks5_server_userpass_auth_encode(req->reply,
sizeof(req->reply),
trunnel_resp);
if (encoded < 0) {
log_warn(LD_APP, "socks5: server userpass auth encoding failed");
res = SOCKS_RESULT_INVALID;
goto end;
}
req->replylen = (size_t)encoded;
end:
socks5_server_userpass_auth_free(trunnel_resp);
return res;
}
/**
* Parse a single SOCKS5 client request (RFC 1928 section 4) from buffer
* raw_data of length datalen and update relevant field of
* req. Set *drain_out to number of bytes we parsed so far.
*
* Return SOCKS_RESULT_DONE if parsing succeeded, SOCKS_RESULT_INVALID if
* parsing failed because of invalid input or SOCKS_RESULT_TRUNCATED if it
* failed due to incomplete (truncated) input.
*/
static socks_result_t
parse_socks5_client_request(const uint8_t *raw_data, socks_request_t *req,
size_t datalen, size_t *drain_out)
{
socks_result_t res = SOCKS_RESULT_DONE;
tor_addr_t destaddr;
socks5_client_request_t *trunnel_req = NULL;
ssize_t parsed =
socks5_client_request_parse(&trunnel_req, raw_data, datalen);
if (parsed == -1) {
log_warn(LD_APP, "socks5: parsing failed - invalid client request");
res = SOCKS_RESULT_INVALID;
socks_request_set_socks5_error(req, SOCKS5_GENERAL_ERROR);
goto end;
} else if (parsed == -2) {
res = SOCKS_RESULT_TRUNCATED;
goto end;
}
tor_assert(parsed >= 0);
*drain_out = (size_t)parsed;
if (socks5_client_request_get_version(trunnel_req) != 5) {
res = SOCKS_RESULT_INVALID;
socks_request_set_socks5_error(req, SOCKS5_GENERAL_ERROR);
goto end;
}
req->command = socks5_client_request_get_command(trunnel_req);
req->port = socks5_client_request_get_dest_port(trunnel_req);
uint8_t atype = socks5_client_request_get_atype(trunnel_req);
req->socks5_atyp = atype;
switch (atype) {
case 1: {
uint32_t ipv4 = socks5_client_request_get_dest_addr_ipv4(trunnel_req);
tor_addr_from_ipv4h(&destaddr, ipv4);
tor_addr_to_str(req->address, &destaddr, sizeof(req->address), 1);
} break;
case 3: {
const struct domainname_st *dns_name =
socks5_client_request_getconst_dest_addr_domainname(trunnel_req);
const char *hostname = domainname_getconstarray_name(dns_name);
strlcpy(req->address, hostname, sizeof(req->address));
} break;
case 4: {
const uint8_t *ipv6 =
socks5_client_request_getarray_dest_addr_ipv6(trunnel_req);
tor_addr_from_ipv6_bytes(&destaddr, ipv6);
tor_addr_to_str(req->address, &destaddr, sizeof(req->address), 1);
} break;
default: {
socks_request_set_socks5_error(req, SOCKS5_ADDRESS_TYPE_NOT_SUPPORTED);
res = -1;
} break;
}
end:
socks5_client_request_free(trunnel_req);
return res;
}
/**
* Validate and respond to SOCKS5 request we parsed in
* parse_socks5_client_request (corresponding to req.
* Write appropriate response to req->reply (in
* SOCKS5 wire format). If log_sockstype is true, log a
* notice about possible DNS leaks on local system. If
* safe_socks is true, disallow insecure usage of SOCKS
* protocol. Return SOCKS_RESULT_DONE on success or
* SOCKS_RESULT_INVALID on failure.
*/
static socks_result_t
process_socks5_client_request(socks_request_t *req,
int log_sockstype,
int safe_socks)
{
socks_result_t res = SOCKS_RESULT_DONE;
tor_addr_t tmpaddr;
if (req->command != SOCKS_COMMAND_CONNECT &&
req->command != SOCKS_COMMAND_RESOLVE &&
req->command != SOCKS_COMMAND_RESOLVE_PTR) {
socks_request_set_socks5_error(req,SOCKS5_COMMAND_NOT_SUPPORTED);
res = SOCKS_RESULT_INVALID;
goto end;
}
if (req->command == SOCKS_COMMAND_RESOLVE_PTR &&
tor_addr_parse(&tmpaddr, req->address) < 0) {
socks_request_set_socks5_error(req, SOCKS5_ADDRESS_TYPE_NOT_SUPPORTED);
log_warn(LD_APP, "socks5 received RESOLVE_PTR command with "
"a malformed address. Rejecting.");
res = SOCKS_RESULT_INVALID;
goto end;
}
if (!string_is_valid_dest(req->address)) {
socks_request_set_socks5_error(req, SOCKS5_GENERAL_ERROR);
log_warn(LD_PROTOCOL,
"Your application (using socks5 to port %d) gave Tor "
"a malformed hostname: %s. Rejecting the connection.",
req->port, escaped_safe_str_client(req->address));
res = SOCKS_RESULT_INVALID;
goto end;
}
if (req->socks5_atyp == 1 || req->socks5_atyp == 4) {
if (req->command != SOCKS_COMMAND_RESOLVE_PTR &&
!addressmap_have_mapping(req->address,0)) {
log_unsafe_socks_warning(5, req->address, req->port, safe_socks);
if (safe_socks) {
socks_request_set_socks5_error(req, SOCKS5_NOT_ALLOWED);
res = SOCKS_RESULT_INVALID;
goto end;
}
}
}
if (log_sockstype)
log_notice(LD_APP,
"Your application (using socks5 to port %d) instructed "
"Tor to take care of the DNS resolution itself if "
"necessary. This is good.", req->port);
end:
return res;
}
/**
* Handle (parse, validate, process, respond) a single SOCKS
* message in buffer raw_data of length datalen.
* Update relevant fields of req. If log_sockstype
* is true, log a warning about possible DNS leaks on local
* system. If safe_socks is true, disallow insecure
* usage of SOCKS protocol. Set *drain_out to number
* of bytes in raw_data that we processed so far and
* that can be safely drained from buffer.
*
* Return:
* - SOCKS_RESULT_DONE if succeeded and not expecting further
* messages from client.
* - SOCKS_RESULT_INVALID if any of the steps failed due to
* request being invalid or unexpected given current state.
* - SOCKS_RESULT_TRUNCATED if we do not found an expected
* SOCKS message in its entirety (more stuff has to arrive
* from client).
* - SOCKS_RESULT_MORE_EXPECTED if we handled current message
* successfully, but we expect more messages from the
* client.
*/
static socks_result_t
handle_socks_message(const uint8_t *raw_data, size_t datalen,
socks_request_t *req, int log_sockstype,
int safe_socks, size_t *drain_out)
{
socks_result_t res = SOCKS_RESULT_DONE;
uint8_t socks_version = raw_data[0];
if (socks_version == SOCKS_AUTH)
socks_version = SOCKS_VER_5; // SOCKS5 username/pass subnegotiation
if (socks_version == SOCKS_VER_4) {
if (datalen < SOCKS4_NETWORK_LEN) {
res = 0;
goto end;
}
int is_socks4a = 0;
res = parse_socks4_request((const uint8_t *)raw_data, req, datalen,
&is_socks4a, drain_out);
if (res != SOCKS_RESULT_DONE) {
goto end;
}
res = process_socks4_request(req, is_socks4a,log_sockstype,
safe_socks);
if (res != SOCKS_RESULT_DONE) {
goto end;
}
goto end;
} else if (socks_version == SOCKS_VER_5) {
if (datalen < 2) { /* version and another byte */
res = 0;
goto end;
}
/* RFC1929 SOCKS5 username/password subnegotiation. */
if (!req->got_auth && (raw_data[0] == 1 ||
req->auth_type == SOCKS_USER_PASS)) {
res = parse_socks5_userpass_auth(raw_data, req, datalen,
drain_out);
if (res != SOCKS_RESULT_DONE) {
goto end;
}
res = process_socks5_userpass_auth(req);
if (res != SOCKS_RESULT_DONE) {
goto end;
}
res = SOCKS_RESULT_MORE_EXPECTED;
goto end;
} else if (req->socks_version != SOCKS_VER_5) {
int have_user_pass=0, have_no_auth=0;
res = parse_socks5_methods_request(raw_data, req, datalen,
&have_user_pass,
&have_no_auth,
drain_out);
if (res != SOCKS_RESULT_DONE) {
goto end;
}
res = process_socks5_methods_request(req, have_user_pass,
have_no_auth);
if (res != SOCKS_RESULT_DONE) {
goto end;
}
res = SOCKS_RESULT_MORE_EXPECTED;
goto end;
} else {
res = parse_socks5_client_request(raw_data, req,
datalen, drain_out);
if (BUG(res == SOCKS_RESULT_INVALID && req->replylen == 0)) {
socks_request_set_socks5_error(req, SOCKS5_GENERAL_ERROR);
}
if (res != SOCKS_RESULT_DONE) {
goto end;
}
res = process_socks5_client_request(req, log_sockstype,
safe_socks);
if (res != SOCKS_RESULT_DONE) {
goto end;
}
}
} else {
*drain_out = datalen;
res = SOCKS_RESULT_INVALID;
}
end:
return res;
}
/** There is a (possibly incomplete) socks handshake on buf, of one
* of the forms
* - socks4: "socksheader username\\0"
* - socks4a: "socksheader username\\0 destaddr\\0"
* - socks5 phase one: "version #methods methods"
* - socks5 phase two: "version command 0 addresstype..."
* If it's a complete and valid handshake, and destaddr fits in
* MAX_SOCKS_ADDR_LEN bytes, then pull the handshake off the buf,
* assign to req, and return 1.
*
* If it's invalid or too big, return -1.
*
* Else it's not all there yet, leave buf alone and return 0.
*
* If you want to specify the socks reply, write it into req->reply
* and set req->replylen, else leave req->replylen alone.
*
* If log_sockstype is non-zero, then do a notice-level log of whether
* the connection is possibly leaking DNS requests locally or not.
*
* If safe_socks is true, then reject unsafe socks protocols.
*
* If returning 0 or -1, req->address and req->port are
* undefined.
*/
int
fetch_from_buf_socks(buf_t *buf, socks_request_t *req,
int log_sockstype, int safe_socks)
{
int res = 0;
size_t datalen = buf_datalen(buf);
size_t n_drain;
const char *head = NULL;
socks_result_t socks_res;
size_t n_pullup;
if (buf_datalen(buf) < 2) { /* version and another byte */
res = 0;
goto end;
}
do {
n_drain = 0;
n_pullup = MIN(MAX_SOCKS_MESSAGE_LEN, buf_datalen(buf));
buf_pullup(buf, n_pullup, &head, &datalen);
tor_assert(head && datalen >= 2);
socks_res = parse_socks(head, datalen, req, log_sockstype,
safe_socks, &n_drain);
if (socks_res == SOCKS_RESULT_INVALID)
buf_clear(buf);
else if (socks_res != SOCKS_RESULT_TRUNCATED && n_drain > 0)
buf_drain(buf, n_drain);
switch (socks_res) {
case SOCKS_RESULT_INVALID:
res = -1;
break;
case SOCKS_RESULT_DONE:
res = 1;
break;
case SOCKS_RESULT_TRUNCATED:
if (datalen == n_pullup)
return 0;
FALLTHROUGH;
case SOCKS_RESULT_MORE_EXPECTED:
res = 0;
break;
}
} while (res == 0 && head && buf_datalen(buf) >= 2);
end:
return res;
}
/** Create a SOCKS5 reply message with reason in its REP field and
* have Tor send it as error response to req.
*/
static void
socks_request_set_socks5_error(socks_request_t *req,
socks5_reply_status_t reason)
{
socks5_server_reply_t *trunnel_resp = socks5_server_reply_new();
tor_assert(trunnel_resp);
socks5_server_reply_set_version(trunnel_resp, SOCKS_VER_5);
socks5_server_reply_set_reply(trunnel_resp, reason);
socks5_server_reply_set_atype(trunnel_resp, 0x01);
const char *errmsg = socks5_server_reply_check(trunnel_resp);
if (errmsg) {
log_warn(LD_APP, "socks5: reply validation failed: %s",
errmsg);
goto end;
}
ssize_t encoded = socks5_server_reply_encode(req->reply,
sizeof(req->reply),
trunnel_resp);
if (encoded < 0) {
log_warn(LD_APP, "socks5: reply encoding failed: %d",
(int)encoded);
} else {
req->replylen = (size_t)encoded;
}
end:
socks5_server_reply_free(trunnel_resp);
}
static const char SOCKS_PROXY_IS_NOT_AN_HTTP_PROXY_MSG[] =
"HTTP/1.0 501 Tor is not an HTTP Proxy\r\n"
"Content-Type: text/html; charset=iso-8859-1\r\n\r\n"
"\n"
"\n"
"This is a SOCKS Proxy, Not An HTTP Proxy\n"
"\n"
"\n"
"This is a SOCKS proxy, not an HTTP proxy.
\n"
"\n"
"It appears you have configured your web browser to use this Tor port as\n"
"an HTTP proxy.\n"
"
\n"
"\n"
"This is not correct: This port is configured as a SOCKS proxy, not\n"
"an HTTP proxy. If you need an HTTP proxy tunnel, use the HTTPTunnelPort\n"
"configuration option in place of, or in addition to, SOCKSPort.\n"
"Please configure your client accordingly.\n"
"
\n"
"\n"
"See "
"https://www.torproject.org/documentation.html for more "
"information.\n"
"
\n"
"\n"
"\n";
/** Implementation helper to implement fetch_from_*_socks. Instead of looking
* at a buffer's contents, we look at the datalen bytes of data in
* data. Instead of removing data from the buffer, we set
* drain_out to the amount of data that should be removed (or -1 if the
* buffer should be cleared). Instead of pulling more data into the first
* chunk of the buffer, we set *want_length_out to the number of bytes
* we'd like to see in the input buffer, if they're available. */
static socks_result_t
parse_socks(const char *data, size_t datalen, socks_request_t *req,
int log_sockstype, int safe_socks, size_t *drain_out)
{
uint8_t first_octet;
if (datalen < 2) {
/* We always need at least 2 bytes. */
return SOCKS_RESULT_TRUNCATED;
}
first_octet = get_uint8(data);
if (first_octet == SOCKS_VER_5 || first_octet == SOCKS_VER_4 ||
first_octet == SOCKS_AUTH) { // XXX: RFC 1929
return handle_socks_message((const uint8_t *)data, datalen, req,
log_sockstype, safe_socks, drain_out);
}
switch (first_octet) { /* which version of socks? */
case 'G': /* get */
case 'H': /* head */
case 'P': /* put/post */
case 'C': /* connect */
strlcpy((char*)req->reply, SOCKS_PROXY_IS_NOT_AN_HTTP_PROXY_MSG,
MAX_SOCKS_REPLY_LEN);
req->replylen = strlen((char*)req->reply)+1;
FALLTHROUGH;
default: /* version is not socks4 or socks5 */
log_warn(LD_APP,
"Socks version %d not recognized. (This port is not an "
"HTTP proxy; did you want to use HTTPTunnelPort?)",
*(data));
{
/* Tell the controller the first 8 bytes. */
char *tmp = tor_strndup(data, datalen < 8 ? datalen : 8);
control_event_client_status(LOG_WARN,
"SOCKS_UNKNOWN_PROTOCOL DATA=\"%s\"",
escaped(tmp));
tor_free(tmp);
}
return SOCKS_RESULT_INVALID;
}
tor_assert_unreached();
return SOCKS_RESULT_INVALID;
}
/** Inspect a reply from SOCKS server stored in buf according
* to state, removing the protocol data upon success. Return 0 on
* incomplete response, 1 on success and -1 on error, in which case
* reason is set to a descriptive message (free() when finished
* with it).
*
* As a special case, 2 is returned when user/pass is required
* during SOCKS5 handshake and user/pass is configured.
*/
int
fetch_from_buf_socks_client(buf_t *buf, int state, char **reason)
{
ssize_t drain = 0;
int r;
const char *head = NULL;
size_t datalen = 0;
if (buf_datalen(buf) < 2)
return 0;
buf_pullup(buf, MAX_SOCKS_MESSAGE_LEN, &head, &datalen);
tor_assert(head && datalen >= 2);
r = parse_socks_client((uint8_t*)head, datalen,
state, reason, &drain);
if (drain > 0)
buf_drain(buf, drain);
else if (drain < 0)
buf_clear(buf);
return r;
}
/** Implementation logic for fetch_from_*_socks_client. */
static int
parse_socks_client(const uint8_t *data, size_t datalen,
int state, char **reason,
ssize_t *drain_out)
{
unsigned int addrlen;
*drain_out = 0;
if (datalen < 2)
return 0;
switch (state) {
case PROXY_SOCKS4_WANT_CONNECT_OK:
/* Wait for the complete response */
if (datalen < 8)
return 0;
if (data[1] != 0x5a) {
*reason = tor_strdup(socks4_response_code_to_string(data[1]));
return -1;
}
/* Success */
*drain_out = 8;
return 1;
case PROXY_SOCKS5_WANT_AUTH_METHOD_NONE:
/* we don't have any credentials */
if (data[1] != 0x00) {
*reason = tor_strdup("server doesn't support any of our "
"available authentication methods");
return -1;
}
log_info(LD_NET, "SOCKS 5 client: continuing without authentication");
*drain_out = -1;
return 1;
case PROXY_SOCKS5_WANT_AUTH_METHOD_RFC1929:
/* we have a username and password. return 1 if we can proceed without
* providing authentication, or 2 otherwise. */
switch (data[1]) {
case 0x00:
log_info(LD_NET, "SOCKS 5 client: we have auth details but server "
"doesn't require authentication.");
*drain_out = -1;
return 1;
case 0x02:
log_info(LD_NET, "SOCKS 5 client: need authentication.");
*drain_out = -1;
return 2;
default:
/* This wasn't supposed to be exhaustive; there are other
* authentication methods too. */
;
}
*reason = tor_strdup("server doesn't support any of our available "
"authentication methods");
return -1;
case PROXY_SOCKS5_WANT_AUTH_RFC1929_OK:
/* handle server reply to rfc1929 authentication */
if (data[1] != 0x00) {
*reason = tor_strdup("authentication failed");
return -1;
}
log_info(LD_NET, "SOCKS 5 client: authentication successful.");
*drain_out = -1;
return 1;
case PROXY_SOCKS5_WANT_CONNECT_OK:
/* response is variable length. BND.ADDR, etc, isn't needed
* (don't bother with buf_pullup()), but make sure to eat all
* the data used */
/* wait for address type field to arrive */
if (datalen < 4)
return 0;
switch (data[3]) {
case 0x01: /* ip4 */
addrlen = 4;
break;
case 0x04: /* ip6 */
addrlen = 16;
break;
case 0x03: /* fqdn (can this happen here?) */
if (datalen < 5)
return 0;
addrlen = 1 + data[4];
break;
default:
*reason = tor_strdup("invalid response to connect request");
return -1;
}
/* wait for address and port */
if (datalen < 6 + addrlen)
return 0;
if (data[1] != 0x00) {
*reason = tor_strdup(socks5_response_code_to_string(data[1]));
return -1;
}
*drain_out = 6 + addrlen;
return 1;
}
/* LCOV_EXCL_START */
/* shouldn't get here if the input state is one we know about... */
tor_assert(0);
return -1;
/* LCOV_EXCL_STOP */
}