From ff63e0cdffe7fed64ea41d68dbc293653c57406e Mon Sep 17 00:00:00 2001 From: zzz Date: Fri, 4 Sep 2026 08:33:20 -0400 Subject: [PATCH] i2ptunnel: Fix SOCKS 4/4a downgrade bypass of proxy auth The guard meant to reject SOCKS 4/4a on auth-enabled tunnels checked for legacy proxyUsername/proxyPassword properties that are no longer used for SOCKS, we now store sha256 digest under different properties, so when auth is enabled, a unauthenticated SOCKS 4a CONNECT was accepted. Fix by removing check for legacy properties. Reported by: haoxucu --- .../java/src/net/i2p/i2ptunnel/socks/SOCKSServerFactory.java | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/apps/i2ptunnel/java/src/net/i2p/i2ptunnel/socks/SOCKSServerFactory.java b/apps/i2ptunnel/java/src/net/i2p/i2ptunnel/socks/SOCKSServerFactory.java index 9170d7a2e..8b7ea5fde 100644 --- a/apps/i2ptunnel/java/src/net/i2p/i2ptunnel/socks/SOCKSServerFactory.java +++ b/apps/i2ptunnel/java/src/net/i2p/i2ptunnel/socks/SOCKSServerFactory.java @@ -50,9 +50,7 @@ class SOCKSServerFactory { switch (socksVer) { case 0x04: // SOCKS version 4/4a - if (Boolean.parseBoolean(props.getProperty(I2PTunnelHTTPClientBase.PROP_AUTH)) && - props.containsKey(I2PTunnelHTTPClientBase.PROP_USER) && - props.containsKey(I2PTunnelHTTPClientBase.PROP_PW)) { + if (Boolean.parseBoolean(props.getProperty(I2PTunnelHTTPClientBase.PROP_AUTH))) { throw new SOCKSException("SOCKS 4/4a not supported when authorization is required"); } serv = new SOCKS4aServer(ctx, s, props);