1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
|
From 024bbf84f137b6e937f8a702cb0718544e48483a Mon Sep 17 00:00:00 2001
From: nnposter <nnposter@e0a8ed71-7df4-0310-8962-fdc924857419>
Date: Tue, 16 Mar 2021 02:34:35 +0000
Subject: [PATCH] Make sure that SOCKS proxied server data are processed There
was a race condition where proxied server data could arrive appended to the
final SOCKS handshake response, causing the data to get skipped.
---
ncat/ncat_connect.c | 44 +++++++++++++++++++++++++++++++++++++++++---
1 files changed, 41 insertions(+), 3 deletions(-)
--- a/ncat/ncat_connect.c
+++ b/ncat/ncat_connect.c
@@ -552,6 +552,8 @@ static int do_proxy_socks4(void)
union sockaddr_u addr;
size_t sslen;
int sd;
+ size_t remainderlen;
+ char* remainder;
if (getaddrfamily(o.target) == 2) {
loguser("Error: IPv6 addresses are not supported with Socks4.\n");
@@ -629,6 +631,10 @@ static int do_proxy_socks4(void)
return -1;
}
+ /* whatever is left in the buffer is part of the proxied connection */
+ remainder = socket_buffer_remainder(&stateful_buf, &remainderlen);
+ Write(STDOUT_FILENO, remainder, remainderlen);
+
return sd;
}
@@ -641,7 +647,7 @@ static int do_proxy_socks5(void)
struct socket_buffer stateful_buf;
struct socks5_connect socks5msg;
uint16_t proxyport = htons(o.portno);
- char socksbuf[8];
+ char socksbuf[4];
int sd;
size_t dstlen, targetlen;
struct socks5_request socks5msg2;
@@ -653,6 +659,10 @@ static int do_proxy_socks5(void)
void *addrbuf;
size_t addrlen;
char addrstr[INET6_ADDRSTRLEN];
+ size_t bndaddrlen;
+ char bndaddr[16 + 2]; /* IPv4/IPv6 address and port */
+ size_t remainderlen;
+ char* remainder;
sd = do_connect(SOCK_STREAM);
if (sd == -1) {
@@ -847,13 +857,18 @@ static int do_proxy_socks5(void)
return -1;
}
- /* TODO just two bytes for now, need to read more for bind */
- if (socket_buffer_readcount(&stateful_buf, socksbuf, 2) < 0) {
+ if (socket_buffer_readcount(&stateful_buf, socksbuf, 4) < 0) {
loguser("Error: malformed request response from proxy.\n");
close(sd);
return -1;
}
+ if (socksbuf[0] != SOCKS5_VERSION) {
+ loguser("Error: wrong SOCKS version in request response.\n");
+ close(sd);
+ return -1;
+ }
+
switch(socksbuf[1]) {
case 0:
if (o.verbose)
@@ -897,6 +912,29 @@ static int do_proxy_socks5(void)
return -1;
}
+ switch (socksbuf[3]) {
+ case SOCKS5_ATYP_IPv4:
+ bndaddrlen = 4 + 2;
+ break;
+ case SOCKS5_ATYP_IPv6:
+ bndaddrlen = 16 + 2;
+ break;
+ default:
+ loguser("Error: invalid proxy bind address type.\n");
+ close(sd);
+ return -1;
+ }
+
+ if (socket_buffer_readcount(&stateful_buf, bndaddr, bndaddrlen) < 0) {
+ loguser("Error: malformed request response from proxy.\n");
+ close(sd);
+ return -1;
+ }
+
+ /* whatever is left in the buffer is part of the proxied connection */
+ remainder = socket_buffer_remainder(&stateful_buf, &remainderlen);
+ Write(STDOUT_FILENO, remainder, remainderlen);
+
return(sd);
}
|
