Socks5ClientConnector.java
/*
* Copyright (C) 2018, Thomas Wolf <thomas.wolf@paranor.ch> and others
*
* This program and the accompanying materials are made available under the
* terms of the Eclipse Distribution License v. 1.0 which is available at
* https://www.eclipse.org/org/documents/edl-v10.php.
*
* SPDX-License-Identifier: BSD-3-Clause
*/
package org.eclipse.jgit.internal.transport.sshd.proxy;
import static java.nio.charset.StandardCharsets.US_ASCII;
import static java.nio.charset.StandardCharsets.UTF_8;
import static java.text.MessageFormat.format;
import java.io.IOException;
import java.net.InetAddress;
import java.net.InetSocketAddress;
import org.apache.sshd.client.session.ClientSession;
import org.apache.sshd.common.io.IoSession;
import org.apache.sshd.common.util.Readable;
import org.apache.sshd.common.util.buffer.Buffer;
import org.apache.sshd.common.util.buffer.BufferUtils;
import org.apache.sshd.common.util.buffer.ByteArrayBuffer;
import org.eclipse.jgit.annotations.NonNull;
import org.eclipse.jgit.internal.transport.sshd.GssApiMechanisms;
import org.eclipse.jgit.internal.transport.sshd.SshdText;
import org.eclipse.jgit.internal.transport.sshd.auth.AuthenticationHandler;
import org.eclipse.jgit.internal.transport.sshd.auth.BasicAuthentication;
import org.eclipse.jgit.internal.transport.sshd.auth.GssApiAuthentication;
import org.eclipse.jgit.transport.SshConstants;
import org.ietf.jgss.GSSContext;
/**
* A {@link AbstractClientProxyConnector} to connect through a SOCKS5 proxy.
*
* @see <a href="https://tools.ietf.org/html/rfc1928">RFC 1928</a>
*/
public class Socks5ClientConnector extends AbstractClientProxyConnector {
// private static final byte SOCKS_VERSION_4 = 4;
private static final byte SOCKS_VERSION_5 = 5;
private static final byte SOCKS_CMD_CONNECT = 1;
// private static final byte SOCKS5_CMD_BIND = 2;
// private static final byte SOCKS5_CMD_UDP_ASSOCIATE = 3;
// Address types
private static final byte SOCKS_ADDRESS_IPv4 = 1;
private static final byte SOCKS_ADDRESS_FQDN = 3;
private static final byte SOCKS_ADDRESS_IPv6 = 4;
// Reply codes
private static final byte SOCKS_REPLY_SUCCESS = 0;
private static final byte SOCKS_REPLY_FAILURE = 1;
private static final byte SOCKS_REPLY_FORBIDDEN = 2;
private static final byte SOCKS_REPLY_NETWORK_UNREACHABLE = 3;
private static final byte SOCKS_REPLY_HOST_UNREACHABLE = 4;
private static final byte SOCKS_REPLY_CONNECTION_REFUSED = 5;
private static final byte SOCKS_REPLY_TTL_EXPIRED = 6;
private static final byte SOCKS_REPLY_COMMAND_UNSUPPORTED = 7;
private static final byte SOCKS_REPLY_ADDRESS_UNSUPPORTED = 8;
/**
* Authentication methods for SOCKS5.
*
* @see <a href=
* "https://www.iana.org/assignments/socks-methods/socks-methods.xhtml">SOCKS
* Methods, IANA.org</a>
*/
private enum SocksAuthenticationMethod {
ANONYMOUS(0),
GSSAPI(1),
PASSWORD(2),
// CHALLENGE_HANDSHAKE(3),
// CHALLENGE_RESPONSE(5),
// SSL(6),
// NDS(7),
// MULTI_AUTH(8),
// JSON(9),
NONE_ACCEPTABLE(0xFF);
private final byte value;
SocksAuthenticationMethod(int value) {
this.value = (byte) value;
}
public byte getValue() {
return value;
}
}
private enum ProtocolState {
NONE,
INIT {
@Override
public void handleMessage(Socks5ClientConnector connector,
IoSession session, Buffer data) throws Exception {
connector.versionCheck(data.getByte());
SocksAuthenticationMethod authMethod = connector.getAuthMethod(
data.getByte());
switch (authMethod) {
case ANONYMOUS:
connector.sendConnectInfo(session);
break;
case PASSWORD:
connector.doPasswordAuth(session);
break;
case GSSAPI:
connector.doGssApiAuth(session);
break;
default:
throw new IOException(
format(SshdText.get().proxyCannotAuthenticate,
connector.proxyAddress));
}
}
},
AUTHENTICATING {
@Override
public void handleMessage(Socks5ClientConnector connector,
IoSession session, Buffer data) throws Exception {
connector.authStep(session, data);
}
},
CONNECTING {
@Override
public void handleMessage(Socks5ClientConnector connector,
IoSession session, Buffer data) throws Exception {
// Special case: when GSS-API authentication completes, the
// client moves into CONNECTING as soon as the GSS context is
// established and sends the connect request. This is per RFC
// 1961. But for the server, RFC 1961 says it _should_ send an
// empty token even if none generated when its server side
// context is established. That means we may actually get an
// empty token here. That message is 4 bytes long (and has
// content 0x01, 0x01, 0x00, 0x00). We simply skip this message
// if we get it here. If the server for whatever reason sends
// back a "GSS failed" message (it shouldn't, at this point)
// it will be two bytes 0x01 0xFF, which will fail the version
// check.
if (data.available() != 4) {
connector.versionCheck(data.getByte());
connector.establishConnection(data);
}
}
},
CONNECTED,
FAILED;
public void handleMessage(Socks5ClientConnector connector,
@SuppressWarnings("unused") IoSession session, Buffer data)
throws Exception {
throw new IOException(
format(SshdText.get().proxySocksUnexpectedMessage,
connector.proxyAddress, this,
BufferUtils.toHex(data.array())));
}
}
private ProtocolState state;
private AuthenticationHandler<Buffer, Buffer> authenticator;
private GSSContext context;
private byte[] authenticationProposals;
/**
* Creates a new {@link Socks5ClientConnector}. The connector supports
* anonymous connections as well as username-password or Kerberos5 (GSS-API)
* authentication.
*
* @param proxyAddress
* of the proxy server we're connecting to
* @param remoteAddress
* of the target server to connect to
*/
public Socks5ClientConnector(@NonNull InetSocketAddress proxyAddress,
@NonNull InetSocketAddress remoteAddress) {
this(proxyAddress, remoteAddress, null, null);
}
/**
* Creates a new {@link Socks5ClientConnector}. The connector supports
* anonymous connections as well as username-password or Kerberos5 (GSS-API)
* authentication.
*
* @param proxyAddress
* of the proxy server we're connecting to
* @param remoteAddress
* of the target server to connect to
* @param proxyUser
* to authenticate at the proxy with
* @param proxyPassword
* to authenticate at the proxy with
*/
public Socks5ClientConnector(@NonNull InetSocketAddress proxyAddress,
@NonNull InetSocketAddress remoteAddress,
String proxyUser, char[] proxyPassword) {
super(proxyAddress, remoteAddress, proxyUser, proxyPassword);
this.state = ProtocolState.NONE;
}
@Override
public void sendClientProxyMetadata(ClientSession sshSession)
throws Exception {
init(sshSession);
IoSession session = sshSession.getIoSession();
// Send the initial request
Buffer buffer = new ByteArrayBuffer(5, false);
buffer.putByte(SOCKS_VERSION_5);
context = getGSSContext(remoteAddress);
authenticationProposals = getAuthenticationProposals();
buffer.putByte((byte) authenticationProposals.length);
buffer.putRawBytes(authenticationProposals);
state = ProtocolState.INIT;
session.writeBuffer(buffer).verify(getTimeout());
}
private byte[] getAuthenticationProposals() {
byte[] proposals = new byte[3];
int i = 0;
proposals[i++] = SocksAuthenticationMethod.ANONYMOUS.getValue();
proposals[i++] = SocksAuthenticationMethod.PASSWORD.getValue();
if (context != null) {
proposals[i++] = SocksAuthenticationMethod.GSSAPI.getValue();
}
if (i == proposals.length) {
return proposals;
}
byte[] result = new byte[i];
System.arraycopy(proposals, 0, result, 0, i);
return result;
}
private void sendConnectInfo(IoSession session) throws Exception {
GssApiMechanisms.closeContextSilently(context);
byte[] rawAddress = getRawAddress(remoteAddress);
byte[] remoteName = null;
byte type;
int length = 0;
if (rawAddress == null) {
remoteName = remoteAddress.getHostString().getBytes(US_ASCII);
if (remoteName == null || remoteName.length == 0) {
throw new IOException(
format(SshdText.get().proxySocksNoRemoteHostName,
remoteAddress));
} else if (remoteName.length > 255) {
// Should not occur; host names must not be longer than 255
// US_ASCII characters. Internal error, no translation.
throw new IOException(format(
"Proxy host name too long for SOCKS (at most 255 characters): {0}", //$NON-NLS-1$
remoteAddress.getHostString()));
}
type = SOCKS_ADDRESS_FQDN;
length = remoteName.length + 1;
} else {
length = rawAddress.length;
type = length == 4 ? SOCKS_ADDRESS_IPv4 : SOCKS_ADDRESS_IPv6;
}
Buffer buffer = new ByteArrayBuffer(4 + length + 2, false);
buffer.putByte(SOCKS_VERSION_5);
buffer.putByte(SOCKS_CMD_CONNECT);
buffer.putByte((byte) 0); // Reserved
buffer.putByte(type);
if (remoteName != null) {
buffer.putByte((byte) remoteName.length);
buffer.putRawBytes(remoteName);
} else {
buffer.putRawBytes(rawAddress);
}
int port = remoteAddress.getPort();
if (port <= 0) {
port = SshConstants.SSH_DEFAULT_PORT;
}
buffer.putByte((byte) ((port >> 8) & 0xFF));
buffer.putByte((byte) (port & 0xFF));
state = ProtocolState.CONNECTING;
session.writeBuffer(buffer).verify(getTimeout());
}
private void doPasswordAuth(IoSession session) throws Exception {
GssApiMechanisms.closeContextSilently(context);
authenticator = new SocksBasicAuthentication();
session.addCloseFutureListener(f -> close());
startAuth(session);
}
private void doGssApiAuth(IoSession session) throws Exception {
authenticator = new SocksGssApiAuthentication();
session.addCloseFutureListener(f -> close());
startAuth(session);
}
private void close() {
AuthenticationHandler<?, ?> handler = authenticator;
authenticator = null;
if (handler != null) {
handler.close();
}
}
private void startAuth(IoSession session) throws Exception {
Buffer buffer = null;
try {
authenticator.setParams(null);
authenticator.start();
buffer = authenticator.getToken();
state = ProtocolState.AUTHENTICATING;
if (buffer == null) {
// Internal error; no translation
throw new IOException(
"No data for proxy authentication with " //$NON-NLS-1$
+ proxyAddress);
}
session.writeBuffer(buffer).verify(getTimeout());
} finally {
if (buffer != null) {
buffer.clear(true);
}
}
}
private void authStep(IoSession session, Buffer input) throws Exception {
Buffer buffer = null;
try {
authenticator.setParams(input);
authenticator.process();
buffer = authenticator.getToken();
if (buffer != null) {
session.writeBuffer(buffer).verify(getTimeout());
}
} finally {
if (buffer != null) {
buffer.clear(true);
}
}
if (authenticator.isDone()) {
sendConnectInfo(session);
}
}
private void establishConnection(Buffer data) throws Exception {
byte reply = data.getByte();
switch (reply) {
case SOCKS_REPLY_SUCCESS:
state = ProtocolState.CONNECTED;
setDone(true);
return;
case SOCKS_REPLY_FAILURE:
throw new IOException(format(
SshdText.get().proxySocksFailureGeneral, proxyAddress));
case SOCKS_REPLY_FORBIDDEN:
throw new IOException(
format(SshdText.get().proxySocksFailureForbidden,
proxyAddress, remoteAddress));
case SOCKS_REPLY_NETWORK_UNREACHABLE:
throw new IOException(
format(SshdText.get().proxySocksFailureNetworkUnreachable,
proxyAddress, remoteAddress));
case SOCKS_REPLY_HOST_UNREACHABLE:
throw new IOException(
format(SshdText.get().proxySocksFailureHostUnreachable,
proxyAddress, remoteAddress));
case SOCKS_REPLY_CONNECTION_REFUSED:
throw new IOException(
format(SshdText.get().proxySocksFailureRefused,
proxyAddress, remoteAddress));
case SOCKS_REPLY_TTL_EXPIRED:
throw new IOException(
format(SshdText.get().proxySocksFailureTTL, proxyAddress));
case SOCKS_REPLY_COMMAND_UNSUPPORTED:
throw new IOException(
format(SshdText.get().proxySocksFailureUnsupportedCommand,
proxyAddress));
case SOCKS_REPLY_ADDRESS_UNSUPPORTED:
throw new IOException(
format(SshdText.get().proxySocksFailureUnsupportedAddress,
proxyAddress));
default:
throw new IOException(format(
SshdText.get().proxySocksFailureUnspecified, proxyAddress));
}
}
@Override
public void messageReceived(IoSession session, Readable buffer)
throws Exception {
try {
// Dispatch according to protocol state
ByteArrayBuffer data = new ByteArrayBuffer(buffer.available(),
false);
data.putBuffer(buffer);
data.compact();
state.handleMessage(this, session, data);
} catch (Exception e) {
state = ProtocolState.FAILED;
if (authenticator != null) {
authenticator.close();
authenticator = null;
}
try {
setDone(false);
} catch (Exception inner) {
e.addSuppressed(inner);
}
throw e;
}
}
private void versionCheck(byte version) throws Exception {
if (version != SOCKS_VERSION_5) {
throw new IOException(
format(SshdText.get().proxySocksUnexpectedVersion,
Integer.toString(version & 0xFF)));
}
}
private SocksAuthenticationMethod getAuthMethod(byte value) {
if (value != SocksAuthenticationMethod.NONE_ACCEPTABLE.getValue()) {
for (byte proposed : authenticationProposals) {
if (proposed == value) {
for (SocksAuthenticationMethod method : SocksAuthenticationMethod
.values()) {
if (method.getValue() == value) {
return method;
}
}
break;
}
}
}
return SocksAuthenticationMethod.NONE_ACCEPTABLE;
}
private static byte[] getRawAddress(@NonNull InetSocketAddress address) {
InetAddress ipAddress = GssApiMechanisms.resolve(address);
return ipAddress == null ? null : ipAddress.getAddress();
}
private static GSSContext getGSSContext(
@NonNull InetSocketAddress address) {
if (!GssApiMechanisms.getSupportedMechanisms()
.contains(GssApiMechanisms.KERBEROS_5)) {
return null;
}
return GssApiMechanisms.createContext(GssApiMechanisms.KERBEROS_5,
GssApiMechanisms.getCanonicalName(address));
}
/**
* @see <a href="https://tools.ietf.org/html/rfc1929">RFC 1929</a>
*/
private class SocksBasicAuthentication
extends BasicAuthentication<Buffer, Buffer> {
private static final byte SOCKS_BASIC_PROTOCOL_VERSION = 1;
private static final byte SOCKS_BASIC_AUTH_SUCCESS = 0;
public SocksBasicAuthentication() {
super(proxyAddress, proxyUser, proxyPassword);
}
@Override
public void process() throws Exception {
// Retries impossible. RFC 1929 specifies that the server MUST
// close the connection if authentication is unsuccessful.
done = true;
if (params.getByte() != SOCKS_BASIC_PROTOCOL_VERSION
|| params.getByte() != SOCKS_BASIC_AUTH_SUCCESS) {
throw new IOException(format(
SshdText.get().proxySocksAuthenticationFailed, proxy));
}
}
@Override
protected void askCredentials() {
super.askCredentials();
adjustTimeout();
}
@Override
public Buffer getToken() throws IOException {
if (done) {
return null;
}
try {
byte[] rawUser = user.getBytes(UTF_8);
if (rawUser.length > 255) {
throw new IOException(format(
SshdText.get().proxySocksUsernameTooLong, proxy,
Integer.toString(rawUser.length), user));
}
if (password.length > 255) {
throw new IOException(
format(SshdText.get().proxySocksPasswordTooLong,
proxy, Integer.toString(password.length)));
}
ByteArrayBuffer buffer = new ByteArrayBuffer(
3 + rawUser.length + password.length, false);
buffer.putByte(SOCKS_BASIC_PROTOCOL_VERSION);
buffer.putByte((byte) rawUser.length);
buffer.putRawBytes(rawUser);
buffer.putByte((byte) password.length);
buffer.putRawBytes(password);
return buffer;
} finally {
clearPassword();
done = true;
}
}
}
/**
* @see <a href="https://tools.ietf.org/html/rfc1961">RFC 1961</a>
*/
private class SocksGssApiAuthentication
extends GssApiAuthentication<Buffer, Buffer> {
private static final byte SOCKS5_GSSAPI_VERSION = 1;
private static final byte SOCKS5_GSSAPI_TOKEN = 1;
private static final int SOCKS5_GSSAPI_FAILURE = 0xFF;
public SocksGssApiAuthentication() {
super(proxyAddress);
}
@Override
protected GSSContext createContext() throws Exception {
return context;
}
@Override
public Buffer getToken() throws Exception {
if (token == null) {
return null;
}
Buffer buffer = new ByteArrayBuffer(4 + token.length, false);
buffer.putByte(SOCKS5_GSSAPI_VERSION);
buffer.putByte(SOCKS5_GSSAPI_TOKEN);
buffer.putByte((byte) ((token.length >> 8) & 0xFF));
buffer.putByte((byte) (token.length & 0xFF));
buffer.putRawBytes(token);
return buffer;
}
@Override
protected byte[] extractToken(Buffer input) throws Exception {
if (context == null) {
return null;
}
int version = input.getUByte();
if (version != SOCKS5_GSSAPI_VERSION) {
throw new IOException(
format(SshdText.get().proxySocksGssApiVersionMismatch,
remoteAddress, Integer.toString(version)));
}
int msgType = input.getUByte();
if (msgType == SOCKS5_GSSAPI_FAILURE) {
throw new IOException(format(
SshdText.get().proxySocksGssApiFailure, remoteAddress));
} else if (msgType != SOCKS5_GSSAPI_TOKEN) {
throw new IOException(format(
SshdText.get().proxySocksGssApiUnknownMessage,
remoteAddress, Integer.toHexString(msgType & 0xFF)));
}
if (input.available() >= 2) {
int length = (input.getUByte() << 8) + input.getUByte();
if (input.available() >= length) {
byte[] value = new byte[length];
if (length > 0) {
input.getRawBytes(value);
}
return value;
}
}
throw new IOException(
format(SshdText.get().proxySocksGssApiMessageTooShort,
remoteAddress));
}
}
}