forked from rofl0r/microsocks
-
Notifications
You must be signed in to change notification settings - Fork 0
/
sockssrv.c
449 lines (412 loc) · 12.1 KB
/
sockssrv.c
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
/*
MicroSocks - multithreaded, small, efficient SOCKS5 server.
Copyright (C) 2017 rofl0r.
This is the successor of "rocksocks5", and it was written with
different goals in mind:
- prefer usage of standard libc functions over homegrown ones
- no artificial limits
- do not aim for minimal binary size, but for minimal source code size,
and maximal readability, reusability, and extensibility.
as a result of that, ipv4, dns, and ipv6 is supported out of the box
and can use the same code, while rocksocks5 has several compile time
defines to bring down the size of the resulting binary to extreme values
like 10 KB static linked when only ipv4 support is enabled.
still, if optimized for size, *this* program when static linked against musl
libc is not even 50 KB. that's easily usable even on the cheapest routers.
*/
#define _GNU_SOURCE
#include <unistd.h>
#define _POSIX_C_SOURCE 200809L
#include <stdlib.h>
#include <string.h>
#include <stdio.h>
#include <pthread.h>
#include <signal.h>
#include <sys/select.h>
#include <arpa/inet.h>
#include <errno.h>
#include <limits.h>
#include "server.h"
#include "sblist.h"
#ifndef MAX
#define MAX(x, y) ((x) > (y) ? (x) : (y))
#endif
#if !defined(PTHREAD_STACK_MIN) || defined(__APPLE__)
/* MAC says its min is 8KB, but then crashes in our face. thx hunkOLard */
#undef PTHREAD_STACK_MIN
#define PTHREAD_STACK_MIN 64*1024
#elif defined(__GLIBC__)
#undef PTHREAD_STACK_MIN
#define PTHREAD_STACK_MIN 32*1024
#endif
static const char* auth_user;
static const char* auth_pass;
static sblist* auth_ips;
static pthread_mutex_t auth_ips_mutex = PTHREAD_MUTEX_INITIALIZER;
static const struct server* server;
static int bind_mode;
enum socksstate {
SS_1_CONNECTED,
SS_2_NEED_AUTH, /* skipped if NO_AUTH method supported */
SS_3_AUTHED,
};
enum authmethod {
AM_NO_AUTH = 0,
AM_GSSAPI = 1,
AM_USERNAME = 2,
AM_INVALID = 0xFF
};
enum errorcode {
EC_SUCCESS = 0,
EC_GENERAL_FAILURE = 1,
EC_NOT_ALLOWED = 2,
EC_NET_UNREACHABLE = 3,
EC_HOST_UNREACHABLE = 4,
EC_CONN_REFUSED = 5,
EC_TTL_EXPIRED = 6,
EC_COMMAND_NOT_SUPPORTED = 7,
EC_ADDRESSTYPE_NOT_SUPPORTED = 8,
};
struct thread {
pthread_t pt;
struct client client;
enum socksstate state;
volatile int done;
};
#ifndef CONFIG_LOG
#define CONFIG_LOG 1
#endif
#if CONFIG_LOG
/* we log to stderr because it's not using line buffering, i.e. malloc which would need
locking when called from different threads. for the same reason we use dprintf,
which writes directly to an fd. */
#define dolog(...) dprintf(2, __VA_ARGS__)
#else
static void dolog(const char* fmt, ...) { }
#endif
static int connect_socks_target(unsigned char *buf, size_t n, struct client *client) {
if(n < 5) return -EC_GENERAL_FAILURE;
if(buf[0] != 5) return -EC_GENERAL_FAILURE;
if(buf[1] != 1) return -EC_COMMAND_NOT_SUPPORTED; /* we support only CONNECT method */
if(buf[2] != 0) return -EC_GENERAL_FAILURE; /* malformed packet */
int af = AF_INET;
size_t minlen = 4 + 4 + 2, l;
char namebuf[256];
struct addrinfo* remote;
switch(buf[3]) {
case 4: /* ipv6 */
af = AF_INET6;
minlen = 4 + 2 + 16;
/* fall through */
case 1: /* ipv4 */
if(n < minlen) return -EC_GENERAL_FAILURE;
if(namebuf != inet_ntop(af, buf+4, namebuf, sizeof namebuf))
return -EC_GENERAL_FAILURE; /* malformed or too long addr */
break;
case 3: /* dns name */
l = buf[4];
minlen = 4 + 2 + l + 1;
if(n < 4 + 2 + l + 1) return -EC_GENERAL_FAILURE;
memcpy(namebuf, buf+4+1, l);
namebuf[l] = 0;
break;
default:
return -EC_ADDRESSTYPE_NOT_SUPPORTED;
}
unsigned short port;
port = (buf[minlen-2] << 8) | buf[minlen-1];
if(resolve(namebuf, port, &remote)) return -9;
int fd = socket(remote->ai_addr->sa_family, SOCK_STREAM, 0);
if(fd == -1) {
eval_errno:
freeaddrinfo(remote);
switch(errno) {
case EPROTOTYPE:
case EPROTONOSUPPORT:
case EAFNOSUPPORT:
return -EC_ADDRESSTYPE_NOT_SUPPORTED;
case ECONNREFUSED:
return -EC_CONN_REFUSED;
case ENETDOWN:
case ENETUNREACH:
return -EC_NET_UNREACHABLE;
case EHOSTUNREACH:
return -EC_HOST_UNREACHABLE;
case EBADF:
default:
perror("socket/connect");
return -EC_GENERAL_FAILURE;
}
}
if(bind_mode && server_bindtoip(server, fd) == -1)
goto eval_errno;
if(connect(fd, remote->ai_addr, remote->ai_addrlen) == -1)
goto eval_errno;
freeaddrinfo(remote);
if(CONFIG_LOG) {
char clientname[256];
af = client->addr.v4.sin_family;
void *ipdata = af == AF_INET ? (void*)&client->addr.v4.sin_addr : (void*)&client->addr.v6.sin6_addr;
inet_ntop(af, ipdata, clientname, sizeof clientname);
dolog("client[%d] %s: connected to %s:%d\n", client->fd, clientname, namebuf, port);
}
return fd;
}
static int is_authed(union sockaddr_union *client, union sockaddr_union *authedip) {
if(authedip->v4.sin_family == client->v4.sin_family) {
int af = authedip->v4.sin_family;
size_t cmpbytes = af == AF_INET ? 4 : 16;
void *cmp1 = af == AF_INET ? (void*)&client->v4.sin_addr : (void*)&client->v6.sin6_addr;
void *cmp2 = af == AF_INET ? (void*)&authedip->v4.sin_addr : (void*)&authedip->v6.sin6_addr;
if(!memcmp(cmp1, cmp2, cmpbytes)) return 1;
}
return 0;
}
static enum authmethod check_auth_method(unsigned char *buf, size_t n, struct client*client) {
if(buf[0] != 5) return AM_INVALID;
size_t idx = 1;
if(idx >= n ) return AM_INVALID;
int n_methods = buf[idx];
idx++;
while(idx < n && n_methods > 0) {
if(buf[idx] == AM_NO_AUTH) {
if(!auth_user) return AM_NO_AUTH;
else if(auth_ips) {
size_t i;
int authed = 0;
pthread_mutex_lock(&auth_ips_mutex);
for(i=0;i<sblist_getsize(auth_ips);i++) {
if((authed = is_authed(&client->addr, sblist_get(auth_ips, i))))
break;
}
pthread_mutex_unlock(&auth_ips_mutex);
if(authed) return AM_NO_AUTH;
}
} else if(buf[idx] == AM_USERNAME) {
if(auth_user) return AM_USERNAME;
}
idx++;
n_methods--;
}
return AM_INVALID;
}
static void add_auth_ip(struct client*client) {
pthread_mutex_lock(&auth_ips_mutex);
sblist_add(auth_ips, &client->addr);
pthread_mutex_unlock(&auth_ips_mutex);
}
static void send_auth_response(int fd, int version, enum authmethod meth) {
unsigned char buf[2];
buf[0] = version;
buf[1] = meth;
write(fd, buf, 2);
}
static void send_error(int fd, enum errorcode ec) {
/* position 4 contains ATYP, the address type, which is the same as used in the connect
request. we're lazy and return always IPV4 address type in errors. */
char buf[10] = { 5, ec, 0, 1 /*AT_IPV4*/, 0,0,0,0, 0,0 };
write(fd, buf, 10);
}
static void copyloop(int fd1, int fd2) {
int maxfd = fd2;
if(fd1 > fd2) maxfd = fd1;
fd_set fdsc, fds;
FD_ZERO(&fdsc);
FD_SET(fd1, &fdsc);
FD_SET(fd2, &fdsc);
while(1) {
memcpy(&fds, &fdsc, sizeof(fds));
/* inactive connections are reaped after 15 min to free resources.
usually programs send keep-alive packets so this should only happen
when a connection is really unused. */
struct timeval timeout = {.tv_sec = 60*15, .tv_usec = 0};
switch(select(maxfd+1, &fds, 0, 0, &timeout)) {
case 0:
send_error(fd1, EC_TTL_EXPIRED);
return;
case -1:
if(errno == EINTR) continue;
else perror("select");
return;
}
int infd = FD_ISSET(fd1, &fds) ? fd1 : fd2;
int outfd = infd == fd2 ? fd1 : fd2;
char buf[1024];
ssize_t sent = 0, n = read(infd, buf, sizeof buf);
if(n <= 0) return;
while(sent < n) {
ssize_t m = write(outfd, buf+sent, n-sent);
if(m < 0) return;
sent += m;
}
}
}
static enum errorcode check_credentials(unsigned char* buf, size_t n) {
if(n < 5) return EC_GENERAL_FAILURE;
if(buf[0] != 1) return EC_GENERAL_FAILURE;
unsigned ulen, plen;
ulen=buf[1];
if(n < 2 + ulen + 2) return EC_GENERAL_FAILURE;
plen=buf[2+ulen];
if(n < 2 + ulen + 1 + plen) return EC_GENERAL_FAILURE;
char user[256], pass[256];
memcpy(user, buf+2, ulen);
memcpy(pass, buf+2+ulen+1, plen);
user[ulen] = 0;
pass[plen] = 0;
if(!strcmp(user, auth_user) && !strcmp(pass, auth_pass)) return EC_SUCCESS;
return EC_NOT_ALLOWED;
}
static void* clientthread(void *data) {
struct thread *t = data;
t->state = SS_1_CONNECTED;
unsigned char buf[1024];
ssize_t n;
int ret;
int remotefd = -1;
enum authmethod am;
while((n = recv(t->client.fd, buf, sizeof buf, 0)) > 0) {
switch(t->state) {
case SS_1_CONNECTED:
am = check_auth_method(buf, n, &t->client);
if(am == AM_NO_AUTH) t->state = SS_3_AUTHED;
else if (am == AM_USERNAME) t->state = SS_2_NEED_AUTH;
send_auth_response(t->client.fd, 5, am);
if(am == AM_INVALID) goto breakloop;
break;
case SS_2_NEED_AUTH:
ret = check_credentials(buf, n);
send_auth_response(t->client.fd, 1, ret);
if(ret != EC_SUCCESS)
goto breakloop;
t->state = SS_3_AUTHED;
if(auth_ips) add_auth_ip(&t->client);
break;
case SS_3_AUTHED:
ret = connect_socks_target(buf, n, &t->client);
if(ret < 0) {
send_error(t->client.fd, ret*-1);
goto breakloop;
}
remotefd = ret;
send_error(t->client.fd, EC_SUCCESS);
copyloop(t->client.fd, remotefd);
goto breakloop;
}
}
breakloop:
if(remotefd != -1)
close(remotefd);
close(t->client.fd);
t->done = 1;
return 0;
}
static void collect(sblist *threads) {
size_t i;
for(i=0;i<sblist_getsize(threads);) {
struct thread* thread = *((struct thread**)sblist_get(threads, i));
if(thread->done) {
pthread_join(thread->pt, 0);
sblist_delete(threads, i);
free(thread);
} else
i++;
}
}
static int usage(void) {
dprintf(2,
"MicroSocks SOCKS5 Server\n"
"------------------------\n"
"usage: microsocks -1 -b -i listenip -p port -u user -P password\n"
"all arguments are optional.\n"
"by default listenip is 0.0.0.0 and port 1080.\n\n"
"option -b forces outgoing connections to be bound to the ip specified with -i\n"
"option -1 activates auth_once mode: once a specific ip address\n"
"authed successfully with user/pass, it is added to a whitelist\n"
"and may use the proxy without auth.\n"
"this is handy for programs like firefox that don't support\n"
"user/pass auth. for it to work you'd basically make one connection\n"
"with another program that supports it, and then you can use firefox too.\n"
);
return 1;
}
/* prevent username and password from showing up in top. */
static void zero_arg(char *s) {
size_t i, l = strlen(s);
for(i=0;i<l;i++) s[i] = 0;
}
int main(int argc, char** argv) {
int c;
const char *listenip = "0.0.0.0";
unsigned port = 1080;
while((c = getopt(argc, argv, ":1bi:p:u:P:")) != -1) {
switch(c) {
case '1':
auth_ips = sblist_new(sizeof(union sockaddr_union), 8);
break;
case 'b':
bind_mode = 1;
break;
case 'u':
auth_user = strdup(optarg);
zero_arg(optarg);
break;
case 'P':
auth_pass = strdup(optarg);
zero_arg(optarg);
break;
case 'i':
listenip = optarg;
break;
case 'p':
port = atoi(optarg);
break;
case ':':
dprintf(2, "error: option -%c requires an operand\n", optopt);
case '?':
return usage();
}
}
if((auth_user && !auth_pass) || (!auth_user && auth_pass)) {
dprintf(2, "error: user and pass must be used together\n");
return 1;
}
if(auth_ips && !auth_pass) {
dprintf(2, "error: auth-once option must be used together with user/pass\n");
return 1;
}
signal(SIGPIPE, SIG_IGN);
struct server s;
sblist *threads = sblist_new(sizeof (struct thread*), 8);
if(server_setup(&s, listenip, port)) {
perror("server_setup");
return 1;
}
server = &s;
size_t stacksz = MAX(8192, PTHREAD_STACK_MIN); /* 4KB for us, 4KB for libc */
while(1) {
collect(threads);
struct client c;
struct thread *curr = malloc(sizeof (struct thread));
if(!curr) goto oom;
curr->done = 0;
if(server_waitclient(&s, &c)) continue;
curr->client = c;
if(!sblist_add(threads, &curr)) {
close(curr->client.fd);
free(curr);
oom:
dolog("rejecting connection due to OOM\n");
usleep(16); /* prevent 100% CPU usage in OOM situation */
continue;
}
pthread_attr_t *a = 0, attr;
if(pthread_attr_init(&attr) == 0) {
a = &attr;
pthread_attr_setstacksize(a, stacksz);
}
if(pthread_create(&curr->pt, a, clientthread, curr) != 0)
dolog("pthread_create failed. OOM?\n");
if(a) pthread_attr_destroy(&attr);
}
}