+ struct PortForwarding *pf = (struct PortForwarding *) plug;
+ if (pf->dynamic) {
+ while (len--) {
+ if (pf->sockslen >= pf->sockssize) {
+ pf->sockssize = pf->sockslen * 5 / 4 + 256;
+ pf->socksbuf = sresize(pf->socksbuf, pf->sockssize, char);
+ }
+ pf->socksbuf[pf->sockslen++] = *data++;
+
+ /*
+ * Now check what's in the buffer to see if it's a
+ * valid and complete message in the SOCKS exchange.
+ */
+ if ((pf->dynamic == 1 || (pf->dynamic >> 12) == 4) &&
+ pf->socksbuf[0] == 4) {
+ /*
+ * SOCKS 4.
+ */
+ if (pf->dynamic == 1)
+ pf->dynamic = 0x4000;
+ if (pf->sockslen < 2)
+ continue; /* don't have command code yet */
+ if (pf->socksbuf[1] != 1) {
+ /* Not CONNECT. */
+ /* Send back a SOCKS 4 error before closing. */
+ char data[8];
+ memset(data, 0, sizeof(data));
+ data[1] = 91; /* generic `request rejected' */
+ sk_write(pf->s, data, 8);
+ pfd_close(pf);
+ return 1;
+ }
+ if (pf->sockslen <= 8)
+ continue; /* haven't started user/hostname */
+ if (pf->socksbuf[pf->sockslen-1] != 0)
+ continue; /* haven't _finished_ user/hostname */
+ /*
+ * Now we have a full SOCKS 4 request. Check it to
+ * see if it's a SOCKS 4A request.
+ */
+ if (pf->socksbuf[4] == 0 && pf->socksbuf[5] == 0 &&
+ pf->socksbuf[6] == 0 && pf->socksbuf[7] != 0) {
+ /*
+ * It's SOCKS 4A. So if we haven't yet
+ * collected the host name, we should continue
+ * waiting for data in order to do so; if we
+ * have, we can go ahead.
+ */
+ int len;
+ if (pf->dynamic == 0x4000) {
+ pf->dynamic = 0x4001;
+ pf->sockslen = 8; /* reset buffer to overwrite name */
+ continue;
+ }
+ pf->socksbuf[0] = 0; /* reply version code */
+ pf->socksbuf[1] = 90; /* request granted */
+ sk_write(pf->s, pf->socksbuf, 8);
+ len = pf->sockslen - 8;
+ pf->port = GET_16BIT_MSB_FIRST(pf->socksbuf+2);
+ pf->hostname = snewn(len+1, char);
+ pf->hostname[len] = '\0';
+ memcpy(pf->hostname, pf->socksbuf + 8, len);
+ goto connect;
+ } else {
+ /*
+ * It's SOCKS 4, which means we should format
+ * the IP address into the hostname string and
+ * then just go.
+ */
+ pf->socksbuf[0] = 0; /* reply version code */
+ pf->socksbuf[1] = 90; /* request granted */
+ sk_write(pf->s, pf->socksbuf, 8);
+ pf->port = GET_16BIT_MSB_FIRST(pf->socksbuf+2);
+ pf->hostname = dupprintf("%d.%d.%d.%d",
+ (unsigned char)pf->socksbuf[4],
+ (unsigned char)pf->socksbuf[5],
+ (unsigned char)pf->socksbuf[6],
+ (unsigned char)pf->socksbuf[7]);
+ goto connect;
+ }
+ }
+
+ if ((pf->dynamic == 1 || (pf->dynamic >> 12) == 5) &&
+ pf->socksbuf[0] == 5) {
+ /*
+ * SOCKS 5.
+ */
+ if (pf->dynamic == 1)
+ pf->dynamic = 0x5000;
+
+ if (pf->dynamic == 0x5000) {
+ int i, method;
+ char data[2];
+ /*
+ * We're receiving a set of method identifiers.
+ */
+ if (pf->sockslen < 2)
+ continue; /* no method count yet */
+ if (pf->sockslen < 2 + (unsigned char)pf->socksbuf[1])
+ continue; /* no methods yet */
+ method = 0xFF; /* invalid */
+ for (i = 0; i < (unsigned char)pf->socksbuf[1]; i++)
+ if (pf->socksbuf[2+i] == 0) {
+ method = 0;/* no auth */
+ break;
+ }
+ data[0] = 5;
+ data[1] = method;
+ sk_write(pf->s, data, 2);
+ pf->dynamic = 0x5001;
+ pf->sockslen = 0; /* re-empty the buffer */
+ continue;
+ }
+
+ if (pf->dynamic == 0x5001) {
+ /*
+ * We're receiving a SOCKS request.
+ */
+ unsigned char reply[10]; /* SOCKS5 atyp=1 reply */
+ int atype, alen = 0;
+
+ /*
+ * Pre-fill reply packet.
+ * In all cases, we set BND.{HOST,ADDR} to 0.0.0.0:0
+ * (atyp=1) in the reply; if we succeed, we don't know
+ * the right answers, and if we fail, they should be
+ * ignored.
+ */
+ memset(reply, 0, lenof(reply));
+ reply[0] = 5; /* VER */
+ reply[3] = 1; /* ATYP = 1 (IPv4, 0.0.0.0:0) */
+
+ if (pf->sockslen < 6) continue;
+ atype = (unsigned char)pf->socksbuf[3];
+ if (atype == 1) /* IPv4 address */
+ alen = 4;
+ if (atype == 4) /* IPv6 address */
+ alen = 16;
+ if (atype == 3) /* domain name has leading length */
+ alen = 1 + (unsigned char)pf->socksbuf[4];
+ if (pf->sockslen < 6 + alen) continue;
+ if (pf->socksbuf[1] != 1 || pf->socksbuf[2] != 0) {
+ /* Not CONNECT or reserved field nonzero - error */
+ reply[1] = 1; /* generic failure */
+ sk_write(pf->s, (char *) reply, lenof(reply));
+ pfd_close(pf);
+ return 1;
+ }
+ /*
+ * Now we have a viable connect request. Switch
+ * on atype.
+ */
+ pf->port = GET_16BIT_MSB_FIRST(pf->socksbuf+4+alen);
+ if (atype == 1) {
+ /* REP=0 (success) already */
+ sk_write(pf->s, (char *) reply, lenof(reply));
+ pf->hostname = dupprintf("%d.%d.%d.%d",
+ (unsigned char)pf->socksbuf[4],
+ (unsigned char)pf->socksbuf[5],
+ (unsigned char)pf->socksbuf[6],
+ (unsigned char)pf->socksbuf[7]);
+ goto connect;
+ } else if (atype == 3) {
+ /* REP=0 (success) already */
+ sk_write(pf->s, (char *) reply, lenof(reply));
+ pf->hostname = snewn(alen, char);
+ pf->hostname[alen-1] = '\0';
+ memcpy(pf->hostname, pf->socksbuf + 5, alen-1);
+ goto connect;
+ } else {
+ /*
+ * Unknown address type. (FIXME: support IPv6!)
+ */
+ reply[1] = 8; /* atype not supported */
+ sk_write(pf->s, (char *) reply, lenof(reply));
+ pfd_close(pf);
+ return 1;
+ }
+ }
+ }
+
+ /*
+ * If we get here without either having done `continue'
+ * or `goto connect', it must be because there is no
+ * sensible interpretation of what's in our buffer. So
+ * close the connection rudely.
+ */
+ pfd_close(pf);
+ return 1;
+ }
+ return 1;