fedproxy/internal/socks5/request.go

312 lines
7.3 KiB
Go
Raw Permalink Normal View History

2018-08-29 05:06:07 -07:00
package socks5
import (
"fmt"
"io"
"net"
"strconv"
"strings"
"golang.org/x/net/context"
)
const (
ConnectCommand = uint8(1)
BindCommand = uint8(2)
AssociateCommand = uint8(3)
ipv4Address = uint8(1)
fqdnAddress = uint8(3)
ipv6Address = uint8(4)
)
const (
successReply uint8 = iota
serverFailure
ruleFailure
networkUnreachable
hostUnreachable
connectionRefused
ttlExpired
commandNotSupported
addrTypeNotSupported
)
var (
unrecognizedAddrType = fmt.Errorf("Unrecognized address type")
)
// AddrSpec is used to return the target AddrSpec
// which may be specified as IPv4, IPv6, or a FQDN
type AddrSpec struct {
FQDN string
IP net.IP
Port int
}
func (a *AddrSpec) String() string {
if a.FQDN != "" {
return fmt.Sprintf("%s (%s):%d", a.FQDN, a.IP, a.Port)
}
return fmt.Sprintf("%s:%d", a.IP, a.Port)
}
// Address returns a string suitable to dial; prefer returning IP-based
// address, fallback to FQDN
func (a AddrSpec) Address() string {
if 0 != len(a.IP) {
return net.JoinHostPort(a.IP.String(), strconv.Itoa(a.Port))
}
return net.JoinHostPort(a.FQDN, strconv.Itoa(a.Port))
}
// A Request represents request received by a server
type Request struct {
// Protocol version
Version uint8
// Requested command
Command uint8
// AuthContext provided during negotiation
AuthContext *AuthContext
// AddrSpec of the the network that sent the request
RemoteAddr *AddrSpec
// AddrSpec of the desired destination
2018-08-29 05:12:07 -07:00
DestAddr AddrSpec
2018-08-29 05:06:07 -07:00
bufConn io.Reader
}
2018-08-29 05:12:07 -07:00
func (req *Request) ConnectAddress() string {
return req.DestAddr.Address()
}
2018-08-29 05:25:27 -07:00
type socksConn interface {
2018-08-29 05:06:07 -07:00
io.WriteCloser
RemoteAddr() net.Addr
}
2018-08-29 05:25:27 -07:00
// readRequest creates a new Request from the tcp connection
func readRequest(bufConn io.Reader, req *Request) error {
2018-08-29 05:06:07 -07:00
// Read the version byte
header := []byte{0, 0, 0}
if _, err := io.ReadAtLeast(bufConn, header, 3); err != nil {
2018-08-29 05:25:27 -07:00
return fmt.Errorf("Failed to get command version: %v", err)
2018-08-29 05:06:07 -07:00
}
// Ensure we are compatible
if header[0] != socks5Version {
2018-08-29 05:25:27 -07:00
return fmt.Errorf("Unsupported command version: %v", header[0])
2018-08-29 05:06:07 -07:00
}
// Read in the destination address
2018-08-29 05:25:27 -07:00
err := readAddrSpec(bufConn, &req.DestAddr)
2018-08-29 05:06:07 -07:00
if err != nil {
2018-08-29 05:25:27 -07:00
return err
2018-08-29 05:06:07 -07:00
}
2018-08-29 05:25:27 -07:00
req.Version = socks5Version
req.Command = header[1]
req.bufConn = bufConn
return nil
2018-08-29 05:06:07 -07:00
}
// handleRequest is used for request processing after authentication
2018-08-29 05:25:27 -07:00
func (s *Server) handleRequest(req *Request, conn socksConn) error {
2018-08-29 05:06:07 -07:00
ctx := context.Background()
// Switch on the command
switch req.Command {
case ConnectCommand:
return s.handleConnect(ctx, conn, req)
case BindCommand:
return s.handleBind(ctx, conn, req)
default:
if err := sendReply(conn, commandNotSupported, nil); err != nil {
return fmt.Errorf("Failed to send reply: %v", err)
}
return fmt.Errorf("Unsupported command: %v", req.Command)
}
}
// handleConnect is used to handle a connect command
2018-08-29 05:25:27 -07:00
func (s *Server) handleConnect(ctx context.Context, conn socksConn, req *Request) error {
2018-08-29 05:06:07 -07:00
// Check if this is allowed
if ctx_, ok := s.config.Rules.Allow(ctx, req); !ok {
if err := sendReply(conn, ruleFailure, nil); err != nil {
return fmt.Errorf("Failed to send reply: %v", err)
}
return fmt.Errorf("Connect to %v blocked by rules", req.DestAddr)
} else {
ctx = ctx_
}
// Attempt to connect
dial := s.config.Dial
if dial == nil {
2018-08-29 05:25:27 -07:00
dial = func(addr string) (net.Conn, error) {
return net.Dial("tcp", addr)
2018-08-29 05:06:07 -07:00
}
}
2018-08-29 05:25:27 -07:00
target, err := dial(req.ConnectAddress())
2018-08-29 05:06:07 -07:00
if err != nil {
msg := err.Error()
resp := hostUnreachable
if strings.Contains(msg, "refused") {
resp = connectionRefused
} else if strings.Contains(msg, "network is unreachable") {
resp = networkUnreachable
}
if err := sendReply(conn, resp, nil); err != nil {
return fmt.Errorf("Failed to send reply: %v", err)
}
return fmt.Errorf("Connect to %v failed: %v", req.DestAddr, err)
}
defer target.Close()
// Send success
local := target.LocalAddr().(*net.TCPAddr)
bind := AddrSpec{IP: local.IP, Port: local.Port}
if err := sendReply(conn, successReply, &bind); err != nil {
return fmt.Errorf("Failed to send reply: %v", err)
}
// Start proxying
errCh := make(chan error, 2)
go proxy(target, req.bufConn, errCh)
go proxy(conn, target, errCh)
// Wait
for i := 0; i < 2; i++ {
e := <-errCh
if e != nil {
// return from this function closes target (and conn).
return e
}
}
return nil
}
// handleBind is used to handle a connect command
2018-08-29 05:25:27 -07:00
func (s *Server) handleBind(ctx context.Context, conn socksConn, req *Request) error {
2018-08-29 05:06:07 -07:00
// Check if this is allowed
if ctx_, ok := s.config.Rules.Allow(ctx, req); !ok {
if err := sendReply(conn, ruleFailure, nil); err != nil {
return fmt.Errorf("Failed to send reply: %v", err)
}
return fmt.Errorf("Bind to %v blocked by rules", req.DestAddr)
} else {
ctx = ctx_
}
// TODO: Support bind
if err := sendReply(conn, commandNotSupported, nil); err != nil {
return fmt.Errorf("Failed to send reply: %v", err)
}
return nil
}
// readAddrSpec is used to read AddrSpec.
// Expects an address type byte, follwed by the address and port
2018-08-29 05:25:27 -07:00
func readAddrSpec(r io.Reader, d *AddrSpec) error {
2018-08-29 05:06:07 -07:00
// Get the address type
addrType := []byte{0}
if _, err := r.Read(addrType); err != nil {
2018-08-29 05:25:27 -07:00
return err
2018-08-29 05:06:07 -07:00
}
// Handle on a per type basis
switch addrType[0] {
case ipv4Address:
addr := make([]byte, 4)
if _, err := io.ReadAtLeast(r, addr, len(addr)); err != nil {
2018-08-29 05:25:27 -07:00
return err
2018-08-29 05:06:07 -07:00
}
d.IP = net.IP(addr)
case ipv6Address:
addr := make([]byte, 16)
if _, err := io.ReadAtLeast(r, addr, len(addr)); err != nil {
2018-08-29 05:25:27 -07:00
return err
2018-08-29 05:06:07 -07:00
}
d.IP = net.IP(addr)
case fqdnAddress:
if _, err := r.Read(addrType); err != nil {
2018-08-29 05:25:27 -07:00
return err
2018-08-29 05:06:07 -07:00
}
addrLen := int(addrType[0])
fqdn := make([]byte, addrLen)
if _, err := io.ReadAtLeast(r, fqdn, addrLen); err != nil {
2018-08-29 05:25:27 -07:00
return err
2018-08-29 05:06:07 -07:00
}
d.FQDN = string(fqdn)
default:
2018-08-29 05:25:27 -07:00
return unrecognizedAddrType
2018-08-29 05:06:07 -07:00
}
// Read the port
port := []byte{0, 0}
if _, err := io.ReadAtLeast(r, port, 2); err != nil {
2018-08-29 05:25:27 -07:00
return err
2018-08-29 05:06:07 -07:00
}
d.Port = (int(port[0]) << 8) | int(port[1])
2018-08-29 05:25:27 -07:00
return nil
2018-08-29 05:06:07 -07:00
}
// sendReply is used to send a reply message
func sendReply(w io.Writer, resp uint8, addr *AddrSpec) error {
// Format the address
var addrType uint8
var addrBody []byte
var addrPort uint16
switch {
case addr == nil:
addrType = ipv4Address
addrBody = []byte{0, 0, 0, 0}
addrPort = 0
case addr.FQDN != "":
addrType = fqdnAddress
addrBody = append([]byte{byte(len(addr.FQDN))}, addr.FQDN...)
addrPort = uint16(addr.Port)
case addr.IP.To4() != nil:
addrType = ipv4Address
addrBody = []byte(addr.IP.To4())
addrPort = uint16(addr.Port)
case addr.IP.To16() != nil:
addrType = ipv6Address
addrBody = []byte(addr.IP.To16())
addrPort = uint16(addr.Port)
default:
return fmt.Errorf("Failed to format address: %v", addr)
}
// Format the message
msg := make([]byte, 6+len(addrBody))
msg[0] = socks5Version
msg[1] = resp
msg[2] = 0 // Reserved
msg[3] = addrType
copy(msg[4:], addrBody)
msg[4+len(addrBody)] = byte(addrPort >> 8)
msg[4+len(addrBody)+1] = byte(addrPort & 0xff)
// Send the message
_, err := w.Write(msg)
return err
}
// proxy is used to suffle data from src to destination, and sends errors
// down a dedicated channel
2018-08-29 05:25:27 -07:00
func proxy(dst socksConn, src io.Reader, errCh chan error) {
2018-08-29 05:06:07 -07:00
var buf [1024 * 4]byte
_, err := io.CopyBuffer(dst, src, buf[:])
2018-08-29 05:25:27 -07:00
dst.Close()
2018-08-29 05:06:07 -07:00
errCh <- err
}