Rulessocks5代理ip

XEP-0260:JingleSOCKS5BytestreamsTransportMethodPeterSaint-Andremailto:xsf@stpeter.
imxmpp:peter@jabber.
orghttp://stpeter.
im/DirkMeyermailto:dmeyer@tzi.
dexmpp:dmeyer@jabber.
orgJustinKarnegesmailto:justin@karneges.
comxmpp:justin@andbit.
netMarcusLundbladmailto:ml@update.
uu.
sexmpp:mlundblad@jabber.
orgTobiasMarkmannmailto:tobias.
markmann@isode.
comxmpp:tm@ayena.
deKlausHartkemailto:klaus.
hartke@googlemail.
comxmpp:nx@jabber.
org2018-05-15Version1.
0.
3StatusTypeShortNameDraftStandardsTrackjingle-s5bThisspecificationdefinesaJingletransportmethodthatresultsinsendingdataviatheSOCKS5Bytestreams(S5B)protocoldefinedinXEP-0065.
EssentiallythistransportmethodreusesXEP-0065se-manticsforsendingthedataanddefinesnativeJinglemethodsforstartingandendinganS5Bsession.
LegalCopyrightThisXMPPExtensionProtocoliscopyright1999–2020bytheXMPPStandardsFoundation(XSF).
PermissionsPermissionisherebygranted,freeofcharge,toanypersonobtainingacopyofthisspecification(the"Specification"),tomakeuseoftheSpecificationwithoutrestriction,includingwithoutlimitationtherightstoimplementtheSpecificationinasoftwareprogram,deploytheSpecificationinanetworkservice,andcopy,modify,merge,publish,translate,distribute,sublicense,orsellcopiesoftheSpecifi-cation,andtopermitpersonstowhomtheSpecificationisfurnishedtodoso,subjecttotheconditionthattheforegoingcopyrightnoticeandthispermissionnoticeshallbeincludedinallcopiesorsub-stantialportionsoftheSpecification.
Unlessseparatepermissionisgranted,modifiedworksthatareredistributedshallnotcontainmisleadinginformationregardingtheauthors,title,number,orpub-lisheroftheSpecification,andshallnotclaimendorsementofthemodifiedworksbytheauthors,anyorganizationorprojecttowhichtheauthorsbelong,ortheXMPPStandardsFoundation.
Warranty##NOTEWELL:ThisSpecificationisprovidedonan"ASIS"BASIS,WITHOUTWARRANTIESORCONDI-TIONSOFANYKIND,expressorimplied,including,withoutlimitation,anywarrantiesorconditionsofTITLE,NON-INFRINGEMENT,MERCHANTABILITY,orFITNESSFORAPARTICULARPURPOSE.
##LiabilityInnoeventandundernolegaltheory,whetherintort(includingnegligence),contract,orotherwise,unlessrequiredbyapplicablelaw(suchasdeliberateandgrosslynegligentacts)oragreedtoinwriting,shalltheXMPPStandardsFoundationoranyauthorofthisSpecificationbeliablefordamages,includ-inganydirect,indirect,special,incidental,orconsequentialdamagesofanycharacterarisingfrom,outof,orinconnectionwiththeSpecificationortheimplementation,deployment,orotheruseoftheSpecification(includingbutnotlimitedtodamagesforlossofgoodwill,workstoppage,computerfail-ureormalfunction,oranyandallothercommercialdamagesorlosses),eveniftheXMPPStandardsFoundationorsuchauthorhasbeenadvisedofthepossibilityofsuchdamages.
ConformanceThisXMPPExtensionProtocolhasbeencontributedinfullconformancewiththeXSF'sIntellectualPropertyRightsPolicy(acopyofwhichcanbefoundatorobtainedbywritingtoXMPPStandardsFoundation,P.
O.
Box787,Parker,CO80134USA).
Contents1Introduction12Protocol12.
1SelectingCandidates22.
2ExchangingCandidates22.
3ConnectingtoCandidates72.
4CompletingtheNegotiation82.
5ExchangingData102.
6ClosingtheBytestream103FallbackMethods114ProcessingRulesandUsageGuidelines135DeterminingSupport146SecurityConsiderations146.
1SharingIPAddresses146.
2EncryptionofMedia157IANAConsiderations158XMPPRegistrarConsiderations158.
1ProtocolNamespaces158.
2ProtocolVersioning158.
3JingleTransportMethods159Schema1610Acknowledgements182PROTOCOL1IntroductionJingle(XEP-0166)1definesaframeworkfornegotiatingandmanagingdatasessionsoverXMPP.
Inordertoprovideaflexibleframework,thebaseJinglespecificationdefinesneitherdatatransportmethodsnorapplicationformats,leavingthatuptoseparatespecifications.
ThecurrentdocumentdefinesatransportmethodforestablishingandmanagingdataexchangesbetweenXMPPentitiesusingtheexistingSOCKS5Bytestreams(S5B)protocolspecifiedinSOCKS5Bytestreams(XEP-0065)2.
This"jingle-s5b"methodresultsinastreamingtransportmethodsuitableforuseinJingleapplicationtypeswherepacketlosscannotbetolerated(e.
g.
,filetransfer).
Jingle-S5BreusestheprotocolflowfromXEP-0065forthecom-municationwithaSOCKS5streamhost;thecommunicationbetweentwoclientstonegotiatethepossiblecandidatesdiffersfromXEP-0065andsharessimilaritieswithJingleICE-UDPTransportMethod(XEP-0176)32ProtocolThebasicflowisasfollows.
InitiatorResponder|||session-initiate||(withS5Bcandidates)||ack||session-accept||(withS5Bcandidates)||ack||candidate-usedtransport-info||ack||candidate-usedtransport-info||ack||S5B"SESSION"||session-terminate|1XEP-0166:Jingle.
2XEP-0065:SOCKS5Bytestreams.
3XEP-0176:JingleICE-UDPTransportMethod.
12PROTOCOL|ack|||Thisflowisillustratedinthefollowingexamples(tosimplifythepresentationtheseusean"example"applicationinsteadofarealapplicationtype).
2.
1SelectingCandidatesItisRECOMMENDEDthataclientwillofferasmanyelementsaspossiblewithitselfasthehost(i.
e.
,non-proxycandidates).
Suchcandidatesmightbefoundusingthefollowingmethods:OpeningtheTCPportonallavailableinterfacestheuserwantstouse(e.
g.
,maybenotanexpensiveUMTSlink),includingtheIPv4andIPv6addressesofthatinterface(ifavail-able).
Usingtheclient'sexternalIPaddressasdiscoveredthroughanassistingNATprotocolorothermeans.
IftheclientknowsitisbehindaNATandtherouterannouncesUPnPIGDorNAT-PMPsupport,theclientSHOULDmaptheopenporttotheexternalinterfaceoftherouterandincludethepublicIPaddressandportinformationintheoffers.
Toincreasethechanceofsuccesswithoutusingaproxy,thisspecificationencouragestherespondertoalsosendoffers,effectivelyequivalenttothe"fast-mode"forSOCKS5Bytestreamsaspreviouslydescribedat.
2.
2ExchangingCandidatesOncetheinitiatorhasasetofcandidates,itsendsaJinglesession-initiaterequestthatcontainsoneormoretransportcandidateswhichareamixtureofXEP-0065streamhostsandICEcandidatesusedinXEP-0176.
JustaswiththeelementfromXEP-0065,heretheelementcontainsthecandidates.
ThefollowingrulesapplytothedefinedattributesoftheelementwhensentbytheinitiatorinaJinglesession-initatemessage:1.
The'sid'attributeMUSTbeincluded.
ThisattributespecifiestheStreamIDforthisbytestream.
2.
The'dstaddr'attributeSHOULDbeincludediftheinitiatorincludesatleastonecandi-dateofthe"proxy"type.
ThisattributeenablestheinitiatortocommunicatethevalueithascalculatedfortheSOCKS5DST.
ADDRfield(seeSection5.
3.
2andSection7ofXEP-0065)sothattherespondercanprovideanaccuratevaluetotheproxyduringSOCKS522PROTOCOLnegotiation.
HerethevalueiscalculatedasSHA1(SID+InitiatorJID+ResponderJID)sincetheinitiatorwillbetheentitythatactivatesthebytestreamattheproxy.
43.
The'mode'attributeMAYbeincluded.
ThisattributespecifieswhethertheunderlyingtransportforthebytestreamwillbeTCP(avalueof"tcp",whichisthedefault)orUDP(avalueof"udp",seeSection8ofXEP-0065).
Inthefollowingexample,Romeo'sclienthastwointerfaces,oneonport5086andtheotheronport5087.
TheprovidedcandidatesaretheIPv4addressofoneinterface,theIPv4addressofthesecondinterface,andaproxyaddressatstreamer.
shakespeare.
lit.
BecauseRomeo'sclienthasincludedaproxycandidate,itincludesitscomputedvaluefortheDST.
ADDRfieldinthe'dstaddr'attribute(herecomputedastheSHA-1hashof"vj3hs98yromeo@montague.
lit/orchardjuliet@capulet.
lit/balcony").
Listing1:Initiatorsendssession-initiateTheresponderimmediatelyacknowledgesreceipt.
Listing2:Responderacknowledgessession-initiateDependingontheapplicationtype,auseragentcontrolledbyahumanusermightneedtowaitfortheusertoaffirmadesiretoproceedwiththesessionbeforecontinuing.
Whentheuseragenthasreceivedsuchaffirmation(oriftheuseragentcanautomaticallyproceedforanyreason,e.
g.
becausenohumaninterventionisexpectedorbecauseahumanuserhasconfiguredtheuseragenttoautomaticallyacceptsessionswithagivenentity),itreturnsaJinglesession-acceptmessage.
ThismessageMUSTcontainaelementqualifiedbythe'urn:xmpp:jingle:transports:s5b:1'namespace,whichSHOULDinturncontainoneelementforeachSOCKS5Bytestreamscandidategeneratedbyorknowntotheresponder,butMAYinsteadbeemptyiftheresponderdoesnotwishtoofferanycandidatesorwishestosendeachcandidateasthepayloadofatransport-infomessage.
Iftherespondersendscandidatesinthesession-accept,thechancesofasuccessfulconnectionareincreased.
Forexample,theinitiatormightbebehindaNATormighthavenoaccesstoanS5Bproxy,whereastherespondermighthaveapublicIPaddress,mightknowaboutaproxy,ormighthaveNATpenetrationsupportlikeNAT-PMPinarouter.
However,theresponderMUSTNOTofferasacandidateanyhost/portcombinationthathasalreadybeenofferedbytheinitiator;thishelpstopreventfailureofnegotiationwithS5Bproxies.
ThefollowingrulesapplytothedefinedattributesoftheelementwhensentbytheresponderinaJinglesession-acceptmessage:1.
The'sid'attributeMUSTbeincludedandMUSTbethesameStreamIDcommunicatedbytheinitiatorintheJinglesession-initiatemessage.
2.
The'dstaddr'attributeSHOULDbeincludediftheresponderincludesatleastonecandi-dateofthe"proxy"type.
Thisattributeenablestherespondertocommunicatethevalue42PROTOCOLithascalculatedfortheSOCKS5DST.
ADDRfield(seeSection5.
3.
2andSection7ofXEP-0065)sothattheinitiatorcanprovideanaccuratevaluetotheproxyduringSOCKS5negotiation.
HerethevalueiscalculatedasSHA1(SID+ResponderJID+InitiatorJID)sincetheresponderwillbetheentitythatactivatesthebytestreamattheproxy.
53.
The'mode'attributeMUSTNOTbeincludedsincetheunderlyingtransportforthebytestreamisdeterminedbytheinitiator.
Inthefollowingexample,Juliet'sclientopensoneport.
Theprovidedcandidatesarethe(private)IPv4addressoftheinterface,a(public)IPv6address,thepublicIPv4addresscreatedbymappingtheprivateIPaddress/portusingNAT-PMP,andaproxyaddress.
BecauseJuliet'sclienthasincludedaproxycandidate,itincludesitscomputedvaluefortheDST.
ADDRfieldinthe'dstaddr'attribute(herecomputedastheSHA-1hashof"vj3hs98yjuliet@capulet.
lit/balconyromeo@montague.
lit/orchard").
Listing3:Respondersendssession-acceptwithcandidatesTheinitiatoracknowledgesreceiptandtriestoconnecttotheofferedcandidates.
Listing4:Initiatoracknowledgessession-acceptAclientSHOULDchecktheofferedcandidatesinorderoftheirpriority,startingwiththehighestvalue.
Howthepriorityiscalculateddependsontheactualavailableinterfaces.
AnimplementationSHOULDusethefollowingformula:priority=(2^16)*(typepreference)+(localpreference)Thetypepreferenceisanintegervaluebetween0and127.
Thefollowingtypesandtheirsuggestedpreferencevaluesaredefined.
TypeDescriptionPreferenceValuedirectDirectconnectionusingthegivenin-terface126assistedDirectconnectionusingNATassistingtechnologieslikeNAT-PMPorUPnP-IGD120tunnelTunnelprotocolssuchasTeredo110proxySOCKS5Relay10Thelocalpreferenceisusedtoratedifferentcandidatesofthesametype,e.
g.
aDSLlinkmightbepreferredoveraVPNconnection.
ThevalueofthelocalpreferenceSHOULDbebetween0and65535.
Theproposedvaluesareonlyguidelines.
Ifaclientwantstoincreaseor62PROTOCOLdecreasethevalueofaspecificcandidateitisfreetodoso.
Forinstance,aclientmighthaveanexpensiveUMTSlinkasalastresortandmightratethislinklowerthanallSOCKS5relays.
2.
3ConnectingtoCandidatesAfterreceivingitspeer'scandidates,aclientstarttoconnecttotheminorderofthepriority.
AdetaileddescriptionoftheprotocolcanbefoundinXEP-0065.
Onceoneclienthassuccessfullycreatedaconnection,itsendstheelementtothepeerinsideaJingletransport-infomessage.
Ifaclientreceivesacandidate-usednotificationitSHOULDcontinuetryingtoconnecttocandidatessentbyitspeerifithasnottriedallcandidateswithahigherprioritythantheonesuccessfullyusedbythepeer.
Listing5:Initiatorsendscandidate-usedinJingletransport-infoThepeerimmediatelyacknowledgesreceipt.
Listing6:Responderacknowledgescandidate-usedmessageIfaclientisunabletoconnecttoanycandidatesentbyitspeer,orifitstoppedtryingtoconnectbecauseitspeersentacandidate-usednotificationwithapriorityhigherthanitsremainingcandidate(s),itsendsacandidate-errorJingletransport-infomessage(thisisequivalenttotheIQ-errorwithcode='500'fromthe"fast-mode"extension).
72PROTOCOLListing7:Respondersendscandidate-errorinJingletransport-infoThepeerimmediatelyacknowledgesreceipt.
Listing8:Responderacknowledgescandidate-errormessage2.
4CompletingtheNegotiationThetransportnegotiationiscompletedinoneofthefollowingways:1.
Ifbothpartiessendacandidate-errornotificationthentheSOCKS5negotiationhasfailedandthepartiesneedtofallbacktosomeothertransportmethod,typically(butnotnecessarily)IBB;seetheFallbackMethodssectionofthisdocumentfordetails.
2.
Ifoneofthepartiessendsacandidate-errornotificationandtheotherpartysendsacandidate-usednotification,thenthecandidate-usedshallbeconsideredthenominatedcandidate.
3.
Ifbothpartiessendacandidate-usednotificationbutthecandidateshaveadifferentpriority,thenthecandidatewiththehigherpriorityshallbeconsideredthenominatedcandidate.
4.
Ifbothpartiessendacandidate-usednotificationwithcandidateshavingthesamepri-ority,thenthecandidatechosenbytheinitiatorshallbeconsideredthenominatedcan-didate(thisisconsistentwiththerulesinXEP-0166).
82PROTOCOLThepartiesshallusethenominatedcandidateforthedatatransfer.
However,ifthenomi-natedcandidateisofthe"proxy"type,thenthepeerhasnowaytoknowwhenitcansenddata.
ThereforethepartythatofferedthenominatedcandidateMUSTdotwothings.
.
.
First,itactivatesthebytestream,asdescribedinXEP-0065:Listing9:Responderactivatesthebytestreamatproxyromeo@montague.
lit/orchardListing10:ProxyinformsresponderofactivationSecond,itsendsanactivatednotificationtothepeer;itdoessobysendingatransport-infomessagecontaininganelement:Listing11:ResponderinformsinitiatorthatbytestreamhasbeenactivatedIfthenominatedcandidateisoftheproxytypeandeitherpartycannotconnecttotheproxy(forexamplebecauseofarestrictivefirewall),thefailingpartyshallsendatransport-info92PROTOCOLmessagecontaininganelement.
Listing12:ResponderinformsinitiatorofinabilitytoconnecttotheproxyThepartiesshallthenconsiderthebytestreamunsuccessfulandSHOULDattempttofallbacktoanothertransportasdescribedinFallbackMethods.
2.
5ExchangingDataOncethepartieshavechosen(andifnecessaryactivated)astreamhost,theycanexchangedataasdefinedinXEP-0065.
2.
6ClosingtheBytestreamOncethepartieshavefinishedusingthebytestream(e.
g.
,becauseacompletefilehasbeensent),eitherpartycansendaJinglesession-terminateaction.
Listing13:Initiatorterminatesthesession103FALLBACKMETHODSTheotherpartythenacknowledgesthesession-terminateandtheJinglesessionisfinished.
Listing14:Responderacknowledgessession-terminate3FallbackMethodsIftheSOCKS5Bytestreamsnegotiationfails,thepartiesmightwantto"fallback"toan-othertransport.
CurrentlythetransportoflastresortforastreamingexchangeisIn-BandBytestreams(XEP-0047)6asdescribedforJingleinJingleIn-BandBytestreamsTransportMethod(XEP-0261)7,howeverifothertransportmethodsaredefinedinthefuture(e.
g.
RFC65448)thenclientscouldfallbacktothosemethodsinsteadofIBB.
TheprotocolflowforfallbackfromS5BtoIBBisasfollows.
RomeoJuliet|||session-initiate||(withS5Binfo)||ack||session-accept||(withS5Binfo)||[SOCKS5failure!
]||x-x||transport-replace(IBB)||ack||transport-accept(IBB)||ack||IBB"SESSION"|6XEP-0047:In-BandBytestreams.
7XEP-0261:JingleIn-BandBytestreamsTransportMethod.
8RFC6544:TCPCandidateswithInteractiveConnectivityEstablishment(ICE).
113FALLBACKMETHODS|terminate||ack|||FirsttheinitiatorsendsaJinglesession-initiate,inthiscasewithatransportofSOCKS5Bytestreams.
Theprotocolflowisexactlythesameasdescribedabove.
Ifbothpartiesareunabletoconnecttoacandidateprovidedbythepeer,theysendcandidate-errormessagestoindicatethatSOCKS5hasfailed.
TheinitiatorMUSTeitherterminatetheJinglesessionwithaJinglereasonoforreplacethetransportwithsomethingelseusingthetransport-replaceaction.
TypicallythefallbackoptionisIBB(see,forexample,JingleFileTransfer(XEP-0234)9).
Thereforetheinitiatorsendsatransport-replaceactionincludingatransportofIBB.
Listing15:InitiatorreplacestransportwithIBBTheresponderthenacknowledgesthetransport-replaceaction.
Listing16:Responderacknowledgestransport-replaceIfthetransportreplacementisacceptable,theresponderthensendsatransport-acceptactiontotheinitiator(ifnot,therespondersendsatransport-rejectaction).
Iftheresponderwishestouseasmallerblocksizethantheonespecifiedinthetransport-replaceoffer,thiscanbedonebyspecifyingablock-sizeattributeinthetransport-acceptaction.
9XEP-0234:JingleFileTransfer.
124PROCESSINGRULESANDUSAGEGUIDELINESListing17:Respondersendstransport-acceptTheinitiatoracknowledgestheJingletransport-acceptaction.
Listing18:Initiatoracknowledgestransport-acceptNowthepartiescansenddatausingIn-BandBytestreamsasdefinedinXEP-0261andXEP-0047.
4ProcessingRulesandUsageGuidelinesThesameprocessingrulesandusageguidelinesdefinedinXEP-0065applytotheJingleS5BTransportMethod.
ThisdocumentaddsthefollowingimplementationsuggestionsinthecontextofJingle:1.
Trytheofferedcandidatesintheorderoftheirpriority,fromhighesttolowest.
2.
Staggertheconnectionattempts(e.
g.
,initiatecommunicationswiththehighest-prioritycandidate,thenwait200msbeforeinitiatingcommunicationswiththesecond-highest-prioritycandidate).
3.
Toincreasethepotentialforusingadirectconnection,considerwaitingabitlongerthan200mstoinitiatecommunicationswithproxycandidates.
136SECURITYCONSIDERATIONS5DeterminingSupportToadvertiseitssupportfortheJingleSOCKS5BytestreamsTransportMethod,whenreplyingtoServiceDiscovery(XEP-0030)10informationrequestsanentityMUSTreturnURNsforanyversionofthisprotocolthattheentitysupports--e.
g.
,"urn:xmpp:jingle:transports:s5b:1"forthisversion(seeNamespaceVersioningregardingthepossibilityofincrementingtheversionnumber).
Listing19:ServicediscoveryinformationrequestListing20:ServicediscoveryinformationresponseInorderforanapplicationtodeterminewhetheranentitysupportsthisprotocol,wherepossibleitSHOULDusethedynamic,presence-basedprofileofservicediscoverydefinedinEntityCapabilities(XEP-0115)11.
However,ifanapplicationhasnotreceivedentitycapabilitiesinformationfromanentity,itSHOULDuseexplicitservicediscoveryinstead.
6SecurityConsiderations6.
1SharingIPAddressesTheexchangeofcandidatesmightresultinexposureofthesender'sIPaddresses,whichcompriseaformofpersonallyidentifyinginformation.
AJingleclientMUSTenableausertocontrolwhichentitieswillbeallowedtoreceivesuchinformation.
Ifahumanuserexplicitlyacceptsasessionrequest,thentheclientcanconsiderthatactiontoimplyapprovalofIPaddresssharing.
10XEP-0030:ServiceDiscovery.
11XEP-0115:EntityCapabilities.
148XMPPREGISTRARCONSIDERATIONS6.
2EncryptionofMediaThisspecification,likeXEP-0065beforeit,doesnotdirectlysupportend-to-endencryptionofthemediasentoverthetransport.
7IANAConsiderationsThisdocumentrequiresnointeractionwiththeInternetAssignedNumbersAuthority(IANA)12.
8XMPPRegistrarConsiderations8.
1ProtocolNamespacesTheXMPPRegistrar13includes'urn:xmpp:jingle:transports:s5b:1'initsregistryofprotocolnamespacesat,asdescribedinSection4ofXMPPRegistrarFunction(XEP-0053)14.
8.
2ProtocolVersioningIftheprotocoldefinedinthisspecificationundergoesarevisionthatisnotfullybackwards-compatiblewithanolderversion,theXMPPRegistrarshallincrementtheprotocolversionnumberfoundattheendoftheXMLnamespacesdefinedherein,asdescribedinSection4ofXEP-0053.
8.
3JingleTransportMethodsTheXMPPRegistrar15includes"jingle-s5b"initsregistryofJingletransportmethodsat.
Theregistrysubmissionisasfollows:12TheInternetAssignedNumbersAuthority(IANA)isthecentralcoordinatorfortheassignmentofuniquepa-rametervaluesforInternetprotocols,suchasportnumbersandURIschemes.
Forfurtherinformation,see.
13TheXMPPRegistrarmaintainsalistofreservedprotocolnamespacesaswellasregistriesofparametersusedinthecontextofXMPPextensionprotocolsapprovedbytheXMPPStandardsFoundation.
Forfurtherinforma-tion,see.
14XEP-0053:XMPPRegistrarFunction.
15TheXMPPRegistrarmaintainsalistofreservedprotocolnamespacesaswellasregistriesofparametersusedinthecontextofXMPPextensionprotocolsapprovedbytheXMPPStandardsFoundation.
Forfurtherinforma-tion,see.
159SCHEMAs5bAmethodfornegotiatingdataexchangeoverSOCKS5Bytestreams.
streamingXEP-02609SchemaTheprotocoldocumentedbythisschemaisdefinedinXEP-0260:http://www.
xmpp.
org/extensions/xep-0260.
html169SCHEMA1710ACKNOWLEDGEMENTS10AcknowledgementsThankstoSteffenLarsen,FlorianSchmaus,KevinSmith,andRemkoTrononfortheirfeedback.
18