[PATCH 2/3] configure source IP of outgoing connections
Roman Hoog Antink <[email protected]> Fri, 9 May 2014 10:24:54 +0200
| Newsgroups | gmane.comp.security.zebedee.general |
|---|---|
| Message-ID | <[email protected]> |
This is a multi-part message in MIME format. --------------1.9.1 Content-Type: text/plain; charset=UTF-8; format=fixed Content-Transfer-Encoding: quoted-printable From: Tabita Arn <[email protected]> Signed-off-by: Roman Hoog Antink <[email protected]> --- zebedee.c | 40 ++++++++++++++++++++++++++++++++++------ zebedee.pod | 4 ++++ 2 files changed, 38 insertions(+), 6 deletions(-) --------------1.9.1 Content-Type: text/x-patch; name="0002-configure-source-IP-of-outgoing-connections.patch" Content-Disposition: attachment; filename="0002-configure-source-IP-of-outgoing-connections.patch" Content-Transfer-Encoding: quoted-printable diff --git a/zebedee.c b/zebedee.c index bbd2081..019a4e4 100644 --- a/zebedee.c +++ b/zebedee.c @@ -544,6 +544,7 @@ int UdpMode =3D 0; /* Run in UDP mode = */ int TcpMode =3D 1; /* Run in TCP mode */ unsigned short TcpTimeout =3D DFLT_TCP_TIMEOUT; /* TCP inactivity time= out */ unsigned short UdpTimeout =3D DFLT_UDP_TIMEOUT; /* UDP inactivity time= out */ +char *SourceIp =3D NULL; /* source IP address */ char *ListenIp =3D NULL; /* IP address on which to listen */ int ListenMode =3D 0; /* True if client waits for server con= nection */ char *ClientHost =3D NULL; /* Server initiates connection to clie= nt */ @@ -2110,6 +2111,22 @@ makeConnection(const char *host, const unsigned sh= ort port, return -1; } =20 + if (Transparent && SourceIp !=3D NULL) + { + message(0, 0, "can't use transparent and sourceip"); + exit(EXIT_FAILURE); + } + + if (fromAddrP =3D=3D NULL && SourceIp !=3D NULL) + { + memset(&myFromAddr, 0, sizeof(myFromAddr)); + if (!getHostAddress(SourceIp, &myFromAddr, NULL, NULL)) + { + message(0, 0, "can't resolve source address '%s'", SourceIp)= ; + exit(EXIT_FAILURE); + } + } + /* ** If a source address was specified, try to set it. This is not ** fatal if it fails -- not all platforms support it. @@ -2124,11 +2141,13 @@ makeConnection(const char *host, const unsigned s= hort port, */ #error "Time to implement transparent proxy using setsockopt(fd, SOL_TCP= , TCP_TPROXY_SRCADDR, ...) now!" #else - if (fromAddrP && ((fromAddrP->sa.sa_family =3D=3D AF_INET && fromAdd= rP->in.sin_addr.s_addr) + if ((fromAddrP && fromAddrP->sa.sa_family =3D=3D AF_INET && fromAddr= P->in.sin_addr.s_addr) + || (myFromAddr.sa.sa_family =3D=3D AF_INET && myFromAddr.in.sin_a= ddr.s_addr) #if defined(USE_IPv6) - || (fromAddrP->sa.sa_family =3D=3D AF_INET6 && memcmp(&fromA= ddrP->in6.sin6_addr, &in6addr_any, sizeof(struct in6_addr))) + || (fromAddrP && fromAddrP->sa.sa_family =3D=3D AF_INET6 && memcm= p(&fromAddrP->in6.sin6_addr, &in6addr_any, sizeof(struct in6_addr))) + || (myFromAddr.sa.sa_family =3D=3D AF_INET6 && memcmp(&myFromAddr= .in6.sin6_addr, &in6addr_any, sizeof(struct in6_addr))) #endif - )) + ) { #ifdef USE_UDP_SPOOFING closesocket(sfd); @@ -2139,8 +2158,11 @@ makeConnection(const char *host, const unsigned sh= ort port, return -1; } #else - memset(&myFromAddr, 0, sizeof(addr)); - memcpy(&myFromAddr, fromAddrP, sizeof(addr)); + if (fromAddrP !=3D NULL) + { + memset(&myFromAddr, 0, sizeof(addr)); + memcpy(&myFromAddr, fromAddrP, sizeof(addr)); + } if (bind(sfd, &myFromAddr.sa, addr.sa.sa_family =3D=3D AF_INET ?= sizeof(addr.in) : sizeof(addr)) < 0) { message(1, errno, "WARNING: failed to set connection source = address -- ignored"); @@ -8192,6 +8214,7 @@ parseConfigLine(const char *lineBuf, int level) setBoolean(value, &yesNo); setString(yesNo ? "127.0.0.1" : "0.0.0.0", &ListenIp); } + else if (!strcasecmp(key, "sourceip")) setString(value, &SourceIp); else if (!strcasecmp(key, "listenip")) setString(value, &ListenIp); else if (!strcasecmp(key, "listenmode")) setBoolean(value, &ListenMo= de); else if (!strcasecmp(key, "clienthost")) setString(value, &ClientHos= t); @@ -8304,6 +8327,7 @@ usage(void) #if defined(USE_IPv6) " -4 Use IPv4 protocol only\n" #endif + " -a address Source IP for outgoing connections\n" " -b address Bind only this address when listening for c= onnections\n" " -C num Set the number of attempts to connect back = to client (default 1)\n" " -c host Server initiates connection to client host\= n" @@ -8826,7 +8850,7 @@ main(int argc, char **argv) =20 /* Parse the options! */ =20 - while ((ch =3D getopt(argc, argv, "4b:C:c:Dde:f:F:hHik:K:LlmN:n:o:pP= r:sS:tT:uUv:x:z:")) !=3D -1) + while ((ch =3D getopt(argc, argv, "4a:b:C:c:Dde:f:F:hHik:K:LlmN:n:o:= pPr:sS:tT:uUv:x:z:")) !=3D -1) { switch (ch) { @@ -8841,6 +8865,10 @@ main(int argc, char **argv) ClientHost =3D optarg; break; =20 + case 'a': + SourceIp =3D optarg; + break; + case 'b': ListenIp =3D optarg; break; diff --git a/zebedee.pod b/zebedee.pod index ff0a581..f5e182f 100644 --- a/zebedee.pod +++ b/zebedee.pod @@ -402,6 +402,10 @@ B<L<server|/item_server>> keyword: Restrict network sockets to IPv4 protocol only. This is useful when runn= ing B<Zebedee> compiled with IPv6 support on machines without full IPv6 supp= ort. =20 +=3Ditem B<sourceip> (command-line B<-a>) + +Use this IP as source IP for outgoing connections. + =3Ditem B<server> (command-line B<-s>) =20 This is a boolean indicating whether the program should run as a client = or a --------------1.9.1 Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline ------------------------------------------------------------------------------ Is your legacy SCM system holding you back? Join Perforce May 7 to find out: • 3 signs your SCM is hindering your productivity • Requirements for releasing software faster • Expert tips and advice for migrating your SCM now http://p.sf.net/sfu/perforce --------------1.9.1 Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Zebedee-talk mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/zebedee-talk --------------1.9.1--