SOCKS Protocol Version 5
Extracted elements (28)
SOCKS Version 5 is conceptually a 'shim-layer' between the application layer and the transport layer. It does not provide network-layer gateway services such as forwarding of ICMP messages. This positioning allows transparent firewall traversal without modifying transport-layer behavior.
The UDP ASSOCIATE design ties the UDP association lifetime to the control TCP connection rather than making it independent. This simplifies cleanup and ensures that broken TCP connections automatically release all associated UDP relay resources.
SOCKS Version 5 extends SOCKS Version 4 to include UDP support, generalized strong authentication schemes, and domain-name and IPv6 addressing. SOCKS Version 4 only supported TCP-based client-server applications without strong authentication.
When the server is multi-homed, the BND.ADDR returned in a CONNECT reply may differ from the IP address the client uses to reach the SOCKS server. Clients must use the BND.ADDR and BND.PORT from the reply, not the server's known address.
A UDP association terminates when the TCP connection on which the UDP ASSOCIATE request arrived terminates. The lifetime of UDP associations is tied to the control TCP connection.
A UDP-based client MUST send its datagrams to the UDP relay server at the BND.PORT indicated in the reply to the UDP ASSOCIATE request, and MUST encapsulate datagrams if the authentication method provides encapsulation.
Compliant implementations MUST support GSSAPI and SHOULD support USERNAME/PASSWORD authentication methods.
For UDP ASSOCIATE, if the client does not know its sending address and port at the time of the request, the client MUST use a port number and address of all zeros.
If the negotiated authentication method includes encapsulation for integrity checking and/or confidentiality, client requests MUST be encapsulated in the method-dependent encapsulation.
If the server responds to the method negotiation with X'FF' (no acceptable methods), the client MUST close the connection.
Implementation of UDP fragmentation is optional; an implementation that does not support fragmentation MUST drop any datagram whose FRAG field is other than X'00'.
The programming interface for a SOCKS-aware UDP MUST report an available buffer space smaller than the actual OS-provided space to account for header overhead: 10+method_dependent octets smaller for IPv4 (ATYP X'01'), 262+method_dependent for domain names (ATYP X'03'), and 20+method_dependent for IPv6 (ATYP X'04').
The reassembly timer for UDP fragments MUST be no less than 5 seconds. The reassembly queue must be reinitialized and fragments abandoned when the timer expires or a datagram arrives with a FRAG value less than the highest processed.
The UDP relay server MUST acquire the expected client IP address from the SOCKS server and MUST drop any datagrams arriving from any source IP address other than the one recorded for the particular association.
When a reply with REP other than X'00' indicates failure, the SOCKS server MUST terminate the TCP connection shortly after sending the reply, no more than 10 seconds after detecting the failure condition.
When data arrives at the SOCKS server for the client and the authentication method supports encapsulation, the server MUST encapsulate the data as appropriate for the authentication method in use.
For BIND operations, the SOCKS server sends two replies: the first after binding a new socket (BND.PORT/BND.ADDR contain the listening address for the client to advertise), and the second after an incoming connection succeeds or fails (BND.PORT/BND.ADDR contain the connecting host's address).
Reply codes (REP field) include: X'00' succeeded, X'01' general SOCKS server failure, X'02' connection not allowed by ruleset, X'03' network unreachable, X'04' host unreachable, X'05' connection refused, X'06' TTL expired, X'07' command not supported, X'08' address type not supported, X'09'–X'FF' unassigned.
The FRAG field supports UDP datagram fragmentation: X'00' indicates a standalone datagram, values 1–127 indicate fragment position within a sequence, and the high-order bit (X'80') indicates end-of-fragment sequence. Implementations maintain a reassembly queue and timer per fragment sequence.
Three address types are defined via ATYP: X'01' for IPv4 (4 octets), X'03' for fully-qualified domain name (first octet is length, no NUL terminator), and X'04' for IPv6 (16 octets).
Three command types are defined: CONNECT (X'01') for outbound TCP connections, BIND (X'02') for accepting inbound connections (e.g., FTP data transfers), and UDP ASSOCIATE (X'03') for establishing a UDP relay association.
Authentication METHOD values are defined as: X'00' NO AUTHENTICATION REQUIRED, X'01' GSSAPI, X'02' USERNAME/PASSWORD, X'03'–X'7F' IANA ASSIGNED, X'80'–X'FE' RESERVED FOR PRIVATE METHODS, X'FF' NO ACCEPTABLE METHODS. New method numbers must be obtained from IANA.
The security of firewall traversal via SOCKS Version 5 is highly dependent on the particular authentication and encapsulation methods provided in a given implementation and selected during negotiation. Administrators must carefully select authentication methods appropriate for their security requirements.
Each UDP datagram sent to the relay server carries a header: RSV (2 octets, X'0000'), FRAG (1 octet, fragment number), ATYP (1 octet), DST.ADDR (variable), DST.PORT (2 octets), followed by DATA (variable).
The client version identifier/method selection message contains: VER (1 octet, X'05'), NMETHODS (1 octet, count of method identifiers), and METHODS (1 to 255 octets, list of supported authentication method codes).
The server method selection message contains: VER (1 octet, X'05') and METHOD (1 octet, the selected authentication method). A value of X'FF' indicates no acceptable method was found.
The server reply message contains: VER (1 octet, X'05'), REP (1 octet, reply code), RSV (1 octet, X'00'), ATYP (1 octet), BND.ADDR (variable, server-bound address), BND.PORT (2 octets, network byte order). RSV fields MUST be set to X'00'.
The SOCKS request message contains: VER (1 octet, X'05'), CMD (1 octet: CONNECT=X'01', BIND=X'02', UDP ASSOCIATE=X'03'), RSV (1 octet, X'00'), ATYP (1 octet, address type), DST.ADDR (variable), DST.PORT (2 octets, network byte order).