- tor-commits - lists.torproject.org

[obfsproxy/master] We can now send 'SOCKS5_FAILED_UNSUPPORTED' replies as well!
by nickm＠torproject.org 28 May '11

28 May '11

commit 7eb36a85f4884668a259040e5dcb2350ed3b0595 Author: George Kadianakis <desnacked(a)gmail.com> Date: Tue May 24 16:43:28 2011 +0200 We can now send 'SOCKS5_FAILED_UNSUPPORTED' replies as well! --- src/network.c | 13 +++++++++++-- src/socks.c | 22 ++++++++++++---------- src/socks.h | 3 +++ 3 files changed, 26 insertions(+), 12 deletions(-) diff --git a/src/network.c b/src/network.c index 835dff1..1f68804 100644 --- a/src/network.c +++ b/src/network.c @@ -268,6 +268,15 @@ socks_read_cb(struct bufferevent *bev, void *arg) return; /* need to read more data. */ else if (r == -1) conn_free(conn); /* XXXX maybe send socks reply */ + else if (r == -2) { + bufferevent_enable(bev, EV_WRITE); + bufferevent_disable(bev, EV_READ); + socks5_send_reply(bufferevent_get_output(bev), conn->socks_state, + SOCKS5_FAILED_UNSUPPORTED); + bufferevent_setcb(bev, NULL, + close_conn_on_flush, output_event_cb, conn); + return; + } } static void @@ -399,8 +408,8 @@ output_event_cb(struct bufferevent *bev, short what, void *arg) * socks client */ socks_state_set_address(conn->socks_state, sa); } - socks_send_reply(conn->socks_state, bufferevent_get_output(conn->input), - 0); + socks_send_reply(conn->socks_state, + bufferevent_get_output(conn->input), 0); /* we sent a socks reply. We can finally move over to being a regular input bufferevent. */ socks_state_free(conn->socks_state); diff --git a/src/socks.c b/src/socks.c index a388363..367c2f1 100644 --- a/src/socks.c +++ b/src/socks.c @@ -90,13 +90,13 @@ socks_errno_to_reply(socks_state_t *state, int error) return SOCKS5_FAILED_GENERAL; } } - } - return -1; + } else + return -1; } /** Takes a command request from 'source', it evaluates it and if it's - legit it parses into 'parsereq'. + legit it parses it into 'parsereq'. It returns '1' if everything went fine. It returns '0' if we need more data from the client. @@ -138,6 +138,7 @@ socks5_handle_request(struct evbuffer *source, struct parsereq *parsereq) printf("socks: Corrupted packet. Discarding.\n"); goto err; } + if (p[1] != SOCKS5_CMD_CONNECT) return -2; /* We must send reply to the client. */ @@ -495,13 +496,14 @@ handle_socks(struct evbuffer *source, struct evbuffer *dest, if (socks_state->state == ST_NEGOTIATION_DONE) { /* We know this connection. Let's see what it wants. */ r = socks5_handle_request(source,&socks_state->parsereq); - if (r == -1) - goto broken; - else if (r == -2) { - socks5_send_reply(dest,socks_state, - SOCKS5_FAILED_UNSUPPORTED); + if (r == -2) { /* Request CMD != CONNECT. */ + socks_state->broken = 1; + return -2; + } else if (r == -1) /* Broken request. */ goto broken; - } else if (r == 1) + else if (r == 0) /* Incomplete. */ + return 0; + else if (r == 1) /* Neat request. */ socks_state->state = ST_HAVE_ADDR; return r; } @@ -565,6 +567,7 @@ socks_state_set_address(socks_state_t *state, const struct sockaddr *sa) } /** + This function sends a SOCKS{5,4} "Server Reply" to 'dest'. 'error' is 0 if no errors were encountered during the SOCKS operation (normally a CONNECT with no errors means that the connect() was successful). @@ -582,4 +585,3 @@ socks_send_reply(socks_state_t *state, struct evbuffer *dest, int error) else return -1; } - diff --git a/src/socks.h b/src/socks.h index 01a76ff..09ebe28 100644 --- a/src/socks.h +++ b/src/socks.h @@ -28,6 +28,9 @@ int socks_state_get_address(const socks_state_t *state, int *port_out); int socks_state_set_address(socks_state_t *state, const struct sockaddr *sa); int socks_send_reply(socks_state_t *state, struct evbuffer *dest, int error); +int socks5_send_reply(struct evbuffer *reply_dest, + socks_state_t *state, int status); + #define SOCKS_SUCCESS 0x0 #define SOCKS_FAILED 0x01

1 0

[obfsproxy/master] Added support for more SOCKS5 replies.
by nickm＠torproject.org 28 May '11

28 May '11

commit 891596713a8868b1d05b3fbfefc8b8674feb8b7a Author: George Kadianakis <desnacked(a)gmail.com> Date: Tue May 24 05:18:04 2011 +0200 Added support for more SOCKS5 replies. --- src/network.c | 4 +- src/socks.c | 121 +++++++++++++++++++++++++++++++++------------ src/socks.h | 12 +++- src/test/unittest_socks.c | 37 ++++++++++++-- 4 files changed, 134 insertions(+), 40 deletions(-) diff --git a/src/network.c b/src/network.c index 7b017b5..835dff1 100644 --- a/src/network.c +++ b/src/network.c @@ -358,7 +358,7 @@ output_event_cb(struct bufferevent *bev, short what, void *arg) bufferevent_enable(conn->input, EV_WRITE); bufferevent_disable(conn->input, EV_READ); socks_send_reply(conn->socks_state, bufferevent_get_output(conn->input), - SOCKS_FAILED); + EVUTIL_SOCKET_ERROR()); bufferevent_setcb(conn->input, NULL, close_conn_on_flush, output_event_cb, conn); return; @@ -400,7 +400,7 @@ output_event_cb(struct bufferevent *bev, short what, void *arg) socks_state_set_address(conn->socks_state, sa); } socks_send_reply(conn->socks_state, bufferevent_get_output(conn->input), - SOCKS_SUCCESS); + 0); /* we sent a socks reply. We can finally move over to being a regular input bufferevent. */ socks_state_free(conn->socks_state); diff --git a/src/socks.c b/src/socks.c index 5d73965..a388363 100644 --- a/src/socks.c +++ b/src/socks.c @@ -6,6 +6,7 @@ #include <string.h> #include <stdlib.h> #include <stdio.h> +#include <errno.h> #define SOCKS_PRIVATE #include "socks.h" @@ -34,7 +35,7 @@ "Method Negotiation Packet" is handled by: socks5_handle_negotiation() "Method Negotiation Reply" is done by: socks5_do_negotiation() "Client request" is handled by: socks5_handle_request() - "Server reply" is done by: socks5_send_reply + "Server reply" is done by: socks5_send_reply() */ static int socks5_do_negotiation(struct evbuffer *dest, @@ -59,20 +60,53 @@ socks_state_free(socks_state_t *s) memset(s,0x0b, sizeof(socks_state_t)); free(s); } + /** - This function handles connection requests by authenticated SOCKS - clients. - Considering a request packet from 'source', it evaluates it and pushes - the appropriate reply to 'dest'. - If the request was correct and can be fulfilled, it connects 'output' - to the location the client specified to actually set up the proxying. - - XXX: You will notice some "sizeof(req)-1" that initially make no - sense, but because of handle_socks() removing the version byte, - there are only 3 bytes (==sizeof(req)-1) between the start - of 'source' and addrlen. I don't know if replacing it with plain "3" - would make more sense. + This function receives an errno(3) 'error' and returns the reply + code that should be sent to the SOCKS client. + If 'error' is 0 it means that no errors were encountered, and + SOCKS{4,5}_SUCCESS is returned. +*/ +static int +socks_errno_to_reply(socks_state_t *state, int error) +{ + if (state->version == SOCKS4_VERSION) { + if (!error) + return SOCKS4_SUCCESS; + else + return SOCKS4_FAILED; + } else if (state->version == SOCKS5_VERSION) { + if (!error) + return SOCKS5_SUCCESS; + else { + switch (error) { + case ENETUNREACH: + return SOCKS5_FAILED_NETUNREACH; + case EHOSTUNREACH: + return SOCKS5_FAILED_HOSTUNREACH; + case ECONNREFUSED: + return SOCKS5_FAILED_REFUSED; + default: + return SOCKS5_FAILED_GENERAL; + } + } + } + return -1; +} +/** + Takes a command request from 'source', it evaluates it and if it's + legit it parses into 'parsereq'. + + It returns '1' if everything went fine. + It returns '0' if we need more data from the client. + It returns '-1' if we didn't like something. + It returns '-2' if the client asked for something else than CONNECT. + If that's the case we should send a reply back to the client + telling him that we don't support it. + + Disclaimer: This is just a temporary documentation. + Client Request (Client -> Server) */ int @@ -100,10 +134,12 @@ socks5_handle_request(struct evbuffer *source, struct parsereq *parsereq) /* p[0] = Version p[1] = Command field p[2] = Reserved field */ - if (p[0] != SOCKS5_VERSION || p[1] != SOCKS5_CMD_CONNECT || p[2] != 0x00) { - printf("socks: Only CONNECT supported. Sowwy!\n"); + if (p[0] != SOCKS5_VERSION || p[2] != 0x00) { + printf("socks: Corrupted packet. Discarding.\n"); goto err; } + if (p[1] != SOCKS5_CMD_CONNECT) + return -2; /* We must send reply to the client. */ unsigned int addrlen,af,extralen=0; /* p[3] is Address type field */ @@ -183,7 +219,6 @@ int socks5_send_reply(struct evbuffer *reply_dest, socks_state_t *state, int status) { - /* This is the buffer that contains our reply to the client. */ uchar p[4]; uchar addr[16]; const char *extra = NULL; @@ -193,19 +228,31 @@ socks5_send_reply(struct evbuffer *reply_dest, socks_state_t *state, Either way, we should send something back to the client */ p[0] = SOCKS5_VERSION; /* Version field */ /* Reply field */ - p[1] = (status == SOCKS_SUCCESS) ? SOCKS5_SUCCESS : SOCKS5_FAILED; + p[1] = status; p[2] = 0; /* Reserved */ - if (state->parsereq.af == AF_UNSPEC) { - addrlen = 1; - addr[0] = strlen(state->parsereq.addr); - extra = state->parsereq.addr; - p[3] = SOCKS5_ATYP_FQDN; + + /* If status is SOCKS5_FAILED_UNSUPPORTED, it means that we failed + before populating state->parsereq. We will just feel the rest + of the reply packet with zeroes and ship it off. + */ + if (status == SOCKS5_FAILED_UNSUPPORTED) { + addrlen = 4; + p[3] = SOCKS5_ATYP_IPV4; + memset(addr,'\x00',4); + port = 0; } else { - addrlen = (state->parsereq.af == AF_INET) ? 4 : 16; - p[3] = (state->parsereq.af == AF_INET) ? SOCKS5_ATYP_IPV4 : SOCKS5_ATYP_IPV6; - evutil_inet_pton(state->parsereq.af, state->parsereq.addr, addr); + if (state->parsereq.af == AF_UNSPEC) { + addrlen = 1; + addr[0] = strlen(state->parsereq.addr); + extra = state->parsereq.addr; + p[3] = SOCKS5_ATYP_FQDN; + } else { + addrlen = (state->parsereq.af == AF_INET) ? 4 : 16; + p[3] = (state->parsereq.af == AF_INET) ? SOCKS5_ATYP_IPV4 : SOCKS5_ATYP_IPV6; + evutil_inet_pton(state->parsereq.af, state->parsereq.addr, addr); + } + port = htons(state->parsereq.port); } - port = htons(state->parsereq.port); evbuffer_add(reply_dest, p, 4); evbuffer_add(reply_dest, addr, addrlen); @@ -377,7 +424,7 @@ socks4_send_reply(struct evbuffer *dest, socks_state_t *state, int status) /* Nul byte */ msg[0] = 0; /* convert to socks4 status */ - msg[1] = (status == SOCKS_SUCCESS) ? SOCKS4_SUCCESS : SOCKS4_FAILED; + msg[1] = status; memcpy(msg+2, &portnum, 2); /* ASN: What should we do here in the case of an FQDN request? */ memcpy(msg+4, &in.s_addr, 4); @@ -450,7 +497,11 @@ handle_socks(struct evbuffer *source, struct evbuffer *dest, r = socks5_handle_request(source,&socks_state->parsereq); if (r == -1) goto broken; - else if (r == 1) + else if (r == -2) { + socks5_send_reply(dest,socks_state, + SOCKS5_FAILED_UNSUPPORTED); + goto broken; + } else if (r == 1) socks_state->state = ST_HAVE_ADDR; return r; } @@ -513,12 +564,20 @@ socks_state_set_address(socks_state_t *state, const struct sockaddr *sa) return 0; } +/** + 'error' is 0 if no errors were encountered during the SOCKS + operation (normally a CONNECT with no errors means that the + connect() was successful). + If 'error' is not 0, it means that an error was encountered and + error carries the errno(3) of the error. +*/ int -socks_send_reply(socks_state_t *state, struct evbuffer *dest, int status) +socks_send_reply(socks_state_t *state, struct evbuffer *dest, int error) { - if (state->version == 5) + int status = socks_errno_to_reply(state, error); + if (state->version == SOCKS5_VERSION) return socks5_send_reply(dest, state, status); - else if (state->version == 4) + else if (state->version == SOCKS4_VERSION) return socks4_send_reply(dest, state, status); else return -1; diff --git a/src/socks.h b/src/socks.h index 589cd9c..01a76ff 100644 --- a/src/socks.h +++ b/src/socks.h @@ -27,13 +27,19 @@ int socks_state_get_address(const socks_state_t *state, const char **addr_out, int *port_out); int socks_state_set_address(socks_state_t *state, const struct sockaddr *sa); -int socks_send_reply(socks_state_t *state, struct evbuffer *dest, int status); +int socks_send_reply(socks_state_t *state, struct evbuffer *dest, int error); #define SOCKS_SUCCESS 0x0 #define SOCKS_FAILED 0x01 -#define SOCKS5_SUCCESS 0x0 -#define SOCKS5_FAILED 0x01 +#define SOCKS5_SUCCESS 0x0 +#define SOCKS5_FAILED_GENERAL 0x01 +#define SOCKS5_FAILED_NOTALLOWED 0x02 +#define SOCKS5_FAILED_NETUNREACH 0x03 +#define SOCKS5_FAILED_HOSTUNREACH 0x04 +#define SOCKS5_FAILED_REFUSED 0x05 +#define SOCKS5_FAILED_TTLEXPIRED 0x06 +#define SOCKS5_FAILED_UNSUPPORTED 0x07 #ifdef SOCKS_PRIVATE diff --git a/src/test/unittest_socks.c b/src/test/unittest_socks.c index 8f06d51..8839eff 100644 --- a/src/test/unittest_socks.c +++ b/src/test/unittest_socks.c @@ -266,6 +266,21 @@ test_socks_socks5_request(void *data) buffer_len = evbuffer_get_length(source); tt_int_op(0, ==, evbuffer_drain(source, buffer_len)); + /* Eigth test: + Everything is dreamy... if only the requested command was CONNECT... */ + uchar req8[9]; + req8[0] = 3; + req8[1] = 0; + req8[2] = 1; + memcpy(req8+3,&addr_ipv4,4); + memcpy(req8+7,&port,2); + + evbuffer_add(source, "\x05", 1); + evbuffer_add(source, req8, 9); + /* '-2' means that we don't support the requested command. */ + tt_int_op(-2, ==, socks5_handle_request(source,&pr1)); + + end: if (state) socks_state_free(state); @@ -301,7 +316,7 @@ test_socks_socks5_request_reply(void *data) We ask the server to send us a reply on an IPv4 request with succesful status. */ tt_int_op(1, ==, socks5_send_reply(reply_dest, - state, SOCKS_SUCCESS)); + state, SOCKS5_SUCCESS)); uchar rep1[255]; evbuffer_remove(reply_dest,rep1,255); /* yes, this is dirty */ @@ -348,7 +363,7 @@ test_socks_socks5_request_reply(void *data) strcpy(state->parsereq.addr, fqdn); tt_int_op(1, ==, socks5_send_reply(reply_dest, - state, SOCKS_FAILED)); + state, SOCKS5_FAILED_GENERAL)); uchar rep3[255]; evbuffer_remove(reply_dest,rep3,255); @@ -360,6 +375,20 @@ test_socks_socks5_request_reply(void *data) /* check port */ tt_int_op(0, ==, memcmp(rep3+5+strlen(fqdn),"\x1c\xbd",2)); + /* Fourth test: + We ask the server while having an empty parsereq and with a + SOCKS5_FAILED_UNSUPPORTED status. */ + memset(&state->parsereq,'\x00',sizeof(struct parsereq)); + + tt_int_op(1, ==, socks5_send_reply(reply_dest, + state, SOCKS5_FAILED_UNSUPPORTED)); + uchar rep4[255]; + evbuffer_remove(reply_dest,rep4,255); + + tt_assert(rep4[3] == SOCKS5_ATYP_IPV4); + tt_int_op(0, ==, memcmp(rep4+4,"\x00\x00\x00\x00",4)); + tt_int_op(0, ==, memcmp(rep4+4+4, "\x00\x00", 2)); + end: if (state) socks_state_free(state); @@ -534,7 +563,7 @@ test_socks_socks4_request_reply(void *data) We ask the server to send us a reply on an IPv4 request with succesful status. */ tt_int_op(1, ==, socks4_send_reply(reply_dest, - state, SOCKS_SUCCESS)); + state, SOCKS4_SUCCESS)); uchar rep1[255]; evbuffer_remove(reply_dest,rep1,255); /* yes, this is dirty */ @@ -558,7 +587,7 @@ test_socks_socks4_request_reply(void *data) strcpy(state->parsereq.addr, fqdn); tt_int_op(1, ==, socks4_send_reply(reply_dest, - state, SOCKS_FAILED)); + state, SOCKS4_FAILED)); uchar rep2[255]; evbuffer_remove(reply_dest,rep2,255);

1 0

[obfsproxy/master] Use generic SOCKS_* definitions, instead of using the SOCKS5_* ones as generic.
by nickm＠torproject.org 28 May '11

28 May '11

commit 641f44e875b350686e7647c9e6ca77514b75a542 Author: George Kadianakis <desnacked(a)gmail.com> Date: Tue May 24 04:02:14 2011 +0200 Use generic SOCKS_* definitions, instead of using the SOCKS5_* ones as generic. --- src/network.c | 4 ++-- src/socks.c | 5 +++-- src/socks.h | 8 +++++--- src/test/unittest_socks.c | 10 +++++----- 4 files changed, 15 insertions(+), 12 deletions(-) diff --git a/src/network.c b/src/network.c index 258d382..7b017b5 100644 --- a/src/network.c +++ b/src/network.c @@ -358,7 +358,7 @@ output_event_cb(struct bufferevent *bev, short what, void *arg) bufferevent_enable(conn->input, EV_WRITE); bufferevent_disable(conn->input, EV_READ); socks_send_reply(conn->socks_state, bufferevent_get_output(conn->input), - SOCKS5_REP_FAIL); + SOCKS_FAILED); bufferevent_setcb(conn->input, NULL, close_conn_on_flush, output_event_cb, conn); return; @@ -400,7 +400,7 @@ output_event_cb(struct bufferevent *bev, short what, void *arg) socks_state_set_address(conn->socks_state, sa); } socks_send_reply(conn->socks_state, bufferevent_get_output(conn->input), - SOCKS5_REP_SUCCESS); + SOCKS_SUCCESS); /* we sent a socks reply. We can finally move over to being a regular input bufferevent. */ socks_state_free(conn->socks_state); diff --git a/src/socks.c b/src/socks.c index 6144e26..5d73965 100644 --- a/src/socks.c +++ b/src/socks.c @@ -192,7 +192,8 @@ socks5_send_reply(struct evbuffer *reply_dest, socks_state_t *state, /* We either failed or succeded. Either way, we should send something back to the client */ p[0] = SOCKS5_VERSION; /* Version field */ - p[1] = (unsigned char) status; /* Reply field */ + /* Reply field */ + p[1] = (status == SOCKS_SUCCESS) ? SOCKS5_SUCCESS : SOCKS5_FAILED; p[2] = 0; /* Reserved */ if (state->parsereq.af == AF_UNSPEC) { addrlen = 1; @@ -376,7 +377,7 @@ socks4_send_reply(struct evbuffer *dest, socks_state_t *state, int status) /* Nul byte */ msg[0] = 0; /* convert to socks4 status */ - msg[1] = (status == SOCKS5_REP_SUCCESS) ? SOCKS4_SUCCESS : SOCKS4_FAILED; + msg[1] = (status == SOCKS_SUCCESS) ? SOCKS4_SUCCESS : SOCKS4_FAILED; memcpy(msg+2, &portnum, 2); /* ASN: What should we do here in the case of an FQDN request? */ memcpy(msg+4, &in.s_addr, 4); diff --git a/src/socks.h b/src/socks.h index 37c94cc..589cd9c 100644 --- a/src/socks.h +++ b/src/socks.h @@ -29,9 +29,11 @@ int socks_state_get_address(const socks_state_t *state, int socks_state_set_address(socks_state_t *state, const struct sockaddr *sa); int socks_send_reply(socks_state_t *state, struct evbuffer *dest, int status); -#define SOCKS5_REP_SUCCESS 0x0 -/* XXX there are more response codes than this! */ -#define SOCKS5_REP_FAIL 0x01 +#define SOCKS_SUCCESS 0x0 +#define SOCKS_FAILED 0x01 + +#define SOCKS5_SUCCESS 0x0 +#define SOCKS5_FAILED 0x01 #ifdef SOCKS_PRIVATE diff --git a/src/test/unittest_socks.c b/src/test/unittest_socks.c index cc68528..8f06d51 100644 --- a/src/test/unittest_socks.c +++ b/src/test/unittest_socks.c @@ -301,7 +301,7 @@ test_socks_socks5_request_reply(void *data) We ask the server to send us a reply on an IPv4 request with succesful status. */ tt_int_op(1, ==, socks5_send_reply(reply_dest, - state, SOCKS5_REP_SUCCESS)); + state, SOCKS_SUCCESS)); uchar rep1[255]; evbuffer_remove(reply_dest,rep1,255); /* yes, this is dirty */ @@ -323,7 +323,7 @@ test_socks_socks5_request_reply(void *data) strcpy(state->parsereq.addr, "d:1:5:e:a:5:e:0"); tt_int_op(1, ==, socks5_send_reply(reply_dest, - state, SOCKS5_REP_SUCCESS)); + state, SOCKS_SUCCESS)); uchar rep2[255]; evbuffer_remove(reply_dest,rep2,255); @@ -348,7 +348,7 @@ test_socks_socks5_request_reply(void *data) strcpy(state->parsereq.addr, fqdn); tt_int_op(1, ==, socks5_send_reply(reply_dest, - state, SOCKS5_REP_FAIL)); + state, SOCKS_FAILED)); uchar rep3[255]; evbuffer_remove(reply_dest,rep3,255); @@ -534,7 +534,7 @@ test_socks_socks4_request_reply(void *data) We ask the server to send us a reply on an IPv4 request with succesful status. */ tt_int_op(1, ==, socks4_send_reply(reply_dest, - state, SOCKS5_REP_SUCCESS)); + state, SOCKS_SUCCESS)); uchar rep1[255]; evbuffer_remove(reply_dest,rep1,255); /* yes, this is dirty */ @@ -558,7 +558,7 @@ test_socks_socks4_request_reply(void *data) strcpy(state->parsereq.addr, fqdn); tt_int_op(1, ==, socks4_send_reply(reply_dest, - state, SOCKS5_REP_FAIL)); + state, SOCKS_FAILED)); uchar rep2[255]; evbuffer_remove(reply_dest,rep2,255);

1 0

[obfsproxy/master] Some last fixes and documentation improvements.
by nickm＠torproject.org 28 May '11

28 May '11

commit 1fed3ff856194293775296256625cd3bd4064629 Author: George Kadianakis <desnacked(a)gmail.com> Date: Tue May 24 21:39:04 2011 +0200 Some last fixes and documentation improvements. --- src/socks.c | 4 ++-- src/socks.h | 5 +---- src/test/unittest_socks.c | 4 ++-- 3 files changed, 5 insertions(+), 8 deletions(-) diff --git a/src/socks.c b/src/socks.c index 367c2f1..7ee44ee 100644 --- a/src/socks.c +++ b/src/socks.c @@ -233,7 +233,7 @@ socks5_send_reply(struct evbuffer *reply_dest, socks_state_t *state, p[2] = 0; /* Reserved */ /* If status is SOCKS5_FAILED_UNSUPPORTED, it means that we failed - before populating state->parsereq. We will just feel the rest + before populating state->parsereq. We will just fill the rest of the reply packet with zeroes and ship it off. */ if (status == SOCKS5_FAILED_UNSUPPORTED) { @@ -241,7 +241,7 @@ socks5_send_reply(struct evbuffer *reply_dest, socks_state_t *state, p[3] = SOCKS5_ATYP_IPV4; memset(addr,'\x00',4); port = 0; - } else { + } else { /* state->parsereq is fine. move on. */ if (state->parsereq.af == AF_UNSPEC) { addrlen = 1; addr[0] = strlen(state->parsereq.addr); diff --git a/src/socks.h b/src/socks.h index 09ebe28..d360982 100644 --- a/src/socks.h +++ b/src/socks.h @@ -32,10 +32,7 @@ int socks5_send_reply(struct evbuffer *reply_dest, socks_state_t *state, int status); -#define SOCKS_SUCCESS 0x0 -#define SOCKS_FAILED 0x01 - -#define SOCKS5_SUCCESS 0x0 +#define SOCKS5_SUCCESS 0x00 #define SOCKS5_FAILED_GENERAL 0x01 #define SOCKS5_FAILED_NOTALLOWED 0x02 #define SOCKS5_FAILED_NETUNREACH 0x03 diff --git a/src/test/unittest_socks.c b/src/test/unittest_socks.c index 8839eff..5ec28cc 100644 --- a/src/test/unittest_socks.c +++ b/src/test/unittest_socks.c @@ -269,7 +269,7 @@ test_socks_socks5_request(void *data) /* Eigth test: Everything is dreamy... if only the requested command was CONNECT... */ uchar req8[9]; - req8[0] = 3; + req8[0] = 2; /* BIND CMD */ req8[1] = 0; req8[2] = 1; memcpy(req8+3,&addr_ipv4,4); @@ -338,7 +338,7 @@ test_socks_socks5_request_reply(void *data) strcpy(state->parsereq.addr, "d:1:5:e:a:5:e:0"); tt_int_op(1, ==, socks5_send_reply(reply_dest, - state, SOCKS_SUCCESS)); + state, SOCKS5_SUCCESS)); uchar rep2[255]; evbuffer_remove(reply_dest,rep2,255);

1 0

[obfsproxy/master] Added 'src/test/test_socks_unsupported.py' which tests the SOCKS5_FAILED_UNSUPPORTED
by nickm＠torproject.org 28 May '11

28 May '11

commit 0b2750f4323e8a1f04dc1b64be1b5b43f0a7f127 Author: George Kadianakis <desnacked(a)gmail.com> Date: Tue May 24 16:52:39 2011 +0200 Added 'src/test/test_socks_unsupported.py' which tests the SOCKS5_FAILED_UNSUPPORTED reply on the wire (since there is already a unit test for this.). --- src/test/test_socks_unsupported.py | 16 ++++++++++++++++ 1 files changed, 16 insertions(+), 0 deletions(-) diff --git a/src/test/test_socks_unsupported.py b/src/test/test_socks_unsupported.py new file mode 100644 index 0000000..c0d625c --- /dev/null +++ b/src/test/test_socks_unsupported.py @@ -0,0 +1,16 @@ +import socket,struct + +negot = struct.pack('BBB', 5, 1, 0) +request = struct.pack('BBBBBBB', 5, 2, 0, 1, 1, 1, 1) + +PORT = 4500 + +s=socket.socket(socket.AF_INET, socket.SOCK_STREAM) +s.connect(("127.0.0.1",PORT)) +s.send(negot) +s.recv(1024) +s.send(request) +data = s.recv(1024) +if (struct.unpack('BBBBih', data)[1] == 7): + print "Works." +

1 0

[obfsproxy/master] Implemented nickm's comments.
by nickm＠torproject.org 28 May '11

28 May '11

commit bb3b4f219f0685da10e0b95b36c181135c17f469 Author: George Kadianakis <desnacked(a)gmail.com> Date: Sat May 28 05:34:46 2011 +0200 Implemented nickm's comments. * Used WSA error codes for Windows compatibility. * Used enum to turn socks5_handle_request returns into meaningful words. * 's/EVUTIL_SOCKET_ERROR()/evutil_socket_geterror()/g' --- src/network.c | 13 ++++++----- src/socks.c | 43 +++++++++++++++++++++-------------- src/socks.h | 12 ++++++++- src/test/test_socks_unsupported.py | 2 + src/test/unittest_socks.c | 16 ++++++------ 5 files changed, 53 insertions(+), 33 deletions(-) diff --git a/src/network.c b/src/network.c index 1f68804..f1c4584 100644 --- a/src/network.c +++ b/src/network.c @@ -10,6 +10,7 @@ #include "util.h" #include "socks.h" #include "protocol.h" +#include "socks.h" #include <assert.h> #include <stdlib.h> @@ -229,7 +230,7 @@ socks_read_cb(struct bufferevent *bev, void *arg) { conn_t *conn = arg; //struct bufferevent *other; - int r; + enum req_status r; assert(bev == conn->input); /* socks must be on the initial bufferevent */ //dbg(("Got data on the socks side (%d) \n", conn->socks_state->state)); @@ -262,13 +263,13 @@ socks_read_cb(struct bufferevent *bev, void *arg) r = handle_socks(bufferevent_get_input(bev), bufferevent_get_output(bev), conn->socks_state); - } while (r == 1); + } while (r == SOCKS_GOOD); - if (r == 0) + if (r == SOCKS_INCOMPLETE) return; /* need to read more data. */ - else if (r == -1) + else if (r == SOCKS_BROKEN) conn_free(conn); /* XXXX maybe send socks reply */ - else if (r == -2) { + else if (r == SOCKS_CMD_NOT_CONNECT) { bufferevent_enable(bev, EV_WRITE); bufferevent_disable(bev, EV_READ); socks5_send_reply(bufferevent_get_output(bev), conn->socks_state, @@ -367,7 +368,7 @@ output_event_cb(struct bufferevent *bev, short what, void *arg) bufferevent_enable(conn->input, EV_WRITE); bufferevent_disable(conn->input, EV_READ); socks_send_reply(conn->socks_state, bufferevent_get_output(conn->input), - EVUTIL_SOCKET_ERROR()); + evutil_socket_geterror()); bufferevent_setcb(conn->input, NULL, close_conn_on_flush, output_event_cb, conn); return; diff --git a/src/socks.c b/src/socks.c index 7ee44ee..8782a63 100644 --- a/src/socks.c +++ b/src/socks.c @@ -38,6 +38,7 @@ "Server reply" is done by: socks5_send_reply() */ + static int socks5_do_negotiation(struct evbuffer *dest, unsigned int neg_was_success); @@ -61,6 +62,12 @@ socks_state_free(socks_state_t *s) free(s); } +#ifdef _WIN32 +#define ERR(e) WSA##e +#else +#define ERR(e) e +#endif + /** This function receives an errno(3) 'error' and returns the reply code that should be sent to the SOCKS client. @@ -80,11 +87,11 @@ socks_errno_to_reply(socks_state_t *state, int error) return SOCKS5_SUCCESS; else { switch (error) { - case ENETUNREACH: + case ERR(ENETUNREACH): return SOCKS5_FAILED_NETUNREACH; - case EHOSTUNREACH: + case ERR(EHOSTUNREACH): return SOCKS5_FAILED_HOSTUNREACH; - case ECONNREFUSED: + case ERR(ECONNREFUSED): return SOCKS5_FAILED_REFUSED; default: return SOCKS5_FAILED_GENERAL; @@ -94,6 +101,8 @@ socks_errno_to_reply(socks_state_t *state, int error) return -1; } +#undef ERR + /** Takes a command request from 'source', it evaluates it and if it's legit it parses it into 'parsereq'. @@ -109,7 +118,7 @@ socks_errno_to_reply(socks_state_t *state, int error) Client Request (Client -> Server) */ -int +enum req_status socks5_handle_request(struct evbuffer *source, struct parsereq *parsereq) { /** XXX: max FQDN size is 255. */ @@ -121,7 +130,7 @@ socks5_handle_request(struct evbuffer *source, struct parsereq *parsereq) if (buflength < SIZEOF_SOCKS5_STATIC_REQ+1) { printf("socks: request packet is too small (1).\n"); - return 0; + return SOCKS_INCOMPLETE; } /* We only need the socks5_req and an extra byte to get @@ -140,7 +149,7 @@ socks5_handle_request(struct evbuffer *source, struct parsereq *parsereq) } if (p[1] != SOCKS5_CMD_CONNECT) - return -2; /* We must send reply to the client. */ + return SOCKS_CMD_NOT_CONNECT; /* We must send reply to the client. */ unsigned int addrlen,af,extralen=0; /* p[3] is Address type field */ @@ -169,7 +178,7 @@ socks5_handle_request(struct evbuffer *source, struct parsereq *parsereq) int minsize = SIZEOF_SOCKS5_STATIC_REQ + addrlen + extralen + 2; if (buflength < minsize) { printf("socks: request packet too small %d:%d (2)\n", buflength, minsize); - return 0; + return SOCKS_INCOMPLETE; } /* Drain data from the buffer to get to the good part, the actual @@ -203,10 +212,10 @@ socks5_handle_request(struct evbuffer *source, struct parsereq *parsereq) parsereq->port = ntohs(destport); parsereq->af = af; - return 1; + return SOCKS_GOOD; err: - return -1; + return SOCKS_BROKEN; } /** @@ -446,7 +455,7 @@ int handle_socks(struct evbuffer *source, struct evbuffer *dest, socks_state_t *socks_state) { - int r; + enum req_status r; if (socks_state->broken) return -1; @@ -496,15 +505,15 @@ handle_socks(struct evbuffer *source, struct evbuffer *dest, if (socks_state->state == ST_NEGOTIATION_DONE) { /* We know this connection. Let's see what it wants. */ r = socks5_handle_request(source,&socks_state->parsereq); - if (r == -2) { /* Request CMD != CONNECT. */ + if (r == SOCKS_GOOD) + socks_state->state = ST_HAVE_ADDR; + else if (r == SOCKS_INCOMPLETE) + return SOCKS_INCOMPLETE; + else if (r == SOCKS_CMD_NOT_CONNECT) { socks_state->broken = 1; - return -2; - } else if (r == -1) /* Broken request. */ + return SOCKS_CMD_NOT_CONNECT; + } else if (r == SOCKS_BROKEN) goto broken; - else if (r == 0) /* Incomplete. */ - return 0; - else if (r == 1) /* Neat request. */ - socks_state->state = ST_HAVE_ADDR; return r; } break; diff --git a/src/socks.h b/src/socks.h index d360982..7b35cb5 100644 --- a/src/socks.h +++ b/src/socks.h @@ -16,6 +16,14 @@ enum socks_status_t { /* Have sent reply */ ST_SENT_REPLY }; + +enum req_status { + SOCKS_GOOD=0, + SOCKS_INCOMPLETE, + SOCKS_CMD_NOT_CONNECT, + SOCKS_BROKEN +}; + int handle_socks(struct evbuffer *source, struct evbuffer *dest, socks_state_t *socks_state); socks_state_t *socks_state_new(void); @@ -90,10 +98,10 @@ struct socks_state_t { int socks5_handle_negotiation(struct evbuffer *source, struct evbuffer *dest, socks_state_t *state); -int socks5_handle_request(struct evbuffer *source, - struct parsereq *parsereq); int socks5_send_reply(struct evbuffer *reply_dest, socks_state_t *state, int status); +enum req_status socks5_handle_request(struct evbuffer *source, struct parsereq *parsereq); + int socks4_read_request(struct evbuffer *source, socks_state_t *state); int socks4_send_reply(struct evbuffer *dest, diff --git a/src/test/test_socks_unsupported.py b/src/test/test_socks_unsupported.py index c0d625c..d1afd02 100644 --- a/src/test/test_socks_unsupported.py +++ b/src/test/test_socks_unsupported.py @@ -13,4 +13,6 @@ s.send(request) data = s.recv(1024) if (struct.unpack('BBBBih', data)[1] == 7): print "Works." +else: + print "Fail!" diff --git a/src/test/unittest_socks.c b/src/test/unittest_socks.c index 5ec28cc..d7706ee 100644 --- a/src/test/unittest_socks.c +++ b/src/test/unittest_socks.c @@ -158,7 +158,7 @@ test_socks_socks5_request(void *data) evbuffer_add(source, "\x05", 1); evbuffer_add(source, req1, 7); - tt_int_op(0, ==, socks5_handle_request(source,&pr1)); /* 0: want more data*/ + tt_int_op(SOCKS_INCOMPLETE, ==, socks5_handle_request(source,&pr1)); /* 0: want more data*/ /* emptying source buffer before next test */ size_t buffer_len = evbuffer_get_length(source); @@ -175,7 +175,7 @@ test_socks_socks5_request(void *data) evbuffer_add(source, "\x05", 1); evbuffer_add(source, req2, 7); - tt_int_op(0, ==, socks5_handle_request(source,&pr1)); /* 0: want more data*/ + tt_int_op(SOCKS_INCOMPLETE, ==, socks5_handle_request(source,&pr1)); /* 0: want more data*/ /* emptying source buffer before next test */ buffer_len = evbuffer_get_length(source); @@ -192,7 +192,7 @@ test_socks_socks5_request(void *data) evbuffer_add(source, "\x05", 1); evbuffer_add(source, req3, 9); - tt_int_op(1, ==, socks5_handle_request(source,&pr1)); + tt_int_op(SOCKS_GOOD, ==, socks5_handle_request(source,&pr1)); tt_str_op(pr1.addr, ==, "127.0.0.1"); tt_int_op(pr1.port, ==, 80); @@ -211,7 +211,7 @@ test_socks_socks5_request(void *data) memcpy(req4+20,&port,2); evbuffer_add(source,req4,22); - tt_int_op(1, ==, socks5_handle_request(source,&pr1)); + tt_int_op(SOCKS_GOOD, ==, socks5_handle_request(source,&pr1)); tt_str_op(pr1.addr, ==, "d:1:5:e:a:5:e:0"); tt_int_op(pr1.port, ==, 80); @@ -232,7 +232,7 @@ test_socks_socks5_request(void *data) memcpy(req5+5+strlen(fqdn),&port,2); evbuffer_add(source, req5, 24); - tt_int_op(1, ==, socks5_handle_request(source,&pr1)); + tt_int_op(SOCKS_GOOD, ==, socks5_handle_request(source,&pr1)); tt_str_op(pr1.addr, ==, "www.test.example"); tt_int_op(pr1.port, ==, 80); @@ -244,7 +244,7 @@ test_socks_socks5_request(void *data) req6[2] = 0; evbuffer_add(source,req6,3); - tt_int_op(0, ==, socks5_handle_request(source,&pr1)); + tt_int_op(SOCKS_INCOMPLETE, ==, socks5_handle_request(source,&pr1)); /* emptying source buffer before next test */ buffer_len = evbuffer_get_length(source); @@ -260,7 +260,7 @@ test_socks_socks5_request(void *data) req7[4] = 42; evbuffer_add(source,req7,5); - tt_int_op(-1, ==, socks5_handle_request(source,&pr1)); + tt_int_op(SOCKS_BROKEN, ==, socks5_handle_request(source,&pr1)); /* emptying source buffer before next test */ buffer_len = evbuffer_get_length(source); @@ -278,7 +278,7 @@ test_socks_socks5_request(void *data) evbuffer_add(source, "\x05", 1); evbuffer_add(source, req8, 9); /* '-2' means that we don't support the requested command. */ - tt_int_op(-2, ==, socks5_handle_request(source,&pr1)); + tt_int_op(SOCKS_CMD_NOT_CONNECT, ==, socks5_handle_request(source,&pr1)); end:

1 0

[obfsproxy/master] evutil_socket_geterror() takes an argument
by nickm＠torproject.org 28 May '11

28 May '11

commit 3d988b65198163de6b0c9e4de2bfc964dcfe3e82 Author: Nick Mathewson <nickm(a)torproject.org> Date: Sat May 28 00:34:02 2011 -0400 evutil_socket_geterror() takes an argument --- src/network.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/src/network.c b/src/network.c index f1c4584..0f26648 100644 --- a/src/network.c +++ b/src/network.c @@ -368,7 +368,7 @@ output_event_cb(struct bufferevent *bev, short what, void *arg) bufferevent_enable(conn->input, EV_WRITE); bufferevent_disable(conn->input, EV_READ); socks_send_reply(conn->socks_state, bufferevent_get_output(conn->input), - evutil_socket_geterror()); + evutil_socket_geterror(bufferevent_getfd(bev))); bufferevent_setcb(conn->input, NULL, close_conn_on_flush, output_event_cb, conn); return;

1 0

r24790: {website} fix the warning image and link to the donation page through (in website/trunk: css donate/en)
by Andrew Lewman 27 May '11

27 May '11

Author: phobos Date: 2011-05-27 02:15:22 +0000 (Fri, 27 May 2011) New Revision: 24790 Modified: website/trunk/css/layout.css website/trunk/donate/en/become-sponsor.wml website/trunk/donate/en/donate-hardware.wml website/trunk/donate/en/donate-service.wml website/trunk/donate/en/matching-program.wml Log: fix the warning image and link to the donation page through the new sidenav. Modified: website/trunk/css/layout.css =================================================================== --- website/trunk/css/layout.css 2011-05-27 01:25:07 UTC (rev 24789) +++ website/trunk/css/layout.css 2011-05-27 02:15:22 UTC (rev 24790) @@ -431,7 +431,7 @@ } .warning h2 { - background: url("../images/warning.jpg") no-repeat scroll left top transparent; + background: url("../images/warning2.jpg") no-repeat scroll left top transparent; padding-left: 40px; } Modified: website/trunk/donate/en/become-sponsor.wml =================================================================== --- website/trunk/donate/en/become-sponsor.wml 2011-05-27 01:25:07 UTC (rev 24789) +++ website/trunk/donate/en/become-sponsor.wml 2011-05-27 02:15:22 UTC (rev 24790) @@ -39,7 +39,7 @@ </div>  <div id = "sidecol"> -#include "side.wmi" +#include "side-donate.wmi" #include "info.wmi" </div>  Modified: website/trunk/donate/en/donate-hardware.wml =================================================================== --- website/trunk/donate/en/donate-hardware.wml 2011-05-27 01:25:07 UTC (rev 24789) +++ website/trunk/donate/en/donate-hardware.wml 2011-05-27 02:15:22 UTC (rev 24790) @@ -27,7 +27,7 @@ </div>  <div id = "sidecol"> -#include "side.wmi" +#include "side-donate.wmi" #include "info.wmi" </div>  Modified: website/trunk/donate/en/donate-service.wml =================================================================== --- website/trunk/donate/en/donate-service.wml 2011-05-27 01:25:07 UTC (rev 24789) +++ website/trunk/donate/en/donate-service.wml 2011-05-27 02:15:22 UTC (rev 24790) @@ -36,7 +36,7 @@ </div>  <div id = "sidecol"> -#include "side.wmi" +#include "side-donate.wmi" #include "info.wmi" </div>  Modified: website/trunk/donate/en/matching-program.wml =================================================================== --- website/trunk/donate/en/matching-program.wml 2011-05-27 01:25:07 UTC (rev 24789) +++ website/trunk/donate/en/matching-program.wml 2011-05-27 02:15:22 UTC (rev 24790) @@ -16,7 +16,7 @@ </div>  <div id = "sidecol"> -#include "side.wmi" +#include "side-donate.wmi" #include "info.wmi" </div>

1 0

r24789: {website} rransom is correct, it's page donate/donate. (website/trunk/download/en)
by Andrew Lewman 27 May '11

27 May '11

Author: phobos Date: 2011-05-27 01:25:07 +0000 (Fri, 27 May 2011) New Revision: 24789 Modified: website/trunk/download/en/download-easy.wml website/trunk/download/en/download.wml Log: rransom is correct, it's page donate/donate. Modified: website/trunk/download/en/download-easy.wml =================================================================== --- website/trunk/download/en/download-easy.wml 2011-05-27 01:20:37 UTC (rev 24788) +++ website/trunk/download/en/download-easy.wml 2011-05-27 01:25:07 UTC (rev 24789) @@ -96,7 +96,7 @@ <input class="donate-btn" type="submit" name="donate" value="Donate"> </p> <p> - <a href="../donate/donate" >Other donation options...</a> + <a href="<page donate/donate>">Other donation options...</a> </p> </form> </td> Modified: website/trunk/download/en/download.wml =================================================================== --- website/trunk/download/en/download.wml 2011-05-27 01:20:37 UTC (rev 24788) +++ website/trunk/download/en/download.wml 2011-05-27 01:25:07 UTC (rev 24789) @@ -92,7 +92,7 @@ <p> <input class="donate-btn" type="submit" name="donate" value="Donate"> </p> - <p><a href="../donate/donate" >Other donation options...</a></p> + <p><a href="<page donate/donate>">Other donation options...</a></p> </form>

1 0

r24788: {website} remove the hard links to english pages. (in website/trunk: donate/en download/en)
by Andrew Lewman 27 May '11

27 May '11

Author: phobos Date: 2011-05-27 01:20:37 +0000 (Fri, 27 May 2011) New Revision: 24788 Modified: website/trunk/donate/en/donate.wml website/trunk/download/en/download-easy.wml website/trunk/download/en/download.wml Log: remove the hard links to english pages. Modified: website/trunk/donate/en/donate.wml =================================================================== --- website/trunk/donate/en/donate.wml 2011-05-27 01:04:25 UTC (rev 24787) +++ website/trunk/donate/en/donate.wml 2011-05-27 01:20:37 UTC (rev 24788) @@ -142,10 +142,10 @@ <input type="hidden" name="isDonationWidget" value="1"> <input type="hidden" name="description" value="Supporting Online Anonymity & Privacy"> <input type="hidden" name="amazonPaymentsAccountId" value="XGSROLNTXRNC3N1P4TXKMNK14LN1D6SZUD8SN1"> - <input type="hidden" name="returnUrl" value="https://www.torproject.org/donate/donate.html.en"> + <input type="hidden" name="returnUrl" value="https://www.torproject.org/donate/donate"> <input type="hidden" name="processImmediate" value="1"> <input type="hidden" name="cobrandingStyle" value="logo"> - <input type="hidden" name="abandonUrl" value="https://www.torproject.org/donate/donate.html.en"> + <input type="hidden" name="abandonUrl" value="https://www.torproject.org/donate/donate"> </div> </form> <small>Requires an Amazon Account</small> Modified: website/trunk/download/en/download-easy.wml =================================================================== --- website/trunk/download/en/download-easy.wml 2011-05-27 01:04:25 UTC (rev 24787) +++ website/trunk/download/en/download-easy.wml 2011-05-27 01:20:37 UTC (rev 24788) @@ -96,7 +96,7 @@ <input class="donate-btn" type="submit" name="donate" value="Donate"> </p> <p> - <a href="../donate/donate.html.en" >Other donation options...</a> + <a href="../donate/donate" >Other donation options...</a> </p> </form> </td> @@ -152,7 +152,7 @@ </tbody> </table>  +<p>Interested in <a href="../about/overview">learning more about Tor in general</a>?</p> --> </div>  <div id="sidecol-right"> Modified: website/trunk/download/en/download.wml =================================================================== --- website/trunk/download/en/download.wml 2011-05-27 01:04:25 UTC (rev 24787) +++ website/trunk/download/en/download.wml 2011-05-27 01:20:37 UTC (rev 24788) @@ -92,7 +92,7 @@ <p> <input class="donate-btn" type="submit" name="donate" value="Donate"> </p> - <p><a href="../donate/donate.html.en" >Other donation options...</a></p> + <p><a href="../donate/donate" >Other donation options...</a></p> </form>

1 0