1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
5 /* Copyright (c) The Exim Maintainers 2021 - 2022 */
6 /* Copyright (c) Jeremy Harris 2015 - 2018 */
7 /* See the file NOTICE for conditions of use and distribution. */
9 /* SOCKS version 5 proxy, client-mode */
14 #ifdef SUPPORT_SOCKS /* entire file */
17 # define nelem(arr) (sizeof(arr)/sizeof(*arr))
22 #define SOCKS_PORT 1080
23 #define SOCKS_TIMEOUT 5
24 #define SOCKS_WEIGHT 1
25 #define SOCKS_PRIORITY 1
28 #define AUTH_NAME 2 /* user/password per RFC 1929 */
29 #define AUTH_NAME_VER 1
38 {US"general SOCKS server failure", EIO},
39 {US"connection not allowed by ruleset", EACCES},
40 {US"Network unreachable", ENETUNREACH},
41 {US"Host unreachable", EHOSTUNREACH},
42 {US"Connection refused", ECONNREFUSED},
43 {US"TTL expired", ECANCELED},
44 {US"Command not supported", EOPNOTSUPP},
45 {US"Address type not supported", EAFNOSUPPORT}
50 const uschar * proxy_host;
51 uschar auth_type; /* RFC 1928 encoding */
52 const uschar * auth_name;
53 const uschar * auth_pwd;
62 socks_option_defaults(socks_opts * sob)
64 sob->proxy_host = NULL;
65 sob->auth_type = AUTH_NONE;
66 sob->auth_name = US"";
68 sob->is_failed = FALSE;
69 sob->port = SOCKS_PORT;
70 sob->timeout = SOCKS_TIMEOUT;
71 sob->weight = SOCKS_WEIGHT;
72 sob->priority = SOCKS_PRIORITY;
76 socks_option(socks_opts * sob, const uschar * opt)
78 if (Ustrncmp(opt, "auth=", 5) == 0)
81 if (Ustrcmp(opt, "none") == 0) sob->auth_type = AUTH_NONE;
82 else if (Ustrcmp(opt, "name") == 0) sob->auth_type = AUTH_NAME;
84 else if (Ustrncmp(opt, "name=", 5) == 0)
85 sob->auth_name = opt + 5;
86 else if (Ustrncmp(opt, "pass=", 5) == 0)
87 sob->auth_pwd = opt + 5;
88 else if (Ustrncmp(opt, "port=", 5) == 0)
89 sob->port = atoi(CCS opt + 5);
90 else if (Ustrncmp(opt, "tmo=", 4) == 0)
91 sob->timeout = atoi(CCS opt + 4);
92 else if (Ustrncmp(opt, "pri=", 4) == 0)
93 sob->priority = atoi(CCS opt + 4);
94 else if (Ustrncmp(opt, "weight=", 7) == 0)
95 sob->weight = atoi(CCS opt + 7);
100 socks_auth(int fd, int method, socks_opts * sob, time_t tmo)
108 log_write(0, LOG_MAIN|LOG_PANIC,
109 "Unrecognised socks auth method %d", method);
114 HDEBUG(D_transport|D_acl|D_v) debug_printf_indent(" socks auth NAME '%s' '%s'\n",
115 sob->auth_name, sob->auth_pwd);
116 i = Ustrlen(sob->auth_name);
117 j = Ustrlen(sob->auth_pwd);
118 s = string_sprintf("%c%c%.255s%c%.255s", AUTH_NAME_VER,
119 i, sob->auth_name, j, sob->auth_pwd);
121 HDEBUG(D_transport|D_acl|D_v)
123 debug_printf_indent(" SOCKS>>");
124 for (int i = 0; i<len; i++) debug_printf(" %02x", s[i]);
127 if (send(fd, s, len, 0) < 0)
130 (void) setsockopt(fd, IPPROTO_TCP, TCP_QUICKACK, US &off, sizeof(off));
132 if (!fd_ready(fd, tmo) || read(fd, s, 2) != 2)
134 HDEBUG(D_transport|D_acl|D_v)
135 debug_printf_indent(" SOCKS<< %02x %02x\n", s[0], s[1]);
136 if (s[0] == AUTH_NAME_VER && s[1] == 0)
138 HDEBUG(D_transport|D_acl|D_v) debug_printf_indent(" socks auth OK\n");
142 log_write(0, LOG_MAIN|LOG_PANIC, "socks auth failed");
150 /* Find a suitable proxy to use from the list.
151 Possible common code with spamd_get_server() ?
153 Return: index into proxy spec array, or -1
157 socks_get_proxy(socks_opts * proxies, unsigned nproxies)
161 socks_opts * lim = &proxies[nproxies];
165 if (nproxies == 1) /* shortcut, if we have only 1 server */
166 return (proxies[0].is_failed ? -1 : 0);
168 /* scan for highest pri */
169 for (pri = 0, sd = proxies; sd < lim; sd++)
170 if (!sd->is_failed && sd->priority > pri)
173 /* get sum of weights at this pri */
174 for (weights = 0, sd = proxies; sd < lim; sd++)
175 if (!sd->is_failed && sd->priority == pri)
176 weights += sd->weight;
177 if (weights == 0) /* all servers failed */
180 for (rnd = random_number(weights), i = 0; i < nproxies; i++)
183 if (!sd->is_failed && sd->priority == pri)
184 if ((rnd -= sd->weight) < 0)
188 log_write(0, LOG_MAIN|LOG_PANIC,
189 "%s unknown error (memory/cpu corruption?)", __FUNCTION__);
195 /* Make a connection via a socks proxy
198 host smtp target host
199 host_af address family
200 port remote tcp port number
201 interface local interface
203 timeout connection timeout (zero for indefinite)
206 0 on success; -1 on failure, with errno set
210 socks_sock_connect(host_item * host, int host_af, int port, uschar * interface,
211 transport_instance * tb, int timeout)
213 smtp_transport_options_block * ob =
214 (smtp_transport_options_block *)tb->options_block;
215 const uschar * proxy_list;
216 const uschar * proxy_spec;
220 const uschar * state;
222 socks_opts proxies[32]; /* max #proxies handled */
224 socks_opts * sob = NULL;
228 if (!timeout) timeout = 24*60*60; /* use 1 day for "indefinite" */
229 tmo = time(NULL) + timeout;
231 if (!(proxy_list = expand_string(ob->socks_proxy)))
233 log_write(0, LOG_MAIN|LOG_PANIC, "Bad expansion for socks_proxy in %s",
238 /* Read proxy list */
241 nproxies < nelem(proxies)
242 && (proxy_spec = string_nextinlist(&proxy_list, &sep, NULL, 0));
246 const uschar * option;
248 socks_option_defaults(sob = &proxies[nproxies]);
250 if (!(sob->proxy_host = string_nextinlist(&proxy_spec, &subsep, NULL, 0)))
252 /* paniclog config error */
256 /*XXX consider global options eg. "hide socks_password = wibble" on the tpt */
257 /* extract any further per-proxy options */
258 while ((option = string_nextinlist(&proxy_spec, &subsep, NULL, 0)))
259 socks_option(sob, option);
263 /* Set up the socks protocol method-selection message,
264 for sending on connection */
266 state = US"method select";
267 buf[0] = 5; buf[1] = 1; buf[2] = sob->auth_type;
268 early_data.data = buf;
271 /* Try proxies until a connection succeeds */
277 smtp_connect_args sc = {.sock = -1};
279 if ((idx = socks_get_proxy(proxies, nproxies)) < 0)
281 HDEBUG(D_transport|D_acl|D_v) debug_printf_indent(" no proxies left\n");
287 /* bodge up a host struct for the proxy */
288 proxy.address = proxy.name = sob->proxy_host;
289 proxy.port = sob->port;
294 sc.host_af = Ustrchr(sob->proxy_host, ':') ? AF_INET6 : AF_INET;
295 sc.interface = interface;
297 /*XXX we trust that the method-select command is idempotent */
298 if ((fd = smtp_sock_connect(&sc, sob->timeout, &early_data)) >= 0)
300 proxy_local_address = string_copy(proxy.address);
301 proxy_local_port = sob->port;
305 log_write(0, LOG_MAIN, "%s: %s", __FUNCTION__, strerror(errno));
306 sob->is_failed = TRUE;
309 /* Do the socks protocol stuff */
311 HDEBUG(D_transport|D_acl|D_v) debug_printf_indent(" SOCKS>> 05 01 %02x\n", sob->auth_type);
313 /* expect method response */
316 (void) setsockopt(fd, IPPROTO_TCP, TCP_QUICKACK, US &off, sizeof(off));
319 if ( !fd_ready(fd, tmo)
320 || read(fd, buf, 2) != 2
323 HDEBUG(D_transport|D_acl|D_v)
324 debug_printf_indent(" SOCKS<< %02x %02x\n", buf[0], buf[1]);
326 || socks_auth(fd, buf[1], sob, tmo) != OK
331 union sockaddr_46 sin;
332 (void) ip_addr(&sin, host_af, host->address, port);
334 /* send connect (ipver, ipaddr, port) */
336 buf[0] = 5; buf[1] = 1; buf[2] = 0; buf[3] = host_af == AF_INET6 ? 4 : 1;
338 if (host_af == AF_INET6)
340 memcpy(buf+4, &sin.v6.sin6_addr, sizeof(sin.v6.sin6_addr));
341 memcpy(buf+4+sizeof(sin.v6.sin6_addr),
342 &sin.v6.sin6_port, sizeof(sin.v6.sin6_port));
343 size = 4+sizeof(sin.v6.sin6_addr)+sizeof(sin.v6.sin6_port);
348 memcpy(buf+4, &sin.v4.sin_addr.s_addr, sizeof(sin.v4.sin_addr.s_addr));
349 memcpy(buf+4+sizeof(sin.v4.sin_addr.s_addr),
350 &sin.v4.sin_port, sizeof(sin.v4.sin_port));
351 size = 4+sizeof(sin.v4.sin_addr.s_addr)+sizeof(sin.v4.sin_port);
356 HDEBUG(D_transport|D_acl|D_v)
358 debug_printf_indent(" SOCKS>>");
359 for (int i = 0; i<size; i++) debug_printf(" %02x", buf[i]);
362 if (send(fd, buf, size, 0) < 0)
365 /* expect conn-reply (success, local(ipver, addr, port))
366 of same length as conn-request, or non-success fail code */
368 if ( !fd_ready(fd, tmo)
369 || (size = read(fd, buf, size)) < 2
372 HDEBUG(D_transport|D_acl|D_v)
374 debug_printf_indent(" SOCKS>>");
375 for (int i = 0; i<size; i++) debug_printf(" %02x", buf[i]);
383 proxy_external_address = string_copy(
384 host_ntoa(buf[3] == 4 ? AF_INET6 : AF_INET, buf+4, NULL, NULL));
385 proxy_external_port = ntohs(*((uint16_t *)(buf + (buf[3] == 4 ? 20 : 8))));
386 proxy_session = TRUE;
388 HDEBUG(D_transport|D_acl|D_v)
389 debug_printf_indent(" proxy farside: [%s]:%d\n", proxy_external_address, proxy_external_port);
394 HDEBUG(D_transport|D_acl|D_v) debug_printf_indent(" proxy snd_err %s: %s\n", state, strerror(errno));
399 struct socks_err * se =
400 buf[1] > nelem(socks_errs) ? NULL : socks_errs + buf[1];
401 HDEBUG(D_transport|D_acl|D_v)
402 debug_printf_indent(" proxy %s: %s\n", state, se ? se->reason : US"unknown error code received");
403 errno = se ? se->errcode : EPROTO;
407 HDEBUG(D_transport|D_acl|D_v) debug_printf_indent(" proxy rcv_err %s: %s\n", state, strerror(errno));
408 if (!errno) errno = EPROTO;
409 else if (errno == ENOENT) errno = ECONNABORTED;
413 #endif /* entire file */