summaryrefslogtreecommitdiff
path: root/src/usr.bin/nc/socks.c
diff options
context:
space:
mode:
authorcvs2svn <admin@example.com>2008-07-28 23:44:12 +0000
committercvs2svn <admin@example.com>2008-07-28 23:44:12 +0000
commitdaac2f633f49a45baa8412c5e4e71e594236e7b8 (patch)
treec2b7593b6807015d5bd1bbe95841e718a3b3df42 /src/usr.bin/nc/socks.c
parent10837c3c47f1b9d7d1a061fff2327a4e280ba338 (diff)
downloadopenbsd-pre_openssl_0_9_8h.tar.gz
openbsd-pre_openssl_0_9_8h.tar.bz2
openbsd-pre_openssl_0_9_8h.zip
This commit was manufactured by cvs2git to create tag 'pre_openssl_0_9_8h'.pre_openssl_0_9_8h
Diffstat (limited to 'src/usr.bin/nc/socks.c')
-rw-r--r--src/usr.bin/nc/socks.c326
1 files changed, 0 insertions, 326 deletions
diff --git a/src/usr.bin/nc/socks.c b/src/usr.bin/nc/socks.c
deleted file mode 100644
index da7bd0c60e..0000000000
--- a/src/usr.bin/nc/socks.c
+++ /dev/null
@@ -1,326 +0,0 @@
1/* $OpenBSD: socks.c,v 1.17 2006/09/25 04:51:20 ray Exp $ */
2
3/*
4 * Copyright (c) 1999 Niklas Hallqvist. All rights reserved.
5 * Copyright (c) 2004, 2005 Damien Miller. All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in the
14 * documentation and/or other materials provided with the distribution.
15 *
16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
17 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
18 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
19 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
20 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
21 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
22 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
23 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
24 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
25 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
26 */
27
28#include <sys/types.h>
29#include <sys/socket.h>
30#include <netinet/in.h>
31#include <arpa/inet.h>
32
33#include <err.h>
34#include <errno.h>
35#include <netdb.h>
36#include <stdio.h>
37#include <stdlib.h>
38#include <string.h>
39#include <unistd.h>
40#include <resolv.h>
41#include <readpassphrase.h>
42#include "atomicio.h"
43
44#define SOCKS_PORT "1080"
45#define HTTP_PROXY_PORT "3128"
46#define HTTP_MAXHDRS 64
47#define SOCKS_V5 5
48#define SOCKS_V4 4
49#define SOCKS_NOAUTH 0
50#define SOCKS_NOMETHOD 0xff
51#define SOCKS_CONNECT 1
52#define SOCKS_IPV4 1
53#define SOCKS_DOMAIN 3
54#define SOCKS_IPV6 4
55
56int remote_connect(const char *, const char *, struct addrinfo);
57int socks_connect(const char *, const char *, struct addrinfo,
58 const char *, const char *, struct addrinfo, int,
59 const char *);
60
61static int
62decode_addrport(const char *h, const char *p, struct sockaddr *addr,
63 socklen_t addrlen, int v4only, int numeric)
64{
65 int r;
66 struct addrinfo hints, *res;
67
68 bzero(&hints, sizeof(hints));
69 hints.ai_family = v4only ? PF_INET : PF_UNSPEC;
70 hints.ai_flags = numeric ? AI_NUMERICHOST : 0;
71 hints.ai_socktype = SOCK_STREAM;
72 r = getaddrinfo(h, p, &hints, &res);
73 /* Don't fatal when attempting to convert a numeric address */
74 if (r != 0) {
75 if (!numeric) {
76 errx(1, "getaddrinfo(\"%.64s\", \"%.64s\"): %s", h, p,
77 gai_strerror(r));
78 }
79 return (-1);
80 }
81 if (addrlen < res->ai_addrlen) {
82 freeaddrinfo(res);
83 errx(1, "internal error: addrlen < res->ai_addrlen");
84 }
85 memcpy(addr, res->ai_addr, res->ai_addrlen);
86 freeaddrinfo(res);
87 return (0);
88}
89
90static int
91proxy_read_line(int fd, char *buf, size_t bufsz)
92{
93 size_t off;
94
95 for(off = 0;;) {
96 if (off >= bufsz)
97 errx(1, "proxy read too long");
98 if (atomicio(read, fd, buf + off, 1) != 1)
99 err(1, "proxy read");
100 /* Skip CR */
101 if (buf[off] == '\r')
102 continue;
103 if (buf[off] == '\n') {
104 buf[off] = '\0';
105 break;
106 }
107 off++;
108 }
109 return (off);
110}
111
112static const char *
113getproxypass(const char *proxyuser, const char *proxyhost)
114{
115 char prompt[512];
116 static char pw[256];
117
118 snprintf(prompt, sizeof(prompt), "Proxy password for %s@%s: ",
119 proxyuser, proxyhost);
120 if (readpassphrase(prompt, pw, sizeof(pw), RPP_REQUIRE_TTY) == NULL)
121 errx(1, "Unable to read proxy passphrase");
122 return (pw);
123}
124
125int
126socks_connect(const char *host, const char *port,
127 struct addrinfo hints __attribute__ ((__unused__)),
128 const char *proxyhost, const char *proxyport, struct addrinfo proxyhints,
129 int socksv, const char *proxyuser)
130{
131 int proxyfd, r, authretry = 0;
132 size_t hlen, wlen;
133 unsigned char buf[1024];
134 size_t cnt;
135 struct sockaddr_storage addr;
136 struct sockaddr_in *in4 = (struct sockaddr_in *)&addr;
137 struct sockaddr_in6 *in6 = (struct sockaddr_in6 *)&addr;
138 in_port_t serverport;
139 const char *proxypass = NULL;
140
141 if (proxyport == NULL)
142 proxyport = (socksv == -1) ? HTTP_PROXY_PORT : SOCKS_PORT;
143
144 /* Abuse API to lookup port */
145 if (decode_addrport("0.0.0.0", port, (struct sockaddr *)&addr,
146 sizeof(addr), 1, 1) == -1)
147 errx(1, "unknown port \"%.64s\"", port);
148 serverport = in4->sin_port;
149
150 again:
151 if (authretry++ > 3)
152 errx(1, "Too many authentication failures");
153
154 proxyfd = remote_connect(proxyhost, proxyport, proxyhints);
155
156 if (proxyfd < 0)
157 return (-1);
158
159 if (socksv == 5) {
160 if (decode_addrport(host, port, (struct sockaddr *)&addr,
161 sizeof(addr), 0, 1) == -1)
162 addr.ss_family = 0; /* used in switch below */
163
164 /* Version 5, one method: no authentication */
165 buf[0] = SOCKS_V5;
166 buf[1] = 1;
167 buf[2] = SOCKS_NOAUTH;
168 cnt = atomicio(vwrite, proxyfd, buf, 3);
169 if (cnt != 3)
170 err(1, "write failed (%d/3)", cnt);
171
172 cnt = atomicio(read, proxyfd, buf, 2);
173 if (cnt != 2)
174 err(1, "read failed (%d/3)", cnt);
175
176 if (buf[1] == SOCKS_NOMETHOD)
177 errx(1, "authentication method negotiation failed");
178
179 switch (addr.ss_family) {
180 case 0:
181 /* Version 5, connect: domain name */
182
183 /* Max domain name length is 255 bytes */
184 hlen = strlen(host);
185 if (hlen > 255)
186 errx(1, "host name too long for SOCKS5");
187 buf[0] = SOCKS_V5;
188 buf[1] = SOCKS_CONNECT;
189 buf[2] = 0;
190 buf[3] = SOCKS_DOMAIN;
191 buf[4] = hlen;
192 memcpy(buf + 5, host, hlen);
193 memcpy(buf + 5 + hlen, &serverport, sizeof serverport);
194 wlen = 7 + hlen;
195 break;
196 case AF_INET:
197 /* Version 5, connect: IPv4 address */
198 buf[0] = SOCKS_V5;
199 buf[1] = SOCKS_CONNECT;
200 buf[2] = 0;
201 buf[3] = SOCKS_IPV4;
202 memcpy(buf + 4, &in4->sin_addr, sizeof in4->sin_addr);
203 memcpy(buf + 8, &in4->sin_port, sizeof in4->sin_port);
204 wlen = 10;
205 break;
206 case AF_INET6:
207 /* Version 5, connect: IPv6 address */
208 buf[0] = SOCKS_V5;
209 buf[1] = SOCKS_CONNECT;
210 buf[2] = 0;
211 buf[3] = SOCKS_IPV6;
212 memcpy(buf + 4, &in6->sin6_addr, sizeof in6->sin6_addr);
213 memcpy(buf + 20, &in6->sin6_port,
214 sizeof in6->sin6_port);
215 wlen = 22;
216 break;
217 default:
218 errx(1, "internal error: silly AF");
219 }
220
221 cnt = atomicio(vwrite, proxyfd, buf, wlen);
222 if (cnt != wlen)
223 err(1, "write failed (%d/%d)", cnt, wlen);
224
225 cnt = atomicio(read, proxyfd, buf, 10);
226 if (cnt != 10)
227 err(1, "read failed (%d/10)", cnt);
228 if (buf[1] != 0)
229 errx(1, "connection failed, SOCKS error %d", buf[1]);
230 } else if (socksv == 4) {
231 /* This will exit on lookup failure */
232 decode_addrport(host, port, (struct sockaddr *)&addr,
233 sizeof(addr), 1, 0);
234
235 /* Version 4 */
236 buf[0] = SOCKS_V4;
237 buf[1] = SOCKS_CONNECT; /* connect */
238 memcpy(buf + 2, &in4->sin_port, sizeof in4->sin_port);
239 memcpy(buf + 4, &in4->sin_addr, sizeof in4->sin_addr);
240 buf[8] = 0; /* empty username */
241 wlen = 9;
242
243 cnt = atomicio(vwrite, proxyfd, buf, wlen);
244 if (cnt != wlen)
245 err(1, "write failed (%d/%d)", cnt, wlen);
246
247 cnt = atomicio(read, proxyfd, buf, 8);
248 if (cnt != 8)
249 err(1, "read failed (%d/8)", cnt);
250 if (buf[1] != 90)
251 errx(1, "connection failed, SOCKS error %d", buf[1]);
252 } else if (socksv == -1) {
253 /* HTTP proxy CONNECT */
254
255 /* Disallow bad chars in hostname */
256 if (strcspn(host, "\r\n\t []:") != strlen(host))
257 errx(1, "Invalid hostname");
258
259 /* Try to be sane about numeric IPv6 addresses */
260 if (strchr(host, ':') != NULL) {
261 r = snprintf(buf, sizeof(buf),
262 "CONNECT [%s]:%d HTTP/1.0\r\n",
263 host, ntohs(serverport));
264 } else {
265 r = snprintf(buf, sizeof(buf),
266 "CONNECT %s:%d HTTP/1.0\r\n",
267 host, ntohs(serverport));
268 }
269 if (r == -1 || (size_t)r >= sizeof(buf))
270 errx(1, "hostname too long");
271 r = strlen(buf);
272
273 cnt = atomicio(vwrite, proxyfd, buf, r);
274 if (cnt != r)
275 err(1, "write failed (%d/%d)", cnt, r);
276
277 if (authretry > 1) {
278 char resp[1024];
279
280 proxypass = getproxypass(proxyuser, proxyhost);
281 r = snprintf(buf, sizeof(buf), "%s:%s",
282 proxyuser, proxypass);
283 if (r == -1 || (size_t)r >= sizeof(buf) ||
284 b64_ntop(buf, strlen(buf), resp,
285 sizeof(resp)) == -1)
286 errx(1, "Proxy username/password too long");
287 r = snprintf(buf, sizeof(buf), "Proxy-Authorization: "
288 "Basic %s\r\n", resp);
289 if (r == -1 || (size_t)r >= sizeof(buf))
290 errx(1, "Proxy auth response too long");
291 r = strlen(buf);
292 if ((cnt = atomicio(vwrite, proxyfd, buf, r)) != r)
293 err(1, "write failed (%d/%d)", cnt, r);
294 }
295
296 /* Terminate headers */
297 if ((r = atomicio(vwrite, proxyfd, "\r\n", 2)) != 2)
298 err(1, "write failed (2/%d)", r);
299
300 /* Read status reply */
301 proxy_read_line(proxyfd, buf, sizeof(buf));
302 if (proxyuser != NULL &&
303 strncmp(buf, "HTTP/1.0 407 ", 12) == 0) {
304 if (authretry > 1) {
305 fprintf(stderr, "Proxy authentication "
306 "failed\n");
307 }
308 close(proxyfd);
309 goto again;
310 } else if (strncmp(buf, "HTTP/1.0 200 ", 12) != 0 &&
311 strncmp(buf, "HTTP/1.1 200 ", 12) != 0)
312 errx(1, "Proxy error: \"%s\"", buf);
313
314 /* Headers continue until we hit an empty line */
315 for (r = 0; r < HTTP_MAXHDRS; r++) {
316 proxy_read_line(proxyfd, buf, sizeof(buf));
317 if (*buf == '\0')
318 break;
319 }
320 if (*buf != '\0')
321 errx(1, "Too many proxy headers received");
322 } else
323 errx(1, "Unknown proxy protocol %d", socksv);
324
325 return (proxyfd);
326}
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2026-08-31 06:24:48 +0000