X-Git-Url: https://www.tinc-vpn.org/git/browse?p=tinc;a=blobdiff_plain;f=src%2Fmeta.c;h=27baf8fea48018dcfa57f42958ac13ba2153641b;hp=1b3424606771b813aa3a15c096a8ad751eaafbcc;hb=c6b1643c2bcc727db4aed69bc58eb1f31903fdcf;hpb=b58d95eb29662bce4388f95dbc5762b9e2999806

diff --git a/src/meta.c b/src/meta.c
index 1b342460..27baf8fe 100644
--- a/src/meta.c
+++ b/src/meta.c
@@ -177,15 +177,45 @@ bool receive_meta(connection_t *c) {
 
 		if(c->tcplen) {
 			if(c->tcplen <= c->buflen) {
-				if(proxytype == PROXY_SOCKS4 && c->allow_request == ID) {
-					if(c->buffer[0] == 0 && c->buffer[1] == 0x5a) {
-						logger(LOG_DEBUG, "Proxy request granted");
+				if(!c->node) {
+					if(c->outgoing && proxytype == PROXY_SOCKS4 && c->allow_request == ID) {
+						if(c->buffer[0] == 0 && c->buffer[1] == 0x5a) {
+							logger(LOG_DEBUG, "Proxy request granted");
+						} else {
+							logger(LOG_ERR, "Proxy request rejected");
+							return false;
+						}
+					} else if(c->outgoing && proxytype == PROXY_SOCKS5 && c->allow_request == ID) {
+						if(c->buffer[0] != 5) {
+							logger(LOG_ERR, "Invalid response from proxy server");
+							return false;
+						}
+						if(c->buffer[1] == 0xff) {
+							logger(LOG_ERR, "Proxy request rejected: unsuitable authentication method");
+							return false;
+						}
+						if(c->buffer[2] != 5) {
+							logger(LOG_ERR, "Invalid response from proxy server");
+							return false;
+						}
+						if(c->buffer[3] == 0) {
+							logger(LOG_DEBUG, "Proxy request granted");
+						} else {
+							logger(LOG_DEBUG, "Proxy request rejected");
+							return false;
+						}
 					} else {
-						logger(LOG_ERR, "Proxy request rejected");
+						logger(LOG_ERR, "c->tcplen set but c->node is NULL!");
+						abort();
+					}
+				} else {
+					if(c->allow_request == ALL) {
+						receive_tcppacket(c, c->buffer, c->tcplen);
+					} else {
+						logger(LOG_ERR, "Got unauthorized TCP packet from %s (%s)", c->name, c->hostname);
 						return false;
 					}
-				} else 
-					receive_tcppacket(c, c->buffer, c->tcplen);
+				}
 
 				c->buflen -= c->tcplen;
 				lenin -= c->tcplen - oldlen;