X-Git-Url: https://git.distorted.org.uk/u/mdw/putty/blobdiff_plain/8d8af57108127dbd5731ac9cce147fe11779e46f..edb548cd8283b5e3f680a0a8b641f9afb12d4ba4:/proxy.c diff --git a/proxy.c b/proxy.c index dd5c428c..70da38c3 100644 --- a/proxy.c +++ b/proxy.c @@ -14,11 +14,10 @@ #include "network.h" #include "proxy.h" -#define do_proxy_dns(cfg) \ - (cfg->proxy_dns == FORCE_ON || \ - (cfg->proxy_dns == AUTO && \ - cfg->proxy_type != PROXY_SOCKS4 && \ - cfg->proxy_type != PROXY_SOCKS5)) +#define do_proxy_dns(conf) \ + (conf_get_int(conf, CONF_proxy_dns) == FORCE_ON || \ + (conf_get_int(conf, CONF_proxy_dns) == AUTO && \ + conf_get_int(conf, CONF_proxy_type) != PROXY_SOCKS4)) /* * Call this when proxy negotiation is complete, so that this @@ -66,6 +65,9 @@ void proxy_activate (Proxy_Socket p) */ if (p->pending_flush) sk_flush(p->sub_socket); + /* if we have a pending EOF to send, send it */ + if (p->pending_eof) sk_write_eof(p->sub_socket); + /* if the backend wanted the socket unfrozen, try to unfreeze. * our set_frozen handler will flush buffered receive data before * unfreezing the actual underlying socket. @@ -118,6 +120,17 @@ static int sk_proxy_write_oob (Socket s, const char *data, int len) return sk_write_oob(ps->sub_socket, data, len); } +static void sk_proxy_write_eof (Socket s) +{ + Proxy_Socket ps = (Proxy_Socket) s; + + if (ps->state != PROXY_STATE_ACTIVE) { + ps->pending_eof = 1; + return; + } + sk_write_eof(ps->sub_socket); +} + static void sk_proxy_flush (Socket s) { Proxy_Socket ps = (Proxy_Socket) s; @@ -191,6 +204,15 @@ static const char * sk_proxy_socket_error (Socket s) /* basic proxy plug functions */ +static void plug_proxy_log(Plug plug, int type, SockAddr addr, int port, + const char *error_msg, int error_code) +{ + Proxy_Plug pp = (Proxy_Plug) plug; + Proxy_Socket ps = pp->proxy_socket; + + plug_log(ps->plug, type, addr, port, error_msg, error_code); +} + static int plug_proxy_closing (Plug p, const char *error_msg, int error_code, int calling_back) { @@ -256,7 +278,7 @@ static int plug_proxy_accepting (Plug p, OSSocket sock) * it will only check the host name. */ static int proxy_for_destination (SockAddr addr, char *hostname, int port, - const Config *cfg) + Conf *conf) { int s = 0, e = 0; char hostip[64]; @@ -264,10 +286,19 @@ static int proxy_for_destination (SockAddr addr, char *hostname, int port, const char *exclude_list; /* + * Special local connections such as Unix-domain sockets + * unconditionally cannot be proxied, even in proxy-localhost + * mode. There just isn't any way to ask any known proxy type for + * them. + */ + if (addr && sk_address_is_special_local(addr)) + return 0; /* do not proxy */ + + /* * Check the host name and IP against the hard-coded * representations of `localhost'. */ - if (!cfg->even_proxy_localhost && + if (!conf_get_int(conf, CONF_even_proxy_localhost) && (sk_hostname_is_local(hostname) || (addr && sk_address_is_local(addr)))) return 0; /* do not proxy */ @@ -281,7 +312,7 @@ static int proxy_for_destination (SockAddr addr, char *hostname, int port, hostname_len = strlen(hostname); - exclude_list = cfg->proxy_exclude_list; + exclude_list = conf_get_str(conf, CONF_proxy_exclude_list); /* now parse the exclude list, and see if either our IP * or hostname matches anything in it. @@ -342,28 +373,29 @@ static int proxy_for_destination (SockAddr addr, char *hostname, int port, } SockAddr name_lookup(char *host, int port, char **canonicalname, - const Config *cfg) + Conf *conf, int addressfamily) { - if (cfg->proxy_type != PROXY_NONE && - do_proxy_dns(cfg) && - proxy_for_destination(NULL, host, port, cfg)) { + if (conf_get_int(conf, CONF_proxy_type) != PROXY_NONE && + do_proxy_dns(conf) && + proxy_for_destination(NULL, host, port, conf)) { *canonicalname = dupstr(host); return sk_nonamelookup(host); } - return sk_namelookup(host, canonicalname); + return sk_namelookup(host, canonicalname, addressfamily); } Socket new_connection(SockAddr addr, char *hostname, int port, int privport, - int oobinline, int nodelay, Plug plug, - const Config *cfg) + int oobinline, int nodelay, int keepalive, + Plug plug, Conf *conf) { static const struct socket_function_table socket_fn_table = { sk_proxy_plug, sk_proxy_close, sk_proxy_write, sk_proxy_write_oob, + sk_proxy_write_eof, sk_proxy_flush, sk_proxy_set_private_ptr, sk_proxy_get_private_ptr, @@ -372,35 +404,39 @@ Socket new_connection(SockAddr addr, char *hostname, }; static const struct plug_function_table plug_fn_table = { + plug_proxy_log, plug_proxy_closing, plug_proxy_receive, plug_proxy_sent, plug_proxy_accepting }; - if (cfg->proxy_type != PROXY_NONE && - proxy_for_destination(addr, hostname, port, cfg)) + if (conf_get_int(conf, CONF_proxy_type) != PROXY_NONE && + proxy_for_destination(addr, hostname, port, conf)) { Proxy_Socket ret; Proxy_Plug pplug; SockAddr proxy_addr; char *proxy_canonical_name; Socket sret; + int type; if ((sret = platform_new_connection(addr, hostname, port, privport, - oobinline, nodelay, plug, cfg)) != + oobinline, nodelay, keepalive, + plug, conf)) != NULL) return sret; ret = snew(struct Socket_proxy_tag); ret->fn = &socket_fn_table; - ret->cfg = *cfg; /* STRUCTURE COPY */ + ret->conf = conf_copy(conf); ret->plug = plug; ret->remote_addr = addr; /* will need to be freed on close */ ret->remote_port = port; ret->error = NULL; ret->pending_flush = 0; + ret->pending_eof = 0; ret->freeze = 0; bufchain_init(&ret->pending_input_data); @@ -410,14 +446,15 @@ Socket new_connection(SockAddr addr, char *hostname, ret->sub_socket = NULL; ret->state = PROXY_STATE_NEW; ret->negotiate = NULL; - - if (cfg->proxy_type == PROXY_HTTP) { + + type = conf_get_int(conf, CONF_proxy_type); + if (type == PROXY_HTTP) { ret->negotiate = proxy_http_negotiate; - } else if (cfg->proxy_type == PROXY_SOCKS4) { + } else if (type == PROXY_SOCKS4) { ret->negotiate = proxy_socks4_negotiate; - } else if (cfg->proxy_type == PROXY_SOCKS5) { + } else if (type == PROXY_SOCKS5) { ret->negotiate = proxy_socks5_negotiate; - } else if (cfg->proxy_type == PROXY_TELNET) { + } else if (type == PROXY_TELNET) { ret->negotiate = proxy_telnet_negotiate; } else { ret->error = "Proxy error: Unknown proxy method"; @@ -431,10 +468,12 @@ Socket new_connection(SockAddr addr, char *hostname, pplug->proxy_socket = ret; /* look-up proxy */ - proxy_addr = sk_namelookup(cfg->proxy_host, - &proxy_canonical_name); + proxy_addr = sk_namelookup(conf_get_str(conf, CONF_proxy_host), + &proxy_canonical_name, + conf_get_int(conf, CONF_addressfamily)); if (sk_addr_error(proxy_addr) != NULL) { ret->error = "Proxy error: Unable to resolve proxy host name"; + sfree(pplug); return (Socket)ret; } sfree(proxy_canonical_name); @@ -442,9 +481,10 @@ Socket new_connection(SockAddr addr, char *hostname, /* create the actual socket we will be using, * connected to our proxy server and port. */ - ret->sub_socket = sk_new(proxy_addr, cfg->proxy_port, + ret->sub_socket = sk_new(proxy_addr, + conf_get_int(conf, CONF_proxy_port), privport, oobinline, - nodelay, (Plug) pplug); + nodelay, keepalive, (Plug) pplug); if (sk_socket_error(ret->sub_socket) != NULL) return (Socket) ret; @@ -456,17 +496,17 @@ Socket new_connection(SockAddr addr, char *hostname, } /* no proxy, so just return the direct socket */ - return sk_new(addr, port, privport, oobinline, nodelay, plug); + return sk_new(addr, port, privport, oobinline, nodelay, keepalive, plug); } Socket new_listener(char *srcaddr, int port, Plug plug, int local_host_only, - const Config *cfg) + Conf *conf, int addressfamily) { /* TODO: SOCKS (and potentially others) support inbound * TODO: connections via the proxy. support them. */ - return sk_newlistener(srcaddr, port, plug, local_host_only); + return sk_newlistener(srcaddr, port, plug, local_host_only, addressfamily); } /* ---------------------------------------------------------------------- @@ -516,6 +556,7 @@ int proxy_http_negotiate (Proxy_Socket p, int change) * request */ char *buf, dest[512]; + char *username, *password; sk_getaddr(p->remote_addr, dest, lenof(dest)); @@ -524,18 +565,22 @@ int proxy_http_negotiate (Proxy_Socket p, int change) sk_write(p->sub_socket, buf, strlen(buf)); sfree(buf); - if (p->cfg.proxy_username[0] || p->cfg.proxy_password[0]) { - char buf[sizeof(p->cfg.proxy_username)+sizeof(p->cfg.proxy_password)]; - char buf2[sizeof(buf)*4/3 + 100]; + username = conf_get_str(p->conf, CONF_proxy_username); + password = conf_get_str(p->conf, CONF_proxy_password); + if (username[0] || password[0]) { + char *buf, *buf2; int i, j, len; - sprintf(buf, "%s:%s", p->cfg.proxy_username, p->cfg.proxy_password); + buf = dupprintf("%s:%s", username, password); len = strlen(buf); + buf2 = snewn(len * 4 / 3 + 100, char); sprintf(buf2, "Proxy-Authorization: Basic "); for (i = 0, j = strlen(buf2); i < len; i += 3, j += 4) base64_encode_atom((unsigned char *)(buf+i), (len-i > 3 ? 3 : len-i), buf2+j); strcpy(buf2+j, "\r\n"); sk_write(p->sub_socket, buf2, strlen(buf2)); + sfree(buf); + sfree(buf2); } sk_write(p->sub_socket, "\r\n", 2); @@ -702,11 +747,11 @@ int proxy_socks4_negotiate (Proxy_Socket p, int change) int length, type, namelen; char *command, addr[4], hostname[512]; + char *username; type = sk_addrtype(p->remote_addr); if (type == ADDRTYPE_IPV6) { - plug_closing(p->plug, "Proxy error: SOCKS version 4 does" - " not support IPv6", PROXY_ERROR_GENERAL, 0); + p->error = "Proxy error: SOCKS version 4 does not support IPv6"; return 1; } else if (type == ADDRTYPE_IPV4) { namelen = 0; @@ -719,9 +764,10 @@ int proxy_socks4_negotiate (Proxy_Socket p, int change) addr[3] = 1; } - length = strlen(p->cfg.proxy_username) + namelen + 9; + username = conf_get_str(p->conf, CONF_proxy_username); + length = strlen(username) + namelen + 9; command = snewn(length, char); - strcpy(command + 8, p->cfg.proxy_username); + strcpy(command + 8, username); command[0] = 4; /* version 4 */ command[1] = 1; /* CONNECT command */ @@ -734,10 +780,11 @@ int proxy_socks4_negotiate (Proxy_Socket p, int change) memcpy(command + 4, addr, 4); /* hostname */ - memcpy(command + 8 + strlen(p->cfg.proxy_username) + 1, + memcpy(command + 8 + strlen(username) + 1, hostname, namelen); sk_write(p->sub_socket, command, length); + sfree(username); sfree(command); p->state = 1; @@ -858,15 +905,19 @@ int proxy_socks5_negotiate (Proxy_Socket p, int change) * 0x03 = CHAP */ - char command[4]; + char command[5]; + char *username, *password; int len; command[0] = 5; /* version 5 */ - if (p->cfg.proxy_username[0] || p->cfg.proxy_password[0]) { - command[1] = 2; /* two methods supported: */ + username = conf_get_str(p->conf, CONF_proxy_username); + password = conf_get_str(p->conf, CONF_proxy_password); + if (username[0] || password[0]) { command[2] = 0x00; /* no authentication */ - command[3] = 0x02; /* username/password */ - len = 4; + len = 3; + proxy_socks5_offerencryptedauth (command, &len); + command[len++] = 0x02; /* username/password */ + command[1] = len - 2; /* Number of methods supported */ } else { command[1] = 1; /* one methods supported: */ command[2] = 0x00; /* no authentication */ @@ -922,7 +973,7 @@ int proxy_socks5_negotiate (Proxy_Socket p, int change) * authentication methods: * 0x00 = no authentication * 0x01 = GSSAPI - * 0x02 = username/password + * 0x02 = username/password * 0x03 = CHAP * 0xff = no acceptable methods */ @@ -987,6 +1038,12 @@ int proxy_socks5_negotiate (Proxy_Socket p, int change) p->state = 2; /* now proceed as authenticated */ } + if (p->state == 8) { + int ret; + ret = proxy_socks5_handlechap(p); + if (ret) return ret; + } + if (p->state == 2) { /* request format: @@ -1132,18 +1189,20 @@ int proxy_socks5_negotiate (Proxy_Socket p, int change) } if (p->state == 5) { - if (p->cfg.proxy_username[0] || p->cfg.proxy_password[0]) { - char userpwbuf[514]; + char *username = conf_get_str(p->conf, CONF_proxy_username); + char *password = conf_get_str(p->conf, CONF_proxy_password); + if (username[0] || password[0]) { + char userpwbuf[255 + 255 + 3]; int ulen, plen; - ulen = strlen(p->cfg.proxy_username); + ulen = strlen(username); if (ulen > 255) ulen = 255; if (ulen < 1) ulen = 1; - plen = strlen(p->cfg.proxy_password); + plen = strlen(password); if (plen > 255) plen = 255; if (plen < 1) plen = 1; userpwbuf[0] = 1; /* version number of subnegotiation */ userpwbuf[1] = ulen; - memcpy(userpwbuf+2, p->cfg.proxy_username, ulen); + memcpy(userpwbuf+2, username, ulen); userpwbuf[ulen+2] = plen; - memcpy(userpwbuf+ulen+3, p->cfg.proxy_password, plen); + memcpy(userpwbuf+ulen+3, password, plen); sk_write(p->sub_socket, userpwbuf, ulen + plen + 3); p->state = 7; } else @@ -1155,10 +1214,9 @@ int proxy_socks5_negotiate (Proxy_Socket p, int change) } if (p->state == 6) { - /* TODO: Handle CHAP authentication */ - plug_closing(p->plug, "Proxy error: We don't support CHAP authentication", - PROXY_ERROR_GENERAL, 0); - return 1; + int ret; + ret = proxy_socks5_selectchap(p); + if (ret) return ret; } } @@ -1177,8 +1235,9 @@ int proxy_socks5_negotiate (Proxy_Socket p, int change) * standardised or at all well-defined.) */ -char *format_telnet_command(SockAddr addr, int port, const Config *cfg) +char *format_telnet_command(SockAddr addr, int port, Conf *conf) { + char *fmt = conf_get_str(conf, CONF_proxy_telnet_command); char *ret = NULL; int retlen = 0, retsize = 0; int so = 0, eo = 0; @@ -1193,22 +1252,21 @@ char *format_telnet_command(SockAddr addr, int port, const Config *cfg) * %%, %host, %port, %user, and %pass */ - while (cfg->proxy_telnet_command[eo] != 0) { + while (fmt[eo] != 0) { /* scan forward until we hit end-of-line, * or an escape character (\ or %) */ - while (cfg->proxy_telnet_command[eo] != 0 && - cfg->proxy_telnet_command[eo] != '%' && - cfg->proxy_telnet_command[eo] != '\\') eo++; + while (fmt[eo] != 0 && fmt[eo] != '%' && fmt[eo] != '\\') + eo++; /* if we hit eol, break out of our escaping loop */ - if (cfg->proxy_telnet_command[eo] == 0) break; + if (fmt[eo] == 0) break; /* if there was any unescaped text before the escape * character, send that now */ if (eo != so) { ENSURE(eo - so); - memcpy(ret + retlen, cfg->proxy_telnet_command + so, eo - so); + memcpy(ret + retlen, fmt + so, eo - so); retlen += eo - so; } @@ -1216,15 +1274,15 @@ char *format_telnet_command(SockAddr addr, int port, const Config *cfg) /* if the escape character was the last character of * the line, we'll just stop and send it. */ - if (cfg->proxy_telnet_command[eo] == 0) break; + if (fmt[eo] == 0) break; - if (cfg->proxy_telnet_command[so] == '\\') { + if (fmt[so] == '\\') { /* we recognize \\, \%, \r, \n, \t, \x??. * anything else, we just send unescaped (including the \). */ - switch (cfg->proxy_telnet_command[eo]) { + switch (fmt[eo]) { case '\\': ENSURE(1); @@ -1265,15 +1323,12 @@ char *format_telnet_command(SockAddr addr, int port, const Config *cfg) for (;;) { eo++; - if (cfg->proxy_telnet_command[eo] >= '0' && - cfg->proxy_telnet_command[eo] <= '9') - v += cfg->proxy_telnet_command[eo] - '0'; - else if (cfg->proxy_telnet_command[eo] >= 'a' && - cfg->proxy_telnet_command[eo] <= 'f') - v += cfg->proxy_telnet_command[eo] - 'a' + 10; - else if (cfg->proxy_telnet_command[eo] >= 'A' && - cfg->proxy_telnet_command[eo] <= 'F') - v += cfg->proxy_telnet_command[eo] - 'A' + 10; + if (fmt[eo] >= '0' && fmt[eo] <= '9') + v += fmt[eo] - '0'; + else if (fmt[eo] >= 'a' && fmt[eo] <= 'f') + v += fmt[eo] - 'a' + 10; + else if (fmt[eo] >= 'A' && fmt[eo] <= 'F') + v += fmt[eo] - 'A' + 10; else { /* non hex character, so we abort and just * send the whole thing unescaped (including \x) @@ -1300,7 +1355,7 @@ char *format_telnet_command(SockAddr addr, int port, const Config *cfg) default: ENSURE(2); - memcpy(ret+retlen, cfg->proxy_telnet_command + so, 2); + memcpy(ret+retlen, fmt + so, 2); retlen += 2; eo++; break; @@ -1308,16 +1363,16 @@ char *format_telnet_command(SockAddr addr, int port, const Config *cfg) } else { /* % escape. we recognize %%, %host, %port, %user, %pass. - * anything else, we just send unescaped (including the %). + * %proxyhost, %proxyport. Anything else we just send + * unescaped (including the %). */ - if (cfg->proxy_telnet_command[eo] == '%') { + if (fmt[eo] == '%') { ENSURE(1); ret[retlen++] = '%'; eo++; } - else if (strnicmp(cfg->proxy_telnet_command + eo, - "host", 4) == 0) { + else if (strnicmp(fmt + eo, "host", 4) == 0) { char dest[512]; int destlen; sk_getaddr(addr, dest, lenof(dest)); @@ -1327,8 +1382,7 @@ char *format_telnet_command(SockAddr addr, int port, const Config *cfg) retlen += destlen; eo += 4; } - else if (strnicmp(cfg->proxy_telnet_command + eo, - "port", 4) == 0) { + else if (strnicmp(fmt + eo, "port", 4) == 0) { char portstr[8], portlen; portlen = sprintf(portstr, "%i", port); ENSURE(portlen); @@ -1336,22 +1390,41 @@ char *format_telnet_command(SockAddr addr, int port, const Config *cfg) retlen += portlen; eo += 4; } - else if (strnicmp(cfg->proxy_telnet_command + eo, - "user", 4) == 0) { - int userlen = strlen(cfg->proxy_username); + else if (strnicmp(fmt + eo, "user", 4) == 0) { + char *username = conf_get_str(conf, CONF_proxy_username); + int userlen = strlen(username); ENSURE(userlen); - memcpy(ret+retlen, cfg->proxy_username, userlen); + memcpy(ret+retlen, username, userlen); retlen += userlen; eo += 4; } - else if (strnicmp(cfg->proxy_telnet_command + eo, - "pass", 4) == 0) { - int passlen = strlen(cfg->proxy_password); + else if (strnicmp(fmt + eo, "pass", 4) == 0) { + char *password = conf_get_str(conf, CONF_proxy_password); + int passlen = strlen(password); ENSURE(passlen); - memcpy(ret+retlen, cfg->proxy_password, passlen); + memcpy(ret+retlen, password, passlen); retlen += passlen; eo += 4; } + else if (strnicmp(fmt + eo, "proxyhost", 9) == 0) { + char *host = conf_get_str(conf, CONF_proxy_host); + int phlen = strlen(host); + ENSURE(phlen); + memcpy(ret+retlen, host, phlen); + retlen += phlen; + eo += 9; + } + else if (strnicmp(fmt + eo, "proxyport", 9) == 0) { + int port = conf_get_int(conf, CONF_proxy_port); + char pport[50]; + int pplen; + sprintf(pport, "%d", port); + pplen = strlen(pport); + ENSURE(pplen); + memcpy(ret+retlen, pport, pplen); + retlen += pplen; + eo += 9; + } else { /* we don't escape this, so send the % now, and * don't advance eo, so that we'll consider the @@ -1369,7 +1442,7 @@ char *format_telnet_command(SockAddr addr, int port, const Config *cfg) /* if there is any unescaped text at the end of the line, send it */ if (eo != so) { ENSURE(eo - so); - memcpy(ret + retlen, cfg->proxy_telnet_command + so, eo - so); + memcpy(ret + retlen, fmt + so, eo - so); retlen += eo - so; } @@ -1386,7 +1459,7 @@ int proxy_telnet_negotiate (Proxy_Socket p, int change) char *formatted_cmd; formatted_cmd = format_telnet_command(p->remote_addr, p->remote_port, - &p->cfg); + p->conf); sk_write(p->sub_socket, formatted_cmd, strlen(formatted_cmd)); sfree(formatted_cmd);