]>
Commit | Line | Data |
---|---|---|
71aff188 YCH |
1 | # Public Domain SOCKS proxy protocol implementation |
2 | # Adapted from https://gist.github.com/bluec0re/cafd3764412967417fd3 | |
9e9cd724 YCH |
3 | # References: |
4 | # SOCKS4 protocol http://www.openssh.com/txt/socks4.protocol | |
5 | # SOCKS4A protocol http://www.openssh.com/txt/socks4a.protocol | |
6 | # SOCKS5 protocol https://tools.ietf.org/html/rfc1928 | |
7 | # SOCKS5 username/password authentication https://tools.ietf.org/html/rfc1929 | |
8 | ||
71aff188 YCH |
9 | import collections |
10 | import socket | |
4350b745 | 11 | |
f8271158 | 12 | from .compat import compat_ord, compat_struct_pack, compat_struct_unpack |
4350b745 | 13 | |
71aff188 | 14 | __author__ = 'Timo Schmid <coding@timoschmid.de>' |
4350b745 | 15 | |
9e9cd724 YCH |
16 | SOCKS4_VERSION = 4 |
17 | SOCKS4_REPLY_VERSION = 0x00 | |
18 | # Excerpt from SOCKS4A protocol: | |
19 | # if the client cannot resolve the destination host's domain name to find its | |
20 | # IP address, it should set the first three bytes of DSTIP to NULL and the last | |
21 | # byte to a non-zero value. | |
edaa23f8 | 22 | SOCKS4_DEFAULT_DSTIP = compat_struct_pack('!BBBB', 0, 0, 0, 0xFF) |
9e9cd724 YCH |
23 | |
24 | SOCKS5_VERSION = 5 | |
25 | SOCKS5_USER_AUTH_VERSION = 0x01 | |
26 | SOCKS5_USER_AUTH_SUCCESS = 0x00 | |
27 | ||
28 | ||
86e5f3ed | 29 | class Socks4Command: |
9e9cd724 YCH |
30 | CMD_CONNECT = 0x01 |
31 | CMD_BIND = 0x02 | |
32 | ||
33 | ||
34 | class Socks5Command(Socks4Command): | |
35 | CMD_UDP_ASSOCIATE = 0x03 | |
36 | ||
37 | ||
86e5f3ed | 38 | class Socks5Auth: |
9e9cd724 YCH |
39 | AUTH_NONE = 0x00 |
40 | AUTH_GSSAPI = 0x01 | |
41 | AUTH_USER_PASS = 0x02 | |
42 | AUTH_NO_ACCEPTABLE = 0xFF # For server response | |
43 | ||
44 | ||
86e5f3ed | 45 | class Socks5AddressType: |
9e9cd724 YCH |
46 | ATYP_IPV4 = 0x01 |
47 | ATYP_DOMAINNAME = 0x03 | |
48 | ATYP_IPV6 = 0x04 | |
49 | ||
4350b745 | 50 | |
4bd7d9d4 | 51 | class ProxyError(socket.error): |
9e9cd724 YCH |
52 | ERR_SUCCESS = 0x00 |
53 | ||
54 | def __init__(self, code=None, msg=None): | |
55 | if code is not None and msg is None: | |
83442966 | 56 | msg = self.CODES.get(code) or 'unknown error' |
86e5f3ed | 57 | super().__init__(code, msg) |
9e9cd724 YCH |
58 | |
59 | ||
60 | class InvalidVersionError(ProxyError): | |
61 | def __init__(self, expected_version, got_version): | |
86e5f3ed | 62 | msg = ('Invalid response version from server. Expected {:02x} got ' |
63 | '{:02x}'.format(expected_version, got_version)) | |
64 | super().__init__(0, msg) | |
4350b745 YCH |
65 | |
66 | ||
4350b745 | 67 | class Socks4Error(ProxyError): |
9e9cd724 YCH |
68 | ERR_SUCCESS = 90 |
69 | ||
4350b745 | 70 | CODES = { |
9e9cd724 | 71 | 91: 'request rejected or failed', |
a2406fce | 72 | 92: 'request rejected because SOCKS server cannot connect to identd on the client', |
9e9cd724 | 73 | 93: 'request rejected because the client program and identd report different user-ids' |
4350b745 | 74 | } |
71aff188 | 75 | |
4350b745 | 76 | |
9e9cd724 YCH |
77 | class Socks5Error(ProxyError): |
78 | ERR_GENERAL_FAILURE = 0x01 | |
71aff188 | 79 | |
4350b745 YCH |
80 | CODES = { |
81 | 0x01: 'general SOCKS server failure', | |
82 | 0x02: 'connection not allowed by ruleset', | |
83 | 0x03: 'Network unreachable', | |
84 | 0x04: 'Host unreachable', | |
85 | 0x05: 'Connection refused', | |
86 | 0x06: 'TTL expired', | |
87 | 0x07: 'Command not supported', | |
88 | 0x08: 'Address type not supported', | |
89 | 0xFE: 'unknown username or invalid password', | |
90 | 0xFF: 'all offered authentication methods were rejected' | |
91 | } | |
92 | ||
71aff188 | 93 | |
86e5f3ed | 94 | class ProxyType: |
71aff188 | 95 | SOCKS4 = 0 |
4350b745 | 96 | SOCKS4A = 1 |
71aff188 | 97 | SOCKS5 = 2 |
4350b745 | 98 | |
582be358 | 99 | |
9e9cd724 YCH |
100 | Proxy = collections.namedtuple('Proxy', ( |
101 | 'type', 'host', 'port', 'username', 'password', 'remote_dns')) | |
4350b745 | 102 | |
4350b745 | 103 | |
71aff188 | 104 | class sockssocket(socket.socket): |
9e9cd724 YCH |
105 | def __init__(self, *args, **kwargs): |
106 | self._proxy = None | |
86e5f3ed | 107 | super().__init__(*args, **kwargs) |
9e9cd724 YCH |
108 | |
109 | def setproxy(self, proxytype, addr, port, rdns=True, username=None, password=None): | |
110 | assert proxytype in (ProxyType.SOCKS4, ProxyType.SOCKS4A, ProxyType.SOCKS5) | |
111 | ||
112 | self._proxy = Proxy(proxytype, addr, port, username, password, rdns) | |
4350b745 YCH |
113 | |
114 | def recvall(self, cnt): | |
115 | data = b'' | |
116 | while len(data) < cnt: | |
117 | cur = self.recv(cnt - len(data)) | |
118 | if not cur: | |
86e5f3ed | 119 | raise EOFError(f'{cnt - len(data)} bytes missing') |
4350b745 YCH |
120 | data += cur |
121 | return data | |
122 | ||
9e9cd724 YCH |
123 | def _recv_bytes(self, cnt): |
124 | data = self.recvall(cnt) | |
86e5f3ed | 125 | return compat_struct_unpack(f'!{cnt}B', data) |
9e9cd724 YCH |
126 | |
127 | @staticmethod | |
128 | def _len_and_data(data): | |
edaa23f8 | 129 | return compat_struct_pack('!B', len(data)) + data |
9e9cd724 YCH |
130 | |
131 | def _check_response_version(self, expected_version, got_version): | |
132 | if got_version != expected_version: | |
133 | self.close() | |
134 | raise InvalidVersionError(expected_version, got_version) | |
4350b745 | 135 | |
9e9cd724 | 136 | def _resolve_address(self, destaddr, default, use_remote_dns): |
4350b745 | 137 | try: |
9e9cd724 | 138 | return socket.inet_aton(destaddr) |
86e5f3ed | 139 | except OSError: |
9e9cd724 YCH |
140 | if use_remote_dns and self._proxy.remote_dns: |
141 | return default | |
4350b745 | 142 | else: |
9e9cd724 YCH |
143 | return socket.inet_aton(socket.gethostbyname(destaddr)) |
144 | ||
145 | def _setup_socks4(self, address, is_4a=False): | |
146 | destaddr, port = address | |
147 | ||
148 | ipaddr = self._resolve_address(destaddr, SOCKS4_DEFAULT_DSTIP, use_remote_dns=is_4a) | |
149 | ||
edaa23f8 | 150 | packet = compat_struct_pack('!BBH', SOCKS4_VERSION, Socks4Command.CMD_CONNECT, port) + ipaddr |
9e9cd724 YCH |
151 | |
152 | username = (self._proxy.username or '').encode('utf-8') | |
153 | packet += username + b'\x00' | |
4350b745 YCH |
154 | |
155 | if is_4a and self._proxy.remote_dns: | |
9e9cd724 | 156 | packet += destaddr.encode('utf-8') + b'\x00' |
4350b745 YCH |
157 | |
158 | self.sendall(packet) | |
159 | ||
edaa23f8 | 160 | version, resp_code, dstport, dsthost = compat_struct_unpack('!BBHI', self.recvall(8)) |
4350b745 | 161 | |
9e9cd724 | 162 | self._check_response_version(SOCKS4_REPLY_VERSION, version) |
4350b745 | 163 | |
9e9cd724 | 164 | if resp_code != Socks4Error.ERR_SUCCESS: |
4350b745 YCH |
165 | self.close() |
166 | raise Socks4Error(resp_code) | |
167 | ||
71aff188 YCH |
168 | return (dsthost, dstport) |
169 | ||
9e9cd724 YCH |
170 | def _setup_socks4a(self, address): |
171 | self._setup_socks4(address, is_4a=True) | |
4350b745 | 172 | |
9e9cd724 | 173 | def _socks5_auth(self): |
edaa23f8 | 174 | packet = compat_struct_pack('!B', SOCKS5_VERSION) |
4350b745 | 175 | |
9e9cd724 | 176 | auth_methods = [Socks5Auth.AUTH_NONE] |
4350b745 | 177 | if self._proxy.username and self._proxy.password: |
9e9cd724 YCH |
178 | auth_methods.append(Socks5Auth.AUTH_USER_PASS) |
179 | ||
edaa23f8 | 180 | packet += compat_struct_pack('!B', len(auth_methods)) |
86e5f3ed | 181 | packet += compat_struct_pack(f'!{len(auth_methods)}B', *auth_methods) |
4350b745 YCH |
182 | |
183 | self.sendall(packet) | |
184 | ||
9e9cd724 | 185 | version, method = self._recv_bytes(2) |
4350b745 | 186 | |
9e9cd724 | 187 | self._check_response_version(SOCKS5_VERSION, version) |
4350b745 | 188 | |
54f54fcc YCH |
189 | if method == Socks5Auth.AUTH_NO_ACCEPTABLE or ( |
190 | method == Socks5Auth.AUTH_USER_PASS and (not self._proxy.username or not self._proxy.password)): | |
4350b745 | 191 | self.close() |
54f54fcc | 192 | raise Socks5Error(Socks5Auth.AUTH_NO_ACCEPTABLE) |
4350b745 | 193 | |
9e9cd724 YCH |
194 | if method == Socks5Auth.AUTH_USER_PASS: |
195 | username = self._proxy.username.encode('utf-8') | |
196 | password = self._proxy.password.encode('utf-8') | |
edaa23f8 | 197 | packet = compat_struct_pack('!B', SOCKS5_USER_AUTH_VERSION) |
9e9cd724 | 198 | packet += self._len_and_data(username) + self._len_and_data(password) |
4350b745 YCH |
199 | self.sendall(packet) |
200 | ||
9e9cd724 | 201 | version, status = self._recv_bytes(2) |
4350b745 | 202 | |
9e9cd724 | 203 | self._check_response_version(SOCKS5_USER_AUTH_VERSION, version) |
4350b745 | 204 | |
9e9cd724 | 205 | if status != SOCKS5_USER_AUTH_SUCCESS: |
4350b745 | 206 | self.close() |
9e9cd724 | 207 | raise Socks5Error(Socks5Error.ERR_GENERAL_FAILURE) |
4350b745 | 208 | |
9e9cd724 YCH |
209 | def _setup_socks5(self, address): |
210 | destaddr, port = address | |
211 | ||
212 | ipaddr = self._resolve_address(destaddr, None, use_remote_dns=True) | |
213 | ||
214 | self._socks5_auth() | |
215 | ||
216 | reserved = 0 | |
edaa23f8 | 217 | packet = compat_struct_pack('!BBB', SOCKS5_VERSION, Socks5Command.CMD_CONNECT, reserved) |
4350b745 | 218 | if ipaddr is None: |
9e9cd724 | 219 | destaddr = destaddr.encode('utf-8') |
edaa23f8 | 220 | packet += compat_struct_pack('!B', Socks5AddressType.ATYP_DOMAINNAME) |
9e9cd724 | 221 | packet += self._len_and_data(destaddr) |
4350b745 | 222 | else: |
edaa23f8 YCH |
223 | packet += compat_struct_pack('!B', Socks5AddressType.ATYP_IPV4) + ipaddr |
224 | packet += compat_struct_pack('!H', port) | |
4350b745 YCH |
225 | |
226 | self.sendall(packet) | |
227 | ||
9e9cd724 | 228 | version, status, reserved, atype = self._recv_bytes(4) |
4350b745 | 229 | |
9e9cd724 | 230 | self._check_response_version(SOCKS5_VERSION, version) |
4350b745 | 231 | |
9e9cd724 | 232 | if status != Socks5Error.ERR_SUCCESS: |
4350b745 YCH |
233 | self.close() |
234 | raise Socks5Error(status) | |
235 | ||
9e9cd724 | 236 | if atype == Socks5AddressType.ATYP_IPV4: |
4350b745 | 237 | destaddr = self.recvall(4) |
9e9cd724 YCH |
238 | elif atype == Socks5AddressType.ATYP_DOMAINNAME: |
239 | alen = compat_ord(self.recv(1)) | |
4350b745 | 240 | destaddr = self.recvall(alen) |
9e9cd724 | 241 | elif atype == Socks5AddressType.ATYP_IPV6: |
4350b745 | 242 | destaddr = self.recvall(16) |
edaa23f8 | 243 | destport = compat_struct_unpack('!H', self.recvall(2))[0] |
71aff188 YCH |
244 | |
245 | return (destaddr, destport) | |
4350b745 YCH |
246 | |
247 | def _make_proxy(self, connect_func, address): | |
9e9cd724 | 248 | if not self._proxy: |
4350b745 YCH |
249 | return connect_func(self, address) |
250 | ||
9e9cd724 YCH |
251 | result = connect_func(self, (self._proxy.host, self._proxy.port)) |
252 | if result != 0 and result is not None: | |
253 | return result | |
254 | setup_funcs = { | |
255 | ProxyType.SOCKS4: self._setup_socks4, | |
256 | ProxyType.SOCKS4A: self._setup_socks4a, | |
257 | ProxyType.SOCKS5: self._setup_socks5, | |
258 | } | |
259 | setup_funcs[self._proxy.type](address) | |
260 | return result | |
261 | ||
4350b745 | 262 | def connect(self, address): |
71aff188 | 263 | self._make_proxy(socket.socket.connect, address) |
4350b745 YCH |
264 | |
265 | def connect_ex(self, address): | |
71aff188 | 266 | return self._make_proxy(socket.socket.connect_ex, address) |