/* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 2 -*- */ /* vim:set expandtab ts=4 sw=2 sts=2 cin: */ /* This Source Code Form is subject to the terms of the Mozilla Public * License, v. 2.0. If a copy of the MPL was not distributed with this * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ #include "nspr.h" #include "private/pprio.h" #include "nsString.h" #include "nsCRT.h" #include "nsIDNSService.h" #include "nsIDNSRecord.h" #include "nsISocketProvider.h" #include "nsNamedPipeIOLayer.h" #include "nsSOCKSIOLayer.h" #include "nsNetCID.h" #include "nsIDNSListener.h" #include "nsICancelable.h" #include "nsThreadUtils.h" #include "nsIFile.h" #include "nsIFileProtocolHandler.h" #include "mozilla/Logging.h" #include "mozilla/net/DNS.h" #include "mozilla/Unused.h" using mozilla::LogLevel; using namespace mozilla::net; static PRDescIdentity nsSOCKSIOLayerIdentity; static PRIOMethods nsSOCKSIOLayerMethods; static bool firstTime = true; static bool ipv6Supported = true; static mozilla::LazyLogModule gSOCKSLog("SOCKS"); #define LOGDEBUG(args) MOZ_LOG(gSOCKSLog, mozilla::LogLevel::Debug, args) #define LOGERROR(args) MOZ_LOG(gSOCKSLog, mozilla::LogLevel::Error, args) class nsSOCKSSocketInfo : public nsIDNSListener { enum State { SOCKS_INITIAL, SOCKS_DNS_IN_PROGRESS, SOCKS_DNS_COMPLETE, SOCKS_CONNECTING_TO_PROXY, SOCKS4_WRITE_CONNECT_REQUEST, SOCKS4_READ_CONNECT_RESPONSE, SOCKS5_WRITE_AUTH_REQUEST, SOCKS5_READ_AUTH_RESPONSE, SOCKS5_WRITE_USERNAME_REQUEST, SOCKS5_READ_USERNAME_RESPONSE, SOCKS5_WRITE_CONNECT_REQUEST, SOCKS5_READ_CONNECT_RESPONSE_TOP, SOCKS5_READ_CONNECT_RESPONSE_BOTTOM, SOCKS_CONNECTED, SOCKS_FAILED }; // A buffer of 520 bytes should be enough for any request and response // in case of SOCKS4 as well as SOCKS5 static const uint32_t BUFFER_SIZE = 520; static const uint32_t MAX_HOSTNAME_LEN = 255; static const uint32_t MAX_USERNAME_LEN = 255; static const uint32_t MAX_PASSWORD_LEN = 255; public: nsSOCKSSocketInfo(); NS_DECL_THREADSAFE_ISUPPORTS NS_DECL_NSIDNSLISTENER void Init(int32_t version, int32_t family, nsIProxyInfo* proxy, const char* destinationHost, uint32_t flags, uint32_t tlsFlags); void SetConnectTimeout(PRIntervalTime to); PRStatus DoHandshake(PRFileDesc* fd, int16_t oflags = -1); int16_t GetPollFlags() const; bool IsConnected() const { return mState == SOCKS_CONNECTED; } void ForgetFD() { mFD = nullptr; } void SetNamedPipeFD(PRFileDesc* fd) { mFD = fd; } void GetExternalProxyAddr(NetAddr& aExternalProxyAddr); void GetDestinationAddr(NetAddr& aDestinationAddr); void SetDestinationAddr(const NetAddr& aDestinationAddr); private: virtual ~nsSOCKSSocketInfo() { ForgetFD(); HandshakeFinished(); } void HandshakeFinished(PRErrorCode err = 0); PRStatus StartDNS(PRFileDesc* fd); PRStatus ConnectToProxy(PRFileDesc* fd); void FixupAddressFamily(PRFileDesc* fd, NetAddr* proxy); PRStatus ContinueConnectingToProxy(PRFileDesc* fd, int16_t oflags); PRStatus WriteV4ConnectRequest(); PRStatus ReadV4ConnectResponse(); PRStatus WriteV5AuthRequest(); PRStatus ReadV5AuthResponse(); PRStatus WriteV5UsernameRequest(); PRStatus ReadV5UsernameResponse(); PRStatus WriteV5ConnectRequest(); PRStatus ReadV5AddrTypeAndLength(uint8_t* type, uint32_t* len); PRStatus ReadV5ConnectResponseTop(); PRStatus ReadV5ConnectResponseBottom(); uint8_t ReadUint8(); uint16_t ReadUint16(); uint32_t ReadUint32(); void ReadNetAddr(NetAddr* addr, uint16_t fam); void ReadNetPort(NetAddr* addr); void WantRead(uint32_t sz); PRStatus ReadFromSocket(PRFileDesc* fd); PRStatus WriteToSocket(PRFileDesc* fd); bool IsLocalProxy() { nsAutoCString proxyHost; mProxy->GetHost(proxyHost); return IsHostLocalTarget(proxyHost); } nsresult SetLocalProxyPath(const nsACString& aLocalProxyPath, NetAddr* aProxyAddr) { #ifdef XP_UNIX nsresult rv; MOZ_ASSERT(aProxyAddr); nsCOMPtr<nsIProtocolHandler> protocolHandler( do_GetService(NS_NETWORK_PROTOCOL_CONTRACTID_PREFIX "file", &rv)); if (NS_WARN_IF(NS_FAILED(rv))) { return rv; } nsCOMPtr<nsIFileProtocolHandler> fileHandler( do_QueryInterface(protocolHandler, &rv)); if (NS_WARN_IF(NS_FAILED(rv))) { return rv; } nsCOMPtr<nsIFile> socketFile; rv = fileHandler->GetFileFromURLSpec(aLocalProxyPath, getter_AddRefs(socketFile)); if (NS_WARN_IF(NS_FAILED(rv))) { return rv; } nsAutoCString path; if (NS_WARN_IF(NS_FAILED(rv = socketFile->GetNativePath(path)))) { return rv; } if (sizeof(aProxyAddr->local.path) <= path.Length()) { NS_WARNING("domain socket path too long."); return NS_ERROR_FAILURE; } aProxyAddr->raw.family = AF_UNIX; strcpy(aProxyAddr->local.path, path.get()); return NS_OK; #elif defined(XP_WIN) MOZ_ASSERT(aProxyAddr); if (sizeof(aProxyAddr->local.path) <= aLocalProxyPath.Length()) { NS_WARNING("pipe path too long."); return NS_ERROR_FAILURE; } aProxyAddr->raw.family = AF_LOCAL; strcpy(aProxyAddr->local.path, PromiseFlatCString(aLocalProxyPath).get()); return NS_OK; #else mozilla::Unused << aLocalProxyPath; mozilla::Unused << aProxyAddr; return NS_ERROR_NOT_IMPLEMENTED; #endif } bool SetupNamedPipeLayer(PRFileDesc* fd) { #if defined(XP_WIN) if (IsLocalProxy()) { // nsSOCKSIOLayer handshaking only works under blocking mode // unfortunately. Remember named pipe's FD to switch between modes. SetNamedPipeFD(fd->lower); return true; } #endif return false; } private: State mState{SOCKS_INITIAL}; uint8_t* mData{nullptr}; uint8_t* mDataIoPtr{nullptr}; uint32_t mDataLength{0}; uint32_t mReadOffset{0}; uint32_t mAmountToRead{0}; nsCOMPtr<nsIDNSRecord> mDnsRec; nsCOMPtr<nsICancelable> mLookup; nsresult mLookupStatus{NS_ERROR_NOT_INITIALIZED}; PRFileDesc* mFD{nullptr}; nsCString mDestinationHost; nsCOMPtr<nsIProxyInfo> mProxy; int32_t mVersion{-1}; // SOCKS version 4 or 5 int32_t mDestinationFamily{AF_INET}; uint32_t mFlags{0}; uint32_t mTlsFlags{0}; NetAddr mInternalProxyAddr; NetAddr mExternalProxyAddr; NetAddr mDestinationAddr; PRIntervalTime mTimeout{PR_INTERVAL_NO_TIMEOUT}; nsCString mProxyUsername; // Cache, from mProxy }; nsSOCKSSocketInfo::nsSOCKSSocketInfo() { mData = new uint8_t[BUFFER_SIZE]; mInternalProxyAddr.raw.family = AF_INET; mInternalProxyAddr.inet.ip = htonl(INADDR_ANY); mInternalProxyAddr.inet.port = htons(0); mExternalProxyAddr.raw.family = AF_INET; mExternalProxyAddr.inet.ip = htonl(INADDR_ANY); mExternalProxyAddr.inet.port = htons(0); mDestinationAddr.raw.family = AF_INET; mDestinationAddr.inet.ip = htonl(INADDR_ANY); mDestinationAddr.inet.port = htons(0); } /* Helper template class to statically check that writes to a fixed-size * buffer are not going to overflow. * * Example usage: * uint8_t real_buf[TOTAL_SIZE]; * Buffer<TOTAL_SIZE> buf(&real_buf); * auto buf2 = buf.WriteUint16(1); * auto buf3 = buf2.WriteUint8(2); * * It is possible to chain them, to limit the number of (error-prone) * intermediate variables: * auto buf = Buffer<TOTAL_SIZE>(&real_buf) * .WriteUint16(1) * .WriteUint8(2); * * Debug builds assert when intermediate variables are reused: * Buffer<TOTAL_SIZE> buf(&real_buf); * auto buf2 = buf.WriteUint16(1); * auto buf3 = buf.WriteUint8(2); // Asserts * * Strings can be written, given an explicit maximum length. * buf.WriteString<MAX_STRING_LENGTH>(str); * * The Written() method returns how many bytes have been written so far: * Buffer<TOTAL_SIZE> buf(&real_buf); * auto buf2 = buf.WriteUint16(1); * auto buf3 = buf2.WriteUint8(2); * buf3.Written(); // returns 3. */ template <size_t Size> class Buffer { public: Buffer() = default; explicit Buffer(uint8_t* aBuf, size_t aLength = 0) : mBuf(aBuf), mLength(aLength) {} template <size_t Size2> MOZ_IMPLICIT Buffer(const Buffer<Size2>& aBuf) : mBuf(aBuf.mBuf), mLength(aBuf.mLength) { static_assert(Size2 > Size, "Cannot cast buffer"); } Buffer<Size - sizeof(uint8_t)> WriteUint8(uint8_t aValue) { return Write(aValue); } Buffer<Size - sizeof(uint16_t)> WriteUint16(uint16_t aValue) { return Write(aValue); } Buffer<Size - sizeof(uint32_t)> WriteUint32(uint32_t aValue) { return Write(aValue); } Buffer<Size - sizeof(uint16_t)> WriteNetPort(const NetAddr* aAddr) { return WriteUint16(aAddr->inet.port); } Buffer<Size - sizeof(IPv6Addr)> WriteNetAddr(const NetAddr* aAddr) { if (aAddr->raw.family == AF_INET) { return Write(aAddr->inet.ip); } if (aAddr->raw.family == AF_INET6) { return Write(aAddr->inet6.ip.u8); } MOZ_ASSERT_UNREACHABLE("Unknown address family"); return *this; } template <size_t MaxLength> Buffer<Size - MaxLength> WriteString(const nsACString& aStr) { if (aStr.Length() > MaxLength) { return Buffer<Size - MaxLength>(nullptr); } return WritePtr<char, MaxLength>(aStr.Data(), aStr.Length()); } size_t Written() { MOZ_ASSERT(mBuf); return mLength; } explicit operator bool() { return !!mBuf; } private: template <size_t Size2> friend class Buffer; template <typename T> Buffer<Size - sizeof(T)> Write(T& aValue) { return WritePtr<T, sizeof(T)>(&aValue, sizeof(T)); } template <typename T, size_t Length> Buffer<Size - Length> WritePtr(const T* aValue, size_t aCopyLength) { static_assert(Size >= Length, "Cannot write that much"); MOZ_ASSERT(aCopyLength <= Length); MOZ_ASSERT(mBuf); memcpy(mBuf, aValue, aCopyLength); Buffer<Size - Length> result(mBuf + aCopyLength, mLength + aCopyLength); mBuf = nullptr; mLength = 0; return result; } uint8_t* mBuf{nullptr}; size_t mLength{0}; }; void nsSOCKSSocketInfo::Init(int32_t version, int32_t family, nsIProxyInfo* proxy, const char* host, uint32_t flags, uint32_t tlsFlags) { mVersion = version; mDestinationFamily = family; mProxy = proxy; mDestinationHost = host; mFlags = flags; mTlsFlags = tlsFlags; mProxy->GetUsername(mProxyUsername); // cache } NS_IMPL_ISUPPORTS(nsSOCKSSocketInfo, nsIDNSListener) void nsSOCKSSocketInfo::GetExternalProxyAddr(NetAddr& aExternalProxyAddr) { aExternalProxyAddr = mExternalProxyAddr; } void nsSOCKSSocketInfo::GetDestinationAddr(NetAddr& aDestinationAddr) { aDestinationAddr = mDestinationAddr; } void nsSOCKSSocketInfo::SetDestinationAddr(const NetAddr& aDestinationAddr) { mDestinationAddr = aDestinationAddr; } // There needs to be a means of distinguishing between connection errors // that the SOCKS server reports when it rejects a connection request, and // connection errors that happen while attempting to connect to the SOCKS // server. Otherwise, Firefox will report incorrectly that the proxy server // is refusing connections when a SOCKS request is rejected by the proxy. // When a SOCKS handshake failure occurs, the PR error is set to // PR_UNKNOWN_ERROR, and the real error code is returned via the OS error. void nsSOCKSSocketInfo::HandshakeFinished(PRErrorCode err) { if (err == 0) { mState = SOCKS_CONNECTED; #if defined(XP_WIN) // Switch back to nonblocking mode after finishing handshaking. if (IsLocalProxy() && mFD) { PRSocketOptionData opt_nonblock; opt_nonblock.option = PR_SockOpt_Nonblocking; opt_nonblock.value.non_blocking = PR_TRUE; PR_SetSocketOption(mFD, &opt_nonblock); mFD = nullptr; } #endif } else { mState = SOCKS_FAILED; PR_SetError(PR_UNKNOWN_ERROR, err); } // We don't need the buffer any longer, so free it. delete[] mData; mData = nullptr; mDataIoPtr = nullptr; mDataLength = 0; mReadOffset = 0; mAmountToRead = 0; if (mLookup) { mLookup->Cancel(NS_ERROR_FAILURE); mLookup = nullptr; } } PRStatus nsSOCKSSocketInfo::StartDNS(PRFileDesc* fd) { MOZ_ASSERT(!mDnsRec && mState == SOCKS_INITIAL, "Must be in initial state to make DNS Lookup"); nsCOMPtr<nsIDNSService> dns = do_GetService(NS_DNSSERVICE_CONTRACTID); if (!dns) return PR_FAILURE; nsCString proxyHost; mProxy->GetHost(proxyHost); mozilla::OriginAttributes attrs; mFD = fd; nsresult rv = dns->AsyncResolveNative( proxyHost, nsIDNSService::RESOLVE_TYPE_DEFAULT, nsIDNSService::RESOLVE_IGNORE_SOCKS_DNS, nullptr, this, mozilla::GetCurrentEventTarget(), attrs, getter_AddRefs(mLookup)); if (NS_FAILED(rv)) { LOGERROR(("socks: DNS lookup for SOCKS proxy %s failed", proxyHost.get())); return PR_FAILURE; } mState = SOCKS_DNS_IN_PROGRESS; PR_SetError(PR_IN_PROGRESS_ERROR, 0); return PR_FAILURE; } NS_IMETHODIMP nsSOCKSSocketInfo::OnLookupComplete(nsICancelable* aRequest, nsIDNSRecord* aRecord, nsresult aStatus) { MOZ_ASSERT(aRequest == mLookup, "wrong DNS query"); mLookup = nullptr; mLookupStatus = aStatus; mDnsRec = aRecord; mState = SOCKS_DNS_COMPLETE; if (mFD) { ConnectToProxy(mFD); ForgetFD(); } return NS_OK; } PRStatus nsSOCKSSocketInfo::ConnectToProxy(PRFileDesc* fd) { PRStatus status; nsresult rv; MOZ_ASSERT(mState == SOCKS_DNS_COMPLETE, "Must have DNS to make connection!"); if (NS_FAILED(mLookupStatus)) { PR_SetError(PR_BAD_ADDRESS_ERROR, 0); return PR_FAILURE; } // Try socks5 if the destination addrress is IPv6 if (mVersion == 4 && mDestinationAddr.raw.family == AF_INET6) { mVersion = 5; } nsAutoCString proxyHost; mProxy->GetHost(proxyHost); int32_t proxyPort; mProxy->GetPort(&proxyPort); int32_t addresses = 0; do { if (IsLocalProxy()) { rv = SetLocalProxyPath(proxyHost, &mInternalProxyAddr); if (NS_FAILED(rv)) { LOGERROR( ("socks: unable to connect to SOCKS proxy, %s", proxyHost.get())); return PR_FAILURE; } } else { nsCOMPtr<nsIDNSAddrRecord> record = do_QueryInterface(mDnsRec); MOZ_ASSERT(record); if (addresses++) { record->ReportUnusable(proxyPort); } rv = record->GetNextAddr(proxyPort, &mInternalProxyAddr); // No more addresses to try? If so, we'll need to bail if (NS_FAILED(rv)) { LOGERROR( ("socks: unable to connect to SOCKS proxy, %s", proxyHost.get())); return PR_FAILURE; } if (MOZ_LOG_TEST(gSOCKSLog, LogLevel::Debug)) { char buf[kIPv6CStrBufSize]; mInternalProxyAddr.ToStringBuffer(buf, sizeof(buf)); LOGDEBUG(("socks: trying proxy server, %s:%hu", buf, ntohs(mInternalProxyAddr.inet.port))); } } NetAddr proxy = mInternalProxyAddr; FixupAddressFamily(fd, &proxy); PRNetAddr prProxy; NetAddrToPRNetAddr(&proxy, &prProxy); status = fd->lower->methods->connect(fd->lower, &prProxy, mTimeout); if (status != PR_SUCCESS) { PRErrorCode c = PR_GetError(); // If EINPROGRESS, return now and check back later after polling if (c == PR_WOULD_BLOCK_ERROR || c == PR_IN_PROGRESS_ERROR) { mState = SOCKS_CONNECTING_TO_PROXY; return status; } if (IsLocalProxy()) { LOGERROR(("socks: connect to domain socket failed (%d)", c)); PR_SetError(PR_CONNECT_REFUSED_ERROR, 0); mState = SOCKS_FAILED; return status; } } } while (status != PR_SUCCESS); #if defined(XP_WIN) // Switch to blocking mode during handshaking if (IsLocalProxy() && mFD) { PRSocketOptionData opt_nonblock; opt_nonblock.option = PR_SockOpt_Nonblocking; opt_nonblock.value.non_blocking = PR_FALSE; PR_SetSocketOption(mFD, &opt_nonblock); } #endif // Connected now, start SOCKS if (mVersion == 4) return WriteV4ConnectRequest(); return WriteV5AuthRequest(); } void nsSOCKSSocketInfo::FixupAddressFamily(PRFileDesc* fd, NetAddr* proxy) { int32_t proxyFamily = mInternalProxyAddr.raw.family; // Do nothing if the address family is already matched if (proxyFamily == mDestinationFamily) { return; } // If the system does not support IPv6 and the proxy address is IPv6, // We can do nothing here. if (proxyFamily == AF_INET6 && !ipv6Supported) { return; } // If the system does not support IPv6 and the destination address is // IPv6, convert IPv4 address to IPv4-mapped IPv6 address to satisfy // the emulation layer if (mDestinationFamily == AF_INET6 && !ipv6Supported) { proxy->inet6.family = AF_INET6; proxy->inet6.port = mInternalProxyAddr.inet.port; uint8_t* proxyp = proxy->inet6.ip.u8; memset(proxyp, 0, 10); memset(proxyp + 10, 0xff, 2); memcpy(proxyp + 12, (char*)&mInternalProxyAddr.inet.ip, 4); // mDestinationFamily should not be updated return; } // There's no PR_NSPR_IO_LAYER required when using named pipe, // we simply ignore the TCP family here. if (SetupNamedPipeLayer(fd)) { return; } // Get an OS native handle from a specified FileDesc PROsfd osfd = PR_FileDesc2NativeHandle(fd); if (osfd == -1) { return; } // Create a new FileDesc with a specified family PRFileDesc* tmpfd = PR_OpenTCPSocket(proxyFamily); if (!tmpfd) { return; } PROsfd newsd = PR_FileDesc2NativeHandle(tmpfd); if (newsd == -1) { PR_Close(tmpfd); return; } // Must succeed because PR_FileDesc2NativeHandle succeeded fd = PR_GetIdentitiesLayer(fd, PR_NSPR_IO_LAYER); MOZ_ASSERT(fd); // Swap OS native handles PR_ChangeFileDescNativeHandle(fd, newsd); PR_ChangeFileDescNativeHandle(tmpfd, osfd); // Close temporary FileDesc which is now associated with // old OS native handle PR_Close(tmpfd); mDestinationFamily = proxyFamily; } PRStatus nsSOCKSSocketInfo::ContinueConnectingToProxy(PRFileDesc* fd, int16_t oflags) { PRStatus status; MOZ_ASSERT(mState == SOCKS_CONNECTING_TO_PROXY, "Continuing connection in wrong state!"); LOGDEBUG(("socks: continuing connection to proxy")); status = fd->lower->methods->connectcontinue(fd->lower, oflags); if (status != PR_SUCCESS) { PRErrorCode c = PR_GetError(); if (c != PR_WOULD_BLOCK_ERROR && c != PR_IN_PROGRESS_ERROR) { // A connection failure occured, try another address mState = SOCKS_DNS_COMPLETE; return ConnectToProxy(fd); } // We're still connecting return PR_FAILURE; } // Connected now, start SOCKS if (mVersion == 4) return WriteV4ConnectRequest(); return WriteV5AuthRequest(); } PRStatus nsSOCKSSocketInfo::WriteV4ConnectRequest() { if (mProxyUsername.Length() > MAX_USERNAME_LEN) { LOGERROR(("socks username is too long")); HandshakeFinished(PR_UNKNOWN_ERROR); return PR_FAILURE; } NetAddr* addr = &mDestinationAddr; int32_t proxy_resolve; MOZ_ASSERT(mState == SOCKS_CONNECTING_TO_PROXY, "Invalid state!"); proxy_resolve = mFlags & nsISocketProvider::PROXY_RESOLVES_HOST; mDataLength = 0; mState = SOCKS4_WRITE_CONNECT_REQUEST; LOGDEBUG(("socks4: sending connection request (socks4a resolve? %s)", proxy_resolve ? "yes" : "no")); // Send a SOCKS 4 connect request. auto buf = Buffer<BUFFER_SIZE>(mData) .WriteUint8(0x04) // version -- 4 .WriteUint8(0x01) // command -- connect .WriteNetPort(addr); // We don't have anything more to write after the if, so we can // use a buffer with no further writes allowed. Buffer<0> buf3; if (proxy_resolve) { // Add the full name, null-terminated, to the request // according to SOCKS 4a. A fake IP address, with the first // four bytes set to 0 and the last byte set to something other // than 0, is used to notify the proxy that this is a SOCKS 4a // request. This request type works for Tor and perhaps others. // Passwords not supported by V4. auto buf2 = buf.WriteUint32(htonl(0x00000001)) // Fake IP .WriteString<MAX_USERNAME_LEN>(mProxyUsername) .WriteUint8(0x00) // Null-terminate username .WriteString<MAX_HOSTNAME_LEN>(mDestinationHost); // Hostname if (!buf2) { LOGERROR(("socks4: destination host name is too long!")); HandshakeFinished(PR_BAD_ADDRESS_ERROR); return PR_FAILURE; } buf3 = buf2.WriteUint8(0x00); } else if (addr->raw.family == AF_INET) { // Passwords not supported by V4. buf3 = buf.WriteNetAddr(addr) // Add the IPv4 address .WriteString<MAX_USERNAME_LEN>(mProxyUsername) .WriteUint8(0x00); // Null-terminate username } else { LOGERROR(("socks: SOCKS 4 can only handle IPv4 addresses!")); HandshakeFinished(PR_BAD_ADDRESS_ERROR); return PR_FAILURE; } mDataLength = buf3.Written(); return PR_SUCCESS; } PRStatus nsSOCKSSocketInfo::ReadV4ConnectResponse() { MOZ_ASSERT(mState == SOCKS4_READ_CONNECT_RESPONSE, "Handling SOCKS 4 connection reply in wrong state!"); MOZ_ASSERT(mDataLength == 8, "SOCKS 4 connection reply must be 8 bytes!"); LOGDEBUG(("socks4: checking connection reply")); if (ReadUint8() != 0x00) { LOGERROR(("socks4: wrong connection reply")); HandshakeFinished(PR_CONNECT_REFUSED_ERROR); return PR_FAILURE; } // See if our connection request was granted if (ReadUint8() == 90) { LOGDEBUG(("socks4: connection successful!")); HandshakeFinished(); return PR_SUCCESS; } LOGERROR(("socks4: unable to connect")); HandshakeFinished(PR_CONNECT_REFUSED_ERROR); return PR_FAILURE; } PRStatus nsSOCKSSocketInfo::WriteV5AuthRequest() { MOZ_ASSERT(mVersion == 5, "SOCKS version must be 5!"); mDataLength = 0; mState = SOCKS5_WRITE_AUTH_REQUEST; // Send an initial SOCKS 5 greeting LOGDEBUG(("socks5: sending auth methods")); mDataLength = Buffer<BUFFER_SIZE>(mData) .WriteUint8(0x05) // version -- 5 .WriteUint8(0x01) // # of auth methods -- 1 // Use authenticate iff we have a proxy username. .WriteUint8(mProxyUsername.IsEmpty() ? 0x00 : 0x02) .Written(); return PR_SUCCESS; } PRStatus nsSOCKSSocketInfo::ReadV5AuthResponse() { MOZ_ASSERT(mState == SOCKS5_READ_AUTH_RESPONSE, "Handling SOCKS 5 auth method reply in wrong state!"); MOZ_ASSERT(mDataLength == 2, "SOCKS 5 auth method reply must be 2 bytes!"); LOGDEBUG(("socks5: checking auth method reply")); // Check version number if (ReadUint8() != 0x05) { LOGERROR(("socks5: unexpected version in the reply")); HandshakeFinished(PR_CONNECT_REFUSED_ERROR); return PR_FAILURE; } // Make sure our authentication choice was accepted, // and continue accordingly uint8_t authMethod = ReadUint8(); if (mProxyUsername.IsEmpty() && authMethod == 0x00) { // no auth LOGDEBUG(("socks5: server allows connection without authentication")); return WriteV5ConnectRequest(); } if (!mProxyUsername.IsEmpty() && authMethod == 0x02) { // username/pw LOGDEBUG(("socks5: auth method accepted by server")); return WriteV5UsernameRequest(); } // 0xFF signals error LOGERROR(("socks5: server did not accept our authentication method")); HandshakeFinished(PR_CONNECT_REFUSED_ERROR); return PR_FAILURE; } PRStatus nsSOCKSSocketInfo::WriteV5UsernameRequest() { MOZ_ASSERT(mVersion == 5, "SOCKS version must be 5!"); if (mProxyUsername.Length() > MAX_USERNAME_LEN) { LOGERROR(("socks username is too long")); HandshakeFinished(PR_UNKNOWN_ERROR); return PR_FAILURE; } nsCString password; mProxy->GetPassword(password); if (password.Length() > MAX_PASSWORD_LEN) { LOGERROR(("socks password is too long")); HandshakeFinished(PR_UNKNOWN_ERROR); return PR_FAILURE; } mDataLength = 0; mState = SOCKS5_WRITE_USERNAME_REQUEST; // RFC 1929 Username/password auth for SOCKS 5 LOGDEBUG(("socks5: sending username and password")); mDataLength = Buffer<BUFFER_SIZE>(mData) .WriteUint8(0x01) // version 1 (not 5) .WriteUint8(mProxyUsername.Length()) // username length .WriteString<MAX_USERNAME_LEN>(mProxyUsername) // username .WriteUint8(password.Length()) // password length .WriteString<MAX_PASSWORD_LEN>( password) // password. WARNING: Sent unencrypted! .Written(); return PR_SUCCESS; } PRStatus nsSOCKSSocketInfo::ReadV5UsernameResponse() { MOZ_ASSERT(mState == SOCKS5_READ_USERNAME_RESPONSE, "Handling SOCKS 5 username/password reply in wrong state!"); MOZ_ASSERT(mDataLength == 2, "SOCKS 5 username reply must be 2 bytes"); // Check version number, must be 1 (not 5) if (ReadUint8() != 0x01) { LOGERROR(("socks5: unexpected version in the reply")); HandshakeFinished(PR_CONNECT_REFUSED_ERROR); return PR_FAILURE; } // Check whether username/password were accepted if (ReadUint8() != 0x00) { // 0 = success LOGERROR(("socks5: username/password not accepted")); HandshakeFinished(PR_CONNECT_REFUSED_ERROR); return PR_FAILURE; } LOGDEBUG(("socks5: username/password accepted by server")); return WriteV5ConnectRequest(); } PRStatus nsSOCKSSocketInfo::WriteV5ConnectRequest() { // Send SOCKS 5 connect request NetAddr* addr = &mDestinationAddr; int32_t proxy_resolve; proxy_resolve = mFlags & nsISocketProvider::PROXY_RESOLVES_HOST; LOGDEBUG(("socks5: sending connection request (socks5 resolve? %s)", proxy_resolve ? "yes" : "no")); mDataLength = 0; mState = SOCKS5_WRITE_CONNECT_REQUEST; auto buf = Buffer<BUFFER_SIZE>(mData) .WriteUint8(0x05) // version -- 5 .WriteUint8(0x01) // command -- connect .WriteUint8(0x00); // reserved // We're writing a net port after the if, so we need a buffer allowing // to write that much. Buffer<sizeof(uint16_t)> buf2; // Add the address to the SOCKS 5 request. SOCKS 5 supports several // address types, so we pick the one that works best for us. if (proxy_resolve) { // Add the host name. Only a single byte is used to store the length, // so we must prevent long names from being used. buf2 = buf.WriteUint8(0x03) // addr type -- domainname .WriteUint8(mDestinationHost.Length()) // name length .WriteString<MAX_HOSTNAME_LEN>(mDestinationHost); // Hostname if (!buf2) { LOGERROR(("socks5: destination host name is too long!")); HandshakeFinished(PR_BAD_ADDRESS_ERROR); return PR_FAILURE; } } else if (addr->raw.family == AF_INET) { buf2 = buf.WriteUint8(0x01) // addr type -- IPv4 .WriteNetAddr(addr); } else if (addr->raw.family == AF_INET6) { buf2 = buf.WriteUint8(0x04) // addr type -- IPv6 .WriteNetAddr(addr); } else { LOGERROR(("socks5: destination address of unknown type!")); HandshakeFinished(PR_BAD_ADDRESS_ERROR); return PR_FAILURE; } auto buf3 = buf2.WriteNetPort(addr); // port mDataLength = buf3.Written(); return PR_SUCCESS; } PRStatus nsSOCKSSocketInfo::ReadV5AddrTypeAndLength(uint8_t* type, uint32_t* len) { MOZ_ASSERT(mState == SOCKS5_READ_CONNECT_RESPONSE_TOP || mState == SOCKS5_READ_CONNECT_RESPONSE_BOTTOM, "Invalid state!"); MOZ_ASSERT(mDataLength >= 5, "SOCKS 5 connection reply must be at least 5 bytes!"); // Seek to the address location mReadOffset = 3; *type = ReadUint8(); switch (*type) { case 0x01: // ipv4 *len = 4 - 1; break; case 0x04: // ipv6 *len = 16 - 1; break; case 0x03: // fqdn *len = ReadUint8(); break; default: // wrong address type LOGERROR(("socks5: wrong address type in connection reply!")); return PR_FAILURE; } return PR_SUCCESS; } PRStatus nsSOCKSSocketInfo::ReadV5ConnectResponseTop() { uint8_t res; uint32_t len; MOZ_ASSERT(mState == SOCKS5_READ_CONNECT_RESPONSE_TOP, "Invalid state!"); MOZ_ASSERT(mDataLength == 5, "SOCKS 5 connection reply must be exactly 5 bytes!"); LOGDEBUG(("socks5: checking connection reply")); // Check version number if (ReadUint8() != 0x05) { LOGERROR(("socks5: unexpected version in the reply")); HandshakeFinished(PR_CONNECT_REFUSED_ERROR); return PR_FAILURE; } // Check response res = ReadUint8(); if (res != 0x00) { PRErrorCode c = PR_CONNECT_REFUSED_ERROR; switch (res) { case 0x01: LOGERROR( ("socks5: connect failed: " "01, General SOCKS server failure.")); break; case 0x02: LOGERROR( ("socks5: connect failed: " "02, Connection not allowed by ruleset.")); break; case 0x03: LOGERROR(("socks5: connect failed: 03, Network unreachable.")); c = PR_NETWORK_UNREACHABLE_ERROR; break; case 0x04: LOGERROR(("socks5: connect failed: 04, Host unreachable.")); c = PR_BAD_ADDRESS_ERROR; break; case 0x05: LOGERROR(("socks5: connect failed: 05, Connection refused.")); break; case 0x06: LOGERROR(("socks5: connect failed: 06, TTL expired.")); c = PR_CONNECT_TIMEOUT_ERROR; break; case 0x07: LOGERROR( ("socks5: connect failed: " "07, Command not supported.")); break; case 0x08: LOGERROR( ("socks5: connect failed: " "08, Address type not supported.")); c = PR_BAD_ADDRESS_ERROR; break; default: LOGERROR(("socks5: connect failed.")); break; } HandshakeFinished(c); return PR_FAILURE; } if (ReadV5AddrTypeAndLength(&res, &len) != PR_SUCCESS) { HandshakeFinished(PR_BAD_ADDRESS_ERROR); return PR_FAILURE; } mState = SOCKS5_READ_CONNECT_RESPONSE_BOTTOM; WantRead(len + 2); return PR_SUCCESS; } PRStatus nsSOCKSSocketInfo::ReadV5ConnectResponseBottom() { uint8_t type; uint32_t len; MOZ_ASSERT(mState == SOCKS5_READ_CONNECT_RESPONSE_BOTTOM, "Invalid state!"); if (ReadV5AddrTypeAndLength(&type, &len) != PR_SUCCESS) { HandshakeFinished(PR_BAD_ADDRESS_ERROR); return PR_FAILURE; } MOZ_ASSERT(mDataLength == 7 + len, "SOCKS 5 unexpected length of connection reply!"); LOGDEBUG(("socks5: loading source addr and port")); // Read what the proxy says is our source address switch (type) { case 0x01: // ipv4 ReadNetAddr(&mExternalProxyAddr, AF_INET); break; case 0x04: // ipv6 ReadNetAddr(&mExternalProxyAddr, AF_INET6); break; case 0x03: // fqdn (skip) mReadOffset += len; mExternalProxyAddr.raw.family = AF_INET; break; } ReadNetPort(&mExternalProxyAddr); LOGDEBUG(("socks5: connected!")); HandshakeFinished(); return PR_SUCCESS; } void nsSOCKSSocketInfo::SetConnectTimeout(PRIntervalTime to) { mTimeout = to; } PRStatus nsSOCKSSocketInfo::DoHandshake(PRFileDesc* fd, int16_t oflags) { LOGDEBUG(("socks: DoHandshake(), state = %d", mState)); switch (mState) { case SOCKS_INITIAL: if (IsLocalProxy()) { mState = SOCKS_DNS_COMPLETE; mLookupStatus = NS_OK; return ConnectToProxy(fd); } return StartDNS(fd); case SOCKS_DNS_IN_PROGRESS: PR_SetError(PR_IN_PROGRESS_ERROR, 0); return PR_FAILURE; case SOCKS_DNS_COMPLETE: return ConnectToProxy(fd); case SOCKS_CONNECTING_TO_PROXY: return ContinueConnectingToProxy(fd, oflags); case SOCKS4_WRITE_CONNECT_REQUEST: if (WriteToSocket(fd) != PR_SUCCESS) return PR_FAILURE; WantRead(8); mState = SOCKS4_READ_CONNECT_RESPONSE; return PR_SUCCESS; case SOCKS4_READ_CONNECT_RESPONSE: if (ReadFromSocket(fd) != PR_SUCCESS) return PR_FAILURE; return ReadV4ConnectResponse(); case SOCKS5_WRITE_AUTH_REQUEST: if (WriteToSocket(fd) != PR_SUCCESS) return PR_FAILURE; WantRead(2); mState = SOCKS5_READ_AUTH_RESPONSE; return PR_SUCCESS; case SOCKS5_READ_AUTH_RESPONSE: if (ReadFromSocket(fd) != PR_SUCCESS) return PR_FAILURE; return ReadV5AuthResponse(); case SOCKS5_WRITE_USERNAME_REQUEST: if (WriteToSocket(fd) != PR_SUCCESS) return PR_FAILURE; WantRead(2); mState = SOCKS5_READ_USERNAME_RESPONSE; return PR_SUCCESS; case SOCKS5_READ_USERNAME_RESPONSE: if (ReadFromSocket(fd) != PR_SUCCESS) return PR_FAILURE; return ReadV5UsernameResponse(); case SOCKS5_WRITE_CONNECT_REQUEST: if (WriteToSocket(fd) != PR_SUCCESS) return PR_FAILURE; // The SOCKS 5 response to the connection request is variable // length. First, we'll read enough to tell how long the response // is, and will read the rest later. WantRead(5); mState = SOCKS5_READ_CONNECT_RESPONSE_TOP; return PR_SUCCESS; case SOCKS5_READ_CONNECT_RESPONSE_TOP: if (ReadFromSocket(fd) != PR_SUCCESS) return PR_FAILURE; return ReadV5ConnectResponseTop(); case SOCKS5_READ_CONNECT_RESPONSE_BOTTOM: if (ReadFromSocket(fd) != PR_SUCCESS) return PR_FAILURE; return ReadV5ConnectResponseBottom(); case SOCKS_CONNECTED: LOGERROR(("socks: already connected")); HandshakeFinished(PR_IS_CONNECTED_ERROR); return PR_FAILURE; case SOCKS_FAILED: LOGERROR(("socks: already failed")); return PR_FAILURE; } LOGERROR(("socks: executing handshake in invalid state, %d", mState)); HandshakeFinished(PR_INVALID_STATE_ERROR); return PR_FAILURE; } int16_t nsSOCKSSocketInfo::GetPollFlags() const { switch (mState) { case SOCKS_DNS_IN_PROGRESS: case SOCKS_DNS_COMPLETE: case SOCKS_CONNECTING_TO_PROXY: return PR_POLL_EXCEPT | PR_POLL_WRITE; case SOCKS4_WRITE_CONNECT_REQUEST: case SOCKS5_WRITE_AUTH_REQUEST: case SOCKS5_WRITE_USERNAME_REQUEST: case SOCKS5_WRITE_CONNECT_REQUEST: return PR_POLL_WRITE; case SOCKS4_READ_CONNECT_RESPONSE: case SOCKS5_READ_AUTH_RESPONSE: case SOCKS5_READ_USERNAME_RESPONSE: case SOCKS5_READ_CONNECT_RESPONSE_TOP: case SOCKS5_READ_CONNECT_RESPONSE_BOTTOM: return PR_POLL_READ; default: break; } return 0; } inline uint8_t nsSOCKSSocketInfo::ReadUint8() { uint8_t rv; MOZ_ASSERT(mReadOffset + sizeof(rv) <= mDataLength, "Not enough space to pop a uint8_t!"); rv = mData[mReadOffset]; mReadOffset += sizeof(rv); return rv; } inline uint16_t nsSOCKSSocketInfo::ReadUint16() { uint16_t rv; MOZ_ASSERT(mReadOffset + sizeof(rv) <= mDataLength, "Not enough space to pop a uint16_t!"); memcpy(&rv, mData + mReadOffset, sizeof(rv)); mReadOffset += sizeof(rv); return rv; } inline uint32_t nsSOCKSSocketInfo::ReadUint32() { uint32_t rv; MOZ_ASSERT(mReadOffset + sizeof(rv) <= mDataLength, "Not enough space to pop a uint32_t!"); memcpy(&rv, mData + mReadOffset, sizeof(rv)); mReadOffset += sizeof(rv); return rv; } void nsSOCKSSocketInfo::ReadNetAddr(NetAddr* addr, uint16_t fam) { uint32_t amt = 0; const uint8_t* ip = mData + mReadOffset; addr->raw.family = fam; if (fam == AF_INET) { amt = sizeof(addr->inet.ip); MOZ_ASSERT(mReadOffset + amt <= mDataLength, "Not enough space to pop an ipv4 addr!"); memcpy(&addr->inet.ip, ip, amt); } else if (fam == AF_INET6) { amt = sizeof(addr->inet6.ip.u8); MOZ_ASSERT(mReadOffset + amt <= mDataLength, "Not enough space to pop an ipv6 addr!"); memcpy(addr->inet6.ip.u8, ip, amt); } mReadOffset += amt; } void nsSOCKSSocketInfo::ReadNetPort(NetAddr* addr) { addr->inet.port = ReadUint16(); } void nsSOCKSSocketInfo::WantRead(uint32_t sz) { MOZ_ASSERT(mDataIoPtr == nullptr, "WantRead() called while I/O already in progress!"); MOZ_ASSERT(mDataLength + sz <= BUFFER_SIZE, "Can't read that much data!"); mAmountToRead = sz; } PRStatus nsSOCKSSocketInfo::ReadFromSocket(PRFileDesc* fd) { int32_t rc; const uint8_t* end; if (!mAmountToRead) { LOGDEBUG(("socks: ReadFromSocket(), nothing to do")); return PR_SUCCESS; } if (!mDataIoPtr) { mDataIoPtr = mData + mDataLength; mDataLength += mAmountToRead; } end = mData + mDataLength; while (mDataIoPtr < end) { rc = PR_Read(fd, mDataIoPtr, end - mDataIoPtr); if (rc <= 0) { if (rc == 0) { LOGERROR(("socks: proxy server closed connection")); HandshakeFinished(PR_CONNECT_REFUSED_ERROR); return PR_FAILURE; } if (PR_GetError() == PR_WOULD_BLOCK_ERROR) { LOGDEBUG(("socks: ReadFromSocket(), want read")); } break; } mDataIoPtr += rc; } LOGDEBUG(("socks: ReadFromSocket(), have %u bytes total", unsigned(mDataIoPtr - mData))); if (mDataIoPtr == end) { mDataIoPtr = nullptr; mAmountToRead = 0; mReadOffset = 0; return PR_SUCCESS; } return PR_FAILURE; } PRStatus nsSOCKSSocketInfo::WriteToSocket(PRFileDesc* fd) { int32_t rc; const uint8_t* end; if (!mDataLength) { LOGDEBUG(("socks: WriteToSocket(), nothing to do")); return PR_SUCCESS; } if (!mDataIoPtr) mDataIoPtr = mData; end = mData + mDataLength; while (mDataIoPtr < end) { rc = PR_Write(fd, mDataIoPtr, end - mDataIoPtr); if (rc < 0) { if (PR_GetError() == PR_WOULD_BLOCK_ERROR) { LOGDEBUG(("socks: WriteToSocket(), want write")); } break; } mDataIoPtr += rc; } if (mDataIoPtr == end) { mDataIoPtr = nullptr; mDataLength = 0; mReadOffset = 0; return PR_SUCCESS; } return PR_FAILURE; } static PRStatus nsSOCKSIOLayerConnect(PRFileDesc* fd, const PRNetAddr* addr, PRIntervalTime to) { PRStatus status; NetAddr dst; nsSOCKSSocketInfo* info = (nsSOCKSSocketInfo*)fd->secret; if (info == nullptr) return PR_FAILURE; if (addr->raw.family == PR_AF_INET6 && PR_IsNetAddrType(addr, PR_IpAddrV4Mapped)) { const uint8_t* srcp; LOGDEBUG(("socks: converting ipv4-mapped ipv6 address to ipv4")); // copied from _PR_ConvertToIpv4NetAddr() dst.raw.family = AF_INET; dst.inet.ip = htonl(INADDR_ANY); dst.inet.port = htons(0); srcp = addr->ipv6.ip.pr_s6_addr; memcpy(&dst.inet.ip, srcp + 12, 4); dst.inet.family = AF_INET; dst.inet.port = addr->ipv6.port; } else { memcpy(&dst, addr, sizeof(dst)); } info->SetDestinationAddr(dst); info->SetConnectTimeout(to); do { status = info->DoHandshake(fd, -1); } while (status == PR_SUCCESS && !info->IsConnected()); return status; } static PRStatus nsSOCKSIOLayerConnectContinue(PRFileDesc* fd, int16_t oflags) { PRStatus status; nsSOCKSSocketInfo* info = (nsSOCKSSocketInfo*)fd->secret; if (info == nullptr) return PR_FAILURE; do { status = info->DoHandshake(fd, oflags); } while (status == PR_SUCCESS && !info->IsConnected()); return status; } static int16_t nsSOCKSIOLayerPoll(PRFileDesc* fd, int16_t in_flags, int16_t* out_flags) { nsSOCKSSocketInfo* info = (nsSOCKSSocketInfo*)fd->secret; if (info == nullptr) return PR_FAILURE; if (!info->IsConnected()) { *out_flags = 0; return info->GetPollFlags(); } return fd->lower->methods->poll(fd->lower, in_flags, out_flags); } static PRStatus nsSOCKSIOLayerClose(PRFileDesc* fd) { nsSOCKSSocketInfo* info = (nsSOCKSSocketInfo*)fd->secret; PRDescIdentity id = PR_GetLayersIdentity(fd); if (info && id == nsSOCKSIOLayerIdentity) { info->ForgetFD(); NS_RELEASE(info); fd->identity = PR_INVALID_IO_LAYER; } return fd->lower->methods->close(fd->lower); } static PRFileDesc* nsSOCKSIOLayerAccept(PRFileDesc* fd, PRNetAddr* addr, PRIntervalTime timeout) { // TODO: implement SOCKS support for accept return fd->lower->methods->accept(fd->lower, addr, timeout); } static int32_t nsSOCKSIOLayerAcceptRead(PRFileDesc* sd, PRFileDesc** nd, PRNetAddr** raddr, void* buf, int32_t amount, PRIntervalTime timeout) { // TODO: implement SOCKS support for accept, then read from it return sd->lower->methods->acceptread(sd->lower, nd, raddr, buf, amount, timeout); } static PRStatus nsSOCKSIOLayerBind(PRFileDesc* fd, const PRNetAddr* addr) { // TODO: implement SOCKS support for bind (very similar to connect) return fd->lower->methods->bind(fd->lower, addr); } static PRStatus nsSOCKSIOLayerGetName(PRFileDesc* fd, PRNetAddr* addr) { nsSOCKSSocketInfo* info = (nsSOCKSSocketInfo*)fd->secret; if (info != nullptr && addr != nullptr) { NetAddr temp; info->GetExternalProxyAddr(temp); NetAddrToPRNetAddr(&temp, addr); return PR_SUCCESS; } return PR_FAILURE; } static PRStatus nsSOCKSIOLayerGetPeerName(PRFileDesc* fd, PRNetAddr* addr) { nsSOCKSSocketInfo* info = (nsSOCKSSocketInfo*)fd->secret; if (info != nullptr && addr != nullptr) { NetAddr temp; info->GetDestinationAddr(temp); NetAddrToPRNetAddr(&temp, addr); return PR_SUCCESS; } return PR_FAILURE; } static PRStatus nsSOCKSIOLayerListen(PRFileDesc* fd, int backlog) { // TODO: implement SOCKS support for listen return fd->lower->methods->listen(fd->lower, backlog); } // add SOCKS IO layer to an existing socket nsresult nsSOCKSIOLayerAddToSocket(int32_t family, const char* host, int32_t port, nsIProxyInfo* proxy, int32_t socksVersion, uint32_t flags, uint32_t tlsFlags, PRFileDesc* fd) { NS_ENSURE_TRUE((socksVersion == 4) || (socksVersion == 5), NS_ERROR_NOT_INITIALIZED); if (firstTime) { // XXX hack until NSPR provides an official way to detect system IPv6 // support (bug 388519) PRFileDesc* tmpfd = PR_OpenTCPSocket(PR_AF_INET6); if (!tmpfd) { ipv6Supported = false; } else { // If the system does not support IPv6, NSPR will push // IPv6-to-IPv4 emulation layer onto the native layer ipv6Supported = PR_GetIdentitiesLayer(tmpfd, PR_NSPR_IO_LAYER) == tmpfd; PR_Close(tmpfd); } nsSOCKSIOLayerIdentity = PR_GetUniqueIdentity("SOCKS layer"); nsSOCKSIOLayerMethods = *PR_GetDefaultIOMethods(); nsSOCKSIOLayerMethods.connect = nsSOCKSIOLayerConnect; nsSOCKSIOLayerMethods.connectcontinue = nsSOCKSIOLayerConnectContinue; nsSOCKSIOLayerMethods.poll = nsSOCKSIOLayerPoll; nsSOCKSIOLayerMethods.bind = nsSOCKSIOLayerBind; nsSOCKSIOLayerMethods.acceptread = nsSOCKSIOLayerAcceptRead; nsSOCKSIOLayerMethods.getsockname = nsSOCKSIOLayerGetName; nsSOCKSIOLayerMethods.getpeername = nsSOCKSIOLayerGetPeerName; nsSOCKSIOLayerMethods.accept = nsSOCKSIOLayerAccept; nsSOCKSIOLayerMethods.listen = nsSOCKSIOLayerListen; nsSOCKSIOLayerMethods.close = nsSOCKSIOLayerClose; firstTime = false; } LOGDEBUG(("Entering nsSOCKSIOLayerAddToSocket().")); PRFileDesc* layer; PRStatus rv; layer = PR_CreateIOLayerStub(nsSOCKSIOLayerIdentity, &nsSOCKSIOLayerMethods); if (!layer) { LOGERROR(("PR_CreateIOLayerStub() failed.")); return NS_ERROR_FAILURE; } nsSOCKSSocketInfo* infoObject = new nsSOCKSSocketInfo(); if (!infoObject) { // clean up IOLayerStub LOGERROR(("Failed to create nsSOCKSSocketInfo().")); PR_Free(layer); // PR_CreateIOLayerStub() uses PR_Malloc(). return NS_ERROR_FAILURE; } NS_ADDREF(infoObject); infoObject->Init(socksVersion, family, proxy, host, flags, tlsFlags); layer->secret = (PRFilePrivate*)infoObject; PRDescIdentity fdIdentity = PR_GetLayersIdentity(fd); #if defined(XP_WIN) if (fdIdentity == mozilla::net::nsNamedPipeLayerIdentity) { // remember named pipe fd on the info object so that we can switch // blocking and non-blocking mode on the pipe later. infoObject->SetNamedPipeFD(fd); } #endif rv = PR_PushIOLayer(fd, fdIdentity, layer); if (rv == PR_FAILURE) { LOGERROR(("PR_PushIOLayer() failed. rv = %x.", rv)); NS_RELEASE(infoObject); PR_Free(layer); // PR_CreateIOLayerStub() uses PR_Malloc(). return NS_ERROR_FAILURE; } return NS_OK; } bool IsHostLocalTarget(const nsACString& aHost) { #if defined(XP_UNIX) return StringBeginsWith(aHost, "file:"_ns); #elif defined(XP_WIN) return IsNamedPipePath(aHost); #else return false; #endif // XP_UNIX }