Re: ncat: patch that adds socks5 support - allows to proxy IPv6 connections

[Shinnok <admin () shinnok com>]

On 05/24/2011 09:27 AM, Marek Lukaszuk wrote:
> On Sat, May 21, 2011 at 09:46, Marek Lukaszuk <m.lukaszuk () gmail com> wrote:
> > On Sat, May 21, 2011 at 09:18, David Fifield <david () bamsoftware com> wrote:
> > > Hi, Marek. I've asked Shinnok to review this patch as a feature creeper.
> > > Something I'd like to see is the SOCKS negotiations moved into separate
> > > functions to reduce function length and indentation depth.
>
> OK, so attached is a new patch, it should work without any problems on
> systems that support IPv6 (*)
>
> what it does is:
> - adds support to proxy IPv4, IPv6 and fqdn through Socks5 proxy,
> - adds authentication support for Socks5,
> - adds support to proxy fqdn via Socks4a proxy,
> - fixes authentication support for Socks4 proxy on 64bit systems
> (looks like a wrong type used to store IPv4 address, was unsigned long
> I changed it to uint32_t),
> - the destination that we proxy to is not stored in a socket structure
> anymore, this allows to proxy unsupported address families and leave
> the name resolution up to the proxy (this change was done to all
> proxies),
> - Socks4 (actually Socks4a now) and Socks5 code is  in a separate functions.
> - general cleanup of the proxy code in the ncat_connect code,
>
> I've run some tests and as far as I can see there shouldn't be any
> obvious bugs, but fell free to send me any that you find.
>
> (*)There is one small issue, I would like to make the code that allows
> to proxy IPv6 via Socks5 independent from the local system (so that we
> can proxy to an IPv6 address from an IPv4 only system). The one and
> only function that I miss is something that will translate IPv6
> address to 16 bytes (something like inet_pton - currently used) that
> can also be used on systems that don't have IPv6 support. I saw a
> function in nbase called inet_pton6, my idea was to copy it over to
> ncat  not sure if this is a good idea. What approach do you suggest
> here?
>
> Any suggestions, corrections are always welcome :)
>
> Marek

Hi Marek,

I've finally come to reviewing the patch you submitted and here's the
output.

Two major issues were found and fixed in the patch to your patch I've
attached to this e-mail:

1) You forgot to handle --proxy-type * for listen mode too. First hunk
in the patch fixes this.

2) Default port selection, -p port specifier and default last argument
is a port for listen mode are not behaving all that well, since the port
selection was not done properly. Remaining hunks fix that.

There's still a couple of errors to be fixed as
./ncat/tests/ncat-test.pl still issues some proxy specific errors, 9
errors to be more specific, from 54 something previously(give or take 5
which are ipv6 specific), but I have to crash now since I am too tired.
It would be great if you could take a look over my patch and apply it to
yours and then run ncat-test.pl yourself and go on from there.

Regards,

Shinnok

Attachment: ncat_proxy_fixes.patch
Description:

_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://seclists.org/nmap-dev/