This provides SOCKS4A support, which allows a SOCKS4 client to provide a
host name instead of an IP address. It indicates that it's doing so by
using a known-invalid IP address 0.0.0.x (where x != 0), and then
appending the NUL-terminated hostname to the connection request.
Although we check for the terminating NUL manually and the
'fatal(len %d > have %d)' should never happen, the condition for it
(in
the existing processing of the username) seems to have been off-by-one;
not accounting for the terminating NUL. I've fixed that while I'm at it.
--- openssh-5.0p1/channels.c~ 2008-04-09 17:06:20.000000000 +0100
+++ openssh-5.0p1/channels.c 2008-07-01 09:34:51.000000000 +0100
@@ -1028,7 +1028,7 @@ static int
channel_decode_socks4(Channel *c, fd_set *readset, fd_set *writeset)
{
char *p, *host;
- u_int len, have, i, found;
+ u_int len, have, i, found, need;
char username[256];
struct {
u_int8_t version;
@@ -1044,10 +1044,20 @@ channel_decode_socks4(Channel *c, fd_set
if (have < len)
return 0;
p = buffer_ptr(&c->input);
+
+ need = 1;
+ /* SOCKS4A uses an invalid IP address 0.0.0.x */
+ if (!p[4] && !p[5] && !p[6] && p[7]) {
+ debug2("channel %d: socks4a request", c->self);
+ /* ... and needs an extra string (the hostname) */
+ need = 2;
+ }
+ /* Check for terminating NUL on the string(s) */
for (found = 0, i = len; i < have; i++) {
if (p[i] == '\0') {
- found = 1;
- break;
+ found++;
+ if (found == need)
+ break;
}
if (i > 1024) {
/* the peer is probably sending garbage */
@@ -1056,7 +1066,7 @@ channel_decode_socks4(Channel *c, fd_set
return -1;
}
}
- if (!found)
+ if (found < need)
return 0;
buffer_get(&c->input, (char *)&s4_req.version, 1);
buffer_get(&c->input, (char *)&s4_req.command, 1);
@@ -1066,19 +1076,33 @@ channel_decode_socks4(Channel *c, fd_set
p = buffer_ptr(&c->input);
len = strlen(p);
debug2("channel %d: decode socks4: user %s/%d", c->self, p, len);
+ len++; /* trailing '\0' */
if (len > have)
fatal("channel %d: decode socks4: len %d > have %d",
c->self, len, have);
strlcpy(username, p, sizeof(username));
buffer_consume(&c->input, len);
- buffer_consume(&c->input, 1); /* trailing '\0' */
- host = inet_ntoa(s4_req.dest_addr);
- strlcpy(c->path, host, sizeof(c->path));
+ if (need == 1) { /* SOCKS4: one string */
+ host = inet_ntoa(s4_req.dest_addr);
+ strlcpy(c->path, host, sizeof(c->path));
+ } else { /* SOCKS4A: two strings */
+ have = buffer_len(&c->input);
+ p = buffer_ptr(&c->input);
+ len = strlen(p);
+ debug2("channel %d: decode socks4a: host %s/%d", c->self, p,
+ len);
+ len++; /* trailing '\0' */
+ if (len > have)
+ fatal("channel %d: decode socks4a: len %d > have %d",
+ c->self, len, have);
+ strlcpy(c->path, p, sizeof(c->path));
+ buffer_consume(&c->input, len);
+ }
c->host_port = ntohs(s4_req.dest_port);
debug2("channel %d: dynamic request: socks4 host %s port %u command
%u",
- c->self, host, c->host_port, s4_req.command);
+ c->self, c->path, c->host_port, s4_req.command);
if (s4_req.command != 1) {
debug("channel %d: cannot handle: socks4 cn %d",
--
dwmw2