Skip to content

Commit ae650ef

Browse files
intikaintika
committed
v5.50 initial bind support
1 parent a7b0ed9 commit ae650ef

2 files changed

Lines changed: 137 additions & 6 deletions

File tree

‎README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -68,6 +68,7 @@ Changelog:
6868
- Block non tcp packet on send()
6969
- Prevent bypass noleak
7070
- Add support for bind() to block listen on unsupported protocol
71+
- Add skype support
7172

7273
**Version 5.40:**
7374

‎src/libproxybound.c‎

Lines changed: 136 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -394,7 +394,7 @@ int connect(int sock, const struct sockaddr *addr, socklen_t len) {
394394
// AF_X25 /* 9 - Reserved for X.25 project */
395395
// AF_MAX /* 12 - For now.. */
396396
// PF_FILE
397-
// Etc.
397+
// ...
398398

399399
//Allow direct unix
400400
if (SOCKFAMILY(*addr) == AF_UNIX) {
@@ -404,6 +404,7 @@ int connect(int sock, const struct sockaddr *addr, socklen_t len) {
404404

405405
p_addr_in = &((struct sockaddr_in *) addr)->sin_addr;
406406
port = ntohs(((struct sockaddr_in *) addr)->sin_port);
407+
//inet_ntop - convert IPv4 and IPv6 addresses from binary to text form
407408
inet_ntop(AF_INET, p_addr_in, ip, sizeof(ip));
408409

409410
#ifdef DEBUG
@@ -426,7 +427,7 @@ int connect(int sock, const struct sockaddr *addr, socklen_t len) {
426427
}*/
427428

428429
//Block other sock
429-
//WARNING NORMALLY I DONT BLOCK THEASE...
430+
//WARNING NORMALLY I DONT BLOCK THESE...
430431
if (SOCKFAMILY(*addr) != AF_INET) {
431432
if (proxybound_allow_leak) {
432433
PDEBUG("allowing direct non tcp connect()\n\n");
@@ -440,8 +441,13 @@ int connect(int sock, const struct sockaddr *addr, socklen_t len) {
440441
}
441442
}
442443

443-
//Block udp
444-
//(socktype == SOCK_DGRAM) is non local udp connect altrady handled bellow
444+
//Block udp etc. (socktype == SOCK_DGRAM) is non local udp bind already handled bellow
445+
//SOCK_STREAM
446+
//SOCK_DGRAM
447+
//SOCK_SEQPACKET
448+
//SOCK_RAW
449+
//SOCK_RDM
450+
//SOCK_PACKET
445451
if (socktype != SOCK_STREAM) {
446452
if (proxybound_allow_leak) {
447453
PDEBUG("allowing direct udp connect()\n\n");
@@ -481,16 +487,140 @@ int connect(int sock, const struct sockaddr *addr, socklen_t len) {
481487
return ret;
482488
}
483489

490+
//int connect(int sock, const struct sockaddr *addr, socklen_t len)
484491
int bind(int sockfd, const struct sockaddr *addr, socklen_t addrlen) {
485-
PDEBUG("bind: got a bind request\n");
492+
//return true_bind(sockfd, addr, addrlen);
493+
PDEBUG("\nbind: got a bind request\n");
486494

487495
/* If the real bind doesn't exist, we're stuffed */
488496
if (true_bind == NULL) {
489497
PDEBUG("unresolved symbol: bind\n\n");
490498
return -1;
491-
}
499+
}
492500

501+
// ------------------------------------------------------------------------------------
502+
// Borrowed from connect function and adapted
503+
504+
//proxify variables
505+
//ip_type dest_ip;
506+
//int ret = 0, flags = 0;
507+
int socktype = 0;
508+
socklen_t optlen = 0;
509+
char ip[256];
510+
struct in_addr *p_addr_in;
511+
unsigned short port;
512+
size_t i;
513+
int remote_dns_bind = 0;
514+
optlen = sizeof(socktype);
515+
getsockopt(sockfd, SOL_SOCKET, SO_TYPE, &socktype, &optlen);
516+
517+
// Sock family list (not complete)
518+
// AF_UNIX_CCSID /* - Unix domain sockets */
519+
// AF_UNIX /* 1 - Unix domain sockets */
520+
// AF_INET /* 2 - Internet IP Protocol */
521+
// AF_INET6 /* 10 - IPv6 */
522+
// AF_UNSPEC /* 0 */
523+
// AF_AX25 /* 3 - Amateur Radio AX.25 */
524+
// AF_IPX /* 4 - Novell IPX */
525+
// AF_APPLETALK /* 5 - Appletalk DDP */
526+
// AF_NETROM /* 6 - Amateur radio NetROM */
527+
// AF_BRIDGE /* 7 - Multiprotocol bridge */
528+
// AF_AAL5 /* 8 - Reserved for Werner's ATM */
529+
// AF_X25 /* 9 - Reserved for X.25 project */
530+
// AF_MAX /* 12 - For now.. */
531+
// MSG_PROXY /* 16 - ... */
532+
// PF_FILE /* ?? - ... */
533+
// ...
534+
535+
//Allow direct unix
536+
if (SOCKFAMILY(*addr) == AF_UNIX) {
537+
PDEBUG("allowing direct unix bind()\n\n");
538+
return true_bind(sockfd, addr, addrlen);
539+
}
540+
541+
p_addr_in = &((struct sockaddr_in *) addr)->sin_addr;
542+
port = ntohs(((struct sockaddr_in *) addr)->sin_port);
543+
//inet_ntop - convert IPv4 and IPv6 addresses from binary to text form
544+
inet_ntop(AF_INET, p_addr_in, ip, sizeof(ip));
545+
546+
#ifdef DEBUG
547+
PDEBUG("bind target: %s\n\n", ip);
548+
PDEBUG("bind port: %d\n\n", port);
549+
#endif
550+
551+
//Allow direct local 127.x.x.x
552+
if ((ip[0] == '1') && (ip[1] == '2') && (ip[2] == '7') && (ip[3] == '.')) {
553+
PDEBUG("Local ip detected... ignoring\n\n");
554+
return true_bind(sockfd, addr, addrlen);
555+
}
556+
557+
// Check if bind called from proxydns
558+
remote_dns_bind = (ntohl(p_addr_in->s_addr) >> 24 == remote_dns_subnet);
559+
for(i = 0; i < num_localnet_addr && !remote_dns_bind; i++) {
560+
if((localnet_addr[i].in_addr.s_addr & localnet_addr[i].netmask.s_addr) == (p_addr_in->s_addr & localnet_addr[i].netmask.s_addr)) {
561+
if(!localnet_addr[i].port || localnet_addr[i].port == port) {
562+
PDEBUG("Accessing localnet using true_bind\n\n");
563+
return true_bind(sockfd, addr, addrlen);
564+
}
565+
}
566+
}
567+
568+
//Block udp etc. (socktype == SOCK_DGRAM) is non local udp bind already handled bellow
569+
//SOCK_STREAM
570+
//SOCK_DGRAM
571+
//SOCK_SEQPACKET
572+
//SOCK_RAW
573+
//SOCK_RDM
574+
//SOCK_PACKET
575+
576+
#ifdef DEBUG
577+
PDEBUG("bind() sock SOCK_STREAM = %d\n",SOCK_STREAM);
578+
PDEBUG("bind() sock SOCK_DGRAM = %d\n",SOCK_DGRAM);
579+
PDEBUG("bind() sock SOCK_SEQPACKET = %d\n",SOCK_SEQPACKET);
580+
PDEBUG("bind() sock SOCK_RAW = %d\n",SOCK_RAW);
581+
PDEBUG("bind() sock SOCK_RDM = %d\n",SOCK_RDM);
582+
PDEBUG("bind() sock SOCK_PACKET = %d\n",SOCK_PACKET);
583+
PDEBUG("Requested SOCK =%d)\n",socktype);
584+
PDEBUG("Requested SOCKFAMILY =%d)\n\n",SOCKFAMILY(*addr));
585+
#endif
586+
587+
//Required to proxify the connection
588+
//Type Raw, 0.0.0.0, MSG_PROXY
589+
if ((socktype == SOCK_RAW) && (SOCKFAMILY(*addr) == MSG_PROXY)) {
590+
if ((ip[0] == '0') && (ip[1] == '.') && (ip[2] == '0') && (ip[3] == '.' ) && (ip[4] == '0') && (ip[5] == '.') && (ip[6] == '0')) {
591+
PDEBUG("Bind allowing Raw, 0.0.0.0, MSG_PROXY...\n\n");
592+
return true_bind(sockfd, addr, addrlen);
593+
}
594+
}
595+
596+
if (socktype != SOCK_STREAM) {
597+
if (proxybound_allow_leak) {
598+
PDEBUG("allowing direct udp bind()\n\n");
599+
return true_bind(sockfd, addr, addrlen);
600+
} else {
601+
PDEBUG("blocking direct udp bind() \n\n");
602+
if (!port) return -1;
603+
if ((proxybound_allow_dns) && (is_dns_port(port))) {return true_bind(sockfd, addr, addrlen);}
604+
else {return -1;}
605+
return -1; //Au cas ou
606+
}
607+
} else {
608+
//SOCK_STREAM TCP
609+
return true_bind(sockfd, addr, addrlen);
610+
}
611+
493612
return true_bind(sockfd, addr, addrlen);
613+
614+
//proxify connect function
615+
/*flags = fcntl(sockfd, F_GETFL, 0);
616+
if(flags & O_NONBLOCK)
617+
fcntl(sockfd, F_SETFL, !O_NONBLOCK);
618+
dest_ip.as_int = SOCKADDR(*addr);
619+
ret = connect_proxy_chain(sockfd, dest_ip, SOCKPORT(*addr), proxybound_pd, proxybound_proxy_count, proxybound_ct, proxybound_max_chain);
620+
fcntl(sockfd, F_SETFL, flags);
621+
if(ret != SUCCESS)
622+
errno = ECONNREFUSED;
623+
return ret;*/
494624
}
495625

496626
ssize_t sendto(int sockfd, const void *buf, size_t len, int flags, const struct sockaddr *dest_addr, socklen_t addrlen) {

0 commit comments

Comments
 (0)