X-Git-Url: https://www.tinc-vpn.org/git/browse?a=blobdiff_plain;f=src%2Fmeta.c;h=28c85cf0e6b9615866771857e8a201b6fccadb8b;hb=ee63f2a32be398c31301e9ce9154511b24089d8d;hp=1244bfd0e55478ace2a22028541c6fd30a544b63;hpb=053af97c9e729ab485609e4202f5195fdc8aeeb5;p=tinc

diff --git a/src/meta.c b/src/meta.c
index 1244bfd0..28c85cf0 100644
--- a/src/meta.c
+++ b/src/meta.c
@@ -185,7 +185,10 @@ bool receive_meta(connection_t *c) {
 
 			if(c->tcplen) {
 				char *tcpbuffer = buffer_read(&c->inbuf, c->tcplen);
-				if(tcpbuffer) {
+				if(!tcpbuffer)
+					break;
+
+				if(!c->node) {
 					if(proxytype == PROXY_SOCKS4 && c->allow_request == ID) {
 						if(tcpbuffer[0] == 0 && tcpbuffer[1] == 0x5a) {
 							logger(DEBUG_CONNECTIONS, LOG_DEBUG, "Proxy request granted");
@@ -193,13 +196,39 @@ bool receive_meta(connection_t *c) {
 							logger(DEBUG_CONNECTIONS, LOG_ERR, "Proxy request rejected");
 							return false;
 						}
-					} else
-						receive_tcppacket(c, tcpbuffer, c->tcplen);
-					c->tcplen = 0;
-					continue;
+					} else if(proxytype == PROXY_SOCKS5 && c->allow_request == ID) {
+						if(tcpbuffer[0] != 5) {
+							logger(DEBUG_CONNECTIONS, LOG_ERR, "Invalid response from proxy server");
+							return false;
+						}
+						if(tcpbuffer[1] == 0xff) {
+							logger(DEBUG_CONNECTIONS, LOG_ERR, "Proxy request rejected: unsuitable authentication method");
+							return false;
+						}
+						if(tcpbuffer[2] != 5) {
+							logger(DEBUG_CONNECTIONS, LOG_ERR, "Invalid response from proxy server");
+							return false;
+						}
+						if(tcpbuffer[3] == 0) {
+							logger(DEBUG_CONNECTIONS, LOG_DEBUG, "Proxy request granted");
+						} else {
+							logger(DEBUG_CONNECTIONS, LOG_DEBUG, "Proxy request rejected");
+							return false;
+						}
+					} else {
+						logger(DEBUG_CONNECTIONS, LOG_ERR, "c->tcplen set but c->node is NULL!");
+						abort();
+					}
 				} else {
-					break;
+					if(c->allow_request == ALL) {
+						receive_tcppacket(c, tcpbuffer, c->tcplen);
+					} else {
+						logger(DEBUG_CONNECTIONS, LOG_ERR, "Got unauthorized TCP packet from %s (%s)", c->name, c->hostname);
+						return false;
+					}
 				}
+
+				c->tcplen = 0;
 			}
 
 			/* Otherwise we are waiting for a request */