release 4.11

http://marc.info/?l=openbsd-bugs&m=145280872431093&w=2

closes #95

.gitignore

@@ -1,9 +1,17 @@
+proxychains4
+*.bz2
+*.xz
 *.o
 *.so
 *.la
 *.lo
 .deps/
 .libs/
+*.rcb
+*.out
+*~
+*.patch
+version.h
 
 # Autoconf stuff 
 libtool

AUTHORS

@@ -1,5 +1,27 @@
+original code up to version 3.1
 N3E7CR34TUR3.
+http://proxychains.sourceforge.net
+netcreature@users.sourceforge.net
 
-web site:	proxychains.sourceforge.net
-email:		netcreature@users.sourceforge.net
+main.c, remote-dns, thread safety, bugfixes, build system, 
+cleanups, mac support
+rofl0r.
+https://github.com/rofl0r/proxychains-ng
+
+localnet, bugfixes
+jianing yang.
+https://github.com/jianingy/proxychains
+https://sourceforge.net/projects/proxychains/forums/forum/644747/topic/3498696
+
+round-robin
+crass.
+https://github.com/crass/proxychains-ng
+
+poll_retry (fixes for signal handling)
+colin cross.
+https://sourceforge.net/projects/proxychains/forums/forum/644747/topic/2367923
+
+collecting patches from px forum and putting it into a repo
+adam hamsik.
+https://github.com/haad/proxychains
 

COPYING

@@ -1,8 +1,8 @@
 		    GNU GENERAL PUBLIC LICENSE
 		       Version 2, June 1991
 
- Copyright (C) 1989, 1991 Free Software Foundation, Inc.
-                          675 Mass Ave, Cambridge, MA 02139, USA
+ Copyright (C) 1989, 1991 Free Software Foundation, Inc.,
+ 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
  Everyone is permitted to copy and distribute verbatim copies
  of this license document, but changing it is not allowed.
 

ChangeLog

@@ -1,65 +0,0 @@
-ProxyChains version history (public releases)
-====================
-
-ver 3.1
-
-changed:
-	* dns resolver script fix
-	* prototypes in core.h
-
--------------------------------------------------------------------------
-ver 3.0
-
-added:
-	* new feature - DNS from behind proxy
-	* proxyresolv - stand alone command
-	* proxychains.conf - new option to enable/disable DNS support
-
-changed:
-	* bugfixes in core lib
-	* fixed strict chain
-	* fixed random chain
-	* output text
-	* autotools fix 
-
--------------------------------------------------------------------------
-ver 2.1
-	* bugfuxes
-
--------------------------------------------------------------------------
-ver 2.0
-	* major core rewrite
-	* new config options
-
--------------------------------------------------------------------------
-
-ver 1.8.2
-	* minor bugfixes
-	* improved compilation on FreeBSD & OpenBSD sysems.
-	* improved compilation on Sun Solaris systems .
-	* cross platform (UNIX) issues
-
--------------------------------------------------------------------------
-
-ver 1.8.0
-
-added:
-	* Socks5 protocol
-	* Socks4 protocol
-	* HTTP proxy auth basic
-	* Socks4 user auth
-	* Socks5 user/pass auth
-	* more chain options (random, strict, dynamic )
-	* configurable timeout for TCP connect.
-	* configurable timeout for TCP read.
-	* INSTALL file (explains how to install properly)
-
-changed:
-	* configuration file entries (proxychains.conf)
-	* configuration file lookup
-
--------------------------------------------------------------------------
-
-ver 0.0.1
-	* TCP calls interception
-	* HTTP CONNECT proxy protocol.

INSTALL

@@ -1,13 +0,0 @@
-ProxyChains ver 3.1 Installation
-=======================
-
-If you have installed other ver of proxychains  "make uninstall" before installing this distribution
-
-unpack the .tar.gz , 'cd' to distribution directory and
-run following commands (as root)
--------------------------------------
-./configure
-make
-make install
--------------------------------------
-that's all

Makefile

@@ -11,52 +11,81 @@ bindir = $(exec_prefix)/bin
 prefix = /usr/local/
 includedir = $(prefix)/include
 libdir = $(prefix)/lib
+sysconfdir=$(prefix)/etc
 
 SRCS = $(sort $(wildcard src/*.c))
 OBJS = $(SRCS:.c=.o)
-LOBJS = src/core.o src/libproxychains.o
+LOBJS = src/nameinfo.o src/version.o \
+        src/core.o src/common.o src/libproxychains.o \
+        src/allocator_thread.o src/ip_type.o \
+        src/hostsreader.o src/hash.o src/debug.o
 
-CFLAGS  += -Wall -O0 -g -std=c99 -D_GNU_SOURCE -pipe -DTHREAD_SAFE
-LDFLAGS = -shared -fPIC -ldl -lpthread
+GENH = src/version.h
+
+CFLAGS  += -Wall -O0 -g -std=c99 -D_GNU_SOURCE -pipe
+NO_AS_NEEDED = -Wl,--no-as-needed
+LIBDL   = -ldl
+LDFLAGS = -shared -fPIC $(NO_AS_NEEDED) $(LIBDL) -lpthread
 INC     = 
 PIC     = -fPIC
 AR      = $(CROSS_COMPILE)ar
 RANLIB  = $(CROSS_COMPILE)ranlib
 
-LDSO_PATHNAME = libproxychains4.so
+LDSO_SUFFIX = so
+LD_SET_SONAME = -Wl,-soname=
+INSTALL = ./tools/install.sh
+
+LDSO_PATHNAME = libproxychains4.$(LDSO_SUFFIX)
 
 SHARED_LIBS = $(LDSO_PATHNAME)
 ALL_LIBS = $(SHARED_LIBS)
 PXCHAINS = proxychains4
 ALL_TOOLS = $(PXCHAINS)
+ALL_CONFIGS = src/proxychains.conf
 
 -include config.mak
 
-CFLAGS+=$(USER_CFLAGS)
-CFLAGS_MAIN=-DLIB_DIR=\"$(libdir)\"
+CFLAGS+=$(USER_CFLAGS) $(MAC_CFLAGS)
+CFLAGS_MAIN=-DLIB_DIR=\"$(libdir)\" -DSYSCONFDIR=\"$(sysconfdir)\" -DDLL_NAME=\"$(LDSO_PATHNAME)\"
 
 
 all: $(ALL_LIBS) $(ALL_TOOLS)
 
-#install: $(ALL_LIBS:lib/%=$(DESTDIR)$(libdir)/%) $(DESTDIR)$(LDSO_PATHNAME)
-install: 
-	install -D -m 755 $(ALL_TOOLS) $(bindir)/
-	install -D -m 644 $(ALL_LIBS) $(libdir)/
-	install -D -m 644 src/proxychains.conf $(prefix)/etc/
+install: install-libs install-tools
+
+$(DESTDIR)$(bindir)/%: %
+	$(INSTALL) -D -m 755 $< $@
+
+$(DESTDIR)$(libdir)/%: %
+	$(INSTALL) -D -m 644 $< $@
+
+$(DESTDIR)$(sysconfdir)/%: src/%
+	$(INSTALL) -D -m 644 $< $@
+
+install-libs: $(ALL_LIBS:%=$(DESTDIR)$(libdir)/%)
+install-tools: $(ALL_TOOLS:%=$(DESTDIR)$(bindir)/%)
+install-config: $(ALL_CONFIGS:src/%=$(DESTDIR)$(sysconfdir)/%)
 
 clean:
 	rm -f $(ALL_LIBS)
 	rm -f $(ALL_TOOLS)
 	rm -f $(OBJS)
+	rm -f $(GENH)
+
+src/version.h: $(wildcard VERSION .git)
+	printf '#define VERSION "%s"\n' "$$(sh tools/version.sh)" > $@
+
+src/version.o: src/version.h
 
 %.o: %.c
-	$(CC) $(CFLAGS) $(CFLAGS_MAIN) $(INC) $(PIC) -c -o $@ $<
+	$(CC) $(CPPFLAGS) $(CFLAGS) $(CFLAGS_MAIN) $(INC) $(PIC) -c -o $@ $<
 
 $(LDSO_PATHNAME): $(LOBJS)
-	$(CC) $(LDFLAGS) -Wl,-soname=$(LDSO_PATHNAME) -o $@ $(LOBJS)
+	$(CC) $(LDFLAGS) $(LD_SET_SONAME)$(LDSO_PATHNAME) $(USER_LDFLAGS) \
+		-o $@ $(LOBJS)
 
 $(ALL_TOOLS): $(OBJS)
-	$(CC) src/main.o -o $(PXCHAINS)
+	$(CC) src/main.o src/common.o $(USER_LDFLAGS) -o $(PXCHAINS)
 
 
-.PHONY: all clean install
+.PHONY: all clean install install-config install-libs install-tools

README

@@ -1,39 +1,132 @@
-ProxyChains ver 4.0 README
-==========================
+ProxyChains-NG ver 4.11 README
+=============================
+
+  ProxyChains is a UNIX program, that hooks network-related libc functions
+  in DYNAMICALLY LINKED programs via a preloaded DLL (dlsym(), LD_PRELOAD)
+  and redirects the connections through SOCKS4a/5 or HTTP proxies.
+  It supports TCP only (no UDP/ICMP etc).
+
+  The way it works is basically a HACK; so it is possible that it doesn't
+  work with your program, especially when it's a script, or starts
+  numerous processes like background daemons or uses dlopen() to load
+  "modules" (bug in glibc dynlinker).
+  It should work with simple compiled (C/C++) dynamically linked programs
+  though.
+
+  If your program doesn't work with proxychains, consider using an
+  iptables based solution instead; this is much more robust.
+
+  Supported Platforms: Linux, BSD, Mac.
+
 
 *********** ATTENTION ***********
 
-this program works only on dynamically linked programs.
-also both proxychains and the program to call must use
-the same dynamic linker (i.e. same libc)
+  this program can be used to circumvent censorship.
+  doing so can be VERY DANGEROUS in certain countries.
 
-*********************************
+  ALWAYS MAKE SURE THAT PROXYCHAINS WORKS AS EXPECTED
+  BEFORE USING IT FOR ANYTHING SERIOUS.
 
+  this involves both the program and the proxy that you're going to
+  use.
 
-This is Unix version only.
+  for example, you can connect to some "what is my ip" service
+  like ifconfig.me to make sure that it's not using your real ip.
 
-How to mess with sources - How to Install : read INSTALL !!!!!!
+  ONLY USE PROXYCHAINS IF YOU KNOW WHAT YOU'RE DOING.
 
-This program forces any tcp connection made by any given tcp client
-to follow through proxy (or proxy chain). It is a kind of proxifier.
-It acts like sockscap / permeo / eborder driver ( intercepts TCP calls )
-It is FREE.
+  THE AUTHORS AND MAINTAINERS OF PROXYCHAINS DO NOT TAKE ANY
+  RESPONSIBILITY FOR ANY ABUSE OR MISUSE OF THIS SOFTWARE AND
+  THE RESULTING CONSEQUENCES.
+
+*** Installation ***
+
+  # needs a working C compiler, preferably gcc
+  ./configure --prefix=/usr --sysconfdir=/etc
+  make
+  [optional] sudo make install
+  [optional] sudo make install-config (installs proxychains.conf)
+
+  if you dont install, you can use proxychains from the build directory
+  like this: ./proxychains4 -f src/proxychains.conf telnet google.com 80
 
 Changelog:
 ----------
+Version 4.11
+- preliminary IPv6 support
+- fixed bug in hostsreader
+- preliminary support for usage on OpenBSD (caveat emptor)
 
-Version (4.x) removes the dnsresolver script which required a dynamically
-linked "dig" binary to be present with remote DNS lookup.
-this speeds up any operation involving DNS, as the old script had to use TCP.
-additionally it allows to use .onion urls when used with TOR.
-also it removed the broken autoconf build system with a simple Makefile.
-there's a ./configure script though for convenience.
-it also adds support for a config file passed via command line switches/
-environment variables.
+Version 4.10
+- fix regression in linking order with custom LDFLAGS
+- fix segfault in DNS mapping code in programs with > ~400 different lookups
 
-Version (3.x) introduces support for DNS resolving through proxy 
-it supports SOCKS4, SOCKS5 and HTTP CONNECT proxy servers.
-Auth-types: socks - "user/pass" , http - "basic".
+Version 4.9
+- fix a security issue CVE-2015-3887
+- add sendto hook to handle MSG_FASTOPEN flag
+- replace problematic hostentdb with hostsreader
+- fix compilation on OpenBSD (although doesn't work there)
+
+Version 4.8.1:
+- fix regression in 4.8 install-config Makefile target
+
+Version 4.8:
+- fix for odd cornercase where getaddrinfo was used with AI_NUMERICHOST
+  to test for a numeric ip instead of resolving it (fixes nmap).
+- allow usage with programs that rely on LD_PRELOAD themselves
+- reject wrong entries in config file
+- print version number on startup
+
+Version 4.7:
+- new round_robin chaintype by crass.
+- fix bug with lazy allocation when GCC constructor was not used.
+- new configure flag --fat-binary to create a "fat" binary/library on OS X
+- return EBADF rather than EINTR in close hook.
+  it's legal for a program to retry close() calls when they receive
+  EINTR, which could cause an infinite loop, as seen in chromium.
+
+Version 4.6:
+- some cosmetic fixes to Makefile, fix a bug when non-numeric ip was
+  used as proxy server address.
+
+Version 4.5:
+- hook close() to prevent OpenSSH from messing with internal infrastructure.
+  this caused ssh client to segfault when proxified.
+
+Version 4.4:
+- FreeBSD port
+- fixes some installation issues on Debian and Mac.
+
+Version 4.3:
+- fixes programs that do dns-lookups in child processes (fork()ed),
+  like irssi. to achieve this, support for compilation without pthreads
+  was sacrified.
+- fixes thread safety for gethostent() calls.
+- improved DNS handling speed, since hostent db is cached.
+
+Version 4.2:
+- fixes compilation issues with ubuntu 12.04 toolchain
+- fixes segfault in rare codepath
+
+Version 4.1
+- support for mac os x (all archs)
+- all internal functions are threadsafe when compiled with -DTHREAD_SAFE
+  (default).
+
+Version 4.0
+- replaced dnsresolver script (which required a dynamically linked "dig"
+  binary to be present) with remote DNS lookup.
+  this speeds up any operation involving DNS, as the old script had to use TCP.
+  additionally it allows to use .onion urls when used with TOR.
+- removed broken autoconf build system with a simple Makefile.
+  there's a ./configure script though for convenience.
+  it also adds support for a config file passed via command line switches/
+  environment variables.
+
+Version 3.0
+- support for DNS resolving through proxy
+  supports SOCKS4, SOCKS5 and HTTP CONNECT proxy servers.
+  Auth-types: socks - "user/pass" , http - "basic".
 
 When to use it ?
 1) When the only way to get "outside" from your LAN is through proxy server.
@@ -42,7 +135,8 @@ When to use it ?
 	like: your_host <--> proxy1 <--> proxy2 <--> target_host
 4) To "proxify" some program with no proxy support built-in (like telnet)
 5) Access intranet from outside via proxy.
-5) To use DNS behind proxy.
+6) To use DNS behind proxy.
+7) To access hidden tor onion services.
 
 Some cool features:
 
@@ -52,10 +146,9 @@ Some cool features:
 	random order from the list ( user defined length of chain ).
 	exact order  (as they appear in the list )
 	dynamic order (smart exclude dead proxies from chain)
-* You can use it with any TCP client application, even network scanners
-	yes, yes - you can make portscan via proxy (or chained proxies)
-	for example with Nmap scanner by fyodor (www.insecire.org/nmap).
-	proxychains nmap -sT -PO -p 80 -iR  (find some webservers through proxy)
+* You can use it with most TCP client applications, possibly even network
+	scanners, as long as they use standard libc functionality.
+	pcap based scanning does not work.
 * You can use it with servers, like squid, sendmail, or whatever.
 * DNS resolving through proxy.
 
@@ -64,32 +157,65 @@ Configuration:
 --------------
 
 proxychains looks for config file in following order:
-1)	file listed in environment variable ${PROXYCHAINS_CONF_FILE} or
+1)	file listed in environment variable PROXYCHAINS_CONF_FILE or
 	provided as a -f argument to proxychains script or binary.
 2)	./proxychains.conf
 3)	$(HOME)/.proxychains/proxychains.conf
-4)	/etc/proxychains.conf  **
+4)	$(sysconfdir)/proxychains.conf  **
 
-**see more in /etc/proxychains.conf
+** usually /etc/proxychains.conf
 
 Usage Example:
 
-	bash$ proxychains telnet targethost.com
+	$ proxychains telnet targethost.com
 
 in this example it will run telnet through proxy(or chained proxies)
 specified by proxychains.conf
 
 Usage Example:
 
-      	bash$ proxychains -f /etc/proxychains-other.conf targethost2.com
+	$ proxychains -f /etc/proxychains-other.conf telnet targethost2.com
 
-in this example it will use different configuration file then proxychains.conf 
+in this example it will use different configuration file then proxychains.conf
 to connect to targethost2.com host.
 
 Usage Example:
 
-	bash$ proxyresolv targethost.com
+	$ proxyresolv targethost.com
 
 in this example it will resolve targethost.com through proxy(or chained proxies)
 specified by proxychains.conf
 
+Known Problems:
+---------------
+- newer versions of nmap try to determine the network interface to use
+  even if it's not needed (like when doing simple syn scans which use the
+  standard POSIX socket API. this results in errors when proxychains hands
+  out an ip address to a reserved address space.
+  possible workarounds: disable proxy_dns, use a numeric ip, or use nmap's
+  native support for SOCKS proxies.
+
+- Mac OS X 10.11 (El Capitan) ships with a new security feature called SIP
+  that prevents hooking of system apps.
+  workarounds are to partially disable SIP by issuing
+  csrutil enable --without debug in recovery mode,
+  or to copy the system binary into the home directory and run it from there.
+  see github issue #78 for details.
+
+- the glibc dynlinker has a bug or security feature that inhibits dlopen()ed
+  modules from being subject to the same dlsym hooks as installed for the main
+  program. this mainly affects scripting languages such as perl or python
+  that heavily rely on dlopen() for modules written in C to work.
+  there are unconfirmed reports that it works as root though.
+  musl libc is unaffected from the bug.
+
+
+Community:
+----------
+#proxychains on irc.freenode.net
+
+Donations:
+----------
+bitcoins donations are welcome - please send to this address:
+1C9LBpuy56veBqw5N33sZMoZW8mwCw3tPh
+

TODO

@@ -1,8 +1,6 @@
-ProxyChains ver 3.1 TODO
+ProxyChains ver 4.0 TODO
 ===================
 
-   stable DNS resolver .... currently gnu dig is used, which is an ugly hack
-	also it is required to link it with the same libc as proxychains
 	
    hooks for reentrant dns functions, i.e. gethostbyaddr_r
 

VERSION

@@ -0,0 +1 @@
+4.11

configure

@@ -2,6 +2,73 @@
 
 prefix=/usr/local
 
+ismac() {
+	uname -s | grep Darwin >/dev/null
+}
+
+isx86_64() {
+	uname -m | grep -i X86_64 >/dev/null
+}
+
+isbsd() {
+	uname -s | grep BSD >/dev/null
+}
+
+isopenbsd() {
+	uname -s | grep OpenBSD >/dev/null
+}
+
+check_compile() {
+	printf "checking %s ... " "$1"
+	local tmp=$(mktemp)
+	printf "$3" > "$tmp".c
+	local res=0
+	$CC $CPPFLAGS $2 $CFLAGS -c "$tmp".c -o "$tmp".o >/dev/null 2>&1 \
+	|| res=1
+	rm -f "$tmp".c "$tmp".o
+	test x$res = x0 && \
+	{ printf "yes\n" ; test x"$2" = x || CPPFLAGS="$CPPFLAGS $2" ; } \
+	|| printf "no\n"
+	return $res
+}
+
+check_define() {
+	printf "checking whether \$CC defines %s ... " "$1"
+	local res=1
+	$CC $CPPFLAGS $CFLAGS -dM -E - </dev/null | grep "$1" >/dev/null && res=0
+	test x$res = x0 && printf "yes\n" || printf "no\n"
+	return $res
+}
+
+check_compile_run() {
+	printf "checking %s ... " "$1"
+	local tmp=$(mktemp)
+	printf "$2" > "$tmp".c
+	local res=0
+	$CC $CPPFLAGS $CFLAGS "$tmp".c -o "$tmp".out >/dev/null 2>&1 \
+	|| res=1
+	test x$res = x0 && { "$tmp".out || res=1 ; }
+	rm -f "$tmp".c "$tmp".o "$tmp".out
+	test x$res = x0 && printf "yes\n" || printf "no\n"
+	return $res
+}
+
+usage() {
+	echo "supported arguments"
+	echo "--prefix=/path            default: $prefix"
+	echo "--exec_prefix=/path       default: $prefix/bin"
+	echo "--bindir=/path            default: $prefix/bin"
+	echo "--libdir=/path            default: $prefix/lib"
+	echo "--includedir=/path        default: $prefix/include"
+	echo "--sysconfdir=/path        default: $prefix/etc"
+	echo "--ignore-cve              default: no"
+	echo "	if set to yes ignores CVE-2015-3887 and makes it possible"
+	echo "	to preload from current dir (insecure)"
+	ismac && isx86_64 && echo "--fat-binary : build for both i386 and x86_64 architectures on 64-bit Macs"
+	echo "--help : show this text"
+	exit 1
+}
+
 spliteq() {
 	arg=$1
 	echo "${arg#*=}"
@@ -9,13 +76,20 @@ spliteq() {
 	# or echo "$arg" | sed 's/[^=]*=//'
 }
 
+fat_binary=
+ignore_cve=no
 parsearg() {
 	case "$1" in
-	--prefix=*) prefix=$(spliteq "$1");;
+	--prefix=*) prefix=`spliteq $1`;;
 	--exec_prefix=*) exec_prefix=`spliteq $1`;;
 	--bindir=*) bindir=`spliteq $1`;;
 	--libdir=*) libdir=`spliteq $1`;;
 	--includedir=*) includedir=`spliteq $1`;;
+	--sysconfdir=*) sysconfdir=`spliteq $1`;;
+	--ignore-cve) ignore_cve=1;;
+	--ignore-cve=*) ignore_cve=`spliteq $1`;;
+	--fat-binary) fat_binary=1;;
+	--help) usage;;
 	esac
 }
 
@@ -26,34 +100,70 @@ while true ; do
 	esac
 done
 
-if [ ! $exec_prefix ] ; then
+if [ -z "$exec_prefix" ] ; then
 	exec_prefix=$prefix
 fi
 
-if [ ! $libdir ] ; then
+if [ -z "$libdir" ] ; then
 	libdir=$prefix/lib
 fi
 
-if [ ! $includedir ] ; then
+if [ -z "$includedir" ] ; then
 	includedir=$prefix/include
 fi
 
-if [ ! $bindir ] ; then
+if [ -z "$sysconfdir" ] ; then
+	sysconfdir=$prefix/etc
+fi
+
+if [ -z "$bindir" ] ; then
 	bindir=$exec_prefix/bin
 fi
 
-if [ ! $CC ] ; then
+if [ -z "$CC" ] ; then
 	CC=cc
 fi
 
+check_compile 'whether netinet/in.h defines s6_addr16' "" \
+'#include <netinet/in.h>\nint main(int a, char**c){struct in6_addr x={.s6_addr32[0]=a};return x.s6_addr16[0]; }' \
+|| {
+check_compile 'whether netinet/in.h defines __u6_addr.__u6_addr16' \
+'-Ds6_addr16=__u6_addr.__u6_addr16 -Ds6_addr32=__u6_addr.__u6_addr32' \
+'#include <netinet/in.h>\nint main(int a, char**c){struct in6_addr x={.s6_addr32[0]=a};return x.s6_addr16[0]; }'
+}
+
+check_define __OpenBSD__ && \
+check_compile_run 'whether OpenBSDs fclose() (illegally) calls close()' \
+'#include <stdio.h>\n#include<stdlib.h>\nint close(int x){exit(0);}int main(){fclose(stdin);return 1;}' && \
+CPPFLAGS="$CPPFLAGS -DBROKEN_FCLOSE"
+
 echo CC?=$CC>config.mak
 [ -z "$CPPFLAGS" ] || echo CPPFLAGS?=$CPPFLAGS>>config.mak
 [ -z "$CFLAGS" ] || echo USER_CFLAGS?=$CFLAGS>>config.mak
+[ -z "$LDFLAGS" ] || echo USER_LDFLAGS?=$LDFLAGS>>config.mak
 echo prefix=$prefix>>config.mak
 echo exec_prefix=$exec_prefix>>config.mak
 echo bindir=$bindir>>config.mak
 echo libdir=$libdir>>config.mak
 echo includedir=$includedir>>config.mak
+echo sysconfdir=$sysconfdir>>config.mak
+[ "$ignore_cve" = "no" ] && echo CPPFLAGS+= -DSUPER_SECURE>>config.mak
+make_cmd=make
+if ismac ; then
+	echo NO_AS_NEEDED=>>config.mak
+	echo LDSO_SUFFIX=dylib>>config.mak
+	echo MAC_CFLAGS+=-DIS_MAC=1>>config.mak
+	if isx86_64 && [ "$fat_binary" = 1 ] ; then
+		echo "Configuring a fat binary for i386 and x86_64"
+		echo MAC_CFLAGS+=-arch i386 -arch x86_64>>config.mak
+		echo LDFLAGS+=-arch i386 -arch x86_64>>config.mak
+	fi
+	echo LD_SET_SONAME=-Wl,-install_name,>>config.mak
+elif isbsd ; then
+	echo LIBDL=>>config.mak
+	echo "CFLAGS+=-DIS_BSD">>config.mak
+	isopenbsd && echo "CFLAGS+=-DIS_OPENBSD">>config.mak
+	make_cmd=gmake
+fi
 
-echo done, now run make \&\& make install
-
+echo "Done, now run $make_cmd && $make_cmd install"

dist/config.mak

@@ -1,11 +0,0 @@
-### config.mak template for proxychains
-#######################################
-
-# just copy into proxychains root dir and adapt to your needs.
-
-prefix = /usr/local/
-libdir = $(prefix)/lib
-
-exec_prefix = /usr/local
-bindir = $(exec_prefix)/bin
-

proxychains.lsm

@@ -1,14 +0,0 @@
-Begin3
-Title:          ProxyChains 
-Version:        3.0
-Entered-date:   
-Description:    
-Keywords:        
-Author:          <N37CR347UR3>
-Maintained-by:   <NetCreature>
-Primary-site:   	        
-Home-page:      http://proxychains.sourceforge.net
-Original-site:  
-Platforms:       Linux and other Unices
-Copying-policy: GNU Public License
-End

src/allocator_thread.c

@@ -0,0 +1,300 @@
+#include <pthread.h>
+#include <unistd.h>
+#include <fcntl.h>
+#include <stdlib.h>
+#include <stdio.h>
+#include <sys/select.h>
+#include <assert.h>
+#include <string.h>
+#include <stdint.h>
+#include <stddef.h>
+#include <errno.h>
+#include "allocator_thread.h"
+#include "debug.h"
+#include "ip_type.h"
+#include "mutex.h"
+#include "hash.h"
+
+/* stuff for our internal translation table */
+
+typedef struct {
+	uint32_t hash;
+	char* string;
+} string_hash_tuple;
+
+typedef struct {
+	uint32_t counter;
+	uint32_t capa;
+	string_hash_tuple** list;
+} internal_ip_lookup_table;
+
+static void *dumpstring(char* s, size_t len) {
+	char* p = malloc(len);
+	if(p) memcpy(p, s, len);
+	return p;
+}
+
+pthread_mutex_t internal_ips_lock;
+internal_ip_lookup_table *internal_ips = NULL;
+internal_ip_lookup_table internal_ips_buf;
+
+uint32_t index_from_internal_ip(ip_type4 internalip) {
+	PFUNC();
+	ip_type4 tmp = internalip;
+	uint32_t ret;
+	ret = tmp.octet[3] + (tmp.octet[2] << 8) + (tmp.octet[1] << 16);
+	ret -= 1;
+	return ret;
+}
+
+char *string_from_internal_ip(ip_type4 internalip) {
+	PFUNC();
+	char *res = NULL;
+	uint32_t index = index_from_internal_ip(internalip);
+	if(index < internal_ips->counter)
+		res = internal_ips->list[index]->string;
+	return res;
+}
+
+extern unsigned int remote_dns_subnet;
+ip_type4 make_internal_ip(uint32_t index) {
+	ip_type4 ret;
+	index++; // so we can start at .0.0.1
+	if(index > 0xFFFFFF)
+		return ip_type_invalid.addr.v4;
+	ret.octet[0] = remote_dns_subnet & 0xFF;
+	ret.octet[1] = (index & 0xFF0000) >> 16;
+	ret.octet[2] = (index & 0xFF00) >> 8;
+	ret.octet[3] = index & 0xFF;
+	return ret;
+}
+
+static ip_type4 ip_from_internal_list(char* name, size_t len) {
+	uint32_t hash = dalias_hash((char *) name);
+	size_t i;
+	ip_type4 res;
+	void* new_mem;
+	// see if we already have this dns entry saved.
+	if(internal_ips->counter) {
+		for(i = 0; i < internal_ips->counter; i++) {
+			if(internal_ips->list[i]->hash == hash && !strcmp(name, internal_ips->list[i]->string)) {
+				res = make_internal_ip(i);
+				PDEBUG("got cached ip for %s\n", name);
+				goto have_ip;
+			}
+		}
+	}
+	// grow list if needed.
+	if(internal_ips->capa < internal_ips->counter + 1) {
+		PDEBUG("realloc\n");
+		new_mem = realloc(internal_ips->list, (internal_ips->capa + 16) * sizeof(void *));
+		if(new_mem) {
+			internal_ips->capa += 16;
+			internal_ips->list = new_mem;
+		} else {
+	oom:
+			PDEBUG("out of mem\n");
+			goto err_plus_unlock;
+		}
+	}
+
+	res = make_internal_ip(internal_ips->counter);
+	if(res.as_int == ip_type_invalid.addr.v4.as_int)
+		goto err_plus_unlock;
+
+	string_hash_tuple tmp = { 0 };
+	new_mem = dumpstring((char*) &tmp, sizeof(string_hash_tuple));
+	if(!new_mem)
+		goto oom;
+
+	PDEBUG("creating new entry %d for ip of %s\n", (int) internal_ips->counter, name);
+
+	internal_ips->list[internal_ips->counter] = new_mem;
+	internal_ips->list[internal_ips->counter]->hash = hash;
+	
+	new_mem = dumpstring((char*) name, len + 1);
+	
+	if(!new_mem) {
+		internal_ips->list[internal_ips->counter] = 0;
+		goto oom;
+	}
+	internal_ips->list[internal_ips->counter]->string = new_mem;
+
+	internal_ips->counter += 1;
+
+	have_ip:
+
+	return res;
+	err_plus_unlock:
+	
+	PDEBUG("return err\n");
+	return ip_type_invalid.addr.v4;
+}
+
+/* stuff for communication with the allocator thread */
+
+enum at_msgtype {
+	ATM_GETIP,
+	ATM_GETNAME,
+	ATM_EXIT,
+};
+
+enum at_direction {
+	ATD_SERVER = 0,
+	ATD_CLIENT,
+	ATD_MAX,
+};
+
+struct at_msghdr {
+	enum at_msgtype msgtype;
+	size_t datalen;
+};
+
+static pthread_t allocator_thread;
+static pthread_attr_t allocator_thread_attr;
+int req_pipefd[2];
+int resp_pipefd[2];
+
+static int wait_data(int readfd) {
+	PFUNC();
+	fd_set fds;
+	FD_ZERO(&fds);
+	FD_SET(readfd, &fds);
+	int ret;
+	while((ret = select(readfd+1, &fds, NULL, NULL, NULL)) <= 0) {
+		if(ret < 0) {
+			int e = errno;
+			if(e == EINTR) continue;
+#ifdef __GLIBC__
+			char emsg[1024];
+			char* x = strerror_r(errno, emsg, sizeof emsg);
+			dprintf(2, "select2: %s\n", x);
+#endif
+			return 0;
+		}
+	}
+	return 1;
+}
+
+static int sendmessage(enum at_direction dir, struct at_msghdr *hdr, void* data) {
+	static int* destfd[ATD_MAX] = { [ATD_SERVER] = &req_pipefd[1], [ATD_CLIENT] = &resp_pipefd[1] };
+	int ret = write(*destfd[dir], hdr, sizeof *hdr) == sizeof *hdr;
+	if(ret && hdr->datalen) {
+		assert(hdr->datalen <= MSG_LEN_MAX);
+		ret = write(*destfd[dir], data, hdr->datalen) == hdr->datalen;
+	}
+	return ret;
+}
+
+static int getmessage(enum at_direction dir, struct at_msghdr *hdr, void* data) {
+	static int* readfd[ATD_MAX] = { [ATD_SERVER] = &req_pipefd[0], [ATD_CLIENT] = &resp_pipefd[0] };
+	int ret;
+	if((ret = wait_data(*readfd[dir]))) {
+		ret = read(*readfd[dir], hdr, sizeof *hdr) == sizeof(*hdr);
+		assert(hdr->datalen <= MSG_LEN_MAX);
+		if(ret && hdr->datalen) {
+			ret = read(*readfd[dir], data, hdr->datalen) == hdr->datalen;
+		}
+	}
+	return ret;
+}
+
+static void* threadfunc(void* x) {
+	(void) x;
+	int ret;
+	struct at_msghdr msg;
+	union { 
+		char host[MSG_LEN_MAX];
+		ip_type4 ip;
+	} readbuf;
+	while((ret = getmessage(ATD_SERVER, &msg, &readbuf))) {
+		switch(msg.msgtype) {
+			case ATM_GETIP:
+				/* client wants an ip for a DNS name. iterate our list and check if we have an existing entry.
+					* if not, create a new one. */
+				readbuf.ip = ip_from_internal_list(readbuf.host, msg.datalen - 1);
+				msg.datalen = sizeof(ip_type4);
+				break;
+			case ATM_GETNAME: {
+				char *host = string_from_internal_ip(readbuf.ip);
+				if(host) {
+					size_t l = strlen(host);
+					assert(l < MSG_LEN_MAX);
+					memcpy(readbuf.host, host, l + 1);
+					msg.datalen = l + 1;
+				}
+				break;
+			}
+			case ATM_EXIT:
+				return 0;
+			default:
+				abort();
+		}
+		ret = sendmessage(ATD_CLIENT, &msg, &readbuf);
+	}
+	return 0;
+}
+
+/* API to access the internal ip mapping */
+
+ip_type4 at_get_ip_for_host(char* host, size_t len) {
+	ip_type4 readbuf;
+	MUTEX_LOCK(&internal_ips_lock);
+	if(len > MSG_LEN_MAX) goto inv;
+	struct at_msghdr msg = {.msgtype = ATM_GETIP, .datalen = len + 1 };
+	if(sendmessage(ATD_SERVER, &msg, host) &&
+	   getmessage(ATD_CLIENT, &msg, &readbuf));
+	else {
+		inv:
+		readbuf = ip_type_invalid.addr.v4;
+	}
+	MUTEX_UNLOCK(&internal_ips_lock);
+	return readbuf;
+}
+
+size_t at_get_host_for_ip(ip_type4 ip, char* readbuf) {
+	struct at_msghdr msg = {.msgtype = ATM_GETNAME, .datalen = sizeof(ip_type4) };
+	size_t res = 0;
+	MUTEX_LOCK(&internal_ips_lock);
+	if(sendmessage(ATD_SERVER, &msg, &ip) && getmessage(ATD_CLIENT, &msg, readbuf)) {
+		if((ptrdiff_t) msg.datalen <= 0) res = 0;
+		else res = msg.datalen - 1;
+	}
+	MUTEX_UNLOCK(&internal_ips_lock);
+	return res;
+}
+
+
+static void initpipe(int* fds) {
+	if(pipe(fds) == -1) {
+		perror("pipe");
+		exit(1);
+	}
+}
+
+/* initialize with pointers to shared memory. these will
+ * be used to place responses and arguments */
+void at_init(void) {
+	PFUNC();
+	MUTEX_INIT(&internal_ips_lock);
+	internal_ips = &internal_ips_buf;
+	memset(internal_ips, 0, sizeof *internal_ips);
+	initpipe(req_pipefd);
+	initpipe(resp_pipefd);
+	pthread_attr_init(&allocator_thread_attr);
+	pthread_attr_setstacksize(&allocator_thread_attr, 16 * 1024);
+	pthread_create(&allocator_thread, &allocator_thread_attr, threadfunc, 0);
+}
+
+void at_close(void) {
+	PFUNC();
+	const int msg = ATM_EXIT;
+	write(req_pipefd[1], &msg, sizeof(int));
+	pthread_join(allocator_thread, NULL);
+	close(req_pipefd[0]);
+	close(req_pipefd[1]);
+	close(resp_pipefd[0]);
+	close(resp_pipefd[1]);
+	pthread_attr_destroy(&allocator_thread_attr);
+	MUTEX_DESTROY(&internal_ips_lock);
+}

src/allocator_thread.h

@@ -0,0 +1,19 @@
+#ifndef ALLOCATOR_THREAD_H
+#define ALLOCATOR_THREAD_H
+
+#include <unistd.h>
+#include "ip_type.h"
+
+#define MSG_LEN_MAX 256
+
+extern int req_pipefd[2];
+extern int resp_pipefd[2];
+
+void at_init(void);
+void at_close(void);
+size_t at_get_host_for_ip(ip_type4 ip, char* readbuf);
+ip_type4 at_get_ip_for_host(char* host, size_t len);
+
+//RcB: DEP "allocator_thread.c"
+#endif
+

src/common.c

@@ -0,0 +1,98 @@
+#include "common.h"
+#include <stdlib.h>
+#include <unistd.h>
+#include <stdio.h>
+
+const char *proxy_type_strmap[] = {
+    "http",
+    "socks4",
+    "socks5",
+};
+
+const char *chain_type_strmap[] = {
+    "dynamic_chain",
+    "strict_chain",
+    "random_chain",
+    "round_robin_chain",
+};
+
+const char *proxy_state_strmap[] = {
+    "play",
+    "down",
+    "blocked",
+    "busy",
+};
+
+// stolen from libulz (C) rofl0r
+void pc_stringfromipv4(unsigned char *ip_buf_4_bytes, char *outbuf_16_bytes) {
+	unsigned char *p;
+	char *o = outbuf_16_bytes;
+	unsigned char n;
+	for(p = ip_buf_4_bytes; p < ip_buf_4_bytes + 4; p++) {
+		n = *p;
+		if(*p >= 100) {
+			if(*p >= 200)
+				*(o++) = '2';
+			else
+				*(o++) = '1';
+			n %= 100;
+		}
+		if(*p >= 10) {
+			*(o++) = (n / 10) + '0';
+			n %= 10;
+		}
+		*(o++) = n + '0';
+		*(o++) = '.';
+	}
+	o[-1] = 0;
+}
+
+static int check_path(char *path) {
+	if(!path)
+		return 0;
+	return access(path, R_OK) != -1;
+}
+
+char *get_config_path(char* default_path, char* pbuf, size_t bufsize) {
+	char buf[512];
+	// top priority: user defined path
+	char *path = default_path;
+	if(check_path(path))
+		goto have;
+
+	// priority 1: env var PROXYCHAINS_CONF_FILE
+	path = getenv(PROXYCHAINS_CONF_FILE_ENV_VAR);
+	if(check_path(path))
+		goto have;
+
+	// priority 2; proxychains conf in actual dir
+	path = getcwd(buf, sizeof(buf));
+	snprintf(pbuf, bufsize, "%s/%s", path, PROXYCHAINS_CONF_FILE);
+	path = pbuf;
+	if(check_path(path))
+		goto have;
+
+	// priority 3; $HOME/.proxychains/proxychains.conf
+	path = getenv("HOME");
+	snprintf(pbuf, bufsize, "%s/.proxychains/%s", path, PROXYCHAINS_CONF_FILE);
+	path = pbuf;
+	if(check_path(path))
+		goto have;
+
+	// priority 4: $SYSCONFDIR/proxychains.conf
+	path = SYSCONFDIR "/" PROXYCHAINS_CONF_FILE;
+	if(check_path(path))
+		goto have;
+
+	// priority 5: /etc/proxychains.conf
+	path = "/etc/" PROXYCHAINS_CONF_FILE;
+	if(check_path(path))
+		goto have;
+
+	perror("couldnt find configuration file");
+	exit(1);
+
+	return NULL;
+	have:
+	return path;
+}

src/common.h

@@ -1,4 +1,22 @@
+#ifndef COMMON_H
+#define COMMON_H
+
 #define PROXYCHAINS_CONF_FILE_ENV_VAR "PROXYCHAINS_CONF_FILE"
 #define PROXYCHAINS_QUIET_MODE_ENV_VAR "PROXYCHAINS_QUIET_MODE"
 #define PROXYCHAINS_CONF_FILE "proxychains.conf"
 #define LOG_PREFIX "[proxychains] "
+#ifndef SYSCONFDIR
+#define SYSCONFDIR "/etc"
+#endif
+
+#include <stddef.h>
+
+extern const char *proxy_type_strmap[];
+extern const char *chain_type_strmap[];
+extern const char *proxy_state_strmap[];
+
+char *get_config_path(char* default_path, char* pbuf, size_t bufsize);
+void pc_stringfromipv4(unsigned char *ip_buf_4_bytes, char *outbuf_16_bytes);
+
+//RcB: DEP "common.c"
+#endif

src/core.h

@@ -4,10 +4,8 @@
     begin                : Tue May 14 2002
     copyright          :  netcreature (C) 2002
     email                 : netcreature@users.sourceforge.net
- ***************************************************************************/
-#include <stdint.h>
- /*     GPL */
-/***************************************************************************
+ ***************************************************************************
+ ***************************************************************************
  *                                                                         *
  *   This program is free software; you can redistribute it and/or modify  *
  *   it under the terms of the GNU General Public License as published by  *
@@ -15,32 +13,20 @@
  *   (at your option) any later version.                                   *
  *                                                                         *
  ***************************************************************************/
+
+#include <unistd.h>
+#include <stdint.h>
+#include <netinet/in.h>
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <netdb.h>
+
 #ifndef __CORE_HEADER
 #define __CORE_HEADER
 #define BUFF_SIZE 8*1024  // used to read responses from proxies.
-#define     MAX_LOCALNET 1024
+#define     MAX_LOCALNET 64
 
-typedef union {
-	unsigned char octet[4];
-	uint32_t as_int;
-} ip_type;
-
-typedef struct {
-	uint32_t hash;
-	char* string;
-} string_hash_tuple;
-
-typedef struct {
-	uint32_t counter;
-	uint32_t capa;
-	string_hash_tuple** list;
-} internal_ip_lookup_table;
-
-extern internal_ip_lookup_table internal_ips;
-#ifdef THREAD_SAFE
-#include <pthread.h>
-extern pthread_mutex_t internal_ips_lock;
-#endif
+#include "ip_type.h"
 
 /*error codes*/
 typedef enum {
@@ -52,7 +38,6 @@ typedef enum {
 	BLOCKED  //  target's port blocked on last proxy in the chain
 } ERR_CODE;
 
-
 typedef enum {
 	HTTP_TYPE,
 	SOCKS4_TYPE,
@@ -62,8 +47,9 @@ typedef enum {
 typedef enum {
 	DYNAMIC_TYPE,
 	STRICT_TYPE,
-	RANDOM_TYPE}
-chain_type;
+	RANDOM_TYPE,
+	ROUND_ROBIN_TYPE
+} chain_type;
 
 typedef enum {
 	PLAY_STATE,
@@ -91,61 +77,57 @@ typedef struct {
 	char pass[256];
 } proxy_data;
 
-typedef struct {
-	proxy_data *pd;
-	chain_type ct;
-	unsigned int proxy_count;
-	int sock;
-	struct sockaddr addr;
-	int flags;
-} thread_arg;
-
-int connect_proxy_chain (
-	int sock,
-	ip_type target_ip,
-	unsigned short target_port,
-	proxy_data * pd,
-	unsigned int proxy_count,
-	chain_type ct,
-	unsigned int max_chain );
-
-int proxychains_write_log(char *str,...);
-struct hostent* proxy_gethostbyname(const char *name);
+int connect_proxy_chain (int sock, ip_type target_ip, unsigned short target_port,
+			 proxy_data * pd, unsigned int proxy_count, chain_type ct,
+			 unsigned int max_chain );
 
+void proxychains_write_log(char *str, ...);
 
+typedef int (*close_t)(int);
 typedef int (*connect_t)(int, const struct sockaddr *, socklen_t);
-connect_t true_connect;
-
 typedef struct hostent* (*gethostbyname_t)(const char *);
-gethostbyname_t true_gethostbyname;
-
-typedef int (*getaddrinfo_t)(const char *, const char *,
-		const struct addrinfo *,
-		struct addrinfo **);
-getaddrinfo_t true_getaddrinfo;
-
 typedef int (*freeaddrinfo_t)(struct addrinfo *);
-freeaddrinfo_t true_freeaddrinfo;
-
-typedef int (*getnameinfo_t) (const struct sockaddr *,
-		socklen_t, char *,
-		socklen_t, char *,
-		socklen_t, unsigned int);
-getnameinfo_t true_getnameinfo;
-
 typedef struct hostent *(*gethostbyaddr_t) (const void *, socklen_t, int);
-gethostbyaddr_t true_gethostbyaddr;
 
-int proxy_getaddrinfo(const char *node, const char *service,
-		                const struct addrinfo *hints,
-				                struct addrinfo **res);
+typedef int (*getaddrinfo_t)(const char *, const char *, const struct addrinfo *, 
+			     struct addrinfo **);
 
-struct hostent* proxy_gethostbyname(const char *name);
+typedef int (*getnameinfo_t) (const struct sockaddr *, socklen_t, char *, 
+			      socklen_t, char *, socklen_t, int);
+
+typedef ssize_t (*sendto_t) (int sockfd, const void *buf, size_t len, int flags,
+			     const struct sockaddr *dest_addr, socklen_t addrlen);
+
+
+
+extern connect_t true_connect;
+extern gethostbyname_t true_gethostbyname;
+extern getaddrinfo_t true_getaddrinfo;
+extern freeaddrinfo_t true_freeaddrinfo;
+extern getnameinfo_t true_getnameinfo;
+extern gethostbyaddr_t true_gethostbyaddr;
+
+struct gethostbyname_data {
+	struct hostent hostent_space;
+	in_addr_t resolved_addr;
+	char *resolved_addr_p[2];
+	char addr_name[1024 * 8];
+};
+
+struct hostent* proxy_gethostbyname(const char *name, struct gethostbyname_data *data);
+
+int proxy_getaddrinfo(const char *node, const char *service, 
+		      const struct addrinfo *hints, struct addrinfo **res);
+void proxy_freeaddrinfo(struct addrinfo *res);
+
+void core_initialize(void);
+void core_unload(void);
+
+#include "debug.h"
 
-#ifdef DEBUG
-# define PDEBUG(fmt, args...) fprintf(stderr,"DEBUG:"fmt, ## args)
-#else
-# define PDEBUG(fmt, args...)
 #endif
 
-#endif 
+//RcB: DEP "core.c"
+//RcB: DEP "libproxychains.c"
+//RcB: LINK "-Wl,--no-as-needed -ldl -lpthread"
+

src/debug.c

@@ -0,0 +1,25 @@
+
+#ifdef DEBUG
+# include "core.h"
+# include "common.h"
+# include "debug.h"
+#include <arpa/inet.h>
+
+void DUMP_PROXY_CHAIN(proxy_data *pchain, unsigned int count) {
+	char ip_buf[INET6_ADDRSTRLEN];
+	for (; count; pchain++, count--) {
+		if(!inet_ntop(pchain->ip.is_v6?AF_INET6:AF_INET,pchain->ip.addr.v6,ip_buf,sizeof ip_buf)) {
+			proxychains_write_log(LOG_PREFIX "error: ip address conversion failed\n");
+			continue;
+		}
+		PDEBUG("[%s] %s %s:%d", proxy_state_strmap[pchain->ps],
+		       proxy_type_strmap[pchain->pt], 
+		       ip_buf, htons(pchain->port));
+		if (*pchain->user || *pchain->pass) {
+			PSTDERR(" [u=%s,p=%s]", pchain->user, pchain->pass);
+		}
+		PSTDERR("\n");
+	}
+}
+
+#endif

src/debug.h

@@ -0,0 +1,22 @@
+#ifndef DEBUG_H
+#define DEBUG_H
+
+#ifdef DEBUG
+# include <stdio.h>
+# define PSTDERR(fmt, args...) do { dprintf(2,fmt, ## args); } while(0)
+# define PDEBUG(fmt, args...) PSTDERR("DEBUG:"fmt, ## args)
+# define DEBUGDECL(args...) args
+
+# include "core.h"
+void DUMP_PROXY_CHAIN(proxy_data *pchain, unsigned int count);
+
+#else
+# define PDEBUG(fmt, args...) do {} while (0)
+# define DEBUGDECL(args...)
+# define DUMP_PROXY_CHAIN(args...) do {} while (0)
+#endif
+
+# define PFUNC() do { PDEBUG("pid[%d]:%s\n", getpid(), __FUNCTION__); } while(0)
+
+#endif
+

src/hash.c

@@ -0,0 +1,12 @@
+#include "hash.h"
+
+/* dalias' version of the elf hash */
+uint32_t dalias_hash(char *s0) {
+	unsigned char *s = (void *) s0;
+	uint_fast32_t h = 0;
+	while(*s) {
+		h = 16 * h + *s++;
+		h ^= h >> 24 & 0xf0;
+	}
+	return h & 0xfffffff;
+}

src/hash.h

@@ -0,0 +1,10 @@
+#ifndef HASH_H
+#define HASH_H
+
+#include <stdint.h>
+
+uint32_t dalias_hash(char *s0);
+
+//RcB: DEP "hash.c"
+
+#endif

src/hostsreader.c

@@ -0,0 +1,123 @@
+#include <stdio.h>
+#include <ctype.h>
+#include <string.h>
+
+/*
+   simple reader for /etc/hosts
+   it only supports comments, blank lines and lines consisting of an ipv4 hostname pair.
+   this is required so we can return entries from the host db without messing up the
+   non-thread-safe state of libc's gethostent().
+
+*/
+
+struct hostsreader {
+	FILE *f;
+	char* ip, *name;
+};
+
+int hostsreader_open(struct hostsreader *ctx) {
+	if(!(ctx->f = fopen("/etc/hosts", "r"))) return 0;
+	return 1;
+}
+
+void hostsreader_close(struct hostsreader *ctx) {
+	fclose(ctx->f);
+}
+
+static int isnumericipv4(const char* ipstring);
+int hostsreader_get(struct hostsreader *ctx, char* buf, size_t bufsize) {
+	while(1) {
+		if(!fgets(buf, bufsize, ctx->f)) return 0;
+		if(*buf == '#') continue;
+		char *p = buf;
+		size_t l = bufsize;
+		ctx->ip = p;
+		while(*p && !isspace(*p) && l) {
+			p++;
+			l--;
+		}
+		if(!l || !*p || p == ctx->ip) continue;
+		*p = 0;
+		p++;
+		while(*p && isspace(*p) && l) {
+			p++;
+			l--;
+		}
+		if(!l || !*p) continue;
+		ctx->name = p;
+		while(*p && !isspace(*p) && l) {
+			p++;
+			l--;
+		}
+		if(!l || !*p) continue;
+		*p = 0;
+		if(isnumericipv4(ctx->ip)) return 1;
+	}
+}
+
+char* hostsreader_get_ip_for_name(const char* name, char* buf, size_t bufsize) {
+	struct hostsreader ctx;
+	char *res = 0;
+	if(!hostsreader_open(&ctx)) return 0;
+	while(hostsreader_get(&ctx, buf, bufsize)) {
+		if(!strcmp(ctx.name, name)) {
+			res = ctx.ip;
+			break;
+		}
+	}
+	hostsreader_close(&ctx);
+	return res;
+}
+
+#include "ip_type.h"
+#include <netinet/in.h>
+#include <sys/socket.h>
+#include <arpa/inet.h>
+ip_type4 hostsreader_get_numeric_ip_for_name(const char* name) {
+	char *hres;
+	char buf[320];
+	if((hres = hostsreader_get_ip_for_name(name, buf, sizeof buf))) {
+		struct in_addr c;
+		inet_aton(hres, &c);
+		ip_type4 res;
+		memcpy(res.octet, &c.s_addr, 4);
+		return res;
+	} else return ip_type_invalid.addr.v4;
+}
+
+#ifdef HOSTSREADER_TEST
+#include "ip_type.c"
+int main(int a, char**b) {
+	char buf[256];
+	if(a != 2) return 1;
+	char * ret = hostsreader_get_ip_for_name(b[1], buf, sizeof buf);
+	printf("%s\n", ret ? ret : "null");
+}
+#endif
+
+/* isnumericipv4() taken from libulz */
+static int isnumericipv4(const char* ipstring) {
+	size_t x = 0, n = 0, d = 0;
+	int wasdot = 0;
+	while(1) {
+		switch(ipstring[x]) {
+			case 0: goto done;
+			case '.':
+				if(!n || wasdot) return 0;
+				d++;
+				wasdot = 1;
+				break;
+			case '0': case '1': case '2': case '3': case '4':
+			case '5': case '6': case '7': case '8': case '9':
+				n++;
+				wasdot = 0;
+				break;
+			default:
+				return 0;
+		}
+		x++;
+	}
+	done:
+	if(d == 3 && n >= 4 && n <= 12) return 1;
+	return 0;
+}

src/ip_type.c

@@ -0,0 +1,5 @@
+#include "ip_type.h"
+
+const ip_type ip_type_invalid = { .addr.v4.as_int = -1 };
+const ip_type ip_type_localhost = { .addr.v4 = {127, 0, 0, 1} };
+

src/ip_type.h

@@ -0,0 +1,23 @@
+#ifndef IP_TYPE_H
+#define IP_TYPE_H
+
+#include <stdint.h>
+
+typedef union {
+	unsigned char octet[4];
+	uint32_t as_int;
+} ip_type4;
+
+typedef struct {
+	union {
+		ip_type4 v4;
+		unsigned char v6[16];
+	} addr;
+	char is_v6;
+} ip_type;
+
+extern const ip_type ip_type_invalid;
+extern const ip_type ip_type_localhost;
+
+//RcB: DEP "ip_type.c"
+#endif

src/libproxychains.c

@@ -23,6 +23,7 @@
 #include <stdlib.h>
 #include <string.h>
 #include <errno.h>
+#include <assert.h>
 #include <netdb.h>
 
 #include <netinet/in.h>
@@ -31,6 +32,7 @@
 #include <sys/socket.h>
 #include <fcntl.h>
 #include <dlfcn.h>
+#include <pthread.h>
 
 
 #include "core.h"
@@ -41,464 +43,472 @@
 #define     SOCKADDR_2(x)     (satosin(x)->sin_addr)
 #define     SOCKPORT(x)     (satosin(x)->sin_port)
 #define     SOCKFAMILY(x)     (satosin(x)->sin_family)
-#define     MAX_CHAIN 30*1024
+#define     MAX_CHAIN 512
+
+close_t true_close;
+connect_t true_connect;
+gethostbyname_t true_gethostbyname;
+getaddrinfo_t true_getaddrinfo;
+freeaddrinfo_t true_freeaddrinfo;
+getnameinfo_t true_getnameinfo;
+gethostbyaddr_t true_gethostbyaddr;
+sendto_t true_sendto;
 
 int tcp_read_time_out;
 int tcp_connect_time_out;
 chain_type proxychains_ct;
 proxy_data proxychains_pd[MAX_CHAIN];
 unsigned int proxychains_proxy_count = 0;
+unsigned int proxychains_proxy_offset = 0;
 int proxychains_got_chain_data = 0;
 unsigned int proxychains_max_chain = 1;
 int proxychains_quiet_mode = 0;
 int proxychains_resolver = 0;
-static int init_l = 0;
 localaddr_arg localnet_addr[MAX_LOCALNET];
 size_t num_localnet_addr = 0;
+unsigned int remote_dns_subnet = 224;
 
-static inline void get_chain_data(proxy_data *pd, unsigned int *proxy_count,
-	chain_type *ct);
-static void init_lib(void);
+pthread_once_t init_once = PTHREAD_ONCE_INIT;
 
-static void init_lib(void)
-{
-#ifdef THREAD_SAFE
-	pthread_mutex_init(&internal_ips_lock, NULL);
-#endif
-	/* read the config file */
-	get_chain_data(proxychains_pd, &proxychains_proxy_count, &proxychains_ct);
-	
-	proxychains_write_log(LOG_PREFIX "DLL init\n");
-	
-	true_connect = (connect_t) dlsym(RTLD_NEXT, "connect");
+static int init_l = 0;
 
-	if (!true_connect) {
-		fprintf(stderr, "Cannot load symbol 'connect' %s\n", dlerror());
+static inline void get_chain_data(proxy_data * pd, unsigned int *proxy_count, chain_type * ct);
+
+static void* load_sym(char* symname, void* proxyfunc) {
+
+	void *funcptr = dlsym(RTLD_NEXT, symname);
+
+	if(!funcptr) {
+		fprintf(stderr, "Cannot load symbol '%s' %s\n", symname, dlerror());
 		exit(1);
 	} else {
-		#ifdef DEBUG
-		PDEBUG( "loaded symbol 'connect'"
-		" real addr %p  wrapped addr %p\n",
-		true_connect, connect);
-		#endif
+		PDEBUG("loaded symbol '%s'" " real addr %p  wrapped addr %p\n", symname, funcptr, proxyfunc);
 	}
-	if(connect==true_connect) {
-		#ifdef DEBUG
+	if(funcptr == proxyfunc) {
 		PDEBUG("circular reference detected, aborting!\n");
-		#endif
 		abort();
 	}
-	
-	true_gethostbyname = (gethostbyname_t) 
-		dlsym(RTLD_NEXT, "gethostbyname");
+	return funcptr;
+}
 
-	if (!true_gethostbyname) {
-		fprintf(stderr, "Cannot load symbol 'gethostbyname' %s\n", 
-				dlerror());
-		exit(1);
-	} else {
-		#ifdef DEBUG
-		PDEBUG( "loaded symbol 'gethostbyname'"
-		" real addr %p  wrapped addr %p\n",
-		true_gethostbyname, gethostbyname);
-		#endif
-	}
-	true_getaddrinfo = (getaddrinfo_t) 
-		dlsym(RTLD_NEXT, "getaddrinfo");
+#define INIT() init_lib_wrapper(__FUNCTION__)
 
-	if (!true_getaddrinfo) {
-		fprintf(stderr, "Cannot load symbol 'getaddrinfo' %s\n", 
-				dlerror());
-		exit(1);
-	} else {
-		#ifdef DEBUG
-		PDEBUG( "loaded symbol 'getaddrinfo'"
-			" real addr %p  wrapped addr %p\n",
-			true_getaddrinfo, getaddrinfo);
-		#endif
-	}
-	true_freeaddrinfo = (freeaddrinfo_t) 
-		dlsym(RTLD_NEXT, "freeaddrinfo");
+#define SETUP_SYM(X) do { true_ ## X = load_sym( # X, X ); } while(0)
 
-	if (!true_freeaddrinfo) {
-		fprintf(stderr, "Cannot load symbol 'freeaddrinfo' %s\n", 
-				dlerror());
-		exit(1);
-	} else {
-		#ifdef DEBUG
-		PDEBUG( "loaded symbol 'freeaddrinfo'"
-			" real addr %p  wrapped addr %p\n",
-			true_freeaddrinfo, freeaddrinfo);
-		#endif
-	}
-	true_gethostbyaddr = (gethostbyaddr_t) 
-		dlsym(RTLD_NEXT, "gethostbyaddr");
+#include "allocator_thread.h"
 
-	if (!true_gethostbyaddr) {
-		fprintf(stderr, "Cannot load symbol 'gethostbyaddr' %s\n", 
-				dlerror());
-		exit(1);
-	} else {
-		#ifdef DEBUG
-		PDEBUG( "loaded symbol 'gethostbyaddr'"
-			" real addr %p  wrapped addr %p\n",
-			true_gethostbyaddr, gethostbyaddr);
-		#endif
-	}
-	true_getnameinfo = (getnameinfo_t) 
-		dlsym(RTLD_NEXT, "getnameinfo");
+const char *proxychains_get_version(void);
+
+static void setup_hooks(void) {
+	SETUP_SYM(connect);
+	SETUP_SYM(sendto);
+	SETUP_SYM(gethostbyname);
+	SETUP_SYM(getaddrinfo);
+	SETUP_SYM(freeaddrinfo);
+	SETUP_SYM(gethostbyaddr);
+	SETUP_SYM(getnameinfo);
+	SETUP_SYM(close);
+}
+
+static void do_init(void) {
+	srand(time(NULL));
+	core_initialize();
+	at_init();
+
+	/* read the config file */
+	get_chain_data(proxychains_pd, &proxychains_proxy_count, &proxychains_ct);
+	DUMP_PROXY_CHAIN(proxychains_pd, proxychains_proxy_count);
+
+	proxychains_write_log(LOG_PREFIX "DLL init: proxychains-ng %s\n", proxychains_get_version());
+
+	setup_hooks();
 
-	if (!true_getnameinfo) {
-		fprintf(stderr, "Cannot load symbol 'getnameinfo' %s\n", 
-				dlerror());
-		exit(1);
-	} else {
-		#ifdef DEBUG
-		PDEBUG( "loaded symbol 'getnameinfo'"
-			" real addr %p  wrapped addr %p\n",
-			true_getnameinfo, getnameinfo);
-		#endif
-	}
 	init_l = 1;
 }
 
-static inline void get_chain_data(
-			proxy_data *pd,
-			unsigned int *proxy_count,
-			chain_type *ct)
-{
-	int count=0,port_n=0,list=0;
-	char buff[1024],type[1024],host[1024],user[1024];
+static void init_lib_wrapper(const char* caller) {
+#ifndef DEBUG
+	(void) caller;
+#endif
+	if(!init_l) PDEBUG("%s called from %s\n", __FUNCTION__,  caller);
+	pthread_once(&init_once, do_init);
+}
+
+/* if we use gcc >= 3, we can instruct the dynamic loader 
+ * to call init_lib at link time. otherwise it gets loaded
+ * lazily, which has the disadvantage that there's a potential
+ * race condition if 2 threads call it before init_l is set 
+ * and PTHREAD support was disabled */
+#if __GNUC__ > 2
+__attribute__((constructor))
+static void gcc_init(void) {
+	INIT();
+}
+#endif
+
+/* get configuration from config file */
+static void get_chain_data(proxy_data * pd, unsigned int *proxy_count, chain_type * ct) {
+	int count = 0, port_n = 0, list = 0;
+	char buff[1024], type[1024], host[1024], user[1024];
 	char *env;
 	char local_in_addr_port[32];
 	char local_in_addr[32], local_in_port[32], local_netmask[32];
-	FILE* file;
+	FILE *file = NULL;
 
 	if(proxychains_got_chain_data)
-	return;
+		return;
 
 	//Some defaults
-	tcp_read_time_out = 4*1000;
-	tcp_connect_time_out = 10*1000;
+	tcp_read_time_out = 4 * 1000;
+	tcp_connect_time_out = 10 * 1000;
 	*ct = DYNAMIC_TYPE;
 
-	/*
-	 * Get path to configuration file from env this file has priority
-	 * if it's defined.
-	 */
-	env = getenv(PROXYCHAINS_CONF_FILE_ENV_VAR);
-
-	snprintf(buff,256,"%s/.proxychains/proxychains.conf",getenv("HOME"));
-
-	if(!env || (!(file=fopen(env,"r"))))
-	if(!(file=fopen("./proxychains.conf","r")))
-	if(!(file=fopen(buff,"r")))
-	if(!(file=fopen("/etc/proxychains.conf","r")))
+	env = get_config_path(getenv(PROXYCHAINS_CONF_FILE_ENV_VAR), buff, sizeof(buff));
+	if( ( file = fopen(env, "r") ) == NULL )
 	{
-		perror("Can't locate proxychains.conf");
-		exit(1);
+	        perror("couldnt read configuration file");
+        	exit(1);
 	}
-	
-	env = getenv(PROXYCHAINS_QUIET_MODE_ENV_VAR);
-	if(env && *env == '1') proxychains_quiet_mode = 1;
 
-	while(fgets(buff,sizeof(buff),file)) {
-		if(buff[0] != '\n' && buff[strspn(buff," ")]!='#') {
+	env = getenv(PROXYCHAINS_QUIET_MODE_ENV_VAR);
+	if(env && *env == '1')
+		proxychains_quiet_mode = 1;
+
+	while(fgets(buff, sizeof(buff), file)) {
+		if(buff[0] != '\n' && buff[strspn(buff, " ")] != '#') {
+			/* proxylist has to come last */
 			if(list) {
+				if(count >= MAX_CHAIN)
+					break;
+
 				memset(&pd[count], 0, sizeof(proxy_data));
-				
+
 				pd[count].ps = PLAY_STATE;
 				port_n = 0;
-				
-				sscanf(buff,"%s %s %d %s %s", type, host, &port_n,
-					pd[count].user, pd[count].pass);
-				
-				pd[count].ip.as_int = (uint32_t) inet_addr(host);
-				pd[count].port = htons((unsigned short)port_n);
-				
-				if(!strcmp(type,"http")) {
+
+				int ret = sscanf(buff, "%s %s %d %s %s", type, host, &port_n, pd[count].user, pd[count].pass);
+				if(ret < 3 || ret == EOF) {
+					inv:
+					fprintf(stderr, "error: invalid item in proxylist section: %s", buff);
+					exit(1);
+				}
+
+				memset(&pd[count].ip, 0, sizeof(pd[count].ip));
+				pd[count].ip.is_v6 = !!strchr(host, ':');
+				pd[count].port = htons((unsigned short) port_n);
+				ip_type* host_ip = &pd[count].ip;
+				if(1 != inet_pton(host_ip->is_v6 ? AF_INET6 : AF_INET, host, host_ip->addr.v6)) {
+					fprintf(stderr, "proxy %s has invalid value or is not numeric\n", host);
+					exit(1);
+				}
+
+				if(!strcmp(type, "http")) {
 					pd[count].pt = HTTP_TYPE;
-				} else if(!strcmp(type,"socks4")) {
+				} else if(!strcmp(type, "socks4")) {
 					pd[count].pt = SOCKS4_TYPE;
-				} else if(!strcmp(type,"socks5")) {
+				} else if(!strcmp(type, "socks5")) {
 					pd[count].pt = SOCKS5_TYPE;
-				} else 
-					continue;
-				
-				if(pd[count].ip.as_int && port_n &&
-				   pd[count].ip.as_int != (uint32_t) -1)
-					if(++count==MAX_CHAIN)
-						break;
-			 } else {
-				if(strstr(buff,"[ProxyList]")) {
-					list=1;
-				} else if(strstr(buff,"random_chain")) {
-					*ct=RANDOM_TYPE;
-				} else if(strstr(buff,"strict_chain")) {
-					*ct=STRICT_TYPE;
-				} else if(strstr(buff,"dynamic_chain")) {
-					*ct=DYNAMIC_TYPE;
-				} else if(strstr(buff,"tcp_read_time_out")){
-					sscanf(buff,"%s %d",user,&tcp_read_time_out) ;
-				} else if(strstr(buff,"tcp_connect_time_out")){
-					sscanf(buff,"%s %d",user,&tcp_connect_time_out) ;
-				} else if(strstr(buff,"localnet")) {
-					if (sscanf(buff,"%s %21[^/]/%15s", user,
-						local_in_addr_port, local_netmask) < 3) {
+				} else
+					goto inv;
+
+				if(port_n)
+					count++;
+			} else {
+				if(strstr(buff, "[ProxyList]")) {
+					list = 1;
+				} else if(strstr(buff, "random_chain")) {
+					*ct = RANDOM_TYPE;
+				} else if(strstr(buff, "strict_chain")) {
+					*ct = STRICT_TYPE;
+				} else if(strstr(buff, "dynamic_chain")) {
+					*ct = DYNAMIC_TYPE;
+				} else if(strstr(buff, "round_robin_chain")) {
+					*ct = ROUND_ROBIN_TYPE;
+				} else if(strstr(buff, "tcp_read_time_out")) {
+					sscanf(buff, "%s %d", user, &tcp_read_time_out);
+				} else if(strstr(buff, "tcp_connect_time_out")) {
+					sscanf(buff, "%s %d", user, &tcp_connect_time_out);
+				} else if(strstr(buff, "remote_dns_subnet")) {
+					sscanf(buff, "%s %d", user, &remote_dns_subnet);
+					if(remote_dns_subnet >= 256) {
+						fprintf(stderr,
+							"remote_dns_subnet: invalid value. requires a number between 0 and 255.\n");
+						exit(1);
+					}
+				} else if(strstr(buff, "localnet")) {
+					if(sscanf(buff, "%s %21[^/]/%15s", user, local_in_addr_port, local_netmask) < 3) {
 						fprintf(stderr, "localnet format error");
 						exit(1);
 					}
 					/* clean previously used buffer */
-					memset(local_in_port, 0,
-						sizeof(local_in_port) / sizeof(local_in_port[0]));
+					memset(local_in_port, 0, sizeof(local_in_port) / sizeof(local_in_port[0]));
 
-					if (sscanf(local_in_addr_port, "%15[^:]:%5s",
-						local_in_addr, local_in_port) < 2) {
-					    PDEBUG("added localnet: netaddr=%s, port=%s\n",
-							local_in_addr, local_netmask);
+					if(sscanf(local_in_addr_port, "%15[^:]:%5s", local_in_addr, local_in_port) < 2) {
+						PDEBUG("added localnet: netaddr=%s, netmask=%s\n",
+						       local_in_addr, local_netmask);
 					} else {
-					    PDEBUG("added localnet: netaddr=%s, port=%s, netmask=%s\n",
-							local_in_addr, local_in_port, local_netmask);
+						PDEBUG("added localnet: netaddr=%s, port=%s, netmask=%s\n",
+						       local_in_addr, local_in_port, local_netmask);
 					}
-					if (num_localnet_addr < MAX_LOCALNET)
-					{
+					if(num_localnet_addr < MAX_LOCALNET) {
 						int error;
-						error = inet_pton(AF_INET, local_in_addr, &localnet_addr[num_localnet_addr].in_addr);
-						if (error <= 0)
-						{
+						error =
+						    inet_pton(AF_INET, local_in_addr,
+							      &localnet_addr[num_localnet_addr].in_addr);
+						if(error <= 0) {
 							fprintf(stderr, "localnet address error\n");
 							exit(1);
 						}
-						error = inet_pton(AF_INET, local_netmask, &localnet_addr[num_localnet_addr].netmask);
-						if (error <= 0)
-						{
+						error =
+						    inet_pton(AF_INET, local_netmask,
+							      &localnet_addr[num_localnet_addr].netmask);
+						if(error <= 0) {
 							fprintf(stderr, "localnet netmask error\n");
 							exit(1);
 						}
-						if (local_in_port[0]) {
-							localnet_addr[num_localnet_addr].port = (short)atoi(local_in_port);
+						if(local_in_port[0]) {
+							localnet_addr[num_localnet_addr].port =
+							    (short) atoi(local_in_port);
 						} else {
 							localnet_addr[num_localnet_addr].port = 0;
 						}
 						++num_localnet_addr;
-					}
-					else
-					{
+					} else {
 						fprintf(stderr, "# of localnet exceed %d.\n", MAX_LOCALNET);
 					}
-				} else if(strstr(buff,"chain_len")){
-					char *pc;int len;
-					pc=strchr(buff,'=');
-					len=atoi(++pc);
-					proxychains_max_chain=(len?len:1);
-				} else if(strstr(buff,"quiet_mode")){
-					proxychains_quiet_mode=1;
-				} else if(strstr(buff,"proxy_dns")){
-					proxychains_resolver=1;
+				} else if(strstr(buff, "chain_len")) {
+					char *pc;
+					int len;
+					pc = strchr(buff, '=');
+					len = atoi(++pc);
+					proxychains_max_chain = (len ? len : 1);
+				} else if(strstr(buff, "quiet_mode")) {
+					proxychains_quiet_mode = 1;
+				} else if(strstr(buff, "proxy_dns")) {
+					proxychains_resolver = 1;
 				}
 			}
 		}
 	}
+#ifndef BROKEN_FCLOSE
 	fclose(file);
+#endif
+	if(!count) {
+		fprintf(stderr, "error: no valid proxy found in config\n");
+		exit(1);
+	}
 	*proxy_count = count;
 	proxychains_got_chain_data = 1;
 }
 
+/*******  HOOK FUNCTIONS  *******/
 
+int close(int fd) {
+	INIT();
+	/* prevent rude programs (like ssh) from closing our pipes */
+	if(fd != req_pipefd[0]  && fd != req_pipefd[1] &&
+	   fd != resp_pipefd[0] && fd != resp_pipefd[1]) {
+		return true_close(fd);
+	}
+	errno = EBADF;
+	return -1;
+}
+static int is_v4inv6(const struct in6_addr *a) {
+	return a->s6_addr32[0] == 0 && a->s6_addr32[1] == 0 &&
+	       a->s6_addr16[4] == 0 && a->s6_addr16[5] == 0xffff;
+}
+int connect(int sock, const struct sockaddr *addr, unsigned int len) {
+	INIT();
+	PFUNC();
 
-int connect (int sock, const struct sockaddr *addr, unsigned int len)
-{
-	int socktype=0, flags=0, ret=0;
+	int socktype = 0, flags = 0, ret = 0;
 	socklen_t optlen = 0;
 	ip_type dest_ip;
-#ifdef DEBUG
-	char str[256];
-#endif
+	DEBUGDECL(char str[256]);
+
 	struct in_addr *p_addr_in;
+	struct in6_addr *p_addr_in6;
 	unsigned short port;
 	size_t i;
+	int remote_dns_connect = 0;
+	optlen = sizeof(socktype);
+	sa_family_t fam = SOCKFAMILY(*addr);
+	getsockopt(sock, SOL_SOCKET, SO_TYPE, &socktype, &optlen);
+	if(!((fam  == AF_INET || fam == AF_INET6) && socktype == SOCK_STREAM))
+		return true_connect(sock, addr, len);
 
-	if(!init_l)
-		init_lib();
-	optlen=sizeof(socktype);
-	getsockopt(sock,SOL_SOCKET,SO_TYPE,&socktype,&optlen);
-	if (! (SOCKFAMILY(*addr)==AF_INET  && socktype==SOCK_STREAM))
-		return true_connect(sock,addr,len);
+	int v6 = dest_ip.is_v6 = fam == AF_INET6;
 
-	p_addr_in = &((struct sockaddr_in *)addr)->sin_addr;
-	port = ntohs(((struct sockaddr_in *)addr)->sin_port);
+	p_addr_in = &((struct sockaddr_in *) addr)->sin_addr;
+	p_addr_in6 = &((struct sockaddr_in6 *) addr)->sin6_addr;
+	port = !v6 ? ntohs(((struct sockaddr_in *) addr)->sin_port)
+	           : ntohs(((struct sockaddr_in6 *) addr)->sin6_port);
+	struct in_addr v4inv6;
+	if(v6 && is_v4inv6(p_addr_in6)) {
+		memcpy(&v4inv6.s_addr, &p_addr_in6->s6_addr32[3], 4);
+		v6 = dest_ip.is_v6 = 0;
+		p_addr_in = &v4inv6;
+	}
 
-#ifdef DEBUG
-//	PDEBUG("localnet: %s; ", inet_ntop(AF_INET,&in_addr_localnet, str, sizeof(str)));
-//	PDEBUG("netmask: %s; " , inet_ntop(AF_INET, &in_addr_netmask, str, sizeof(str)));
-	PDEBUG("target: %s\n", inet_ntop(AF_INET, p_addr_in, str, sizeof(str)));
+//      PDEBUG("localnet: %s; ", inet_ntop(AF_INET,&in_addr_localnet, str, sizeof(str)));
+//      PDEBUG("netmask: %s; " , inet_ntop(AF_INET, &in_addr_netmask, str, sizeof(str)));
+	PDEBUG("target: %s\n", inet_ntop(v6 ? AF_INET6 : AF_INET, v6 ? (void*)p_addr_in6 : (void*)p_addr_in, str, sizeof(str)));
 	PDEBUG("port: %d\n", port);
-#endif
-	for (i = 0; i < num_localnet_addr; i++) {
-		if ((localnet_addr[i].in_addr.s_addr & localnet_addr[i].netmask.s_addr)
-			== (p_addr_in->s_addr & localnet_addr[i].netmask.s_addr))
-		{
-			if (localnet_addr[i].port && localnet_addr[i].port == port) {
+
+	// check if connect called from proxydns
+        remote_dns_connect = !v6 && (ntohl(p_addr_in->s_addr) >> 24 == remote_dns_subnet);
+
+	if (!v6) for(i = 0; i < num_localnet_addr && !remote_dns_connect; i++) {
+		if((localnet_addr[i].in_addr.s_addr & localnet_addr[i].netmask.s_addr)
+		   == (p_addr_in->s_addr & localnet_addr[i].netmask.s_addr)) {
+			if(!localnet_addr[i].port || localnet_addr[i].port == port) {
 				PDEBUG("accessing localnet using true_connect\n");
-				return true_connect(sock,addr,len);
+				return true_connect(sock, addr, len);
 			}
 		}
 	}
 
 	flags = fcntl(sock, F_GETFL, 0);
 	if(flags & O_NONBLOCK)
-	fcntl(sock, F_SETFL, !O_NONBLOCK);
-	
-	dest_ip.as_int = SOCKADDR(*addr);
-	
-	ret = connect_proxy_chain(
-		sock,
-		dest_ip,
-		SOCKPORT(*addr),
-		proxychains_pd,
-		proxychains_proxy_count,
-		proxychains_ct,
-		proxychains_max_chain );
-	
+		fcntl(sock, F_SETFL, !O_NONBLOCK);
+
+	memcpy(dest_ip.addr.v6, v6 ? (void*)p_addr_in6 : (void*)p_addr_in, v6?16:4);
+
+	ret = connect_proxy_chain(sock,
+				  dest_ip,
+				  htons(port),
+				  proxychains_pd, proxychains_proxy_count, proxychains_ct, proxychains_max_chain);
+
 	fcntl(sock, F_SETFL, flags);
 	if(ret != SUCCESS)
-	errno = ECONNREFUSED;
+		errno = ECONNREFUSED;
 	return ret;
 }
 
-struct hostent *gethostbyname(const char *name)
-{
-	if(!init_l)
-		init_lib();
-	
-	PDEBUG("gethostbyname: %s\n",name);
-	
+static struct gethostbyname_data ghbndata;
+struct hostent *gethostbyname(const char *name) {
+	INIT();
+	PDEBUG("gethostbyname: %s\n", name);
+
 	if(proxychains_resolver)
-		return proxy_gethostbyname(name);
+		return proxy_gethostbyname(name, &ghbndata);
 	else
 		return true_gethostbyname(name);
-			
+
 	return NULL;
 }
 
-int getaddrinfo(const char *node, const char *service,
-		const struct addrinfo *hints,
-		struct addrinfo **res)
-{
-	int ret = 0;
-	
-	if(!init_l)
-		init_lib();
-	
-	PDEBUG("getaddrinfo: %s %s\n",node ,service);
-	
+int getaddrinfo(const char *node, const char *service, const struct addrinfo *hints, struct addrinfo **res) {
+	INIT();
+	PDEBUG("getaddrinfo: %s %s\n", node ? node : "null", service ? service : "null");
+
 	if(proxychains_resolver)
-		ret = proxy_getaddrinfo(node, service, hints, res);
+		return proxy_getaddrinfo(node, service, hints, res);
 	else
-		ret = true_getaddrinfo(node, service, hints, res);
-			
-	return ret;
+		return true_getaddrinfo(node, service, hints, res);
 }
 
-void freeaddrinfo(struct addrinfo *res)
-{
-	if(!init_l)
-		init_lib();
-	
-	PDEBUG("freeaddrinfo %p \n",res);
-	
+void freeaddrinfo(struct addrinfo *res) {
+	INIT();
+	PDEBUG("freeaddrinfo %p \n", res);
+
 	if(!proxychains_resolver)
 		true_freeaddrinfo(res);
-	else {
-		free(res->ai_addr);
-		free(res);
-	}
-	return;
+	else
+		proxy_freeaddrinfo(res);
 }
-// work around a buggy prototype in GLIBC. according to the bugtracker it has been fixed in git at 02 May 2011.
-// 2.14 came out in June 2011 so that should be the first fixed version
-#if defined(__GLIBC__) && (__GLIBC__ < 3) && (__GLIBC_MINOR__ < 14)
-int getnameinfo (const struct sockaddr * sa,
-                        socklen_t salen, char * host,
-                        socklen_t hostlen, char * serv,
-                        socklen_t servlen, unsigned int flags)
-#else
-int getnameinfo (const struct sockaddr * sa,
-			socklen_t salen, char * host,
-			socklen_t hostlen, char * serv,
-			socklen_t servlen, int flags)
-#endif
+
+int pc_getnameinfo(const struct sockaddr *sa, socklen_t salen,
+	           char *host, socklen_t hostlen, char *serv,
+	           socklen_t servlen, int flags)
 {
-	int ret = 0;
-	
-	if(!init_l)
-		init_lib();
-	
-	PDEBUG("getnameinfo: %s %s\n", host, serv);
-	
+	INIT();
+	PFUNC();
+
 	if(!proxychains_resolver) {
-		ret = true_getnameinfo(sa,salen,host,hostlen,
-				serv,servlen,flags);
+		return true_getnameinfo(sa, salen, host, hostlen, serv, servlen, flags);
 	} else {
-		if(hostlen) 
-			strncpy(host, inet_ntoa(SOCKADDR_2(*sa)),hostlen);
-		if(servlen) 
-			snprintf(serv, servlen,"%d",ntohs(SOCKPORT(*sa)));
+		if(!salen || !(SOCKFAMILY(*sa) == AF_INET || SOCKFAMILY(*sa) == AF_INET6))
+			return EAI_FAMILY;
+		int v6 = SOCKFAMILY(*sa) == AF_INET6;
+		if(salen < (v6?sizeof(struct sockaddr_in6):sizeof(struct sockaddr_in)))
+			return EAI_FAMILY;
+		if(hostlen) {
+			unsigned char v4inv6buf[4];
+			const void *ip = v6 ? (void*)&((struct sockaddr_in6*)sa)->sin6_addr
+			                    : (void*)&((struct sockaddr_in*)sa)->sin_addr;
+			unsigned scopeid = 0;
+			if(v6) {
+				if(is_v4inv6(&((struct sockaddr_in6*)sa)->sin6_addr)) {
+					memcpy(v4inv6buf, &((struct sockaddr_in6*)sa)->sin6_addr.s6_addr32[3], 4);
+					ip = v4inv6buf;
+					v6 = 0;
+				} else
+					scopeid = ((struct sockaddr_in6 *)sa)->sin6_scope_id;
+			}
+			if(!inet_ntop(v6?AF_INET6:AF_INET,ip,host,hostlen))
+				return EAI_OVERFLOW;
+			if(scopeid) {
+				size_t l = strlen(host);
+				if(snprintf(host+l, hostlen-l, "%%%u", scopeid) >= hostlen-l)
+					return EAI_OVERFLOW;
+			}
+		}
+		if(servlen) {
+			if(snprintf(serv, servlen, "%d", ntohs(SOCKPORT(*sa))) >= servlen)
+				return EAI_OVERFLOW;
+		}
 	}
-	return ret;
+	return 0;
 }
 
-// stolen from libulz (C) rofl0r
-static void pc_stringfromipv4(unsigned char* ip_buf_4_bytes, char* outbuf_16_bytes) {
-        unsigned char* p;
-        char *o = outbuf_16_bytes;
-        unsigned char n;
-        for(p = ip_buf_4_bytes; p < ip_buf_4_bytes + 4; p++) {
-                n = *p;
-                if(*p >= 100) {
-                        if(*p >= 200) *(o++) = '2';
-                        else *(o++) = '1';
-                        n %= 100;
-                }
-                if(*p >= 10) {
-                        *(o++) = (n / 10) + '0';
-                        n %= 10;
-                }
-                *(o++) = n + '0';
-                *(o++) = '.';
-        }
-        o[-1] = 0;
-}
+struct hostent *gethostbyaddr(const void *addr, socklen_t len, int type) {
+	INIT();
+	PDEBUG("TODO: proper gethostbyaddr hook\n");
 
-struct hostent *gethostbyaddr (const void *addr, socklen_t len, int type)
-{
 	static char buf[16];
 	static char ipv4[4];
-	static char* list[2];
+	static char *list[2];
+	static char *aliases[1];
 	static struct hostent he;
-	
-	if(!init_l)
-		init_lib();
-	
-	PDEBUG("TODO: proper gethostbyaddr hook\n");
-	
+
 	if(!proxychains_resolver)
-		return true_gethostbyaddr(addr,len,type);
+		return true_gethostbyaddr(addr, len, type);
 	else {
-		
+
 		PDEBUG("len %u\n", len);
-		if(len != 4) return NULL;
+		if(len != 4)
+			return NULL;
 		he.h_name = buf;
 		memcpy(ipv4, addr, 4);
 		list[0] = ipv4;
 		list[1] = NULL;
 		he.h_addr_list = list;
 		he.h_addrtype = AF_INET;
-		he.h_aliases = NULL;
+		aliases[0] = NULL;
+		he.h_aliases = aliases;
 		he.h_length = 4;
-		pc_stringfromipv4((unsigned char*)addr, buf);
+		pc_stringfromipv4((unsigned char *) addr, buf);
 		return &he;
 	}
 	return NULL;
 }
-	
+
+#ifndef MSG_FASTOPEN
+#   define MSG_FASTOPEN 0x20000000
+#endif
+
+ssize_t sendto(int sockfd, const void *buf, size_t len, int flags,
+	       const struct sockaddr *dest_addr, socklen_t addrlen) {
+	INIT();
+	PFUNC();
+	if (flags & MSG_FASTOPEN) {
+		if (!connect(sockfd, dest_addr, addrlen) && errno != EINPROGRESS) {
+			return -1;
+		}
+		dest_addr = NULL;
+		addrlen = 0;
+		flags &= ~MSG_FASTOPEN;
+	}
+	return true_sendto(sockfd, buf, len, flags, dest_addr, addrlen);
+}

src/main.c

@@ -1,12 +1,4 @@
-/***************************************************************************
-                          main.c  -  description
-
-    begin                : Tue May 14 2002
-    copyright            :  netcreature (C) 2002
-    email                : netcreature@users.sourceforge.net
- ***************************************************************************/
- /*     GPL */
-/***************************************************************************
+/*   (C) 2011, 2012 rofl0r
  *                                                                         *
  *   This program is free software; you can redistribute it and/or modify  *
  *   it under the terms of the GNU General Public License as published by  *
@@ -14,6 +6,7 @@
  *   (at your option) any later version.                                   *
  *                                                                         *
  ***************************************************************************/
+
 #undef _POSIX_C_SOURCE
 #define _POSIX_C_SOURCE 200809L
 #undef _XOPEN_SOURCE
@@ -26,30 +19,23 @@
 #include <sys/types.h>
 #include <sys/wait.h>
 
-extern char *optarg;
-extern int optind, opterr, optopt;
-
 #include "common.h"
 
-static int usage(char** argv) {
-	printf( "\nUsage:\t%s -q -f config_file program_name [arguments]\n"
-		"\t-q makes proxychains quiet - this overrides the config setting\n"
-		"\t-t allows to manually specify a configfile to use\n"
-		"\tfor example : proxychains telnet somehost.com\n"
-		"More help in README file\n\n", argv[0]);
+static int usage(char **argv) {
+	printf("\nUsage:\t%s -q -f config_file program_name [arguments]\n"
+	       "\t-q makes proxychains quiet - this overrides the config setting\n"
+	       "\t-f allows to manually specify a configfile to use\n"
+	       "\tfor example : proxychains telnet somehost.com\n" "More help in README file\n\n", argv[0]);
 	return EXIT_FAILURE;
 }
 
-int check_path(char* path) {
-	if(!path) return 0;
-	return access(path, R_OK) != -1;
-}
-
-static const char* dll_name = "libproxychains4.so";
+static const char *dll_name = DLL_NAME;
 
 static char own_dir[256];
-static const char* dll_dirs[] = {
+static const char *dll_dirs[] = {
+#ifndef SUPER_SECURE /* CVE-2015-3887 */
 	".",
+#endif
 	own_dir,
 	LIB_DIR,
 	"/lib",
@@ -59,89 +45,73 @@ static const char* dll_dirs[] = {
 	NULL
 };
 
-static void set_own_dir(const char* argv0) {
+static void set_own_dir(const char *argv0) {
 	size_t l = strlen(argv0);
-	while(l && argv0[l - 1] != '/') l--;
+	while(l && argv0[l - 1] != '/')
+		l--;
 	if(l == 0)
+#ifdef SUPER_SECURE
+		memcpy(own_dir, "/dev/null/", 11);
+#else
 		memcpy(own_dir, ".", 2);
+#endif
 	else {
 		memcpy(own_dir, argv0, l - 1);
 		own_dir[l] = 0;
 	}
 }
 
+#define MAX_COMMANDLINE_FLAGS 2
+
 int main(int argc, char *argv[]) {
 	char *path = NULL;
 	char buf[256];
 	char pbuf[256];
-	int opt;
 	int start_argv = 1;
 	int quiet = 0;
-	
-	if(argc == 1) return usage(argv);
+	size_t i;
+	const char *prefix = NULL;
 
-	while ((opt = getopt(argc, argv, "qf:")) != -1) {
-		switch (opt) {
-			case 'q':
+	for(i = 0; i < MAX_COMMANDLINE_FLAGS; i++) {
+		if(start_argv < argc && argv[start_argv][0] == '-') {
+			if(argv[start_argv][1] == 'q') {
 				quiet = 1;
 				start_argv++;
-				break;
-			case 'f':
-				path = (char *)optarg;
-				if(!path) {
-					fprintf(stderr, "error: no path supplied.\n");
-					return EXIT_FAILURE;
-				}
+			} else if(argv[start_argv][1] == 'f') {
+
+				if(start_argv + 1 < argc)
+					path = argv[start_argv + 1];
+				else
+					return usage(argv);
+
 				start_argv += 2;
-				break;
-			default: /* '?' */
-				return usage(argv);
 			}
+		} else
+			break;
 	}
-	
-	if(start_argv >= argc) return usage(argv);
+
+	if(start_argv >= argc)
+		return usage(argv);
 
 	/* check if path of config file has not been passed via command line */
-	if(!path) {
-		// priority 1: env var PROXYCHAINS_CONF_FILE
-		path = getenv(PROXYCHAINS_CONF_FILE_ENV_VAR);
-		if(check_path(path)) goto have;
-		
-		// priority 2; proxychains conf in actual dir
-		path = getcwd(buf, sizeof(buf));
-		snprintf(pbuf, sizeof(pbuf), "%s/%s", path, PROXYCHAINS_CONF_FILE);
-		path = pbuf;
-		if(check_path(path)) goto have;
-		
-		// priority 3; $HOME/.proxychains/proxychains.conf
-		path = getenv("HOME");
-		snprintf(pbuf, sizeof(pbuf), "%s/.proxychains/%s", path, PROXYCHAINS_CONF_FILE);
-		path = pbuf;
-		if(check_path(path)) goto have;
-		
-		// priority 4: /etc/proxychains.conf
-		path = "/etc/proxychains.conf";
-		if(check_path(path)) goto have;
-		perror("couldnt find configuration file");
-		return 1;
-	}
-	
-	have:
+	path = get_config_path(path, pbuf, sizeof(pbuf));
 
-	if(!quiet) fprintf(stderr, LOG_PREFIX "config file found: %s\n", path);
+	if(!quiet)
+		fprintf(stderr, LOG_PREFIX "config file found: %s\n", path);
 
 	/* Set PROXYCHAINS_CONF_FILE to get proxychains lib to use new config file. */
 	setenv(PROXYCHAINS_CONF_FILE_ENV_VAR, path, 1);
-	
-	if(quiet) setenv(PROXYCHAINS_QUIET_MODE_ENV_VAR, "1", 1);
+
+	if(quiet)
+		setenv(PROXYCHAINS_QUIET_MODE_ENV_VAR, "1", 1);
 
 
 	// search DLL
-	size_t i = 0;
-	const char* prefix = NULL;
 
 	set_own_dir(argv[0]);
 
+	i = 0;
+
 	while(dll_dirs[i]) {
 		snprintf(buf, sizeof(buf), "%s/%s", dll_dirs[i], dll_name);
 		if(access(buf, R_OK) != -1) {
@@ -155,10 +125,26 @@ int main(int argc, char *argv[]) {
 		fprintf(stderr, "couldnt locate %s\n", dll_name);
 		return EXIT_FAILURE;
 	}
-	if(!quiet) fprintf(stderr, LOG_PREFIX "preloading %s/%s\n", prefix, dll_name);
-	
-	snprintf(buf, sizeof(buf), "LD_PRELOAD=%s/%s", prefix, dll_name);
+	if(!quiet)
+		fprintf(stderr, LOG_PREFIX "preloading %s/%s\n", prefix, dll_name);
 
+#ifdef IS_MAC
+	putenv("DYLD_FORCE_FLAT_NAMESPACE=1");
+#define LD_PRELOAD_ENV "DYLD_INSERT_LIBRARIES"
+#define LD_PRELOAD_SEP ":"
+#else
+#define LD_PRELOAD_ENV "LD_PRELOAD"
+/* all historic implementations of BSD and linux dynlinkers seem to support
+   space as LD_PRELOAD separator, with colon added only recently.
+   we use the old syntax for maximum compat */
+#define LD_PRELOAD_SEP " "
+#endif
+	char *old_val = getenv(LD_PRELOAD_ENV);
+	snprintf(buf, sizeof(buf), LD_PRELOAD_ENV "=%s/%s%s%s",
+	         prefix, dll_name,
+	         /* append previous LD_PRELOAD content, if existent */
+	         old_val ? LD_PRELOAD_SEP : "",
+	         old_val ? old_val : "");
 	putenv(buf);
 	execvp(argv[start_argv], &argv[start_argv]);
 	perror("proxychains can't load process....");

src/mutex.h

@@ -0,0 +1,10 @@
+#ifndef MUTEX_H
+#define MUTEX_H
+
+#include <pthread.h>
+# define MUTEX_LOCK(x) pthread_mutex_lock(x)
+# define MUTEX_UNLOCK(x) pthread_mutex_unlock(x)
+# define MUTEX_INIT(x) pthread_mutex_init(x, NULL)
+# define MUTEX_DESTROY(x) pthread_mutex_destroy(x)
+
+#endif

src/nameinfo.c

@@ -0,0 +1,13 @@
+#include <sys/socket.h>
+
+extern int pc_getnameinfo(const void *sa, socklen_t salen, 
+                   char *host, socklen_t hostlen, char *serv, 
+                   socklen_t servlen, int flags);
+
+
+int getnameinfo(const void *sa, socklen_t salen, 
+                   char *host, socklen_t hostlen, char *serv, 
+                   socklen_t servlen, int flags) {
+	return pc_getnameinfo(sa, salen, host, hostlen, serv, servlen, flags);
+}
+

src/proxychains

@@ -1,26 +0,0 @@
-#!/bin/sh
-echo "ProxyChains-3.1 (http://proxychains.sf.net)"
-
-usage() {
-
-	echo "	usage:"
-	echo "		$0 [h] [f config-file] <prog> [args]"
-	exit
-}
-
-if [ $# = 0 ] ; then
-	usage
-fi
-
-if [ $1 = "-h" ]; then
-	usage
-fi
-
-if [ "$1" = "-f" ]; then
-	export PROXYCHAINS_CONF_FILE=$2;
-	shift;
-	shift;
-fi
-
-export LD_PRELOAD=libproxychains.so.3
-exec "$@"

src/proxychains.conf

@@ -1,7 +1,7 @@
-# proxychains.conf  VER 3.1
+# proxychains.conf  VER 4.x
 #
-#        HTTP, SOCKS4, SOCKS5 tunneling proxifier with DNS.
-#	
+#        HTTP, SOCKS4a, SOCKS5 tunneling proxifier with DNS.
+
 
 # The option below identifies how the ProxyList is treated.
 # only one option should be uncommented at time,
@@ -22,13 +22,27 @@ strict_chain
 # all proxies must be online to play in chain
 # otherwise EINTR is returned to the app
 #
+#round_robin_chain
+#
+# Round Robin - Each connection will be done via chained proxies
+# of chain_len length
+# all proxies chained in the order as they appear in the list
+# at least one proxy must be online to play in chain
+# (dead proxies are skipped).
+# the start of the current proxy chain is the proxy after the last
+# proxy in the previously invoked proxy chain.
+# if the end of the proxy chain is reached while looking for proxies
+# start at the beginning again.
+# otherwise EINTR is returned to the app
+# These semantics are not guaranteed in a multithreaded environment.
+#
 #random_chain
 #
 # Random - Each connection will be done via random proxy
 # (or proxy chain, see  chain_len) from the list.
 # this option is good to test your IDS :)
 
-# Make sense only if random_chain
+# Make sense only if random_chain or round_robin_chain
 #chain_len = 2
 
 # Quiet mode (no output from library)
@@ -37,11 +51,25 @@ strict_chain
 # Proxy DNS requests - no leak for DNS data
 proxy_dns 
 
+# set the class A subnet number to use for the internal remote DNS mapping
+# we use the reserved 224.x.x.x range by default,
+# if the proxified app does a DNS request, we will return an IP from that range.
+# on further accesses to this ip we will send the saved DNS name to the proxy.
+# in case some control-freak app checks the returned ip, and denies to 
+# connect, you can use another subnet, e.g. 10.x.x.x or 127.x.x.x.
+# of course you should make sure that the proxified app does not need
+# *real* access to this subnet. 
+# i.e. dont use the same subnet then in the localnet section
+#remote_dns_subnet 127 
+#remote_dns_subnet 10
+remote_dns_subnet 224
+
 # Some timeouts in milliseconds
 tcp_read_time_out 15000
 tcp_connect_time_out 8000
 
-# Example for localnet exclusion
+### Examples for localnet exclusion
+## localnet ranges will *not* use a proxy to connect.
 ## Exclude connections to 192.168.1.0/24 with port 80
 # localnet 192.168.1.0:80/255.255.255.0
 
@@ -51,10 +79,23 @@ tcp_connect_time_out 8000
 ## Exclude connections to ANYwhere with port 80
 # localnet 0.0.0.0:80/0.0.0.0
 
+## RFC5735 Loopback address range
+## if you enable this, you have to make sure remote_dns_subnet is not 127
+## you'll need to enable it if you want to use an application that 
+## connects to localhost.
+# localnet 127.0.0.0/255.0.0.0
+
+## RFC1918 Private Address Ranges
+# localnet 10.0.0.0/255.0.0.0
+# localnet 172.16.0.0/255.240.0.0
+# localnet 192.168.0.0/255.255.0.0
+
 # ProxyList format
-#       type  host  port [user pass]
+#       type  ip  port [user pass]
 #       (values separated by 'tab' or 'blank')
 #
+#       only numeric ipv4 addresses are valid
+#
 #
 #        Examples:
 #

src/proxyresolv

@@ -1,8 +1,10 @@
 #!/bin/sh
-# This script is called by proxychains to resolve DNS names
+# This is a legacy script that uses "dig" to do DNS lookups via TCP.
+# it is not actively maintained since proxychains no longer depends
+# on it. i leave it here as a bonus.
 
 # DNS server used to resolve names
-DNS_SERVER=4.2.2.2
+DNS_SERVER=8.8.8.8
 
 
 if [ $# = 0 ] ; then
@@ -12,5 +14,5 @@ if [ $# = 0 ] ; then
 fi
 
 
-export LD_PRELOAD=libproxychains.so
-dig $1 @$DNS_SERVER +tcp | awk '/A.+[0-9]+\.[0-9]+\.[0-9]/{print $5;}'
+export LD_PRELOAD=libproxychains4.so
+dig $1 @$DNS_SERVER +tcp | awk '/A.?[0-9]+\.[0-9]+\.[0-9]/{print $5;}'

src/version.c

@@ -0,0 +1,6 @@
+#include "version.h"
+static const char version[] = VERSION;
+const char *proxychains_get_version(void) {
+	return version;
+}
+

tests/test_getaddrinfo.c

@@ -0,0 +1,41 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <netdb.h>
+#include <netinet/in.h>
+#include <sys/socket.h>
+ 
+#ifndef   NI_MAXHOST
+#define   NI_MAXHOST 1025
+#endif
+ 
+int main(void) {
+	struct addrinfo *result;
+	struct addrinfo *res;
+	int error;
+	
+	/* resolve the domain name into a list of addresses */
+	error = getaddrinfo("www.example.com", NULL, NULL, &result);
+	if (error != 0)
+	{   
+		fprintf(stderr, "error in getaddrinfo: %s\n", gai_strerror(error));
+		return EXIT_FAILURE;
+	}   
+	
+	/* loop over all returned results and do inverse lookup */
+	for (res = result; res != NULL; res = res->ai_next)
+	{   
+		char hostname[NI_MAXHOST] = "";
+	
+		error = getnameinfo(res->ai_addr, res->ai_addrlen, hostname, NI_MAXHOST, NULL, 0, 0); 
+		if (error != 0)
+		{
+		fprintf(stderr, "error in getnameinfo: %s\n", gai_strerror(error));
+		continue;
+		}
+		if (*hostname != '\0')
+		printf("hostname: %s\n", hostname);
+	}   
+	
+	freeaddrinfo(result);
+	return EXIT_SUCCESS;
+}

tests/test_gethostent.c

@@ -0,0 +1,24 @@
+#include <netdb.h>
+#include <stdio.h>
+#include "../src/common.h"
+
+void printhostent(struct hostent *hp) {
+	char ipbuf[16];
+	pc_stringfromipv4(hp->h_addr_list[0], ipbuf);
+	printf("alias: %p, len: %d, name: %s, addrlist: %p, addrtype: %d, ip: %s\n", 
+		hp->h_aliases, 
+		hp->h_length,
+		hp->h_name,
+		hp->h_addr_list,
+		hp->h_addrtype,
+		ipbuf
+	);
+}
+
+int main(int argc, char** argv) {
+	struct hostent *hp;
+	while((hp = gethostent())) {
+		printhostent(hp);
+	}
+	return 0;
+}

tests/test_gethostent_r.c

@@ -0,0 +1,61 @@
+#include <netdb.h>
+#include <stdio.h>
+#include <errno.h>
+#include "../src/common.h"
+
+/*
+int gethostent_r( 
+        struct hostent *ret, char *buf, size_t buflen,
+        struct hostent **result, int *h_errnop);
+
+Glibc2 also has reentrant versions gethostent_r(), gethostbyaddr_r(),
+gethostbyname_r() and gethostbyname2_r(). 
+
+The caller supplies a hostent structure ret which will be filled in on success, 
+and a temporary work buffer buf of size buflen. 
+After the call, result will point to the result on success. 
+In case of an error or if no entry is found result will be NULL. 
+The functions return 0 on success and a nonzero error number on failure. 
+In addition to the errors returned by the nonreentrant versions of these functions, 
+if buf is too small, the functions will return ERANGE, and the call should be retried 
+with a larger buffer. 
+The global variable h_errno is not modified, but the address of a variable in which 
+to store error numbers is passed in h_errnop.
+*/
+
+void printhostent(struct hostent *hp) {
+	char ipbuf[16];
+	pc_stringfromipv4(hp->h_addr_list[0], ipbuf);
+	printf("alias: %p, len: %d, name: %s, addrlist: %p, addrtype: %d, ip: %s\n", 
+		hp->h_aliases, 
+		hp->h_length,
+		hp->h_name,
+		hp->h_addr_list,
+		hp->h_addrtype,
+		ipbuf
+	);
+}
+
+int main(int argc, char** argv) {
+	struct hostent he_buf;
+	struct hostent *he_res;
+	char h_buf[1024];
+	int ch_errno;
+	int ret;
+	do {
+		ret = gethostent_r(&he_buf, h_buf, sizeof(h_buf), &he_res, &ch_errno);
+		printf("ret: %d, h_errno: %d\n", ret, ch_errno);
+		if(ret != 0) {
+			errno = ret;
+			ret = -1;
+		}
+		if(ret == -1) {
+			perror("gethostent_r");
+			break;
+		}
+		if(he_res) {
+			printhostent(he_res);
+		}
+	} while (he_res);
+	return 0;
+}

tests/test_getnameinfo.c

@@ -0,0 +1,127 @@
+#include <netdb.h>
+#include <stdio.h>
+#include <string.h>
+#include <assert.h>
+#include <sys/socket.h>
+#include <netinet/in.h>
+
+#define     satosin(x)      ((struct sockaddr_in *) &(x))
+#define     SOCKADDR(x)     (satosin(x)->sin_addr.s_addr)
+#define     SOCKADDR_2(x)     (satosin(x)->sin_addr)
+#define     SOCKPORT(x)     (satosin(x)->sin_port)
+#define     SOCKFAMILY(x)     (satosin(x)->sin_family)
+
+#define ASSERT(X) { if(!(X)) printf("ASSERTION FAILED: %s @%s:%d\n", # X, __FILE__, __LINE__); }
+#define CLR() { hbuf[0] = 0; sbuf[0] = 0; }
+
+int main() {
+	struct sockaddr_in a = {0}, *sa = &a;
+	char hbuf[NI_MAXHOST], sbuf[NI_MAXSERV];
+	a.sin_port = htons(80);
+	memcpy(  &a.sin_addr   , (char[]) {127,0,0,1}, 4);
+
+	int ret;
+
+	if ((ret = getnameinfo((void*)sa, 0, hbuf, sizeof(hbuf), sbuf,
+	    sizeof(sbuf), NI_NUMERICHOST | NI_NUMERICSERV)) == 0)
+		printf("host=%s, serv=%s\n", hbuf, sbuf);
+	else
+		printf("%s\n", gai_strerror(ret));
+
+	ASSERT(ret == EAI_FAMILY);
+	CLR();
+
+	if ((ret = getnameinfo((void*)sa, sizeof a, hbuf, sizeof(hbuf), sbuf,
+	    sizeof(sbuf), NI_NUMERICHOST | NI_NUMERICSERV)) == 0)
+		printf("host=%s, serv=%s\n", hbuf, sbuf);
+	else
+		printf("%s\n", gai_strerror(ret));
+
+	ASSERT(ret == EAI_FAMILY);
+	CLR();
+
+	SOCKFAMILY(a) = AF_INET;
+
+	if ((ret = getnameinfo((void*)sa, sizeof a, hbuf, 1, sbuf,
+	    sizeof(sbuf), NI_NUMERICHOST | NI_NUMERICSERV)) == 0)
+		printf("host=%s, serv=%s\n", hbuf, sbuf);
+	else
+		printf("%s\n", gai_strerror(ret));
+
+	ASSERT(ret == EAI_OVERFLOW);
+	CLR();
+
+	if ((ret = getnameinfo((void*)sa, sizeof a, hbuf, 0, sbuf,
+	    1, NI_NUMERICHOST | NI_NUMERICSERV)) == 0)
+		printf("host=%s, serv=%s\n", hbuf, sbuf);
+	else
+		printf("%s\n", gai_strerror(ret));
+
+	ASSERT(ret == EAI_OVERFLOW);
+	CLR();
+
+	if ((ret = getnameinfo((void*)sa, sizeof(a) - 1, hbuf, 0, sbuf,
+	    sizeof(sbuf), NI_NUMERICHOST | NI_NUMERICSERV)) == 0)
+		printf("host=%s, serv=%s\n", hbuf, sbuf);
+	else
+		printf("%s\n", gai_strerror(ret));
+
+	ASSERT(ret == EAI_FAMILY);
+	CLR();
+
+	if ((ret = getnameinfo((void*)sa, sizeof a, hbuf, 0, sbuf,
+	    sizeof(sbuf), NI_NUMERICHOST | NI_NUMERICSERV)) == 0)
+		printf("host=%s, serv=%s\n", hbuf, sbuf);
+	else
+		printf("%s\n", gai_strerror(ret));
+
+	ASSERT(ret == 0 && !strcmp("80", sbuf));
+	CLR();
+
+	if ((ret = getnameinfo((void*)sa, sizeof a, hbuf, sizeof hbuf, sbuf,
+	    0, NI_NUMERICHOST | NI_NUMERICSERV)) == 0)
+		printf("host=%s, serv=%s\n", hbuf, sbuf);
+	else
+		printf("%s\n", gai_strerror(ret));
+
+	ASSERT(ret == 0 && !strcmp("127.0.0.1",hbuf));
+	CLR();
+
+
+	if ((ret = getnameinfo((void*)sa, sizeof a, hbuf, sizeof(hbuf), sbuf,
+	    sizeof(sbuf), NI_NUMERICHOST | NI_NUMERICSERV)) == 0)
+		printf("host=%s, serv=%s\n", hbuf, sbuf);
+	else
+		printf("%s\n", gai_strerror(ret));
+
+	ASSERT(ret == 0 && !strcmp("127.0.0.1",hbuf) && !strcmp("80", sbuf));
+	CLR();
+
+	struct sockaddr_in6 b = {0}, *sb = &b;
+	b.sin6_port = htons(8080);
+	b.sin6_family = AF_INET6;
+
+	memcpy(&b.sin6_addr,"\0\0\0\0\0\0\0\0\0\0\xff\xff\xc0\xa8\1\2", 16);
+
+	if ((ret = getnameinfo((void*)sb, sizeof b, hbuf, sizeof(hbuf), sbuf,
+	    sizeof(sbuf), NI_NUMERICHOST | NI_NUMERICSERV)) == 0)
+		printf("host=%s, serv=%s\n", hbuf, sbuf);
+	else
+		printf("%s\n", gai_strerror(ret));
+
+	ASSERT(ret == 0 && !strcmp("192.168.1.2",hbuf) && !strcmp("8080", sbuf));
+	CLR();
+
+	b.sin6_scope_id = 3;
+	memcpy(&b.sin6_addr,"\0\0\xaa\0\0\0\0\0\0\0\0\xff\xc0\xa8\1\2", 16);
+
+	if ((ret = getnameinfo((void*)sb, sizeof b, hbuf, sizeof(hbuf), sbuf,
+	    sizeof(sbuf), NI_NUMERICHOST | NI_NUMERICSERV | NI_NUMERICSCOPE)) == 0)
+		printf("host=%s, serv=%s\n", hbuf, sbuf);
+	else
+		printf("%s\n", gai_strerror(ret));
+
+	ASSERT(ret == 0);
+
+	return 0;
+}

tests/test_proxy_gethostbyname.c

@@ -0,0 +1,24 @@
+#include "../src/core.h"
+#include "../src/common.h"
+#include <stdio.h>
+
+void printhostent(struct hostent *hp) {
+	char ipbuf[16];
+	pc_stringfromipv4(hp->h_addr_list[0], ipbuf);
+	printf("alias: %p, len: %d, name: %s, addrlist: %p, addrtype: %d, ip: %s\n", 
+		hp->h_aliases, 
+		hp->h_length,
+		hp->h_name,
+		hp->h_addr_list,
+		hp->h_addrtype,
+		ipbuf
+	);
+}
+int main(int argc, char**argv) {
+	struct hostent* ret;
+	struct gethostbyname_data data;
+	if(argc == 1) return 1;
+	ret = proxy_gethostbyname(argv[1], &data);
+	if(ret) printhostent(ret);
+	return 0;
+}

tests/test_sendto.c

@@ -0,0 +1,66 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <string.h>
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <netinet/in.h>
+#include <netdb.h>
+
+#ifndef MSG_FASTOPEN
+#   define MSG_FASTOPEN 0x20000000
+#endif
+
+void error(const char *msg)
+{
+	perror(msg);
+	exit(1);
+}
+
+int main(int argc, char *argv[])
+{
+	if (argc < 4) {
+		printf("Usage: %s host port method(connect or sendto)\n", argv[0]);
+		return 1;
+	}
+	const char *hostname = argv[1];
+	const int portno = atoi(argv[2]);
+	const char *method = argv[3];
+	char request[BUFSIZ];
+	sprintf(request, "GET / HTTP/1.0\r\nHost: %s\r\n\r\n", hostname);
+	int sockfd, n;
+	struct sockaddr_in serv_addr;
+	struct hostent *server;
+
+	char buffer[BUFSIZ];
+	sockfd = socket(AF_INET, SOCK_STREAM, 0);
+	if (sockfd < 0) error("ERROR opening socket");
+	server = gethostbyname(hostname);
+	if (server == NULL) {
+		fprintf(stderr, "%s: no such host\n", hostname);
+		return 1;
+	}
+	memset(&serv_addr, 0, sizeof(serv_addr));
+	serv_addr.sin_family = AF_INET;
+	memcpy(&serv_addr.sin_addr.s_addr, server->h_addr, server->h_length);
+	serv_addr.sin_port = htons(portno);
+	if (!strcmp(method, "connect")) {
+	  if (connect(sockfd, (struct sockaddr *)&serv_addr, sizeof(serv_addr)) < 0)
+		  error("connect");
+	  n = send(sockfd, request, strlen(request), 0);
+	} else if (!strcmp(method, "sendto")) {
+	  n = sendto(sockfd, request, strlen(request), MSG_FASTOPEN, (struct sockaddr *)&serv_addr, sizeof(serv_addr));
+	} else {
+	  printf("Unknown method %s\n", method);
+	  return 1;
+	}
+	if (n < 0)
+		 error("send");
+	memset(buffer, 0, BUFSIZ);
+	n = read(sockfd, buffer, BUFSIZ - 1);
+	if (n < 0)
+		 error("ERROR reading from socket");
+	printf("%s\n", buffer);
+	close(sockfd);
+	return 0;
+}

tests/test_shm.c

@@ -0,0 +1,39 @@
+#include "../src/shm.h"
+#include <assert.h>
+
+#define s(A) (sizeof(A) - 1)
+#define ss(A) (A), s(A)
+
+int main() {
+	char buf4096[4096];
+	struct stringpool sp;
+	stringpool_init(&sp);
+	char *r;
+	size_t pos = 0;
+	r = stringpool_add(&sp, ss("AAAAA"));
+	assert(r == sp.start);
+	
+	pos += s("AAAAA");
+	assert(sp.alloced == 4096);
+	assert(sp.used == pos);
+	
+	r = stringpool_add(&sp, buf4096, sizeof(buf4096));
+	assert(r == sp.start + pos);
+	
+	pos += sizeof(buf4096);
+	assert(sp.alloced == 4096 * 2);
+	assert(sp.used == pos);
+	
+	r = stringpool_add(&sp, buf4096, 4096 - s("AAAAA"));
+	assert(r == sp.start + pos);
+	pos += 4096 - s("AAAAA");
+	assert(pos == 4096 * 2);
+
+	assert(sp.alloced == 4096 * 2);
+	assert(sp.used == pos);
+	
+	
+	
+	return 0;
+	
+}

tests/test_v4_in_v6.c

@@ -0,0 +1,42 @@
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+#include <netdb.h>
+#include <netinet/in.h>
+#include <sys/socket.h>
+
+static void v4_to_v6(const struct in_addr *v4, struct in6_addr *v6) {
+	memset(v6, 0, sizeof(*v6));
+	v6->s6_addr[10]=0xff;
+	v6->s6_addr[11]=0xff;
+	memcpy(&v6->s6_addr[12], &v4->s_addr, 4);
+}
+
+int main(void) {
+	struct addrinfo *result;
+	struct addrinfo *res;
+	const struct addrinfo hints = { .ai_family = AF_INET };
+	int error, sock;
+
+	/* resolve the domain name into a list of addresses */
+	error = getaddrinfo("www.example.com", NULL, &hints, &result);
+	if (error != 0)	{
+		fprintf(stderr, "error in getaddrinfo: %s\n", gai_strerror(error));
+		return EXIT_FAILURE;
+	}
+	if((sock=socket(AF_INET, SOCK_STREAM, IPPROTO_TCP)) == -1) {
+		perror("socket");
+		return EXIT_FAILURE;
+	}
+	struct sockaddr_in6 a = { .sin6_family = AF_INET6,
+	                          .sin6_port = htons(80) };
+	v4_to_v6(&((struct sockaddr_in *)result->ai_addr)->sin_addr, &a.sin6_addr);
+	freeaddrinfo(result);
+
+	if((error = connect(sock, (struct sockaddr *)&a, sizeof(a))) == -1) {
+		perror("connect");
+		return EXIT_FAILURE;
+	}
+
+	return EXIT_SUCCESS;
+}

tools/install.sh

@@ -0,0 +1,64 @@
+#!/bin/sh
+#
+# This is an actually-safe install command which installs the new
+# file atomically in the new location, rather than overwriting
+# existing files.
+#
+
+usage() {
+printf "usage: %s [-D] [-l] [-m mode] src dest\n" "$0" 1>&2
+exit 1
+}
+
+mkdirp=
+symlink=
+mode=755
+
+while getopts Dlm: name ; do
+case "$name" in
+D) mkdirp=yes ;;
+l) symlink=yes ;;
+m) mode=$OPTARG ;;
+?) usage ;;
+esac
+done
+shift $(($OPTIND - 1))
+
+test "$#" -eq 2 || usage
+src=$1
+dst=$2
+tmp="$dst.tmp.$$"
+
+case "$dst" in
+*/) printf "%s: %s ends in /\n", "$0" "$dst" 1>&2 ; exit 1 ;;
+esac
+
+set -C
+set -e
+
+if test "$mkdirp" ; then
+umask 022
+case "$2" in
+*/*) mkdir -p "${dst%/*}" ;;
+esac
+fi
+
+trap 'rm -f "$tmp"' EXIT INT QUIT TERM HUP
+
+umask 077
+
+if test "$symlink" ; then
+ln -s "$1" "$tmp"
+else
+cat < "$1" > "$tmp"
+chmod "$mode" "$tmp"
+fi
+
+mv -f "$tmp" "$2"
+test -d "$2" && {
+rm -f "$2/$tmp"
+printf "%s: %s is a directory\n" "$0" "$dst" 1>&2
+exit 1
+}
+
+exit 0

tools/version.sh

@@ -0,0 +1,12 @@
+#!/bin/sh
+
+if test -d .git ; then
+if type git >/dev/null 2>&1 ; then
+git describe --tags --match 'v[0-9]*' 2>/dev/null \
+| sed -e 's/^v//' -e 's/-/-git-/'
+else
+sed 's/$/-git/' < VERSION
+fi
+else
+cat VERSION
+fi