(enhancement) IP address of interface pysoxy should initiate connections from

[yutanicorp]

Hi Daneel,
Pysoxy accepts connections on a given IP address, and it would be great to have a parameter to set the interface for outgoing connections. This functionality comes in handy when a host want to separate incoming connections from outgoing connections on specific interfaces.

[MisterDaneel]

Hi Vincent,

Based on this thread I used SO_BINDTODEVICE to bind the socket to an interface.

But only root can set this option on a socket.

Moreover, refer to the thread, you may have to set the sysctl called net.ipv4.conf.all.rp_filter to 0.

Regards

[yutanicorp]

Hi Daneel,

I appreciate your swift response and the refactoring of your code a lot. Thank you.
The refactoring cleared a lot of warnings in PyCharm.

Regarding SO_BINDTODEVICE, it's a nice functionality, but root privilege doesn't have my preference. So, I took the liberty to change the code on my end to use AF_INET instead. This seems not to raise exceptions. In the end, it still satisfies my need.

sock.setsockopt( socket.SOL_SOCKET, socket.AF_INET, OUTGOING_ADDRESS.encode() # socket.SO_BINDTODEVICE, # OUTGOING_INTERFACE.encode() )

I also did a little refactoring with creating a class providing a start() and a stop() method (and commenting out the signal module). As I am going to use your module as a library module for my minitor, I need methods to control the proxy server. Note: I am completely refactoring my solution so that it only contains native code.

I implemented logging too, so no invocations to print() any more. It looks really nice in conjunction with coloredlogs. There is a demo on my page.

If you are interested, I can push my code (in a separate branch) for you to see the difference.

The issue can be closed.

Regards,

[MisterDaneel]

Hi Vincent,

I'm surprised that you can give socket.AF_INET as the option_name argument to setsockopt.

Refer to pubs.opengroup.org setsockopt wait for a constant from the socket-level options. But socket.AF_INET is a constant to designate an address family.

I assume that python use the constant behind AF_INET (https://github.com/torvalds/linux/blob/master/include/linux/socket.h)

#define AF_INET 2 /* Internet IP Protocol */

and mix up with the constant behind SO_REUSEADDR from the socket-level options.(https://github.com/torvalds/linux/blob/master/include/uapi/asm-generic/socket.h)

#define SO_REUSEADDR 2

which does not block the code from working but does not solve your problem.

[yutanicorp]

Hi Daneel,

Honestly, I only looked in the Python documentation and I experimented with it. As I probably said, I am not very experienced working with sockets. I only know the basics. I even have difficulty understanding what you wrote in the previous message. My apologies for frakking the secsockopt up. Question, how can I learn more about these concepts? The Python docs are not really educational.

[yutanicorp]

You also wrote "... but does not solve your problem." What problem do you refer to? If the amendment (AF_INET) is flat-out wrong, please share with me the right solution, so I can add that to the forked version.

[MisterDaneel]

Hi Vincent,

In python sockets are implement the socket system calls from Linux, this is why I look in the Linux system documentation instead of python documentation.

But in Python documentation you can see the definition:

 socket.setsockopt(level, optname, None, optlen: int)

    Set the value of the given socket option (see the Unix manual page setsockopt(2)). 

The level argument specifies the protocol level at which the option resides. You can found all levels in the following link https://github.com/torvalds/linux/blob/master/include/linux/socket.h.

The option_name argument specifies a single option to set for the protocol specified. Refer to https://pubs.opengroup.org/onlinepubs/009695399/functions/setsockopt.html, for SOL_SOCKET the options are as follows:

#define SO_DEBUG 1
#define SO_REUSEADDR 2
#define SO_TYPE 3
#define SO_ERROR 4
#define SO_DONTROUTE 5
#define SO_BROADCAST 6
#define SO_SNDBUF 7
#define SO_RCVBUF 8
#define SO_SNDBUFFORCE 32
#define SO_RCVBUFFORCE 33
#define SO_KEEPALIVE 9
#define SO_OOBINLINE 10
#define SO_NO_CHECK 11
#define SO_PRIORITY 12
#define SO_LINGER 13
#define SO_BSDCOMPAT 14
#define SO_REUSEPORT 15
#ifndef SO_PASSCRED /* powerpc only differs in these */
#define SO_PASSCRED 16
#define SO_PEERCRED 17
#define SO_RCVLOWAT 18
#define SO_SNDLOWAT 19
#define SO_RCVTIMEO_OLD 20

With google, you can found the function of each options:
SO_DEBUG
Turns on recording of debugging information. This option enables or disables debugging in the underlying protocol modules. This option takes an int value. This is a Boolean option.
SO_REUSEADDR
Specifies that the rules used in validating addresses supplied to bind() should allow reuse of local addresses, if this is supported by the protocol. This option takes an int value. This is a Boolean option.
SO_KEEPALIVE
Keeps connections active by enabling the periodic transmission of messages, if this is supported by the protocol. This option takes an int value.
If the connected socket fails to respond to these messages, the connection is broken and threads writing to that socket are notified with a SIGPIPE signal. This is a Boolean option.

I also add some summary to your work: 33d6115

Regads

[yutanicorp]

Hi MisterDaneel,

Thank you for your elaborate response and the added summary to the yutanicorp-refactoring**! It is very much appreciated. I have to mention that the linter complained about the added docstrings. Elaborate summaries are truly great, but there should be at least a one-line summary.

Unfortunately, most of the content of your response goes beyond my understanding. I am not that experienced working with low-level networking interface. Again, I appreciate your efforts to help me.

Regarding the timeout issue, I am not sure if this is helpful and applicable to your program, but I use in the module "minitoragent.py" of package "minitorcorelib" the methods "shutdown()" and "shutdown(socket.SHUT_RDWR)". The invocation must happen from another thread.

I assume the modification below is OK even though you were surprised of the possibility? Apparently, it works.

sock.setsockopt(
     socket.SOL_SOCKET,
     socket.AF_INET,
     self.local_addr_e.encode()  # <<< this
)

** I am still trying to figure out how I can pull your changes from the branch "yutanicorp-refactoring" to the forked version of pysoxy on my GitHub account.

Regards, Vincent

[yutanicorp]

Hi, is there a possibility to hire you to build a client version of this program? pysoxy receives SOCKS proxified connections and removes the encapsulated layer, but I would like to have a version that encapsulate connections to SOCKS. Perhaps, a bit of refactoring of pysoxy is suffice. Anyway, I would like to financially reward you for your time.

[yutanicorp]

Hi @MisterDaneel , in addition to my previous message, I can pay by Paypal, if you would like. Please let me know.