/*
SOCKS proxy support for neon
Copyright (C) 2008, Joe Orton <joe@manyfish.co.uk>
This library is free software; you can redistribute it and/or
modify it under the terms of the GNU Library General Public
License as published by the Free Software Foundation; either
version 2 of the License, or (at your option) any later version.
This library is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
Library General Public License for more details.
You should have received a copy of the GNU Library General Public
License along with this library; if not, write to the Free
Software Foundation, Inc., 59 Temple Place - Suite 330, Boston,
MA 02111-1307, USA
*/
#include "config.h"
#include "ne_internal.h"
#include "ne_string.h"
#include "ne_socket.h"
#include "ne_utils.h"
#include <string.h>
/* SOCKS protocol reference:
v4: http://www.ufasoft.com/doc/socks4_protocol.htm
v4a http://www.smartftp.com/Products/SmartFTP/RFC/socks4a.protocol
v5: http://tools.ietf.org/html/rfc1928
...v5 auth: http://tools.ietf.org/html/rfc1929
*/
#define V5_REPLY_OK 0
#define V5_REPLY_FAIL 1
#define V5_REPLY_DISALLOW 2
#define V5_REPLY_NET_UNREACH 3
#define V5_REPLY_HOST_UNREACH 4
#define V5_REPLY_CONN_REFUSED 5
#define V5_REPLY_TTL_EXPIRED 6
#define V5_REPLY_CMD_UNSUPPORTED 7
#define V5_REPLY_TYPE_UNSUPPORTED 8
#define V5_VERSION 0x05
#define V5_ADDR_IPV4 0x01
#define V5_ADDR_FQDN 0x03
#define V5_ADDR_IPV6 0x04
#define V5_CMD_CONNECT 0x01
#define V5_AUTH_NONE 0x00
#define V5_AUTH_USER 0x02
#define V5_AUTH_NOMETH 0xFF
/* Fail with given V5 error code in given context. */
static int v5fail(ne_socket *sock, unsigned int code, const char *context)
{
const char *err;
switch (code) {
case V5_REPLY_FAIL:
err = _("failure");
break;
case V5_REPLY_DISALLOW:
err = _("connection not permitted");
break;
case V5_REPLY_NET_UNREACH:
err = _("network unreachable");
break;
case V5_REPLY_HOST_UNREACH:
err = _("host unreachable");
break;
case V5_REPLY_TTL_EXPIRED:
err = _("TTL expired");
break;
case V5_REPLY_CMD_UNSUPPORTED:
err = _("command not supported");
break;
case V5_REPLY_TYPE_UNSUPPORTED:
err = _("address type not supported");
break;
default:
ne_sock_set_error(sock, _("%s: unrecognized error (%u)"), context, code);
return NE_SOCK_ERROR;
}
ne_sock_set_error(sock, "%s: %s", context, err);
return NE_SOCK_ERROR;
}
/* Fail with given error string. */
static int fail(ne_socket *sock, const char *error)
{
ne_sock_set_error(sock, "%s", error);
return NE_SOCK_ERROR;
}
/* Fail with given NE_SOCK_* error code and given context. */
static int sofail(ne_socket *sock, ssize_t ret, const char *context)
{
char *err = ne_strdup(ne_sock_error(sock));
ne_sock_set_error(sock, "%s: %s", context, err);
ne_free(err);
return NE_SOCK_ERROR;
}
/* SOCKSv5 proxy. */
static int v5_proxy(ne_socket *sock, const ne_inet_addr *addr,
const char *hostname, unsigned int port,
const char *username, const char *password)
{
unsigned char msg[1024], *p;
unsigned int len;
int ret;
ssize_t n;
p = msg;
*p++ = V5_VERSION;
*p++ = 2; /* Two supported auth protocols; none and user. */
*p++ = V5_AUTH_NONE;
*p++ = V5_AUTH_USER;
ret = ne_sock_fullwrite(sock, (char *)msg, p - msg);
if (ret) {
return sofail(sock, ret, _("Could not send message to proxy"));
}
n = ne_sock_fullread(sock, (char *)msg, 2);
if (n) {
return sofail(sock, ret, _("Could not read initial response from proxy"));
}
else if (msg[0] != V5_VERSION) {
return fail(sock, _("Invalid version in proxy response"));
}
/* Authenticate, if necessary. */
switch (msg[1]) {
case V5_AUTH_NONE:
break;
case V5_AUTH_USER:
p = msg;
*p++ = 0x01;
len = strlen(username) & 0xff;
*p++ = len;
memcpy(p, username, len);
p += len;
len = strlen(password) & 0xff;
*p++ = len;
memcpy(p, password, len);
p += len;
ret = ne_sock_fullwrite(sock, (char *)msg, p - msg);
if (ret) {
return sofail(sock, ret, _("Could not send login message"));
}
n = ne_sock_fullread(sock, (char *)msg, 2);
if (n) {
return sofail(sock, ret, _("Could not read login reply"));
}
else if (msg[0] != 1) {
return fail(sock, _("Invalid version in login reply"));
}
else if (msg[1] != 0) {
return fail(sock, _("Authentication failed"));
}
break;
case V5_AUTH_NOMETH:
return fail(sock, _("No acceptable authentication method"));
default:
return fail(sock, _("Unexpected authentication method chosen"));
}
/* Send the CONNECT command. */
p = msg;
*p++ = V5_VERSION;
*p++ = V5_CMD_CONNECT;
*p++ = 0; /* reserved */
if (addr) {
unsigned char raw[16];
if (ne_iaddr_typeof(addr) == ne_iaddr_ipv4) {
len = 4;
*p++ = V5_ADDR_IPV4;
}
else {
len = 16;
*p++ = V5_ADDR_IPV6;
}
memcpy(p, ne_iaddr_raw(addr, raw), len);
p += len;
}
else {
len = strlen(hostname) & 0xff;
*p++ = V5_ADDR_FQDN;
*p++ = len;
memcpy(p, hostname, len);
p += len;
}
*p++ = (port >> 8) & 0xff;
*p++ = port & 0xff;
ret = ne_sock_fullwrite(sock, (char *)msg, p - msg);
if (ret) {
return sofail(sock, ret, _("Could not send connect request"));
}
n = ne_sock_fullread(sock, (char *)msg, 4);
if (n) {
return sofail(sock, n, _("Could not read connect reply"));
}
if (msg[0] != V5_VERSION) {
return fail(sock, _("Invalid version in connect reply"));
}
if (msg[1] != V5_REPLY_OK) {
return v5fail(sock, msg[1], _("Could not connect"));
}
switch (msg[3]) {
case V5_ADDR_IPV4:
len = 4;
break;
case V5_ADDR_IPV6:
len = 16;
break;
case V5_ADDR_FQDN:
n = ne_sock_read(sock, (char *)msg, 1);
if (n != 1) {
return sofail(sock, n,
_("Could not read FQDN length in connect reply"));
}
len = msg[0];
break;
default:
return fail(sock, _("Unknown address type in connect reply"));
}
n = ne_sock_fullread(sock, (char *)msg, len + 2);
if (n) {
return sofail(sock, n, _("Could not read address in connect reply"));
}
return 0;
}
#define V4_VERSION 0x04
#define V4_CMD_STREAM 0x01
#define V4_REP_OK 0x5a /* request granted */
#define V4_REP_FAIL 0x5b /* request rejected or failed */
#define V4_REP_NOIDENT 0x5c /* request failed, could connect to identd */
#define V4_REP_IDFAIL 0x5d /* request failed, identd denial */
/* Fail for given SOCKSv4 error code. */
static int v4fail(ne_socket *sock, unsigned int code, const char *context)
{
const char *err;
switch (code) {
case V4_REP_FAIL:
err = _("request rejected or failed");
break;
case V4_REP_NOIDENT:
err = _("could not establish connection to identd");
break;
case V4_REP_IDFAIL:
err = _("rejected due to identd user mismatch");
break;
default:
ne_sock_set_error(sock, _("%s: unrecognized failure (%u)"),
context, code);
return NE_SOCK_ERROR;
}
ne_sock_set_error(sock, "%s: %s", context, err);
return NE_SOCK_ERROR;
}
/* SOCKS v4 or v4A proxy. */
static int v4_proxy(ne_socket *sock, enum ne_sock_sversion vers,
const ne_inet_addr *addr, const char *hostname,
unsigned int port, const char *username)
{
unsigned char msg[1024], raw[16], *p;
ssize_t n;
int ret;
p = msg;
*p++ = V4_VERSION;
*p++ = V4_CMD_STREAM;
*p++ = (port >> 8) & 0xff;
*p++ = port & 0xff;
if (vers == NE_SOCK_SOCKSV4A) {
/* A bogus address is used to signify use of the hostname,
* 0.0.0.X where X != 0. */
memcpy(p, "\x00\x00\x00\xff", 4);
}
else {
/* API precondition that addr is IPv4; if it's not this will
* just copy out the first four bytes of the v6 address;
* garbage in => garbage out. */
memcpy(p, ne_iaddr_raw(addr, raw), 4);
}
p += 4;
if (username) {
unsigned int len = strlen(username) & 0xff;
memcpy(p, username, len);
p += len;
}
*p++ = '\0';
if (vers == NE_SOCK_SOCKSV4A) {
unsigned int len = strlen(hostname) & 0xff;
memcpy(p, hostname, len);
p += len;
*p++ = '\0';
}
ret = ne_sock_fullwrite(sock, (char *)msg, p - msg);
if (ret) {
return sofail(sock, ret, _("Could not send message to proxy"));
}
n = ne_sock_fullread(sock, (char *)msg, 8);
if (n) {
return sofail(sock, ret, _("Could not read response from proxy"));
}
if (msg[1] != V4_REP_OK) {
return v4fail(sock, ret, _("Could not connect"));
}
return 0;
}
int ne_sock_proxy(ne_socket *sock, enum ne_sock_sversion vers,
const ne_inet_addr *addr, const char *hostname,
unsigned int port,
const char *username, const char *password)
{
if (vers == NE_SOCK_SOCKSV5) {
return v5_proxy(sock, addr, hostname, port, username, password);
}
else {
return v4_proxy(sock, vers, addr, hostname, port, username);
}
}