- tor-commits - lists.torproject.org

[tor/maint-0.2.2] Remove the -F option from tor-resolve.
by nickm＠torproject.org 28 May '11

28 May '11

commit 57810c333a38c72c1e361c02e31de7712d1f221a Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon May 23 16:59:41 2011 -0400 Remove the -F option from tor-resolve. It used to mean "Force": it would tell tor-resolve to ask tor to resolve an address even if it ended with .onion. But when AutomapHostsOnResolve was added, automatically refusing to resolve .onion hosts stopped making sense. So in 0.2.1.16-rc (commit 298dc95dfd8), we made tor-resolve happy to resolve anything. The -F option stayed in, though, even though it didn't do anything. Oddly, it never got documented. Found while fixing GCC 4.6 "set, unused variable" warnings. --- changes/bug3208 | 4 ++++ src/tools/tor-resolve.c | 4 +--- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/changes/bug3208 b/changes/bug3208 new file mode 100644 index 0000000..731c96e --- /dev/null +++ b/changes/bug3208 @@ -0,0 +1,4 @@ + o Removed options: + - Remove undocumented option "-F" from tor-resolve: it hasn't done + anything since 0.2.1.16-rc. + diff --git a/src/tools/tor-resolve.c b/src/tools/tor-resolve.c index 12349d9..8c4d3f6 100644 --- a/src/tools/tor-resolve.c +++ b/src/tools/tor-resolve.c @@ -319,7 +319,7 @@ main(int argc, char **argv) { uint32_t sockshost; uint16_t socksport = 0, port_option = 0; - int isSocks4 = 0, isVerbose = 0, isReverse = 0, force = 0; + int isSocks4 = 0, isVerbose = 0, isReverse = 0; char **arg; int n_args; struct in_addr a; @@ -349,8 +349,6 @@ main(int argc, char **argv) isSocks4 = 0; else if (!strcmp("-x", arg[0])) isReverse = 1; - else if (!strcmp("-F", arg[0])) - force = 1; else if (!strcmp("-p", arg[0])) { int p; if (n_args < 2) {

1 0

[tor/maint-0.2.2] Fix GCC 4.6's new -Wunused-but-set-variable warnings.
by nickm＠torproject.org 28 May '11

28 May '11

commit a5232e0c4c572cdff85701f698b8b90c9443d7e4 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon May 23 17:04:38 2011 -0400 Fix GCC 4.6's new -Wunused-but-set-variable warnings. Most instances were dead code; for those, I removed the assignments. Some were pieces of info we don't currently plan to use, but which we might in the future. For those, I added an explicit cast-to-void to indicate that we know that the thing's unused. Finally, one was a case where we were testing the wrong variable in a unit test. That one I fixed. This resolves bug 3208. --- changes/bug3208 | 2 ++ src/or/circuitbuild.c | 3 --- src/or/command.c | 1 + src/or/control.c | 2 -- src/or/directory.c | 2 -- src/or/dirvote.c | 3 +-- src/or/eventdns.c | 3 +++ src/test/test_crypto.c | 4 +++- 8 files changed, 10 insertions(+), 10 deletions(-) diff --git a/changes/bug3208 b/changes/bug3208 index 731c96e..fd737ba 100644 --- a/changes/bug3208 +++ b/changes/bug3208 @@ -2,3 +2,5 @@ - Remove undocumented option "-F" from tor-resolve: it hasn't done anything since 0.2.1.16-rc. + o Minor bugfixes: + - Fix warnings from GCC 4.6's "-Wunused-but-set-variable" option. diff --git a/src/or/circuitbuild.c b/src/or/circuitbuild.c index 08bfb98..108007e 100644 --- a/src/or/circuitbuild.c +++ b/src/or/circuitbuild.c @@ -3766,7 +3766,6 @@ void entry_guards_compute_status(or_options_t *options, time_t now) { int changed = 0; - int severity = LOG_DEBUG; digestmap_t *reasons; if (! entry_guards) @@ -3793,8 +3792,6 @@ entry_guards_compute_status(or_options_t *options, time_t now) if (remove_dead_entry_guards(now)) changed = 1; - severity = changed ? LOG_DEBUG : LOG_INFO; - if (changed) { SMARTLIST_FOREACH_BEGIN(entry_guards, entry_guard_t *, entry) { const char *reason = digestmap_get(reasons, entry->identity); diff --git a/src/or/command.c b/src/or/command.c index 00d9af3..e377f4f 100644 --- a/src/or/command.c +++ b/src/or/command.c @@ -645,6 +645,7 @@ command_process_netinfo_cell(cell_t *cell, or_connection_t *conn) /* XXX maybe act on my_apparent_addr, if the source is sufficiently * trustworthy. */ + (void)my_apparent_addr; if (connection_or_set_state_open(conn)<0) connection_mark_for_close(TO_CONN(conn)); diff --git a/src/or/control.c b/src/or/control.c index 0dad1b9..f75ac67 100644 --- a/src/or/control.c +++ b/src/or/control.c @@ -3142,7 +3142,6 @@ control_event_circuit_status(origin_circuit_t *circ, circuit_status_event_t tp, { const char *status; char extended_buf[96]; - int providing_reason=0; if (!EVENT_IS_INTERESTING(EVENT_CIRCUIT_STATUS)) return 0; tor_assert(circ); @@ -3166,7 +3165,6 @@ control_event_circuit_status(origin_circuit_t *circ, circuit_status_event_t tp, const char *reason_str = circuit_end_reason_to_control_string(reason_code); char *reason = NULL; size_t n=strlen(extended_buf); - providing_reason=1; if (!reason_str) { reason = tor_malloc(16); tor_snprintf(reason, 16, "UNKNOWN_%d", reason_code); diff --git a/src/or/directory.c b/src/or/directory.c index eb99e9d..ff0a5a4 100644 --- a/src/or/directory.c +++ b/src/or/directory.c @@ -1900,7 +1900,6 @@ connection_dir_client_reached_eof(dir_connection_t *conn) router_get_trusteddirserver_by_digest(conn->identity_digest); char *rejected_hdr = http_get_header(headers, "X-Descriptor-Not-New: "); - int rejected = 0; if (rejected_hdr) { if (!strcmp(rejected_hdr, "Yes")) { log_info(LD_GENERAL, @@ -1913,7 +1912,6 @@ connection_dir_client_reached_eof(dir_connection_t *conn) * last descriptor, not on the published time of the last * descriptor. If those are different, that's a bad thing to * do. -NM */ - rejected = 1; } tor_free(rejected_hdr); } diff --git a/src/or/dirvote.c b/src/or/dirvote.c index 96e3df5..c6ce9f6 100644 --- a/src/or/dirvote.c +++ b/src/or/dirvote.c @@ -1592,7 +1592,7 @@ networkstatus_compute_consensus(smartlist_t *votes, * is the same flag as votes[j]->known_flags[b]. */ int *named_flag; /* Index of the flag "Named" for votes[j] */ int *unnamed_flag; /* Index of the flag "Unnamed" for votes[j] */ - int chosen_named_idx, chosen_unnamed_idx; + int chosen_named_idx; strmap_t *name_to_id_map = strmap_new(); char conflict[DIGEST_LEN]; @@ -1610,7 +1610,6 @@ networkstatus_compute_consensus(smartlist_t *votes, for (i = 0; i < smartlist_len(votes); ++i) unnamed_flag[i] = named_flag[i] = -1; chosen_named_idx = smartlist_string_pos(flags, "Named"); - chosen_unnamed_idx = smartlist_string_pos(flags, "Unnamed"); /* Build the flag index. */ SMARTLIST_FOREACH(votes, networkstatus_t *, v, diff --git a/src/or/eventdns.c b/src/or/eventdns.c index fc005df..b7cc292 100644 --- a/src/or/eventdns.c +++ b/src/or/eventdns.c @@ -1028,6 +1028,9 @@ request_parse(u8 *packet, ssize_t length, struct evdns_server_port *port, struct GET16(answers); GET16(authority); GET16(additional); + (void)additional; + (void)authority; + (void)answers; if (flags & 0x8000) return -1; /* Must not be an answer. */ flags &= 0x0110; /* Only RD and CD get preserved. */ diff --git a/src/test/test_crypto.c b/src/test/test_crypto.c index 781081a..bf2cc48 100644 --- a/src/test/test_crypto.c +++ b/src/test/test_crypto.c @@ -69,7 +69,7 @@ test_crypto_rng(void) uint64_t big; char *host; j = crypto_rand_int(100); - if (i < 0 || i >= 100) + if (j < 0 || j >= 100) allok = 0; big = crypto_rand_uint64(U64_LITERAL(1)<<40); if (big >= (U64_LITERAL(1)<<40)) @@ -240,11 +240,13 @@ test_crypto_sha(void) /* Test SHA-1 with a test vector from the specification. */ i = crypto_digest(data, "abc", 3); test_memeq_hex(data, "A9993E364706816ABA3E25717850C26C9CD0D89D"); + tt_int_op(i, ==, 0); /* Test SHA-256 with a test vector from the specification. */ i = crypto_digest256(data, "abc", 3, DIGEST_SHA256); test_memeq_hex(data, "BA7816BF8F01CFEA414140DE5DAE2223B00361A3" "96177A9CB410FF61F20015AD"); + tt_int_op(i, ==, 0); /* Test HMAC-SHA-1 with test cases from RFC2202. */

1 0

[obfsproxy/master] Beautified protocol-spec.txt a little bit
by nickm＠torproject.org 28 May '11

28 May '11

commit 7f5ce7fefff37b6559db5451c3d1b097629e6d6b Author: George Kadianakis <desnacked(a)gmail.com> Date: Fri May 27 19:42:08 2011 +0200 Beautified protocol-spec.txt a little bit --- doc/protocol-spec.txt | 41 ++++++++++++++++++++++++----------------- 1 files changed, 24 insertions(+), 17 deletions(-) diff --git a/doc/protocol-spec.txt b/doc/protocol-spec.txt index 9a7d4fa..471f2c0 100644 --- a/doc/protocol-spec.txt +++ b/doc/protocol-spec.txt @@ -16,13 +16,13 @@ The Twobfuscator 1. Primitives, notation, and constants. - H(x) is SHA256 of X - E_K(s) is the AES-counter-mode encryption of s using the key K. + H(x) is SHA256 of x. + E_K(s) is the AES-CTR-128 encryption of s using K as key. - x | y is the concatenation of x and y - UINT32(n) is the 4 byte value of n in big-endian (network) order - SR(n) is n bytes of strong random data - WR(n) is n bytes of weaker random data + x | y is the concatenation of x and y. + UINT32(n) is the 4 byte value of n in big-endian (network) order. + SR(n) is n bytes of strong random data. + WR(n) is n bytes of weaker random data. "xyz" is the ASCII characters 'x', 'y', and 'z', not NUL-terminated. s[:n] is the first n bytes of s. s[n:] is the last n bytes of s. @@ -44,9 +44,9 @@ The Twobfuscator 2. Key establishment phase. - The party who opens the connection is the initiator; the one who - accepts it is the responder. Each begins by generating a seed and - a padding key as follows. The initiator generates: + The party who opens the connection is the 'initiator'; the one who + accepts it is the 'responder'. Each begins by generating a seed + and a padding key as follows. The initiator generates: INIT_SEED = SR(SEED_LENGTH) INIT_PAD_KEY = MAC("Initiator obfuscation padding", INIT_SEED)[:KEYLEN] @@ -57,17 +57,24 @@ The Twobfuscator RESP_PAD_KEY = MAC("Responder obfuscation padding", INIT_SEED)[:KEYLEN] Each then generates a random number PADLEN in range from 0 through - MAX_PADDING (inclusive), and sends: + MAX_PADDING (inclusive). - SEED | E_PAD_KEY( UINT32(MAGIC_VALUE) | UINT32(PADLEN) | WR(PADLEN) ) + The initiator then sends: + + SEED | INIT_PAD_KEY( UINT32(MAGIC_VALUE) | UINT32(PADLEN) | WR(PADLEN) ) + + and the responder replies with: + + SEED | RESP_PAD_KEY( UINT32(MAGIC_VALUE) | UINT32(PADLEN) | WR(PADLEN) ) Upon receiving the SEED from the other party, each party derives - the other party's PAD_KEY value as above, and decrypts the next 8 - bytes of the key establishment message. If the MAGIC_VALUE does not - match, or the PADLEN value is greater than MAX_PADDING, the party - receiving it should wait for a random amount of time then close the - connection. Otherwise, it should read the remaining PADLEN bytes of - padding data and discard them. + the other party's padding key value as above, and decrypts the next + 8 bytes of the key establishment message. If the MAGIC_VALUE does + not match, or the PADLEN value is greater than MAX_PADDING, the + party receiving it should wait for a random amount of time (with + maximum wait time being 4 seconds) then close the connection. + Otherwise, it should read the remaining PADLEN bytes of padding data + and discard them. Additional keys are then derived as:

1 0

[obfsproxy/master] Added a first sample of what should become obfs2's threat model.
by nickm＠torproject.org 28 May '11

28 May '11

commit 368073564058981453e3c7a9e3b175ab463e27f5 Author: George Kadianakis <desnacked(a)gmail.com> Date: Fri May 27 19:48:30 2011 +0200 Added a first sample of what should become obfs2's threat model. doc/THREAT_MODEL is a practical list of attacks that obfs2 counters or fails to counter. doc/THREAT_MODEL_PHILOSOPHICAL is a non-practical document of wannabe academia rambling that might prove useful in the future. Of course both files are not in the correct dir since they only refer to obfs2 and not to obfsproxy, but hey! --- doc/THREAT_MODEL | 19 ++++++++ doc/THREAT_MODEL_PHILOSOPHICAL | 99 ++++++++++++++++++++++++++++++++++++++++ 2 files changed, 118 insertions(+), 0 deletions(-) diff --git a/doc/THREAT_MODEL b/doc/THREAT_MODEL new file mode 100644 index 0000000..d973317 --- /dev/null +++ b/doc/THREAT_MODEL @@ -0,0 +1,19 @@ +obfs2 was created to work on top of the Tor protocol (and specifically +it's TLS handshake phase). Do not use obfs2 to obfuscate other +protocols, unless you are super-sure of what you are doing. + +A list follows, of known attacks that obfs2 protects or does not +protect against. obfs2 does not protect you against unknown attacks. + +Attacks obfs2 protects against: +* Non-intelligent DPI boxes censoring based on TLS content patterns. +* In the case of a shared secret, it also protects against intelligent DPI boxes. + +Attacks obfs2 does not protect against: +* Any distinguisher based on the Tor protocol. This includes timing, packet + size and replay attacks. +* Any distinguisher based on packet entropy. +* In the case of obfs2 without a shared secret, obfs2 does not protect + against an intelligent DPI box; a DPI box that simply deobfuscates + the obfs2 protocol (for those not familiar with the protocol: this + is quite easy.). diff --git a/doc/THREAT_MODEL_PHILOSOPHICAL b/doc/THREAT_MODEL_PHILOSOPHICAL new file mode 100644 index 0000000..d67af1b --- /dev/null +++ b/doc/THREAT_MODEL_PHILOSOPHICAL @@ -0,0 +1,99 @@ + Role of this document + +The role of this document is to give a clear image of what obfs2 +provides to a censored Tor user. +The role of this document is *not* to describe the censorship ecosystem, +or to analyze the full threat model of Tor. + + Terminology +* Censorship: + 'Censorship is the suppression of speech or other public + communication which may be considered objectionable, harmful, + sensitive, or inconvenient to the general body of people as + determined by a government, media outlet, or other controlling + body.' +* Anonymity + Anonymity is the state of an individual's personal identity being + publicly unknown. Anonymity does not imply Privacy. +* Tor + Tor is a software system and a computer network intended to provide + online anonymity. It's main application is 'tor'. +* Privacy + Privacy is used to prevent the disclosure of information to + unauthorized individuals or systems. Privacy does not imply + Anonymity. +* Tor bridge + A Tor bridge is a component of the tor network that is not publicly + announced as part of it. It's main purpose is Censorship + circumvention since finding and blocking a bridge is considered + non-trivial. +* obfsproxy + obfsproxy is an application that accepts data as input and can + reshape it into another form. + When used with tor, it can transform tor's traffic into other + protocols in the hope of dodging Censorship. +* obfs2 + obfs2 is a protocol supported by obfsproxy. It shapes data by + encrypting them with a stream cipher with a randomly generated + key. It also supports pre-shared passwords. + + Players: +* Censored tor/obfsproxy user: + A censored tor/obfsproxy user is an Internet user that is censored + by 'A Man In The Middle'. He wants to use tor to achieve anonymity, + but he also needs privacy, to hide the fact that he is using Tor. +* Bridge Operator: + A bridge operator is a person who runs a tor bridge and has + successfully given to the 'Censored tor/obfsproxy user' the necessary + information so that the latter can access the bridge service. +* A Man In The Middle (MITM): + A MITM is a person or a group of people who have the power to + apply Censorship. + + What Tor does and does not provide: + +Once he is a member of the Tor network a censored Tor user can expect +low-latency anonymity. A Tor user can also expect Privacy with regards +to A Man In The Middle, when he is a member of the Tor network. + +The problem is that before and while becoming a member of the Tor +network the user is *not* anonymous and his communications with the +Tor network are *not* private. This allows A Man In The Middle to +identify the Tor user and censor him/her. + + What obfs2 does and does not provide: + +A Tor user using obfs2 with a Tor Bridge *without* a pre-shared password +can expect low quality privacy on his communications with the Tor +network before becoming part of it. +'low quality privacy' means that A Man In The Middle who has studied +the obfs2 protocol can easily decipher it, effectively extinguishing +the privacy. + +A Tor user using obfs2 with a Tor Bridge *with* a pre-shared password +can expect modest privacy on his communications with the Tor network +before becoming part of it. +'modest privacy' means that A Man In The Middle who has studied the +obfs2 protocol should not be able to decipher it. +Still one should know that: +* Because of the nature of the protocol, it is susceptible to offline + password cracking attacks. +* It is the responsibility of the user and the bridge operator to + decide upon a strong pre-shared password. + +After becoming part of the Tor network, the user is considered +anonymous and his communication private, with regards to A Man In The +Middle, under normal circumstances. + +Since the realm of anti-censorship is quite young and +not well studied, the obfs2 user should be aware that there are known +and unknown attacks that can potentially identify obfs2 and can be +deployed by A Man In The Middle. Known attacks like that include +entropy counting and timing attacks. + +Additionally, a Tor user using obfs2 with a Tor bridge must *not* +expect additional entity authentication, data integrity, availability +or deniability. + +Finally, a Tor user using obfs2 with a Tor bridge must *not* expect +protection from flows of the Tor protocol.

1 0

[obfsproxy/master] Merge remote-tracking branch 'asn/bug3288'
by nickm＠torproject.org 28 May '11

28 May '11

commit 8ac51f3f334b4d2116a8ddcea04483dfc5358b26 Merge: 3d988b6 3680735 Author: Nick Mathewson <nickm(a)torproject.org> Date: Sat May 28 00:35:42 2011 -0400 Merge remote-tracking branch 'asn/bug3288' doc/THREAT_MODEL | 19 ++++++++ doc/THREAT_MODEL_PHILOSOPHICAL | 99 ++++++++++++++++++++++++++++++++++++++++ doc/protocol-spec.txt | 41 ++++++++++------- 3 files changed, 142 insertions(+), 17 deletions(-)

1 0

[obfsproxy/master] We can now send 'SOCKS5_FAILED_UNSUPPORTED' replies as well!
by nickm＠torproject.org 28 May '11

28 May '11

commit 7eb36a85f4884668a259040e5dcb2350ed3b0595 Author: George Kadianakis <desnacked(a)gmail.com> Date: Tue May 24 16:43:28 2011 +0200 We can now send 'SOCKS5_FAILED_UNSUPPORTED' replies as well! --- src/network.c | 13 +++++++++++-- src/socks.c | 22 ++++++++++++---------- src/socks.h | 3 +++ 3 files changed, 26 insertions(+), 12 deletions(-) diff --git a/src/network.c b/src/network.c index 835dff1..1f68804 100644 --- a/src/network.c +++ b/src/network.c @@ -268,6 +268,15 @@ socks_read_cb(struct bufferevent *bev, void *arg) return; /* need to read more data. */ else if (r == -1) conn_free(conn); /* XXXX maybe send socks reply */ + else if (r == -2) { + bufferevent_enable(bev, EV_WRITE); + bufferevent_disable(bev, EV_READ); + socks5_send_reply(bufferevent_get_output(bev), conn->socks_state, + SOCKS5_FAILED_UNSUPPORTED); + bufferevent_setcb(bev, NULL, + close_conn_on_flush, output_event_cb, conn); + return; + } } static void @@ -399,8 +408,8 @@ output_event_cb(struct bufferevent *bev, short what, void *arg) * socks client */ socks_state_set_address(conn->socks_state, sa); } - socks_send_reply(conn->socks_state, bufferevent_get_output(conn->input), - 0); + socks_send_reply(conn->socks_state, + bufferevent_get_output(conn->input), 0); /* we sent a socks reply. We can finally move over to being a regular input bufferevent. */ socks_state_free(conn->socks_state); diff --git a/src/socks.c b/src/socks.c index a388363..367c2f1 100644 --- a/src/socks.c +++ b/src/socks.c @@ -90,13 +90,13 @@ socks_errno_to_reply(socks_state_t *state, int error) return SOCKS5_FAILED_GENERAL; } } - } - return -1; + } else + return -1; } /** Takes a command request from 'source', it evaluates it and if it's - legit it parses into 'parsereq'. + legit it parses it into 'parsereq'. It returns '1' if everything went fine. It returns '0' if we need more data from the client. @@ -138,6 +138,7 @@ socks5_handle_request(struct evbuffer *source, struct parsereq *parsereq) printf("socks: Corrupted packet. Discarding.\n"); goto err; } + if (p[1] != SOCKS5_CMD_CONNECT) return -2; /* We must send reply to the client. */ @@ -495,13 +496,14 @@ handle_socks(struct evbuffer *source, struct evbuffer *dest, if (socks_state->state == ST_NEGOTIATION_DONE) { /* We know this connection. Let's see what it wants. */ r = socks5_handle_request(source,&socks_state->parsereq); - if (r == -1) - goto broken; - else if (r == -2) { - socks5_send_reply(dest,socks_state, - SOCKS5_FAILED_UNSUPPORTED); + if (r == -2) { /* Request CMD != CONNECT. */ + socks_state->broken = 1; + return -2; + } else if (r == -1) /* Broken request. */ goto broken; - } else if (r == 1) + else if (r == 0) /* Incomplete. */ + return 0; + else if (r == 1) /* Neat request. */ socks_state->state = ST_HAVE_ADDR; return r; } @@ -565,6 +567,7 @@ socks_state_set_address(socks_state_t *state, const struct sockaddr *sa) } /** + This function sends a SOCKS{5,4} "Server Reply" to 'dest'. 'error' is 0 if no errors were encountered during the SOCKS operation (normally a CONNECT with no errors means that the connect() was successful). @@ -582,4 +585,3 @@ socks_send_reply(socks_state_t *state, struct evbuffer *dest, int error) else return -1; } - diff --git a/src/socks.h b/src/socks.h index 01a76ff..09ebe28 100644 --- a/src/socks.h +++ b/src/socks.h @@ -28,6 +28,9 @@ int socks_state_get_address(const socks_state_t *state, int *port_out); int socks_state_set_address(socks_state_t *state, const struct sockaddr *sa); int socks_send_reply(socks_state_t *state, struct evbuffer *dest, int error); +int socks5_send_reply(struct evbuffer *reply_dest, + socks_state_t *state, int status); + #define SOCKS_SUCCESS 0x0 #define SOCKS_FAILED 0x01

1 0

[obfsproxy/master] Added support for more SOCKS5 replies.
by nickm＠torproject.org 28 May '11

28 May '11

commit 891596713a8868b1d05b3fbfefc8b8674feb8b7a Author: George Kadianakis <desnacked(a)gmail.com> Date: Tue May 24 05:18:04 2011 +0200 Added support for more SOCKS5 replies. --- src/network.c | 4 +- src/socks.c | 121 +++++++++++++++++++++++++++++++++------------ src/socks.h | 12 +++- src/test/unittest_socks.c | 37 ++++++++++++-- 4 files changed, 134 insertions(+), 40 deletions(-) diff --git a/src/network.c b/src/network.c index 7b017b5..835dff1 100644 --- a/src/network.c +++ b/src/network.c @@ -358,7 +358,7 @@ output_event_cb(struct bufferevent *bev, short what, void *arg) bufferevent_enable(conn->input, EV_WRITE); bufferevent_disable(conn->input, EV_READ); socks_send_reply(conn->socks_state, bufferevent_get_output(conn->input), - SOCKS_FAILED); + EVUTIL_SOCKET_ERROR()); bufferevent_setcb(conn->input, NULL, close_conn_on_flush, output_event_cb, conn); return; @@ -400,7 +400,7 @@ output_event_cb(struct bufferevent *bev, short what, void *arg) socks_state_set_address(conn->socks_state, sa); } socks_send_reply(conn->socks_state, bufferevent_get_output(conn->input), - SOCKS_SUCCESS); + 0); /* we sent a socks reply. We can finally move over to being a regular input bufferevent. */ socks_state_free(conn->socks_state); diff --git a/src/socks.c b/src/socks.c index 5d73965..a388363 100644 --- a/src/socks.c +++ b/src/socks.c @@ -6,6 +6,7 @@ #include <string.h> #include <stdlib.h> #include <stdio.h> +#include <errno.h> #define SOCKS_PRIVATE #include "socks.h" @@ -34,7 +35,7 @@ "Method Negotiation Packet" is handled by: socks5_handle_negotiation() "Method Negotiation Reply" is done by: socks5_do_negotiation() "Client request" is handled by: socks5_handle_request() - "Server reply" is done by: socks5_send_reply + "Server reply" is done by: socks5_send_reply() */ static int socks5_do_negotiation(struct evbuffer *dest, @@ -59,20 +60,53 @@ socks_state_free(socks_state_t *s) memset(s,0x0b, sizeof(socks_state_t)); free(s); } + /** - This function handles connection requests by authenticated SOCKS - clients. - Considering a request packet from 'source', it evaluates it and pushes - the appropriate reply to 'dest'. - If the request was correct and can be fulfilled, it connects 'output' - to the location the client specified to actually set up the proxying. - - XXX: You will notice some "sizeof(req)-1" that initially make no - sense, but because of handle_socks() removing the version byte, - there are only 3 bytes (==sizeof(req)-1) between the start - of 'source' and addrlen. I don't know if replacing it with plain "3" - would make more sense. + This function receives an errno(3) 'error' and returns the reply + code that should be sent to the SOCKS client. + If 'error' is 0 it means that no errors were encountered, and + SOCKS{4,5}_SUCCESS is returned. +*/ +static int +socks_errno_to_reply(socks_state_t *state, int error) +{ + if (state->version == SOCKS4_VERSION) { + if (!error) + return SOCKS4_SUCCESS; + else + return SOCKS4_FAILED; + } else if (state->version == SOCKS5_VERSION) { + if (!error) + return SOCKS5_SUCCESS; + else { + switch (error) { + case ENETUNREACH: + return SOCKS5_FAILED_NETUNREACH; + case EHOSTUNREACH: + return SOCKS5_FAILED_HOSTUNREACH; + case ECONNREFUSED: + return SOCKS5_FAILED_REFUSED; + default: + return SOCKS5_FAILED_GENERAL; + } + } + } + return -1; +} +/** + Takes a command request from 'source', it evaluates it and if it's + legit it parses into 'parsereq'. + + It returns '1' if everything went fine. + It returns '0' if we need more data from the client. + It returns '-1' if we didn't like something. + It returns '-2' if the client asked for something else than CONNECT. + If that's the case we should send a reply back to the client + telling him that we don't support it. + + Disclaimer: This is just a temporary documentation. + Client Request (Client -> Server) */ int @@ -100,10 +134,12 @@ socks5_handle_request(struct evbuffer *source, struct parsereq *parsereq) /* p[0] = Version p[1] = Command field p[2] = Reserved field */ - if (p[0] != SOCKS5_VERSION || p[1] != SOCKS5_CMD_CONNECT || p[2] != 0x00) { - printf("socks: Only CONNECT supported. Sowwy!\n"); + if (p[0] != SOCKS5_VERSION || p[2] != 0x00) { + printf("socks: Corrupted packet. Discarding.\n"); goto err; } + if (p[1] != SOCKS5_CMD_CONNECT) + return -2; /* We must send reply to the client. */ unsigned int addrlen,af,extralen=0; /* p[3] is Address type field */ @@ -183,7 +219,6 @@ int socks5_send_reply(struct evbuffer *reply_dest, socks_state_t *state, int status) { - /* This is the buffer that contains our reply to the client. */ uchar p[4]; uchar addr[16]; const char *extra = NULL; @@ -193,19 +228,31 @@ socks5_send_reply(struct evbuffer *reply_dest, socks_state_t *state, Either way, we should send something back to the client */ p[0] = SOCKS5_VERSION; /* Version field */ /* Reply field */ - p[1] = (status == SOCKS_SUCCESS) ? SOCKS5_SUCCESS : SOCKS5_FAILED; + p[1] = status; p[2] = 0; /* Reserved */ - if (state->parsereq.af == AF_UNSPEC) { - addrlen = 1; - addr[0] = strlen(state->parsereq.addr); - extra = state->parsereq.addr; - p[3] = SOCKS5_ATYP_FQDN; + + /* If status is SOCKS5_FAILED_UNSUPPORTED, it means that we failed + before populating state->parsereq. We will just feel the rest + of the reply packet with zeroes and ship it off. + */ + if (status == SOCKS5_FAILED_UNSUPPORTED) { + addrlen = 4; + p[3] = SOCKS5_ATYP_IPV4; + memset(addr,'\x00',4); + port = 0; } else { - addrlen = (state->parsereq.af == AF_INET) ? 4 : 16; - p[3] = (state->parsereq.af == AF_INET) ? SOCKS5_ATYP_IPV4 : SOCKS5_ATYP_IPV6; - evutil_inet_pton(state->parsereq.af, state->parsereq.addr, addr); + if (state->parsereq.af == AF_UNSPEC) { + addrlen = 1; + addr[0] = strlen(state->parsereq.addr); + extra = state->parsereq.addr; + p[3] = SOCKS5_ATYP_FQDN; + } else { + addrlen = (state->parsereq.af == AF_INET) ? 4 : 16; + p[3] = (state->parsereq.af == AF_INET) ? SOCKS5_ATYP_IPV4 : SOCKS5_ATYP_IPV6; + evutil_inet_pton(state->parsereq.af, state->parsereq.addr, addr); + } + port = htons(state->parsereq.port); } - port = htons(state->parsereq.port); evbuffer_add(reply_dest, p, 4); evbuffer_add(reply_dest, addr, addrlen); @@ -377,7 +424,7 @@ socks4_send_reply(struct evbuffer *dest, socks_state_t *state, int status) /* Nul byte */ msg[0] = 0; /* convert to socks4 status */ - msg[1] = (status == SOCKS_SUCCESS) ? SOCKS4_SUCCESS : SOCKS4_FAILED; + msg[1] = status; memcpy(msg+2, &portnum, 2); /* ASN: What should we do here in the case of an FQDN request? */ memcpy(msg+4, &in.s_addr, 4); @@ -450,7 +497,11 @@ handle_socks(struct evbuffer *source, struct evbuffer *dest, r = socks5_handle_request(source,&socks_state->parsereq); if (r == -1) goto broken; - else if (r == 1) + else if (r == -2) { + socks5_send_reply(dest,socks_state, + SOCKS5_FAILED_UNSUPPORTED); + goto broken; + } else if (r == 1) socks_state->state = ST_HAVE_ADDR; return r; } @@ -513,12 +564,20 @@ socks_state_set_address(socks_state_t *state, const struct sockaddr *sa) return 0; } +/** + 'error' is 0 if no errors were encountered during the SOCKS + operation (normally a CONNECT with no errors means that the + connect() was successful). + If 'error' is not 0, it means that an error was encountered and + error carries the errno(3) of the error. +*/ int -socks_send_reply(socks_state_t *state, struct evbuffer *dest, int status) +socks_send_reply(socks_state_t *state, struct evbuffer *dest, int error) { - if (state->version == 5) + int status = socks_errno_to_reply(state, error); + if (state->version == SOCKS5_VERSION) return socks5_send_reply(dest, state, status); - else if (state->version == 4) + else if (state->version == SOCKS4_VERSION) return socks4_send_reply(dest, state, status); else return -1; diff --git a/src/socks.h b/src/socks.h index 589cd9c..01a76ff 100644 --- a/src/socks.h +++ b/src/socks.h @@ -27,13 +27,19 @@ int socks_state_get_address(const socks_state_t *state, const char **addr_out, int *port_out); int socks_state_set_address(socks_state_t *state, const struct sockaddr *sa); -int socks_send_reply(socks_state_t *state, struct evbuffer *dest, int status); +int socks_send_reply(socks_state_t *state, struct evbuffer *dest, int error); #define SOCKS_SUCCESS 0x0 #define SOCKS_FAILED 0x01 -#define SOCKS5_SUCCESS 0x0 -#define SOCKS5_FAILED 0x01 +#define SOCKS5_SUCCESS 0x0 +#define SOCKS5_FAILED_GENERAL 0x01 +#define SOCKS5_FAILED_NOTALLOWED 0x02 +#define SOCKS5_FAILED_NETUNREACH 0x03 +#define SOCKS5_FAILED_HOSTUNREACH 0x04 +#define SOCKS5_FAILED_REFUSED 0x05 +#define SOCKS5_FAILED_TTLEXPIRED 0x06 +#define SOCKS5_FAILED_UNSUPPORTED 0x07 #ifdef SOCKS_PRIVATE diff --git a/src/test/unittest_socks.c b/src/test/unittest_socks.c index 8f06d51..8839eff 100644 --- a/src/test/unittest_socks.c +++ b/src/test/unittest_socks.c @@ -266,6 +266,21 @@ test_socks_socks5_request(void *data) buffer_len = evbuffer_get_length(source); tt_int_op(0, ==, evbuffer_drain(source, buffer_len)); + /* Eigth test: + Everything is dreamy... if only the requested command was CONNECT... */ + uchar req8[9]; + req8[0] = 3; + req8[1] = 0; + req8[2] = 1; + memcpy(req8+3,&addr_ipv4,4); + memcpy(req8+7,&port,2); + + evbuffer_add(source, "\x05", 1); + evbuffer_add(source, req8, 9); + /* '-2' means that we don't support the requested command. */ + tt_int_op(-2, ==, socks5_handle_request(source,&pr1)); + + end: if (state) socks_state_free(state); @@ -301,7 +316,7 @@ test_socks_socks5_request_reply(void *data) We ask the server to send us a reply on an IPv4 request with succesful status. */ tt_int_op(1, ==, socks5_send_reply(reply_dest, - state, SOCKS_SUCCESS)); + state, SOCKS5_SUCCESS)); uchar rep1[255]; evbuffer_remove(reply_dest,rep1,255); /* yes, this is dirty */ @@ -348,7 +363,7 @@ test_socks_socks5_request_reply(void *data) strcpy(state->parsereq.addr, fqdn); tt_int_op(1, ==, socks5_send_reply(reply_dest, - state, SOCKS_FAILED)); + state, SOCKS5_FAILED_GENERAL)); uchar rep3[255]; evbuffer_remove(reply_dest,rep3,255); @@ -360,6 +375,20 @@ test_socks_socks5_request_reply(void *data) /* check port */ tt_int_op(0, ==, memcmp(rep3+5+strlen(fqdn),"\x1c\xbd",2)); + /* Fourth test: + We ask the server while having an empty parsereq and with a + SOCKS5_FAILED_UNSUPPORTED status. */ + memset(&state->parsereq,'\x00',sizeof(struct parsereq)); + + tt_int_op(1, ==, socks5_send_reply(reply_dest, + state, SOCKS5_FAILED_UNSUPPORTED)); + uchar rep4[255]; + evbuffer_remove(reply_dest,rep4,255); + + tt_assert(rep4[3] == SOCKS5_ATYP_IPV4); + tt_int_op(0, ==, memcmp(rep4+4,"\x00\x00\x00\x00",4)); + tt_int_op(0, ==, memcmp(rep4+4+4, "\x00\x00", 2)); + end: if (state) socks_state_free(state); @@ -534,7 +563,7 @@ test_socks_socks4_request_reply(void *data) We ask the server to send us a reply on an IPv4 request with succesful status. */ tt_int_op(1, ==, socks4_send_reply(reply_dest, - state, SOCKS_SUCCESS)); + state, SOCKS4_SUCCESS)); uchar rep1[255]; evbuffer_remove(reply_dest,rep1,255); /* yes, this is dirty */ @@ -558,7 +587,7 @@ test_socks_socks4_request_reply(void *data) strcpy(state->parsereq.addr, fqdn); tt_int_op(1, ==, socks4_send_reply(reply_dest, - state, SOCKS_FAILED)); + state, SOCKS4_FAILED)); uchar rep2[255]; evbuffer_remove(reply_dest,rep2,255);

1 0

[obfsproxy/master] Use generic SOCKS_* definitions, instead of using the SOCKS5_* ones as generic.
by nickm＠torproject.org 28 May '11

28 May '11

commit 641f44e875b350686e7647c9e6ca77514b75a542 Author: George Kadianakis <desnacked(a)gmail.com> Date: Tue May 24 04:02:14 2011 +0200 Use generic SOCKS_* definitions, instead of using the SOCKS5_* ones as generic. --- src/network.c | 4 ++-- src/socks.c | 5 +++-- src/socks.h | 8 +++++--- src/test/unittest_socks.c | 10 +++++----- 4 files changed, 15 insertions(+), 12 deletions(-) diff --git a/src/network.c b/src/network.c index 258d382..7b017b5 100644 --- a/src/network.c +++ b/src/network.c @@ -358,7 +358,7 @@ output_event_cb(struct bufferevent *bev, short what, void *arg) bufferevent_enable(conn->input, EV_WRITE); bufferevent_disable(conn->input, EV_READ); socks_send_reply(conn->socks_state, bufferevent_get_output(conn->input), - SOCKS5_REP_FAIL); + SOCKS_FAILED); bufferevent_setcb(conn->input, NULL, close_conn_on_flush, output_event_cb, conn); return; @@ -400,7 +400,7 @@ output_event_cb(struct bufferevent *bev, short what, void *arg) socks_state_set_address(conn->socks_state, sa); } socks_send_reply(conn->socks_state, bufferevent_get_output(conn->input), - SOCKS5_REP_SUCCESS); + SOCKS_SUCCESS); /* we sent a socks reply. We can finally move over to being a regular input bufferevent. */ socks_state_free(conn->socks_state); diff --git a/src/socks.c b/src/socks.c index 6144e26..5d73965 100644 --- a/src/socks.c +++ b/src/socks.c @@ -192,7 +192,8 @@ socks5_send_reply(struct evbuffer *reply_dest, socks_state_t *state, /* We either failed or succeded. Either way, we should send something back to the client */ p[0] = SOCKS5_VERSION; /* Version field */ - p[1] = (unsigned char) status; /* Reply field */ + /* Reply field */ + p[1] = (status == SOCKS_SUCCESS) ? SOCKS5_SUCCESS : SOCKS5_FAILED; p[2] = 0; /* Reserved */ if (state->parsereq.af == AF_UNSPEC) { addrlen = 1; @@ -376,7 +377,7 @@ socks4_send_reply(struct evbuffer *dest, socks_state_t *state, int status) /* Nul byte */ msg[0] = 0; /* convert to socks4 status */ - msg[1] = (status == SOCKS5_REP_SUCCESS) ? SOCKS4_SUCCESS : SOCKS4_FAILED; + msg[1] = (status == SOCKS_SUCCESS) ? SOCKS4_SUCCESS : SOCKS4_FAILED; memcpy(msg+2, &portnum, 2); /* ASN: What should we do here in the case of an FQDN request? */ memcpy(msg+4, &in.s_addr, 4); diff --git a/src/socks.h b/src/socks.h index 37c94cc..589cd9c 100644 --- a/src/socks.h +++ b/src/socks.h @@ -29,9 +29,11 @@ int socks_state_get_address(const socks_state_t *state, int socks_state_set_address(socks_state_t *state, const struct sockaddr *sa); int socks_send_reply(socks_state_t *state, struct evbuffer *dest, int status); -#define SOCKS5_REP_SUCCESS 0x0 -/* XXX there are more response codes than this! */ -#define SOCKS5_REP_FAIL 0x01 +#define SOCKS_SUCCESS 0x0 +#define SOCKS_FAILED 0x01 + +#define SOCKS5_SUCCESS 0x0 +#define SOCKS5_FAILED 0x01 #ifdef SOCKS_PRIVATE diff --git a/src/test/unittest_socks.c b/src/test/unittest_socks.c index cc68528..8f06d51 100644 --- a/src/test/unittest_socks.c +++ b/src/test/unittest_socks.c @@ -301,7 +301,7 @@ test_socks_socks5_request_reply(void *data) We ask the server to send us a reply on an IPv4 request with succesful status. */ tt_int_op(1, ==, socks5_send_reply(reply_dest, - state, SOCKS5_REP_SUCCESS)); + state, SOCKS_SUCCESS)); uchar rep1[255]; evbuffer_remove(reply_dest,rep1,255); /* yes, this is dirty */ @@ -323,7 +323,7 @@ test_socks_socks5_request_reply(void *data) strcpy(state->parsereq.addr, "d:1:5:e:a:5:e:0"); tt_int_op(1, ==, socks5_send_reply(reply_dest, - state, SOCKS5_REP_SUCCESS)); + state, SOCKS_SUCCESS)); uchar rep2[255]; evbuffer_remove(reply_dest,rep2,255); @@ -348,7 +348,7 @@ test_socks_socks5_request_reply(void *data) strcpy(state->parsereq.addr, fqdn); tt_int_op(1, ==, socks5_send_reply(reply_dest, - state, SOCKS5_REP_FAIL)); + state, SOCKS_FAILED)); uchar rep3[255]; evbuffer_remove(reply_dest,rep3,255); @@ -534,7 +534,7 @@ test_socks_socks4_request_reply(void *data) We ask the server to send us a reply on an IPv4 request with succesful status. */ tt_int_op(1, ==, socks4_send_reply(reply_dest, - state, SOCKS5_REP_SUCCESS)); + state, SOCKS_SUCCESS)); uchar rep1[255]; evbuffer_remove(reply_dest,rep1,255); /* yes, this is dirty */ @@ -558,7 +558,7 @@ test_socks_socks4_request_reply(void *data) strcpy(state->parsereq.addr, fqdn); tt_int_op(1, ==, socks4_send_reply(reply_dest, - state, SOCKS5_REP_FAIL)); + state, SOCKS_FAILED)); uchar rep2[255]; evbuffer_remove(reply_dest,rep2,255);

1 0

[obfsproxy/master] Some last fixes and documentation improvements.
by nickm＠torproject.org 28 May '11

28 May '11

commit 1fed3ff856194293775296256625cd3bd4064629 Author: George Kadianakis <desnacked(a)gmail.com> Date: Tue May 24 21:39:04 2011 +0200 Some last fixes and documentation improvements. --- src/socks.c | 4 ++-- src/socks.h | 5 +---- src/test/unittest_socks.c | 4 ++-- 3 files changed, 5 insertions(+), 8 deletions(-) diff --git a/src/socks.c b/src/socks.c index 367c2f1..7ee44ee 100644 --- a/src/socks.c +++ b/src/socks.c @@ -233,7 +233,7 @@ socks5_send_reply(struct evbuffer *reply_dest, socks_state_t *state, p[2] = 0; /* Reserved */ /* If status is SOCKS5_FAILED_UNSUPPORTED, it means that we failed - before populating state->parsereq. We will just feel the rest + before populating state->parsereq. We will just fill the rest of the reply packet with zeroes and ship it off. */ if (status == SOCKS5_FAILED_UNSUPPORTED) { @@ -241,7 +241,7 @@ socks5_send_reply(struct evbuffer *reply_dest, socks_state_t *state, p[3] = SOCKS5_ATYP_IPV4; memset(addr,'\x00',4); port = 0; - } else { + } else { /* state->parsereq is fine. move on. */ if (state->parsereq.af == AF_UNSPEC) { addrlen = 1; addr[0] = strlen(state->parsereq.addr); diff --git a/src/socks.h b/src/socks.h index 09ebe28..d360982 100644 --- a/src/socks.h +++ b/src/socks.h @@ -32,10 +32,7 @@ int socks5_send_reply(struct evbuffer *reply_dest, socks_state_t *state, int status); -#define SOCKS_SUCCESS 0x0 -#define SOCKS_FAILED 0x01 - -#define SOCKS5_SUCCESS 0x0 +#define SOCKS5_SUCCESS 0x00 #define SOCKS5_FAILED_GENERAL 0x01 #define SOCKS5_FAILED_NOTALLOWED 0x02 #define SOCKS5_FAILED_NETUNREACH 0x03 diff --git a/src/test/unittest_socks.c b/src/test/unittest_socks.c index 8839eff..5ec28cc 100644 --- a/src/test/unittest_socks.c +++ b/src/test/unittest_socks.c @@ -269,7 +269,7 @@ test_socks_socks5_request(void *data) /* Eigth test: Everything is dreamy... if only the requested command was CONNECT... */ uchar req8[9]; - req8[0] = 3; + req8[0] = 2; /* BIND CMD */ req8[1] = 0; req8[2] = 1; memcpy(req8+3,&addr_ipv4,4); @@ -338,7 +338,7 @@ test_socks_socks5_request_reply(void *data) strcpy(state->parsereq.addr, "d:1:5:e:a:5:e:0"); tt_int_op(1, ==, socks5_send_reply(reply_dest, - state, SOCKS_SUCCESS)); + state, SOCKS5_SUCCESS)); uchar rep2[255]; evbuffer_remove(reply_dest,rep2,255);

1 0

[obfsproxy/master] Added 'src/test/test_socks_unsupported.py' which tests the SOCKS5_FAILED_UNSUPPORTED
by nickm＠torproject.org 28 May '11

28 May '11

commit 0b2750f4323e8a1f04dc1b64be1b5b43f0a7f127 Author: George Kadianakis <desnacked(a)gmail.com> Date: Tue May 24 16:52:39 2011 +0200 Added 'src/test/test_socks_unsupported.py' which tests the SOCKS5_FAILED_UNSUPPORTED reply on the wire (since there is already a unit test for this.). --- src/test/test_socks_unsupported.py | 16 ++++++++++++++++ 1 files changed, 16 insertions(+), 0 deletions(-) diff --git a/src/test/test_socks_unsupported.py b/src/test/test_socks_unsupported.py new file mode 100644 index 0000000..c0d625c --- /dev/null +++ b/src/test/test_socks_unsupported.py @@ -0,0 +1,16 @@ +import socket,struct + +negot = struct.pack('BBB', 5, 1, 0) +request = struct.pack('BBBBBBB', 5, 2, 0, 1, 1, 1, 1) + +PORT = 4500 + +s=socket.socket(socket.AF_INET, socket.SOCK_STREAM) +s.connect(("127.0.0.1",PORT)) +s.send(negot) +s.recv(1024) +s.send(request) +data = s.recv(1024) +if (struct.unpack('BBBBih', data)[1] == 7): + print "Works." +

1 0