我正在尝试编写一个C代码,通过SOCKS5代理服务器打开与远程服务器的SSL连接。
我已成功打开与SOCKS5代理服务器的tcp连接。但是,我不知道如何与远程服务器建立SSL连接(与代理服务器不同)。
// p->ai_addr has the SOCKS5 proxy address
m_sock_fd = socket(p->ai_family, p->ai_socktype, p->ai_protocol);
connect(m_sock_fd, p->ai_addr, p->ai_addrlen);
char socks5_request[256] = {0}, response[256] = {0};
sprintf(socks5_request, "\5\1\0");
send(m_sock_fd, socks5_request, 4, 0);
recv(m_sock_fd, response, 256, 0);
assert(response[0] == '\5' && response[1] == '\0'); // OK
m_ssl_ctx = SSL_CTX_new(SSLv23_client_method());
m_ssl = SSL_new(m_ssl_ctx);
SSL_set_fd(m_ssl, m_sock_fd);
SSL_connect(m_ssl); // returns -1
SSL_connect失败并出错:1408F10B:SSL例程:ssl3_get_record:错误的版本号:ssl / record / ssl3_record.c:332:
我有两个问题。
更新4/2/2019
下面的代码用于向代理服务器发送连接请求。对CheckConnectivity()的最后一次调用发现连接已关闭。
struct sockaddr_in addr;
memset(&addr, 0, sizeof(addr));
addr.sin_family = AF_INET;
addr.sin_addr.s_addr = inet_addr("*.*.*.*");
addr.sin_port = htons(443);
SOCKSRequest connect_request;
// 5: protocol number, 1: connect, 0: reserved, 1: ipv4
connect_request.m_version = '\5';
connect_request.m_type = '\1';
connect_request.m_reserved = '\0';
connect_request.m_addr_type = '\1';
connect_request.m_ip = addr.sin_addr.s_addr;
connect_request.m_port = addr.sin_port;
CheckConnectivitiy();
if (!send(m_sock_fd, &connect_request, 4, 0))
return 0;
CheckConnectivitiy();
if (!send(m_sock_fd, &connect_request.m_ip, sizeof(in_addr), 0))
return 0;
CheckConnectivitiy();
if (!send(m_sock_fd, &connect_request.m_port, 2, 0))
return 0;
CheckConnectivitiy(); // connection was closed by peer here!
CheckConnectivity的实现。
int CheckConnectivitiy() const
{
int error = 0;
socklen_t len = sizeof (error);
int retval = getsockopt (m_sock_fd, SOL_SOCKET, SO_ERROR, &error, &len);
if (retval != 0)
{
/* there was a problem getting the error code */
fprintf(stderr, "error getting socket error code: %s\n", strerror(retval));
return 0;
}
if (error != 0)
{
/* socket has a non zero error status */
fprintf(stderr, "socket error: %s\n", strerror(error));
return 0;
}
return 1;
}
您只需要1个连接,即代理服务器。你告诉代理它应该连接到下一个(你没有这样做!)。仅当代理成功连接时,才能与目标服务器建立有效连接。只有这样才能发送SSL / TLS握手,就好像您已直接连接到目标服务器一样。
我建议你阅读RFC 1928的SOCKS v5协议。您正在发送身份验证请求并阅读其响应,但在尝试使用SSL / TLS之前,您没有发送Connect请求并且读取是响应。这就是握手失败的原因。您尚未连接到目标服务器。