xjasonlyu / tun2socks

tun2socks - powered by gVisor TCP/IP stack
https://github.com/xjasonlyu/tun2socks/wiki
GNU General Public License v3.0
2.84k stars 403 forks source link

Fix: socks5 usernames and passwords can BOTH be up to 255 bytes #343

Closed Yawning closed 3 months ago

Yawning commented 3 months ago

This should be rather self-explanatory. The existing authentication routine limits the entire username/password request to 255 bytes, however that limit applies to the UNAME/PASSWD fields individually. My PR also enforces the RFC specified minimum of 1 byte.

https://github.com/xjasonlyu/tun2socks/blob/main/transport/socks5/rfc1929.txt#L40

2.  Initial negotiation

   Once the SOCKS V5 server has started, and the client has selected the
   Username/Password Authentication protocol, the Username/Password
   subnegotiation begins.  This begins with the client producing a
   Username/Password request:

           +----+------+----------+------+----------+
           |VER | ULEN |  UNAME   | PLEN |  PASSWD  |
           +----+------+----------+------+----------+
           | 1  |  1   | 1 to 255 |  1   | 1 to 255 |
           +----+------+----------+------+----------+
xjasonlyu commented 3 months ago

Merged, thanks!