Ejemplo n.º 1
0
def parse_name(data, offset):
    p = offset
    labels = []
    # l为偏置offset的数据
    l = common.ord(data[p])
    while l > 0:
        # 为什么是128+64
        if (l & (128 + 64)) == (128 + 64):
            # 定义指针
            pointer = struct.unpack('!H', data[p:p + 2])[0]
            # 指针取无符号2字节
            pointer &= 0x3FFF
            # 递归自身处理记录
            r = parse_name(data, pointer)
            # 追加数据
            labels.append(r[1])
            # 指针偏移自增两个字节
            p += 2
            # 指针到末尾(递归结束条件)
            return p - offset, b'.'.join(labels)
        else:
            # 追加labels
            labels.append(data[p + 1:p + 1 + l])
            # 指针自增(递归的一般条件)
            p += 1 + l
        l = common.ord(data[p])
    # 递归结束:l=0:
    return p - offset + 1, b'.'.join(labels)
Ejemplo n.º 2
0
    def server_post_decrypt(self, buf):
        if self.raw_trans:
            return (buf, False)
        self.recv_buf += buf
        out_buf = b''
        if not self.has_recv_header:
            if len(self.recv_buf) < 2:
                return (b'', False)
            if (ord(self.recv_buf[0]) & 0x10) != 0x10:
                return self.not_match_return(self.recv_buf)
            head_size = self.get_head_size(self.recv_buf, 65536)
            if len(self.recv_buf) < head_size + 10:
                return self.not_match_return(self.recv_buf)
            sha1data = hmac.new(self.server_info.recv_iv + self.server_info.key, self.recv_buf[:head_size], hashlib.sha1).digest()[:10]
            if sha1data != self.recv_buf[head_size:head_size + 10]:
                logging.error('server_post_decrype data uncorrect auth HMAC-SHA1')
                return self.not_match_return(self.recv_buf)
            out_buf = to_bytes(chr(ord(self.recv_buf[0]) & 0xEF)) + self.recv_buf[1:head_size]
            self.recv_buf = self.recv_buf[head_size + 10:]
            self.has_recv_header = True
        while len(self.recv_buf) > 2:
            length = struct.unpack('>H', self.recv_buf[:2])[0] + 12
            if length > len(self.recv_buf):
                break

            data = self.recv_buf[12:length]
            sha1data = hmac.new(self.server_info.recv_iv + struct.pack('>I', self.recv_id), data, hashlib.sha1).digest()[:10]
            if sha1data != self.recv_buf[2:12]:
                raise Exception('server_post_decrype data uncorrect chunk HMAC-SHA1')

            self.recv_id = (self.recv_id + 1) & 0xFFFFFFFF
            out_buf += data
            self.recv_buf = self.recv_buf[length:]

        return (out_buf, False)
Ejemplo n.º 3
0
def parse_name(data, offset):
    p = offset
    labels = []
    # l为data数据流中的偏置offset的label的长度
    l = common.ord(data[p])
    while l > 0:
        # 为什么是128+64, 因为未经压缩的合法name长度在63内,因此
        # rfc定义0x11000000B为压缩指针的标志
        if (l & (128 + 64)) == (128 + 64):
            # 取出指针的位置
            pointer = struct.unpack('!H', data[p:p + 2])[0]
            # 指针取两个字节减去高两位(用于标志0x11000000B那两位)
            pointer &= 0x3FFF
            # 递归处理指针,找到上文的name记录,参考rfc1035
            r = parse_name(data, pointer)
            # 读取指针所指的数据,追加到labels中
            labels.append(r[1])
            # 指针偏移自增两个字节(跳过0x11000000B所在的两个字节的data数据段)
            p += 2
            # 递归返回
            return p - offset, b'.'.join(labels)
        # 若不是指针压缩,直接追加dns报文
        else:
            # 追加labels
            labels.append(data[p + 1:p + 1 + l])
            # 指针自增(1+len)
            p += 1 + l
        l = common.ord(data[p])
    # 递归返回
    return p - offset + 1, b'.'.join(labels)
Ejemplo n.º 4
0
def parse_name(data, offset):
    """
    提取NAME字段
    :param data:        接收到的数据
    :param offset:      name字段的偏移量
    :return:            (l, r) l name字段的长度,r 解析出的数据
    """
    p = offset
    labels = []
    l = common.ord(data[p])
    while l > 0:
        if (l & (128 + 64)) == (128 + 64):
            # pointer
            pointer = struct.unpack('!H', data[p:p + 2])[0]
            pointer &= 0x3FFF
            r = parse_name(data, pointer)
            labels.append(r[1])
            p += 2
            # pointer is the end
            return p - offset, b'.'.join(labels)
        else:
            labels.append(data[p + 1:p + 1 + l])
            p += 1 + l
        l = common.ord(data[p])
    return p - offset + 1, b'.'.join(labels)
Ejemplo n.º 5
0
 def get_head_size(self, buf, def_value):
     if len(buf) < 2:
         return def_value
     if ord(buf[0]) == 1:
         return 7
     if ord(buf[0]) == 4:
         return 19
     if ord(buf[0]) == 3:
         return 4 + ord(buf[1])
     return def_value
Ejemplo n.º 6
0
 def server_udp_post_decrypt(self, buf):
     if buf and ((ord(buf[0]) & 0x10) == 0x10):
         if len(buf) <= 11:
             return b''
         sha1data = hmac.new(self.server_info.recv_iv + self.server_info.key, buf[:-10], hashlib.sha1).digest()[:10]
         if sha1data != buf[-10:]:
             return b''
         return to_bytes(chr(ord(buf[0]) & 0xEF)) + buf[1:-10]
     else:
         return buf
Ejemplo n.º 7
0
 def server_udp_post_decrypt(self, buf):
     if buf and ((ord(buf[0]) & 0x10) == 0x10):
         if len(buf) <= 11:
             return b'E'
         sha1data = hmac.new(self.server_info.recv_iv + self.server_info.key, buf[:-10], hashlib.sha1).digest()[:10]
         if sha1data != buf[-10:]:
             logging.error('server_udp_post_decrypt data uncorrect auth HMAC-SHA1')
             return b'E'
         return to_bytes(chr(ord(buf[0]) & 0xEF)) + buf[1:-10]
     else:
         return buf
Ejemplo n.º 8
0
 def _get_head_size(self, buf, def_value):
     if len(buf) < 2:
         return def_value
     head_type = common.ord(buf[0]) & 0xF
     if head_type == 1:
         return 7
     if head_type == 4:
         return 19
     if head_type == 3:
         return 4 + common.ord(buf[1])
     return def_value
Ejemplo n.º 9
0
 def get_head_size(self, buf, def_value):
     if len(buf) < 2:
         return def_value
     head_type = ord(buf[0]) & 0x7
     if head_type == 1:
         return 7
     if head_type == 4:
         return 19
     if head_type == 3:
         return 4 + ord(buf[1])
     return def_value
Ejemplo n.º 10
0
def test_nonce_increment():
    buf = create_string_buffer(12)
    print("".join("%02x" % ord(b) for b in buf))
    nonce_increment(buf, 12)
    nonce_increment(buf, 12)
    nonce_increment(buf, 12)
    nonce_increment(buf, 12)
    print("".join("%02x" % ord(b) for b in buf))
    for i in range(256):
        nonce_increment(buf, 12)
        print("".join("%02x" % ord(b) for b in buf))
Ejemplo n.º 11
0
    def client_decode(self, buf):
        if self.handshake_status == -1:
            return (buf, False)

        if self.handshake_status == 8:
            ret = b''
            self.recv_buffer += buf
            while len(self.recv_buffer) > 5:
                if ord(self.recv_buffer[0]) != 0x17:
                    logging.info("data = %s" % (binascii.hexlify(self.recv_buffer)))
                    raise Exception('server_decode appdata error')
                size = struct.unpack('>H', self.recv_buffer[3:5])[0]
                if len(self.recv_buffer) < size + 5:
                    break
                buf = self.recv_buffer[5:size+5]
                ret += buf
                self.recv_buffer = self.recv_buffer[size+5:]
            return (ret, False)

        if len(buf) < 11 + 32 + 1 + 32:
            raise Exception('client_decode data error')
        verify = buf[11:33]
        if hmac.new(self.server_info.key + self.server_info.data.client_id, verify, hashlib.sha1).digest()[:10] != buf[33:43]:
            raise Exception('client_decode data error')
        return (b'', True)
Ejemplo n.º 12
0
 def pack_data(self, buf):
     rnd_data = os.urandom(common.ord(os.urandom(1)[0]) % 16)
     data = common.chr(len(rnd_data) + 1) + rnd_data + buf
     data = struct.pack('>H', len(data) + 6) + data
     adler32 = zlib.adler32(data) & 0xFFFFFFFF
     data += struct.pack('<I', adler32)
     return data
Ejemplo n.º 13
0
    def client_post_decrypt(self, buf):
        if self.raw_trans:
            return buf
        self.recv_buf += buf
        out_buf = b''
        while len(self.recv_buf) > 2:
            length = struct.unpack('>H', self.recv_buf[:2])[0]
            if length >= 8192 or length < 7:
                self.raw_trans = True
                self.recv_buf = b''
                raise Exception('client_post_decrypt data error')
            if length > len(self.recv_buf):
                break

            if struct.pack('<I', zlib.adler32(self.recv_buf[:length - 4]) & 0xFFFFFFFF) != self.recv_buf[length - 4:length]:
                self.raw_trans = True
                self.recv_buf = b''
                raise Exception('client_post_decrypt data uncorrect checksum')

            pos = common.ord(self.recv_buf[2])
            if pos < 255:
                pos += 2
            else:
                pos = struct.unpack('>H', self.recv_buf[3:5])[0] + 2
            out_buf += self.recv_buf[pos:length - 4]
            self.recv_buf = self.recv_buf[length:]

        if out_buf:
            self.decrypt_packet_num += 1
        return out_buf
Ejemplo n.º 14
0
    def client_post_decrypt(self, buf):
        if self.raw_trans:
            return buf
        self.recv_buf += buf
        out_buf = b''
        while len(self.recv_buf) > 4:
            mac_key = self.user_key + struct.pack('<I', self.recv_id)
            mac = hmac.new(mac_key, self.recv_buf[:2], self.hashfunc).digest()[:2]
            if mac != self.recv_buf[2:4]:
                raise Exception('client_post_decrypt data uncorrect mac')
            length = struct.unpack('<H', self.recv_buf[:2])[0]
            if length >= 8192 or length < 7:
                self.raw_trans = True
                self.recv_buf = b''
                raise Exception('client_post_decrypt data error')
            if length > len(self.recv_buf):
                break

            if hmac.new(mac_key, self.recv_buf[:length - 4], self.hashfunc).digest()[:4] != self.recv_buf[length - 4:length]:
                self.raw_trans = True
                self.recv_buf = b''
                raise Exception('client_post_decrypt data uncorrect checksum')

            self.recv_id = (self.recv_id + 1) & 0xFFFFFFFF
            pos = common.ord(self.recv_buf[4])
            if pos < 255:
                pos += 4
            else:
                pos = struct.unpack('<H', self.recv_buf[5:7])[0] + 4
            out_buf += self.recv_buf[pos:length - 4]
            self.recv_buf = self.recv_buf[length:]

        return out_buf
Ejemplo n.º 15
0
    def server_post_decrypt(self, buf):
        if self.raw_trans:
            return (buf, False)
        self.recv_buf += buf
        out_buf = b''
        while len(self.recv_buf) > 2:
            length = struct.unpack('>H', self.recv_buf[:2])[0]
            if length >= 8192 or length < 7:
                self.raw_trans = True
                self.recv_buf = b''
                if self.decrypt_packet_num == 0:
                    return (b'E', False)
                else:
                    raise Exception('server_post_decrype data error')
            if length > len(self.recv_buf):
                break

            if (binascii.crc32(self.recv_buf[:length]) & 0xffffffff) != 0xffffffff:
                self.raw_trans = True
                self.recv_buf = b''
                if self.decrypt_packet_num == 0:
                    return (b'E', False)
                else:
                    raise Exception('server_post_decrype data uncorrect CRC32')

            pos = common.ord(self.recv_buf[2]) + 2
            out_buf += self.recv_buf[pos:length - 4]
            self.recv_buf = self.recv_buf[length:]

        if out_buf:
            self.decrypt_packet_num += 1
        return (out_buf, False)
Ejemplo n.º 16
0
    def server_post_decrypt(self, buf):
        if self.raw_trans:
            return buf
        self.recv_buf += buf
        out_buf = b''
        while len(self.recv_buf) > 2:
            length = struct.unpack('>H', self.recv_buf[:2])[0]
            if length >= 8192:
                self.raw_trans = True
                self.recv_buf = b''
                if self.decrypt_packet_num == 0:
                    logging.info('auth_simple: over size')
                    return b'E'
                else:
                    raise Exception('server_post_decrype data error')
            if length > len(self.recv_buf):
                break

            if (binascii.crc32(self.recv_buf[:length]) & 0xffffffff) != 0xffffffff:
                logging.info('auth_simple: crc32 error, data %s' % (binascii.hexlify(self.recv_buf[:length]),))
                self.raw_trans = True
                self.recv_buf = b''
                if self.decrypt_packet_num == 0:
                    return b'E'
                else:
                    raise Exception('server_post_decrype data uncorrect CRC32')

            pos = common.ord(self.recv_buf[2]) + 2
            out_buf += self.recv_buf[pos:length - 4]
            if not self.has_recv_header:
                if len(out_buf) < 12:
                    self.raw_trans = True
                    self.recv_buf = b''
                    logging.info('auth_simple: too short')
                    return b'E'
                utc_time = struct.unpack('<I', out_buf[:4])[0]
                client_id = struct.unpack('<I', out_buf[4:8])[0]
                connection_id = struct.unpack('<I', out_buf[8:12])[0]
                time_dif = common.int32((int(time.time()) & 0xffffffff) - utc_time)
                if time_dif < 60 * -3 or time_dif > 60 * 3 or common.int32(utc_time - self.server_info.data.startup_time) < 0:
                    self.raw_trans = True
                    self.recv_buf = b''
                    logging.info('auth_simple: wrong timestamp, time_dif %d, data %s' % (time_dif, binascii.hexlify(out_buf),))
                    return b'E'
                elif self.server_info.data.insert(client_id, connection_id):
                    self.has_recv_header = True
                    out_buf = out_buf[12:]
                    self.client_id = client_id
                    self.connection_id = connection_id
                else:
                    self.raw_trans = True
                    self.recv_buf = b''
                    logging.info('auth_simple: auth fail, data %s' % (binascii.hexlify(out_buf),))
                    return b'E'
            self.recv_buf = self.recv_buf[length:]

        if out_buf:
            self.server_info.data.update(self.client_id, self.connection_id)
            self.decrypt_packet_num += 1
        return out_buf
Ejemplo n.º 17
0
    def _handle_stage_addr(self, data):
        try:
            if self._is_local:
                cmd = common.ord(data[1])
                if cmd == CMD_UDP_ASSOCIATE:
                    logging.debug('UDP associate')
                    if self._local_sock.family == socket.AF_INET6:
                        header = b'\x05\x00\x00\x04'
                    else:
                        header = b'\x05\x00\x00\x01'
                    addr, port = self._local_sock.getsockname()[:2]
                    addr_to_send = socket.inet_pton(self._local_sock.family,
                                                    addr)
                    port_to_send = struct.pack('>H', port)
                    self._write_to_sock(header + addr_to_send + port_to_send,
                                        self._local_sock)
                    self._stage = STAGE_UDP_ASSOC
                    # just wait for the client to disconnect
                    return
                elif cmd == CMD_CONNECT:
                    # just trim VER CMD RSV
                    data = data[3:]
                else:
                    logging.error('unknown command %d', cmd)
                    self.destroy()
                    return
            header_result = parse_header(data)
            if header_result is None:
                raise Exception('can not parse header')
            addrtype, remote_addr, remote_port, header_length = header_result
            logging.info('connecting %s:%d' % (common.to_str(remote_addr),
                                               remote_port))
            self._remote_address = (remote_addr, remote_port)
            # pause reading
            self._update_stream(STREAM_UP, WAIT_STATUS_WRITING)
            self._stage = STAGE_DNS
            if self._is_local:
                # forward address to remote
                self._write_to_sock((b'\x05\x00\x00\x01'
                                     b'\x00\x00\x00\x00\x10\x10'),
                                    self._local_sock)
                data_to_send = self._encryptor.encrypt(data)
                self._data_to_write_to_remote.append(data_to_send)
                # notice here may go into _handle_dns_resolved directly

                # Here uses the resolve in dns_server, dns_server could perform like a portable module
                self._dns_resolver.resolve(self._chosen_server[0],
                                           self._handle_dns_resolved)
            else:
                if len(data) > header_length:
                    self._data_to_write_to_remote.append(data[header_length:])
                # notice here may go into _handle_dns_resolved directly
                self._dns_resolver.resolve(remote_addr,
                                           self._handle_dns_resolved)
        except Exception as e:
            logging.error(e)
            if self._config['verbose']:
                traceback.print_exc()
            # TODO use logging when debug completed
            self.destroy()
Ejemplo n.º 18
0
    def _handle_server(self):
        server = self._server_socket
        data, r_addr = server.recvfrom(BUF_SIZE)
        ogn_data = data
        if not data:
            logging.debug('UDP handle_server: data is empty')
        if self._stat_callback:
            self._stat_callback(self._listen_port, len(data))
        uid = None
        if self._is_local:
            frag = common.ord(data[2])
            if frag != 0:
                logging.warn('drop a message since frag is not 0')
                return
            else:
                data = data[3:]
        else:
            ref_iv = [0]
            data = encrypt.encrypt_all_iv(self._protocol.obfs.server_info.key, self._method, 0, data, ref_iv)
            # decrypt data
            if not data:
                logging.debug('UDP handle_server: data is empty after decrypt')
                return
            self._protocol.obfs.server_info.recv_iv = ref_iv[0]
            data, uid = self._protocol.server_udp_post_decrypt(data)

        #logging.info("UDP data %s" % (binascii.hexlify(data),))
        if not self._is_local:
            data = pre_parse_header(data)
            if data is None:
                return

        try:
            header_result = parse_header(data)
        except:
            self._handel_protocol_error(r_addr, ogn_data)
            return

        if header_result is None:
            self._handel_protocol_error(r_addr, ogn_data)
            return
        connecttype, addrtype, dest_addr, dest_port, header_length = header_result

        if self._is_local:
            addrtype = 3
            server_addr, server_port = self._get_a_server()
        else:
            server_addr, server_port = dest_addr, dest_port

        if (addrtype & 7) == 3:
            af = common.is_ip(server_addr)
            if af == False:
                handler = common.UDPAsyncDNSHandler((data, r_addr, uid, header_length))
                handler.resolve(self._dns_resolver, (server_addr, server_port), self._handle_server_dns_resolved)
            else:
                self._handle_server_dns_resolved("", (server_addr, server_port), server_addr, (data, r_addr, uid, header_length))
        else:
            self._handle_server_dns_resolved("", (server_addr, server_port), server_addr, (data, r_addr, uid, header_length))
Ejemplo n.º 19
0
 def pack_data(self, buf):
     if len(buf) == 0:
         return b''
     rnd_data = os.urandom(common.ord(os.urandom(1)[0]) % 16)
     data = common.chr(len(rnd_data) + 1) + rnd_data + buf
     data = struct.pack('>H', len(data) + 6) + data
     crc = (0xffffffff - binascii.crc32(data)) & 0xffffffff
     data += struct.pack('<I', crc)
     return data
Ejemplo n.º 20
0
def parse_name(data, offset):
	p = offset
	labels = []
	l = common.ord(data[p])
	while l > 0:
		if (l & (128 + 64)) == (128 + 64):
			# pointer
			pointer = struct.unpack('!H', data[p:p + 2])[0]
			pointer &= 0x3FFF
			r = parse_name(data, pointer)
			labels.append(r[1])
			p += 2
			# pointer is the end
			return p - offset, b'.'.join(labels)
		else:
			labels.append(data[p + 1:p + 1 + l])
			p += 1 + l
		l = common.ord(data[p])
	return p - offset + 1, b'.'.join(labels)
Ejemplo n.º 21
0
    def rnd_data(self, buf_size):
        if buf_size > 1300:
            return b'\x01'

        if buf_size > 400:
            rnd_data = os.urandom(common.ord(os.urandom(1)[0]) % 128)
            return common.chr(len(rnd_data) + 1) + rnd_data

        rnd_data = os.urandom(struct.unpack('>H', os.urandom(2))[0] % 1024)
        return common.chr(255) + struct.pack('>H', len(rnd_data) + 3) + rnd_data
Ejemplo n.º 22
0
 def pack_auth_data(self, buf):
     if len(buf) == 0:
         return b''
     rnd_data = os.urandom(common.ord(os.urandom(1)[0]) % 128)
     data = common.chr(len(rnd_data) + 1) + rnd_data + buf
     data = struct.pack('>H', len(data) + 16) + data
     crc = binascii.crc32(self.server_info.key) & 0xFFFFFFFF
     data = struct.pack('<I', crc) + data
     data += hmac.new(self.server_info.iv + self.server_info.key, data, hashlib.sha1).digest()[:10]
     return data
Ejemplo n.º 23
0
def get_table(key):
    m = hashlib.md5()
    m.update(key)
    s = m.digest()
    a, b = struct.unpack('<QQ', s)
    table = maketrans(b'', b'')
    table = [table[i: i + 1] for i in range(len(table))]
    for i in range(1, 1024):
        table.sort(key=lambda x: int(a % (ord(x) + i)))
    return table
Ejemplo n.º 24
0
 def client_pre_encrypt(self, buf):
     ret = b''
     if not self.has_sent_header:
         datalen = max(len(buf), common.ord(os.urandom(1)[0]) % 32 + 4)
         ret += self.pack_data(self.auth_data() + buf[:datalen])
         buf = buf[datalen:]
         self.has_sent_header = True
     while len(buf) > self.unit_len:
         ret += self.pack_data(buf[:self.unit_len])
         buf = buf[self.unit_len:]
     ret += self.pack_data(buf)
     return ret
Ejemplo n.º 25
0
    def rnd_data(self, buf_size):
        if buf_size > 1200:
            return b'\x01'

        if buf_size > 400:
            rnd_data = os.urandom(common.ord(os.urandom(1)[0]) % 256)
        else:
            rnd_data = os.urandom(struct.unpack('>H', os.urandom(2))[0] % 512)

        if len(rnd_data) < 128:
            return common.chr(len(rnd_data) + 1) + rnd_data
        else:
            return common.chr(255) + struct.pack('>H', len(rnd_data) + 3) + rnd_data
Ejemplo n.º 26
0
 def _check_auth_method(self, data):
     # VER, NMETHODS, and at least 1 METHODS
     if len(data) < 3:
         logging.warning('method selection header too short')
         raise BadSocksHeader
     socks_version = common.ord(data[0])
     nmethods = common.ord(data[1])
     if socks_version != 5:
         logging.warning('unsupported SOCKS protocol version ' +
                         str(socks_version))
         raise BadSocksHeader
     if nmethods < 1 or len(data) != nmethods + 2:
         logging.warning('NMETHODS and number of METHODS mismatch')
         raise BadSocksHeader
     noauth_exist = False
     for method in data[2:]:
         if common.ord(method) == METHOD_NOAUTH:
             noauth_exist = True
             break
     if not noauth_exist:
         logging.warning('none of SOCKS METHOD\'s '
                         'requested by client is supported')
         raise NoAcceptableMethods
Ejemplo n.º 27
0
 def rnd_data_len(self, buf_size, full_buf_size):
     if full_buf_size >= self.server_info.buffer_size:
         return 0
     tcp_mss = self.server_info.tcp_mss
     rev_len = tcp_mss - buf_size - 9
     if rev_len == 0:
         return 0
     if rev_len < 0:
         if rev_len > -tcp_mss:
             return self.trapezoid_random_int(rev_len + tcp_mss, -0.3)
         return common.ord(os.urandom(1)[0]) % 32
     if buf_size > 900:
         return struct.unpack('>H', os.urandom(2))[0] % rev_len
     return self.trapezoid_random_int(rev_len, -0.3)
Ejemplo n.º 28
0
 def client_encode(self, buf):
     if self.raw_trans_sent:
         return buf
     self.send_buffer += buf
     if not self.has_sent_header:
         self.has_sent_header = True
         data = os.urandom(common.ord(os.urandom(1)[0]) % 96 + 4)
         crc = (0xffffffff - binascii.crc32(data)) & 0xffffffff
         return data + struct.pack('<I', crc)
     if self.raw_trans_recv:
         ret = self.send_buffer
         self.send_buffer = b''
         self.raw_trans_sent = True
         return ret
     return b''
Ejemplo n.º 29
0
def parse_name(data, offset):

    # obtain the first byte pointed by offset
    # it is either a length octet followed by a label or another pointer or a termination
    # common.ord() converts it from ASCII char to number
    p = offset
    labels = []
    l = common.ord(data[p])

    # while not a termination
    while l > 0:
        # if the first byte is a pointer
        # dig into it, retrieve the innermost labels and append it as tail
        # then return directly
        # this is because pointer, if exists, is at the end of label sequence
        if (l & (128 + 64)) == (128 + 64):
            # pointer
            pointer = struct.unpack('!H', data[p:p + 2])[0]
            pointer &= 0x3FFF
            r = parse_name(data, pointer)
            labels.append(r[1])
            p += 2
            # pointer is the end
            return p - offset, b'.'.join(labels)

        # if the first byte is a length octet
        # append label according to length
        # then jump to the beginning of the next label
        else:
            labels.append(data[p + 1:p + 1 + l])
            p += 1 + l

        l = common.ord(data[p])

    # when termination is found, return labels and total length
    return p - offset + 1, b'.'.join(labels)
Ejemplo n.º 30
0
def nonce_increment(nonce, nlen):
    """
    Increase nonce by 1 in little endian
    From libsodium sodium_increment():
    for (; i < nlen; i++) {
        c += (uint_fast16_t) n[i];
        n[i] = (unsigned char) c;
        c >>= 8;
    }
    :param nonce: string_buffer nonce
    :param nlen: nonce length
    :return: nonce plus by 1
    """
    c = 1
    i = 0
    # n = create_string_buffer(nlen)
    while i < nlen:
        c += ord(nonce[i])
        nonce[i] = chr(c & 0xFF)
        c >>= 8
        i += 1
    return  # n.raw
Ejemplo n.º 31
0
    def server_decode(self, buf):
        if self.handshake_status == -1:
            return (buf, True, False)

        if self.handshake_status == 8:
            ret = b''
            self.recv_buffer += buf
            while len(self.recv_buffer) > 5:
                if ord(self.recv_buffer[0]) != 0x17 or ord(
                        self.recv_buffer[1]) != 0x3 or ord(
                            self.recv_buffer[2]) != 0x3:
                    logging.info("data = %s" %
                                 (binascii.hexlify(self.recv_buffer)))
                    raise Exception('server_decode appdata error')
                size = struct.unpack('>H', self.recv_buffer[3:5])[0]
                if len(self.recv_buffer) < size + 5:
                    break
                ret += self.recv_buffer[5:size + 5]
                self.recv_buffer = self.recv_buffer[size + 5:]
            return (ret, True, False)

        if self.handshake_status == 3:
            verify = buf
            verify_len = 43 - 10
            if len(buf) < 43:
                raise Exception('server_decode data error')
            if not match_begin(buf, b"\x14" + self.tls_version +
                               b"\x00\x01\x01"):  #ChangeCipherSpec
                raise Exception('server_decode data error')
            buf = buf[6:]
            if not match_begin(
                    buf, b"\x16" + self.tls_version + b"\x00\x20"):  #Finished
                raise Exception('server_decode data error')
            if hmac.new(self.server_info.key + self.client_id,
                        verify[:verify_len], hashlib.sha1).digest(
                        )[:10] != verify[verify_len:verify_len + 10]:
                raise Exception('server_decode data error')
            if len(buf) < 37:
                raise Exception('server_decode data error')
            self.recv_buffer = buf[37:]
            self.handshake_status = 8
            return self.server_decode(b'')

        #raise Exception("handshake data = %s" % (binascii.hexlify(buf)))
        self.handshake_status = 2
        ogn_buf = buf
        if not match_begin(buf, b'\x16\x03\x01'):
            return self.decode_error_return(ogn_buf)
        buf = buf[3:]
        if struct.unpack('>H', buf[:2])[0] != len(buf) - 2:
            logging.info("tls_auth wrong tls head size")
            return self.decode_error_return(ogn_buf)
        buf = buf[2:]
        if not match_begin(buf, b'\x01\x00'):  #client hello
            logging.info("tls_auth not client hello message")
            return self.decode_error_return(ogn_buf)
        buf = buf[2:]
        if struct.unpack('>H', buf[:2])[0] != len(buf) - 2:
            logging.info("tls_auth wrong message size")
            return self.decode_error_return(ogn_buf)
        buf = buf[2:]
        if not match_begin(buf, self.tls_version):
            logging.info("tls_auth wrong tls version")
            return self.decode_error_return(ogn_buf)
        buf = buf[2:]
        verifyid = buf[:32]
        buf = buf[32:]
        sessionid_len = ord(buf[0])
        if sessionid_len < 32:
            logging.info("tls_auth wrong sessionid_len")
            return self.decode_error_return(ogn_buf)
        sessionid = buf[1:sessionid_len + 1]
        buf = buf[sessionid_len + 1:]
        self.client_id = sessionid
        sha1 = hmac.new(self.server_info.key + sessionid, verifyid[:22],
                        hashlib.sha1).digest()[:10]
        utc_time = struct.unpack('>I', verifyid[:4])[0]
        time_dif = common.int32((int(time.time()) & 0xffffffff) - utc_time)
        if self.server_info.obfs_param:
            try:
                self.max_time_dif = int(self.server_info.obfs_param)
            except:
                pass
        if self.max_time_dif > 0 and (time_dif < -self.max_time_dif or time_dif > self.max_time_dif \
                or common.int32(utc_time - self.server_info.data.startup_time) < -self.max_time_dif / 2):
            logging.info("tls_auth wrong time")
            return self.decode_error_return(ogn_buf)
        if sha1 != verifyid[22:]:
            logging.info("tls_auth wrong sha1")
            return self.decode_error_return(ogn_buf)
        if self.server_info.data.client_data.get(verifyid[:22]):
            logging.info("replay attack detect, id = %s" %
                         (binascii.hexlify(verifyid)))
            return self.decode_error_return(ogn_buf)
        self.server_info.data.client_data.sweep()
        self.server_info.data.client_data[verifyid[:22]] = sessionid
        # (buffer_to_recv, is_need_decrypt, is_need_to_encode_and_send_back)

        buf = buf[48:]

        host_name = ''
        for index in range(len(buf)):
            if index + 4 < len(buf):
                if buf[index:index + 4] == b"\x00\x17\x00\x00":
                    if buf[:index] != '':
                        host_name = buf[:index]

        return (b'', False, True, host_name)
Ejemplo n.º 32
0
    def _handle_server(self):
        server = self._server_socket
        data, r_addr = server.recvfrom(BUF_SIZE)
        key = None
        iv = None
        if not data:
            logging.debug('UDP handle_server: data is empty')
        if self._stat_callback:
            self._stat_callback(self._listen_port, len(data))
        if self._is_local:
            # +----+------+------+----------+----------+----------+
            # |RSV | FRAG | ATYP | DST.ADDR | DST.PORT |   DATA   |
            # +----+------+------+----------+----------+----------+
            #      ~~~~~~~~
            frag = common.ord(data[2])  #shadowsocks中FRAG就使用0
            if frag != 0:
                logging.warn('UDP drop a message since frag is not 0')
                return
            else:
                # +------+----------+----------+----------+
                # | ATYP | DST.ADDR | DST.PORT |   DATA   |
                # +------+----------+----------+----------+
                data = data[3:]
        else:
            data, key, iv = encrypt.dencrypt_all(self._password, self._method,
                                                 data)
            # decrypt data
            if not data:
                logging.debug('UDP handle_server: data is empty after decrypt')
                return
        header_result = parse_header(data)
        if header_result is None:
            return

        # +------+----------+----------+----------+
        # | ATYP | DST.ADDR | DST.PORT |   DATA   |
        # +------+----------+----------+----------+
        # .                            .
        # |<----- header_length ------>|
        addrtype, dest_addr, dest_port, header_length = header_result

        # 如果是sslocal,则需要查找的是ssserver的地址及端口
        # 如果是ssserver,则需要获取的是目标服务器的地址及端口
        if self._is_local:
            # ssserver 地址和端口
            server_addr, server_port = self._get_a_server()
        else:
            # 「目标服务器」地址和端口
            server_addr, server_port = dest_addr, dest_port
            # spec https://shadowsocks.org/en/spec/one-time-auth.html
            self._ota_enable_session = addrtype & ADDRTYPE_AUTH
            if self._ota_enable and not self._ota_enable_session:
                logging.warn('client one time auth is required')
                return
            if self._ota_enable_session:
                if len(data) < header_length + ONETIMEAUTH_BYTES:
                    logging.warn('UDP one time auth header is too short')
                    return
                _hash = data[-ONETIMEAUTH_BYTES:]
                data = data[:-ONETIMEAUTH_BYTES]
                _key = iv + key
                if onetimeauth_verify(_hash, data, _key) is False:
                    logging.warn('UDP one time auth fail')
                    return
        # 从缓存中取 server_addr 解析后的地址
        addrs = self._dns_cache.get(server_addr, None)
        # 如果找不到,则解析 server_addr 的地址并存入缓存
        if addrs is None:
            # 注意,getaddrinfo 函数是阻塞的
            addrs = socket.getaddrinfo(server_addr, server_port, 0,
                                       socket.SOCK_DGRAM, socket.SOL_UDP)
            if not addrs:
                # drop
                return
            else:
                self._dns_cache[server_addr] = addrs

        af, socktype, proto, canonname, sa = addrs[0]

        # 根据地址、端口、af 生成一个 key,这个 key 与 UDP 套接字一一对应
        key = client_key(r_addr, af)
        client = self._cache.get(key, None)
        if not client:
            # TODO async getaddrinfo
            if self._forbidden_iplist:
                if common.to_str(sa[0]) in self._forbidden_iplist:
                    logging.debug('IP %s is in forbidden list, drop' %
                                  common.to_str(sa[0]))
                    # drop
                    return
            # 创建 UDP 套接字
            client = socket.socket(af, socktype, proto)
            client.setblocking(False)
            self._cache[key] = client
            # 将套接字与其地址关联起来,`_handle_client` 会用到
            self._client_fd_to_server_addr[client.fileno()] = r_addr
            # 将套接字关联的文件描述符加入 `self._sockets` 中,`handle_event` 会用到
            self._sockets.add(client.fileno())
            # 将套接字加入事件循环,
            self._eventloop.add(client, eventloop.POLL_IN, self)
        # 如果是 sslocal,那么需要将数据加密
        if self._is_local:
            key, iv, m = encrypt.gen_key_iv(self._password, self._method)
            # spec https://shadowsocks.org/en/spec/one-time-auth.html
            if self._ota_enable_session:
                data = self._ota_chunk_data_gen(key, iv, data)
            data = encrypt.encrypt_all_m(key, iv, m, self._method, data)
            if not data:
                return
        # 如果是 ssserver,在将接收到的数据发送给目标服务器之前,
        # 需要解密并且去掉头部,解密在上面已经完成了
        else:
            # +------+----------+----------+----------+
            # | ATYP | DST.ADDR | DST.PORT |   DATA   |
            # +------+----------+----------+----------+
            #
            data = data[header_length:]
        if not data:
            return
        # - 对于 sslocal 而言,将加密后的数据发送给 ssserver,数据格式如下:
        #
        #    +------+----------+----------+----------+
        #    | ATYP | DST.ADDR | DST.PORT |   DATA   |
        #    +------+----------+----------+----------+
        #
        # - 对于 ssserver 而言,将解密后的数据发送给目标服务器(只剩 `DATA` 部分了)
        try:
            client.sendto(data, (server_addr, server_port))
        except IOError as e:
            err = eventloop.errno_from_exception(e)
            if err in (errno.EINPROGRESS, errno.EAGAIN):
                pass
            else:
                shell.print_exception(e)
Ejemplo n.º 33
0
 def server_encode(self, buf):
     if self.has_sent_header:
         return buf
     self.has_sent_header = True
     return os.urandom(common.ord(os.urandom(1)[0]) % 96 + 4)
Ejemplo n.º 34
0
    def server_decode(self, buf):
        if self.deobfs_stage == -1:
            return (buf, True, False)

        if self.deobfs_stage == 1:
            ret = b''
            self.recv_buffer += buf
            while len(self.recv_buffer) > 5:
                if ord(self.recv_buffer[0]) != 0x17 or ord(
                        self.recv_buffer[1]) != 0x3 or ord(
                            self.recv_buffer[2]) != 0x3:
                    logging.info("data = %s" %
                                 (binascii.hexlify(self.recv_buffer)))
                    raise Exception('server_decode appdata error')
                size = struct.unpack('>H', self.recv_buffer[3:5])[0]
                if len(self.recv_buffer) < size + 5:
                    break
                ret += self.recv_buffer[5:size + 5]
                self.recv_buffer = self.recv_buffer[size + 5:]
            return (ret, True, False)

        #raise Exception("handshake data = %s" % (binascii.hexlify(buf)))

        self.recv_buffer += buf
        buf = self.recv_buffer
        ogn_buf = buf
        if len(buf) < 5:
            return (b'', False, False)
        if not match_begin(buf, b'\x16\x03\x01'):
            return self.decode_error_return(ogn_buf)
        buf = buf[3:]
        header_len = struct.unpack('>H', buf[:2])[0]
        if header_len > len(buf) - 2:
            return (b'', False, False)

        self.recv_buffer = self.recv_buffer[header_len + 5:]
        self.deobfs_stage = 1
        buf = buf[2:header_len + 2]
        if not match_begin(buf, b'\x01\x00'):  #client hello
            logging.info("tls_auth not client hello message")
            return self.decode_error_return(ogn_buf)
        buf = buf[2:]
        if struct.unpack('>H', buf[:2])[0] != len(buf) - 2:
            logging.info("tls_auth wrong message size")
            return self.decode_error_return(ogn_buf)
        buf = buf[2:]
        if not match_begin(buf, self.tls_version):
            logging.info("tls_auth wrong tls version")
            return self.decode_error_return(ogn_buf)
        buf = buf[2:]
        verifyid = buf[:32]
        buf = buf[32:]
        sessionid_len = ord(buf[0])
        if sessionid_len < 32:
            logging.info("tls_auth wrong sessionid_len")
            return self.decode_error_return(ogn_buf)
        sessionid = buf[1:sessionid_len + 1]
        buf = buf[sessionid_len + 1:]
        self.client_id = sessionid
        utc_time = struct.unpack('>I', verifyid[:4])[0]
        time_dif = common.int32((int(time.time()) & 0xffffffff) - utc_time)
        if self.server_info.obfs_param:
            try:
                self.max_time_dif = int(self.server_info.obfs_param)
            except:
                pass
        if self.max_time_dif > 0 and (time_dif < -self.max_time_dif or time_dif > self.max_time_dif \
                or common.int32(utc_time - self.server_info.data.startup_time) < -self.max_time_dif / 2):
            logging.info("tls_auth wrong time")
            return self.decode_error_return(ogn_buf)
        if self.server_info.data.client_data.get(verifyid[:22]):
            logging.info("replay attack detect, id = %s" %
                         (binascii.hexlify(verifyid)))
            return self.decode_error_return(ogn_buf)
        self.server_info.data.client_data.sweep()
        self.server_info.data.client_data[verifyid[:22]] = sessionid
        # (buffer_to_recv, is_need_decrypt, is_need_to_encode_and_send_back)

        buf = buf[62:]
        if not match_begin(buf, b'\x00\x23'):
            logging.info("ext header error")
            return self.decode_error_return(ogn_buf)

        buf = buf[2:]
        ext_length = struct.unpack('>H', buf[:2])[0]
        buf = buf[2:]
        ret = buf[:ext_length]
        if len(self.recv_buffer) > 0:
            ret += self.server_decode(b'')[0]
        buf = buf[ext_length:]

        host_name = b''
        buf = buf[7:]
        host_name_len = struct.unpack('>H', buf[:2])[0]
        buf = buf[2:]
        hostname = buf[:host_name_len]

        host_name = common.to_str(hostname)

        return (ret, True, False, host_name)
Ejemplo n.º 35
0
 def pack_auth_data(self, buf):
     data = chr(ord(buf[0]) | 0x10) + buf[1:]
     data += hmac.new(self.server_info.iv + self.server_info.key, data, hashlib.sha1).digest()[:10]
     return data
Ejemplo n.º 36
0
    def _handle_server(self):
        server = self._server_socket
        data, r_addr = server.recvfrom(BUF_SIZE)
        ogn_data = data
        if not data:
            logging.debug('UDP handle_server: data is empty')
        if self._stat_callback:
            self._stat_callback(self._listen_port, len(data))
        uid = None
        if self._is_local:
            frag = common.ord(data[2])
            if frag != 0:
                logging.warn('Drop a message since frag is not 0')
                return
            else:
                data = data[3:]
        else:
            ref_iv = [0]
            data = encrypt.encrypt_all_iv(self._protocol.obfs.server_info.key,
                                          self._method, 0, data, ref_iv)
            # decrypt data
            if not data:
                logging.debug('UDP handle_server: data is empty after decrypt')
                return
            self._protocol.obfs.server_info.recv_iv = ref_iv[0]
            data, uid = self._protocol.server_udp_post_decrypt(data)

        #logging.info("UDP data %s" % (binascii.hexlify(data),))
        if not self._is_local:
            data = pre_parse_header(data)
            if data is None:
                return

        try:
            header_result = parse_header(data)
        except:
            self._handel_protocol_error(r_addr, ogn_data)
            return

        if header_result is None:
            self._handel_protocol_error(r_addr, ogn_data)
            return
        connecttype, addrtype, dest_addr, dest_port, header_length = header_result

        if self._is_local:
            addrtype = 3
            server_addr, server_port = self._get_a_server()
        else:
            server_addr, server_port = dest_addr, dest_port

        if (addrtype & 7) == 3:
            af = common.is_ip(server_addr)
            if af == False:
                handler = common.UDPAsyncDNSHandler(
                    (data, r_addr, uid, header_length))
                handler.resolve(self._dns_resolver, (server_addr, server_port),
                                self._handle_server_dns_resolved)
            else:
                self._handle_server_dns_resolved(
                    "", (server_addr, server_port), server_addr,
                    (data, r_addr, uid, header_length))
        else:
            self._handle_server_dns_resolved(
                "", (server_addr, server_port), server_addr,
                (data, r_addr, uid, header_length))
Ejemplo n.º 37
0
    def server_decode(self, buf):
        if self.raw_trans_recv:
            return (buf, True, False)

        if self.has_recv_header:
            verify = buf
            verify_len = 43 - 10
            if len(buf) < 43:
                raise Exception('server_decode data error')
            if not match_begin(buf, b"\x14" + self.tls_version + "\x00\x01\x01"): #ChangeCipherSpec
                raise Exception('server_decode data error')
            buf = buf[6:]
            if not match_begin(buf, b"\x16" + self.tls_version + "\x00\x20"): #Finished
                raise Exception('server_decode data error')
            if hmac.new(self.server_info.key + self.client_id, verify[:verify_len], hashlib.sha1).digest()[:10] != verify[verify_len:verify_len+10]:
                raise Exception('server_decode data error')
            if len(buf) < 37:
                raise Exception('server_decode data error')
            buf = buf[37:]
            self.raw_trans_recv = True
            return (buf, True, False)

        self.has_recv_header = True
        ogn_buf = buf
        if not match_begin(buf, b'\x16' + self.tls_version):
            return self.decode_error_return(ogn_buf)
        buf = buf[3:]
        if struct.unpack('>H', buf[:2])[0] != len(buf) - 2:
            return self.decode_error_return(ogn_buf)
        buf = buf[2:]
        if not match_begin(buf, b'\x01\x00'): #client hello
            return self.decode_error_return(ogn_buf)
        buf = buf[2:]
        if struct.unpack('>H', buf[:2])[0] != len(buf) - 2:
            return self.decode_error_return(ogn_buf)
        buf = buf[2:]
        if not match_begin(buf, self.tls_version):
            return self.decode_error_return(ogn_buf)
        buf = buf[2:]
        verifyid = buf[:32]
        buf = buf[32:]
        sessionid_len = ord(buf[0])
        if sessionid_len < 32:
            logging.info("tls_auth wrong sessionid_len")
            return self.decode_error_return(ogn_buf)
        sessionid = buf[1:sessionid_len + 1]
        buf = buf[sessionid_len+1:]
        self.client_id = sessionid
        sha1 = hmac.new(self.server_info.key + sessionid, verifyid[:22], hashlib.sha1).digest()[:10]
        utc_time = struct.unpack('>I', verifyid[:4])[0]
        time_dif = common.int32((int(time.time()) & 0xffffffff) - utc_time)
        if time_dif < -self.max_time_dif or time_dif > self.max_time_dif \
                or common.int32(utc_time - self.server_info.data.startup_time) < -self.max_time_dif / 2:
            logging.info("tls_auth wrong time")
            return self.decode_error_return(ogn_buf)
        if sha1 != verifyid[22:]:
            logging.info("tls_auth wrong sha1")
            return self.decode_error_return(ogn_buf)
        if self.server_info.data.client_data.get(verifyid[:22]):
            logging.info("replay attack detect, id = %s" % (binascii.hexlify(verifyid)))
            return self.decode_error_return(ogn_buf)
        self.server_info.data.client_data.sweep()
        self.server_info.data.client_data[verifyid[:22]] = sessionid
        # (buffer_to_recv, is_need_decrypt, is_need_to_encode_and_send_back)
        return (b'', False, True)
Ejemplo n.º 38
0
    def _handle_stage_addr(self, ogn_data, data):
        try:
            if self._is_local:
                cmd = common.ord(data[1])
                if cmd == CMD_UDP_ASSOCIATE:
                    logging.debug('UDP associate')
                    if self._local_sock.family == socket.AF_INET6:
                        header = b'\x05\x00\x00\x04'
                    else:
                        header = b'\x05\x00\x00\x01'
                    addr, port = self._local_sock.getsockname()[:2]
                    addr_to_send = socket.inet_pton(self._local_sock.family,
                                                    addr)
                    port_to_send = struct.pack('>H', port)
                    self._write_to_sock(header + addr_to_send + port_to_send,
                                        self._local_sock)
                    self._stage = STAGE_UDP_ASSOC
                    # just wait for the client to disconnect
                    return
                elif cmd == CMD_CONNECT:
                    # just trim VER CMD RSV
                    data = data[3:]
                else:
                    logging.error('unknown command %d', cmd)
                    self.destroy()
                    return

            before_parse_data = data
            if self._is_local:
                header_result = parse_header(data)
            else:
                if data is None or FORCE_NEW_PROTOCOL and common.ord(
                        data[0]) != 0x88 and (~common.ord(data[0])
                                              & 0xff) != 0x88:
                    data = self._handel_protocol_error(self._client_address,
                                                       ogn_data)
                data = pre_parse_header(data)
                if data is None:
                    data = self._handel_protocol_error(self._client_address,
                                                       ogn_data)
                header_result = parse_header(data)
                if header_result is None:
                    data = self._handel_protocol_error(self._client_address,
                                                       ogn_data)
                    header_result = parse_header(data)
            connecttype, remote_addr, remote_port, header_length = header_result
            logging.info('%s connecting %s:%d from %s:%d' %
                         ((connecttype == 0) and 'TCP'
                          or 'UDP', common.to_str(remote_addr), remote_port,
                          self._client_address[0], self._client_address[1]))
            self._remote_address = (common.to_str(remote_addr), remote_port)
            self._remote_udp = (connecttype != 0)
            # pause reading
            self._update_stream(STREAM_UP, WAIT_STATUS_WRITING)
            self._stage = STAGE_DNS
            if self._is_local:
                # forward address to remote
                self._write_to_sock((b'\x05\x00\x00\x01'
                                     b'\x00\x00\x00\x00\x10\x10'),
                                    self._local_sock)
                if CLIENT_NEW_PROTOCOL:
                    rnd_len = random.randint(1, 32)
                    total_len = 7 + rnd_len + len(data)
                    data = b'\x88' + struct.pack(
                        '>H',
                        total_len) + chr(rnd_len) + (b' ' *
                                                     (rnd_len - 1)) + data
                    crc = (0xffffffff - binascii.crc32(data)) & 0xffffffff
                    data += struct.pack('<I', crc)
                data = self._obfs.client_pre_encrypt(data)
                data_to_send = self._encryptor.encrypt(data)
                self._data_to_write_to_remote.append(data_to_send)
                # notice here may go into _handle_dns_resolved directly
                self._dns_resolver.resolve(self._chosen_server[0],
                                           self._handle_dns_resolved)
            else:
                if len(data) > header_length:
                    self._data_to_write_to_remote.append(data[header_length:])
                # notice here may go into _handle_dns_resolved directly
                self._dns_resolver.resolve(remote_addr,
                                           self._handle_dns_resolved)
        except Exception as e:
            self._log_error(e)
            if self._config['verbose']:
                traceback.print_exc()
            self.destroy()
Ejemplo n.º 39
0
    def _handle_server(self):
        server = self._server_socket
        data, r_addr = server.recvfrom(BUF_SIZE)
        ogn_data = data
        if not data:
            logging.debug('UDP handle_server: data is empty')
        if self._stat_callback:
            self._stat_callback(self._listen_port, len(data))
        uid = None
        if self._is_local:
            frag = common.ord(data[2])
            if frag != 0:
                logging.warn('drop a message since frag is not 0')
                return
            else:
                data = data[3:]
        else:
            try:
                data, key, ref_iv = encrypt.decrypt_all(
                    self._password, self._method, data)
            except Exception:
                logging.debug('UDP handle_server: decrypt data failed')
                return

            # decrypt data
            if not data:
                logging.debug('UDP handle_server: data is empty after decrypt')
                return
            ref_iv = [0]
            self._protocol.obfs.server_info.recv_iv = ref_iv[0]
            data, uid = self._protocol.server_udp_post_decrypt(data)

            if self._config['is_multi_user'] != 0 and data:
                if uid:
                    if uid not in self.mu_server_transfer_ul:
                        self.mu_server_transfer_ul[uid] = 0
                    if uid not in self.mu_server_transfer_dl:
                        self.mu_server_transfer_dl[uid] = 0
                    if uid not in self.mu_connected_iplist:
                        self.mu_connected_iplist[uid] = []
                    if uid not in self.mu_detect_log_list:
                        self.mu_detect_log_list[uid] = []

                    if common.getRealIp(
                            r_addr[0]) not in self.mu_connected_iplist[uid]:
                        self.mu_connected_iplist[uid].append(
                            common.getRealIp(r_addr[0]))

                else:
                    raise Exception(
                        'This port is multi user in single port only,so The connection has been rejected, when connect from %s:%d via port %d'
                        % (r_addr[0], r_addr[1], self._listen_port))

        is_relay = False

        #logging.info("UDP data %s" % (binascii.hexlify(data),))
        if not self._is_local:

            if not self._is_relay(r_addr, ogn_data, uid):
                data = pre_parse_header(data)

                data = self._pre_parse_udp_header(data)
                if data is None:
                    return

                if isinstance(data, tuple):
                    return
                    # return self._handle_tcp_over_udp(data, r_addr)
            else:
                if self._config["is_multi_user"] == 0:
                    data, is_relay = self._handel_normal_relay(
                        r_addr, ogn_data)
                else:
                    data, is_relay = self._handel_mu_relay(
                        r_addr, ogn_data, uid)

        try:
            header_result = parse_header(data)
        except:
            self._handel_protocol_error(r_addr, ogn_data)
            return

        if header_result is None:
            self._handel_protocol_error(r_addr, ogn_data)
            return
        connecttype, addrtype, dest_addr, dest_port, header_length = header_result

        if self._is_local:
            addrtype = 3
            server_addr, server_port = self._get_a_server()
        else:
            server_addr, server_port = dest_addr, dest_port

        if (addrtype & 7) == 3:
            af = common.is_ip(server_addr)
            if af == False:
                handler = common.UDPAsyncDNSHandler(
                    (data, r_addr, uid, header_length, is_relay))
                handler.resolve(self._dns_resolver, (server_addr, server_port),
                                self._handle_server_dns_resolved)
            else:
                self._handle_server_dns_resolved(
                    "", (server_addr, server_port), server_addr,
                    (data, r_addr, uid, header_length, is_relay))
        else:
            self._handle_server_dns_resolved(
                "", (server_addr, server_port), server_addr,
                (data, r_addr, uid, header_length, is_relay))
Ejemplo n.º 40
0
 def _handle_stage_addr(self, data):
     logging.debug("Running in the TCPRelayHandler class. [_handle_stage_addr]")
     try:
         if self._is_local:
             cmd = common.ord(data[1])
             if cmd == CMD_UDP_ASSOCIATE:
                 logging.debug('UDP associate')
                 if self._local_sock.family == socket.AF_INET6:
                     header = b'\x05\x00\x00\x04'
                 else:
                     header = b'\x05\x00\x00\x01'
                 addr, port = self._local_sock.getsockname()[:2]
                 addr_to_send = socket.inet_pton(
                     self._local_sock.family, addr)
                 port_to_send = struct.pack('>H', port)
                 self._write_to_sock(
                     header + addr_to_send + port_to_send, self._local_sock)
                 self._stage = STAGE_UDP_ASSOC
                 # just wait for the client to disconnect
                 return
             elif cmd == CMD_CONNECT:
                 # just trim VER CMD RSV
                 data = data[3:]
             else:
                 logging.error('unknown command %d' % cmd)
                 common.error_to_file('unknown command %d' % cmd,self._config)
                 self.destroy()
                 return
         header_result = parse_header(data,self._config)
         if header_result is None:
             raise Exception('can not parse header')
         addrtype, remote_addr, remote_port, header_length = header_result
         logging.info('connecting %s:%d from %s:%d' % (common.to_str(
             remote_addr), remote_port, self._client_address[0], self._client_address[1]))
         if self._server._listen_port in self._config['forbid']['port']:
             for i in self._config['forbid']['site']:
                 if str(i) in common.to_str(remote_addr):
                     self.destroy()
         try:
             if common.to_str(self._config['log']['log_enable']) == "True":
                 log_str_one_line = '''[%s]\t%s:%d\t%s:%d [server_port: %s]\n''' % (time.strftime(
                     "%Y-%m-%d %H:%M:%S"), common.to_str(remote_addr), remote_port, self._client_address[0], self._client_address[1],self._server._listen_port)
                 log_str_buf.append(log_str_one_line)
                 if os.path.exists(os.path.split(self._config['log']['log_path'])[0]) is False:
                     os.makedirs(os.path.split(self._config['log']['log_path'])[0])
                 if len(log_str_buf) == 10:
                     f = open("%s" % self._config['log']['log_path'], 'a+')
                     f.write("".join(log_str_buf))
                     f.close()
                     del log_str_buf[:]
         except Exception as e:
             logging.error(
                 "Sorry.Some ERROR happend when I try to log something to file : info: %s" % str(e))
             common.error_to_file("Sorry.Some ERROR happend when I try to log something to file : info: %s" % str(e),self._config)
         self._remote_address = (common.to_str(remote_addr), remote_port)
         # pause reading
         self._update_stream(STREAM_UP, WAIT_STATUS_WRITING)
         self._stage = STAGE_DNS
         if self._is_local:
             # forward address to remote
             self._write_to_sock(
                 (b'\x05\x00\x00\x01' b'\x00\x00\x00\x00\x10\x10'), self._local_sock)
             data_to_send = self._encryptor.encrypt(data)
             self._data_to_write_to_remote.append(data_to_send)
             # notice here may go into _handle_dns_resolved directly
             self._dns_resolver.resolve(
                 self._chosen_server[0], self._handle_dns_resolved)
         else:
             if len(data) > header_length:
                 self._data_to_write_to_remote.append(data[header_length:])
             # notice here may go into _handle_dns_resolved directly
             self._dns_resolver.resolve(
                 remote_addr, self._handle_dns_resolved)
     except Exception as e:
         self._log_error(e)
         if self._config['verbose']:
             traceback.print_exc()
         # TODO use logging when debug completed
         self.destroy()
Ejemplo n.º 41
0
    def _handle_stage_addr(self, data):
        try:
            if self._is_local:
                cmd = common.ord(data[1])
                if cmd == CMD_UDP_ASSOCIATE:
                    logging.debug('UDP associate')
                    if self._local_sock.family == socket.AF_INET6:
                        header = b'\x05\x00\x00\x04'
                    else:
                        header = b'\x05\x00\x00\x01'
                    addr, port = self._local_sock.getsockname()[:2]
                    addr_to_send = socket.inet_pton(self._local_sock.family,
                                                    addr)
                    port_to_send = struct.pack('>H', port)
                    self._write_to_sock(header + addr_to_send + port_to_send,
                                        self._local_sock)
                    self._stage = STAGE_UDP_ASSOC
                    # just wait for the client to disconnect
                    return
                elif cmd == CMD_CONNECT:
                    # just trim VER CMD RSV
                    data = data[3:]
                else:
                    logging.error('unknown command %d', cmd)
                    self.destroy()
                    return
            header_result = parse_header(data)
            if header_result is None:
                raise Exception('can not parse header')
            addrtype, remote_addr, remote_port, header_length = header_result

            if self._ban_list:
                link_name = common.to_str(remote_addr)
                for b in self._ban_list:
                    if b in link_name:
                        raise Exception('link %s is been banned by rule %s' %
                                        (link_name, b))

            logging.info('connecting %s:%d from %s:%d' %
                         (common.to_str(remote_addr), remote_port,
                          self._client_address[0], self._client_address[1]))
            self._remote_address = (common.to_str(remote_addr), remote_port)
            # pause reading
            self._update_stream(STREAM_UP, WAIT_STATUS_WRITING)
            self._stage = STAGE_DNS
            if self._is_local:
                # forward address to remote
                self._write_to_sock((b'\x05\x00\x00\x01'
                                     b'\x00\x00\x00\x00\x10\x10'),
                                    self._local_sock)
                data_to_send = self._encryptor.encrypt(data)
                self._data_to_write_to_remote.append(data_to_send)
                # notice here may go into _handle_dns_resolved directly
                self._dns_resolver.resolve(self._chosen_server[0],
                                           self._handle_dns_resolved)
            else:
                if len(data) > header_length:
                    self._data_to_write_to_remote.append(data[header_length:])
                # notice here may go into _handle_dns_resolved directly
                self._dns_resolver.resolve(remote_addr,
                                           self._handle_dns_resolved)
        except Exception as e:
            self._log_error(e)
            if self._config['verbose']:
                traceback.print_exc()
            self.destroy()
Ejemplo n.º 42
0
    def server_post_decrypt(self, buf):
        if self.raw_trans:
            return (buf, False)
        self.recv_buf += buf
        out_buf = b''
        sendback = False

        if not self.has_recv_header:
            if len(self.recv_buf) <= 6:
                return (b'', False)
            crc = struct.pack(
                '<I',
                binascii.crc32(self.recv_buf[:2] + self.salt +
                               self.server_info.key) & 0xFFFFFFFF)
            if crc != self.recv_buf[2:6]:
                return self.not_match_return(self.recv_buf)
            length = struct.unpack('>H', self.recv_buf[:2])[0]
            if length > len(self.recv_buf):
                return (b'', False)
            sha1data = hmac.new(
                self.server_info.recv_iv + self.server_info.key,
                self.recv_buf[:length - 10], hashlib.sha1).digest()[:10]
            if sha1data != self.recv_buf[length - 10:length]:
                logging.error('auth_sha1_v4 data uncorrect auth HMAC-SHA1')
                return self.not_match_return(self.recv_buf)
            pos = common.ord(self.recv_buf[6])
            if pos < 255:
                pos += 6
            else:
                pos = struct.unpack('>H', self.recv_buf[7:9])[0] + 6
            out_buf = self.recv_buf[pos:length - 10]
            if len(out_buf) < 12:
                logging.info('auth_sha1_v4: too short, data %s' %
                             (binascii.hexlify(self.recv_buf), ))
                return self.not_match_return(self.recv_buf)
            utc_time = struct.unpack('<I', out_buf[:4])[0]
            client_id = struct.unpack('<I', out_buf[4:8])[0]
            connection_id = struct.unpack('<I', out_buf[8:12])[0]
            time_dif = common.int32(utc_time - (int(time.time()) & 0xffffffff))
            if time_dif < -self.max_time_dif or time_dif > self.max_time_dif:
                logging.info(
                    'auth_sha1_v4: wrong timestamp, time_dif %d, data %s' % (
                        time_dif,
                        binascii.hexlify(out_buf),
                    ))
                return self.not_match_return(self.recv_buf)
            elif self.server_info.data.insert(client_id, connection_id):
                self.has_recv_header = True
                out_buf = out_buf[12:]
                self.client_id = client_id
                self.connection_id = connection_id
            else:
                logging.info('auth_sha1_v4: auth fail, data %s' %
                             (binascii.hexlify(out_buf), ))
                return self.not_match_return(self.recv_buf)
            self.recv_buf = self.recv_buf[length:]
            self.has_recv_header = True
            sendback = True

        while len(self.recv_buf) > 4:
            crc = struct.pack('<H', binascii.crc32(self.recv_buf[:2]) & 0xFFFF)
            if crc != self.recv_buf[2:4]:
                self.raw_trans = True
                logging.info('auth_sha1_v4: wrong crc')
                if self.decrypt_packet_num == 0:
                    logging.info('auth_sha1_v4: wrong crc')
                    return (b'E' * 2048, False)
                else:
                    raise Exception('server_post_decrype data error')
            length = struct.unpack('>H', self.recv_buf[:2])[0]
            if length >= 8192 or length < 7:
                self.raw_trans = True
                self.recv_buf = b''
                if self.decrypt_packet_num == 0:
                    logging.info('auth_sha1_v4: over size')
                    return (b'E' * 2048, False)
                else:
                    raise Exception('server_post_decrype data error')
            if length > len(self.recv_buf):
                break

            if struct.pack(
                    '<I',
                    zlib.adler32(self.recv_buf[:length - 4])
                    & 0xFFFFFFFF) != self.recv_buf[length - 4:length]:
                logging.info('auth_sha1_v4: checksum error, data %s' %
                             (binascii.hexlify(self.recv_buf[:length]), ))
                self.raw_trans = True
                self.recv_buf = b''
                if self.decrypt_packet_num == 0:
                    return (b'E' * 2048, False)
                else:
                    raise Exception(
                        'server_post_decrype data uncorrect checksum')

            pos = common.ord(self.recv_buf[4])
            if pos < 255:
                pos += 4
            else:
                pos = struct.unpack('>H', self.recv_buf[5:7])[0] + 4
            out_buf += self.recv_buf[pos:length - 4]
            self.recv_buf = self.recv_buf[length:]
            if pos == length - 4:
                sendback = True

        if out_buf:
            self.server_info.data.update(self.client_id, self.connection_id)
            self.decrypt_packet_num += 1
        return (out_buf, sendback)
Ejemplo n.º 43
0
 def _ota_chunk_data_gen(self, key, iv, data):
     data = common.chr(common.ord(data[0]) | ADDRTYPE_AUTH) + data[1:]
     key = iv + key
     return data + onetimeauth_gen(data, key)
Ejemplo n.º 44
0
    def _handle_server(self):
        server = self._server_socket

        data, r_addr = server.recvfrom(BUF_SIZE)
        key = None
        iv = None
        if not data:
            logging.debug('UDP handle_server: data is empty')
        if self._stat_callback:
            self._stat_callback(self._listen_port, len(data))
		
		# 若本地端从监听1080端口收到本机应用进程(例如chrome)的数据,进行切除header
        if self._is_local:
            if self._is_tunnel:
                # add ss header to data
                tunnel_remote = self.tunnel_remote
                tunnel_remote_port = self.tunnel_remote_port
                data = common.add_header(tunnel_remote,
                                         tunnel_remote_port, data)
            else:
                frag = common.ord(data[2])
                if frag != 0:
                    logging.warn('UDP drop a message since frag is not 0')
                    return
                else:
                    data = data[3:]
		# 如果是服务端收到本地端发出的udp数据,先进行解密
        else:
            # decrypt data
            try:
                data, key, iv = cryptor.decrypt_all(self._password,
                                                    self._method,
                                                    data, self._crypto_path)
            except Exception:
                logging.debug('UDP handle_server: decrypt data failed')
                return
            if not data:
                logging.debug('UDP handle_server: data is empty after decrypt')
                return
        # 处理header
        header_result = parse_header(data)
        if header_result is None:
            return
        addrtype, dest_addr, dest_port, header_length = header_result
        logging.info("udp data to %s:%d from %s:%d"
                     % (dest_addr, dest_port, r_addr[0], r_addr[1]))
        if self._is_local:
            # 如果是local收到,则server_addr server_port都是远程的
            server_addr, server_port = self._get_a_server()
        else:
            # 如果远程收到,则将server_addr这些改成dest_addr dest_port,方便操作
            # dest就是最终目标,例如 www.youtube.com:443
            server_addr, server_port = dest_addr, dest_port
            # spec https://shadowsocks.org/en/spec/one-time-auth.html
            self._ota_enable_session = addrtype & ADDRTYPE_AUTH
            if self._ota_enable and not self._ota_enable_session:
                logging.warn('client one time auth is required')
                return
            if self._ota_enable_session:
                if len(data) < header_length + ONETIMEAUTH_BYTES:
                    logging.warn('UDP one time auth header is too short')
                    return
                _hash = data[-ONETIMEAUTH_BYTES:]
                data = data[: -ONETIMEAUTH_BYTES]
                _key = iv + key
                if onetimeauth_verify(_hash, data, _key) is False:
                    logging.warn('UDP one time auth fail')
                    return
        addrs = self._dns_cache.get(server_addr, None)
        if addrs is None:
            addrs = socket.getaddrinfo(server_addr, server_port, 0,
                                       socket.SOCK_DGRAM, socket.SOL_UDP)
            if not addrs:
                # drop
                return
            else:
                self._dns_cache[server_addr] = addrs

        af, socktype, proto, canonname, sa = addrs[0]
        key = client_key(r_addr, af)
        client = self._cache.get(key, None)
        if not client:
            # TODO async getaddrinfo
            if self._forbidden_iplist:
                if common.to_str(sa[0]) in self._forbidden_iplist:
                    logging.debug('IP %s is in forbidden list, drop' %
                                  common.to_str(sa[0]))
                    # drop
                    return
            client = socket.socket(af, socktype, proto)
            client.setblocking(False)
            self._cache[key] = client
            self._client_fd_to_server_addr[client.fileno()] = r_addr

            self._sockets.add(client.fileno())
            # 添加进Eventloop,标志设置为可读
            self._eventloop.add(client, eventloop.POLL_IN, self)

        # 如果是local,要向远程发,要过墙,所以要加密
        if self._is_local:
            key, iv, m = cryptor.gen_key_iv(self._password, self._method)
            # spec https://shadowsocks.org/en/spec/one-time-auth.html
            if self._ota_enable_session:
                data = self._ota_chunk_data_gen(key, iv, data)
            try:
                data = cryptor.encrypt_all_m(key, iv, m, self._method, data,
                                             self._crypto_path)
            except Exception:
                logging.debug("UDP handle_server: encrypt data failed")
                return
            if not data:
                return
        # 如果是远程,要向dest发请求,所以把除数据的部分除去,即除去header。
        else:
            # data已经在上面进行数据解密了。不需要像local一样加密发送。
            # data已经被切除头的3个字节了
            data = data[header_length:]
        if not data:
            return
        try:
            # 发送,完美无瑕。。。。
            # 这个sendto同时有udp的和tcp的两种,sendto函数主要用于UDP,但这里两种都用了
            # 调用sendto时候会自动加上那个首3个字节,貌似是x00 x00 x00
            client.sendto(data, (server_addr, server_port))
        except IOError as e:
            err = eventloop.errno_from_exception(e)
            if err in (errno.EINPROGRESS, errno.EAGAIN):
                pass
            else:
                shell.print_exception(e)
Ejemplo n.º 45
0
    def server_post_decrypt(self, buf):
        if self.raw_trans:
            return (buf, False)
        self.recv_buf += buf
        out_buf = b''
        sendback = False

        if not self.has_recv_header:
            if len(self.recv_buf) >= 7 or len(self.recv_buf) in [2, 3]:
                recv_len = min(len(self.recv_buf), 7)
                mac_key = self.server_info['recv_iv'] + self.server_info['key']
                sha1data = hmac.new(mac_key, self.recv_buf[:1],
                                    self.hashfunc).digest()[:recv_len - 1]
                if sha1data != self.recv_buf[1:recv_len]:
                    return self.not_match_return(self.recv_buf)

            if len(self.recv_buf) < 31:
                return (b'', False)
            sha1data = hmac.new(mac_key, self.recv_buf[7:27],
                                self.hashfunc).digest()[:4]
            if sha1data != self.recv_buf[27:31]:
                logging.error(
                    '%s data uncorrect auth HMAC-SHA1 from %s:%d, data %s' %
                    (self.no_compatible_method, self.server_info[''].client,
                     self.server_info[''].client_port,
                     binascii.hexlify(self.recv_buf)))
                if len(self.recv_buf) < 31 + self.extra_wait_size:
                    return (b'', False)
                return self.not_match_return(self.recv_buf)

            uid = self.recv_buf[7:11]
            #             if uid in self.server_info.users:
            #                 self.user_id = uid
            #                 self.user_key = self.hashfunc(self.server_info.users[uid]).digest()
            #                 self.server_info.update_user_func(uid)
            #             else:
            #                 if not self.server_info.users:
            #                     self.user_key = self.server_info.key
            #                 else:
            #                     self.user_key = self.server_info.recv_iv

            if self.user_key is None:
                self.user_key = self.server_info['key']

            encryptor = encrypt.Encryptor(
                to_bytes(base64.b64encode(self.user_key)) + self.salt,
                'aes-128-cbc')
            head = encryptor.decrypt(
                b'\x00' * 16 + self.recv_buf[11:27] +
                b'\x00')  # need an extra byte or recv empty
            length = struct.unpack('<H', head[12:14])[0]
            if len(self.recv_buf) < length:
                return (b'', False)

            utc_time = struct.unpack('<I', head[:4])[0]
            client_id = struct.unpack('<I', head[4:8])[0]
            connection_id = struct.unpack('<I', head[8:12])[0]
            rnd_len = struct.unpack('<H', head[14:16])[0]
            if hmac.new(self.user_key, self.recv_buf[:length - 4],
                        self.hashfunc).digest()[:4] != self.recv_buf[length -
                                                                     4:length]:
                logging.info('%s: checksum error, data %s' %
                             (self.no_compatible_method,
                              binascii.hexlify(self.recv_buf[:length])))
                return self.not_match_return(self.recv_buf)
            time_dif = common.int32(utc_time - (int(time.time()) & 0xffffffff))
            if time_dif < -self.max_time_dif or time_dif > self.max_time_dif:
                logging.info('%s: wrong timestamp, time_dif %d, data %s' %
                             (self.no_compatible_method, time_dif,
                              binascii.hexlify(head)))
                return self.not_match_return(self.recv_buf)
            elif self.data.insert(self.user_id, client_id, connection_id):
                self.has_recv_header = True
                out_buf = self.recv_buf[31 + rnd_len:length - 4]
                self.client_id = client_id
                self.connection_id = connection_id
            else:
                logging.info(
                    '%s: auth fail, data %s' %
                    (self.no_compatible_method, binascii.hexlify(out_buf)))
                return self.not_match_return(self.recv_buf)
            self.recv_buf = self.recv_buf[length:]
            self.has_recv_header = True
            sendback = True

        while len(self.recv_buf) > 4:
            mac_key = self.user_key + struct.pack('<I', self.recv_id)
            mac = hmac.new(mac_key, self.recv_buf[:2],
                           self.hashfunc).digest()[:2]
            if mac != self.recv_buf[2:4]:
                self.raw_trans = True
                logging.info(self.no_compatible_method + ': wrong crc')
                if self.recv_id == 0:
                    logging.info(self.no_compatible_method + ': wrong crc')
                    return (b'E' * 2048, False)
                else:
                    raise Exception('server_post_decrype data error')
            length = struct.unpack('<H', self.recv_buf[:2])[0]
            if length >= 8192 or length < 7:
                self.raw_trans = True
                self.recv_buf = b''
                if self.recv_id == 0:
                    logging.info(self.no_compatible_method + ': over size')
                    return (b'E' * 2048, False)
                else:
                    raise Exception('server_post_decrype data error')
            if length > len(self.recv_buf):
                break

            if hmac.new(mac_key, self.recv_buf[:length - 4],
                        self.hashfunc).digest()[:4] != self.recv_buf[length -
                                                                     4:length]:
                logging.info('%s: checksum error, data %s' %
                             (self.no_compatible_method,
                              binascii.hexlify(self.recv_buf[:length])))
                self.raw_trans = True
                self.recv_buf = b''
                if self.recv_id == 0:
                    return (b'E' * 2048, False)
                else:
                    raise Exception(
                        'server_post_decrype data uncorrect checksum')

            self.recv_id = (self.recv_id + 1) & 0xFFFFFFFF
            pos = common.ord(self.recv_buf[4])
            if pos < 255:
                pos += 4
            else:
                pos = struct.unpack('<H', self.recv_buf[5:7])[0] + 4
            out_buf += self.recv_buf[pos:length - 4]
            self.recv_buf = self.recv_buf[length:]
            if pos == length - 4:
                sendback = True

        if out_buf:
            self.data.update(self.user_id, self.client_id, self.connection_id)
        return (out_buf, sendback)
Ejemplo n.º 46
0
    def _handle_server(self):
        server = self._server_socket
        data, r_addr = server.recvfrom(BUF_SIZE)
        key = None
        iv = None
        if not data:
            logging.debug('UDP handle_server: data is empty')
        if self._stat_callback:
            self._stat_callback(self._listen_port, len(data))
        if self._is_local:
            if self._is_tunnel:
                # add ss header to data
                tunnel_remote = self.tunnel_remote
                tunnel_remote_port = self.tunnel_remote_port
                data = common.add_header(tunnel_remote,
                                         tunnel_remote_port, data)
            else:
                frag = common.ord(data[2])
                if frag != 0:
                    logging.warn('UDP drop a message since frag is not 0')
                    return
                else:
                    data = data[3:]
        else:
            # decrypt data
            try:
                data, key, iv = cryptor.decrypt_all(self._password,
                                                    self._method,
                                                    data, self._crypto_path)
            except Exception:
                logging.debug('UDP handle_server: decrypt data failed')
                return
            if not data:
                logging.debug('UDP handle_server: data is empty after decrypt')
                return
        header_result = parse_header(data)
        if header_result is None:
            return
        addrtype, dest_addr, dest_port, header_length = header_result
        logging.info("udp data to %s:%d from %s:%d"
                     % (dest_addr, dest_port, r_addr[0], r_addr[1]))
        if self._is_local:
            server_addr, server_port = self._get_a_server()
        else:
            server_addr, server_port = dest_addr, dest_port
            # spec https://shadowsocks.org/en/spec/one-time-auth.html
            self._ota_enable_session = addrtype & ADDRTYPE_AUTH
            if self._ota_enable and not self._ota_enable_session:
                logging.warn('client one time auth is required')
                return
            if self._ota_enable_session:
                if len(data) < header_length + ONETIMEAUTH_BYTES:
                    logging.warn('UDP one time auth header is too short')
                    return
                _hash = data[-ONETIMEAUTH_BYTES:]
                data = data[: -ONETIMEAUTH_BYTES]
                _key = iv + key
                if onetimeauth_verify(_hash, data, _key) is False:
                    logging.warn('UDP one time auth fail')
                    return
        addrs = self._dns_cache.get(server_addr, None)
        if addrs is None:
            addrs = socket.getaddrinfo(server_addr, server_port, 0,
                                       socket.SOCK_DGRAM, socket.SOL_UDP)
            if not addrs:
                # drop
                return
            else:
                self._dns_cache[server_addr] = addrs

        af, socktype, proto, canonname, sa = addrs[0]
        key = client_key(r_addr, af)
        client = self._cache.get(key, None)
        if not client:
            # TODO async getaddrinfo
            if self._forbidden_iplist:
                if common.to_str(sa[0]) in self._forbidden_iplist:
                    logging.debug('IP %s is in forbidden list, drop' %
                                  common.to_str(sa[0]))
                    # drop
                    return
            client = socket.socket(af, socktype, proto)
            client.setblocking(False)
            self._cache[key] = client
            self._client_fd_to_server_addr[client.fileno()] = r_addr

            self._sockets.add(client.fileno())
            self._eventloop.add(client, eventloop.POLL_IN, self)

        if self._is_local:
            key, iv, m = cryptor.gen_key_iv(self._password, self._method)
            # spec https://shadowsocks.org/en/spec/one-time-auth.html
            if self._ota_enable_session:
                data = self._ota_chunk_data_gen(key, iv, data)
            try:
                data = cryptor.encrypt_all_m(key, iv, m, self._method, data,
                                             self._crypto_path)
            except Exception:
                logging.debug("UDP handle_server: encrypt data failed")
                return
            if not data:
                return
        else:
            data = data[header_length:]
        if not data:
            return
        try:
            client.sendto(data, (server_addr, server_port))
        except IOError as e:
            err = eventloop.errno_from_exception(e)
            if err in (errno.EINPROGRESS, errno.EAGAIN):
                pass
            else:
                shell.print_exception(e)
Ejemplo n.º 47
0
    def _handle_server(self):
        server = self._server_socket
        data, r_addr = server.recvfrom(BUF_SIZE)
        if not data:
            logging.debug('UDP handle_server: data is empty')
        if self._stat_callback:
            self._stat_callback(self._listen_port, len(data))
        # note(yan): server接受到数据
        if self._is_local:
            # note(yan): 如果是local的话,收到的是SOCKS5 UDP request.
            frag = common.ord(data[2])
            if frag != 0:
                logging.warn('drop a message since frag is not 0')
                return
            else:
                data = data[3:]
        else:
            # note(yan): 否则,收到的是shadowsocks encrypted udp request.
            # 注意ss udp request的后半段,和socks5 udp request完全一致
            data = encrypt.encrypt_all(self._password, self._method, 0, data)
            # decrypt data
            if not data:
                logging.debug('UDP handle_server: data is empty after decrypt')
                return
        header_result = parse_header(data)
        if header_result is None:
            return
        addrtype, dest_addr, dest_port, header_length = header_result

        # note(yan): 如果是local的话,那么dest_addr/port在配置中
        # 否则dest_addr/port在请求里面
        if self._is_local:
            server_addr, server_port = self._get_a_server()
        else:
            server_addr, server_port = dest_addr, dest_port

        addrs = self._dns_cache.get(server_addr, None)
        if addrs is None:
            addrs = socket.getaddrinfo(server_addr, server_port, 0,
                                       socket.SOCK_DGRAM, socket.SOL_UDP)
            if not addrs:
                # drop
                return
            else:
                self._dns_cache[server_addr] = addrs

        af, socktype, proto, canonname, sa = addrs[0]
        # note(yan): 找到对应的proxy client. 所有的proxy都需要管理
        # <c, c>这样的pair集合
        key = client_key(r_addr, af)
        client = self._cache.get(key, None)
        if not client:
            # TODO async getaddrinfo
            if self._forbidden_iplist:
                if common.to_str(sa[0]) in self._forbidden_iplist:
                    logging.debug('IP %s is in forbidden list, drop' %
                                  common.to_str(sa[0]))
                    # drop
                    return
            client = socket.socket(af, socktype, proto)
            client.setblocking(False)
            self._cache[key] = client
            self._client_fd_to_server_addr[client.fileno()] = r_addr

            self._sockets.add(client.fileno())
            self._eventloop.add(client, eventloop.POLL_IN, self)

        if self._is_local:
            data = encrypt.encrypt_all(self._password, self._method, 1, data)
            if not data:
                return
        else:
            data = data[header_length:]
        if not data:
            return
        try:
            client.sendto(data, (server_addr, server_port))
        except IOError as e:
            err = eventloop.errno_from_exception(e)
            if err in (errno.EINPROGRESS, errno.EAGAIN):
                pass
            else:
                shell.print_exception(e)
Ejemplo n.º 48
0
Archivo: auth.py Proyecto: Chen0831/ssr
    def server_post_decrypt(self, buf):
        if self.raw_trans:
            return buf
        self.recv_buf += buf
        out_buf = b''
        if not self.has_recv_header:
            if len(self.recv_buf) < 4:
                return b''
            crc = struct.pack(
                '<I',
                binascii.crc32(self.server_info.key) & 0xFFFFFFFF)
            if crc != self.recv_buf[:4]:
                if self.method == 'auth_sha1':
                    return b'E'
                else:
                    self.raw_trans = True
                    return self.recv_buf
            length = struct.unpack('>H', self.recv_buf[4:6])[0]
            if length > len(self.recv_buf):
                return b''
            sha1data = hmac.new(
                self.server_info.recv_iv + self.server_info.key,
                self.recv_buf[:length - 10], hashlib.sha1).digest()[:10]
            if sha1data != self.recv_buf[length - 10:length]:
                logging.error('auth_sha1 data uncorrect auth HMAC-SHA1')
                return b'E'
            pos = common.ord(self.recv_buf[6]) + 6
            out_buf = self.recv_buf[pos:length - 10]
            if len(out_buf) < 12:
                self.raw_trans = True
                self.recv_buf = b''
                logging.info('auth_sha1: too short')
                return b'E'
            utc_time = struct.unpack('<I', out_buf[:4])[0]
            client_id = struct.unpack('<I', out_buf[4:8])[0]
            connection_id = struct.unpack('<I', out_buf[8:12])[0]
            time_dif = common.int32((int(time.time()) & 0xffffffff) - utc_time)
            if time_dif < -self.max_time_dif or time_dif > self.max_time_dif \
                    or common.int32(utc_time - self.server_info.data.startup_time) < -self.max_time_dif / 2:
                self.raw_trans = True
                self.recv_buf = b''
                logging.info(
                    'auth_sha1: wrong timestamp, time_dif %d, data %s' % (
                        time_dif,
                        binascii.hexlify(out_buf),
                    ))
                return b'E'
            elif self.server_info.data.insert(client_id, connection_id):
                self.has_recv_header = True
                out_buf = out_buf[12:]
                self.client_id = client_id
                self.connection_id = connection_id
            else:
                self.raw_trans = True
                self.recv_buf = b''
                logging.info('auth_sha1: auth fail, data %s' %
                             (binascii.hexlify(out_buf), ))
                return b'E'
            self.recv_buf = self.recv_buf[length:]
            self.has_recv_header = True

        while len(self.recv_buf) > 2:
            length = struct.unpack('>H', self.recv_buf[:2])[0]
            if length >= 8192 or length < 7:
                self.raw_trans = True
                self.recv_buf = b''
                if self.decrypt_packet_num == 0:
                    logging.info('auth_sha1: over size')
                    return b'E'
                else:
                    raise Exception('server_post_decrype data error')
            if length > len(self.recv_buf):
                break

            if struct.pack(
                    '<I',
                    zlib.adler32(self.recv_buf[:length - 4])
                    & 0xFFFFFFFF) != self.recv_buf[length - 4:length]:
                logging.info('auth_sha1: checksum error, data %s' %
                             (binascii.hexlify(self.recv_buf[:length]), ))
                self.raw_trans = True
                self.recv_buf = b''
                if self.decrypt_packet_num == 0:
                    return b'E'
                else:
                    raise Exception(
                        'server_post_decrype data uncorrect checksum')

            pos = common.ord(self.recv_buf[2]) + 2
            out_buf += self.recv_buf[pos:length - 4]
            self.recv_buf = self.recv_buf[length:]

        if out_buf:
            self.server_info.data.update(self.client_id, self.connection_id)
            self.decrypt_packet_num += 1
        return out_buf
Ejemplo n.º 49
0
    def _handle_server(self):
        server = self._server_socket
        data, r_addr = server.recvfrom(BUF_SIZE)
        client_address = r_addr[0]
        key = None
        iv = None
        if not data:
            logging.debug('U[%d] UDP handle_server: data is empty' %
                          self._config['server_port'])
        if self._stat_callback:
            self._stat_callback(self._listen_port, len(data))
        if self._is_local:
            if self._is_tunnel:
                # add ss header to data
                tunnel_remote = self.tunnel_remote
                tunnel_remote_port = self.tunnel_remote_port
                data = common.add_header(tunnel_remote,
                                         tunnel_remote_port, data)
            else:
                frag = common.ord(data[2])
                if frag != 0:
                    logging.warn('UDP drop a message since frag is not 0')
                    return
                else:
                    data = data[3:]
        else:
            # decrypt data
            try:
                data, key, iv = cryptor.decrypt_all(self._password,
                                                    self._method,
                                                    data)
            except Exception:
                logging.debug('U[%d] UDP handle_server: decrypt data failed' % self._config[
                    'server_port'])
                return
            if not data:
                logging.debug(
                    'U[%d] UDP handle_server: data is empty after decrypt' % self._config[
                        'server_port']
                )
                return
        header_result = parse_header(data)
        if header_result is None:
            return
        addrtype, dest_addr, dest_port, header_length = header_result

        if self._config['firewall_ports'] and self._config['server_port'] not in self._config['firewall_trusted']:
            # Firewall enabled
            if self._config['firewall_mode'] == 'blacklist' and dest_port in self._config['firewall_ports']:
                firewall_blocked = True
            elif self._config['firewall_mode'] == 'whitelist' and dest_port not in self._config['firewall_ports']:
                firewall_blocked = True
            else:
                firewall_blocked = False
        else:
            firewall_blocked = False
        if firewall_blocked:
            logging.warning('U[%d] UDP PORT BANNED: RP[%d] A[%s-->%s]' % (
                self._config['server_port'], dest_port,
                client_address, common.to_str(dest_addr)
            ))
            return
        else:
            logging.info('U[%d] UDP CONN: RP[%d] A[%s-->%s]' % (
                self._config['server_port'], dest_port,
                client_address, common.to_str(dest_addr)
            ))
        if self._is_local:
            server_addr, server_port = self._get_a_server()
        else:
            server_addr, server_port = dest_addr, dest_port
            # spec https://shadowsocks.org/en/spec/one-time-auth.html
            self._ota_enable_session = addrtype & ADDRTYPE_AUTH
            if self._ota_enable and not self._ota_enable_session:
                logging.warn('client one time auth is required')
                return
            if self._ota_enable_session:
                if len(data) < header_length + ONETIMEAUTH_BYTES:
                    logging.warn('U[%d] UDP one time auth header is too short' % self._config[
                                 'server_port'])
                    return
                _hash = data[-ONETIMEAUTH_BYTES:]
                data = data[: -ONETIMEAUTH_BYTES]
                _key = iv + key
                if onetimeauth_verify(_hash, data, _key) is False:
                    logging.warn('U[%d] UDP one time auth fail' %
                                 self._config['server_port'])
                    return
        addrs = self._dns_cache.get(server_addr, None)
        if addrs is None:
            addrs = socket.getaddrinfo(server_addr, server_port, 0,
                                       socket.SOCK_DGRAM, socket.SOL_UDP)
            if not addrs:
                # drop
                return
            else:
                self._dns_cache[server_addr] = addrs

        af, socktype, proto, canonname, sa = addrs[0]
        key = client_key(r_addr, af)
        client = self._cache.get(key, None)
        if not client:
            # TODO async getaddrinfo
            if self._forbidden_iplist:
                if common.to_str(sa[0]) in self._forbidden_iplist:
                    logging.debug('U[%d] IP %s is in forbidden list, drop' %
                                  (self._config['server_port'], common.to_str(sa[0])))
                    # drop
                    return
            client = socket.socket(af, socktype, proto)
            client.setblocking(False)
            self._cache[key] = client
            self._client_fd_to_server_addr[client.fileno()] = r_addr

            self._sockets.add(client.fileno())
            self._eventloop.add(client, eventloop.POLL_IN, self)

        if self._is_local:
            key, iv, m = cryptor.gen_key_iv(self._password, self._method)
            # spec https://shadowsocks.org/en/spec/one-time-auth.html
            if self._ota_enable_session:
                data = self._ota_chunk_data_gen(key, iv, data)
            try:
                data = cryptor.encrypt_all_m(key, iv, m, self._method, data,
                                             self._crypto_path)
            except Exception:
                logging.debug("UDP handle_server: encrypt data failed")
                return
            if not data:
                return
        else:
            data = data[header_length:]
        if not data:
            return
        try:
            client.sendto(data, (server_addr, server_port))
        except (socket.error, OSError, IOError) as e:
            error_no = eventloop.errno_from_exception(e)
            if sys.platform == "win32":
                if error_no in (errno.EAGAIN, errno.EINPROGRESS,
                                errno.EWOULDBLOCK, errno.WSAEWOULDBLOCK):
                    pass
                else:
                    shell.print_exception(e)
            elif error_no in (errno.EAGAIN, errno.EINPROGRESS,
                              errno.EWOULDBLOCK):
                pass
            else:
                shell.print_exception(e)
Ejemplo n.º 50
0
    def _handle_server(self):
        server = self._server_socket
        data, r_addr = server.recvfrom(BUF_SIZE)
        if not data:
            logging.debug('UDP handle_server: data is empty')
        if self._is_local:
            frag = common.ord(data[2])
            if frag != 0:
                logging.warn('drop a message since frag is not 0')
                return
            else:
                data = data[3:]
        else:
            data = encrypt.encrypt_all(self._password, self._method, 0, data)
            # decrypt data
            if not data:
                logging.debug('UDP handle_server: data is empty after decrypt')
                return
        header_result = parse_header(data)
        if header_result is None:
            return
        addrtype, dest_addr, dest_port, header_length = header_result

        if self._is_local:
            server_addr, server_port = self._get_a_server()
        else:
            server_addr, server_port = dest_addr, dest_port

        key = client_key(r_addr[0], r_addr[1], dest_addr, dest_port)
        client = self._cache.get(key, None)
        if not client:
            # TODO async getaddrinfo
            addrs = socket.getaddrinfo(server_addr, server_port, 0,
                                       socket.SOCK_DGRAM, socket.SOL_UDP)
            if addrs:
                af, socktype, proto, canonname, sa = addrs[0]
                if self._forbidden_iplist:
                    if common.to_str(sa[0]) in self._forbidden_iplist:
                        logging.debug('IP %s is in forbidden list, drop' %
                                      common.to_str(sa[0]))
                        # drop
                        return
                client = socket.socket(af, socktype, proto)
                client.setblocking(False)
                self._cache[key] = client
                self._client_fd_to_server_addr[client.fileno()] = r_addr
            else:
                # drop
                return
            self._sockets.add(client.fileno())
            self._eventloop.add(client, eventloop.POLL_IN)

        if self._is_local:
            data = encrypt.encrypt_all(self._password, self._method, 1, data)
            if not data:
                return
        else:
            data = data[header_length:]
        if not data:
            return
        try:
            client.sendto(data, (server_addr, server_port))
        except IOError as e:
            err = eventloop.errno_from_exception(e)
            if err in (errno.EINPROGRESS, errno.EAGAIN):
                pass
            else:
                shell.print_exception(e)
Ejemplo n.º 51
0
 def _handle_stage_addr(self, data):
     try:
         if self._is_local:
             cmd = common.ord(data[1])
             if cmd == CMD_UDP_ASSOCIATE:
                 logging.debug('UDP associate')
                 if self._local_sock.family == socket.AF_INET6:
                     header = b'\x05\x00\x00\x04'
                 else:
                     header = b'\x05\x00\x00\x01'
                 addr, port = self._local_sock.getsockname()[:2]
                 addr_to_send = socket.inet_pton(self._local_sock.family,
                                                 addr)
                 port_to_send = struct.pack('>H', port)
                 self._write_to_sock(header + addr_to_send + port_to_send,
                                     self._local_sock)
                 self._stage = STAGE_UDP_ASSOC
                 # just wait for the client to disconnect
                 return
             elif cmd == CMD_CONNECT:
                 # just trim VER CMD RSV
                 data = data[3:]
             else:
                 logging.error('unknown command %d', cmd)
                 self.destroy()
                 return
         header_result = parse_header(data)
         if header_result is None:
             raise Exception('can not parse header')
         addrtype, remote_addr, remote_port, header_length = header_result
         logging.info('connecting %s:%d from %s:%d' %
                      (common.to_str(remote_addr), remote_port,
                       self._client_address[0], self._client_address[1]))
         if self._is_local is False:
             # spec https://shadowsocks.org/en/spec/one-time-auth.html
             if self._ota_enable or addrtype & ADDRTYPE_AUTH:
                 if len(data) < header_length + ONETIMEAUTH_BYTES:
                     logging.warn('one time auth header is too short')
                     return None
                 offset = header_length + ONETIMEAUTH_BYTES
                 _hash = data[header_length: offset]
                 _data = data[:header_length]
                 key = self._encryptor.decipher_iv + self._encryptor.key
                 if onetimeauth_verify(_hash, _data, key) is False:
                     logging.warn('one time auth fail')
                     self.destroy()
                 header_length += ONETIMEAUTH_BYTES
         self._remote_address = (common.to_str(remote_addr), remote_port)
         # pause reading
         self._update_stream(STREAM_UP, WAIT_STATUS_WRITING)
         self._stage = STAGE_DNS
         if self._is_local:
             # forward address to remote
             self._write_to_sock((b'\x05\x00\x00\x01'
                                  b'\x00\x00\x00\x00\x10\x10'),
                                 self._local_sock)
             # spec https://shadowsocks.org/en/spec/one-time-auth.html
             # ATYP & 0x10 == 1, then OTA is enabled.
             if self._ota_enable:
                 data = common.chr(addrtype | ADDRTYPE_AUTH) + data[1:]
                 key = self._encryptor.cipher_iv + self._encryptor.key
                 data += onetimeauth_gen(data, key)
             data_to_send = self._encryptor.encrypt(data)
             self._data_to_write_to_remote.append(data_to_send)
             # notice here may go into _handle_dns_resolved directly
             self._dns_resolver.resolve(self._chosen_server[0],
                                        self._handle_dns_resolved)
         else:
             if self._ota_enable:
                 data = data[header_length:]
                 self._ota_chunk_data(data,
                                      self._data_to_write_to_remote.append)
             elif len(data) > header_length:
                 self._data_to_write_to_remote.append(data[header_length:])
             # notice here may go into _handle_dns_resolved directly
             self._dns_resolver.resolve(remote_addr,
                                        self._handle_dns_resolved)
     except Exception as e:
         self._log_error(e)
         if self._config['verbose']:
             traceback.print_exc()
         self.destroy()
Ejemplo n.º 52
0
 def client_udp_pre_encrypt(self, buf):
     ret = self.pack_auth_data(buf)
     return chr(ord(buf[0]) | 0x10) + buf[1:]
Ejemplo n.º 53
0
Archivo: auth.py Proyecto: Chen0831/ssr
    def server_post_decrypt(self, buf):
        if self.raw_trans:
            return buf
        self.recv_buf += buf
        out_buf = b''
        if not self.has_recv_header:
            if len(self.recv_buf) < 4:
                return b''
            crc = struct.pack(
                '<I',
                binascii.crc32(self.salt + self.server_info.key) & 0xFFFFFFFF)
            if crc != self.recv_buf[:4]:
                if self.method == 'auth_sha1_v2':
                    return b'E'
                else:
                    self.raw_trans = True
                    return self.recv_buf
            length = struct.unpack('>H', self.recv_buf[4:6])[0]
            if length > len(self.recv_buf):
                return b''
            sha1data = hmac.new(
                self.server_info.recv_iv + self.server_info.key,
                self.recv_buf[:length - 10], hashlib.sha1).digest()[:10]
            if sha1data != self.recv_buf[length - 10:length]:
                logging.error('auth_sha1_v2 data uncorrect auth HMAC-SHA1')
                return b'E'
            pos = common.ord(self.recv_buf[6])
            if pos < 255:
                pos += 6
            else:
                pos = struct.unpack('>H', self.recv_buf[7:9])[0] + 6
            out_buf = self.recv_buf[pos:length - 10]
            if len(out_buf) < 8:
                self.raw_trans = True
                self.recv_buf = b''
                logging.info('auth_sha1_v2: too short')
                return b'E'
            client_id = struct.unpack('<Q', out_buf[:8])[0]
            connection_id = struct.unpack('<I', out_buf[8:12])[0]
            if self.server_info.data.insert(client_id, connection_id):
                self.has_recv_header = True
                out_buf = out_buf[12:]
                self.client_id = client_id
                self.connection_id = connection_id
            else:
                self.raw_trans = True
                self.recv_buf = b''
                logging.info('auth_sha1_v2: auth fail, data %s' %
                             (binascii.hexlify(out_buf), ))
                return b'E'
            self.recv_buf = self.recv_buf[length:]
            self.has_recv_header = True

        while len(self.recv_buf) > 2:
            length = struct.unpack('>H', self.recv_buf[:2])[0]
            if length >= 8192 or length < 7:
                self.raw_trans = True
                self.recv_buf = b''
                if self.decrypt_packet_num == 0:
                    logging.info('auth_sha1_v2: over size')
                    return b'E'
                else:
                    raise Exception('server_post_decrype data error')
            if length > len(self.recv_buf):
                break

            if struct.pack(
                    '<I',
                    zlib.adler32(self.recv_buf[:length - 4])
                    & 0xFFFFFFFF) != self.recv_buf[length - 4:length]:
                logging.info('auth_sha1: checksum error, data %s' %
                             (binascii.hexlify(self.recv_buf[:length]), ))
                self.raw_trans = True
                self.recv_buf = b''
                if self.decrypt_packet_num == 0:
                    return b'E'
                else:
                    raise Exception(
                        'server_post_decrype data uncorrect checksum')

            pos = common.ord(self.recv_buf[2])
            if pos < 255:
                pos += 2
            else:
                pos = struct.unpack('>H', self.recv_buf[3:5])[0] + 2
            out_buf += self.recv_buf[pos:length - 4]
            self.recv_buf = self.recv_buf[length:]

        if out_buf:
            self.server_info.data.update(self.client_id, self.connection_id)
            self.decrypt_packet_num += 1
        return out_buf
Ejemplo n.º 54
0
    def _write_to_sock(self, data, sock):
        # write data to sock
        # if only some of the data are written, put remaining in the buffer
        # and update the stream to wait for writing
        if not sock:
            return False
        #logging.debug("_write_to_sock %s %s %s" % (self._remote_sock, sock, self._remote_udp))
        uncomplete = False
        if self._remote_udp and sock == self._remote_sock:
            try:
                self._udp_data_send_buffer += data
                #logging.info('UDP over TCP sendto %d %s' % (len(data), binascii.hexlify(data)))
                while len(self._udp_data_send_buffer) > 6:
                    length = struct.unpack('>H',
                                           self._udp_data_send_buffer[:2])[0]
                    if length >= 0xff00:
                        length = struct.unpack(
                            '>H', self._udp_data_send_buffer[1:3])[0] + 0xff00

                    if length > len(self._udp_data_send_buffer):
                        break

                    data = self._udp_data_send_buffer[:length]
                    if length >= 0xff00:
                        data = data[1:]
                    self._udp_data_send_buffer = self._udp_data_send_buffer[
                        length:]

                    frag = common.ord(data[2])
                    if frag != 0:
                        logging.warn('drop a message since frag is %d' %
                                     (frag, ))
                        continue
                    else:
                        data = data[3:]
                    header_result = parse_header(data)
                    if header_result is None:
                        continue
                    connecttype, dest_addr, dest_port, header_length = header_result
                    addrs = socket.getaddrinfo(dest_addr, dest_port, 0,
                                               socket.SOCK_DGRAM,
                                               socket.SOL_UDP)
                    #logging.info('UDP over TCP sendto %s:%d %d bytes from %s:%d' % (dest_addr, dest_port, len(data), self._client_address[0], self._client_address[1]))
                    if addrs:
                        af, socktype, proto, canonname, server_addr = addrs[0]
                        data = data[header_length:]
                        if af == socket.AF_INET6:
                            self._remote_sock_v6.sendto(
                                data, (server_addr[0], dest_port))
                        else:
                            sock.sendto(data, (server_addr[0], dest_port))

            except Exception as e:
                #trace = traceback.format_exc()
                #logging.error(trace)
                error_no = eventloop.errno_from_exception(e)
                if error_no in (errno.EAGAIN, errno.EINPROGRESS,
                                errno.EWOULDBLOCK):
                    uncomplete = True
                else:
                    shell.print_exception(e)
                    self.destroy()
                    return False
            return True
        else:
            try:
                if self._encrypt_correct:
                    if sock == self._remote_sock:
                        self._server.server_transfer_ul += len(data)
                        self._update_activity(len(data))
                if data:
                    l = len(data)
                    s = sock.send(data)
                    if s < l:
                        data = data[s:]
                        uncomplete = True
                else:
                    return
            except (OSError, IOError) as e:
                error_no = eventloop.errno_from_exception(e)
                if error_no in (errno.EAGAIN, errno.EINPROGRESS,
                                errno.EWOULDBLOCK):
                    uncomplete = True
                else:
                    #traceback.print_exc()
                    shell.print_exception(e)
                    self.destroy()
                    return False
            except Exception as e:
                shell.print_exception(e)
                self.destroy()
                return False
        if uncomplete:
            if sock == self._local_sock:
                self._data_to_write_to_local.append(data)
                self._update_stream(STREAM_DOWN, WAIT_STATUS_WRITING)
            elif sock == self._remote_sock:
                self._data_to_write_to_remote.append(data)
                self._update_stream(STREAM_UP, WAIT_STATUS_WRITING)
            else:
                logging.error('write_all_to_sock:unknown socket')
        else:
            if sock == self._local_sock:
                self._update_stream(STREAM_DOWN, WAIT_STATUS_READING)
            elif sock == self._remote_sock:
                self._update_stream(STREAM_UP, WAIT_STATUS_READING)
            else:
                logging.error('write_all_to_sock:unknown socket')
        return True
Ejemplo n.º 55
0
Archivo: auth.py Proyecto: Chen0831/ssr
    def server_post_decrypt(self, buf):
        if self.raw_trans:
            return buf
        self.recv_buf += buf
        out_buf = b''
        while len(self.recv_buf) > 2:
            length = struct.unpack('>H', self.recv_buf[:2])[0]
            if length >= 8192 or length < 7:
                self.raw_trans = True
                self.recv_buf = b''
                if self.decrypt_packet_num == 0:
                    logging.info('auth_simple: over size')
                    return b'E'
                else:
                    raise Exception('server_post_decrype data error')
            if length > len(self.recv_buf):
                break

            if (binascii.crc32(self.recv_buf[:length])
                    & 0xffffffff) != 0xffffffff:
                logging.info('auth_simple: crc32 error, data %s' %
                             (binascii.hexlify(self.recv_buf[:length]), ))
                self.raw_trans = True
                self.recv_buf = b''
                if self.decrypt_packet_num == 0:
                    return b'E'
                else:
                    raise Exception('server_post_decrype data uncorrect CRC32')

            pos = common.ord(self.recv_buf[2]) + 2
            out_buf += self.recv_buf[pos:length - 4]
            if not self.has_recv_header:
                if len(out_buf) < 12:
                    self.raw_trans = True
                    self.recv_buf = b''
                    logging.info('auth_simple: too short')
                    return b'E'
                utc_time = struct.unpack('<I', out_buf[:4])[0]
                client_id = struct.unpack('<I', out_buf[4:8])[0]
                connection_id = struct.unpack('<I', out_buf[8:12])[0]
                time_dif = common.int32((int(time.time()) & 0xffffffff) -
                                        utc_time)
                if time_dif < -self.max_time_dif or time_dif > self.max_time_dif \
                        or common.int32(utc_time - self.server_info.data.startup_time) < 0:
                    self.raw_trans = True
                    self.recv_buf = b''
                    logging.info(
                        'auth_simple: wrong timestamp, time_dif %d, data %s' %
                        (
                            time_dif,
                            binascii.hexlify(out_buf),
                        ))
                    return b'E'
                elif self.server_info.data.insert(client_id, connection_id):
                    self.has_recv_header = True
                    out_buf = out_buf[12:]
                    self.client_id = client_id
                    self.connection_id = connection_id
                else:
                    self.raw_trans = True
                    self.recv_buf = b''
                    logging.info('auth_simple: auth fail, data %s' %
                                 (binascii.hexlify(out_buf), ))
                    return b'E'
            self.recv_buf = self.recv_buf[length:]

        if out_buf:
            self.server_info.data.update(self.client_id, self.connection_id)
            self.decrypt_packet_num += 1
        return out_buf
Ejemplo n.º 56
0
    def _handle_stage_addr(self, ogn_data, data):
        try:
            if self._is_local:
                cmd = common.ord(data[1])
                if cmd == CMD_UDP_ASSOCIATE:
                    logging.debug('UDP associate')
                    if self._local_sock.family == socket.AF_INET6:
                        header = b'\x05\x00\x00\x04'
                    else:
                        header = b'\x05\x00\x00\x01'
                    addr, port = self._local_sock.getsockname()[:2]
                    addr_to_send = socket.inet_pton(self._local_sock.family,
                                                    addr)
                    port_to_send = struct.pack('>H', port)
                    self._write_to_sock(header + addr_to_send + port_to_send,
                                        self._local_sock)
                    self._stage = STAGE_UDP_ASSOC
                    # just wait for the client to disconnect
                    return
                elif cmd == CMD_CONNECT:
                    # just trim VER CMD RSV
                    data = data[3:]
                else:
                    logging.error('unknown command %d', cmd)
                    self.destroy()
                    return

            before_parse_data = data
            if self._is_local:
                header_result = parse_header(data)
            else:
                data = pre_parse_header(data)
                if data is None:
                    data = self._handel_protocol_error(self._client_address,
                                                       ogn_data)
                header_result = parse_header(data)
                if header_result is None:
                    data = self._handel_protocol_error(self._client_address,
                                                       ogn_data)
                    header_result = parse_header(data)
            connecttype, remote_addr, remote_port, header_length = header_result
            common.connect_log(
                '%s connecting %s:%d from %s:%d' %
                ((connecttype == 0) and 'TCP'
                 or 'UDP', common.to_str(remote_addr), remote_port,
                 self._client_address[0], self._client_address[1]))
            self._remote_address = (common.to_str(remote_addr), remote_port)
            self._remote_udp = (connecttype != 0)
            # pause reading
            self._update_stream(STREAM_UP, WAIT_STATUS_WRITING)
            self._stage = STAGE_DNS
            if self._is_local:
                # forward address to remote
                self._write_to_sock((b'\x05\x00\x00\x01'
                                     b'\x00\x00\x00\x00\x10\x10'),
                                    self._local_sock)
                head_len = self._get_head_size(data, 30)
                self._obfs.obfs.server_info.head_len = head_len
                self._protocol.obfs.server_info.head_len = head_len
                if self._encryptor is not None:
                    data = self._protocol.client_pre_encrypt(data)
                    data_to_send = self._encryptor.encrypt(data)
                    data_to_send = self._obfs.client_encode(data_to_send)
                if data_to_send:
                    self._data_to_write_to_remote.append(data_to_send)
                # notice here may go into _handle_dns_resolved directly
                self._dns_resolver.resolve(self._chosen_server[0],
                                           self._handle_dns_resolved)
            else:
                if len(data) > header_length:
                    self._data_to_write_to_remote.append(data[header_length:])
                # notice here may go into _handle_dns_resolved directly
                self._dns_resolver.resolve(remote_addr,
                                           self._handle_dns_resolved)
        except Exception as e:
            self._log_error(e)
            if self._config['verbose']:
                traceback.print_exc()
            self.destroy()
Ejemplo n.º 57
0
def test_table_result():
    from shadowsocks.common import ord
    target1 = [
        [60, 53, 84, 138, 217, 94, 88, 23, 39, 242, 219, 35, 12, 157, 165, 181,
         255, 143, 83, 247, 162, 16, 31, 209, 190, 171, 115, 65, 38, 41, 21,
         245, 236, 46, 121, 62, 166, 233, 44, 154, 153, 145, 230, 49, 128, 216,
         173, 29, 241, 119, 64, 229, 194, 103, 131, 110, 26, 197, 218, 59, 204,
         56, 27, 34, 141, 221, 149, 239, 192, 195, 24, 155, 170, 183, 11, 254,
         213, 37, 137, 226, 75, 203, 55, 19, 72, 248, 22, 129, 33, 175, 178,
         10, 198, 71, 77, 36, 113, 167, 48, 2, 117, 140, 142, 66, 199, 232,
         243, 32, 123, 54, 51, 82, 57, 177, 87, 251, 150, 196, 133, 5, 253,
         130, 8, 184, 14, 152, 231, 3, 186, 159, 76, 89, 228, 205, 156, 96,
         163, 146, 18, 91, 132, 85, 80, 109, 172, 176, 105, 13, 50, 235, 127,
         0, 189, 95, 98, 136, 250, 200, 108, 179, 211, 214, 106, 168, 78, 79,
         74, 210, 30, 73, 201, 151, 208, 114, 101, 174, 92, 52, 120, 240, 15,
         169, 220, 182, 81, 224, 43, 185, 40, 99, 180, 17, 212, 158, 42, 90, 9,
         191, 45, 6, 25, 4, 222, 67, 126, 1, 116, 124, 206, 69, 61, 7, 68, 97,
         202, 63, 244, 20, 28, 58, 93, 134, 104, 144, 227, 147, 102, 118, 135,
         148, 47, 238, 86, 112, 122, 70, 107, 215, 100, 139, 223, 225, 164,
         237, 111, 125, 207, 160, 187, 246, 234, 161, 188, 193, 249, 252],
        [151, 205, 99, 127, 201, 119, 199, 211, 122, 196, 91, 74, 12, 147, 124,
         180, 21, 191, 138, 83, 217, 30, 86, 7, 70, 200, 56, 62, 218, 47, 168,
         22, 107, 88, 63, 11, 95, 77, 28, 8, 188, 29, 194, 186, 38, 198, 33,
         230, 98, 43, 148, 110, 177, 1, 109, 82, 61, 112, 219, 59, 0, 210, 35,
         215, 50, 27, 103, 203, 212, 209, 235, 93, 84, 169, 166, 80, 130, 94,
         164, 165, 142, 184, 111, 18, 2, 141, 232, 114, 6, 131, 195, 139, 176,
         220, 5, 153, 135, 213, 154, 189, 238, 174, 226, 53, 222, 146, 162,
         236, 158, 143, 55, 244, 233, 96, 173, 26, 206, 100, 227, 49, 178, 34,
         234, 108, 207, 245, 204, 150, 44, 87, 121, 54, 140, 118, 221, 228,
         155, 78, 3, 239, 101, 64, 102, 17, 223, 41, 137, 225, 229, 66, 116,
         171, 125, 40, 39, 71, 134, 13, 193, 129, 247, 251, 20, 136, 242, 14,
         36, 97, 163, 181, 72, 25, 144, 46, 175, 89, 145, 113, 90, 159, 190,
         15, 183, 73, 123, 187, 128, 248, 252, 152, 24, 197, 68, 253, 52, 69,
         117, 57, 92, 104, 157, 170, 214, 81, 60, 133, 208, 246, 172, 23, 167,
         160, 192, 76, 161, 237, 45, 4, 58, 10, 182, 65, 202, 240, 185, 241,
         79, 224, 132, 51, 42, 126, 105, 37, 250, 149, 32, 243, 231, 67, 179,
         48, 9, 106, 216, 31, 249, 19, 85, 254, 156, 115, 255, 120, 75, 16]]

    target2 = [
        [124, 30, 170, 247, 27, 127, 224, 59, 13, 22, 196, 76, 72, 154, 32,
         209, 4, 2, 131, 62, 101, 51, 230, 9, 166, 11, 99, 80, 208, 112, 36,
         248, 81, 102, 130, 88, 218, 38, 168, 15, 241, 228, 167, 117, 158, 41,
         10, 180, 194, 50, 204, 243, 246, 251, 29, 198, 219, 210, 195, 21, 54,
         91, 203, 221, 70, 57, 183, 17, 147, 49, 133, 65, 77, 55, 202, 122,
         162, 169, 188, 200, 190, 125, 63, 244, 96, 31, 107, 106, 74, 143, 116,
         148, 78, 46, 1, 137, 150, 110, 181, 56, 95, 139, 58, 3, 231, 66, 165,
         142, 242, 43, 192, 157, 89, 175, 109, 220, 128, 0, 178, 42, 255, 20,
         214, 185, 83, 160, 253, 7, 23, 92, 111, 153, 26, 226, 33, 176, 144,
         18, 216, 212, 28, 151, 71, 206, 222, 182, 8, 174, 205, 201, 152, 240,
         155, 108, 223, 104, 239, 98, 164, 211, 184, 34, 193, 14, 114, 187, 40,
         254, 12, 67, 93, 217, 6, 94, 16, 19, 82, 86, 245, 24, 197, 134, 132,
         138, 229, 121, 5, 235, 238, 85, 47, 103, 113, 179, 69, 250, 45, 135,
         156, 25, 61, 75, 44, 146, 189, 84, 207, 172, 119, 53, 123, 186, 120,
         171, 68, 227, 145, 136, 100, 90, 48, 79, 159, 149, 39, 213, 236, 126,
         52, 60, 225, 199, 105, 73, 233, 252, 118, 215, 35, 115, 64, 37, 97,
         129, 161, 177, 87, 237, 141, 173, 191, 163, 140, 234, 232, 249],
        [117, 94, 17, 103, 16, 186, 172, 127, 146, 23, 46, 25, 168, 8, 163, 39,
         174, 67, 137, 175, 121, 59, 9, 128, 179, 199, 132, 4, 140, 54, 1, 85,
         14, 134, 161, 238, 30, 241, 37, 224, 166, 45, 119, 109, 202, 196, 93,
         190, 220, 69, 49, 21, 228, 209, 60, 73, 99, 65, 102, 7, 229, 200, 19,
         82, 240, 71, 105, 169, 214, 194, 64, 142, 12, 233, 88, 201, 11, 72,
         92, 221, 27, 32, 176, 124, 205, 189, 177, 246, 35, 112, 219, 61, 129,
         170, 173, 100, 84, 242, 157, 26, 218, 20, 33, 191, 155, 232, 87, 86,
         153, 114, 97, 130, 29, 192, 164, 239, 90, 43, 236, 208, 212, 185, 75,
         210, 0, 81, 227, 5, 116, 243, 34, 18, 182, 70, 181, 197, 217, 95, 183,
         101, 252, 248, 107, 89, 136, 216, 203, 68, 91, 223, 96, 141, 150, 131,
         13, 152, 198, 111, 44, 222, 125, 244, 76, 251, 158, 106, 24, 42, 38,
         77, 2, 213, 207, 249, 147, 113, 135, 245, 118, 193, 47, 98, 145, 66,
         160, 123, 211, 165, 78, 204, 80, 250, 110, 162, 48, 58, 10, 180, 55,
         231, 79, 149, 74, 62, 50, 148, 143, 206, 28, 15, 57, 159, 139, 225,
         122, 237, 138, 171, 36, 56, 115, 63, 144, 154, 6, 230, 133, 215, 41,
         184, 22, 104, 254, 234, 253, 187, 226, 247, 188, 156, 151, 40, 108,
         51, 83, 178, 52, 3, 31, 255, 195, 53, 235, 126, 167, 120]]

    encrypt_table = b''.join(get_table(b'foobar!'))
    decrypt_table = maketrans(encrypt_table, maketrans(b'', b''))

    for i in range(0, 256):
        assert (target1[0][i] == ord(encrypt_table[i]))
        assert (target1[1][i] == ord(decrypt_table[i]))

    encrypt_table = b''.join(get_table(b'barfoo!'))
    decrypt_table = maketrans(encrypt_table, maketrans(b'', b''))

    for i in range(0, 256):
        assert (target2[0][i] == ord(encrypt_table[i]))
        assert (target2[1][i] == ord(decrypt_table[i]))
Ejemplo n.º 58
0
    def _handle_stage_addr(self, data):
        try:
            addr, port = self._local_sock.getpeername()[:2]
            if self._is_local:
                cmd = common.ord(data[1])
                if cmd == CMD_UDP_ASSOCIATE:
                    logging.debug('U[%d] UDP associate' %
                                  self._config['server_port'])
                    if self._local_sock.family == socket.AF_INET6:
                        header = b'\x05\x00\x00\x04'
                    else:
                        header = b'\x05\x00\x00\x01'
                    # TODO: inet_pton is added for windows in Py 3.4
                    addr_to_send = socket.inet_pton(self._local_sock.family,
                                                    addr)
                    port_to_send = struct.pack('>H', port)
                    self._write_to_sock(header + addr_to_send + port_to_send,
                                        self._local_sock)
                    self._stage = STAGE_UDP_ASSOC
                    # just wait for the client to disconnect
                    return
                elif cmd == CMD_CONNECT:
                    # just trim VER CMD RSV
                    data = data[3:]
                else:
                    logging.error('U[%d] Unknown command %d',
                                  self._config['server_port'], cmd)
                    self.destroy()
                    return
            header_result = parse_header(data)
            if header_result is None:
                raise Exception('TCP Can not parse header')

            addrtype, remote_addr, remote_port, header_length = header_result
            if self._config['firewall_ports'] and self._config[
                    'server_port'] not in self._config['firewall_trusted']:
                # Firewall enabled
                if self._config[
                        'firewall_mode'] == 'blacklist' and remote_port in self._config[
                            'firewall_ports']:
                    firewall_blocked = True
                elif self._config[
                        'firewall_mode'] == 'whitelist' and remote_port not in self._config[
                            'firewall_ports']:
                    firewall_blocked = True
                else:
                    firewall_blocked = False
            else:
                firewall_blocked = False
            if firewall_blocked:
                logging.warning('U[%d] TCP PORT BANNED: RP[%d] A[%s-->%s]' %
                                (self._config['server_port'], remote_port,
                                 addr, common.to_str(remote_addr)))
                return
            else:
                logging.info('U[%d] TCP CONN: RP[%d] A[%s-->%s]' %
                             (self._config['server_port'], remote_port, addr,
                              common.to_str(remote_addr)))
            self._remote_address = (common.to_str(remote_addr), remote_port)
            # pause reading
            self._update_stream(STREAM_UP, WAIT_STATUS_WRITING)
            self._stage = STAGE_DNS
            if self._is_local:
                # forward address to remote
                self._write_to_sock((b'\x05\x00\x00\x01'
                                     b'\x00\x00\x00\x00\x10\x10'),
                                    self._local_sock)
                key = self._cryptor.cipher_iv + self._cryptor.key
                data_to_send = self._cryptor.encrypt(data)
                self._data_to_write_to_remote.append(data_to_send)
                # notice here may go into _handle_dns_resolved directly
                self._dns_resolver.resolve(self._chosen_server[0],
                                           self._handle_dns_resolved)
            else:
                if len(data) > header_length:
                    self._data_to_write_to_remote.append(data[header_length:])
                # notice here may go into _handle_dns_resolved directly
                self._dns_resolver.resolve(remote_addr,
                                           self._handle_dns_resolved)
        except Exception as e:
            self._log_error(e)
            if self._config['verbose']:
                traceback.print_exc()
            self.destroy()
Ejemplo n.º 59
0
    def _handle_server(self):
        server = self._server_socket

        # receive request
        # note that no listen()/accept() is used as TCP
        # this is because udp doesn't require long-lived connection
        # so the server does not need to listen for and accept connections
        # It only needs to use bind() to associate its socket with a port
        # and then wait for individual messages
        # _server_socket has been bound in __init__()
        data, r_addr = server.recvfrom(BUF_SIZE)
        if not data:
            logging.debug('UDP handle_server: data is empty')
        if self._stat_callback:
            self._stat_callback(self._listen_port, len(data))

        # for a local server, request is from local client
        # if the datagram isnot standalone, drop it
        if self._is_local:

            frag = common.ord(data[2])
            # FRAG    Current fragment number
            # ord() converts it back to number
            # The FRAG field indicates whether or not this datagram is one of a number of fragments.
            # Implementation of fragmentation is optional; an implementation that
            # does not support fragmentation MUST drop any datagram whose FRAG field is other than X'00'.

            if frag != 0:
                logging.warn('drop a message since frag is not 0')
                return
            else:
                data = data[3:]

        # for a remote server, request is from local server
        # decrypt it
        # note that no removal of first 3 bytes canbe found here, guess in decryption?
        else:
            data = encrypt.encrypt_all(self._password, self._method, 0, data)
            # decrypt data
            if not data:
                logging.debug('UDP handle_server: data is empty after decrypt')
                return

        # for both local and remote server, analyse request header
        header_result = parse_header(data)
        if header_result is None:
            return
        addrtype, dest_addr, dest_port, header_length = header_result

        # set a place where a server relays request to
        # a local server relays request to remote server
        if self._is_local:
            server_addr, server_port = self._get_a_server()
        # a remote server relays request to dest, extracted from request header
        else:
            server_addr, server_port = dest_addr, dest_port

        # try to find send-socket from cache
        addrs = self._dns_cache.get(server_addr, None)
        if addrs is None:
            addrs = socket.getaddrinfo(server_addr, server_port, 0,
                                       socket.SOCK_DGRAM, socket.SOL_UDP)
            if not addrs:
                # drop
                return
            else:
                self._dns_cache[server_addr] = addrs
        af, socktype, proto, canonname, sa = addrs[0]
        key = client_key(r_addr, af)
        client = self._cache.get(key, None)

        # if not found in the cache, init a new send-socket
        # add it to the eventloop
        if not client:
            # TODO async getaddrinfo
            if self._forbidden_iplist:
                if common.to_str(sa[0]) in self._forbidden_iplist:
                    logging.debug('IP %s is in forbidden list, drop' %
                                  common.to_str(sa[0]))
                    # drop
                    return
            client = socket.socket(af, socktype, proto)
            client.setblocking(False)
            self._cache[key] = client
            self._client_fd_to_server_addr[client.fileno()] = r_addr

            self._sockets.add(client.fileno())
            self._eventloop.add(client, eventloop.POLL_IN, self)

        # process the request before relay
        # a local server relays request to remote server
        # so request should be encrypted
        if self._is_local:
            data = encrypt.encrypt_all(self._password, self._method, 1, data)
            if not data:
                return
        # a remote server relays request to dest
        # note that request has been decrypted before
        # so just relays it
        # note that udp request header is removed
        else:
            data = data[header_length:]
        if not data:
            return

        # relay the request using send-socket
        try:
            client.sendto(data, (server_addr, server_port))
        except IOError as e:
            err = eventloop.errno_from_exception(e)
            if err in (errno.EINPROGRESS, errno.EAGAIN):
                pass
            else:
                shell.print_exception(e)
Ejemplo n.º 60
0
    def _handle_stage_addr(self, data):
        try:
            addr, port = self._local_sock.getpeername()[:2]
            if self._is_local:
                cmd = common.ord(data[1])
                if cmd == CMD_UDP_ASSOCIATE:
                    logging.debug('U[%d] UDP associate' %
                                  self._config['server_port'])
                    if self._local_sock.family == socket.AF_INET6:
                        header = b'\x05\x00\x00\x04'
                    else:
                        header = b'\x05\x00\x00\x01'
                    # TODO: inet_pton is added for windows in Py 3.4
                    addr_to_send = socket.inet_pton(self._local_sock.family,
                                                    addr)
                    port_to_send = struct.pack('>H', port)
                    self._write_to_sock(header + addr_to_send + port_to_send,
                                        self._local_sock)
                    self._stage = STAGE_UDP_ASSOC
                    # just wait for the client to disconnect
                    return
                elif cmd == CMD_CONNECT:
                    # just trim VER CMD RSV
                    data = data[3:]
                else:
                    logging.error('U[%d] Unknown command %d',
                                  self._config['server_port'], cmd)
                    self.destroy()
                    return
            header_result = parse_header(data)
            if header_result is None:
                raise Exception('TCP Can not parse header')

            addrtype, remote_addr, remote_port, header_length = header_result
            if self._config['firewall_ports'] and self._config[
                    'server_port'] not in self._config['firewall_trusted']:
                # Firewall enabled
                if self._config[
                        'firewall_mode'] == 'blacklist' and remote_port in self._config[
                            'firewall_ports']:
                    firewall_blocked = True
                elif self._config[
                        'firewall_mode'] == 'whitelist' and remote_port not in self._config[
                            'firewall_ports']:
                    firewall_blocked = True
                else:
                    firewall_blocked = False
            else:
                firewall_blocked = False
            if firewall_blocked:
                logging.warning('U[%d] TCP PORT BANNED: RP[%d] A[%s-->%s]' %
                                (self._config['server_port'], remote_port,
                                 addr, common.to_str(remote_addr)))
                return
                key = self._cryptor.decipher_iv + self._cryptor.key
            else:
                logging.info('U[%d] TCP CONN: RP[%d] A[%s-->%s]' %
                             (self._config['server_port'], remote_port, addr,
                              common.to_str(remote_addr)))

            if self._is_local is False:
                # spec https://shadowsocks.org/en/spec/one-time-auth.html
                self._ota_enable_session = addrtype & ADDRTYPE_AUTH
                if self._ota_enable or (addrtype & ADDRTYPE_AUTH
                                        == ADDRTYPE_AUTH):
                    if not self._ota_enable and self._config['verbose']:
                        logging.info(
                            'U[%d] TCP one time auth automatically enabled' %
                            self._config['server_port'])
                    self._ota_enable = True
                    if len(data) < header_length + ONETIMEAUTH_BYTES:
                        logging.warn(
                            'U[%d] One time auth header is too short' %
                            self._config['server_port'])
                        return None
                    offset = header_length + ONETIMEAUTH_BYTES
                    _hash = data[header_length:offset]
                    _data = data[:header_length]
                    key = self._cryptor.decipher_iv + self._cryptor.key
                    if onetimeauth_verify(_hash, _data, key) is False:
                        logging.warn('U[%d] One time auth fail' %
                                     self._config['server_port'])
                        self.destroy()
                    header_length += ONETIMEAUTH_BYTES
            self._remote_address = (common.to_str(remote_addr), remote_port)
            # pause reading
            self._update_stream(STREAM_UP, WAIT_STATUS_WRITING)
            self._stage = STAGE_DNS
            if self._is_local:
                # forward address to remote
                self._write_to_sock((b'\x05\x00\x00\x01'
                                     b'\x00\x00\x00\x00\x10\x10'),
                                    self._local_sock)
                key = self._cryptor.cipher_iv + self._cryptor.key
                # spec https://shadowsocks.org/en/spec/one-time-auth.html
                # ATYP & 0x10 == 0x10, then OTA is enabled.
                if self._ota_enable:
                    data = common.chr(addrtype | ADDRTYPE_AUTH) + data[1:]
                    key = self._cryptor.cipher_iv + self._cryptor.key
                    data += onetimeauth_gen(data, key)
                data_to_send = self._cryptor.encrypt(data)
                self._data_to_write_to_remote.append(data_to_send)
                # notice here may go into _handle_dns_resolved directly
                self._dns_resolver.resolve(self._chosen_server[0],
                                           self._handle_dns_resolved)
            else:
                if self._ota_enable:
                    data = data[header_length:]
                    self._ota_chunk_data(data,
                                         self._data_to_write_to_remote.append)
                elif len(data) > header_length:
                    self._data_to_write_to_remote.append(data[header_length:])
                # notice here may go into _handle_dns_resolved directly
                self._dns_resolver.resolve(remote_addr,
                                           self._handle_dns_resolved)
        except Exception as e:
            self._log_error(e)
            if self._config['verbose']:
                traceback.print_exc()
            self.destroy()