251enum SOCKS5Method: uint8_t {
252    NOAUTH = 0x00,        //!< No authentication required
253    GSSAPI = 0x01,        //!< GSSAPI
254    USER_PASS = 0x02,     //!< Username/password
255    NO_ACCEPTABLE = 0xff, //!< No acceptable methods
256};
257
258/** Values defined for CMD in RFC1928 */
259enum SOCKS5Command: uint8_t {
260    CONNECT = 0x01,
261    BIND = 0x02,
262    UDP_ASSOCIATE = 0x03
263};
264
265/** Values defined for REP in RFC1928 and https://spec.torproject.org/socks-extensions.html */
266enum SOCKS5Reply: uint8_t {
267    SUCCEEDED = 0x00,                  //!< RFC1928: Succeeded
268    GENFAILURE = 0x01,                 //!< RFC1928: General failure
269    NOTALLOWED = 0x02,                 //!< RFC1928: Connection not allowed by ruleset
270    NETUNREACHABLE = 0x03,             //!< RFC1928: Network unreachable
271    HOSTUNREACHABLE = 0x04,            //!< RFC1928: Network unreachable
272    CONNREFUSED = 0x05,                //!< RFC1928: Connection refused
273    TTLEXPIRED = 0x06,                 //!< RFC1928: TTL expired
274    CMDUNSUPPORTED = 0x07,             //!< RFC1928: Command not supported
275    ATYPEUNSUPPORTED = 0x08,           //!< RFC1928: Address type not supported
276    TOR_HS_DESC_NOT_FOUND = 0xf0,      //!< Tor: Onion service descriptor can not be found
277    TOR_HS_DESC_INVALID = 0xf1,        //!< Tor: Onion service descriptor is invalid
278    TOR_HS_INTRO_FAILED = 0xf2,        //!< Tor: Onion service introduction failed
279    TOR_HS_REND_FAILED = 0xf3,         //!< Tor: Onion service rendezvous failed
280    TOR_HS_MISSING_CLIENT_AUTH = 0xf4, //!< Tor: Onion service missing client authorization
281    TOR_HS_WRONG_CLIENT_AUTH = 0xf5,   //!< Tor: Onion service wrong client authorization
282    TOR_HS_BAD_ADDRESS = 0xf6,         //!< Tor: Onion service invalid address
283    TOR_HS_INTRO_TIMEOUT = 0xf7,       //!< Tor: Onion service introduction timed out
284};
285
286/** Values defined for ATYPE in RFC1928 */
287enum SOCKS5Atyp: uint8_t {
288    IPV4 = 0x01,
289    DOMAINNAME = 0x03,
290    IPV6 = 0x04,
291};
292
293/** Status codes that can be returned by InterruptibleRecv */
294enum class IntrRecvError {
295    OK,
296    Timeout,
297    Disconnected,
298    NetworkError,
299    Interrupted
300};
301
302/**
303 * Try to read a specified number of bytes from a socket. Please read the "see
304 * also" section for more detail.
305 *
306 * @param data The buffer where the read bytes should be stored.
307 * @param len The number of bytes to read into the specified buffer.
308 * @param timeout The total timeout for this read.
309 * @param sock The socket (has to be in non-blocking mode) from which to read bytes.
310 *
311 * @returns An IntrRecvError indicating the resulting status of this read.
312 *          IntrRecvError::OK only if all of the specified number of bytes were
313 *          read.
314 *
315 * @see This function can be interrupted by calling g_socks5_interrupt().
316 *      Sockets can be made non-blocking with Sock::SetNonBlocking().
317 */
318static IntrRecvError InterruptibleRecv(uint8_t* data, size_t len, std::chrono::milliseconds timeout, const Sock& sock)
319{
320    auto curTime{Now<SteadyMilliseconds>()};
321    const auto endTime{curTime + timeout};
322    while (len > 0 && curTime < endTime) {
323        ssize_t ret = sock.Recv(data, len, 0); // Optimistically try the recv first
324        if (ret > 0) {
325            len -= ret;
326            data += ret;
327        } else if (ret == 0) { // Unexpected disconnection
328            return IntrRecvError::Disconnected;
329        } else { // Other error or blocking
330            int nErr = WSAGetLastError();
331            if (nErr == WSAEINPROGRESS || nErr == WSAEWOULDBLOCK || nErr == WSAEINVAL) {
332                // Only wait at most MAX_WAIT_FOR_IO at a time, unless
333                // we're approaching the end of the specified total timeout
334                const auto remaining = std::chrono::milliseconds{endTime - curTime};
335                const auto timeout = std::min(remaining, std::chrono::milliseconds{MAX_WAIT_FOR_IO});
336                if (!sock.Wait(timeout, Sock::RecvEvent)) {
337                    return IntrRecvError::NetworkError;
338                }
339            } else {
340                return IntrRecvError::NetworkError;
341            }
342        }
343        if (g_socks5_interrupt) {
344            return IntrRecvError::Interrupted;
345        }
346        curTime = Now<SteadyMilliseconds>();
347    }
348    return len == 0 ? IntrRecvError::OK : IntrRecvError::Timeout;
349}
350
351/** Convert SOCKS5 reply to an error message */
352static std::string Socks5ErrorString(uint8_t err)
353{
354    switch(err) {
355        case SOCKS5Reply::GENFAILURE:
356            return "general failure";
357        case SOCKS5Reply::NOTALLOWED:
358            return "connection not allowed";
359        case SOCKS5Reply::NETUNREACHABLE:
360            return "network unreachable";
361        case SOCKS5Reply::HOSTUNREACHABLE:
362            return "host unreachable";
363        case SOCKS5Reply::CONNREFUSED:
364            return "connection refused";
365        case SOCKS5Reply::TTLEXPIRED:
366            return "TTL expired";
367        case SOCKS5Reply::CMDUNSUPPORTED:
368            return "protocol error";
369        case SOCKS5Reply::ATYPEUNSUPPORTED:
370            return "address type not supported";
371        case SOCKS5Reply::TOR_HS_DESC_NOT_FOUND:
372            return "onion service descriptor can not be found";
373        case SOCKS5Reply::TOR_HS_DESC_INVALID:
374            return "onion service descriptor is invalid";
375        case SOCKS5Reply::TOR_HS_INTRO_FAILED:
376            return "onion service introduction failed";
377        case SOCKS5Reply::TOR_HS_REND_FAILED:
378            return "onion service rendezvous failed";
379        case SOCKS5Reply::TOR_HS_MISSING_CLIENT_AUTH:
380            return "onion service missing client authorization";
381        case SOCKS5Reply::TOR_HS_WRONG_CLIENT_AUTH:
382            return "onion service wrong client authorization";
383        case SOCKS5Reply::TOR_HS_BAD_ADDRESS:
384            return "onion service invalid address";
385        case SOCKS5Reply::TOR_HS_INTRO_TIMEOUT:
386            return "onion service introduction timed out";
387        default:
388            return strprintf("unknown (0x%02x)", err);
389    }
390}
391
392bool Socks5(const std::string& strDest, uint16_t port, const ProxyCredentials* auth, const Sock& sock)
393{
394    try {
395        IntrRecvError recvr;
396        LogDebug(BCLog::NET, "SOCKS5 connecting %s\n", strDest);
397        if (strDest.size() > 255) {
398            LogError("Hostname too long\n");
399            return false;
400        }
401        // Construct the version identifier/method selection message
402        std::vector<uint8_t> vSocks5Init;
403        vSocks5Init.push_back(SOCKSVersion::SOCKS5); // We want the SOCK5 protocol
404        if (auth) {
405            vSocks5Init.push_back(0x02); // 2 method identifiers follow...
406            vSocks5Init.push_back(SOCKS5Method::NOAUTH);
407            vSocks5Init.push_back(SOCKS5Method::USER_PASS);
408        } else {
409            vSocks5Init.push_back(0x01); // 1 method identifier follows...
410            vSocks5Init.push_back(SOCKS5Method::NOAUTH);
411        }
412        sock.SendComplete(vSocks5Init, g_socks5_recv_timeout, g_socks5_interrupt);
413        uint8_t pchRet1[2];
414        if (InterruptibleRecv(pchRet1, 2, g_socks5_recv_timeout, sock) != IntrRecvError::OK) {
415            LogInfo("Socks5() connect to %s:%d failed: InterruptibleRecv() timeout or other failure\n", strDest, port);
416            return false;
417        }
418        if (pchRet1[0] != SOCKSVersion::SOCKS5) {
419            LogError("Proxy failed to initialize\n");
420            return false;
421        }
422        if (pchRet1[1] == SOCKS5Method::USER_PASS && auth) {
423            // Perform username/password authentication (as described in RFC1929)
424            std::vector<uint8_t> vAuth;
425            vAuth.push_back(0x01); // Current (and only) version of user/pass subnegotiation
426            if (auth->username.size() > 255 || auth->password.size() > 255) {
427                LogError("Proxy username or password too long\n");
428                return false;
429            }
430            vAuth.push_back(auth->username.size());
431            vAuth.insert(vAuth.end(), auth->username.begin(), auth->username.end());
432            vAuth.push_back(auth->password.size());
433            vAuth.insert(vAuth.end(), auth->password.begin(), auth->password.end());
434            LogDebug(BCLog::PROXY, "SOCKS5 sending username/password authentication\n");
435            sock.SendComplete(vAuth, g_socks5_recv_timeout, g_socks5_interrupt);
436            uint8_t pchRetA[2];
437            if (InterruptibleRecv(pchRetA, 2, g_socks5_recv_timeout, sock) != IntrRecvError::OK) {
438                LogError("Error reading proxy authentication response\n");
439                return false;
440            }
441            if (pchRetA[0] != 0x01 || pchRetA[1] != 0x00) {
442                LogError("Proxy authentication unsuccessful\n");
443                return false;
444            }
445        } else if (pchRet1[1] == SOCKS5Method::NOAUTH) {
446            // Perform no authentication
447        } else {
448            LogError("Proxy requested wrong authentication method %02x\n", pchRet1[1]);
449            return false;
450        }
451        std::vector<uint8_t> vSocks5;
452        vSocks5.push_back(SOCKSVersion::SOCKS5);   // VER protocol version
453        vSocks5.push_back(SOCKS5Command::CONNECT); // CMD CONNECT
454        vSocks5.push_back(0x00);                   // RSV Reserved must be 0
455        vSocks5.push_back(SOCKS5Atyp::DOMAINNAME); // ATYP DOMAINNAME
456        vSocks5.push_back(strDest.size());         // Length<=255 is checked at beginning of function
457        vSocks5.insert(vSocks5.end(), strDest.begin(), strDest.end());
458        vSocks5.push_back((port >> 8) & 0xFF);
459        vSocks5.push_back((port >> 0) & 0xFF);
460        sock.SendComplete(vSocks5, g_socks5_recv_timeout, g_socks5_interrupt);
461        uint8_t pchRet2[4];
462        if ((recvr = InterruptibleRecv(pchRet2, 4, g_socks5_recv_timeout, sock)) != IntrRecvError::OK) {
463            if (recvr == IntrRecvError::Timeout) {
464                /* If a timeout happens here, this effectively means we timed out while connecting
465                 * to the remote node. This is very common for Tor, so do not print an
466                 * error message. */
467                return false;
468            } else {
469                LogError("Error while reading proxy response\n");
470                return false;
471            }
472        }
473        if (pchRet2[0] != SOCKSVersion::SOCKS5) {
474            LogError("Proxy failed to accept request\n");
475            return false;
476        }
477        if (pchRet2[1] != SOCKS5Reply::SUCCEEDED) {
478            // Failures to connect to a peer that are not proxy errors
479            LogDebug(BCLog::NET,
480                          "Socks5() connect to %s:%d failed: %s\n", strDest, port, Socks5ErrorString(pchRet2[1]));
481            return false;
482        }
483        if (pchRet2[2] != 0x00) { // Reserved field must be 0
484            LogError("Error: malformed proxy response\n");
485            return false;
486        }
487        uint8_t pchRet3[256];
488        switch (pchRet2[3]) {
489        case SOCKS5Atyp::IPV4: recvr = InterruptibleRecv(pchRet3, 4, g_socks5_recv_timeout, sock); break;
490        case SOCKS5Atyp::IPV6: recvr = InterruptibleRecv(pchRet3, 16, g_socks5_recv_timeout, sock); break;
491        case SOCKS5Atyp::DOMAINNAME: {
492            recvr = InterruptibleRecv(pchRet3, 1, g_socks5_recv_timeout, sock);
493            if (recvr != IntrRecvError::OK) {
494                LogError("Error reading from proxy\n");
495                return false;
496            }
497            int nRecv = pchRet3[0];
498            recvr = InterruptibleRecv(pchRet3, nRecv, g_socks5_recv_timeout, sock);
499            break;
500        }