[PATCH] SOCKS4A support

[David Woodhouse]

This provides SOCKS4A support, which allows a SOCKS4 client to provide a
host name instead of an IP address. It indicates that it's doing so by
using a known-invalid IP address 0.0.0.x (where x != 0), and then
appending the NUL-terminated hostname to the connection request.

Although we check for the terminating NUL manually and the
'fatal(len %d > have %d)' should never happen, the condition for it (in
the existing processing of the username) seems to have been off-by-one;
not accounting for the terminating NUL. I've fixed that while I'm at it.

--- openssh-5.0p1/channels.c~	2008-04-09 17:06:20.000000000 +0100
+++ openssh-5.0p1/channels.c	2008-07-01 09:34:51.000000000 +0100
@@ -1028,7 +1028,7 @@ static int
 channel_decode_socks4(Channel *c, fd_set *readset, fd_set *writeset)
 {
 	char *p, *host;
-	u_int len, have, i, found;
+	u_int len, have, i, found, need;
 	char username[256];
 	struct {
 		u_int8_t version;
@@ -1044,10 +1044,20 @@ channel_decode_socks4(Channel *c, fd_set
 	if (have < len)
 		return 0;
 	p = buffer_ptr(&c->input);
+
+	need = 1;
+	/* SOCKS4A uses an invalid IP address 0.0.0.x */
+	if (!p[4] && !p[5] && !p[6] && p[7]) {
+		debug2("channel %d: socks4a request", c->self);
+		/* ... and needs an extra string (the hostname) */
+		need = 2;
+	}
+	/* Check for terminating NUL on the string(s) */
 	for (found = 0, i = len; i < have; i++) {
 		if (p[i] == '\0') {
-			found = 1;
-			break;
+			found++;
+			if (found == need)
+				break;
 		}
 		if (i > 1024) {
 			/* the peer is probably sending garbage */
@@ -1056,7 +1066,7 @@ channel_decode_socks4(Channel *c, fd_set
 			return -1;
 		}
 	}
-	if (!found)
+	if (found < need)
 		return 0;
 	buffer_get(&c->input, (char *)&s4_req.version, 1);
 	buffer_get(&c->input, (char *)&s4_req.command, 1);
@@ -1066,19 +1076,33 @@ channel_decode_socks4(Channel *c, fd_set
 	p = buffer_ptr(&c->input);
 	len = strlen(p);
 	debug2("channel %d: decode socks4: user %s/%d", c->self, p, len);
+	len++;					/* trailing '\0' */
 	if (len > have)
 		fatal("channel %d: decode socks4: len %d > have %d",
 		    c->self, len, have);
 	strlcpy(username, p, sizeof(username));
 	buffer_consume(&c->input, len);
-	buffer_consume(&c->input, 1);		/* trailing '\0' */
 
-	host = inet_ntoa(s4_req.dest_addr);
-	strlcpy(c->path, host, sizeof(c->path));
+	if (need == 1) {			/* SOCKS4: one string */
+		host = inet_ntoa(s4_req.dest_addr);
+		strlcpy(c->path, host, sizeof(c->path));
+	} else {				/* SOCKS4A: two strings */
+		have = buffer_len(&c->input);
+		p = buffer_ptr(&c->input);
+		len = strlen(p);
+		debug2("channel %d: decode socks4a: host %s/%d", c->self, p,
+		       len);
+		len++;				/* trailing '\0' */
+		if (len > have)
+			fatal("channel %d: decode socks4a: len %d > have %d",
+			      c->self, len, have);
+		strlcpy(c->path, p, sizeof(c->path));
+		buffer_consume(&c->input, len);
+	}
 	c->host_port = ntohs(s4_req.dest_port);
 
 	debug2("channel %d: dynamic request: socks4 host %s port %u command %u",
-	    c->self, host, c->host_port, s4_req.command);
+	    c->self, c->path, c->host_port, s4_req.command);
 
 	if (s4_req.command != 1) {
 		debug("channel %d: cannot handle: socks4 cn %d",



-- 
dwmw2