2014-01-23 19:29:13 +00:00
|
|
|
package socks5
|
|
|
|
|
|
|
|
import (
|
2014-01-23 20:04:20 +00:00
|
|
|
"fmt"
|
|
|
|
"io"
|
2014-01-23 21:42:35 +00:00
|
|
|
"log"
|
2014-01-23 19:29:13 +00:00
|
|
|
"net"
|
2014-01-23 21:42:35 +00:00
|
|
|
"strings"
|
2014-01-23 22:07:39 +00:00
|
|
|
"time"
|
2014-01-23 19:29:13 +00:00
|
|
|
)
|
|
|
|
|
2014-01-23 20:04:20 +00:00
|
|
|
const (
|
|
|
|
connectCommand = uint8(1)
|
|
|
|
bindCommand = uint8(2)
|
|
|
|
associateCommand = uint8(3)
|
|
|
|
ipv4Address = uint8(1)
|
|
|
|
fqdnAddress = uint8(3)
|
|
|
|
ipv6Address = uint8(4)
|
|
|
|
)
|
|
|
|
|
|
|
|
const (
|
2014-02-13 18:49:35 +00:00
|
|
|
successReply uint8 = iota
|
2014-01-23 20:04:20 +00:00
|
|
|
serverFailure
|
|
|
|
ruleFailure
|
|
|
|
networkUnreachable
|
|
|
|
hostUnreachable
|
|
|
|
connectionRefused
|
|
|
|
ttlExpired
|
|
|
|
commandNotSupported
|
|
|
|
addrTypeNotSupported
|
|
|
|
)
|
|
|
|
|
|
|
|
var (
|
|
|
|
unrecognizedAddrType = fmt.Errorf("Unrecognized address type")
|
|
|
|
)
|
|
|
|
|
2014-01-24 00:55:08 +00:00
|
|
|
// AddressRewriter is used to rewrite a destination transparently
|
|
|
|
type AddressRewriter interface {
|
|
|
|
Rewrite(addr *AddrSpec) *AddrSpec
|
|
|
|
}
|
|
|
|
|
2014-01-24 00:46:32 +00:00
|
|
|
// AddrSpec is used to return the target AddrSpec
|
2014-01-23 20:04:20 +00:00
|
|
|
// which may be specified as IPv4, IPv6, or a FQDN
|
2014-01-24 00:46:32 +00:00
|
|
|
type AddrSpec struct {
|
|
|
|
FQDN string
|
|
|
|
IP net.IP
|
|
|
|
Port int
|
2014-01-23 20:04:20 +00:00
|
|
|
}
|
|
|
|
|
2014-01-23 22:07:39 +00:00
|
|
|
type conn interface {
|
|
|
|
Write([]byte) (int, error)
|
|
|
|
RemoteAddr() net.Addr
|
|
|
|
}
|
|
|
|
|
2014-01-24 00:46:32 +00:00
|
|
|
func (a *AddrSpec) String() string {
|
|
|
|
if a.FQDN != "" {
|
|
|
|
return fmt.Sprintf("%s (%s):%d", a.FQDN, a.IP, a.Port)
|
2014-01-23 21:11:58 +00:00
|
|
|
}
|
2014-01-24 00:46:32 +00:00
|
|
|
return fmt.Sprintf("%s:%d", a.IP, a.Port)
|
2014-01-23 21:11:58 +00:00
|
|
|
}
|
|
|
|
|
2014-01-23 19:29:13 +00:00
|
|
|
// handleRequest is used for request processing after authentication
|
2014-01-23 22:07:39 +00:00
|
|
|
func (s *Server) handleRequest(conn conn, bufConn io.Reader) error {
|
2014-01-23 20:04:20 +00:00
|
|
|
// Read the version byte
|
|
|
|
header := []byte{0, 0, 0}
|
|
|
|
if _, err := io.ReadAtLeast(bufConn, header, 3); err != nil {
|
|
|
|
return fmt.Errorf("Failed to get command version: %v", err)
|
|
|
|
}
|
|
|
|
|
|
|
|
// Ensure we are compatible
|
|
|
|
if header[0] != socks5Version {
|
|
|
|
return fmt.Errorf("Unsupported command version: %v", header[0])
|
|
|
|
}
|
|
|
|
|
|
|
|
// Read in the destination address
|
|
|
|
dest, err := readAddrSpec(bufConn)
|
|
|
|
if err != nil {
|
|
|
|
if err == unrecognizedAddrType {
|
|
|
|
if err := sendReply(conn, addrTypeNotSupported, nil); err != nil {
|
|
|
|
return fmt.Errorf("Failed to send reply: %v", err)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
return fmt.Errorf("Failed to read destination address: %v", err)
|
|
|
|
}
|
|
|
|
|
2014-01-23 21:11:58 +00:00
|
|
|
// Resolve the address if we have a FQDN
|
2014-01-24 00:46:32 +00:00
|
|
|
if dest.FQDN != "" {
|
|
|
|
addr, err := s.config.Resolver.Resolve(dest.FQDN)
|
2014-01-23 21:11:58 +00:00
|
|
|
if err != nil {
|
2014-01-24 22:31:58 +00:00
|
|
|
if err := sendReply(conn, hostUnreachable, nil); err != nil {
|
2014-01-23 21:11:58 +00:00
|
|
|
return fmt.Errorf("Failed to send reply: %v", err)
|
|
|
|
}
|
2014-01-24 00:46:32 +00:00
|
|
|
return fmt.Errorf("Failed to resolve destination '%v': %v", dest.FQDN, err)
|
2014-01-23 21:11:58 +00:00
|
|
|
}
|
2014-01-24 00:46:32 +00:00
|
|
|
dest.IP = addr
|
2014-01-23 21:11:58 +00:00
|
|
|
}
|
|
|
|
|
2014-01-24 00:55:08 +00:00
|
|
|
// Apply any address rewrites
|
|
|
|
realDest := dest
|
|
|
|
if s.config.Rewriter != nil {
|
|
|
|
realDest = s.config.Rewriter.Rewrite(dest)
|
|
|
|
}
|
2014-01-24 00:46:32 +00:00
|
|
|
|
2014-01-23 20:04:20 +00:00
|
|
|
// Switch on the command
|
|
|
|
switch header[1] {
|
|
|
|
case connectCommand:
|
2014-01-24 00:55:08 +00:00
|
|
|
return s.handleConnect(conn, bufConn, dest, realDest)
|
2014-01-23 20:04:20 +00:00
|
|
|
case bindCommand:
|
2014-01-24 00:55:08 +00:00
|
|
|
return s.handleBind(conn, bufConn, dest, realDest)
|
2014-01-23 20:04:20 +00:00
|
|
|
case associateCommand:
|
2014-01-24 00:55:08 +00:00
|
|
|
return s.handleAssociate(conn, bufConn, dest, realDest)
|
2014-01-23 20:04:20 +00:00
|
|
|
default:
|
2014-01-24 22:31:58 +00:00
|
|
|
if err := sendReply(conn, commandNotSupported, nil); err != nil {
|
2014-01-23 21:42:35 +00:00
|
|
|
return fmt.Errorf("Failed to send reply: %v", err)
|
|
|
|
}
|
2014-01-23 20:04:20 +00:00
|
|
|
return fmt.Errorf("Unsupported command: %v", header[1])
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// handleConnect is used to handle a connect command
|
2014-01-24 00:55:08 +00:00
|
|
|
func (s *Server) handleConnect(conn conn, bufConn io.Reader, dest, realDest *AddrSpec) error {
|
2014-01-23 21:11:58 +00:00
|
|
|
// Check if this is allowed
|
|
|
|
client := conn.RemoteAddr().(*net.TCPAddr)
|
2014-01-24 00:55:08 +00:00
|
|
|
if !s.config.Rules.AllowConnect(realDest.IP, realDest.Port, client.IP, client.Port) {
|
2014-01-24 22:31:58 +00:00
|
|
|
if err := sendReply(conn, ruleFailure, nil); err != nil {
|
2014-01-23 21:11:58 +00:00
|
|
|
return fmt.Errorf("Failed to send reply: %v", err)
|
|
|
|
}
|
|
|
|
return fmt.Errorf("Connect to %v blocked by rules", dest)
|
|
|
|
}
|
|
|
|
|
2014-01-23 21:42:35 +00:00
|
|
|
// Attempt to connect
|
2014-01-24 00:55:08 +00:00
|
|
|
addr := net.TCPAddr{IP: realDest.IP, Port: realDest.Port}
|
2014-01-23 21:42:35 +00:00
|
|
|
target, err := net.DialTCP("tcp", nil, &addr)
|
|
|
|
if err != nil {
|
|
|
|
msg := err.Error()
|
|
|
|
resp := hostUnreachable
|
|
|
|
if strings.Contains(msg, "refused") {
|
|
|
|
resp = connectionRefused
|
|
|
|
} else if strings.Contains(msg, "network is unreachable") {
|
|
|
|
resp = networkUnreachable
|
|
|
|
}
|
2014-01-24 22:31:58 +00:00
|
|
|
if err := sendReply(conn, resp, nil); err != nil {
|
2014-01-23 21:42:35 +00:00
|
|
|
return fmt.Errorf("Failed to send reply: %v", err)
|
|
|
|
}
|
|
|
|
return fmt.Errorf("Connect to %v failed: %v", dest, err)
|
|
|
|
}
|
|
|
|
defer target.Close()
|
|
|
|
|
|
|
|
// Send success
|
2014-01-24 22:31:58 +00:00
|
|
|
local := target.LocalAddr().(*net.TCPAddr)
|
|
|
|
bind := AddrSpec{IP: local.IP, Port: local.Port}
|
|
|
|
if err := sendReply(conn, successReply, &bind); err != nil {
|
2014-01-23 21:42:35 +00:00
|
|
|
return fmt.Errorf("Failed to send reply: %v", err)
|
|
|
|
}
|
|
|
|
|
|
|
|
// Start proxying
|
|
|
|
errCh := make(chan error, 2)
|
2015-09-06 23:47:05 +00:00
|
|
|
go proxy("target", target, bufConn, errCh, s.config.Logger)
|
|
|
|
go proxy("client", conn, target, errCh, s.config.Logger)
|
2014-01-23 21:42:35 +00:00
|
|
|
|
|
|
|
// Wait
|
|
|
|
select {
|
|
|
|
case e := <-errCh:
|
|
|
|
return e
|
|
|
|
}
|
2014-01-23 20:04:20 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
// handleBind is used to handle a connect command
|
2014-01-24 00:55:08 +00:00
|
|
|
func (s *Server) handleBind(conn conn, bufConn io.Reader, dest, realDest *AddrSpec) error {
|
2014-01-23 21:11:58 +00:00
|
|
|
// Check if this is allowed
|
|
|
|
client := conn.RemoteAddr().(*net.TCPAddr)
|
2014-01-24 00:55:08 +00:00
|
|
|
if !s.config.Rules.AllowBind(realDest.IP, realDest.Port, client.IP, client.Port) {
|
2014-01-24 22:31:58 +00:00
|
|
|
if err := sendReply(conn, ruleFailure, nil); err != nil {
|
2014-01-23 21:11:58 +00:00
|
|
|
return fmt.Errorf("Failed to send reply: %v", err)
|
|
|
|
}
|
|
|
|
return fmt.Errorf("Bind to %v blocked by rules", dest)
|
|
|
|
}
|
|
|
|
|
2014-01-23 21:42:35 +00:00
|
|
|
// TODO: Support bind
|
2014-01-24 22:31:58 +00:00
|
|
|
if err := sendReply(conn, commandNotSupported, nil); err != nil {
|
2014-01-23 21:42:35 +00:00
|
|
|
return fmt.Errorf("Failed to send reply: %v", err)
|
|
|
|
}
|
2014-01-23 20:04:20 +00:00
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
|
|
|
// handleAssociate is used to handle a connect command
|
2014-01-24 00:55:08 +00:00
|
|
|
func (s *Server) handleAssociate(conn conn, bufConn io.Reader, dest, realDest *AddrSpec) error {
|
2014-01-23 21:11:58 +00:00
|
|
|
// Check if this is allowed
|
|
|
|
client := conn.RemoteAddr().(*net.TCPAddr)
|
2014-01-24 00:55:08 +00:00
|
|
|
if !s.config.Rules.AllowAssociate(realDest.IP, realDest.Port, client.IP, client.Port) {
|
2014-01-24 22:31:58 +00:00
|
|
|
if err := sendReply(conn, ruleFailure, nil); err != nil {
|
2014-01-23 21:11:58 +00:00
|
|
|
return fmt.Errorf("Failed to send reply: %v", err)
|
|
|
|
}
|
|
|
|
return fmt.Errorf("Associate to %v blocked by rules", dest)
|
|
|
|
}
|
|
|
|
|
2014-01-23 21:42:35 +00:00
|
|
|
// TODO: Support associate
|
2014-01-24 22:31:58 +00:00
|
|
|
if err := sendReply(conn, commandNotSupported, nil); err != nil {
|
2014-01-23 21:42:35 +00:00
|
|
|
return fmt.Errorf("Failed to send reply: %v", err)
|
|
|
|
}
|
2014-01-23 19:29:13 +00:00
|
|
|
return nil
|
|
|
|
}
|
2014-01-23 20:04:20 +00:00
|
|
|
|
2014-01-24 00:46:32 +00:00
|
|
|
// readAddrSpec is used to read AddrSpec.
|
2014-01-23 20:04:20 +00:00
|
|
|
// Expects an address type byte, follwed by the address and port
|
2014-01-24 00:46:32 +00:00
|
|
|
func readAddrSpec(r io.Reader) (*AddrSpec, error) {
|
|
|
|
d := &AddrSpec{}
|
2014-01-23 20:04:20 +00:00
|
|
|
|
|
|
|
// Get the address type
|
|
|
|
addrType := []byte{0}
|
|
|
|
if _, err := r.Read(addrType); err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
|
|
|
// Handle on a per type basis
|
|
|
|
switch addrType[0] {
|
|
|
|
case ipv4Address:
|
|
|
|
addr := make([]byte, 4)
|
|
|
|
if _, err := io.ReadAtLeast(r, addr, len(addr)); err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
2014-01-24 00:46:32 +00:00
|
|
|
d.IP = net.IP(addr)
|
2014-01-23 20:04:20 +00:00
|
|
|
|
|
|
|
case ipv6Address:
|
|
|
|
addr := make([]byte, 16)
|
|
|
|
if _, err := io.ReadAtLeast(r, addr, len(addr)); err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
2014-01-24 00:46:32 +00:00
|
|
|
d.IP = net.IP(addr)
|
2014-01-23 20:04:20 +00:00
|
|
|
|
|
|
|
case fqdnAddress:
|
|
|
|
if _, err := r.Read(addrType); err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
addrLen := int(addrType[0])
|
|
|
|
fqdn := make([]byte, addrLen)
|
|
|
|
if _, err := io.ReadAtLeast(r, fqdn, addrLen); err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
2014-01-24 00:46:32 +00:00
|
|
|
d.FQDN = string(fqdn)
|
2014-01-23 20:04:20 +00:00
|
|
|
|
|
|
|
default:
|
|
|
|
return nil, unrecognizedAddrType
|
|
|
|
}
|
|
|
|
|
|
|
|
// Read the port
|
|
|
|
port := []byte{0, 0}
|
|
|
|
if _, err := io.ReadAtLeast(r, port, 2); err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
2014-01-24 22:31:58 +00:00
|
|
|
d.Port = (int(port[0]) << 8) | int(port[1])
|
2014-01-23 20:04:20 +00:00
|
|
|
|
|
|
|
return d, nil
|
|
|
|
}
|
|
|
|
|
|
|
|
// sendReply is used to send a reply message
|
2014-01-24 00:46:32 +00:00
|
|
|
func sendReply(w io.Writer, resp uint8, addr *AddrSpec) error {
|
2014-01-23 20:04:20 +00:00
|
|
|
// Format the address
|
|
|
|
var addrType uint8
|
|
|
|
var addrBody []byte
|
2014-01-24 00:23:59 +00:00
|
|
|
var addrPort uint16
|
2014-01-23 20:04:20 +00:00
|
|
|
switch {
|
|
|
|
case addr == nil:
|
2014-01-24 22:20:55 +00:00
|
|
|
addrType = ipv4Address
|
|
|
|
addrBody = []byte{0, 0, 0, 0}
|
|
|
|
addrPort = 0
|
2014-01-23 20:04:20 +00:00
|
|
|
|
2014-01-24 00:46:32 +00:00
|
|
|
case addr.FQDN != "":
|
2014-01-23 20:04:20 +00:00
|
|
|
addrType = fqdnAddress
|
2014-01-24 00:46:32 +00:00
|
|
|
addrBody = append([]byte{byte(len(addr.FQDN))}, addr.FQDN...)
|
|
|
|
addrPort = uint16(addr.Port)
|
2014-01-23 20:04:20 +00:00
|
|
|
|
2014-01-24 00:46:32 +00:00
|
|
|
case addr.IP.To4() != nil:
|
2014-01-23 20:04:20 +00:00
|
|
|
addrType = ipv4Address
|
2014-01-24 00:46:32 +00:00
|
|
|
addrBody = []byte(addr.IP.To4())
|
|
|
|
addrPort = uint16(addr.Port)
|
2014-01-23 20:04:20 +00:00
|
|
|
|
2014-01-24 00:46:32 +00:00
|
|
|
case addr.IP.To16() != nil:
|
2014-01-23 20:04:20 +00:00
|
|
|
addrType = ipv6Address
|
2014-01-24 00:46:32 +00:00
|
|
|
addrBody = []byte(addr.IP.To16())
|
|
|
|
addrPort = uint16(addr.Port)
|
2014-01-23 20:04:20 +00:00
|
|
|
|
|
|
|
default:
|
|
|
|
return fmt.Errorf("Failed to format address: %v", addr)
|
|
|
|
}
|
|
|
|
|
|
|
|
// Format the message
|
|
|
|
msg := make([]byte, 6+len(addrBody))
|
|
|
|
msg[0] = socks5Version
|
|
|
|
msg[1] = resp
|
|
|
|
msg[2] = 0 // Reserved
|
|
|
|
msg[3] = addrType
|
|
|
|
copy(msg[4:], addrBody)
|
2014-01-24 22:31:58 +00:00
|
|
|
msg[4+len(addrBody)] = byte(addrPort >> 8)
|
|
|
|
msg[4+len(addrBody)+1] = byte(addrPort & 0xff)
|
2014-01-23 20:04:20 +00:00
|
|
|
|
|
|
|
// Send the message
|
|
|
|
_, err := w.Write(msg)
|
|
|
|
return err
|
|
|
|
}
|
2014-01-23 21:42:35 +00:00
|
|
|
|
|
|
|
// proxy is used to suffle data from src to destination, and sends errors
|
|
|
|
// down a dedicated channel
|
2015-09-06 23:47:05 +00:00
|
|
|
func proxy(name string, dst io.Writer, src io.Reader, errCh chan error, logger *log.Logger) {
|
2014-01-23 22:07:39 +00:00
|
|
|
// Copy
|
2014-01-23 21:42:35 +00:00
|
|
|
n, err := io.Copy(dst, src)
|
2014-01-23 22:07:39 +00:00
|
|
|
|
|
|
|
// Log, and sleep. This is jank but allows the otherside
|
|
|
|
// to finish a pending copy
|
2015-09-06 23:47:05 +00:00
|
|
|
logger.Printf("[DEBUG] socks: Copied %d bytes to %s", n, name)
|
2014-01-23 22:07:39 +00:00
|
|
|
time.Sleep(10 * time.Millisecond)
|
|
|
|
|
|
|
|
// Send any errors
|
|
|
|
errCh <- err
|
2014-01-23 21:42:35 +00:00
|
|
|
}
|