1 /* $OpenBSD: socks.c,v 1.31 2022/06/08 20:20:26 djm Exp $ */
2
3 /*
4 * Copyright (c) 1999 Niklas Hallqvist. All rights reserved.
5 * Copyright (c) 2004, 2005 Damien Miller. All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in the
14 * documentation and/or other materials provided with the distribution.
15 *
16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
17 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
18 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
19 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
20 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
21 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
22 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
23 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
24 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
25 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
26 */
27
28 #include <sys/types.h>
29 #include <sys/socket.h>
30 #include <netinet/in.h>
31 #include <arpa/inet.h>
32
33 #include <err.h>
34 #include <errno.h>
35 #include <netdb.h>
36 #include <stdio.h>
37 #include <stdlib.h>
38 #include <string.h>
39 #include <unistd.h>
40 #include <resolv.h>
41 #include <readpassphrase.h>
42 #include "atomicio.h"
43
44 #define SOCKS_PORT "1080"
45 #define HTTP_PROXY_PORT "3128"
46 #define HTTP_MAXHDRS 64
47 #define SOCKS_V5 5
48 #define SOCKS_V4 4
49 #define SOCKS_NOAUTH 0
50 #define SOCKS_NOMETHOD 0xff
51 #define SOCKS_CONNECT 1
52 #define SOCKS_IPV4 1
53 #define SOCKS_DOMAIN 3
54 #define SOCKS_IPV6 4
55
56 int remote_connect(const char *, const char *, struct addrinfo, char *);
57 int socks_connect(const char *, const char *, struct addrinfo,
58 const char *, const char *, struct addrinfo, int,
59 const char *);
60
61 static int
decode_addrport(const char * h,const char * p,struct sockaddr * addr,socklen_t addrlen,int v4only,int numeric)62 decode_addrport(const char *h, const char *p, struct sockaddr *addr,
63 socklen_t addrlen, int v4only, int numeric)
64 {
65 int r;
66 struct addrinfo hints, *res;
67
68 memset(&hints, 0, sizeof(hints));
69 hints.ai_family = v4only ? PF_INET : PF_UNSPEC;
70 hints.ai_flags = numeric ? AI_NUMERICHOST : 0;
71 hints.ai_socktype = SOCK_STREAM;
72 r = getaddrinfo(h, p, &hints, &res);
73 /* Don't fatal when attempting to convert a numeric address */
74 if (r != 0) {
75 if (!numeric) {
76 errx(1, "getaddrinfo(\"%.64s\", \"%.64s\"): %s", h, p,
77 gai_strerror(r));
78 }
79 return (-1);
80 }
81 if (addrlen < res->ai_addrlen) {
82 freeaddrinfo(res);
83 errx(1, "internal error: addrlen < res->ai_addrlen");
84 }
85 memcpy(addr, res->ai_addr, res->ai_addrlen);
86 freeaddrinfo(res);
87 return (0);
88 }
89
90 static int
proxy_read_line(int fd,char * buf,size_t bufsz)91 proxy_read_line(int fd, char *buf, size_t bufsz)
92 {
93 size_t off;
94
95 for(off = 0;;) {
96 if (off >= bufsz)
97 errx(1, "proxy read too long");
98 if (atomicio(read, fd, buf + off, 1) != 1)
99 err(1, "proxy read");
100 /* Skip CR */
101 if (buf[off] == '\r')
102 continue;
103 if (buf[off] == '\n') {
104 buf[off] = '\0';
105 break;
106 }
107 off++;
108 }
109 return (off);
110 }
111
112 static void
getproxypass(const char * proxyuser,const char * proxyhost,char * pw,size_t pwlen)113 getproxypass(const char *proxyuser, const char *proxyhost,
114 char *pw, size_t pwlen)
115 {
116 char prompt[512];
117
118 snprintf(prompt, sizeof(prompt), "Proxy password for %s@%s: ",
119 proxyuser, proxyhost);
120 if (readpassphrase(prompt, pw, pwlen, RPP_REQUIRE_TTY) == NULL)
121 errx(1, "Unable to read proxy passphrase");
122 }
123
124 /*
125 * Error strings adapted from the generally accepted SOCKSv4 spec:
126 *
127 * http://ftp.icm.edu.pl/packages/socks/socks4/SOCKS4.protocol
128 */
129 static const char *
socks4_strerror(int e)130 socks4_strerror(int e)
131 {
132 switch (e) {
133 case 90:
134 return "Succeeded";
135 case 91:
136 return "Request rejected or failed";
137 case 92:
138 return "SOCKS server cannot connect to identd on the client";
139 case 93:
140 return "Client program and identd report different user-ids";
141 default:
142 return "Unknown error";
143 }
144 }
145
146 /*
147 * Error strings taken almost directly from RFC 1928.
148 */
149 static const char *
socks5_strerror(int e)150 socks5_strerror(int e)
151 {
152 switch (e) {
153 case 0:
154 return "Succeeded";
155 case 1:
156 return "General SOCKS server failure";
157 case 2:
158 return "Connection not allowed by ruleset";
159 case 3:
160 return "Network unreachable";
161 case 4:
162 return "Host unreachable";
163 case 5:
164 return "Connection refused";
165 case 6:
166 return "TTL expired";
167 case 7:
168 return "Command not supported";
169 case 8:
170 return "Address type not supported";
171 default:
172 return "Unknown error";
173 }
174 }
175
176 int
socks_connect(const char * host,const char * port,struct addrinfo hints,const char * proxyhost,const char * proxyport,struct addrinfo proxyhints,int socksv,const char * proxyuser)177 socks_connect(const char *host, const char *port,
178 struct addrinfo hints __attribute__ ((__unused__)),
179 const char *proxyhost, const char *proxyport, struct addrinfo proxyhints,
180 int socksv, const char *proxyuser)
181 {
182 int proxyfd, r, authretry = 0;
183 size_t hlen, wlen;
184 unsigned char buf[1024];
185 size_t cnt;
186 struct sockaddr_storage addr;
187 struct sockaddr_in *in4 = (struct sockaddr_in *)&addr;
188 struct sockaddr_in6 *in6 = (struct sockaddr_in6 *)&addr;
189 in_port_t serverport;
190
191 if (proxyport == NULL)
192 proxyport = (socksv == -1) ? HTTP_PROXY_PORT : SOCKS_PORT;
193
194 /* Abuse API to lookup port */
195 if (decode_addrport("0.0.0.0", port, (struct sockaddr *)&addr,
196 sizeof(addr), 1, 1) == -1)
197 errx(1, "unknown port \"%.64s\"", port);
198 serverport = in4->sin_port;
199
200 again:
201 if (authretry++ > 3)
202 errx(1, "Too many authentication failures");
203
204 proxyfd = remote_connect(proxyhost, proxyport, proxyhints, NULL);
205
206 if (proxyfd < 0)
207 return (-1);
208
209 if (socksv == 5) {
210 if (decode_addrport(host, port, (struct sockaddr *)&addr,
211 sizeof(addr), 0, 1) == -1)
212 addr.ss_family = 0; /* used in switch below */
213
214 /* Version 5, one method: no authentication */
215 buf[0] = SOCKS_V5;
216 buf[1] = 1;
217 buf[2] = SOCKS_NOAUTH;
218 cnt = atomicio(vwrite, proxyfd, buf, 3);
219 if (cnt != 3)
220 err(1, "write failed (%zu/3)", cnt);
221
222 cnt = atomicio(read, proxyfd, buf, 2);
223 if (cnt != 2)
224 err(1, "read failed (%zu/3)", cnt);
225
226 if (buf[1] == SOCKS_NOMETHOD)
227 errx(1, "authentication method negotiation failed");
228
229 switch (addr.ss_family) {
230 case 0:
231 /* Version 5, connect: domain name */
232
233 /* Max domain name length is 255 bytes */
234 hlen = strlen(host);
235 if (hlen > 255)
236 errx(1, "host name too long for SOCKS5");
237 buf[0] = SOCKS_V5;
238 buf[1] = SOCKS_CONNECT;
239 buf[2] = 0;
240 buf[3] = SOCKS_DOMAIN;
241 buf[4] = hlen;
242 memcpy(buf + 5, host, hlen);
243 memcpy(buf + 5 + hlen, &serverport, sizeof serverport);
244 wlen = 7 + hlen;
245 break;
246 case AF_INET:
247 /* Version 5, connect: IPv4 address */
248 buf[0] = SOCKS_V5;
249 buf[1] = SOCKS_CONNECT;
250 buf[2] = 0;
251 buf[3] = SOCKS_IPV4;
252 memcpy(buf + 4, &in4->sin_addr, sizeof in4->sin_addr);
253 memcpy(buf + 8, &in4->sin_port, sizeof in4->sin_port);
254 wlen = 10;
255 break;
256 case AF_INET6:
257 /* Version 5, connect: IPv6 address */
258 buf[0] = SOCKS_V5;
259 buf[1] = SOCKS_CONNECT;
260 buf[2] = 0;
261 buf[3] = SOCKS_IPV6;
262 memcpy(buf + 4, &in6->sin6_addr, sizeof in6->sin6_addr);
263 memcpy(buf + 20, &in6->sin6_port,
264 sizeof in6->sin6_port);
265 wlen = 22;
266 break;
267 default:
268 errx(1, "internal error: silly AF");
269 }
270
271 cnt = atomicio(vwrite, proxyfd, buf, wlen);
272 if (cnt != wlen)
273 err(1, "write failed (%zu/%zu)", cnt, wlen);
274
275 cnt = atomicio(read, proxyfd, buf, 4);
276 if (cnt != 4)
277 err(1, "read failed (%zu/4)", cnt);
278 if (buf[1] != 0) {
279 errx(1, "connection failed, SOCKSv5 error: %s",
280 socks5_strerror(buf[1]));
281 }
282 switch (buf[3]) {
283 case SOCKS_IPV4:
284 cnt = atomicio(read, proxyfd, buf + 4, 6);
285 if (cnt != 6)
286 err(1, "read failed (%zu/6)", cnt);
287 break;
288 case SOCKS_IPV6:
289 cnt = atomicio(read, proxyfd, buf + 4, 18);
290 if (cnt != 18)
291 err(1, "read failed (%zu/18)", cnt);
292 break;
293 default:
294 errx(1, "connection failed, unsupported address type");
295 }
296 } else if (socksv == 4) {
297 /* This will exit on lookup failure */
298 decode_addrport(host, port, (struct sockaddr *)&addr,
299 sizeof(addr), 1, 0);
300
301 /* Version 4 */
302 buf[0] = SOCKS_V4;
303 buf[1] = SOCKS_CONNECT; /* connect */
304 memcpy(buf + 2, &in4->sin_port, sizeof in4->sin_port);
305 memcpy(buf + 4, &in4->sin_addr, sizeof in4->sin_addr);
306 buf[8] = 0; /* empty username */
307 wlen = 9;
308
309 cnt = atomicio(vwrite, proxyfd, buf, wlen);
310 if (cnt != wlen)
311 err(1, "write failed (%zu/%zu)", cnt, wlen);
312
313 cnt = atomicio(read, proxyfd, buf, 8);
314 if (cnt != 8)
315 err(1, "read failed (%zu/8)", cnt);
316 if (buf[1] != 90) {
317 errx(1, "connection failed, SOCKSv4 error: %s",
318 socks4_strerror(buf[1]));
319 }
320 } else if (socksv == -1) {
321 /* HTTP proxy CONNECT */
322
323 /* Disallow bad chars in hostname */
324 if (strcspn(host, "\r\n\t []") != strlen(host))
325 errx(1, "Invalid hostname");
326
327 /* Try to be sane about numeric IPv6 addresses */
328 if (strchr(host, ':') != NULL) {
329 r = snprintf(buf, sizeof(buf),
330 "CONNECT [%s]:%d HTTP/1.0\r\n",
331 host, ntohs(serverport));
332 } else {
333 r = snprintf(buf, sizeof(buf),
334 "CONNECT %s:%d HTTP/1.0\r\n",
335 host, ntohs(serverport));
336 }
337 if (r < 0 || (size_t)r >= sizeof(buf))
338 errx(1, "hostname too long");
339 r = strlen(buf);
340
341 cnt = atomicio(vwrite, proxyfd, buf, r);
342 if (cnt != r)
343 err(1, "write failed (%zu/%d)", cnt, r);
344
345 if (authretry > 1) {
346 char proxypass[256];
347 char resp[1024];
348
349 getproxypass(proxyuser, proxyhost,
350 proxypass, sizeof proxypass);
351 r = snprintf(buf, sizeof(buf), "%s:%s",
352 proxyuser, proxypass);
353 explicit_bzero(proxypass, sizeof proxypass);
354 if (r == -1 || (size_t)r >= sizeof(buf) ||
355 b64_ntop(buf, strlen(buf), resp,
356 sizeof(resp)) == -1)
357 errx(1, "Proxy username/password too long");
358 r = snprintf(buf, sizeof(buf), "Proxy-Authorization: "
359 "Basic %s\r\n", resp);
360 if (r < 0 || (size_t)r >= sizeof(buf))
361 errx(1, "Proxy auth response too long");
362 r = strlen(buf);
363 if ((cnt = atomicio(vwrite, proxyfd, buf, r)) != r)
364 err(1, "write failed (%zu/%d)", cnt, r);
365 explicit_bzero(proxypass, sizeof proxypass);
366 explicit_bzero(buf, sizeof buf);
367 }
368
369 /* Terminate headers */
370 if ((cnt = atomicio(vwrite, proxyfd, "\r\n", 2)) != 2)
371 err(1, "write failed (%zu/2)", cnt);
372
373 /* Read status reply */
374 proxy_read_line(proxyfd, buf, sizeof(buf));
375 if (proxyuser != NULL &&
376 (strncmp(buf, "HTTP/1.0 407 ", 12) == 0 ||
377 strncmp(buf, "HTTP/1.1 407 ", 12) == 0)) {
378 if (authretry > 1) {
379 fprintf(stderr, "Proxy authentication "
380 "failed\n");
381 }
382 close(proxyfd);
383 goto again;
384 } else if (strncmp(buf, "HTTP/1.0 200 ", 12) != 0 &&
385 strncmp(buf, "HTTP/1.1 200 ", 12) != 0)
386 errx(1, "Proxy error: \"%s\"", buf);
387
388 /* Headers continue until we hit an empty line */
389 for (r = 0; r < HTTP_MAXHDRS; r++) {
390 proxy_read_line(proxyfd, buf, sizeof(buf));
391 if (*buf == '\0')
392 break;
393 }
394 if (*buf != '\0')
395 errx(1, "Too many proxy headers received");
396 } else
397 errx(1, "Unknown proxy protocol %d", socksv);
398
399 return (proxyfd);
400 }
401