Socks5协议简介

Posted

tags:

篇首语：本文由小常识网(cha138.com)小编为大家整理，主要介绍了Socks5协议简介相关的知识，希望对你有一定的参考价值。

参考技术A

socks5是一个代理协议，主要的作用就是代理客户端来访问远程服务器，起到一个中介作用。

一般情况下当代理客户端因为防火墙等原因访问不了远程服务器，而另一个服务器即可以访问远程服务器又可以被客户端访问到时，可以在这个服务器上部署socks5服务端，本地部署socks5客户端，让这个中介服务器来代理访问远程服务器。

下面介绍协议流程，可以简单分为握手阶段,准备阶段和代理阶段

客户端建立和代理服的tcp连接A，并发送第一帧数据:

VER:协议版本号，socks5情况下为0x05

代理服务器收到后，会鉴别VER，回应

METHOD:身份验证方法，不需要身份验证时为0x00,此时直接进入”准备阶段“（不为0x00时，需要走身份验证流程，参见 socks5身份验证 ）

客户端发送第二帧数据：

CMD:命令,tcp代理0x01,udp代理0x03
RSV:保留字段
ATYP:地址类型 0x01:ipv4,0x03:域名,0x04:ipv6
DST.ADDR:目标地址
DST.PORT:目标端口
比如数据 ：0x05|0x01|0x00|0x03|0x0d7777772e62616964752e636f6d|0x01bb
代表需要代理的是tcp连接，目标地址类型是域名，真实解析出来目标地址就是" www.baidu.com:443 "，即告诉代理服，帮我和" www.baidu.com:443 "作代理吧

代理服收到后，就直接建立和DST.ADDR的tcp连接B，回复

REP:状态位，0x00代表连接DST.ADDR成功了
RSV:保留字段
ATYP:地址类型 0x01:ipv4,0x03:域名,0x04:ipv6
BND.ADDR:绑定地址，连接B的本地地址
BND.PORT:绑定端口，连接B的本地端口
比如，返回0x05|0x00|0x00|0x01|0xc0a8c76a|0xcdf0，代表准备代理成功了，进入下一步吧

客户端把发给目标服的数据由连接A发给代理服，代理服将这些数据转由连接B发给目标服，同时代理服收到的目标服数据转由连接A返回给客户端

以上是整个socks5代理的tcp代理流程的简单流程，udp代理会复杂些，后面会单独写一篇，
想详细了解的可以参照我的golang实现 https://github.com/0990/socks5

RFC1928-SOCKS Protocol Version 5

自己动手开发Socks5代理服务器

 

一、Socks5协议简介

socks5是基于传输层的协议，客户端和服务器经过两次握手协商之后服务端为客户端建立一条到目标服务器的通道，在传输层转发TCP/UDP流量。

关于socks5协议规范，到处都可以找到，我再重复一遍也没啥意思，因此不再赘述，可以参见rfc1928（英文），或者查阅维基百科SOCKS5 - 维基百科（中文）。

 

二、代码实现

基于socks5进行了一个代理服务器的简单实现，认证方式没有做，客户端和服务器只是简单的进行两次握手即开始转发数据。

package cc11001100.proxyServerDev.socks5;

import java.io.Closeable;
import java.io.IOException;
import java.io.InputStream;
import java.io.OutputStream;
import java.net.InetAddress;
import java.net.ServerSocket;
import java.net.Socket;
import java.net.UnknownHostException;
import java.nio.ByteBuffer;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.List;
import java.util.UUID;
import java.util.concurrent.TimeUnit;
import java.util.concurrent.atomic.AtomicInteger;

/**
 * socks5代理服务器简单实现
 *
 * <a>https://www.ietf.org/rfc/rfc1928.txt</a>
 * <p>
 * <p>
 * 使用socks5代理的坑，域名在本地解析还是在代理服务器端解析，有些比如google.com就必须在代理服务器端解析
 * <a>https://blog.emacsos.com/use-socks5-proxy-in-curl.html</a>
 *
 * @author CC11001100
 */
public class Socks5ProxyServer {

	// 服务监听在哪个端口上
	private static final Integer SERVICE_LISTENER_PORT = 10086;

	// 能够允许的最大客户端数量
	private static final Integer MAX_CLIENT_NUM = 100;

	// 用于统计客户端的数量
	private static AtomicInteger clientNumCount = new AtomicInteger();

	// socks协议的版本，固定为5
	private static final byte VERSION = 0X05;
	// RSV，必须为0
	private static final byte RSV = 0X00;

	private static String SERVER_IP_ADDRESS;

	static {
		try {
			SERVER_IP_ADDRESS = InetAddress.getLocalHost().getHostAddress();
		} catch (UnknownHostException e) {
			e.printStackTrace();
		}
	}

	public static class ClientHandler implements Runnable {

		private Socket clientSocket;
		private String clientIp;
		private int clientPort;

		public ClientHandler(Socket clientSocket) {
			this.clientSocket = clientSocket;
			this.clientIp = clientSocket.getInetAddress().getHostAddress();
			this.clientPort = clientSocket.getPort();
		}

		@Override
		public void run() {
			try {

				// 协商认证方法
				negotiationCertificationMethod();

				// 开始处理客户端的命令
				handleClientCommand();

			} catch (Exception e) {
				handleLog("exception, " + e.getMessage());
			} finally {
				close(clientSocket);
				handleLog("client dead, current client count=%s", clientNumCount.decrementAndGet());
			}
		}

		// 协商与客户端的认证方法
		private void negotiationCertificationMethod() throws IOException {
			InputStream is = clientSocket.getInputStream();
			OutputStream os = clientSocket.getOutputStream();
			byte[] buff = new byte[255];
			// 接收客户端的支持的方法
			is.read(buff, 0, 2);
			int version = buff[0];
			int methodNum = buff[1];

			if (version != VERSION) {
				throw new RuntimeException("version must 0X05");
			} else if (methodNum < 1) {
				throw new RuntimeException("method num must gt 0");
			}

			is.read(buff, 0, methodNum);
			List<METHOD> clientSupportMethodList = METHOD.convertToMethod(Arrays.copyOfRange(buff, 0, methodNum));
			handleLog("version=%s, methodNum=%s, clientSupportMethodList=%s", version, methodNum, clientSupportMethodList);

			// 向客户端发送回应，这里不进行认证
			buff[0] = VERSION;
			buff[1] = METHOD.NO_AUTHENTICATION_REQUIRED.rangeStart;
			os.write(buff, 0, 2);
			os.flush();
		}

		// 认证通过，开始处理客户端发送过来的指令
		private void handleClientCommand() throws IOException {
			InputStream is = clientSocket.getInputStream();
			OutputStream os = clientSocket.getOutputStream();
			byte[] buff = new byte[255];
			// 接收客户端命令
			is.read(buff, 0, 4);
			int version = buff[0];
			COMMAND command = COMMAND.convertToCmd(buff[1]);
			int rsv = buff[2];
			ADDRESS_TYPE addressType = ADDRESS_TYPE.convertToAddressType(buff[3]);
			if (rsv != RSV) {
				throw new RuntimeException("RSV must 0X05");
			} else if (version != VERSION) {
				throw new RuntimeException("VERSION must 0X05");
			} else if (command == null) {
				// 不支持的命令
				sendCommandResponse(COMMAND_STATUS.COMMAND_NOT_SUPPORTED);
				handleLog("not supported command");
				return;
			} else if (addressType == null) {
				// 不支持的地址类型
				sendCommandResponse(COMMAND_STATUS.ADDRESS_TYPE_NOT_SUPPORTED);
				handleLog("address type not supported");
				return;
			}

			String targetAddress = "";
			switch (addressType) {
				case DOMAIN:
					// 如果是域名的话第一个字节表示域名的长度为n，紧接着n个字节表示域名
					is.read(buff, 0, 1);
					int domainLength = buff[0];
					is.read(buff, 0, domainLength);
					targetAddress = new String(Arrays.copyOfRange(buff, 0, domainLength));
					break;
				case IPV4:
					// 如果是ipv4的话使用固定的4个字节表示地址
					is.read(buff, 0, 4);
					targetAddress = ipAddressBytesToString(buff);
					break;
				case IPV6:
					throw new RuntimeException("not support ipv6.");
			}

			is.read(buff, 0, 2);
			int targetPort = ((buff[0] & 0XFF) << 8) | (buff[1] & 0XFF);

			StringBuilder msg = new StringBuilder();
			msg.append("version=").append(version).append(", cmd=").append(command.name())
					.append(", addressType=").append(addressType.name())
					.append(", domain=").append(targetAddress).append(", port=").append(targetPort);
			handleLog(msg.toString());

			// 响应客户端发送的命令，暂时只实现CONNECT命令
			switch (command) {
				case CONNECT:
					handleConnectCommand(targetAddress, targetPort);
				case BIND:
					throw new RuntimeException("not support command BIND");
				case UDP_ASSOCIATE:
					throw new RuntimeException("not support command UDP_ASSOCIATE");
			}

		}

		// convert ip address from 4 byte to string
		private String ipAddressBytesToString(byte[] ipAddressBytes) {
			// first convert to int avoid negative
			return (ipAddressBytes[0] & 0XFF) + "." + (ipAddressBytes[1] & 0XFF) + "." + (ipAddressBytes[2] & 0XFF) + "." + (ipAddressBytes[3] & 0XFF);
		}

		// 处理CONNECT命令
		private void handleConnectCommand(String targetAddress, int targetPort) throws IOException {
			Socket targetSocket = null;
			try {
				targetSocket = new Socket(targetAddress, targetPort);
			} catch (IOException e) {
				sendCommandResponse(COMMAND_STATUS.GENERAL_SOCKS_SERVER_FAILURE);
				return;
			}
			sendCommandResponse(COMMAND_STATUS.SUCCEEDED);
			new SocketForwarding(clientSocket, targetSocket).start();
		}

		private void sendCommandResponse(COMMAND_STATUS commandStatus) throws IOException {
			OutputStream os = clientSocket.getOutputStream();
			os.write(buildCommandResponse(commandStatus.rangeStart));
			os.flush();
		}

		private byte[] buildCommandResponse(byte commandStatusCode) {
			ByteBuffer payload = ByteBuffer.allocate(100);
			payload.put(VERSION);
			payload.put(commandStatusCode);
			payload.put(RSV);
//			payload.put(ADDRESS_TYPE.IPV4.value);
//			payload.put(SERVER_IP_ADDRESS.getBytes());
			payload.put(ADDRESS_TYPE.DOMAIN.value);
			byte[] addressBytes = SERVER_IP_ADDRESS.getBytes();
			payload.put((byte) addressBytes.length);
			payload.put(addressBytes);
			payload.put((byte) (((SERVICE_LISTENER_PORT & 0XFF00) >> 8)));
			payload.put((byte) (SERVICE_LISTENER_PORT & 0XFF));
			byte[] payloadBytes = new byte[payload.position()];
			payload.flip();
			payload.get(payloadBytes);
			return payloadBytes;
		}

		private void handleLog(String format, Object... args) {
			log("handle, clientIp=" + clientIp + ", port=" + clientPort + ", " + format, args);
		}

	}

	// 用来连接客户端和目标服务器转发流量
	public static class SocketForwarding {

		// 客户端socket
		private Socket clientSocket;
		private String clientIp;
		// 目标地址socket
		private Socket targetSocket;
		private String targetAddress;
		private int targetPort;

		public SocketForwarding(Socket clientSocket, Socket targetSocket) {
			this.clientSocket = clientSocket;
			this.clientIp = clientSocket.getInetAddress().getHostAddress();
			this.targetSocket = targetSocket;
			this.targetAddress = targetSocket.getInetAddress().getHostAddress();
			this.targetPort = targetSocket.getPort();
		}

		public void start() {
			OutputStream clientOs = null;
			InputStream clientIs = null;
			InputStream targetIs = null;
			OutputStream targetOs = null;
			long start = System.currentTimeMillis();
			try {

				clientOs = clientSocket.getOutputStream();
				clientIs = clientSocket.getInputStream();
				targetOs = targetSocket.getOutputStream();
				targetIs = targetSocket.getInputStream();

				// 512K，因为会有很多个线程同时申请buff空间，所以不要太大以以防OOM
				byte[] buff = new byte[1024 * 512];
				while (true) {

					boolean needSleep = true;
					while (clientIs.available() != 0) {
						int n = clientIs.read(buff);
						targetOs.write(buff, 0, n);
						transientLog("client to remote, bytes=%d", n);
						needSleep = false;
					}

					while (targetIs.available() != 0) {
						int n = targetIs.read(buff);
						clientOs.write(buff, 0, n);
						transientLog("remote to client, bytes=%d", n);
						needSleep = false;
					}

					if (clientSocket.isClosed()) {
						transientLog("client closed");
						break;
					}

					// 会话最多30秒超时，防止有人占着线程老不释放
					if (System.currentTimeMillis() - start > 30_000) {
						transientLog("time out");
						break;
					}

					// 如果本次循环没有数据传输，说明管道现在不繁忙，应该休息一下把资源让给别的线程
					if (needSleep) {
						try {
							TimeUnit.MILLISECONDS.sleep(10);
						} catch (InterruptedException e) {
							e.printStackTrace();
						}
					}

				}
			} catch (IOException e) {
				transientLog("conn exception" + e.getMessage());
			} finally {
				close(clientIs);
				close(clientOs);
				close(targetIs);
				close(targetOs);
				close(clientSocket);
				close(targetSocket);
			}
			transientLog("done.");
		}

		private void transientLog(String format, Object... args) {
			log("forwarding, clientIp=" + clientIp + ", targetAddress=" + targetAddress + ", port=" + targetPort + ", " + format, args);
		}

	}

	// 客户端认证方法
	public static enum METHOD {

		NO_AUTHENTICATION_REQUIRED((byte) 0X00, (byte) 0X00, "NO AUTHENTICATION REQUIRED"),
		GSSAPI((byte) 0X01, (byte) 0X01, "GSSAPI"),
		USERNAME_PASSWORD((byte) 0X02, (byte) 0X02, " USERNAME/PASSWORD"),
		IANA_ASSIGNED((byte) 0X03, (byte) 0X07, "IANA ASSIGNED"),
		RESERVED_FOR_PRIVATE_METHODS((byte) 0X80, (byte) 0XFE, "RESERVED FOR PRIVATE METHODS"),
		NO_ACCEPTABLE_METHODS((byte) 0XFF, (byte) 0XFF, "NO ACCEPTABLE METHODS");

		private byte rangeStart;
		private byte rangeEnd;
		private String description;

		METHOD(byte rangeStart, byte rangeEnd, String description) {
			this.rangeStart = rangeStart;
			this.rangeEnd = rangeEnd;
			this.description = description;
		}

		public boolean isMe(byte value) {
			return value >= rangeStart && value <= rangeEnd;
		}

		public static List<METHOD> convertToMethod(byte[] methodValues) {
			List<METHOD> methodList = new ArrayList<>();
			for (byte b : methodValues) {
				for (METHOD method : METHOD.values()) {
					if (method.isMe(b)) {
						methodList.add(method);
						break;
					}
				}
			}
			return methodList;
		}

	}

	// 客户端命令
	public static enum COMMAND {
		CONNECT((byte) 0X01, "CONNECT"),
		BIND((byte) 0X02, "BIND"),
		UDP_ASSOCIATE((byte) 0X03, "UDP ASSOCIATE");

		byte value;
		String description;

		COMMAND(byte value, String description) {
			this.value = value;
			this.description = description;
		}

		public static COMMAND convertToCmd(byte value) {
			for (COMMAND cmd : COMMAND.values()) {
				if (cmd.value == value) {
					return cmd;
				}
			}
			return null;
		}

	}

	// 要请求的地址类型
	public static enum ADDRESS_TYPE {
		IPV4((byte) 0X01, "the address is a version-4 IP address, with a length of 4 octets"),
		DOMAIN((byte) 0X03, "the address field contains a fully-qualified domain name.  The first\\n" +
				"   octet of the address field contains the number of octets of name that\\n" +
				"   follow, there is no terminating NUL octet."),
		IPV6((byte) 0X04, "the address is a version-6 IP address, with a length of 16 octets.");
		byte value;
		String description;

		ADDRESS_TYPE(byte value, String description) {
			this.value = value;
			this.description = description;
		}

		public static ADDRESS_TYPE convertToAddressType(byte value) {
			for (ADDRESS_TYPE addressType : ADDRESS_TYPE.values()) {
				if (addressType.value == value) {
					return addressType;
				}
			}
			return null;
		}

	}

	// 对于命令的处理结果
	public static enum COMMAND_STATUS {
		SUCCEEDED((byte) 0X00, (byte) 0X00, "succeeded"),
		GENERAL_SOCKS_SERVER_FAILURE((byte) 0X01, (byte) 0X01, "general SOCKS server failure"),
		CONNECTION_NOT_ALLOWED_BY_RULESET((byte) 0X02, (byte) 0X02, "connection not allowed by ruleset"),
		NETWORK_UNREACHABLE((byte) 0X03, (byte) 0X03, "Network unreachable"),
		HOST_UNREACHABLE((byte) 0X04, (byte) 0X04, "Host unreachable"),
		CONNECTION_REFUSED((byte) 0X05, (byte) 0X05, "Connection refused"),
		TTL_EXPIRED((byte) 0X06, (byte) 0X06, "TTL expired"),
		COMMAND_NOT_SUPPORTED((byte) 0X07, (byte) 0X07, "Command not supported"),
		ADDRESS_TYPE_NOT_SUPPORTED((byte) 0X08, (byte) 0X08, "Address type not supported"),
		UNASSIGNED((byte) 0X09, (byte) 0XFF, "unassigned");

		private byte rangeStart;
		private byte rangeEnd;
		private String description;

		COMMAND_STATUS(byte rangeStart, byte rangeEnd, String description) {
			this.rangeStart = rangeStart;
			this.rangeEnd = rangeEnd;
			this.description = description;
		}

	}

	private synchronized static void log(String format, Object... args) {
		System.out.println(String.format(format, args));
	}

	private static void close(Closeable closeable) {
		if (closeable != null) {
			try {
				closeable.close();
			} catch (IOException e) {
				e.printStackTrace();
			}
		}
	}

	public static void main(String[] args) throws IOException {

		ServerSocket serverSocket = new ServerSocket(SERVICE_LISTENER_PORT);
		while (true) {
			Socket socket = serverSocket.accept();
			if (clientNumCount.get() >= MAX_CLIENT_NUM) {
				log("client num run out.");
				continue;
			}
			log("new client, ip=%s:%d, current client count=%s", socket.getInetAddress(), socket.getPort(), clientNumCount.get());
			clientNumCount.incrementAndGet();
			new Thread(new ClientHandler(socket), "client-handler-" + UUID.randomUUID().toString()).start();
		}

	}

}

验证一下开发的这个代理服务器究竟能不能用呢？

这里使用一台国外拨号主机做实验，将自己写的代理服务器部署上去，新建一个Java文件将上面的代码粘贴进去删除第一行的package信息然后编译运行：

javac Socks5ProxyServer.java
java Socks5ProxyServer

在Chrome浏览器的SwitchyOmega中新增一个情景模式，配置刚刚启动的socks5代理：

image

然后使用这个情景模式打开百度，查看自己当前的ip：

image

查看启动的服务器控制台打印信息：

image 

 

三、使用socks5需要注意的坑

在客户端访问域名的时候，涉及到一个问题，这个域名是应该是客户端解析完告诉代理服务器ip还是应该把域名交给代理服务器去解析？

一般客户端的默认行为是域名在客户端解析，然后再将解析出来的ip拿给代理服务器去处理，但是对于一些网站来说通过ip访问是不成功的，比如google的dns解析，国内机器解析到的ip可能已经被污染，笔者实验发现对于在阿里云服务器访问google解析到的ip 74.86.151.162:443，通过ip访问是不能成功的，而在微软云机器上解析到的ip 172.217.161.164:443，通过ip可以访问成功，将域名交给代理服务器，代理服务器在美国，解析到的ip是能够访问成功的，所以在使用socks5的时候最好能够指明域名是在本地解析还是在代理服务器解析：

默认是在本地解析完将ip传给代理服务器：

curl --socks5 "23.225.xxx.xxx:10086" https://www.google.com

image

通过socks5-hostname指定域名交给代理服务器解析

curl --socks5-hostname "23.225.xxx.xxx:10086" "https://www.google.com"

image 

curl中关于这部分的说明：

--socks5-hostname <host[:port]>
       Use the specified SOCKS5 proxy (and let the proxy resolve the host name). If the port number is not specified, it is assumed at port 1080. (Added in 7.18.0)

       This option overrides any previous use of -x, --proxy, as they are mutually exclusive.

       Since 7.21.7, this option is superfluous since you can specify a socks5 hostname proxy with -x, --proxy using a socks5h:// protocol prefix.

       If this option is used several times, the last one will be used. (This option was previously wrongly documented and used as --socks without the number appended.)

--socks5 <host[:port]>
       Use the specified SOCKS5 proxy - but resolve the host name locally. If the port number is not specified, it is assumed at port 1080.

       This option overrides any previous use of -x, --proxy, as they are mutually exclusive.

       Since 7.21.7, this option is superfluous since you can specify a socks5 proxy with -x, --proxy using a socks5:// protocol prefix.

       If this option is used several times, the last one will be used. (This option was previously wrongly documented and used as --socks without the number appended.)

       This option (as well as --socks4) does not work with IPV6, FTPS or LDAP.

Chrome浏览器的SwitchyOmega的socks5代理是会将域名传给代理服务器解析。

 

 

相关资料：

1. SOCKS5 - 维基百科

2. rfc1928

 

.

以上是关于Socks5协议简介的主要内容，如果未能解决你的问题，请参考以下文章

自己动手开发Socks5代理服务器

#yyds干货盘点#网络协议之:还在用HTTP代理?弱爆了!快试试SOCKS5

Socks5 udp代理

socks5代理使用和安装配置

SOCKS5代理的介绍

怎么开socks5代理，！