SOAX relay for remote measurement #286

amircybersec · 2024-09-19T15:18:40Z

This PR adds an example for running a socks5 proxy that forwards requests to soax server socks5 server. It helps with temporarily sharing access with others to let them perform measurements on a given network.

fortuna · 2024-09-19T18:23:01Z

x/examples/soax-relay/README.md

+
+The relay will use the SOAX package ID and password to connect to the SOAX server, appending the country, sessionid, and sessionlength from the user's input.
+
+### Setup and Running


This is too complicated. You can just use go run directly and pass the full package name. See the docs for the other tools.

I simplified the readme accordingly

fortuna · 2024-09-19T18:24:08Z

x/examples/soax-relay/README.md

+
+The relay will forward these parameters to SOAX, allowing users to benefit from sticky sessions without direct access to SOAX credentials.
+
+### Security Considerations


Also, SOCKS5 is plaintext....

fortuna · 2024-09-19T18:25:11Z

x/examples/soax-relay/README.md

+server:
+  address: "127.0.0.1"
+  port: "1080"


"server" is ambiguous. Perhaps "listen_address"? And we can simplify with a single string

Suggested change

server:

address: "127.0.0.1"

port: "1080"

listen_address: 127.0.0.1:1080

fortuna · 2024-09-19T18:28:02Z

x/examples/soax-relay/README.md

+upstream:
+  prefix: "package-xxxxx-"
+  password: "YourSOAXPassword"
+  address: "proxy.soax.com:5000"


Let's simplify this and be explicit about the soax info, using the names they use:

Suggested change

upstream:

prefix: "package-xxxxx-"

password: "YourSOAXPassword"

address: "proxy.soax.com:5000"

soax:

package_id: "XXXXXX"

package_key: "YourSOAXPassword"

I'd omit the server address too, it's easier.

fortuna · 2024-09-19T18:29:13Z

x/examples/soax-relay/README.md

+  foo: "bar"
+  jane: "password123"
+
+udp_timeout: 1m


Suggested change

udp_timeout: 1m

# Optional

udp_timeout: 1m

timeout param is removed

fortuna · 2024-09-19T20:59:17Z

x/examples/soax-relay/main.go

+	viper.SetConfigType("yaml")
+	viper.AddConfigPath(".")
+
+	if err := viper.ReadInConfig(); err != nil {


No globals please. This hurts readability and maintainability. Can you change the code so it doesn't rely on globals? You can use https://pkg.go.dev/github.com/dvln/viper#New instead.

fortuna · 2024-09-19T21:04:56Z

x/examples/soax-relay/main.go

+
+	server := socks5.NewServer(
+		socks5.WithAuthMethods([]socks5.Authenticator{customAuth}),
+		socks5.WithLogger(socks5.NewLogger(log.New(os.Stdout, "socks5: ", log.LstdFlags))),


Not required, but you could use slog with https://pkg.go.dev/log/slog#NewLogLogger

fortuna · 2024-09-19T21:09:10Z

x/examples/soax-relay/main.go

+
+			switch network {
+			case "tcp", "tcp4", "tcp6":
+				streamEndpoint := transport.StreamDialerEndpoint{Dialer: &transport.TCPDialer{}, Address: soaxAddress}


Please create the endpoint outside the handler. You only need to create it once, no need to create it for every request

I am going to move the socks5 client creation outside of the handler as well.

fortuna · 2024-09-19T21:11:01Z

x/examples/soax-relay/main.go

+}
+
+// Valid checks if the provided prefix and password are valid
+func (s *StaticCredentialStore) Valid(prefix, password, userAddr string) bool {


prefix -> username

Validate is now removed entirely

fortuna · 2024-09-19T21:13:00Z

x/examples/soax-relay/main.go

+}
+
+// CredentialStore is an interface to validate prefix-based credentials
+type CredentialStore interface {


Too many layers here. I don't see much value in the CredentialStore interface and the StaticCredentialStore. The CustomCredentialAuthenticator can hold the authentication logic. It's an integral part of the authenticator.

I removed these extra layers and did a simple map lookup inside Authenticator

fortuna · 2024-09-19T21:29:23Z

x/examples/soax-relay/config.yaml

+  foo: bar
+  exampleuser: examplepass
+
+udp_timeout: 1m


UDP timeout is not needed. Remove.

The TCP connection for the UDP Association is how we determine when to close it.

fortuna · 2024-09-19T21:30:10Z

x/examples/soax-relay/main.go

+	}
+
+	// Start a goroutine to close the connection after a timeout
+	go func() {


Replace this timeout with a loop that reads from the client TCP connection and closes the target TCP connection and the client UDP connection when the client TCP connection is closed. The "loop" can be an io.Copy directly into io.Discard.

fortuna · 2024-09-19T21:45:36Z

x/examples/soax-relay/main.go

+			// Construct the upstream username by concatenating the base username with the suffix
+			soaxUsername := soaxpackage + suffix // e.g., "package-189365-country-ir-seesionid-..."
+
+			switch network {


Handle UDP here as well. There's no need to implement an AssociateHandler, since the library already provides that.

fortuna · 2024-09-19T21:47:40Z

x/examples/soax-relay/main.go

+	return exists && storedPassword == password
+}
+
+func udpAssociateHandler(ctx context.Context, writer io.Writer, request *socks5.Request) error {


Let's remove this and handle UDP in the Server dialer instead.

I'm not comfortable exposing the internals of our SOCKS5 library for now and that will require some more thought.

Using the dialer approach will keep the code simpler, even though it's doing an extra relay of the packets.

@fortuna this is an important part of the implementation. I am basically implementing a custom udpAssociateHandler which relays the UDP associate command coming from the client (to proxy server) to the upstream soax server and relays the bind address communicated by soax server back to the client.

I initially thought I can use WithDialAndRequest to relay UDP as well but this handler only handle outgoing TCP connections (and not even the UDP associate TCP connection). I guess you are suggesting that I use a packetDialer similar to SteamDialer in the WithDialAndRequest for udp networks right? If so, unfortunately that approach won't work since WithDialAndRequest won't be called for udp.

The library already implements the relay:
https://github.com/things-go/go-socks5/blob/503e7866821a419fe3766751f6d5671390072c14/handle.go#L219

The dial to the target happens here:
https://github.com/things-go/go-socks5/blob/503e7866821a419fe3766751f6d5671390072c14/handle.go#L242

It's directly from Server.dial:
https://github.com/things-go/go-socks5/blob/503e7866821a419fe3766751f6d5671390072c14/handle.go#L183

Which is set by WithDialAndRequest. That applies to both tcp and udp.

You will need to take the credentials from the request, create the SOCKS5 dialer, then dial.

Ah no! It doesn't actually use Server.dialWithRequest!
So, yeah, we need to provide the relay.

fortuna · 2024-09-19T21:48:26Z

transport/socks5/packet_listener.go

Revert the transport changes. See below.

@fortuna please refer to my above comment.

fortuna · 2024-09-20T21:33:52Z

x/examples/soax-relay/main.go

+	}
+
+	streamEndpoint := transport.StreamDialerEndpoint{Dialer: &transport.TCPDialer{}, Address: config.SOAX.Address}
+	client, err := csocks5.NewClient(&streamEndpoint)


You can't reuse the client, because you need to set the credentials for each dial. You now have a race condition.

@fortuna these two lines were actually inside WithDialAndRequest (so every dial will override the credentials for that dial). I need to revert back.

fortuna · 2024-09-20T21:34:17Z

x/examples/soax-relay/main.go

+
+			// Construct the upstream username by concatenating the base username with the suffix
+			soaxUsername := config.SOAX.PackageID + suffix // e.g., "package-123456-country-ir-seesionid-..."
+			err = client.SetCredentials([]byte(soaxUsername), []byte(config.SOAX.PackageKey))


This is a race condition, since it will change the credential for everyone using the client

fortuna · 2024-09-20T21:36:42Z

x/examples/soax-relay/main.go

+	// the soax package name with the suffix
+	soaxUsername := config.SOAX.PackageID + suffix
+
+	streamEndpoint := transport.StreamDialerEndpoint{Dialer: &transport.TCPDialer{}, Address: config.SOAX.Address}


Reuse the streamEndpoint with TCP to make it clear it's the same and that it doesn't change on every request.

fortuna · 2024-09-20T21:50:08Z

x/examples/soax-relay/main.go

+	}
+
+	server := socks5.NewServer(
+		socks5.WithAuthMethods([]socks5.Authenticator{customAuth}),


New Approach:

Let's use WithAssociateMiddleware.

We have access to the Request there, so we can process the credentials and create the SOCKS5 client, which we can store in the Context

This is not released yet, so you will need to depend on a specific commit.

In the Dial function (specified with WithDial), retrieve the client from the Context and dial.

fortuna · 2024-09-23T16:01:36Z

x/go.mod

@@ -3,7 +3,7 @@ module github.com/Jigsaw-Code/outline-sdk/x
 go 1.21

 require (
-	github.com/Jigsaw-Code/outline-sdk v0.0.17-0.20240726212635-470a9290ec57
+	github.com/Jigsaw-Code/outline-sdk v0.0.17-0.20240920003233-01a5556214fd


Let's change this to version 0.0.17 and re-run go mod tidy. I believe we can revert the change to the socks5 package.

@fortuna I will get back to exploring and implementing the suggested alternative approach in a bit. That would be a requirement for reverting the changes to socks5 package (which exposes method to send associate command). I am right now focusing on getting a set of remote measurements for the upcoming event and get back on this PR afterwards.

amircybersec added 3 commits September 19, 2024 15:37

export ConnectAndRequest method

2704b35

Add soax-relay to examples

b6cadf8

add readme

91c3b75

amircybersec requested a review from fortuna September 19, 2024 15:19

fortuna reviewed Sep 19, 2024

View reviewed changes

fortuna requested changes Sep 19, 2024

View reviewed changes

amircybersec added 10 commits September 20, 2024 01:19

applied code review comments

2cb1d4b

update config.yaml format

aeea243

update readme

cf93f5e

removed server logger

6238df9

added some depenenties to go.mod

01a5556

update go.mod to point to latest cimmit

16702a5

possible udp issue fix

26d2cf4

copy udp pakcets

03ea5e9

fix config name

9c085c4

add fixed udp address

3bf7af8

fortuna requested changes Sep 20, 2024

View reviewed changes

fortuna reviewed Sep 20, 2024

View reviewed changes

move client creation inside WithDialAndRequest

a637f41

fortuna reviewed Sep 23, 2024

View reviewed changes

amircybersec added 3 commits September 25, 2024 12:40

add iran and russia mobile ISP names to readme

b185b94

add support for both residential and mobile VPs

2f0dbde

update readme

78db65c

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

SOAX relay for remote measurement #286

SOAX relay for remote measurement #286

amircybersec commented Sep 19, 2024

fortuna Sep 19, 2024

amircybersec Sep 20, 2024

fortuna Sep 19, 2024

fortuna Sep 19, 2024

fortuna Sep 19, 2024

fortuna Sep 19, 2024

amircybersec Sep 20, 2024

fortuna Sep 19, 2024

fortuna Sep 19, 2024

fortuna Sep 19, 2024

amircybersec Sep 19, 2024

fortuna Sep 19, 2024

amircybersec Sep 20, 2024

fortuna Sep 19, 2024

amircybersec Sep 20, 2024

fortuna Sep 19, 2024

fortuna Sep 19, 2024

fortuna Sep 19, 2024

fortuna Sep 19, 2024

amircybersec Sep 19, 2024

fortuna Sep 20, 2024

fortuna Sep 20, 2024

fortuna Sep 19, 2024

amircybersec Sep 20, 2024

fortuna Sep 20, 2024

amircybersec Sep 20, 2024

fortuna Sep 20, 2024

fortuna Sep 20, 2024

fortuna Sep 20, 2024

fortuna Sep 23, 2024

amircybersec Sep 23, 2024


		The relay will use the SOAX package ID and password to connect to the SOAX server, appending the country, sessionid, and sessionlength from the user's input.

		### Setup and Running


		The relay will forward these parameters to SOAX, allowing users to benefit from sticky sessions without direct access to SOAX credentials.

		### Security Considerations

SOAX relay for remote measurement #286

Are you sure you want to change the base?

SOAX relay for remote measurement #286

Conversation

amircybersec commented Sep 19, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment