[0001]
[0002]
[0003]
[0004]
[0005]
[0006]
[0007]
[0008]
[0009]
[0010]
[0011]
[0012]
[0013]
[0014]
[0015]
[0016]
[0017]
[0018]
[0019]
[0020]
[0021]
[0022]
[0023]
[0024]
[0025]
[0026]
[0027]
[0028]
[0029]
[0030]
[0031]
[0032]
[0033]
[0034]
[0035]
[0036]
[0037]
[0038]
[0039]
[0040]
[0041]
[0042]
[0043]
[0044]
[0045]
[0046]
[0047]
[0048]
[0049]
[0050]
[0051]
[0052]
[0053]
[0054]
[0055]
[0056]
[0057]
[0058]
[0059]
[0060]
[0061]
[0062]
[0063]
[0064]
[0065]
[0066]
[0067]
[0068]
[0069]
[0070]
[0071]
[0072]
[0073]
[0074]
[0075]
[0076]
[0077]
[0078]
[0079]
[0080]
[0081]
[0082]
[0083]
[0084]
[0085]
[0086]
[0087]
[0088]
[0089]
[0090]
[0091]
[0092]
[0093]
[0094]
[0095]
[0096]
[0097]
[0098]
[0099]
[0100]
[0101]
[0102]
[0103]
[0104]
[0105]
[0106]
[0107]
[0108]
[0109]
[0110]
[0111]
[0112]
[0113]
[0114]
[0115]
[0116]
[0117]
[0118]
[0119]
[0120]
[0121]
[0122]
[0123]
[0124]
[0125]
[0126]
[0127]
[0128]
[0129]
[0130]
[0131]
[0132]
[0133]
[0134]
[0135]
[0136]
[0137]
[0138]
[0139]
[0140]
[0141]
[0142]
[0143]
[0144]
[0145]
[0146]
[0147]
[0148]
[0149]
[0150]
[0151]
[0152]
[0153]
[0154]
[0155]
[0156]
[0157]
[0158]
[0159]
[0160]
[0161]
[0162]
[0163]
[0164]
[0165]
[0166]
[0167]
[0168]
[0169]
[0170]
[0171]
[0172]
[0173]
[0174]
[0175]
[0176]
[0177]
[0178]
[0179]
[0180]
[0181]
[0182]
[0183]
[0184]
[0185]
[0186]
[0187]
[0188]
[0189]
[0190]
[0191]
[0192]
[0193]
[0194]
[0195]
[0196]
[0197]
[0198]
[0199]
[0200]
[0201]
[0202]
[0203]
[0204]
[0205]
[0206]
[0207]
[0208]
[0209]
[0210]
[0211]
[0212]
[0213]
[0214]
[0215]
[0216]
[0217]
[0218]
[0219]
[0220]
[0221]
[0222]
[0223]
[0224]
[0225]
[0226]
[0227]
[0228]
[0229]
[0230]
[0231]
[0232]
[0233]
[0234]
[0235]
[0236]
[0237]
[0238]
[0239]
[0240]
[0241]
[0242]
[0243]
[0244]
[0245]
[0246]
[0247]
[0248]
[0249]
[0250]
[0251]
[0252]
[0253]
[0254]
[0255]
[0256]
[0257]
[0258]
[0259]
[0260]
[0261]
[0262]
[0263]
[0264]
[0265]
[0266]
[0267]
[0268]
[0269]
[0270]
[0271]
[0272]
[0273]
[0274]
[0275]
[0276]
[0277]
[0278]
[0279]
[0280]
[0281]
[0282]
[0283]
[0284]
[0285]
[0286]
[0287]
[0288]
[0289]
[0290]
[0291]
[0292]
[0293]
[0294]
[0295]
[0296]
[0297]
[0298]
[0299]
[0300]
[0301]
[0302]
[0303]
[0304]
[0305]
[0306]
[0307]
[0308]
[0309]
[0310]
[0311]
[0312]
[0313]
[0314]
[0315]
[0316]
[0317]
[0318]
[0319]
[0320]
[0321]
[0322]
[0323]
[0324]
[0325]
[0326]
[0327]
[0328]
[0329]
[0330]
[0331]
[0332]
[0333]
[0334]
[0335]
[0336]
[0337]
[0338]
[0339]
[0340]
[0341]
[0342]
[0343]
[0344]
[0345]
[0346]
[0347]
[0348]
[0349]
[0350]
[0351]
[0352]
[0353]
[0354]
[0355]
[0356]
[0357]
[0358]
[0359]
[0360]
[0361]
[0362]
[0363]
[0364]
[0365]
[0366]
[0367]
[0368]
[0369]
[0370]
[0371]
[0372]
[0373]
[0374]
[0375]
[0376]
[0377]
[0378]
[0379]
[0380]
[0381]
[0382]
[0383]
[0384]
[0385]
[0386]
[0387]
[0388]
[0389]
[0390]
[0391]
[0392]
[0393]
[0394]
[0395]
[0396]
[0397]
[0398]
[0399]
[0400]
[0401]
[0402]
[0403]
[0404]
[0405]
[0406]
[0407]
[0408]
[0409]
[0410]
[0411]
[0412]
[0413]
[0414]
[0415]
[0416]
[0417]
[0418]
[0419]
[0420]
[0421]
[0422]
[0423]
[0424]
[0425]
[0426]
[0427]
[0428]
[0429]
[0430]
[0431]
[0432]
[0433]
[0434]
[0435]
[0436]
[0437]
[0438]
[0439]
[0440]
[0441]
[0442]
[0443]
[0444]
[0445]
[0446]
[0447]
[0448]
[0449]
[0450]
[0451]
[0452]
[0453]
[0454]
[0455]
[0456]
[0457]
[0458]
[0459]
[0460]
[0461]
[0462]
[0463]
[0464]
[0465]
[0466]
[0467]
[0468]
[0469]
[0470]
[0471]
[0472]
[0473]
[0474]
[0475]
[0476]
[0477]
[0478]
[0479]
[0480]
[0481]
[0482]
[0483]
[0484]
[0485]
[0486]
[0487]
[0488]
[0489]
[0490]
[0491]
[0492]
[0493]
[0494]
[0495]
[0496]
[0497]
[0498]
[0499]
[0500]
[0501]
[0502]
[0503]
[0504]
[0505]
[0506]
[0507]
[0508]
[0509]
[0510]
[0511]
[0512]
[0513]
[0514]
[0515]
[0516]
[0517]
[0518]
[0519]
[0520]
[0521]
[0522]
[0523]
[0524]
[0525]
[0526]
[0527]
[0528]
[0529]
[0530]
[0531]
[0532]
[0533]
[0534]
[0535]
[0536]
[0537]
[0538]
[0539]
[0540]
[0541]
[0542]
[0543]
[0544]
[0545]
[0546]
[0547]
[0548]
[0549]
[0550]
[0551]
[0552]
[0553]
[0554]
[0555]
[0556]
[0557]
[0558]
[0559]
[0560]
[0561]
/*****************************************************************************/
/*
ProxySocks.c
RFC 1928 SOCKS Version 5 proxy for TCP/IP.
https://tools.ietf.org/html/rfc1928
This module supports only CONNECT TCP/IP and not BIND or UDP-associate.
This is not a "SOCKS5 compliant" implementation since the RFC requires that
compliant implementation MUST support GSSAPI, which this does not.
Username/Password Authentication for SOCKS V5
https://tools.ietf.org/html/rfc1929
VERSION HISTORY
---------------
15-MAR-2021 MGD initial
*/
/*****************************************************************************/
#ifdef WASD_VMS_V7
#undef _VMS__V6__SOURCE
#define _VMS__V6__SOURCE
#undef __VMS_VER
#define __VMS_VER 70000000
#undef __CRTL_VER
#define __CRTL_VER 70000000
#endif
/* standard C header files */
#include <stdio.h>
#include <ctype.h>
/* VMS related header files */
#include <descrip.h>
#include <ssdef.h>
#include <stsdef.h>
#include <secdef.h>
/* application related header files */
#include "wasd.h"
#define WASD_MODULE "PROXYSOCKS"
static char *Socks5Atyp [] = { "*error*", "IPv4", "*error*",
"domain", "IPv6" };
static char *Socks5Cmd [] = { "*error*", "connect", "bind", "udp"};
static char *Socks5Reply [] = { "success", "failure", "ruleset",
"netunreach", "hostunreach", "refused",
"TTLexp", "command", "address" };
/******************/
/* global storage */
/******************/
/********************/
/* external storage */
/********************/
extern int ProxyReadBufferSize;
extern int ToLowerCase[],
ToUpperCase[];
extern char SoftwareID[];
extern PROXY_ACCOUNTING_STRUCT *ProxyAccountingPtr;
extern WATCH_STRUCT Watch;
/****************************************************************************/
/*
Support SOCKS 5 proxy. RFC 1928 Section 3.
*/
void ProxySocks5 (REQUEST_STRUCT *rqptr)
{
static char ReplyAuthNotOk [] = { SOCKS5_VERSION, SOCKS5_AUTH_NOTOK };
static char ReplyAuthOk [] = { SOCKS5_VERSION, 0 };
char cnt, idx;
char *bptr;
/*********/
/* begin */
/*********/
if (WATCHING (rqptr, WATCH_PROXY))
WatchThis (WATCHITM(rqptr), WATCH_PROXY, "SOCKS5 authenticate !UL",
rqptr->rqNet.ReadBufferPtr[1]);
InstanceGblSecIncrLong (&ProxyAccountingPtr->Socks5Count);
cnt = rqptr->rqNet.ReadBufferPtr[1];
bptr = rqptr->rqNet.ReadBufferPtr+2;
for (idx = 0; idx < cnt; idx++)
{
if (rqptr->ServicePtr->ProxyAuthRequired) {
if (bptr[idx] == SOCKS5_AUTH_USERPASS)
break;
}
else
if (bptr[idx] == SOCKS5_AUTH_NONE)
break;
}
if (idx >= cnt)
{
/* no supported authentication method */
NetWrite (rqptr, &RequestEnd5, ReplyAuthNotOk, sizeof(ReplyAuthNotOk));
return;
}
ReplyAuthOk[1] = bptr[idx];
/* reply to the client that authorisation method is supported */
if (bptr[idx] == SOCKS5_AUTH_USERPASS)
{
if (WATCHING (rqptr, WATCH_PROXY))
WatchThis (WATCHITM(rqptr), WATCH_PROXY,
"SOCKS5 authenticate USERPASS");
NetWrite (rqptr, 0, ReplyAuthOk, sizeof(ReplyAuthOk));
NetRead (rqptr, &ProxySocks5BasicAst, rqptr->rqNet.ReadBufferPtr,
rqptr->rqNet.ReadBufferSize);
}
else
NetWrite (rqptr, &ProxySocks5GetRequest,
ReplyAuthOk, sizeof(ReplyAuthOk));
}
/****************************************************************************/
/*
Process the SOCKS 5 basic authentication from the client. RFC 1929 section 2.
+----+------+----------+------+----------+
|VER | ULEN | UNAME | PLEN | PASSWD |
+----+------+----------+------+----------+
| 1 | 1 | 1 to 255 | 1 | 1 to 255 |
+----+------+----------+------+----------+
WASD implements this in a slightly "cunning" fashion (to accomodate the way
WASD proxy authentication operates in general). When the SOCKS client provides
the username and password this is consolidated as a BASIC authentication
base-64 encoded string *temporarily* in rqptr->RemoteUser +
rqptr->RemoteUserPassword storage (not intended purpose), then incorporated
into a Proxy-Authorization: header field when the request is constructed by
ProxySocks5RequestAst().
So, WASD SOCK5 proxy authentication always returns to the client an initial
authentication OK reply and accepts the client's request, from which it builds
the proxy request which includes a Proxy-Authorization: header field with the
previously supplied BASIC authentication. The proxy request is then processed
and if not authorised *then* returns a failure reply. Not optimal but it
works. The reason for the failure (not authorised) can be WATCHed for.
*/
void ProxySocks5BasicAst (REQUEST_STRUCT *rqptr)
{
static char ReplyAuthNotOk [] = { SOCKS5_VERSION, SOCKS5_AUTH_NOTOK };
static char ReplyAuthOk [] = { SOCKS5_VERSION, SOCKS5_AUTH_OK };
int cnt, idx, plen, ulen, b64len;
char *aptr, *bptr, *bzptr, *sptr, *zptr;
char UserPass [256];
/*********/
/* begin */
/*********/
if (VMSnok (rqptr->NetIoPtr->ReadStatus))
{
/* read from client failed */
RequestEnd5 (rqptr);
return;
}
cnt = rqptr->NetIoPtr->ReadCount;
bptr = rqptr->rqNet.ReadBufferPtr;
bzptr = bptr + cnt;
if (*bptr++ != SOCKS5_AUTH_BASIC_VERSION)
{
/* questionable data */
ProxySocks5ReplyFail (rqptr);
RequestEnd5 (rqptr);
return;
}
/* second this storage that will not be used 'til after authorization */
zptr = (sptr = UserPass) + sizeof(UserPass)-1;
for (cnt = *bptr++; cnt-- && bptr < bzptr && sptr < zptr; *sptr++ = *bptr++);
if (cnt >= 0)
{
/* questionable data */
ProxySocks5ReplyFail (rqptr);
RequestEnd5 (rqptr);
return;
}
ulen = sptr - UserPass;
if (sptr < zptr) *sptr++ = ':';
aptr = sptr;
for (cnt = *bptr++; cnt-- && bptr < bzptr && sptr < zptr; *sptr++ = *bptr++);
if (cnt >= 0)
{
/* questionable data */
ProxySocks5ReplyFail (rqptr);
RequestEnd5 (rqptr);
return;
}
plen = sptr - aptr;
*sptr = '\0';
if (WATCHING (rqptr, WATCH_PROXY))
WatchThis (WATCHITM(rqptr), WATCH_PROXY, "SOCKS5 basic !#AZ:!#**",
ulen, UserPass, plen);
b64len = sizeof(rqptr->RemoteUser) + sizeof(rqptr->RemoteUserPassword);
base64_encode (rqptr->RemoteUser, &b64len, UserPass, ulen+1+plen);
NetWrite (rqptr, &ProxySocks5GetRequest, ReplyAuthOk, sizeof(ReplyAuthOk));
}
/****************************************************************************/
/*
Read the SOCKS 5 request from the client. RFC 1928 Section 4.
*/
void ProxySocks5GetRequest (REQUEST_STRUCT *rqptr)
{
/*********/
/* begin */
/*********/
if (VMSnok (rqptr->NetIoPtr->WriteStatus))
{
/* write to client failed */
RequestEnd5 (rqptr);
return;
}
/* read request from client */
NetRead (rqptr, &ProxySocks5RequestAst, rqptr->rqNet.ReadBufferPtr,
rqptr->rqNet.ReadBufferSize);
}
/****************************************************************************/
/*
Client has provided a command. RFC 1928 Section 4.
Process that and if accepted generated a "faked" WASD proxy CONNECT request.
+----+-----+-------+------+----------+----------+
|VER | CMD | RSV | ATYP | DST.ADDR | DST.PORT |
+----+-----+-------+------+----------+----------+
| 1 | 1 | X'00' | 1 | Variable | 2 |
+----+-----+-------+------+----------+----------+
o VER protocol version: X'05'
o CMD
o CONNECT X'01'
o BIND X'02'
o UDP ASSOCIATE X'03'
o RSV RESERVED
o ATYP address type of following address
o IP V4 address: X'01'
o DOMAINNAME: X'03'
o IP V6 address: X'04'
o DST.ADDR desired destination address
o DST.PORT desired destination port in network octet order
*/
void ProxySocks5RequestAst (REQUEST_STRUCT *rqptr)
{
#define STRCAT(string) { \
for (cptr = string; *cptr && sptr < zptr; *sptr++ = *cptr++); \
}
int atyp, cmd, cnt, idx, len;
ulong HostOrder [4];
ushort port;
char *aptr, *bptr, *cptr, *sptr, *zptr;
char dname [128],
sport [8];
/*********/
/* begin */
/*********/
if (VMSnok (rqptr->NetIoPtr->ReadStatus))
{
/* read from client failed */
RequestEnd5 (rqptr);
return;
}
cnt = rqptr->NetIoPtr->ReadCount;
bptr = rqptr->rqNet.ReadBufferPtr;
if (cnt < 10 || bptr[0] != SOCKS5_VERSION)
{
/* questionable data */
ProxySocks5ReplyFail (rqptr);
RequestEnd5 (rqptr);
return;
}
cmd = bptr[1];
if (cmd < 1 || cmd > 3) cmd = 0;
atyp = bptr[3];
if (atyp == SOCKS5_ATYPE_IPV4)
{
HostOrder[0] = *(ULONGPTR)(bptr+4);
port = ntohs(*(USHORTPTR)(bptr+8));
sprintf (sport, ":%d", port);
aptr = TcpIpAddressToString(HostOrder[0],4);
if (cnt != 10) len = 0;
}
else
if (atyp == SOCKS5_ATYPE_DOMAIN)
{
len = bptr[4];
aptr = dname;
zptr = (sptr = dname) + sizeof(dname)-1;
for (cptr = bptr + 5; len && sptr < zptr; len--) *sptr++ = *cptr++;
*sptr = '\0';
port = ntohs(*(USHORTPTR)cptr);
sprintf (sport, ":%d", port);
len = bptr[4] + 7;
if (len != cnt) len = 0;
}
else
if (atyp == SOCKS5_ATYPE_IPV6)
{
HostOrder[0] = *(ULONGPTR)(bptr+4);
HostOrder[1] = *(ULONGPTR)(bptr+8);
HostOrder[2] = *(ULONGPTR)(bptr+12);
HostOrder[3] = *(ULONGPTR)(bptr+16);
port = ntohs(*(USHORTPTR)(bptr+20));
sprintf (sport, ":%d", port);
aptr = TcpIpAddressToString(HostOrder,6);
/* convert ':' to '-' delimited so not to confuse port */
for (cptr = aptr; *cptr; cptr++) if (*cptr == ':') *cptr = '-';
if (cnt != 22) len = 0;
}
else
aptr = len = port = 0;
if (WATCHING (rqptr, WATCH_PROXY))
WatchThis (WATCHITM(rqptr), WATCH_PROXY,
"SOCKS5 !AZ !AZ !AZ port !UL",
Socks5Cmd[cmd], Socks5Atyp[atyp], aptr, port);
/* only SOCKS5 connect requests are supported */
if (!len || cmd != SOCKS5_CMD_CONNECT)
{
ProxySocks5ReplyFail (rqptr);
RequestEnd5 (rqptr);
return;
}
/* fake a CONNECT request */
zptr = (sptr = rqptr->rqNet.ReadBufferPtr) + rqptr->rqNet.ReadBufferSize;
STRCAT ("CONNECT socks5://");
STRCAT (aptr);
STRCAT (sport);
STRCAT (" HTTP/1.1\r\nUser-Agent: ");
STRCAT (SoftwareID);
STRCAT ("\r\nHost: ");
STRCAT (aptr);
STRCAT (sport);
if (rqptr->RemoteUser[0])
{
STRCAT ("\r\nProxy-Authorization: Basic ");
STRCAT (rqptr->RemoteUser);
rqptr->RemoteUser[0] = rqptr->RemoteUserPassword[0] = '\0';
}
STRCAT ("\r\nX-Forwarded-For: ");
STRCAT (rqptr->ClientPtr->IpAddressString);
STRCAT ("\r\nUpgrade: WASD-SOCKS5-");
STRCAT (Socks5Cmd[cmd]);
STRCAT ("-");
STRCAT (Socks5Atyp[atyp]);
STRCAT ("\r\n\r\n");
/* as if it came from the network */
rqptr->NetIoPtr->ReadCount = sptr - rqptr->rqNet.ReadBufferPtr;
/* after this call the request will have a proxy task */
SysDclAst (RequestGet, rqptr);
#undef STRCAT
}
/****************************************************************************/
/*
Provide the client with succeeded/failed reply. RFC 1928 Section 6.
All replies to the client are blocking and synchronous.
+----+-----+-------+------+----------+----------+
|VER | REP | RSV | ATYP | BND.ADDR | BND.PORT |
+----+-----+-------+------+----------+----------+
| 1 | 1 | X'00' | 1 | Variable | 2 |
+----+-----+-------+------+----------+----------+
Where:
o VER protocol version: X'05'
o REP Reply field:
o X'00' succeeded
o X'01' general SOCKS server failure
o X'02' connection not allowed by ruleset
o X'03' Network unreachable
o X'04' Host unreachable
o X'05' Connection refused
o X'06' TTL expired
o X'07' Command not supported
o X'08' Address type not supported
o X'09' to X'FF' unassigned
o RSV RESERVED
o ATYP address type of following address
*/
void ProxySocks5Reply
(
REQUEST_STRUCT *rqptr,
int ReplyField
)
{
int atyp, b_len, port, reply;
uint blen;
ulong Ip4Address;
uchar Ip6Address;
char *aptr, *bptr;
PROXY_TASK *tkptr;
/*********/
/* begin */
/*********/
tkptr = rqptr->ProxyTaskPtr;
if (ReplyField < 0 || ReplyField > SOCKS5_REPLY_ADDRESS)
{
ProxySocks5ReplyFail (rqptr);
ProxySocks5End (rqptr);
return;
}
bptr = tkptr->Socks5Reply;
bptr[0] = SOCKS5_VERSION;
bptr[1] = reply = ReplyField;
bptr[2] = SOCKS5_RESERVED;
if (IPADDRESS_IS_V4 (&tkptr->ConnectIpAddress))
{
bptr[3] = atyp = SOCKS5_ATYPE_IPV4;
bptr += 4;
IPADDRESS_SET4 (&Ip4Address, &tkptr->ConnectIpAddress)
*(ULONGPTR)bptr = Ip4Address;
aptr = TcpIpAddressToString(bptr,4);
bptr += sizeof(Ip4Address);
}
else
if (IPADDRESS_IS_V6 (&tkptr->ConnectIpAddress))
{
bptr[3] = atyp = SOCKS5_ATYPE_IPV6;
bptr += 4;
memset (&Ip6Address, 0, sizeof(Ip6Address));
IPADDRESS_SET6 (Ip6Address, &tkptr->ConnectIpAddress)
memcpy (bptr, &Ip6Address, sizeof(Ip6Address));
aptr = TcpIpAddressToString(bptr,6);
bptr += sizeof(Ip6Address);
}
else
{
ProxySocks5ReplyFail (rqptr);
ProxySocks5End (rqptr);
return;
}
*(USHORTPTR)bptr = port = (ushort)tkptr->ConnectPort;
bptr += 2;
if (!ReplyField)
InstanceGblSecIncrLong (&ProxyAccountingPtr->Socks5SuccessCount);
else
InstanceGblSecIncrLong (&ProxyAccountingPtr->Socks5FailCount);
blen = bptr - tkptr->Socks5Reply;
bptr = tkptr->Socks5Reply;
if (WATCHING (rqptr, WATCH_PROXY))
WatchThis (WATCHITM(rqptr), WATCH_PROXY,
"SOCKS5 !AZ !AZ !AZ port !UL",
Socks5Reply[reply], Socks5Atyp[atyp], aptr, port);
/* blocking with no AST delivery */
NetWrite (rqptr, NULL, bptr, blen);
}
/****************************************************************************/
/*
All replies to the client are blocking and synchronous.
*/
void ProxySocks5ReplyFail (REQUEST_STRUCT *rqptr)
{
static char ReplyFail [] = { SOCKS5_VERSION, SOCKS5_REPLY_FAILURE,
SOCKS5_RESERVED, SOCKS5_ATYPE_IPV4,
0, 0, 0, 0, 0, 0 };
/*********/
/* begin */
/*********/
if (WATCHING (rqptr, WATCH_PROXY))
WatchThis (WATCHITM(rqptr), WATCH_PROXY, "SOCKS5 reply FAIL");
InstanceGblSecIncrLong (&ProxyAccountingPtr->Socks5FailCount);
NetWrite (rqptr, 0, ReplyFail, sizeof(ReplyFail));
}
/****************************************************************************/
/*
Call proxy end from an AST delivering a request pointer.
*/
void ProxySocks5End (REQUEST_STRUCT *rqptr)
{
/*********/
/* begin */
/*********/
ProxyEnd (rqptr->ProxyTaskPtr);
}
/****************************************************************************/
/*
Don't support SOCKS 4 proxy.
*/
void ProxySocks4 (REQUEST_STRUCT *rqptr)
{
static char ReplyNotSup [] = { 4, 91, 0, 0, 0, 0, 0, 0, 0 };
/*********/
/* begin */
/*********/
if (WATCHING (rqptr, WATCH_PROXY))
WatchThis (WATCHITM(rqptr), WATCH_PROXY, "SOCKS4 unsupported");
NetWrite (rqptr, &RequestEnd5, ReplyNotSup, sizeof(ReplyNotSup));
}
/*****************************************************************************/