Merge 4bf9eecddf into eca362af81

CMakeLists.txt

@@ -55,6 +55,7 @@ option(3PROXY_USE_SPLICE "Build Linux splice() support, slower than read/write f
 option(3PROXY_USE_POLL "Use poll() instead of select() (Unix only)" ON)
 option(3PROXY_USE_WSAPOLL "Use WSAPoll instead of select() (Windows only)" ON)
 option(3PROXY_USE_NETFILTER "Enable Linux netfilter support (Linux only)" ON)
+option(3PROXY_USE_LOCAL_PORT_RANGE "Enable per-connection local port ranges (Linux 6.3+ only)" ON)
 option(3PROXY_USE_UNIX_SOCKETS "Enable Unix domain socket support (Unix only)" ON)
 
 if(NOT WIN32 AND NOT APPLE)
@@ -185,6 +186,10 @@ elseif(CMAKE_SYSTEM_NAME STREQUAL "Linux")
         add_compile_definitions(WITH_NETFILTER)
     endif()
 
+    if(3PROXY_USE_LOCAL_PORT_RANGE)
+        add_compile_definitions(WITH_LOCAL_PORT_RANGE)
+    endif()
+
     if(3PROXY_USE_UNIX_SOCKETS)
         add_compile_definitions(WITH_UN)
     endif()

Makefile.Linux

@@ -25,6 +25,10 @@ LDFLAGS += -fno-strict-aliasing -pthread
 # makefile, including the += above and the STATIC/LIBSTATIC handling below.
 CFLAGS += $(EXTRA_CFLAGS)
 LDFLAGS += $(EXTRA_LDFLAGS)
+LOCAL_PORT_RANGE ?= true
+ifeq ($(LOCAL_PORT_RANGE),true)
+    CFLAGS += -DWITH_LOCAL_PORT_RANGE
+endif
 DLFLAGS ?= -shared
 DLSUFFICS = .ld.so
 # -lpthreads may be reuqired on some platforms instead of -pthreads

man/3proxy.cfg.5

@@ -176,9 +176,6 @@ listen on given local HOST:port for incoming connections instead of making remot
 .B -r\fIHOST\fB:\fIport\fR
 connect to given remote HOST:port instead of listening local connection on -p or default port. Can be used with another 3proxy service running -R option for connect back functionality. Most commonly used with proxy or socks. HOST can be given as IP or hostname, useful in case of dynamic DNS.
 .br
-.B -Tr\fIFIRST\fB-\fILAST\fR, -Ur\fIFIRST\fB-\fILAST\fR, -UAr\fIFIRST\fB-\fILAST\fR
-(Linux) use the inclusive local ephemeral port range FIRST-LAST for outgoing IPv4 TCP (-Tr) or UDP (-Ur) sockets of this service. -UAr applies only to the UDP relay socket returned to a SOCKS5 UDP ASSOCIATE client. Use it when this port range must be forwarded by NAT and allowed by a firewall. Requires kernel support for IP_LOCAL_PORT_RANGE (Linux 6.3 or newer). The option is applied before bind(2); no system-wide sysctl is changed. For example, \fBsocks -p1080 -Ur20000-30000 -UAr30000-31000\fR.
-.br
 .B -oc\fIOPTIONS\fB, -os\fIOPTIONS\fB, -ol\fIOPTIONS\fB, -or\fIOPTIONS\fB, -oR\fIOPTIONS\fR
 options for proxy-to-client (\fB-oc\fR), proxy-to-server (\fB-os\fR), proxy listening (\fB-ol\fR), connect back client (\fB-or\fR), connect back listening (\fB-oR\fR) sockets.
 Options like TCP_CORK, TCP_NODELAY, TCP_DEFER_ACCEPT, TCP_QUICKACK, TCP_TIMESTAMPS, TCP_FASTOPEN, SO_REUSEADDR, SO_REUSEPORT, SO_EXCLUSIVEADDRUSE, SO_PORT_SCALABILITY, SO_REUSE_UNICASTPORT, SO_KEEPALIVE, SO_DONTROUTE may be supported depending on OS.
@@ -820,7 +817,7 @@ with probability of 0.7) for outgoing web connections. Chains are only applied t
 .br
  type is one of:
 .br
- \fBextip\fR does not actually redirect the request; it sets the external address for this request to \fI<ip>\fR. It can be chained with another parent type. It's useful to set the external IP based on ACL or make it random.
+\fBextip\fR does not actually redirect the request; it sets the external address for this request to \fI<ip>\fR. It can be chained with another parent type. It's useful to set the external IP based on ACL or make it random. Its \fI<port>\fR argument is optional and defaults to 0. When built with \fBWITH_LOCAL_PORT_RANGE\fR on Linux 6.3 or newer, \fI<port>\fR may be an inclusive IPv4 local port range \fIFIRST-LAST\fR. The range is applied to outgoing sockets for requests matching this parent; DNS resolver traffic is not affected. For example, \fBparent 1000 extip 192.0.2.10 20000-30000\fR.
 .br
  \fBtcp\fR simply redirect connection. TCP is always last in chain. This type of proxy is a simple TCP redirection, it does not support parent authentication.
 .br

src/acl.c

@@ -150,7 +150,7 @@ int checkACL(struct clientparam * param){
 				if(param->redirected && acentry->chains && SAISNULL(&acentry->chains->addr) && !*SAPORT(&acentry->chains->addr)) {
 					continue;
 				}
-				if(param->remsock != INVALID_SOCKET && (param->operation != UDPASSOC || param->ctrlsocksrv != INVALID_SOCKET)) {
+				if((param->operation == UDPASSOC)? (param->ctrlsocksrv != INVALID_SOCKET) : (param->remsock != INVALID_SOCKET)) {
 					return 0;
 				}
 				for(; i < conf.parentretries; i++){

src/common.c

@@ -10,7 +10,7 @@
 
 #include "proxy.h"
 
-#ifdef __linux__
+#ifdef WITH_LOCAL_PORT_RANGE
 #ifndef IP_LOCAL_PORT_RANGE
 #define IP_LOCAL_PORT_RANGE 51
 #endif
@@ -649,6 +649,7 @@ int doconnect(struct clientparam * param){
 
  if (param->operation == ADMIN || (( param->operation == DNSRESOLVE || param->operation == BIND || param->operation == UDPASSOC) && !param->redirected))
 	return 0;
+ if (param->operation == UDPASSOC && param->ctrlsocksrv != INVALID_SOCKET) return 0;
  if (param->remsock != INVALID_SOCKET){
 	if(param->operation == UDPASSOC) return 0;
 	size = sizeof(param->sinsr);
@@ -684,7 +685,9 @@ int doconnect(struct clientparam * param){
 	}
 	*SAPORT(&param->sinsl) = 0;
 	setopts(param->remsock, param->srv->srvsockopts);
-	if(set_local_port_range(param->srv, param->remsock, (struct sockaddr *)&param->sinsl, LOCAL_PORT_RANGE_TCP)) return 12;
+#ifdef WITH_LOCAL_PORT_RANGE
+	if(set_local_port_range(param, param->remsock, (struct sockaddr *)&param->sinsl)) return 12;
+#endif
 
 	param->srv->so._setsockopt(param->sostate, param->remsock, SOL_SOCKET, SO_LINGER, (char *)&lg, sizeof(lg));
 #if defined SO_BINDTODEVICE
@@ -730,23 +733,15 @@ int doconnect(struct clientparam * param){
  return 0;
 }
 
-int set_local_port_range(struct srvparam *srv, SOCKET sock, const struct sockaddr *sa, int range_type){
-#ifdef __linux__
-	uint32_t range = range_type == LOCAL_PORT_RANGE_TCP ? srv->tcp_local_port_range :
-		range_type == LOCAL_PORT_RANGE_UDP ? srv->udp_local_port_range : srv->udp_associate_port_range;
-
-	if(range && sa->sa_family == AF_INET &&
+#ifdef WITH_LOCAL_PORT_RANGE
+int set_local_port_range(struct clientparam *param, SOCKET sock, const struct sockaddr *sa){
+	if(param->local_port_range && sa->sa_family == AF_INET &&
 	   ((const struct sockaddr_in *)sa)->sin_port == 0 &&
-	   srv->so._setsockopt(srv->so.state, sock, IPPROTO_IP, IP_LOCAL_PORT_RANGE,
-		(char *)&range, sizeof(range))) return -1;
-#else
-	(void)srv;
-	(void)sock;
-	(void)sa;
-	(void)range_type;
-#endif
+	   param->srv->so._setsockopt(param->srv->so.state, sock, IPPROTO_IP, IP_LOCAL_PORT_RANGE,
+		(char *)&param->local_port_range, sizeof(param->local_port_range))) return -1;
 	return 0;
 }
+#endif
 
 int scanaddr(const unsigned char *s, uint32_t * ip, uint32_t * mask) {
 	unsigned d1, d2, d3, d4, m;

src/conf.c

@@ -814,6 +814,11 @@ static int h_parent(int argc, unsigned char **argv){
 		free(chains);
 		return(4);
 	}
+	if(argc < 5 && chains->type != R_EXTIP) {
+		fprintf(stderr, "Chaining error: port is required for parent type %s\n", argv[2]);
+		free(chains);
+		return(3);
+	}
 #ifdef WITH_UN
 	if(!strncmp((char *)argv[3], "unix:", 5)){
 	    make_un(argv[3] + 5, (struct sockaddr_un*)&chains->addr);
@@ -838,7 +843,34 @@ static int h_parent(int argc, unsigned char **argv){
 		*cidr = '/';
 		chains->cidr = atoi(cidr + 1);
 	}
-	*SAPORT(&chains->addr) = htons((uint16_t)atoi((char *)argv[4]));
+	if(argc > 4) {
+		char *end;
+		unsigned long port;
+
+		errno = 0;
+		port = strtoul((char *)argv[4], &end, 10);
+#ifdef WITH_LOCAL_PORT_RANGE
+		if(chains->type == R_EXTIP && *end == '-') {
+			unsigned long last;
+
+			errno = 0;
+			last = strtoul(end + 1, &end, 10);
+			if(errno || *end || !port || !last || port > last || last > 65535) {
+				free(chains->exthost);
+				free(chains);
+				return 3;
+			}
+			chains->local_port_range = ((uint32_t)last << 16) | (uint32_t)port;
+			port = 0;
+		}
+#endif
+		if(errno || *end || port > 65535) {
+			free(chains->exthost);
+			free(chains);
+			return 3;
+		}
+		*SAPORT(&chains->addr) = htons((uint16_t)port);
+	}
 	if(argc > 5) chains->extuser = (unsigned char *)strdup((char *)argv[5]);
 	if(argc > 6) chains->extpass = (unsigned char *)strdup((char *)argv[6]);
 	if(!acl->chains) {
@@ -1696,7 +1728,7 @@ struct commands commandhandlers[]={
 	{NULL, "system", h_system, 2, 2},
 	{NULL, "pidfile", h_pidfile, 2, 2},
 	{NULL, "monitor", h_monitor, 2, 2},
-	{NULL, "parent", h_parent, 5, 0},
+	{NULL, "parent", h_parent, 4, 0},
 	{NULL, "allow", h_ace, 1, 0},
 	{NULL, "deny", h_ace, 1, 0},
 	{NULL, "redirect", h_ace, 3, 0},

src/dnspr.c

@@ -149,10 +149,6 @@ void * dnsprchild(struct clientparam* param) {
 	}
 	memset(&param->sinsl, 0, sizeof(param->sinsl));
 	*SAFAMILY(&param->sinsl) = *SAFAMILY(&nservers[0].addr);
-	if(set_local_port_range(param->srv, param->remsock, (struct sockaddr *)&param->sinsl,
-		nservers[0].usetcp ? LOCAL_PORT_RANGE_TCP : LOCAL_PORT_RANGE_UDP)) {
-		RETURN(819);
-	}
 	if(param->srv->so._bind(param->sostate, param->remsock,(struct sockaddr *)&param->sinsl,SASIZE(&param->sinsl))) {
 		RETURN(819);
 	}

src/ftppr.c

@@ -121,7 +121,9 @@ void * ftpprchild(struct clientparam* param) {
 		}
 		if ((clidatasock=socket(SASOCK(&param->sincl), SOCK_STREAM, IPPROTO_TCP)) == INVALID_SOCKET) {RETURN(821);}
 		*SAPORT(&param->sincl) = 0;
-		if(set_local_port_range(param->srv, clidatasock, (struct sockaddr *)&param->sincl, LOCAL_PORT_RANGE_TCP)){RETURN(822);}
+#ifdef WITH_LOCAL_PORT_RANGE
+		if(set_local_port_range(param, clidatasock, (struct sockaddr *)&param->sincl)){RETURN(822);}
+#endif
 		if(param->srv->so._bind(param->sostate, clidatasock, (struct sockaddr *)&param->sincl, SASIZE(&param->sincl))){RETURN(822);}
 		if (pasv) {
 			if(param->srv->so._listen(param->sostate, clidatasock, 1)) {RETURN(823);}

src/proxy.h

@@ -347,10 +347,9 @@ unsigned char * dologname (unsigned char *buf, unsigned char *name, const unsign
 int readconfig(FILE * fp);
 void initcommands(void);
 int connectwithpoll(struct clientparam *param, SOCKET sock, struct sockaddr *sa, SASIZETYPE size, int to);
-#define LOCAL_PORT_RANGE_TCP 1
-#define LOCAL_PORT_RANGE_UDP 2
-#define LOCAL_PORT_RANGE_UDP_ASSOCIATE 3
-int set_local_port_range(struct srvparam *srv, SOCKET sock, const struct sockaddr *sa, int range_type);
+#ifdef WITH_LOCAL_PORT_RANGE
+int set_local_port_range(struct clientparam *param, SOCKET sock, const struct sockaddr *sa);
+#endif
 
 
 uint32_t myrand(void);

src/proxymain.c

@@ -342,7 +342,6 @@ int MODULEMAINFUNC (int argc, char** argv){
 	"\n"
 	" -iIP ip address or internal interface (clients are expected to connect)\n"
 	" -eIP ip address or external interface (outgoing connection will have this)\n"
-	" -TrFIRST-LAST, -UrFIRST-LAST, -UArFIRST-LAST Linux: local TCP, UDP or UDP ASSOCIATE ranges\n"
 	" -rHOST:PORT Use IP:port for connect back proxy instead of listen port\n"
 	" -RHOST:PORT Use PORT to listen connect back proxy connection to pass data to\n"
 	" -4 Use IPv4 for outgoing connections\n"
@@ -566,35 +565,6 @@ int MODULEMAINFUNC (int argc, char** argv){
 			srv.needuser = 0;
 			if(*(argv[i] + 2)) srv.needuser = atoi(argv[i] + 2);
 			break;
-		 case 'U':
-#ifdef __linux__
-			{
-				char *end;
-				const char *range_arg;
-				unsigned long first, last;
-				uint32_t *range;
-
-				if(argv[i][2] == 'r') {
-					range_arg = argv[i] + 3;
-					range = &srv.udp_local_port_range;
-				}
-				else if(argv[i][2] == 'A' && argv[i][3] == 'r') {
-					range_arg = argv[i] + 4;
-					range = &srv.udp_associate_port_range;
-				}
-				else { error = 1; break; }
-				errno = 0;
-				first = strtoul(range_arg, &end, 10);
-				if(errno || end == range_arg || *end != '-') { error = 1; break; }
-				errno = 0;
-				last = strtoul(end + 1, &end, 10);
-				if(errno || *end || !first || !last || first > last || last > 65535) { error = 1; break; }
-				*range = ((uint32_t)last << 16) | (uint32_t)first;
-			}
-#else
-			error = 1;
-#endif
-			break;
 		 case 'x':
 			srv.nostarttls = 1;
 			break;
@@ -617,27 +587,7 @@ int MODULEMAINFUNC (int argc, char** argv){
 			}
 			break;
 		 case 'T':
-			if(!argv[i][2]) {
-				srv.transparent = 1;
-				break;
-			}
-#ifdef __linux__
-			{
-				char *end;
-				unsigned long first, last;
-
-				if(argv[i][2] != 'r') { error = 1; break; }
-				errno = 0;
-				first = strtoul(argv[i] + 3, &end, 10);
-				if(errno || end == argv[i] + 3 || *end != '-') { error = 1; break; }
-				errno = 0;
-				last = strtoul(end + 1, &end, 10);
-				if(errno || *end || !first || !last || first > last || last > 65535) { error = 1; break; }
-				srv.tcp_local_port_range = ((uint32_t)last << 16) | (uint32_t)first;
-			}
-#else
-			error = 1;
-#endif
+			srv.transparent = 1;
 			break;
 		 case 'S':
 			srv.stacksize = atoi(argv[i]+2);

src/redirect.c

@@ -295,6 +295,9 @@ int handleredirect(struct clientparam * param, struct ace * acentry){
 		if(!connected){
 			if(cur->type == R_EXTIP){
 				param->sinsl = cur->addr;
+#ifdef WITH_LOCAL_PORT_RANGE
+				param->local_port_range = cur->local_port_range;
+#endif
 				if(SAISNULL(&param->sinsl) && (*SAFAMILY(&param->sincr) == AF_INET || *SAFAMILY(&param->sincr) == AF_INET6))param->sinsl = param->sincr;
 #ifndef NOIPV6
 				else if(cur->cidr && *SAFAMILY(&param->sinsl) == AF_INET6){

src/resolve.c

@@ -44,10 +44,6 @@ uint32_t udpresolve(int af, unsigned char * name, unsigned char * value, uint32_
 	    *SAFAMILY(sinsl) = *SAFAMILY(&nservers[i].addr);
 	}
 	if((sock=so._socket(so.state, SASOCK(sinsl), usetcp?SOCK_STREAM:SOCK_DGRAM, usetcp?IPPROTO_TCP:IPPROTO_UDP)) == INVALID_SOCKET) break;
-	if(param && set_local_port_range(param->srv, sock, (struct sockaddr *)sinsl, usetcp ? LOCAL_PORT_RANGE_TCP : LOCAL_PORT_RANGE_UDP)) {
-		so._closesocket(so.state, sock);
-		break;
-	}
 	if(so._bind(so.state, sock,(struct sockaddr *)sinsl,SASIZE(sinsl))){
 	    so._shutdown(so.state, sock, SHUT_RDWR);
 	    so._closesocket(so.state, sock);

src/socks.c

@@ -250,8 +250,9 @@ void * sockschild(struct clientparam* param) {
  }
 
  if(command > 1) {
-	if(set_local_port_range(param->srv, param->remsock, (struct sockaddr *)&param->sinsl,
-		command == 2 ? LOCAL_PORT_RANGE_TCP : LOCAL_PORT_RANGE_UDP)) RETURN(12);
+#ifdef WITH_LOCAL_PORT_RANGE
+	if(set_local_port_range(param, param->remsock, (struct sockaddr *)&param->sinsl)) RETURN(12);
+#endif
 	if(param->srv->so._bind(param->sostate, param->remsock,(struct sockaddr *)&param->sinsl,SASIZE(&param->sinsl))) {
 		*SAPORT(&param->sinsl) = 0;
 		if(param->srv->so._bind(param->sostate, param->remsock,(struct sockaddr *)&param->sinsl,SASIZE(&param->sinsl)))RETURN (12);
@@ -276,7 +277,6 @@ fflush(stderr);
 #endif
 		sin = param->sincl;
 		*SAPORT(&sin) = 0;
-		if(set_local_port_range(param->srv, param->clisock, (struct sockaddr *)&sin, LOCAL_PORT_RANGE_UDP_ASSOCIATE)) {RETURN (12);}
 		if(param->srv->so._bind(param->sostate, param->clisock,(struct sockaddr *)&sin,SASIZE(&sin))) {RETURN (12);}
 		sasize = SASIZE(&sin);
 		param->srv->so._getsockname(param->sostate, param->clisock, (struct sockaddr *)&sin, &sasize);

src/structures.h

@@ -335,6 +335,9 @@ struct chain {
 	unsigned char * extpass;
 	unsigned short weight;
 	unsigned short cidr;
+#ifdef WITH_LOCAL_PORT_RANGE
+	uint32_t local_port_range;
+#endif
 };
 
 struct period {
@@ -589,9 +592,6 @@ struct srvparam {
 	unsigned char *udpbuf;
 	unsigned char *udpbuf2;
 	int udplen;
-	uint32_t tcp_local_port_range;
-	uint32_t udp_local_port_range;
-	uint32_t udp_associate_port_range;
 };
 
 struct clientparam {
@@ -669,6 +669,9 @@ struct clientparam {
 			maxtrafout64;
 	PROXYSOCKADDRTYPE sincl, sincr;
 	PROXYSOCKADDRTYPE	sinsl, sinsr, req;
+#ifdef WITH_LOCAL_PORT_RANGE
+	uint32_t local_port_range;
+#endif
 
 	uint64_t	statscli64,
 			statssrv64;

src/udppm.c

@@ -46,7 +46,9 @@ void * udppmchild(struct clientparam* param) {
 	*SAPORT(&param->sinsl) = 0;
 	param->remsock = param->srv->so._socket(param->srv->so.state, SASOCK(&param->sinsl), SOCK_DGRAM, IPPROTO_UDP);
 	if(param->remsock == INVALID_SOCKET) { RETURN(202); }
-	if(set_local_port_range(param->srv, param->remsock, (struct sockaddr *)&param->sinsl, LOCAL_PORT_RANGE_UDP)) { RETURN(203); }
+#ifdef WITH_LOCAL_PORT_RANGE
+	if(set_local_port_range(param, param->remsock, (struct sockaddr *)&param->sinsl)) { RETURN(203); }
+#endif
 	if(param->srv->so._bind(param->srv->so.state, param->remsock, (struct sockaddr *)&param->sinsl, SASIZE(&param->sinsl))) { RETURN(203); }
 #ifdef _WIN32
 	{ unsigned long ul2 = 1; ioctlsocket(param->remsock, FIONBIO, &ul2); }