SOCKS5协议(中文翻译)

 
 
 
Network Working Group                      M. Leech
Request for Comments: 1928          Bell-Northern Research Ltd
Category: Standards Track                    M. Ganis
                     International Business Machines
                                 Y. Lee
                         NEC Systems Laboratory
                                R. Kuris
                            Unify Corporation
                                D. Koblas
                         Independent Consultant
                                L. Jones
                         Hewlett-Packard Company
                               March 1996
 
 
            SOCKS Protocol Version 5
 
Status of this Memo
[译]本备忘录状态
 
  This document specifies an Internet standards track protocol for the
  Internet community, and requests discussion and suggestions for
  improvements. Please refer to the current edition of the “Internet
  Official Protocol Standards” (STD 1) for the standardization state
  and status of this protocol. Distribution of this memo is unlimited.
  [译]本文档讲述了一种Internet社区的Internet标准跟踪协议,它需要进一步进行讨论和建议以得到改进。请参考最新版的“Internet正式协议标准” (STD1)来获得本协议的标准化程度和状态。本备忘录的发布不受任何限制。
 
Acknowledgments
[译]知识背景
 
  This memo describes a protocol that is an evolution of the previous
  version of the protocol, version 4 [1]. This new protocol stems from
  active discussions and prototype implementations. The key
  contributors are: Marcus Leech: Bell-Northern Research, David Koblas:
  Independent Consultant, Ying-Da Lee: NEC Systems Laboratory, LaMont
  Jones: Hewlett-Packard Company, Ron Kuris: Unify Corporation, Matt
  Ganis: International Business Machines.
  [译]这个备忘录描述了从同一协议的前一版本(版本4[1])发展而来的一个协议。这个新的协议起源于当前的一些讨论和原型的实现(active discussions and prototype implementations)。关键的贡献人有:Marcus Leech: Bell-Northern Research, David Koblas: Independent Consultant, Ying-Da Lee: NEC Systems Laboratory, LaMont Jones: Hewlett-Packard Company, Ron Kuris: Unify Corporation, Matt Ganis: International Business Machines。
 
1. Introduction
[译]介绍
 
  The use of network firewalls, systems that effectively isolate an
  organizations internal network structure from an exterior network,
  such as the INTERNET is becoming increasingly popular. These
  firewall systems typically act as application-layer gateways between
  networks, usually offering controlled TELNET, FTP, and SMTP access.
  With the emergence of more sophisticated application layer protocols
  designed to facilitate global information discovery, there exists a
  need to provide a general framework for these protocols to
  transparently and securely traverse a firewall.
  [译]利用网络防火墙可以将组织内部的网络结构从外部网络如INTERNET中有效地隔离,这种方法在许多网络系统中正变得流行起来。这种防火墙系统通常以应用层网关的形式工作在两个网络之间,提供TELNET、FTP、SMTP等的接入。随着越来越多的使全球信息查找更容易的复杂的应用层协议的出现,有必要提供一个通用框架来使这些协议安全透明地穿过防火墙。
 
 
 
 
 
Leech, et al        Standards Track           [Page 1]


RFC 1928        SOCKS Protocol Version 5       March 1996
 
 
  There exists, also, a need for strong authentication of such
  traversal in as fine-grained a manner as is practical. This
  requirement stems from the realization that client-server
  relationships emerge between the networks of various organizations,
  and that such relationships need to be controlled and often strongly
  authenticated.
  而且在实际应用中还需要一种安全的认证方式用以穿越防火墙。这个要求起源于两个组织的网络中客户/服务器关系的出现,这个关系需要得到控制并要求有安全的认证。
 
  The protocol described here is designed to provide a framework for
  client-server applications in both the TCP and UDP domains to
  conveniently and securely use the services of a network firewall.
  The protocol is conceptually a “shim-layer” between the application
  layer and the transport layer, and as such does not provide network-
  layer gateway services, such as forwarding of ICMP messages.
  [译]在这儿所描述的协议框架是为了让使用TCP和UDP的客户/服务器应用程序更方便安全地使用网络防火墙所提供的服务所设计的。这个协议从概念上来讲是介于应用层和传输层之间的“中介层(shim-layer)”,因而不提供如传递ICMP信息之类由网络层网关的所提供的服务。
 
2. Existing practice
[译]现有的协议
 
  There currently exists a protocol, SOCKS Version 4, that provides for
  unsecured firewall traversal for TCP-based client-server
  applications, including TELNET, FTP and the popular information-
  discovery protocols such as HTTP, WAIS and GOPHER.
  [译]当前存在一个协议SOCKS 4,它为TELNET、FTP、HTTP、WAIS和GOPHER等基于TCP协议的客户/服务器程序提供了一个不安全的防火墙。
 
  This new protocol extends the SOCKS Version 4 model to include UDP,
  and extends the framework to include provisions for generalized
  strong authentication schemes, and extends the addressing scheme to
  encompass domain-name and V6 IP addresses.
  [译]而这个新的协议扩展了SOCKS V4,以使其支持UDP、框架规定的安全认证方案、地址解析方案(addressing scheme)中所规定的域名和IPV6。
 
  The implementation of the SOCKS protocol typically involves the
  recompilation or relinking of TCP-based client applications to use
  the appropriate encapsulation routines in the SOCKS library.
  [译]为了实现这个SOCKS协议,通常需要重新编译或者重新链接基于TCP的客户端应用程序以使用SOCKS库中相应的加密函数。
 
Note:
[译]注意:
 
  Unless otherwise noted, the decimal numbers appearing in packet-
  format diagrams represent the length of the corresponding field, in
  octets. Where a given octet must take on a specific value, the
  syntax X’hh’ is used to denote the value of the single octet in that
  field. When the word ‘Variable’ is used, it indicates that the
  corresponding field has a variable length defined either by an
  associated (one or two octet) length field, or by a data type field.
  [译]除非特别注明,所有出现在数据包格式图中的十进制数字均以字节表示相应域的长度。如果某域需要给定一个字节的值,用X’hh’来表示这个字节中的值。如果某域中用到单词’Variable’,这表示该域的长度是可变的,且该长度定义在一个和这个域相关联(1 – 2个字节)的域中,或一个数据类型域中。
 
3. Procedure for TCP-based clients
[译]基于TCP协议的客户
 
  When a TCP-based client wishes to establish a connection to an object
  that is reachable only via a firewall (such determination is left up
  to the implementation), it must open a TCP connection to the
  appropriate SOCKS port on the SOCKS server system. The SOCKS service
  is conventionally located on TCP port 1080. If the connection
  request succeeds, the client enters a negotiation for the
 
 
 
Leech, et al        Standards Track           [Page 2]


RFC 1928        SOCKS Protocol Version 5       March 1996
 
 
  authentication method to be used, authenticates with the chosen
  method, then sends a relay request. The SOCKS server evaluates the
  request, and either establishes the appropriate connection or denies
  it.
  [译]当一个基于TCP协议的客户端希望与一个只能通过防火墙可以到达的目标(这是由实现所决定的)建立连接,它必须先建立一个与SOCKS服务器上SOCKS端口的TCP连接。通常这个TCP端口是1080。当连接建立后,客户端进入协议的“握手(negotiation)”过程:认证方式的选择,根据选中的方式进行认证,然后发送转发的要求。SOCKS服务器检查这个要求,根据结果,或建立合适的连接,或拒绝。
 
  Unless otherwise noted, the decimal numbers appearing in packet-
  format diagrams represent the length of the corresponding field, in
  octets. Where a given octet must take on a specific value, the
  syntax X’hh’ is used to denote the value of the single octet in that
  field. When the word ‘Variable’ is used, it indicates that the
  corresponding field has a variable length defined either by an
  associated (one or two octet) length field, or by a data type field.
  [译]除非特别注明,所有出现在数据包格式图中的十进制数字均以字节表示相应域的长度。如果某域需要给定一个字节的值,用X’hh’来表示这个字节中的值。如果某域中用到单词’Variable’,这表示该域的长度是可变的,且该长度定义在一个和这个域相关联(1 – 2个字节)的域中,或一个数据类型域中。
 
  The client connects to the server, and sends a version
  identifier/method selection message:
  [译]客户端连到服务器后,然后就发送请求来协商版本和认证方法:
 
|VER | NMETHODS | METHODS |
|—-|———-|———-|
| 1 |  1   | 1 to 255 |
 
  The VER field is set to X’05’ for this version of the protocol. The
  NMETHODS field contains the number of method identifier octets that
  appear in the METHODS field.
  [译]这个版本的SOCKS协议中,VER字段被设置成X’05’。NMETHODS字段包含了在METHODS字段中出现的方法标示的数目(以字节为单位)。
 
  The server selects from one of the methods given in METHODS, and
  sends a METHOD selection message:
  [译]服务器从这些给定的方法中选择一个并发送一个方法选中的消息回客户端:
 
|VER | METHOD |
|—-|——–|
| 1 |  1  |
 
  If the selected METHOD is X’FF’, none of the methods listed by the
  client are acceptable, and the client MUST close the connection.
  [译]如果选中的消息是X’FF’,这表示客户端所列出的方法列表中没有一个方法被选中,客户端必须关闭连接。
 
  The values currently defined for METHOD are:
  [译]当前定义的方法有:
 
     o X’00’ NO AUTHENTICATION REQUIRED
     o X’01’ GSSAPI
     o X’02’ USERNAME/PASSWORD
     o X’03’ to X’7F’ IANA ASSIGNED
     o X’80’ to X’FE’ RESERVED FOR PRIVATE METHODS
     o X’FF’ NO ACCEPTABLE METHODS
     [译]X’00’ 不需要认证
     [译]X’01’ GSSAPI
     [译]X’02’ 用户名/密码
     [译]X’03’ – X’7F’ 由IANA分配
     [译]X’80’ – X’FE’ 为私人方法所保留的
     [译]X’FF’ 没有可以接受的方法
 
  The client and server then enter a method-specific sub-negotiation.
 
 
 
Leech, et al        Standards Track           [Page 3]


RFC 1928        SOCKS Protocol Version 5       March 1996
 
 
  Descriptions of the method-dependent sub-negotiations appear in
  separate memos.
  [译]然后客户和服务器进入由选定认证方法所决定的子协商过程(sub-negotiation)。各种不同的方法的子协商过程的描述请参考各自的备忘录。
 
  Developers of new METHOD support for this protocol should contact
  IANA for a METHOD number. The ASSIGNED NUMBERS document should be
  referred to for a current list of METHOD numbers and their
  corresponding protocols.
  [译]开发者如果要为自己的方法得到一个方法号,可以联系IANA。可以参考关于已经被分配号码的文档以得到当前所有方法的列表和相应的协议。
 
  Compliant implementations MUST support GSSAPI and SHOULD support
  USERNAME/PASSWORD authentication methods.
  [译]符合本文档的SOCKS V5实现必须支持GSSAPI,并且在将来支持用户名/密码认证方式。
 
4. Requests
[译]请求
 
  Once the method-dependent subnegotiation has completed, the client
  sends the request details. If the negotiated method includes
  encapsulation for purposes of integrity checking and/or
  confidentiality, these requests MUST be encapsulated in the method-
  dependent encapsulation.
  [译]一旦子协商过程结束后,客户端就发送详细的请求信息。如果协商的方法中有以完整性检查和/或安全性为目的的封装,这些请求必须按照该方法所定义的方式进行封装。
 
  The SOCKS request is formed as follows:
  [译]SOCKS请求的格式如下:  

VER CMD  RSV  ATYP DST.ADDR DST.PORT
1   1  X’00’  1  Variable   2  

 
   Where:
   [译]其中
 
     o VER  protocol version: X’05’
     o CMD
       o CONNECT X’01’
       o BIND X’02’
       o UDP ASSOCIATE X’03’
     o RSV  RESERVED
     o ATYP  address type of following address
       o IP V4 address: X’01’
       o DOMAINNAME: X’03’
       o IP V6 address: X’04’
     o DST.ADDR    desired destination address
     o DST.PORT desired destination port in network octet
       order
     [译]VER 协议版本: X’05’
     [译]CMD
       [译]CONNECT: X’01’
       [译]BIND: X’02’
       [译]UDP: ASSOCIATE X’03’
     [译]RSV 保留
     [译]ATYP 后面的地址类型
       [译]IPV4: X’01’
       [译]域名: X’03’
       [译]IPV6: X’04’
     [译]DST.ADDR 目的地址
     [译]DST.PORT 以网络字节顺序出现的端口号
 
  The SOCKS server will typically evaluate the request based on source
  and destination addresses, and return one or more reply messages, as
  appropriate for the request type.
  [译]SOCKS服务器会根据源地址和目的地址来分析请求,然后根据请求类型返回一个或多个应答。
 
 
 
 
 
Leech, et al        Standards Track           [Page 4]


RFC 1928        SOCKS Protocol Version 5       March 1996
 
 
5. Addressing
[译]地址
 
  In an address field (DST.ADDR, BND.ADDR), the ATYP field specifies
  the type of address contained within the field:
  [译]ATYP字段中描述了地址字段(DST.ADDR,BND.ADDR)所包含的地址类型:
 
     o X’01’
 
  the address is a version-4 IP address, with a length of 4 octets
  [译]基于IPV4的IP地址,4个字节长
 
     o X’03’
 
  the address field contains a fully-qualified domain name. The first
  octet of the address field contains the number of octets of name that
  follow, there is no terminating NUL octet.
  [译]基于域名的地址,地址字段中的第一字节是以字节为单位的该域名的长度,没有结尾的NUL字节。
 
     o X’04’
 
  the address is a version-6 IP address, with a length of 16 octets.
  [译]基于IPV6的IP地址,16个字节长
 
6. Replies
[译]应答
 
  The SOCKS request information is sent by the client as soon as it has
  established a connection to the SOCKS server, and completed the
  authentication negotiations. The server evaluates the request, and
  returns a reply formed as follows:
  [译]一旦建立了一个到SOCKS服务器的连接,并且完成了认证方式的协商过程,客户机将会发送一个SOCKS请求信息给服务器。服务器将会根据请求,以如下格式返回:  

VER REP  RSV  ATYP BND.ADDR BND.PORT
1   1  X’00’  1  Variable   2  

 
   Where:
   [译]其中:
 
     o VER  protocol version: X’05’
     o REP  Reply field:
       o X’00’ succeeded
       o X’01’ general SOCKS server failure
       o X’02’ connection not allowed by ruleset
       o X’03’ Network unreachable
       o X’04’ Host unreachable
       o X’05’ Connection refused
       o X’06’ TTL expired
       o X’07’ Command not supported
       o X’08’ Address type not supported
       o X’09’ to X’FF’ unassigned
     o RSV  RESERVED
     o ATYP  address type of following address
 
 
 
Leech, et al        Standards Track           [Page 5]


RFC 1928        SOCKS Protocol Version 5       March 1996
 
 
       o IP V4 address: X’01’
       o DOMAINNAME: X’03’
       o IP V6 address: X’04’
     o BND.ADDR    server bound address
     o BND.PORT    server bound port in network octet order
     [译]VER 协议版本: X’05’
     [译]REP 应答字段:
       [译]X’00’ 成功
       [译]X’01’ 普通的SOCKS服务器请求失败
       [译]X’02’ 现有的规则不允许的连接
       [译]X’03’ 网络不可达
       [译]X’04’ 主机不可达
       [译]X’05’ 连接被拒
       [译]X’06’ TTL超时
       [译]X’07’ 不支持的命令
       [译]X’08’ 不支持的地址类型
       [译]X’09’ – X’FF’ 未定义
     [译]RSV 保留
     [译]ATYP 后面的地址类型
     [译]BND.ADDR 服务器绑定的地址
     [译]BND.PORT 以网络字节顺序表示的服务器绑定的段口
 
  Fields marked RESERVED (RSV) must be set to X’00’.
  [译]标识为RSV的字段必须设为X’00’.
 
  If the chosen method includes encapsulation for purposes of
  authentication, integrity and/or confidentiality, the replies are
  encapsulated in the method-dependent encapsulation.
  [译]如果选中的方法中有以完整性检查和/或安全性为目的的封装,这些应答必须按照该方法所定义的方式进行封装。
 
CONNECT
 
  In the reply to a CONNECT, BND.PORT contains the port number that the
  server assigned to connect to the target host, while BND.ADDR
  contains the associated IP address. The supplied BND.ADDR is often
  different from the IP address that the client uses to reach the SOCKS
  server, since such servers are often multi-homed. It is expected
  that the SOCKS server will use DST.ADDR and DST.PORT, and the
  client-side source address and port in evaluating the CONNECT
  request.
  [译]在对一个CONNECT命令的应答中,BND.PORT包含了服务器分配的用来连到目标机的端口号,BND.ADDR则是相应的IP地址。由于SOCKS服务器通常有多个IP,应答中的BND.ADDR常和客户端连到SOCKS服务器的那个IP不同。SOCKS服务器可以利用DST.ADDR和DST.PORT,以及客户端源地址和端口来对一个CONNECT请求进行分析。
 
BIND
 
  The BIND request is used in protocols which require the client to
  accept connections from the server. FTP is a well-known example,
  which uses the primary client-to-server connection for commands and
  status reports, but may use a server-to-client connection for
  transferring data on demand (e.g. LS, GET, PUT).
  [译]BIND请求通常被用在那些要求客户端接受来自服务器的连接的协议上。FTP是一个典型的例子。它建立一个从客户端到服务器端的连接来执行命令以及接收状态的报告,而使用另一个从服务器到客户端的连接来接收传输数据的要求(如LS,GET,PUT)。
 
  It is expected that the client side of an application protocol will
  use the BIND request only to establish secondary connections after a
  primary connection is established using CONNECT. In is expected that
  a SOCKS server will use DST.ADDR and DST.PORT in evaluating the BIND
  request.
  [译]建议只有在一个应用协议的客户端在使用CONNECT命令建立主连接后才可以使用BIND命令建立第二个连接。建议SOCKS服务器使用DST.ADDR和DST.PORT来评价BIND请求。
 
  Two replies are sent from the SOCKS server to the client during a
  BIND operation. The first is sent after the server creates and binds
  a new socket. The BND.PORT field contains the port number that the
  SOCKS server assigned to listen for an incoming connection. The
  BND.ADDR field contains the associated IP address. The client will
  typically use these pieces of information to notify (via the primary
  or control connection) the application server of the rendezvous
  address. The second reply occurs only after the anticipated incoming
  connection succeeds or fails.
  [译]在一个BIND请求的操作过程中,SOCKS服务器要发送两个应答给客户端。当服务器建立并绑定一个新的套接口时发送第一个应答。BND.PORT字段包含SOCKS服务器用来监听进入的连接的端口号,BAND.ADDR字段包含了对应的IP地址。客户端通常使用这些信息来告诉(通过主连接或控制连接)应用服务器连接的汇接点。
 
 
 
 
 
Leech, et al        Standards Track           [Page 6]


RFC 1928        SOCKS Protocol Version 5       March 1996
 
 
  In the second reply, the BND.PORT and BND.ADDR fields contain the
  address and port number of the connecting host.
  [译]第二个应答仅发生在所期望到来的连接成功或失败之后。在第二个应答中,BND.PORT和BND.ADDR字段包含了连上来的主机的IP地址和端口号。
 
UDP ASSOCIATE
 
  The UDP ASSOCIATE request is used to establish an association within
  the UDP relay process to handle UDP datagrams. The DST.ADDR and
  DST.PORT fields contain the address and port that the client expects
  to use to send UDP datagrams on for the association. The server MAY
  use this information to limit access to the association. If the
  client is not in possesion of the information at the time of the UDP
  ASSOCIATE, the client MUST use a port number and address of all
  zeros.
  [译]UDP ASSOCIATE请求通常是要求建立一个UDP转发进程来控制到来的UDP数据报。DST.ADDR和DST.PORT 字段包含客户端所希望的用来发送UDP数据报的IP地址和端口号。服务器可以使用这个信息来限制进入的连接。如果客户端在发送这个请求时没有地址和端口信息,客户端必须用全0来填充。
 
  A UDP association terminates when the TCP connection that the UDP
  ASSOCIATE request arrived on terminates.
  [译]当与UDP相应的TCP连接中断时,该UDP连接也必须中断。
 
  In the reply to a UDP ASSOCIATE request, the BND.PORT and BND.ADDR
  fields indicate the port number/address where the client MUST send
  UDP request messages to be relayed.
  [译]应答UDP ASSOCIATE请求时,BND.PORT 和BND.ADDR字段指明了客户发送UDP消息至服务器的端口和地址。
 
Reply Processing
[译]应答处理
 
  When a reply (REP value other than X’00’) indicates a failure, the
  SOCKS server MUST terminate the TCP connection shortly after sending
  the reply. This must be no more than 10 seconds after detecting the
  condition that caused a failure.
  [译]当一个应答(REP值不等于00)指明出错时,SOCKS服务器必须在发送完应答消息后一小段时间内终止TCP连接。这段时间应该在发现错误后少于10秒。
 
  If the reply code (REP value of X’00’) indicates a success, and the
  request was either a BIND or a CONNECT, the client may now start
  passing data. If the selected authentication method supports
  encapsulation for the purposes of integrity, authentication and/or
  confidentiality, the data are encapsulated using the method-dependent
  encapsulation. Similarly, when data arrives at the SOCKS server for
  the client, the server MUST encapsulate the data as appropriate for
  the authentication method in use.
  [译]如果一个应答(REP值等于00)指明成功,并且请求是一个BIND或CONNECT时,客户端就可以开始发送数据了。如果协商的认证方法中有以完整性、认证和/或安全性为目的的封装,这些请求必须按照该方法所定义的方式进行封装。类似的,当以客户机为目的地的数据到达SOCKS服务器时,SOCKS服务器必须用正在使用的方法对这些数据进行封装。
 
7. Procedure for UDP-based clients
[译]基于UDP协议的客户
 
  A UDP-based client MUST send its datagrams to the UDP relay server at
  the UDP port indicated by BND.PORT in the reply to the UDP ASSOCIATE
  request. If the selected authentication method provides
  encapsulation for the purposes of authenticity, integrity, and/or
  confidentiality, the datagram MUST be encapsulated using the
  appropriate encapsulation. Each UDP datagram carries a UDP request
  header with it:
  [译]在UDP ASSOCIATE应答中由BND.PORT指明了服务器所使用的UDP端口,一个基于UDP协议的客户必须发送数据报至UDP转发服务器的该端口上。如果协商的认证方法中有以完整性、认证和/或安全性为目的的封装,这些数据报必须按照该方法所定义的方式进行封装。每个UDP数据报都有一个UDP请求头在其首部:
 
 
 
 
 
Leech, et al        Standards Track           [Page 7]


RFC 1928        SOCKS Protocol Version 5       March 1996
 
 
|RSV | FRAG | ATYP | DST.ADDR | DST.PORT |  DATA  |
|—-|——|——|———-|———-|———-|
| 2 | 1  | 1  | Variable |  2   | Variable |
 
   The fields in the UDP request header are:
   [译]在UDP请求头中的字段是:
 
     o RSV Reserved X’0000’
     o FRAG  Current fragment number
     o ATYP  address type of following addresses:
       o IP V4 address: X’01’
       o DOMAINNAME: X’03’
       o IP V6 address: X’04’
     o DST.ADDR    desired destination address
     o DST.PORT    desired destination port
     o DATA   user data
     [译]RSV 保留 X’0000’
     [译]FRAG 当前的分段号
     [译]ATYP 后面的地址类型
       [译]IPV4: X’01’
       [译]域名: X’03’
       [译]IPV6: X’04’
     [译]DST.ADDR 目的地址
     [译]DST.PORT 以网络字节顺序出现的端口号
     [译]DATA 用户数据
 
  When a UDP relay server decides to relay a UDP datagram, it does so
  silently, without any notification to the requesting client.
  Similarly, it will drop datagrams it cannot or will not relay. When
  a UDP relay server receives a reply datagram from a remote host, it
  MUST encapsulate that datagram using the above UDP request header,
  and any authentication-method-dependent encapsulation.
  [译]当一个UDP转发服务器转发一个UDP数据报时,不会发送任何通知给客户端;同样,它也将丢弃任何它不能发至远端主机的数据报。当UDP转发服务器从远端服务器收到一个应答的数据报时,必须加上上述UDP请求头,并对数据报进行封装。
 
  The UDP relay server MUST acquire from the SOCKS server the expected
  IP address of the client that will send datagrams to the BND.PORT
  given in the reply to UDP ASSOCIATE. It MUST drop any datagrams
  arriving from any source IP address other than the one recorded for
  the particular association.
  [译]UDP转发服务器必须从SOCKS服务器得到期望的客户端IP地址,并将数据报发送到UDP ASSOCIATE应答中给定的端口号。如果数据报从任何IP地址到来,而该IP地址与该特定连接中指定的IP地址不同,那么该数据报会被丢弃。
 
  The FRAG field indicates whether or not this datagram is one of a
  number of fragments. If implemented, the high-order bit indicates
  end-of-fragment sequence, while a value of X’00’ indicates that this
  datagram is standalone. Values between 1 and 127 indicate the
  fragment position within a fragment sequence. Each receiver will
  have a REASSEMBLY QUEUE and a REASSEMBLY TIMER associated with these
  fragments. The reassembly queue must be reinitialized and the
  associated fragments abandoned whenever the REASSEMBLY TIMER expires,
  or a new datagram arrives carrying a FRAG field whose value is less
  than the highest FRAG value processed for this fragment sequence.
  The reassembly timer MUST be no less than 5 seconds. It is
  recommended that fragmentation be avoided by applications wherever
  possible.
  [译]FRAG字段指明数据报是否是一些分片中的一片。如果SOCKS服务器要实现这个功能,X’00’指明数据报是独立的;其他则越大越是数据报的尾端。介于1到127之间的值说明了该分片在分片序列里的位置。每个接收者都为这些分片提供一个重组队列和一个重组的计时器。这个重组队列必须在重组计时器超时后重新初始化,并丢弃相应的数据报。或者当一个新到达的数据报有一个比当前在处理的数据报序列中最大的FRAG值要小时,也必须重新初始化从组队列。重组计时器必须小于5秒。只要有可能,应用程序最好不要使用分片。
 
  Implementation of fragmentation is optional; an implementation that
  does not support fragmentation MUST drop any datagram whose FRAG
  field is other than X’00’.
  [译]分片的实现是可选的;如果某实现不支持分片,所有FRAG字段不为0的数据报都必须被丢弃。
 
 
 
Leech, et al        Standards Track           [Page 8]


RFC 1928        SOCKS Protocol Version 5       March 1996
 
 
  The programming interface for a SOCKS-aware UDP MUST report an
  available buffer space for UDP datagrams that is smaller than the
  actual space provided by the operating system:
  [译]一个SOCKS的UDP编程界面(The programming interface for a SOCKS-aware UDP)必须报告当前可用UDP数据报缓存空间小于操作系统提供的实际空间:
 
     o if ATYP is X’01’ - 10+method_dependent octets smaller
     o if ATYP is X’03’ - 262+method_dependent octets smaller
     o if ATYP is X’04’ - 20+method_dependent octets smaller
     [译]如果 ATYP是 X’01’ - 10+method_dependent octets smaller
     [译]如果 ATYP是 X’03’ - 262+method_dependent octets smaller
     [译]如果 ATYP是 X’04’ - 20+method_dependent octets smaller
 
8. Security Considerations
[译]安全性考虑
 
  This document describes a protocol for the application-layer
  traversal of IP network firewalls. The security of such traversal is
  highly dependent on the particular authentication and encapsulation
  methods provided in a particular implementation, and selected during
  negotiation between SOCKS client and SOCKS server.
  [译]这篇文档描述了一个用来透过IP网络防火墙的应用层协议。这种传输的安全性在很大程度上依赖于特定实现所拥有以及在SOCKS客户与SOCKS服务器之间经协商所选定的特殊的认证和封装方式。
 
  Careful consideration should be given by the administrator to the
  selection of authentication methods.
  [译]系统管理员需要对用户认证方式的选择进行仔细考虑。
 
9. References
[译]参考书目
 
  [1] Koblas, D., “SOCKS”, Proceedings: 1992 Usenix Security Symposium.
 
Author’s Address
作者地址
 
    Marcus Leech
    Bell-Northern Research Ltd
    P.O. Box 3511, Stn. C,
    Ottawa, ON
    CANADA K1Y 4H7
 
    Phone: (613) 763-9145
    EMail: mleech@bnr.ca
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
Leech, et al        Standards Track           [Page 9]