/* Generic handler for GET, HEAD, and POST methods. */
static int handle_method(struct socket_buffer *client_sock,
struct http_request *request)
{
struct socket_buffer server_sock;
union sockaddr_u su;
size_t sslen = sizeof(su.storage);
int code;
int s, rc;
if (strcmp(request->uri.scheme, "http") != 0) {
if (o.verbose)
logdebug("Unknown scheme in URI: %s.\n", request->uri.scheme);
return 400;
}
if (request->uri.port == -1) {
if (o.verbose)
logdebug("Unknown port in URI.\n");
return 400;
}
rc = resolve(request->uri.host, request->uri.port, &su.storage, &sslen, o.af);
if (rc != 0) {
if (o.debug) {
logdebug("Can't resolve name %s:%d: %s.\n",
request->uri.host, request->uri.port, gai_strerror(rc));
}
return 504;
}
/* RFC 2616, section 5.1.2: "In order to avoid request loops, a proxy MUST
be able to recognize all of its server names, including any aliases,
local variations, and the numeric IP address. */
if (request->uri.port == o.portno && addr_is_local(&su)) {
if (o.verbose)
logdebug("Proxy loop detected: %s:%d\n", request->uri.host, request->uri.port);
return 403;
}
s = Socket(su.storage.ss_family, SOCK_STREAM, IPPROTO_TCP);
if (connect(s, &su.sockaddr, sslen) == -1) {
if (o.debug)
logdebug("Can't connect to %s.\n", inet_socktop(&su));
Close(s);
return 504;
}
socket_buffer_init(&server_sock, s);
code = do_transaction(request, client_sock, &server_sock);
fdinfo_close(&server_sock.fdn);
if (code != 0)
return code;
return 0;
}
int ncat_connect(void)
{
nsock_pool mypool;
int rc;
/* Unless explicitely asked not to do so, ncat uses the
* fallback nsock engine to maximize compatibility between
* operating systems and the different use cases.
*/
if (!o.nsock_engine)
nsock_set_default_engine("select");
/* Create an nsock pool */
if ((mypool = nsp_new(NULL)) == NULL)
bye("Failed to create nsock_pool.");
if (o.debug >= 6)
nsock_set_loglevel(mypool, NSOCK_LOG_DBG_ALL);
else if (o.debug >= 3)
nsock_set_loglevel(mypool, NSOCK_LOG_DBG);
else if (o.debug >= 1)
nsock_set_loglevel(mypool, NSOCK_LOG_INFO);
else
nsock_set_loglevel(mypool, NSOCK_LOG_ERROR);
/* Allow connections to broadcast addresses. */
nsp_setbroadcast(mypool, 1);
#ifdef HAVE_OPENSSL
set_ssl_ctx_options((SSL_CTX *) nsp_ssl_init(mypool));
#endif
if (httpconnect.storage.ss_family == AF_UNSPEC
&& socksconnect.storage.ss_family == AF_UNSPEC) {
/* A non-proxy connection. Create an iod for a new socket. */
cs.sock_nsi = nsi_new(mypool, NULL);
if (cs.sock_nsi == NULL)
bye("Failed to create nsock_iod.");
if (nsi_set_hostname(cs.sock_nsi, o.target) == -1)
bye("Failed to set hostname on iod.");
#if HAVE_SYS_UN_H
/* For DGRAM UNIX socket we have to use source socket */
if (o.af == AF_UNIX && o.udp)
{
if (srcaddr.storage.ss_family != AF_UNIX) {
char *tmp_name = NULL;
/* If no source socket was specified, we have to create temporary one. */
if ((tmp_name = tempnam(NULL, "ncat.")) == NULL)
bye("Failed to create name for temporary DGRAM source Unix domain socket (tempnam).");
srcaddr.un.sun_family = AF_UNIX;
strncpy(srcaddr.un.sun_path, tmp_name, sizeof(srcaddr.un.sun_path));
free (tmp_name);
}
nsi_set_localaddr(cs.sock_nsi, &srcaddr.storage, SUN_LEN((struct sockaddr_un *)&srcaddr.storage));
if (o.verbose)
loguser("[%s] used as source DGRAM Unix domain socket.\n", srcaddr.un.sun_path);
}
else
#endif
if (srcaddr.storage.ss_family != AF_UNSPEC)
nsi_set_localaddr(cs.sock_nsi, &srcaddr.storage, sizeof(srcaddr.storage));
if (o.numsrcrtes) {
unsigned char *ipopts = NULL;
size_t ipoptslen = 0;
if (o.af != AF_INET)
bye("Sorry, -g can only currently be used with IPv4.");
ipopts = buildsrcrte(targetss.in.sin_addr, o.srcrtes, o.numsrcrtes, o.srcrteptr, &ipoptslen);
nsi_set_ipoptions(cs.sock_nsi, ipopts, ipoptslen);
free(ipopts); /* Nsock has its own copy */
}
#if HAVE_SYS_UN_H
if (o.af == AF_UNIX) {
if (o.udp) {
nsock_connect_unixsock_datagram(mypool, cs.sock_nsi, connect_handler, NULL,
&targetss.sockaddr,
SUN_LEN((struct sockaddr_un *)&targetss.sockaddr));
} else {
nsock_connect_unixsock_stream(mypool, cs.sock_nsi, connect_handler, o.conntimeout,
NULL, &targetss.sockaddr,
SUN_LEN((struct sockaddr_un *)&targetss.sockaddr));
}
} else
#endif
if (o.udp) {
nsock_connect_udp(mypool, cs.sock_nsi, connect_handler,
NULL, &targetss.sockaddr, targetsslen,
inet_port(&targetss));
}
#ifdef HAVE_OPENSSL
else if (o.sctp && o.ssl) {
nsock_connect_ssl(mypool, cs.sock_nsi, connect_handler,
o.conntimeout, NULL,
&targetss.sockaddr, targetsslen,
IPPROTO_SCTP, inet_port(&targetss),
NULL);
}
#endif
else if (o.sctp) {
nsock_connect_sctp(mypool, cs.sock_nsi, connect_handler,
o.conntimeout, NULL,
&targetss.sockaddr, targetsslen,
inet_port(&targetss));
}
#ifdef HAVE_OPENSSL
else if (o.ssl) {
nsock_connect_ssl(mypool, cs.sock_nsi, connect_handler,
o.conntimeout, NULL,
&targetss.sockaddr, targetsslen,
IPPROTO_TCP, inet_port(&targetss),
NULL);
}
#endif
else {
nsock_connect_tcp(mypool, cs.sock_nsi, connect_handler,
o.conntimeout, NULL,
&targetss.sockaddr, targetsslen,
inet_port(&targetss));
}
} else {
/* A proxy connection. */
static int connect_socket;
int len;
char *line;
size_t n;
if (httpconnect.storage.ss_family != AF_UNSPEC) {
connect_socket = do_proxy_http();
if (connect_socket == -1)
return 1;
} else if (socksconnect.storage.ss_family != AF_UNSPEC) {
struct socket_buffer stateful_buf;
struct socks4_data socks4msg;
char socksbuf[8];
connect_socket = do_connect(SOCK_STREAM);
if (connect_socket == -1) {
loguser("Proxy connection failed: %s.\n", socket_strerror(socket_errno()));
return 1;
}
socket_buffer_init(&stateful_buf, connect_socket);
if (o.verbose) {
loguser("Connected to proxy %s:%hu\n", inet_socktop(&targetss),
inet_port(&targetss));
}
/* Fill the socks4_data struct */
zmem(&socks4msg, sizeof(socks4msg));
socks4msg.version = SOCKS4_VERSION;
socks4msg.type = SOCKS_CONNECT;
socks4msg.port = socksconnect.in.sin_port;
socks4msg.address = socksconnect.in.sin_addr.s_addr;
if (o.proxy_auth)
Strncpy(socks4msg.username, (char *) o.proxy_auth, sizeof(socks4msg.username));
len = 8 + strlen(socks4msg.username) + 1;
if (send(connect_socket, (char *) &socks4msg, len, 0) < 0) {
loguser("Error sending proxy request: %s.\n", socket_strerror(socket_errno()));
return 1;
}
/* The size of the socks4 response is 8 bytes. So read exactly
8 bytes from the buffer */
if (socket_buffer_readcount(&stateful_buf, socksbuf, 8) < 0) {
loguser("Error: short reponse from proxy.\n");
return 1;
}
if (socksbuf[1] != 90) {
loguser("Proxy connection failed.\n");
return 1;
}
/* Clear out whatever is left in the socket buffer which may be
already sent by proxy server along with http response headers. */
line = socket_buffer_remainder(&stateful_buf, &n);
/* Write the leftover data to stdout. */
Write(STDOUT_FILENO, line, n);
}
/* Once the proxy negotiation is done, Nsock takes control of the
socket. */
cs.sock_nsi = nsi_new2(mypool, connect_socket, NULL);
/* Create IOD for nsp->stdin */
if ((cs.stdin_nsi = nsi_new2(mypool, 0, NULL)) == NULL)
bye("Failed to create stdin nsiod.");
post_connect(mypool, cs.sock_nsi);
}
/* connect */
rc = nsock_loop(mypool, -1);
if (o.verbose) {
struct timeval end_time;
double time;
gettimeofday(&end_time, NULL);
time = TIMEVAL_MSEC_SUBTRACT(end_time, start_time) / 1000.0;
loguser("%lu bytes sent, %lu bytes received in %.2f seconds.\n",
nsi_get_write_count(cs.sock_nsi),
nsi_get_read_count(cs.sock_nsi), time);
}
#if HAVE_SYS_UN_H
if (o.af == AF_UNIX && o.udp) {
if (o.verbose)
loguser("Deleting source DGRAM Unix domain socket. [%s]\n", srcaddr.un.sun_path);
unlink(srcaddr.un.sun_path);
}
#endif
nsp_delete(mypool);
return rc == NSOCK_LOOP_ERROR ? 1 : 0;
}
/* Return a usable socket descriptor after proxy negotiation, or -1 on any
error. If any bytes are received through the proxy after negotiation, they
are written to stdout. */
static int do_proxy_http(void)
{
struct socket_buffer sockbuf;
char *request;
char *status_line, *header;
char *remainder;
size_t len;
int sd, code;
int n;
sd = do_connect(SOCK_STREAM);
if (sd == -1) {
loguser("Proxy connection failed: %s.\n", socket_strerror(socket_errno()));
return -1;
}
status_line = NULL;
header = NULL;
/* First try a request with no authentication. */
request = http_connect_request(&httpconnect, &n);
if (send(sd, request, n, 0) < 0) {
loguser("Error sending proxy request: %s.\n", socket_strerror(socket_errno()));
free(request);
return -1;
}
free(request);
socket_buffer_init(&sockbuf, sd);
if (http_read_status_line(&sockbuf, &status_line) != 0) {
loguser("Error reading proxy response Status-Line.\n");
goto bail;
}
code = http_parse_status_line_code(status_line);
logdebug("Proxy returned status code %d.\n", code);
free(status_line);
status_line = NULL;
if (http_read_header(&sockbuf, &header) != 0) {
loguser("Error reading proxy response header.\n");
goto bail;
}
if (code == 407 && o.proxy_auth != NULL) {
struct http_header *h;
struct http_challenge challenge;
close(sd);
sd = -1;
if (http_parse_header(&h, header) != 0) {
loguser("Error parsing proxy response header.\n");
goto bail;
}
free(header);
header = NULL;
if (http_header_get_proxy_challenge(h, &challenge) == NULL) {
loguser("Error getting Proxy-Authenticate challenge.\n");
http_header_free(h);
goto bail;
}
http_header_free(h);
sd = do_connect(SOCK_STREAM);
if (sd == -1) {
loguser("Proxy reconnection failed: %s.\n", socket_strerror(socket_errno()));
goto bail;
}
request = http_connect_request_auth(&httpconnect, &n, &challenge);
if (request == NULL) {
loguser("Error building Proxy-Authorization header.\n");
http_challenge_free(&challenge);
goto bail;
}
logdebug("Reconnection header:\n%s", request);
if (send(sd, request, n, 0) < 0) {
loguser("Error sending proxy request: %s.\n", socket_strerror(socket_errno()));
free(request);
http_challenge_free(&challenge);
goto bail;
}
free(request);
http_challenge_free(&challenge);
socket_buffer_init(&sockbuf, sd);
if (http_read_status_line(&sockbuf, &status_line) != 0) {
loguser("Error reading proxy response Status-Line.\n");
goto bail;
}
code = http_parse_status_line_code(status_line);
logdebug("Proxy returned status code %d.\n", code);
free(status_line);
status_line = NULL;
if (http_read_header(&sockbuf, &header) != 0) {
loguser("Error reading proxy response header.\n");
goto bail;
}
}
free(header);
header = NULL;
if (code != 200) {
loguser("Proxy returned status code %d.\n", code);
return -1;
}
remainder = socket_buffer_remainder(&sockbuf, &len);
Write(STDOUT_FILENO, remainder, len);
return sd;
bail:
if (sd != -1)
close(sd);
if (status_line != NULL)
free(status_line);
if (header != NULL)
free(header);
return -1;
}
static void http_server_handler(int c)
{
int code;
struct socket_buffer sock;
struct http_request request;
char *buf;
socket_buffer_init(&sock, c);
#if HAVE_OPENSSL
if (o.ssl) {
sock.fdn.ssl = new_ssl(sock.fdn.fd);
if (SSL_accept(sock.fdn.ssl) != 1) {
loguser("Failed SSL connection: %s\n",
ERR_error_string(ERR_get_error(), NULL));
fdinfo_close(&sock.fdn);
return;
}
}
#endif
code = http_read_request_line(&sock, &buf);
if (code != 0) {
if (o.verbose)
logdebug("Error reading Request-Line.\n");
send_string(&sock.fdn, http_code2str(code));
fdinfo_close(&sock.fdn);
return;
}
if (o.debug > 1)
logdebug("Request-Line: %s", buf);
code = http_parse_request_line(buf, &request);
free(buf);
if (code != 0) {
if (o.verbose)
logdebug("Error parsing Request-Line.\n");
send_string(&sock.fdn, http_code2str(code));
fdinfo_close(&sock.fdn);
return;
}
if (!method_is_known(request.method)) {
if (o.debug > 1)
logdebug("Bad method: %s.\n", request.method);
http_request_free(&request);
send_string(&sock.fdn, http_code2str(405));
fdinfo_close(&sock.fdn);
return;
}
code = http_read_header(&sock, &buf);
if (code != 0) {
if (o.verbose)
logdebug("Error reading header.\n");
http_request_free(&request);
send_string(&sock.fdn, http_code2str(code));
fdinfo_close(&sock.fdn);
return;
}
if (o.debug > 1)
logdebug("Header:\n%s", buf);
code = http_request_parse_header(&request, buf);
free(buf);
if (code != 0) {
if (o.verbose)
logdebug("Error parsing header.\n");
http_request_free(&request);
send_string(&sock.fdn, http_code2str(code));
fdinfo_close(&sock.fdn);
return;
}
/* Check authentication. */
if (o.proxy_auth) {
struct http_credentials credentials;
int ret, stale;
if (http_header_get_proxy_credentials(request.header, &credentials) == NULL) {
/* No credentials or a parsing error. */
send_proxy_authenticate(&sock.fdn, 0);
http_request_free(&request);
fdinfo_close(&sock.fdn);
return;
}
ret = check_auth(&request, &credentials, &stale);
http_credentials_free(&credentials);
if (!ret) {
/* Password doesn't match. */
/* RFC 2617, section 1.2: "If a proxy does not accept the
credentials sent with a request, it SHOULD return a 407 (Proxy
Authentication Required). */
send_proxy_authenticate(&sock.fdn, stale);
http_request_free(&request);
fdinfo_close(&sock.fdn);
return;
}
}
if (strcmp(request.method, "CONNECT") == 0) {
code = handle_connect(&sock, &request);
} else if (strcmp(request.method, "GET") == 0
|| strcmp(request.method, "HEAD") == 0
|| strcmp(request.method, "POST") == 0) {
code = handle_method(&sock, &request);
} else {
code = 500;
}
http_request_free(&request);
if (code != 0) {
send_string(&sock.fdn, http_code2str(code));
fdinfo_close(&sock.fdn);
return;
}
fdinfo_close(&sock.fdn);
}