* auth.texi (Secret Service API): Add the missing text.
[emacs.git] / lisp / net / socks.el
blob3c94e7d1b2245ee0f2b01b8a2a119250674f9466
1 ;;; socks.el --- A Socks v5 Client for Emacs
3 ;; Copyright (C) 1996-2000, 2002, 2007-2012 Free Software Foundation, Inc.
5 ;; Author: William M. Perry <wmperry@gnu.org>
6 ;; Dave Love <fx@gnu.org>
7 ;; Keywords: comm, firewalls
9 ;; This file is part of GNU Emacs.
11 ;; GNU Emacs is free software: you can redistribute it and/or modify
12 ;; it under the terms of the GNU General Public License as published by
13 ;; the Free Software Foundation, either version 3 of the License, or
14 ;; (at your option) any later version.
16 ;; GNU Emacs is distributed in the hope that it will be useful,
17 ;; but WITHOUT ANY WARRANTY; without even the implied warranty of
18 ;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19 ;; GNU General Public License for more details.
21 ;; You should have received a copy of the GNU General Public License
22 ;; along with GNU Emacs. If not, see <http://www.gnu.org/licenses/>.
24 ;;; Commentary:
26 ;; This is an implementation of the SOCKS v5 protocol as defined in
27 ;; RFC 1928.
29 ;; TODO
30 ;; - Finish the redirection rules stuff
31 ;; - Implement composition of servers. Recursively evaluate the
32 ;; redirection rules and do SOCKS-over-HTTP and SOCKS-in-SOCKS
34 (eval-when-compile
35 (require 'wid-edit))
36 (require 'custom)
38 ;; FIXME this is bad practice, and who is it for anyway, since Emacs
39 ;; has split-string since at least 21.1.
40 (if (not (fboundp 'split-string))
41 (defun split-string (string &optional pattern)
42 "Return a list of substrings of STRING which are separated by PATTERN.
43 If PATTERN is omitted, it defaults to \"[ \\f\\t\\n\\r\\v]+\"."
44 (or pattern
45 (setq pattern "[ \f\t\n\r\v]+"))
46 (let (parts (start 0))
47 (while (string-match pattern string start)
48 (setq parts (cons (substring string start (match-beginning 0)) parts)
49 start (match-end 0)))
50 (nreverse (cons (substring string start) parts)))))
51 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
52 ;;; Custom widgets
53 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
54 (define-widget 'dynamic-choice 'menu-choice
55 "A pretty simple dynamic dropdown list"
56 :format "%[%t%]: %v"
57 :tag "Network"
58 :case-fold t
59 :void '(item :format "invalid (%t)\n")
60 :value-create 's5-widget-value-create
61 :value-delete 'widget-children-value-delete
62 :value-get 'widget-choice-value-get
63 :value-inline 'widget-choice-value-inline
64 :mouse-down-action 'widget-choice-mouse-down-action
65 :action 'widget-choice-action
66 :error "Make a choice"
67 :validate 'widget-choice-validate
68 :match 's5-dynamic-choice-match
69 :match-inline 's5-dynamic-choice-match-inline)
71 (defun s5-dynamic-choice-match (widget value)
72 (let ((choices (funcall (widget-get widget :choice-function)))
73 current found)
74 (while (and choices (not found))
75 (setq current (car choices)
76 choices (cdr choices)
77 found (widget-apply current :match value)))
78 found))
80 (defun s5-dynamic-choice-match-inline (widget value)
81 (let ((choices (funcall (widget-get widget :choice-function)))
82 current found)
83 (while (and choices (not found))
84 (setq current (car choices)
85 choices (cdr choices)
86 found (widget-match-inline current value)))
87 found))
89 (defun s5-widget-value-create (widget)
90 (let ((choices (funcall (widget-get widget :choice-function)))
91 (value (widget-get widget :value)))
92 (if (not value)
93 (widget-put widget :value (widget-value (car choices))))
94 (widget-put widget :args choices)
95 (widget-choice-value-create widget)))
97 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
98 ;;; Customization support
99 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
100 (defgroup socks nil
101 "SOCKS Support"
102 :version "22.2"
103 :prefix "socks-"
104 :group 'processes)
106 '(defcustom socks-server-aliases nil
107 "A list of server aliases for use in access control and filtering rules."
108 :group 'socks
109 :type '(repeat (list :format "%v"
110 :value ("" "" 1080 5)
111 (string :tag "Alias")
112 (string :tag "Hostname/IP Address")
113 (integer :tag "Port #")
114 (choice :tag "SOCKS Version"
115 (integer :tag "SOCKS v4" :value 4)
116 (integer :tag "SOCKS v5" :value 5)))))
118 '(defcustom socks-network-aliases
119 '(("Anywhere" (netmask "0.0.0.0" "0.0.0.0")))
120 "A list of network aliases for use in subsequent rules."
121 :group 'socks
122 :type '(repeat (list :format "%v"
123 :value (netmask "" "255.255.255.0")
124 (string :tag "Alias")
125 (radio-button-choice
126 :format "%v"
127 (list :tag "IP address range"
128 (const :format "" :value range)
129 (string :tag "From")
130 (string :tag "To"))
131 (list :tag "IP address/netmask"
132 (const :format "" :value netmask)
133 (string :tag "IP Address")
134 (string :tag "Netmask"))
135 (list :tag "Domain Name"
136 (const :format "" :value domain)
137 (string :tag "Domain name"))
138 (list :tag "Unique hostname/IP address"
139 (const :format "" :value exact)
140 (string :tag "Hostname/IP Address"))))))
142 '(defun s5-servers-filter ()
143 (if socks-server-aliases
144 (mapcar (lambda (x) (list 'const :tag (car x) :value (car x))) s5-server-aliases)
145 '((const :tag "No aliases defined" :value nil))))
147 '(defun s5-network-aliases-filter ()
148 (mapcar (lambda (x) (list 'const :tag (car x) :value (car x)))
149 socks-network-aliases))
151 '(defcustom socks-redirection-rules
153 "A list of redirection rules."
154 :group 'socks
155 :type '(repeat (list :format "%v"
156 :value ("Anywhere" nil)
157 (dynamic-choice :choice-function s5-network-aliases-filter
158 :tag "Destination network")
159 (radio-button-choice
160 :tag "Connection type"
161 (const :tag "Direct connection" :value nil)
162 (dynamic-choice :format "%t: %[%v%]"
163 :choice-function s5-servers-filter
164 :tag "Proxy chain via")))))
166 (defcustom socks-server
167 (list "Default server" "socks" 1080 5)
169 :group 'socks
170 :type '(list
171 (string :format "" :value "Default server")
172 (string :tag "Server")
173 (integer :tag "Port")
174 (radio-button-choice :tag "SOCKS Version"
175 :format "%t: %v"
176 (const :tag "SOCKS v4 " :format "%t" :value 4)
177 (const :tag "SOCKS v5" :format "%t" :value 5))))
180 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
181 ;;; Get down to the nitty gritty
182 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
183 (defconst socks-version 5)
184 (defvar socks-debug nil)
186 ;; Common socks v5 commands
187 (defconst socks-connect-command 1)
188 (defconst socks-bind-command 2)
189 (defconst socks-udp-associate-command 3)
191 ;; Miscellaneous other socks constants
192 (defconst socks-authentication-null 0)
193 (defconst socks-authentication-failure 255)
195 ;; Response codes
196 (defconst socks-response-success 0)
197 (defconst socks-response-general-failure 1)
198 (defconst socks-response-access-denied 2)
199 (defconst socks-response-network-unreachable 3)
200 (defconst socks-response-host-unreachable 4)
201 (defconst socks-response-connection-refused 5)
202 (defconst socks-response-ttl-expired 6)
203 (defconst socks-response-cmd-not-supported 7)
204 (defconst socks-response-address-not-supported 8)
206 (defvar socks-errors
207 '("Succeeded"
208 "General SOCKS server failure"
209 "Connection not allowed by ruleset"
210 "Network unreachable"
211 "Host unreachable"
212 "Connection refused"
213 "Time-to-live expired"
214 "Command not supported"
215 "Address type not supported"))
217 ;; The socks v5 address types
218 (defconst socks-address-type-v4 1)
219 (defconst socks-address-type-name 3)
220 (defconst socks-address-type-v6 4)
222 ;; Base variables
223 (defvar socks-timeout 5)
224 (defvar socks-connections (make-hash-table :size 13))
226 ;; Miscellaneous stuff for authentication
227 (defvar socks-authentication-methods nil)
228 (defvar socks-username (user-login-name))
229 (defvar socks-password nil)
231 (defun socks-register-authentication-method (id desc callback)
232 (let ((old (assq id socks-authentication-methods)))
233 (if old
234 (setcdr old (cons desc callback))
235 (setq socks-authentication-methods
236 (cons (cons id (cons desc callback))
237 socks-authentication-methods)))))
239 (defun socks-unregister-authentication-method (id)
240 (let ((old (assq id socks-authentication-methods)))
241 (if old
242 (setq socks-authentication-methods
243 (delq old socks-authentication-methods)))))
245 (socks-register-authentication-method 0 "No authentication" 'identity)
247 (defun socks-build-auth-list ()
248 (let ((num 0)
249 (retval ""))
250 (mapc
251 (function
252 (lambda (x)
253 (if (fboundp (cdr (cdr x)))
254 (setq retval (format "%s%c" retval (car x))
255 num (1+ num)))))
256 (reverse socks-authentication-methods))
257 (format "%c%s" num retval)))
259 (defconst socks-state-waiting-for-auth 0)
260 (defconst socks-state-submethod-negotiation 1)
261 (defconst socks-state-authenticated 2)
262 (defconst socks-state-waiting 3)
263 (defconst socks-state-connected 4)
265 (defmacro socks-wait-for-state-change (proc htable cur-state)
266 `(while (and (= (gethash 'state ,htable) ,cur-state)
267 (memq (process-status ,proc) '(run open)))
268 (accept-process-output ,proc socks-timeout)))
270 (defun socks-filter (proc string)
271 (let ((info (gethash proc socks-connections))
272 state version desired-len)
273 (or info (error "socks-filter called on non-SOCKS connection %S" proc))
274 (setq state (gethash 'state info))
275 (cond
276 ((= state socks-state-waiting-for-auth)
277 (puthash 'scratch (concat string (gethash 'scratch info)) info)
278 (setq string (gethash 'scratch info))
279 (if (< (length string) 2)
280 nil ; We need to spin some more
281 (puthash 'authtype (aref string 1) info)
282 (puthash 'scratch (substring string 2 nil) info)
283 (puthash 'state socks-state-submethod-negotiation info)))
284 ((= state socks-state-submethod-negotiation)
286 ((= state socks-state-authenticated)
288 ((= state socks-state-waiting)
289 (puthash 'scratch (concat string (gethash 'scratch info)) info)
290 (setq string (gethash 'scratch info))
291 (setq version (gethash 'server-protocol info))
292 (cond
293 ((equal version 'http)
294 (if (not (string-match "\r\n\r\n" string))
295 nil ; Need to spin some more
296 (puthash 'state socks-state-connected info)
297 (puthash 'reply 0 info)
298 (puthash 'response string info)))
299 ((equal version 4)
300 (if (< (length string) 2)
301 nil ; Can't know how much to read yet
302 (setq desired-len
303 (+ 4 ; address length
304 2 ; port
305 2 ; initial data
307 (if (< (length string) desired-len)
308 nil ; need to spin some more
309 (let ((response (aref string 1)))
310 (if (= response 90)
311 (setq response 0))
312 (puthash 'state socks-state-connected info)
313 (puthash 'reply response info)
314 (puthash 'response string info)))))
315 ((equal version 5)
316 (if (< (length string) 4)
318 (setq desired-len
319 (+ 6 ; Standard socks header
320 (cond
321 ((= (aref string 3) socks-address-type-v4) 4)
322 ((= (aref string 3) socks-address-type-v6) 16)
323 ((= (aref string 3) socks-address-type-name)
324 (if (< (length string) 5)
326 (+ 1 (aref string 4)))))))
327 (if (< (length string) desired-len)
328 nil ; Need to spin some more
329 (puthash 'state socks-state-connected info)
330 (puthash 'reply (aref string 1) info)
331 (puthash 'response string info))))))
332 ((= state socks-state-connected)
338 (declare-function socks-original-open-network-stream "socks") ; fset
340 ;; FIXME this is a terrible idea.
341 ;; It is not even compatible with the argument spec of open-network-stream
342 ;; in 24.1. If this is really necessary, open-network-stream
343 ;; could get a wrapper hook, or defer to open-network-stream-function.
345 (defvar socks-override-functions nil
346 "*Whether to overwrite the open-network-stream function with the SOCKSified
347 version.")
349 (require 'network-stream)
351 (if (fboundp 'socks-original-open-network-stream)
352 nil ; Do nothing, we've been here already
353 (defalias 'socks-original-open-network-stream
354 (symbol-function 'open-network-stream))
355 (if socks-override-functions
356 (defalias 'open-network-stream 'socks-open-network-stream)))
358 (defun socks-open-connection (server-info)
359 (interactive)
360 (save-excursion
361 (let ((proc (socks-original-open-network-stream "socks"
363 (nth 1 server-info)
364 (nth 2 server-info)))
365 (info (make-hash-table :size 13))
366 (authtype nil)
367 version)
369 ;; Initialize process and info about the process
370 (set-process-filter proc 'socks-filter)
371 (set-process-query-on-exit-flag proc nil)
372 (puthash proc info socks-connections)
373 (puthash 'state socks-state-waiting-for-auth info)
374 (puthash 'authtype socks-authentication-failure info)
375 (puthash 'server-protocol (nth 3 server-info) info)
376 (puthash 'server-name (nth 1 server-info) info)
377 (setq version (nth 3 server-info))
378 (cond
379 ((equal version 'http)
380 ;; Don't really have to do any connection setup under http
381 nil)
382 ((equal version 4)
383 ;; Don't really have to do any connection setup under v4
384 nil)
385 ((equal version 5)
386 ;; Need to handle all the authentication crap under v5
387 ;; Send what we think we can handle for authentication types
388 (process-send-string proc (format "%c%s" socks-version
389 (socks-build-auth-list)))
391 ;; Basically just do a select() until we change states.
392 (socks-wait-for-state-change proc info socks-state-waiting-for-auth)
393 (setq authtype (gethash 'authtype info))
394 (cond
395 ((= authtype socks-authentication-null)
396 (and socks-debug (message "No authentication necessary")))
397 ((= authtype socks-authentication-failure)
398 (error "No acceptable authentication methods found"))
400 (let* ((auth-type (gethash 'authtype info))
401 (auth-handler (assoc auth-type socks-authentication-methods))
402 (auth-func (and auth-handler (cdr (cdr auth-handler))))
403 (auth-desc (and auth-handler (car (cdr auth-handler)))))
404 (set-process-filter proc nil)
405 (if (and auth-func (fboundp auth-func)
406 (funcall auth-func proc))
407 nil ; We succeeded!
408 (delete-process proc)
409 (error "Failed to use auth method: %s (%d)"
410 (or auth-desc "Unknown") auth-type))
414 (puthash 'state socks-state-authenticated info)
415 (set-process-filter proc 'socks-filter)))
416 proc)))
418 (defun socks-send-command (proc command atype address port)
419 (let ((addr (cond
420 ((or (= atype socks-address-type-v4)
421 (= atype socks-address-type-v6))
422 address)
423 ((= atype socks-address-type-name)
424 (format "%c%s" (length address) address))
426 (error "Unknown address type: %d" atype))))
427 (info (gethash proc socks-connections))
428 request version)
429 (or info (error "socks-send-command called on non-SOCKS connection %S"
430 proc))
431 (puthash 'state socks-state-waiting info)
432 (setq version (gethash 'server-protocol info))
433 (cond
434 ((equal version 'http)
435 (setq request (format (eval-when-compile
436 (concat
437 "CONNECT %s:%d HTTP/1.0\r\n"
438 "User-Agent: Emacs/SOCKS v1.0\r\n"
439 "\r\n"))
440 (cond
441 ((equal atype socks-address-type-name) address)
443 (error "Unsupported address type for HTTP: %d" atype)))
444 port)))
445 ((equal version 4)
446 (setq request (string-make-unibyte
447 (format
448 "%c%c%c%c%s%s%c"
449 version ; version
450 command ; command
451 (lsh port -8) ; port, high byte
452 (- port (lsh (lsh port -8) 8)) ; port, low byte
453 addr ; address
454 (user-full-name) ; username
455 0 ; terminate username
456 ))))
457 ((equal version 5)
458 (setq request (string-make-unibyte
459 (format
460 "%c%c%c%c%s%c%c"
461 version ; version
462 command ; command
463 0 ; reserved
464 atype ; address type
465 addr ; address
466 (lsh port -8) ; port, high byte
467 (- port (lsh (lsh port -8) 8)) ; port, low byte
468 ))))
470 (error "Unknown protocol version: %d" version)))
471 (process-send-string proc request)
472 (socks-wait-for-state-change proc info socks-state-waiting)
473 (process-status proc)
474 (if (= (or (gethash 'reply info) 1) socks-response-success)
475 nil ; Sweet sweet success!
476 (delete-process proc)
477 (error "SOCKS: %s" (nth (or (gethash 'reply info) 1) socks-errors)))
478 proc))
481 ;; Replacement functions for open-network-stream, etc.
482 (defvar socks-noproxy nil
483 "*List of regexps matching hosts that we should not socksify connections to")
485 (defun socks-find-route (host service)
486 (let ((route socks-server)
487 (noproxy socks-noproxy))
488 (while noproxy
489 (if (eq ?! (aref (car noproxy) 0))
490 (if (string-match (substring (car noproxy) 1) host)
491 (setq noproxy nil))
492 (if (string-match (car noproxy) host)
493 (setq route nil
494 noproxy nil)))
495 (setq noproxy (cdr noproxy)))
496 route))
498 (defvar socks-services-file "/etc/services")
499 (defvar socks-tcp-services (make-hash-table :size 13 :test 'equal))
500 (defvar socks-udp-services (make-hash-table :size 13 :test 'equal))
502 (defun socks-parse-services ()
503 (if (not (and (file-exists-p socks-services-file)
504 (file-readable-p socks-services-file)))
505 (error "Could not find services file: %s" socks-services-file))
506 (clrhash socks-tcp-services)
507 (clrhash socks-udp-services)
508 (with-current-buffer (get-buffer-create " *socks-tmp*")
509 (erase-buffer)
510 (insert-file-contents socks-services-file)
511 ;; Nuke comments
512 (goto-char (point-min))
513 (while (re-search-forward "#.*" nil t)
514 (replace-match ""))
515 ;; Nuke empty lines
516 (goto-char (point-min))
517 (while (re-search-forward "^[ \t\n]+" nil t)
518 (replace-match ""))
519 ;; Now find all the lines
520 (goto-char (point-min))
521 (let (name port type)
522 (while (re-search-forward "^\\([^ \t]+\\)[ \t]+\\([0-9]+\\)/\\([a-z]+\\)"
523 nil t)
524 (setq name (downcase (match-string 1))
525 port (string-to-number (match-string 2))
526 type (downcase (match-string 3)))
527 (puthash name port (if (equal type "udp")
528 socks-udp-services
529 socks-tcp-services))))))
531 (defun socks-find-services-entry (service &optional udp)
532 "Return the port # associated with SERVICE"
533 (if (= (hash-table-count socks-tcp-services) 0)
534 (socks-parse-services))
535 (gethash (downcase service)
536 (if udp socks-udp-services socks-tcp-services)))
538 (defun socks-open-network-stream (name buffer host service)
539 (let* ((route (socks-find-route host service))
540 proc info version atype)
541 (if (not route)
542 (socks-original-open-network-stream name buffer host service)
543 (setq proc (socks-open-connection route)
544 info (gethash proc socks-connections)
545 version (gethash 'server-protocol info))
546 (cond
547 ((equal version 4)
548 (setq host (socks-nslookup-host host))
549 (if (not (listp host))
550 (error "Could not get IP address for: %s" host))
551 (setq host (apply 'format "%c%c%c%c" host))
552 (setq atype socks-address-type-v4))
554 (setq atype socks-address-type-name)))
555 (socks-send-command proc
556 socks-connect-command
557 atype
558 host
559 (if (stringp service)
561 (socks-find-services-entry service)
562 (error "Unknown service: %s" service))
563 service))
564 (puthash 'buffer buffer info)
565 (puthash 'host host info)
566 (puthash 'service host info)
567 (set-process-filter proc nil)
568 (set-process-buffer proc (if buffer (get-buffer-create buffer)))
569 proc)))
571 ;; Authentication modules go here
573 ;; Basic username/password authentication, ala RFC 1929
574 (socks-register-authentication-method 2 "Username/Password"
575 'socks-username/password-auth)
577 (defconst socks-username/password-auth-version 1)
579 (defun socks-username/password-auth-filter (proc str)
580 (let ((info (gethash proc socks-connections)))
581 (or info (error "socks-filter called on non-SOCKS connection %S" proc))
582 (puthash 'scratch (concat (gethash 'scratch info) str) info)
583 (if (< (length (gethash 'scratch info)) 2)
585 (puthash 'password-auth-status (aref (gethash 'scratch info) 1) info)
586 (puthash 'state socks-state-authenticated info))))
588 (defun socks-username/password-auth (proc)
589 (let* ((info (gethash proc socks-connections))
590 (state (gethash 'state info)))
591 (if (not socks-password)
592 (setq socks-password (read-passwd
593 (format "Password for %s@%s: "
594 socks-username
595 (gethash 'server-name info)))))
596 (puthash 'scratch "" info)
597 (set-process-filter proc 'socks-username/password-auth-filter)
598 (process-send-string proc
599 (format "%c%c%s%c%s"
600 socks-username/password-auth-version
601 (length socks-username)
602 socks-username
603 (length socks-password)
604 socks-password))
605 (socks-wait-for-state-change proc info state)
606 (= (gethash 'password-auth-status info) 0)))
609 ;; More advanced GSS/API stuff, not yet implemented - volunteers?
610 ;; (socks-register-authentication-method 1 "GSS/API" 'socks-gssapi-auth)
612 (defun socks-gssapi-auth (proc)
613 nil)
616 ;; CHAP stuff
617 ;; (socks-register-authentication-method 3 "CHAP" 'socks-chap-auth)
618 (defun socks-chap-auth (proc)
619 nil)
622 ;; CRAM stuff
623 ;; (socks-register-authentication-method 5 "CRAM" 'socks-cram-auth)
624 (defun socks-cram-auth (proc)
625 nil)
628 (defcustom socks-nslookup-program "nslookup"
629 "*If non-NIL then a string naming the nslookup program."
630 :type '(choice (const :tag "None" :value nil) string)
631 :group 'socks)
633 (defun socks-nslookup-host (host)
634 "Attempt to resolve the given HOSTNAME using nslookup if possible."
635 (interactive "sHost: ")
636 (if socks-nslookup-program
637 (let ((proc (start-process " *nslookup*" " *nslookup*"
638 socks-nslookup-program host))
639 (res host))
640 (set-process-query-on-exit-flag proc nil)
641 (with-current-buffer (process-buffer proc)
642 (while (progn
643 (accept-process-output proc)
644 (memq (process-status proc) '(run open))))
645 (goto-char (point-min))
646 (if (re-search-forward "Name:.*\nAddress\\(es\\)?: *\\([0-9.]+\\)$" nil t)
647 (progn
648 (setq res (buffer-substring (match-beginning 2)
649 (match-end 2))
650 res (mapcar 'string-to-int (split-string res "\\.")))))
651 (kill-buffer (current-buffer)))
652 res)
653 host))
655 (provide 'socks)
657 ;;; socks.el ends here