Resolving names and opening network connections

751}
752
753bool HaveNameProxy() {
754    LOCK(g_proxyinfo_mutex);
755    return nameProxy.IsValid();
756}
757
758bool IsProxy(const CNetAddr &addr) {
759    LOCK(g_proxyinfo_mutex);
760    for (int i = 0; i < NET_MAX; i++) {
761        if (addr == static_cast<CNetAddr>(proxyInfo[i].proxy))
762            return true;
763    }
764    return false;
765}
766
767/**
768 * Generate unique credentials for Tor stream isolation. Tor will create
769 * separate circuits for SOCKS5 proxy connections with different credentials, which
770 * makes it harder to correlate the connections.
771 */
772class TorStreamIsolationCredentialsGenerator
773{
774public:
775    TorStreamIsolationCredentialsGenerator():
776        m_prefix(GenerateUniquePrefix()) {
777    }
778
779    /** Return the next unique proxy credentials. */
780    ProxyCredentials Generate() {
781        ProxyCredentials auth;
782        auth.username = auth.password = strprintf("%s%i", m_prefix, m_counter);
783        ++m_counter;
784        return auth;
785    }
786
787    /** Size of session prefix in bytes. */
788    static constexpr size_t PREFIX_BYTE_LENGTH = 8;
789private:
790    const std::string m_prefix;
791    std::atomic<uint64_t> m_counter;
792
793    /** Generate a random prefix for each of the credentials returned by this generator.
794     * This makes sure that different launches of the application (either successively or in parallel)
795     * will not share the same circuits, as would be the case with a bare counter.
796     */
797    static std::string GenerateUniquePrefix() {
798        std::array<uint8_t, PREFIX_BYTE_LENGTH> prefix_bytes;
799        GetRandBytes(prefix_bytes);
800        return HexStr(prefix_bytes) + "-";
801    }
802};
803
804std::unique_ptr<Sock> ConnectThroughProxy(const Proxy& proxy,
805                                          const std::string& dest,
806                                          uint16_t port,
807                                          bool& proxy_connection_failed)
808{
809    // first connect to proxy server
810    auto sock = proxy.Connect();
811    if (!sock) {
812        proxy_connection_failed = true;
813        return {};
814    }
815
816    // do socks negotiation
817    if (proxy.m_tor_stream_isolation) {
818        static TorStreamIsolationCredentialsGenerator generator;
819        ProxyCredentials random_auth{generator.Generate()};
820        if (!Socks5(dest, port, &random_auth, *sock)) {
821            return {};
822        }
823    } else {
824        if (!Socks5(dest, port, nullptr, *sock)) {
825            return {};
826        }
827    }
828    return sock;
829}
830
831CSubNet LookupSubNet(const std::string& subnet_str)
832{
833    CSubNet subnet;
834    assert(!subnet.IsValid());
835    if (ContainsNUL(subnet_str)) {
836        return subnet;
837    }
838
839    const size_t slash_pos{subnet_str.find_last_of('/')};
840    const std::string str_addr{subnet_str.substr(0, slash_pos)};
841    std::optional<CNetAddr> addr{LookupHost(str_addr, /*fAllowLookup=*/false)};
842
843    if (addr.has_value()) {
844        addr = static_cast<CNetAddr>(MaybeFlipIPv6toCJDNS(CService{addr.value(), /*port=*/0}));
845        if (slash_pos != subnet_str.npos) {
846            const std::string netmask_str{subnet_str.substr(slash_pos + 1)};
847            if (const auto netmask{ToIntegral<uint8_t>(netmask_str)}) {
848                // Valid number; assume CIDR variable-length subnet masking.
849                subnet = CSubNet{addr.value(), *netmask};
850            } else {
851                // Invalid number; try full netmask syntax. Never allow lookup for netmask.
852                const std::optional<CNetAddr> full_netmask{LookupHost(netmask_str, /*fAllowLookup=*/false)};
853                if (full_netmask.has_value()) {
854                    subnet = CSubNet{addr.value(), full_netmask.value()};
855                }
856            }
857        } else {
858            // Single IP subnet (<ipv4>/32 or <ipv6>/128).
859            subnet = CSubNet{addr.value()};
860        }
861    }
862
863    return subnet;
864}
865
866bool IsBadPort(uint16_t port)
867{
868    /* Don't forget to update doc/p2p-bad-ports.md if you change this list. */
869
870    switch (port) {
871    case 1:     // tcpmux
872    case 7:     // echo
873    case 9:     // discard
874    case 11:    // systat
875    case 13:    // daytime
876    case 15:    // netstat
877    case 17:    // qotd
878    case 19:    // chargen
879    case 20:    // ftp data
880    case 21:    // ftp access
881    case 22:    // ssh
882    case 23:    // telnet
883    case 25:    // smtp
884    case 37:    // time
885    case 42:    // name
886    case 43:    // nicname
887    case 53:    // domain
888    case 69:    // tftp
889    case 77:    // priv-rjs
890    case 79:    // finger
891    case 87:    // ttylink
892    case 95:    // supdup
893    case 101:   // hostname
894    case 102:   // iso-tsap
895    case 103:   // gppitnp
896    case 104:   // acr-nema
897    case 109:   // pop2
898    case 110:   // pop3
899    case 111:   // sunrpc
900    case 113:   // auth
901    case 115:   // sftp
902    case 117:   // uucp-path
903    case 119:   // nntp
904    case 123:   // NTP
905    case 135:   // loc-srv /epmap
906    case 137:   // netbios
907    case 139:   // netbios
908    case 143:   // imap2
909    case 161:   // snmp
910    case 179:   // BGP
911    case 389:   // ldap
912    case 427:   // SLP (Also used by Apple Filing Protocol)
913    case 465:   // smtp+ssl
914    case 512:   // print / exec
915    case 513:   // login
916    case 514:   // shell
917    case 515:   // printer
918    case 526:   // tempo
919    case 530:   // courier
920    case 531:   // chat
921    case 532:   // netnews
922    case 540:   // uucp
923    case 548:   // AFP (Apple Filing Protocol)
924    case 554:   // rtsp
925    case 556:   // remotefs
926    case 563:   // nntp+ssl
927    case 587:   // smtp (rfc6409)
928    case 601:   // syslog-conn (rfc3195)
929    case 636:   // ldap+ssl
930    case 989:   // ftps-data
931    case 990:   // ftps
932    case 993:   // ldap+ssl
933    case 995:   // pop3+ssl
934    case 1719:  // h323gatestat
935    case 1720:  // h323hostcall
936    case 1723:  // pptp
937    case 2049:  // nfs
938    case 3306:  // MySQL
939    case 3389:  // RDP / Windows Remote Desktop
940    case 3659:  // apple-sasl / PasswordServer
941    case 4045:  // lockd
942    case 5060:  // sip
943    case 5061:  // sips
944    case 5432:  // PostgreSQL
945    case 5900:  // VNC
946    case 6000:  // X11
947    case 6566:  // sane-port
948    case 6665:  // Alternate IRC
949    case 6666:  // Alternate IRC
950    case 6667:  // Standard IRC
951    case 6668:  // Alternate IRC
952    case 6669:  // Alternate IRC
953    case 6697:  // IRC + TLS
954    case 10080: // Amanda
955    case 27017: // MongoDB
956        return true;
957    }
958    return false;
959}
960
961CService MaybeFlipIPv6toCJDNS(const CService& service)
962{
963    CService ret{service};
964    if (ret.IsIPv6() && ret.HasCJDNSPrefix() && g_reachable_nets.Contains(NET_CJDNS)) {
965        ret.m_net = NET_CJDNS;
966    }
967    return ret;
968}
969
970CService GetBindAddress(const Sock& sock)
971{
972    CService addr_bind;
973    sockaddr_storage storage;
974    socklen_t len = sizeof(storage);
975
976    auto sa = reinterpret_cast<sockaddr*>(&storage);
977
978    if (sock.GetSockName(sa, &len) == 0) {
979        addr_bind.SetSockAddr(sa, len);
980    } else {
981        LogWarning("getsockname failed\n");
982    }
983    return addr_bind;
984}
985