socat/socat-chain.sh

265 lines
7.9 KiB
Bash
Raw Permalink Normal View History

#! /usr/bin/env bash
# Copyright Gerhard Rieger and contributors (see file CHANGES)
# Published under the GNU General Public License V.2, see file COPYING
# Shell script to build a chain of Socat instances connected via TCP sockets.
# This allows to drive, e.g., PROXY-CONNECT over SSL, or SSL over serial.
# Currently only a chain made from 3 addresses, resulting in two instances, is
# implemented.
# The 2nd address must be one of OPENSSL (SSL), PROXY-CONNECT (PROXY),
# SOCKS4, SOCKS4A, SOCKS5
# This is beta!
# Examples:
# Drive HTTP CONNECT (PROXY) over SSL
# (establish an SSL tunnel to a proxy server, request being forwarded to a
# telnet server):
# socat-chain.sh \
# STDIO \
# PROXY::<telnet-server>:23 \
# OPENSSL:<proxy-server>:8443
# Accept connections that arrive on port 7777, encrypt the data, and send it
# via socks server to final target:
# socat-chain.sh \
# TCP-L:7777,reuseaddr,fork \
# OPENSSL,verify=0 \
# SOCKS4:<socks-server>:<ssl-server>:8443
# Receive SSL coming from a serial lie
# socat-chain.sh \
# /dev/ttyS0,cfmakeraw \
# SSL-L,cafile=server.pem,verify=0 \
# TCP4:localhost:80
# Formally, this is what happens:
# socat-chain.sh addr1 addr2 addr3
# results in something like:
# socat TCP-L:RANDOM addr3 &
# socat addr1 addr2:localhost:RANDOM
# or on passive/listening addr2:
# socat addr2:RANDOM addr3 &
# socat addr1 TCP:localhost:RANDOM
ECHO="echo -e"
usage () {
$ECHO "Usage: $0 <options> <address1> <address2> <address3>"
$ECHO " <address1> is typically a passive (listening) address like"
$ECHO " TCP-L:1234"
$ECHO " <address2> must be one of OPENSSL, PROXY, SOCK4, SOCKS4A, or SOCKS5,"
$ECHO " or SSL-L (passive/listening)"
$ECHO " Given server hostname and port are ignored and replaced by internal"
$ECHO " communication point"
$ECHO " <address3> is typically a client address with protocol like OPENSSL"
$ECHO " <options>:"
$ECHO " -d* -S <sigmask> -t <timeout> -T <timeout> are passed to socat"
$ECHO " -V prints the socat commands before starting them"
$ECHO "Example to drive SOCKS over TLS:"
$ECHO " $0 \\"
$ECHO " TCP4-L:1234,reuseaddr,fork \\"
$ECHO " SOCKS::<server>:<port> \\"
$ECHO " OPENSSL:10.2.3.4:12345,cafile=..."
$ECHO " Clients that connect to port 1234 will be forwarded to <server>:<port> using socks"
$ECHO " over TLS"
}
LOCALHOST=127.0.0.1
VERBOSE= QUIET= OPTS=
while [ "$1" ]; do
case "X$1" in
X-h) usage; exit ;;
X-V) VERBOSE=1 ;;
X-q) QUIET=1; OPTS="-d0" ;;
X-d*|X-l?*) OPTS="$OPTS $1" ;;
X-b|X-S|X-t|X-T|X-l) OPT=$1; shift; OPTS="$OPTS $OPT $1" ;;
X-) break ;;
X-*) echo "$0: Unknown option \"$1\"" >&2
usage >&2
exit 1 ;;
*) break ;;
esac
shift
done
ARG0="$1"
ARG1="$2"
ARG2="$3"
if [ -z "$ARG0" -o -z "$ARG1" -o -z "$ARG2" ]; then
echo "$0: Three addresses required" >&2
usage >&2
exit 1
fi
mkprogname () {
ARG="$1"
if [[ "$ARG" =~ .*[:].* ]]; then
NAME="${ARG%%:*}"
elif [[ "$ARG" =~ .*[,].* ]]; then
NAME="${ARG%%,*}"
elif [ "X$ARG" = X- ]; then
NAME=stdio
else
NAME="$ARG"
fi
NAME="${NAME,,*}"
echo $NAME
}
# You may place a fork option in the first address
# in which case the following internal listeners do fork too
FORK=
case "$ARG0" in
*,fork,*|*,fork) FORK=fork ;;
esac
# Split middle address for insertion of additional parts
if [[ "$ARG1" =~ .*,.* ]]; then
ARG1A="${ARG1%%,*}"
ARG1B="${ARG1#*,}"
else
ARG1A="$ARG1"
ARG1B=
fi
case "$0" in
*/*) SOCAT=${0%/*}/socat ;;
*) SOCAT=socat ;;
esac
PORT=$($SOCAT -d -d TCP4-L:0,accept-timeout=0.000001 /dev/null 2>&1 |grep listening |sed 's/.*:\([1-9][0-9]*\)$/\1/')
if [ -z "$PORT" ]; then
echo "$0: Failed to determine free TCP port" >&2
exit 1
fi
PASSIVE= # is the second address passive/listening/server?
case "${ARG1A^^*}" in
OPENSSL|OPENSSL:*|SSL|SSL:.*)
OPTS1A=
#if [[ $ARG1A =~ ^\([^:]*\):\([^:]*\):\([^,]*\)\(.*\) ]]; then # bash 3
if [[ $ARG1A =~ ^([^:]*):([^:]*):([^,]*)(.*) ]]; then
OPTS1A="${BASH_REMATCH[4]}"
#elif [[ $ARG1A =~ ^\([^,]*\)\(.*\) ]]; then # bash 3
elif [[ $ARG1A =~ ^([^,]*)(.*) ]]; then
OPTS1A="${BASH_REMATCH[2]}"
else
echo "$0: \"$ARG1A\": invalid arguments" >&2
exit 1
fi
PROG1="${BASH_REMATCH[1]}"
NAME1=$(mkprogname "${BASH_REMATCH[1]}")
NAME2=$(mkprogname "$ARG2")
ARG1A=$PROG1:$LOCALHOST:$PORT$OPTS1A ;;
PROXY-CONNECT:*|PROXY:*)
#if ! [[ $ARG1A =~ ^\([^:]*\):\([^:]*\):\([^:]*\):\([^,]*\)\(.*\) ]]; then # bash 3
if ! [[ $ARG1A =~ ^([^:]*):([^:]*):([^:]*):([^,]*)(.*) ]]; then
echo "$0: \"$ARG1A\": invalid arguments" >&2
exit 1
fi
#echo "0:\"${BASH_REMATCH[0]}\" 1:\"${BASH_REMATCH[1]}\" 2:\"${BASH_REMATCH[2]}\" 3:\"${BASH_REMATCH[3]}\" 4:\"${BASH_REMATCH[4]}\""
PROG1="${BASH_REMATCH[1]}"
NAME1=$(mkprogname "${PROG1,,*}")
NAME2=$(mkprogname "$ARG2")
OPTS1A="${BASH_REMATCH[5]}"
ARG1A="$PROG1:$LOCALHOST:${BASH_REMATCH[3]}:${BASH_REMATCH[4]},proxyport=$PORT,$OPTS1A" ;;
SOCKS:*|SOCKS4:*|SOCKS4A*)
#if ! [[ $ARG1A =~ ^\([^:]*\):\([^:]*\):\([^:]*\):\([^:,]*\),* ]]; then # bash 3
if ! [[ $ARG1A =~ ^([^:]*):([^:]*):([^:]*):([^:,]*),* ]]; then
echo "$0: \"$ARG1A\": invalid arguments" >&2
exit 1
fi
PROG1="${BASH_REMATCH[1]}"
NAME1=$(mkprogname "${PROG1,,*}")
NAME2=$(mkprogname "$ARG2")
OPTS1A="${BASH_REMATCH[5]}"
ARG1A="$PROG1:$LOCALHOST:${BASH_REMATCH[3]}:${BASH_REMATCH[4]},socksport=$PORT,$OPTS1A" ;;
SOCKS5:*|SOCKS5-CONNECT*)
#if ! [[ $ARG1A =~ ^\([^:]*\):\([^:]*\):\([^:]*\):\([^:,]*\):\([^:,]*\),* ]]; then # bash 3
if ! [[ $ARG1A =~ ^([^:]*):([^:]*):([^:]*):([^:,]*):([^:,]*),* ]]; then
echo "$0: \"$ARG1A\": invalid arguments" >&2
exit 1
fi
PROG1="${BASH_REMATCH[1]}"
NAME1=$(mkprogname "${PROG1,,*}")
NAME2=$(mkprogname "$ARG2")
OPTS1A="${BASH_REMATCH[6]}"
ARG1A="$PROG1:$LOCALHOST:$PORT:${BASH_REMATCH[4]}:${BASH_REMATCH[5]},$OPTS1A" ;;
# Passive (server) addresses
OPENSSL-LISTEN|OPENSSL-LISTEN:*|SSL-L|SSL-L:.*)
PASSIVE=1
OPTS1A=
#if [[ $ARG1A =~ ^\([^:]*\):\([^,]*\)\(.*\) ]]; then # bash 3
if [[ $ARG1A =~ ^([^:]*):([^,]*)(.*) ]]; then
OPTS1A="${BASH_REMATCH[3]}"
#elif [[ $ARG1A =~ ^\([^,]*\)\(.*\) ]]; then # bash 3
elif [[ $ARG1A =~ ^([^,]*)(.*) ]]; then
OPTS1A="${BASH_REMATCH[2]}"
else
echo "$0: \"$ARG1A\": invalid arguments" >&2
exit 1
fi
PROG1="${BASH_REMATCH[1]}"
NAME1=$(mkprogname "$ARG0")
NAME2=$(mkprogname "${BASH_REMATCH[1]}")
ARG1A=$PROG1:$PORT$OPTS1A ;;
*) echo "$0: Unsupported address \"$ARG1A\"" >&2
usage >&2
exit 1 ;;
esac
ADDR1A="$ARG0"
if [ -z "$PASSIVE" ]; then
ADDR1B="$ARG1A,bind=$LOCALHOST,$ARG1B"
ADDR2A="TCP4-L:$PORT,reuseaddr,$FORK,bind=$LOCALHOST,range=$LOCALHOST/32"
else
ADDR1B="TCP4:$LOCALHOST:$PORT,bind=$LOCALHOST"
ADDR2A="$ARG1A,reuseaddr,$FORK,bind=$LOCALHOST,range=$LOCALHOST/32,$ARG1B"
fi
ADDR2B="$ARG2"
pid1= pid2=
trap '[ "$pid1" ] && kill $pid1 2>/dev/null; [ "$pid2" ] && kill $pid2 2>/dev/null' EXIT
set -bm
trap 'rc=$?; if ! kill -n 0 $pid2 2>/dev/null; then [ -z "$QUIET" -a $rc -ne 0 ] && echo "$0: socat-$NAME2 exited with rc=$rc" >&2; exit $rc; fi' SIGCHLD
# Start instance 2 first, because instance 1 ("left") connects to 2
if [ "$VERBOSE" ]; then
$ECHO "$SOCAT $OPTS -lp socat-$NAME2 \\
\"$ADDR2A\" \\
\"$ADDR2B\" &"
fi
$SOCAT $OPTS -lp socat-$NAME2 \
"$ADDR2A" \
"$ADDR2B" &
pid2=$!
sleep 0.1
#trap 'if ! kill -n 0 $pid1 2>/dev/null; then [ -z "$QUIET" ] && echo "$0: socat-$NAME1 exited with rc=$?" >&2; kill $pid2 2>/dev/null; exit 1; elif ! kill -n 0 $pid2 2>/dev/null; then [ -z "$QUIET" ] && echo "$0: socat-$NAME2 exited with rc=$?" >&2; kill $pid1 2>/dev/null; exit 1; fi' SIGCHLD
if [ "$VERBOSE" ]; then
$ECHO "$SOCAT $OPTS -lp socat-$NAME1 \\
\"$ADDR1A\" \\
\"$ADDR1B\""
fi
$SOCAT $OPTS -lp socat-$NAME1 \
"$ADDR1A" \
"$ADDR1B"
#pid1=$!
rc1=$?
kill $pid2 2>/dev/null
wait 2>/dev/null
#wait -f
exit $rc1