release 4.16

If the application specifies a protocol but not a socket type,
normally getaddrinfo will select a corresponding protocol.

Mimic this behavior in our implementation of the function as well.
We only care about the case we're actually able to proxify
(SOCK_STREAM / IPPROTO_TCP).

Fixes proxifying pssh.

Makefile

@@ -29,7 +29,6 @@ GENH = src/version.h
 
 CFLAGS  += -Wall -O0 -g -std=c99 -D_GNU_SOURCE -pipe
 NO_AS_NEEDED = -Wl,--no-as-needed
-LIBDL   = -ldl
 LDFLAGS = -fPIC $(NO_AS_NEEDED) $(LIBDL) $(PTHREAD)
 INC     = 
 PIC     = -fPIC

README

@@ -1,4 +1,4 @@
-ProxyChains-NG ver 4.15 README
+ProxyChains-NG ver 4.16 README
 =============================
 
   ProxyChains is a UNIX program, that hooks network-related libc functions
@@ -52,6 +52,15 @@ ProxyChains-NG ver 4.15 README
 
 Changelog:
 ----------
+Version 4.16
+- fix regression in configure script linker flag detection
+- remove 10 year old workaround for wrong glibc getnameinfo signature
+- support for new DYLD hooking method for OSX Monterey
+- netbsd compilation fix
+- support IPv6 localnets
+- more user-friendly error message when execvp fails
+- proxy_getaddrinfo(): fill in ai_socktype if requested
+
 Version 4.15
 - fix configure script for buggy binutils version
 - initialize rand_seed with nano-second granularity

VERSION

@@ -1 +1 @@
-4.15
+4.16

configure

@@ -28,10 +28,20 @@ check_compile() {
 	return $res
 }
 
+get_define() {
+	$CC $OUR_CPPFLAGS $CPPFLAGS $CFLAGS -dM -E - </dev/null | grep "$1"
+}
+
+get_define_stripped() {
+	local output=$(get_define "$1")
+	test "$?" = 0 || return 1
+	printf "%s\n" "$output" | sed 's/^.* .* //'
+}
+
 check_define() {
 	printf "checking whether \$CC defines %s ... " "$1"
 	local res=1
-	$CC $OUR_CPPFLAGS $CPPFLAGS $CFLAGS -dM -E - </dev/null | grep "$1" >/dev/null && res=0
+	get_define "$1" >/dev/null && res=0
 	test x$res = x0 && printf "yes\n" || printf "no\n"
 	return $res
 }
@@ -74,8 +84,10 @@ usage() {
 	echo "--sysconfdir=/path        default: $prefix/etc"
 	echo "--ignore-cve              default: no"
 	echo "	if set to yes ignores CVE-2015-3887 and makes it possible"
-	echo "	to preload from current dir (insecure)"
+	echo "	to preload from current dir (possibly insecure, but handy)"
 	echo "--fat-binary : build for both i386 and x86_64 architectures on 64-bit Macs"
+	echo "--hookmethod=dlsym|dyld   hook method for osx. default: auto"
+	echo "  if OSX >= 12 is detected, dyld method will be used if auto."
 	echo "--help : show this text"
 	exit 1
 }
@@ -89,6 +101,8 @@ spliteq() {
 
 fat_binary=
 ignore_cve=no
+hookmethod=auto
+
 parsearg() {
 	case "$1" in
 	--prefix=*) prefix=`spliteq $1`;;
@@ -99,6 +113,7 @@ parsearg() {
 	--sysconfdir=*) sysconfdir=`spliteq $1`;;
 	--ignore-cve) ignore_cve=1;;
 	--ignore-cve=*) ignore_cve=`spliteq $1`;;
+	--hookmethod=*) hookmethod=`spliteq $1`;;
 	--fat-binary) fat_binary=1;;
 	--help) usage;;
 	esac
@@ -155,7 +170,7 @@ issolaris() {
 }
 haiku_detected=false
 ishaiku() {
-	$haiku_detected	
+	$haiku_detected
 }
 
 check_compile 'whether C compiler works' '' 'int main() {return 0;}' || fail 'error: install a C compiler and library'
@@ -175,6 +190,10 @@ check_compile 'whether we have clock_gettime' "-DHAVE_CLOCK_GETTIME" \
 check_define __APPLE__ && {
 	mac_detected=true
 	check_define __x86_64__ && mac_64=true
+	if test "$hookmethod" = auto ; then
+		osver=$(get_define_stripped __ENVIRONMENT_MAC_OS_X_VERSION_MIN_REQUIRED__ 2>/dev/null)
+		test "$osver" -gt $((120000 - 1)) && hookmethod=dyld
+	fi
 }
 check_define __FreeBSD__ && bsd_detected=true
 check_define __OpenBSD__ && {
@@ -215,6 +234,11 @@ fi
 echo "$LD_SONAME_FLAG"
 echo "LD_SET_SONAME = -Wl,$LD_SONAME_FLAG," >> config.mak
 
+if check_link "checking whether we can use -ldl" "-ldl" \
+"int main(){return 0;}" ; then
+echo "LIBDL = -ldl" >> config.mak
+fi
+
 if check_link "checking whether we can use -lpthread" "-lpthread" \
 "int main(){return 0;}" ; then
 echo "PTHREAD = -lpthread" >> config.mak
@@ -228,10 +252,14 @@ make_cmd=make
 if ismac ; then
 	echo LDSO_SUFFIX=dylib>>config.mak
 	echo MAC_CFLAGS+=-DIS_MAC=1>>config.mak
+	if test "$hookmethod" = dyld ; then
+		echo "using Monterey style DYLD hooking"
+		echo "CFLAGS+=-DMONTEREY_HOOKING">>config.mak
+	fi
 	if ismac64 && [ "$fat_binary" = 1 ] ; then
 		echo "Configuring a fat binary for i386 and x86_64"
-		echo MAC_CFLAGS+=-arch i386 -arch x86_64>>config.mak
-		echo LDFLAGS+=-arch i386 -arch x86_64>>config.mak
+		echo "MAC_CFLAGS+=-arch i386 -arch x86_64">>config.mak
+		echo "LDFLAGS+=-arch i386 -arch x86_64">>config.mak
 	fi
 elif isbsd ; then
 	echo LIBDL=>>config.mak

src/core.c

@@ -1018,6 +1018,8 @@ int proxy_getaddrinfo(const char *node, const char *service, const struct addrin
 		p->ai_socktype = hints->ai_socktype;
 		p->ai_flags = hints->ai_flags;
 		p->ai_protocol = hints->ai_protocol;
+		if(!p->ai_socktype && p->ai_protocol == IPPROTO_TCP)
+			p->ai_socktype = SOCK_STREAM;
 	} else {
 #ifndef AI_V4MAPPED
 #define AI_V4MAPPED 0

src/core.h

@@ -65,8 +65,18 @@ typedef enum {
 } select_type;
 
 typedef struct {
-	struct in_addr in_addr, netmask;
+	sa_family_t family;
 	unsigned short port;
+	union {
+		struct {
+			struct in_addr in_addr;
+			struct in_addr in_mask;
+		};
+		struct {
+			struct in6_addr in6_addr;
+			unsigned char in6_prefix;
+		};
+	};
 } localaddr_arg;
 
 typedef struct {

src/libproxychains.c

@@ -22,6 +22,7 @@
 #include <unistd.h>
 #include <stdlib.h>
 #include <string.h>
+#include <limits.h>
 #include <ctype.h>
 #include <errno.h>
 #include <assert.h>
@@ -104,25 +105,12 @@ static void* load_sym(char* symname, void* proxyfunc) {
 
 #define INIT() init_lib_wrapper(__FUNCTION__)
 
-#define SETUP_SYM(X) do { if (! true_ ## X ) true_ ## X = load_sym( # X, X ); } while(0)
 
 #include "allocator_thread.h"
 
 const char *proxychains_get_version(void);
 
-static void setup_hooks(void) {
-	SETUP_SYM(connect);
-	SETUP_SYM(sendto);
-	SETUP_SYM(gethostbyname);
-	SETUP_SYM(getaddrinfo);
-	SETUP_SYM(freeaddrinfo);
-	SETUP_SYM(gethostbyaddr);
-	SETUP_SYM(getnameinfo);
-#ifdef IS_SOLARIS
-	SETUP_SYM(__xnet_connect);
-#endif
-	SETUP_SYM(close);
-}
+static void setup_hooks(void);
 
 static int close_fds[16];
 static int close_fds_cnt = 0;
@@ -282,8 +270,7 @@ static void get_chain_data(proxy_data * pd, unsigned int *proxy_count, chain_typ
 	int count = 0, port_n = 0, list = 0;
 	char buf[1024], type[1024], host[1024], user[1024];
 	char *buff, *env, *p;
-	char local_in_addr_port[32];
-	char local_in_addr[32], local_in_port[32], local_netmask[32];
+	char local_addr_port[64], local_addr[64], local_netmask[32];
 	char dnat_orig_addr_port[32], dnat_new_addr_port[32];
 	char dnat_orig_addr[32], dnat_orig_port[32], dnat_new_addr[32], dnat_new_port[32];
 	char rdnsd_addr[32], rdnsd_port[8];
@@ -398,42 +385,76 @@ inv_host:
 						exit(1);
 					}
 				} else if(STR_STARTSWITH(buff, "localnet")) {
-					if(sscanf(buff, "%s %21[^/]/%15s", user, local_in_addr_port, local_netmask) < 3) {
+					char colon, extra, right_bracket[2];
+					unsigned short local_port = 0, local_prefix;
+					int local_family, n, valid;
+					if(sscanf(buff, "%s %53[^/]/%15s%c", user, local_addr_port, local_netmask, &extra) != 3) {
 						fprintf(stderr, "localnet format error");
 						exit(1);
 					}
-					/* clean previously used buffer */
-					memset(local_in_port, 0, sizeof(local_in_port) / sizeof(local_in_port[0]));
-
-					if(sscanf(local_in_addr_port, "%15[^:]:%5s", local_in_addr, local_in_port) < 2) {
-						PDEBUG("added localnet: netaddr=%s, netmask=%s\n",
-						       local_in_addr, local_netmask);
+					p = strchr(local_addr_port, ':');
+					if(!p || p == strrchr(local_addr_port, ':')) {
+						local_family = AF_INET;
+						n = sscanf(local_addr_port, "%15[^:]%c%5hu%c", local_addr, &colon, &local_port, &extra);
+						valid = n == 1 || (n == 3 && colon == ':');
+					} else if(local_addr_port[0] == '[') {
+						local_family = AF_INET6;
+						n = sscanf(local_addr_port, "[%45[^][]%1[]]%c%5hu%c", local_addr, right_bracket, &colon, &local_port, &extra);
+						valid = n == 2 || (n == 4 && colon == ':');
 					} else {
-						PDEBUG("added localnet: netaddr=%s, port=%s, netmask=%s\n",
-						       local_in_addr, local_in_port, local_netmask);
+						local_family = AF_INET6;
+						valid = sscanf(local_addr_port, "%45[^][]%c", local_addr, &extra) == 1;
+					}
+					if(!valid) {
+						fprintf(stderr, "localnet address or port error\n");
+						exit(1);
+					}
+					if(local_port) {
+						PDEBUG("added localnet: netaddr=%s, port=%u, netmask=%s\n",
+						       local_addr, local_port, local_netmask);
+					} else {
+						PDEBUG("added localnet: netaddr=%s, netmask=%s\n",
+						       local_addr, local_netmask);
 					}
 					if(num_localnet_addr < MAX_LOCALNET) {
-						int error;
-						error =
-						    inet_pton(AF_INET, local_in_addr,
-							      &localnet_addr[num_localnet_addr].in_addr);
-						if(error <= 0) {
+						localnet_addr[num_localnet_addr].family = local_family;
+						localnet_addr[num_localnet_addr].port = local_port;
+						valid = 0;
+						if (local_family == AF_INET) {
+							valid =
+							    inet_pton(local_family, local_addr,
+							              &localnet_addr[num_localnet_addr].in_addr) > 0;
+						} else if(local_family == AF_INET6) {
+							valid =
+							    inet_pton(local_family, local_addr,
+							              &localnet_addr[num_localnet_addr].in6_addr) > 0;
+						}
+						if(!valid) {
 							fprintf(stderr, "localnet address error\n");
 							exit(1);
 						}
-						error =
-						    inet_pton(AF_INET, local_netmask,
-							      &localnet_addr[num_localnet_addr].netmask);
-						if(error <= 0) {
+						if(local_family == AF_INET && strchr(local_netmask, '.')) {
+							valid =
+							    inet_pton(local_family, local_netmask,
+							              &localnet_addr[num_localnet_addr].in_mask) > 0;
+						} else {
+							valid = sscanf(local_netmask, "%hu%c", &local_prefix, &extra) == 1;
+							if (valid) {
+								if(local_family == AF_INET && local_prefix <= 32) {
+									localnet_addr[num_localnet_addr].in_mask.s_addr =
+										htonl(0xFFFFFFFFu << (32u - local_prefix));
+								} else if(local_family == AF_INET6 && local_prefix <= 128) {
+									localnet_addr[num_localnet_addr].in6_prefix =
+										local_prefix;
+								} else {
+									valid = 0;
+								}
+							}
+						}
+						if(!valid) {
 							fprintf(stderr, "localnet netmask error\n");
 							exit(1);
 						}
-						if(local_in_port[0]) {
-							localnet_addr[num_localnet_addr].port =
-							    (short) atoi(local_in_port);
-						} else {
-							localnet_addr[num_localnet_addr].port = 0;
-						}
 						++num_localnet_addr;
 					} else {
 						fprintf(stderr, "# of localnet exceed %d.\n", MAX_LOCALNET);
@@ -538,7 +559,11 @@ inv_host:
 /*******  HOOK FUNCTIONS  *******/
 
 #define EXPAND( args...) args
+#ifdef MONTEREY_HOOKING
+#define HOOKFUNC(R, N, args...) R pxcng_ ## N ( EXPAND(args) )
+#else
 #define HOOKFUNC(R, N, args...) R N ( EXPAND(args) )
+#endif
 
 HOOKFUNC(int, close, int fd) {
 	if(!init_l) {
@@ -625,14 +650,24 @@ HOOKFUNC(int, connect, int sock, const struct sockaddr *addr, unsigned int len)
 			port = dnat->new_port;
 	}
 
-	if (!v6) for(i = 0; i < num_localnet_addr && !remote_dns_connect; i++) {
-		if((localnet_addr[i].in_addr.s_addr & localnet_addr[i].netmask.s_addr)
-		   == (p_addr_in->s_addr & localnet_addr[i].netmask.s_addr)) {
-			if(!localnet_addr[i].port || localnet_addr[i].port == port) {
-				PDEBUG("accessing localnet using true_connect\n");
-				return true_connect(sock, addr, len);
-			}
+	for(i = 0; i < num_localnet_addr && !remote_dns_connect; i++) {
+		if (localnet_addr[i].port && localnet_addr[i].port != port)
+			continue;
+		if (localnet_addr[i].family != (v6 ? AF_INET6 : AF_INET))
+			continue;
+		if (v6) {
+			size_t prefix_bytes = localnet_addr[i].in6_prefix / CHAR_BIT;
+			size_t prefix_bits = localnet_addr[i].in6_prefix % CHAR_BIT;
+			if (prefix_bytes && memcmp(p_addr_in6->s6_addr, localnet_addr[i].in6_addr.s6_addr, prefix_bytes) != 0)
+				continue;
+			if (prefix_bits && (p_addr_in6->s6_addr[prefix_bytes] ^ localnet_addr[i].in6_addr.s6_addr[prefix_bytes]) >> (CHAR_BIT - prefix_bits))
+				continue;
+		} else {
+			if((p_addr_in->s_addr ^ localnet_addr[i].in_addr.s_addr) & localnet_addr[i].in_mask.s_addr)
+				continue;
 		}
+		PDEBUG("accessing localnet using true_connect\n");
+		return true_connect(sock, addr, len);
 	}
 
 	flags = fcntl(sock, F_GETFL, 0);
@@ -787,3 +822,41 @@ HOOKFUNC(ssize_t, sendto, int sockfd, const void *buf, size_t len, int flags,
 	}
 	return true_sendto(sockfd, buf, len, flags, dest_addr, addrlen);
 }
+
+#ifdef MONTEREY_HOOKING
+#define SETUP_SYM(X) do { if (! true_ ## X ) true_ ## X = &X; } while(0)
+#else
+#define SETUP_SYM(X) do { if (! true_ ## X ) true_ ## X = load_sym( # X, X ); } while(0)
+#endif
+
+static void setup_hooks(void) {
+	SETUP_SYM(connect);
+	SETUP_SYM(sendto);
+	SETUP_SYM(gethostbyname);
+	SETUP_SYM(getaddrinfo);
+	SETUP_SYM(freeaddrinfo);
+	SETUP_SYM(gethostbyaddr);
+	SETUP_SYM(getnameinfo);
+#ifdef IS_SOLARIS
+	SETUP_SYM(__xnet_connect);
+#endif
+	SETUP_SYM(close);
+}
+
+#ifdef MONTEREY_HOOKING
+
+#define DYLD_INTERPOSE(_replacement,_replacee) \
+   __attribute__((used)) static struct{ const void* replacement; const void* replacee; } _interpose_##_replacee \
+   __attribute__((section ("__DATA,__interpose"))) = { (const void*)(unsigned long)&_replacement, (const void*)(unsigned long)&_replacee };
+#define DYLD_HOOK(F) DYLD_INTERPOSE(pxcng_ ## F, F)
+
+DYLD_HOOK(connect);
+DYLD_HOOK(sendto);
+DYLD_HOOK(gethostbyname);
+DYLD_HOOK(getaddrinfo);
+DYLD_HOOK(freeaddrinfo);
+DYLD_HOOK(gethostbyaddr);
+DYLD_HOOK(getnameinfo);
+DYLD_HOOK(close);
+
+#endif

src/main.c

@@ -154,7 +154,8 @@ int main(int argc, char *argv[]) {
 	         old_val ? old_val : "");
 	putenv(buf);
 	execvp(argv[start_argv], &argv[start_argv]);
-	perror("proxychains can't load process....");
+	fprintf(stderr, "proxychains: can't load process '%s'.", argv[start_argv]);
+	perror(" (hint: it's probably a typo)");
 
 	return EXIT_FAILURE;
 }

src/proxychains.conf

@@ -53,9 +53,9 @@ strict_chain
 
 # method 1. this uses the proxychains4 style method to do remote dns:
 # a thread is spawned that serves DNS requests and hands down an ip
-# assigned from an internal list (via remote_dns_subset).
+# assigned from an internal list (via remote_dns_subnet).
 # this is the easiest (setup-wise) and fastest method, however on
-# systems with buggy libcs and very complex software like webbrosers
+# systems with buggy libcs and very complex software like webbrowsers
 # this might not work and/or cause crashes.
 proxy_dns
 
@@ -94,7 +94,7 @@ tcp_connect_time_out 8000
 
 ### Examples for localnet exclusion
 ## localnet ranges will *not* use a proxy to connect.
-## note that localnet works only when plain IPv4 addresses are passed to the app,
+## note that localnet works only when plain IP addresses are passed to the app,
 ## the hostname resolves via /etc/hosts, or proxy_dns is disabled or proxy_dns_old used.
 
 ## Exclude connections to 192.168.1.0/24 with port 80
@@ -105,12 +105,14 @@ tcp_connect_time_out 8000
 
 ## Exclude connections to ANYwhere with port 80
 # localnet 0.0.0.0:80/0.0.0.0
+# localnet [::]:80/0
 
-## RFC5735 Loopback address range
+## RFC6890 Loopback address range
 ## if you enable this, you have to make sure remote_dns_subnet is not 127
 ## you'll need to enable it if you want to use an application that 
 ## connects to localhost.
 # localnet 127.0.0.0/255.0.0.0
+# localnet ::1/128
 
 ## RFC1918 Private Address Ranges
 # localnet 10.0.0.0/255.0.0.0