mucinoab opened a new issue, #911:
URL: https://github.com/apache/mina-sshd/issues/911
### Version
2.15.0
### Bug description
When a client connects through the dynamic SOCKS5 proxy started with
`ClientSession.startDynamicPortForwarding(...)`, two things go wrong:
1. If the greeting or the CONNECT request arrives split across several
reads, the proxy throws `BufferException: Underflow` and closes the
connection.
2. If the client sends data right after the CONNECT request, in the same
write, the proxy sends those bytes back to the client inside the CONNECT
reply. The data never reaches the destination.
This breaks any protocol that starts sending immediately after CONNECT.
Cause, in `SocksProxy.Socks5`: each read is parsed as if it were one
complete SOCKS5 message (no bytes are kept between reads), and the CONNECT
request buffer is reused as the reply buffer.
### Actual behavior
- Fragmented greeting/CONNECT: proxy throws and closes the connection.
- Pipelined CONNECT+data: client receives a reply containing request and/or
application bytes; the payload is not forwarded (or not forwarded exactly
once) to the destination.
In other words, the proxy corrupts the data instead of just passing it.
### Expected behavior
- A message split across several reads is parsed correctly: the proxy waits
until it is complete.
- Data sent after the CONNECT request reaches the destination, in order,
exactly once.
The proxy should pass bytes through untouched for any TCP payload, including
TLS/mTLS.
### Relevant log output
```Shell
org.apache.sshd.common.util.buffer.BufferException: Underflow: no available
bytes in buffer
at
org.apache.sshd.common.util.buffer.ByteArrayBuffer.getByte(ByteArrayBuffer.java:209)
at org.apache.sshd.common.util.buffer.Buffer.getUByte(Buffer.java:284)
at
org.apache.sshd.common.forward.SocksProxy$Proxy.getUByte(SocksProxy.java:117)
at
org.apache.sshd.common.forward.SocksProxy$Socks5.onMessage(SocksProxy.java:258)
at
org.apache.sshd.common.forward.SocksProxy.messageReceived(SocksProxy.java:85)
at
org.apache.sshd.common.io.nio2.Nio2Session.handleReadCycleCompletion(Nio2Session.java:409)
```
### Other information
I will try to drop a PR with the fix soon.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
