release 4.14

conditions that need to be met are:
1) chaintype strict
2) proxy_dns on
3) not the first proxy in the list

if these conditions are met, the dns name can be passed to be
receiving proxy and be resolved there.

addressing https://github.com/rofl0r/proxychains-ng/issues/246#issuecomment-468222637

README

@@ -1,4 +1,4 @@
-ProxyChains-NG ver 4.13 README
+ProxyChains-NG ver 4.14 README
 =============================
 
   ProxyChains is a UNIX program, that hooks network-related libc functions
@@ -52,6 +52,14 @@ ProxyChains-NG ver 4.13 README
 
 Changelog:
 ----------
+Version 4.14
+- allow alternative proto://user:pass@ip:port syntax for proxylist
+- fix endless loop in round robin mode when all proxies are down (#147)
+- fix compilation on android (#265)
+- fix fd leak in forked processes (#273)
+- skip connection attempt to nullrouted ips
+- allow hostnames for proxylist under specific circumstances
+
 Version 4.13
 - fix robustness of DNS lookup thread and a segfault
 - fix socks5 user/pass auth on non-conforming servers

VERSION

@@ -1 +1 @@
-4.13
+4.14

configure

@@ -18,7 +18,7 @@ check_compile() {
 	printf "checking %s ... " "$1"
 	printf "$3" > "$tmpc"
 	local res=0
-	$CC $OUR_CPPFLAGS $CPPFLAGS $2 $CFLAGS -c "$tmpc" -o /dev/null >/dev/null 2>&1 \
+	$CC $OUR_CPPFLAGS $CPPFLAGS $2 $CFLAGS "$tmpc" -o /dev/null >/dev/null 2>&1 \
 	|| res=1
 	test x$res = x0 && \
 	{ printf "yes\n" ; test x"$2" = x || OUR_CPPFLAGS="$OUR_CPPFLAGS $2" ; } \
@@ -149,6 +149,12 @@ issolaris() {
 	$solaris_detected
 }
 
+check_compile 'whether we have GNU-style getservbyname_r()' "-DHAVE_GNU_GETSERVBYNAME_R" \
+'#define _GNU_SOURCE\n#include <netdb.h>\nint main() {\nstruct servent *se = 0;struct servent se_buf;char buf[1024];\ngetservbyname_r("foo", (void*) 0, &se_buf, buf, sizeof(buf), &se);\nreturn 0;}'
+
+check_compile 'whether we have pipe2() and O_CLOEXEC' "-DHAVE_PIPE2" \
+'#define _GNU_SOURCE\n#include <fcntl.h>\n#include <unistd.h>\nint main() {\nint pipefd[2];\npipe2(pipefd, O_CLOEXEC);\nreturn 0;}'
+
 check_define __APPLE__ && {
 	mac_detected=true
 	check_define __x86_64__ && mac_64=true

src/allocator_thread.c

@@ -116,9 +116,9 @@ static ip_type4 ip_from_internal_list(char* name, size_t len) {
 
 	internal_ips->list[internal_ips->counter] = new_mem;
 	internal_ips->list[internal_ips->counter]->hash = hash;
-	
+
 	new_mem = dumpstring((char*) name, len + 1);
-	
+
 	if(!new_mem) {
 		internal_ips->list[internal_ips->counter] = 0;
 		goto oom;
@@ -131,7 +131,7 @@ static ip_type4 ip_from_internal_list(char* name, size_t len) {
 
 	return res;
 	err_plus_unlock:
-	
+
 	PDEBUG("return err\n");
 	return ip_type_invalid.addr.v4;
 }
@@ -244,7 +244,7 @@ static void* threadfunc(void* x) {
 	(void) x;
 	int ret;
 	struct at_msghdr msg;
-	union { 
+	union {
 		char host[MSG_LEN_MAX];
 		ip_type4 ip;
 	} readbuf;
@@ -309,7 +309,18 @@ size_t at_get_host_for_ip(ip_type4 ip, char* readbuf) {
 
 
 static void initpipe(int* fds) {
-	if(pipe(fds) == -1) {
+	int retval;
+
+#ifdef HAVE_PIPE2
+	retval = pipe2(fds, O_CLOEXEC);
+#else
+	retval = pipe(fds);
+	if(retval == 0) {
+		fcntl(fds[0], F_SETFD, FD_CLOEXEC);
+		fcntl(fds[1], F_SETFD, FD_CLOEXEC);
+	}
+#endif
+	if(retval == -1) {
 		perror("pipe");
 		exit(1);
 	}

src/core.c

@@ -38,6 +38,7 @@
 #include "core.h"
 #include "common.h"
 #include "allocator_thread.h"
+#include "mutex.h"
 
 extern int tcp_read_time_out;
 extern int tcp_connect_time_out;
@@ -106,7 +107,7 @@ static void encode_base_64(char *src, char *dest, int max_len) {
 }
 
 void proxychains_write_log(char *str, ...) {
-	char buff[1024*20];
+	char buff[1024*4];
 	va_list arglist;
 	if(!proxychains_quiet_mode) {
 		va_start(arglist, str);
@@ -567,8 +568,8 @@ int connect_proxy_chain(int sock, ip_type target_ip,
 	unsigned int offset = 0;
 	unsigned int alive_count = 0;
 	unsigned int curr_len = 0;
-	unsigned int curr_pos = 0;
 	unsigned int looped = 0; // went back to start of list in RR mode
+	unsigned int rr_loop_max = 14;
 
 	p3 = &p4;
 
@@ -605,23 +606,27 @@ int connect_proxy_chain(int sock, ip_type target_ip,
 
 		case ROUND_ROBIN_TYPE:
 			alive_count = calc_alive(pd, proxy_count);
-			curr_pos = offset = proxychains_proxy_offset;
+			offset = proxychains_proxy_offset;
 			if(alive_count < max_chain)
 				goto error_more;
-                        PDEBUG("1:rr_offset = %d, curr_pos = %d\n", offset, curr_pos);
+			PDEBUG("1:rr_offset = %d\n", offset);
 			/* Check from current RR offset til end */
 			for (;rc != SUCCESS;) {
 				if (!(p1 = select_proxy(FIFOLY, pd, proxy_count, &offset))) {
 					/* We've reached the end of the list, go to the start */
  					offset = 0;
 					looped++;
-					continue;
-				} else if (looped && rc > 0 && offset >= curr_pos) {
- 					PDEBUG("GOTO MORE PROXIES 0\n");
-					/* We've gone back to the start and now past our starting position */
-					proxychains_proxy_offset = 0;
- 					goto error_more;
- 				}
+					if (looped > rr_loop_max) {
+						proxychains_proxy_offset = 0;
+						goto error_more;
+					} else {
+						PDEBUG("rr_type all proxies down, release all\n");
+						release_all(pd, proxy_count);
+						/* Each loop we wait 10ms more */
+						usleep(10000 * looped);
+						continue;
+					}
+				}
  				PDEBUG("2:rr_offset = %d\n", offset);
  				rc=start_chain(&ns, p1, RRT);
 			}
@@ -724,10 +729,13 @@ int connect_proxy_chain(int sock, ip_type target_ip,
 	return -1;
 }
 
+static pthread_mutex_t servbyname_lock;
 void core_initialize(void) {
+	MUTEX_INIT(&servbyname_lock);
 }
 
 void core_unload(void) {
+	MUTEX_DESTROY(&servbyname_lock);
 }
 
 static void gethostbyname_data_setstring(struct gethostbyname_data* data, char* name) {
@@ -790,18 +798,17 @@ void proxy_freeaddrinfo(struct addrinfo *res) {
 	free(res);
 }
 
-#if defined(IS_MAC) || defined(IS_OPENBSD) || defined(IS_SOLARIS)
-#if defined(IS_OPENBSD) || defined(IS_SOLARIS) /* OpenBSD and Solaris has its own incompatible getservbyname_r */
-#define getservbyname_r mygetservbyname_r
-#endif
-/* getservbyname on mac is using thread local storage, so we dont need mutex 
-   TODO: check if the same applies to OpenBSD */
-static int getservbyname_r(const char* name, const char* proto, struct servent* result_buf, 
+static int mygetservbyname_r(const char* name, const char* proto, struct servent* result_buf,
 			   char* buf, size_t buflen, struct servent** result) {
 	PFUNC();
+#ifdef HAVE_GNU_GETSERVBYNAME_R
+	PDEBUG("using host getservbyname_r\n");
+	return getservbyname_r(name, proto, result_buf, buf, buflen, result);
+#endif
 	struct servent *res;
 	int ret;
 	(void) buf; (void) buflen;
+	MUTEX_LOCK(&servbyname_lock);
 	res = getservbyname(name, proto);
 	if(res) {
 		*result_buf = *res;
@@ -811,9 +818,9 @@ static int getservbyname_r(const char* name, const char* proto, struct servent*
 		*result = NULL;
 		ret = ENOENT;
 	}
+	MUTEX_UNLOCK(&servbyname_lock);
 	return ret;
 }
-#endif
 
 int proxy_getaddrinfo(const char *node, const char *service, const struct addrinfo *hints, struct addrinfo **res) {
 	struct gethostbyname_data ghdata;
@@ -844,7 +851,7 @@ int proxy_getaddrinfo(const char *node, const char *service, const struct addrin
 		else
 			goto err2;
 	}
-	if(service) getservbyname_r(service, NULL, &se_buf, buf, sizeof(buf), &se);
+	if(service) mygetservbyname_r(service, NULL, &se_buf, buf, sizeof(buf), &se);
 
 	port = se ? se->s_port : htons(atoi(service ? service : "0"));
 	((struct sockaddr_in *) &space->sockaddr_space)->sin_port = port;

src/libproxychains.c

@@ -78,7 +78,7 @@ pthread_once_t init_once = PTHREAD_ONCE_INIT;
 
 static int init_l = 0;
 
-static inline void get_chain_data(proxy_data * pd, unsigned int *proxy_count, chain_type * ct);
+static void get_chain_data(proxy_data * pd, unsigned int *proxy_count, chain_type * ct);
 
 static void* load_sym(char* symname, void* proxyfunc) {
 
@@ -160,6 +160,107 @@ static void gcc_init(void) {
 }
 #endif
 
+
+typedef enum {
+	RS_PT_NONE = 0,
+	RS_PT_SOCKS4,
+	RS_PT_SOCKS5,
+	RS_PT_HTTP
+} rs_proxyType;
+
+/*
+  proxy_from_string() taken from rocksock network I/O library (C) rofl0r
+  valid inputs:
+	socks5://user:password@proxy.domain.com:port
+	socks5://proxy.domain.com:port
+	socks4://proxy.domain.com:port
+	http://user:password@proxy.domain.com:port
+	http://proxy.domain.com:port
+
+	supplying port number is obligatory.
+	user:pass@ part is optional for http and socks5.
+	however, user:pass authentication is currently not implemented for http proxies.
+  return 1 on success, 0 on error.
+*/
+static int proxy_from_string(const char *proxystring,
+	char *type_buf,
+	char* host_buf,
+	int *port_n,
+	char *user_buf,
+	char* pass_buf)
+{
+	const char* p;
+	rs_proxyType proxytype;
+
+	size_t next_token = 6, ul = 0, pl = 0, hl;
+	if(!proxystring[0] || !proxystring[1] || !proxystring[2] || !proxystring[3] || !proxystring[4] || !proxystring[5]) goto inv_string;
+	if(*proxystring == 's') {
+		switch(proxystring[5]) {
+			case '5': proxytype = RS_PT_SOCKS5; break;
+			case '4': proxytype = RS_PT_SOCKS4; break;
+			default: goto inv_string;
+		}
+	} else if(*proxystring == 'h') {
+		proxytype = RS_PT_HTTP;
+		next_token = 4;
+	} else goto inv_string;
+	if(
+	   proxystring[next_token++] != ':' ||
+	   proxystring[next_token++] != '/' ||
+	   proxystring[next_token++] != '/') goto inv_string;
+	const char *at = strchr(proxystring+next_token, '@');
+	if(at) {
+		if(proxytype == RS_PT_SOCKS4)
+			return 0;
+		p = strchr(proxystring+next_token, ':');
+		if(!p || p >= at) goto inv_string;
+		const char *u = proxystring+next_token;
+		ul = p-u;
+		p++;
+		pl = at-p;
+		if(proxytype == RS_PT_SOCKS5 && (ul > 255 || pl > 255))
+			return 0;
+		memcpy(user_buf, u, ul);
+		user_buf[ul]=0;
+		memcpy(pass_buf, p, pl);
+		pass_buf[pl]=0;
+		next_token += 2+ul+pl;
+	} else {
+		user_buf[0]=0;
+		pass_buf[0]=0;
+	}
+	const char* h = proxystring+next_token;
+	p = strchr(h, ':');
+	if(!p) goto inv_string;
+	hl = p-h;
+	if(hl > 255)
+		return 0;
+	memcpy(host_buf, h, hl);
+	host_buf[hl]=0;
+	*port_n = atoi(p+1);
+	switch(proxytype) {
+		case RS_PT_SOCKS4:
+			strcpy(type_buf, "socks4");
+			break;
+		case RS_PT_SOCKS5:
+			strcpy(type_buf, "socks5");
+			break;
+		case RS_PT_HTTP:
+			strcpy(type_buf, "http");
+			break;
+		default:
+			return 0;
+	}
+	return 1;
+inv_string:
+	return 0;
+}
+
+static const char* bool_str(int bool_val) {
+	if(bool_val) return "true";
+	return "false";
+}
+
 /* get configuration from config file */
 static void get_chain_data(proxy_data * pd, unsigned int *proxy_count, chain_type * ct) {
 	int count = 0, port_n = 0, list = 0;
@@ -202,9 +303,11 @@ static void get_chain_data(proxy_data * pd, unsigned int *proxy_count, chain_typ
 
 				int ret = sscanf(buff, "%s %s %d %s %s", type, host, &port_n, pd[count].user, pd[count].pass);
 				if(ret < 3 || ret == EOF) {
-					inv:
-					fprintf(stderr, "error: invalid item in proxylist section: %s", buff);
-					exit(1);
+					if(!proxy_from_string(buff, type, host, &port_n, pd[count].user, pd[count].pass)) {
+						inv:
+						fprintf(stderr, "error: invalid item in proxylist section: %s", buff);
+						exit(1);
+					}
 				}
 
 				memset(&pd[count].ip, 0, sizeof(pd[count].ip));
@@ -212,8 +315,20 @@ static void get_chain_data(proxy_data * pd, unsigned int *proxy_count, chain_typ
 				pd[count].port = htons((unsigned short) port_n);
 				ip_type* host_ip = &pd[count].ip;
 				if(1 != inet_pton(host_ip->is_v6 ? AF_INET6 : AF_INET, host, host_ip->addr.v6)) {
-					fprintf(stderr, "proxy %s has invalid value or is not numeric\n", host);
-					exit(1);
+					if(*ct == STRICT_TYPE && proxychains_resolver && count > 0) {
+						/* we can allow dns hostnames for all but the first proxy in the list if chaintype is strict, as remote lookup can be done */
+						ip_type4 internal_ip = at_get_ip_for_host(host, strlen(host));
+						pd[count].ip.is_v6 = 0;
+						host_ip->addr.v4 = internal_ip;
+						if(internal_ip.as_int == ip_type_invalid.addr.v4.as_int)
+							goto inv_host;
+					} else {
+inv_host:
+						fprintf(stderr, "proxy %s has invalid value or is not numeric\n", host);
+						fprintf(stderr, "non-numeric ips are only allowed under the following circumstances:\n");
+						fprintf(stderr, "chaintype == strict (%s), proxy is not first in list (%s), proxy_dns active (%s)\n\n", bool_str(*ct == STRICT_TYPE), bool_str(count > 0), bool_str(proxychains_resolver));
+						exit(1);
+					}
 				}
 
 				if(!strcmp(type, "http")) {
@@ -317,6 +432,7 @@ static void get_chain_data(proxy_data * pd, unsigned int *proxy_count, chain_typ
 	}
 	*proxy_count = count;
 	proxychains_got_chain_data = 1;
+	PDEBUG("proxy_dns: %s\n", proxychains_resolver ? "ON" : "OFF");
 }
 
 /*******  HOOK FUNCTIONS  *******/
@@ -372,6 +488,10 @@ int connect(int sock, const struct sockaddr *addr, unsigned int len) {
 		v6 = dest_ip.is_v6 = 0;
 		p_addr_in = &v4inv6;
 	}
+	if(!v6 && !memcmp(p_addr_in, "\0\0\0\0", 4)) {
+		errno = ECONNREFUSED;
+		return -1;
+	}
 
 //      PDEBUG("localnet: %s; ", inet_ntop(AF_INET,&in_addr_localnet, str, sizeof(str)));
 //      PDEBUG("netmask: %s; " , inet_ntop(AF_INET, &in_addr_netmask, str, sizeof(str)));

tests/test_getaddrinfo.c

@@ -3,30 +3,30 @@
 #include <netdb.h>
 #include <netinet/in.h>
 #include <sys/socket.h>
- 
+
 #ifndef   NI_MAXHOST
 #define   NI_MAXHOST 1025
 #endif
- 
-int main(void) {
+
+static int doit(const char* host, const char* service) {
 	struct addrinfo *result;
 	struct addrinfo *res;
 	int error;
-	
+
 	/* resolve the domain name into a list of addresses */
-	error = getaddrinfo("www.example.com", NULL, NULL, &result);
+	error = getaddrinfo(host, service, NULL, &result);
 	if (error != 0)
-	{   
+	{
 		fprintf(stderr, "error in getaddrinfo: %s\n", gai_strerror(error));
 		return EXIT_FAILURE;
-	}   
-	
+	}
+
 	/* loop over all returned results and do inverse lookup */
 	for (res = result; res != NULL; res = res->ai_next)
-	{   
+	{
 		char hostname[NI_MAXHOST] = "";
-	
-		error = getnameinfo(res->ai_addr, res->ai_addrlen, hostname, NI_MAXHOST, NULL, 0, 0); 
+
+		error = getnameinfo(res->ai_addr, res->ai_addrlen, hostname, NI_MAXHOST, NULL, 0, 0);
 		if (error != 0)
 		{
 		fprintf(stderr, "error in getnameinfo: %s\n", gai_strerror(error));
@@ -34,8 +34,15 @@ int main(void) {
 		}
 		if (*hostname != '\0')
 		printf("hostname: %s\n", hostname);
-	}   
-	
+	}
+
 	freeaddrinfo(result);
 	return EXIT_SUCCESS;
 }
+
+int main(void) {
+	int ret;
+	ret = doit("www.example.com", NULL);
+	ret = doit("www.example.com", "80");
+	return ret;
+}