authentication doesn't work with os x

[melnikaite]

Running microsocks -u 1 -P 1

When I do curl -U '1:1' --socks5 x.x.x.x http://icanhazip.com it works fine

When I set the same creds in OS X 10.14.4 settings curl http://icanhazip.com shows real ip and Chrome shows ERR_SOCKS_CONNECTION_FAILED

Not sure if this related to the issue but when I set proxy via cli sudo networksetup -setsocksfirewallproxy Ethernet x.x.x.x 1080 on 1 1 it shows error error -25299 attempting to create account and password for proxy

[rofl0r]

thanks, very interesting. could you do a network packet recording (for example with wireshark or tcpdump), once with curl and once with mac settings and share the differences (or the pcap, so i can try to figure it out myself) ?

[melnikaite]

I see the difference in first request

curl

Frame 20930: 71 bytes on wire (568 bits), 71 bytes captured (568 bits) on interface 0
Ethernet II, Src: Apple_26:5b:35 (40:6c:8f:26:5b:35), Dst: Routerbo_a5:51:11 (b8:69:f4:a5:51:11)
Internet Protocol Version 4, Src: 172.20.200.95, Dst: x.x.x.x
Transmission Control Protocol, Src Port: 59661, Dst Port: 1080, Seq: 1, Ack: 1, Len: 5
Socks Protocol
    Version: 5
    Client Authentication Methods
        Authentication Method Count: 3
        Method[0]: 0 (No authentication)
        Method[1]: 1 (GSSAPI)
        Method[2]: 2 (Username/Password)

system

Frame 24952: 69 bytes on wire (552 bits), 69 bytes captured (552 bits) on interface 0
Ethernet II, Src: Apple_26:5b:35 (40:6c:8f:26:5b:35), Dst: Routerbo_a5:51:11 (b8:69:f4:a5:51:11)
Internet Protocol Version 4, Src: 172.20.200.95, Dst: x.x.x.x
Transmission Control Protocol, Src Port: 59986, Dst Port: 1080, Seq: 1, Ack: 1, Len: 3
Socks Protocol
    Version: 5
    Client Authentication Methods
        Authentication Method Count: 1
        Method[0]: 0 (No authentication)

It's strange, because I see fields for credentials

[rofl0r]

When I set the same creds in OS X 10.14.4 settings curl http://icanhazip.com shows real ip

apparently curl doesn't use the systemwide proxy settings of OSX

Method[0]: 0 (No authentication)

If you use chrome with the systemwide socks settings, are there further packets sent to the proxy after the first one you showed here ?

[melnikaite]

Next package is response from from microsocks

Frame 2909: 68 bytes on wire (544 bits), 68 bytes captured (544 bits) on interface 0
Ethernet II, Src: Routerbo_a5:51:11 (b8:69:f4:a5:51:11), Dst: Apple_26:5b:35 (40:6c:8f:26:5b:35)
Internet Protocol Version 4, Src: 116.203.148.99, Dst: 172.20.200.95
Transmission Control Protocol, Src Port: 1080, Dst Port: 52393, Seq: 1, Ack: 4, Len: 2
Socks Protocol
    Version: 5
    Accepted Auth Method: 0xff (no acceptable method)

After that no more communication, so for each attempt I see with socks filter just two entries

[rofl0r]

thanks. i just re-read rfc1928 and the behaviour of microsocks is as specified.

however, you may want to try out the following change

                 n_methods--;
         }
-        return AM_INVALID;
+        return AM_USERNAME;

 }

[melnikaite]

No, authentication doesn't work, because OS X says that the only supported auth method is No authentication and doesn't send credentials. It seems the only option for me is paid proxifier

[rofl0r]

you could use a local tinyproxy running on your localhost, with a socks5 upstream directive pointing to your microsocks proxy

(i've heard that you need to use the branch threads for mac os x working properly, which is in this PR to tinyproxy)

then configure chromium etc to use the local http proxy

or you simpy use the auth-once parameter to microsocks, and authenticate your ip once via curl on the command line.

[amircybersec]

I believe this issue is related to MacOS support for Socks; I am experiencing the same issue and based on my findings, it does not support username/password authentication even though it has fields for username & password. This is the error the server shows when I choose authentication:

socks5: 2024/03/08 21:45:36 [E]: server: failed to authenticate: no supported authentication mechanism

It works well with no authentication set though...