ginuerzh
91920aa805
Move SetDefaultTLSConfig before register(cfg) in loader.go so ParseService can access it when building handlers. Also add a defensive nil check in socks5 serverSelector.Select() for MethodTLS to prevent future ordering regressions. Root cause: in selector.go, Select() tried to read ClientHello via TLSConfig.GetConfigForClient but s.TLSConfig was nil because register(cfg) -> ParseService -> handler Init ran before SetDefaultTLSConfig was called from loader.go.
103 lines
2.4 KiB
Go
103 lines
2.4 KiB
Go
package v5
|
|
|
|
import (
|
|
"context"
|
|
"crypto/tls"
|
|
"net"
|
|
|
|
"github.com/go-gost/core/auth"
|
|
"github.com/go-gost/core/logger"
|
|
"github.com/go-gost/gosocks5"
|
|
xctx "github.com/go-gost/x/ctx"
|
|
"github.com/go-gost/x/internal/util/socks"
|
|
)
|
|
|
|
type serverSelector struct {
|
|
service string
|
|
methods []uint8
|
|
Authenticator auth.Authenticator
|
|
TLSConfig *tls.Config
|
|
logger logger.Logger
|
|
noTLS bool
|
|
}
|
|
|
|
func (selector *serverSelector) Methods() []uint8 {
|
|
return selector.methods
|
|
}
|
|
|
|
func (s *serverSelector) Select(methods ...uint8) (method uint8) {
|
|
s.logger.Debugf("%d %d %v", gosocks5.Ver5, len(methods), methods)
|
|
method = gosocks5.MethodNoAuth
|
|
for _, m := range methods {
|
|
if m == socks.MethodTLS && !s.noTLS && s.TLSConfig != nil {
|
|
method = m
|
|
break
|
|
}
|
|
}
|
|
|
|
// when Authenticator is set, auth is mandatory
|
|
if s.Authenticator != nil {
|
|
if method == gosocks5.MethodNoAuth {
|
|
method = gosocks5.MethodUserPass
|
|
}
|
|
if method == socks.MethodTLS && !s.noTLS {
|
|
method = socks.MethodTLSAuth
|
|
}
|
|
}
|
|
|
|
return
|
|
}
|
|
|
|
func (s *serverSelector) OnSelected(method uint8, conn net.Conn) (string, net.Conn, error) {
|
|
s.logger.Debugf("%d %d", gosocks5.Ver5, method)
|
|
switch method {
|
|
case gosocks5.MethodNoAuth:
|
|
|
|
case socks.MethodTLS:
|
|
conn = tls.Server(conn, s.TLSConfig)
|
|
|
|
case gosocks5.MethodUserPass, socks.MethodTLSAuth:
|
|
if method == socks.MethodTLSAuth {
|
|
conn = tls.Server(conn, s.TLSConfig)
|
|
}
|
|
|
|
req, err := gosocks5.ReadUserPassRequest(conn)
|
|
if err != nil {
|
|
s.logger.Error(err)
|
|
return "", nil, err
|
|
}
|
|
s.logger.Trace(req)
|
|
|
|
var id string
|
|
if s.Authenticator != nil {
|
|
var ok bool
|
|
ctx := xctx.ContextWithSrcAddr(context.Background(), conn.RemoteAddr())
|
|
id, ok = s.Authenticator.Authenticate(ctx, req.Username, req.Password, auth.WithService(s.service))
|
|
if !ok {
|
|
resp := gosocks5.NewUserPassResponse(gosocks5.UserPassVer, gosocks5.Failure)
|
|
if err := resp.Write(conn); err != nil {
|
|
s.logger.Error(err)
|
|
return "", nil, err
|
|
}
|
|
s.logger.Info(resp)
|
|
|
|
return "", nil, gosocks5.ErrAuthFailure
|
|
}
|
|
}
|
|
|
|
resp := gosocks5.NewUserPassResponse(gosocks5.UserPassVer, gosocks5.Succeeded)
|
|
s.logger.Trace(resp)
|
|
if err := resp.Write(conn); err != nil {
|
|
s.logger.Error(err)
|
|
return "", nil, err
|
|
}
|
|
return id, conn, nil
|
|
|
|
case gosocks5.MethodNoAcceptable:
|
|
return "", nil, gosocks5.ErrBadMethod
|
|
default:
|
|
return "", nil, gosocks5.ErrBadFormat
|
|
}
|
|
return "", conn, nil
|
|
}
|