Monkeypatch socket DNS resolving functions

[Anorov]

I recently became aware of the fact that functions like socket.gethostbyname and socket.getaddrinfo do not construct socket objects and so will not go through the proxy when the socket class is monkeypatched. For many applications this is not a problem, but anything that manually calls the DNS resolving functions may run into problems and will also suffer from a major privacy leak, as the DNS requests will be sent unproxied.

These functions are defined in C, in socketmodule.c and getaddrinfo.c. Currently trying to determine the best way of monkeypatching these. I'd prefer not to edit and compile the C extensions themselves.

[pde]

I have a feeling this is likely to affect applications even if they do not explicitly resolve addresses themselves. The example in #24 includes an unpatched call to socket.getaddrinfo from within the socket library itself.

[JeremyRand]

There's a workaround at http://fitblip.pub/2012/11/13/proxying-dns-with-python/ . It seems it just skips the DNS lookup, under the assumption that the SOCKS proxy can handle the DNS lookup itself. Maybe that would be helpful?

[g1itch]

There is a socksocket.resolve() method in the old pysocks copy inside PyBitmessage.

Isn't it what you are looking for?

[thedrow]

@JeremyRand That trick fails with:

SOCKSHTTPConnectionPool(host='httpbin.org', port=80): Max retries exceeded with url: /ip (Caused by NewConnectionError('<requests.packages.urllib3.contrib.socks.SOCKSConnection object at 0x7f34c76b9c50>: Failed to establish a new connection: illegal IP address string passed to inet_pton',))

when using requests/urllib3 at least.

[JeremyRand]

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Omer Katz:

@JeremyRand That trick fails with: [snip] when using requests/urllib3 at least.

What value do you have set for the `rdns` parameter of PySocks?

…

-----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJY3JfrAAoJELPy0WV4bWVwuBwQAK0t3ew1Re5Yi6kUqqOdAR8/ fkmiDOKQR/52JG7tGPGPt6OVYGd6J/B/0dH4SjWqfuuhT7WYbj5Vcpj02ITWrXzw KQBsmVQ8cp2d+S1JkCdsdUcthbPAcS222kbP6Y5HbExw/QTf33JUv0BqMZKNGs2D VdiS7Ie/iLKfhw/vpFvGps4xkkRiFgz+b5/DxZHfyWbiLGfQoYKGJ07P3zfIVtY0 mwUAzCs2KhmlCgS5xlRkvEHCW5rrCSszVsNgYfLpeDL8qzcNBlphG99bbMJnjOic OnqZDjGqo6VdZc4eptEsZVd3V516xLh5KBABABcA1Y+WG3NctAJVT+zqU6StG7Ds nyporlrYZ9i7Con4r0r8DXTqqzy3zlYq5YWGgROllSzcmTCMK0SEeK8GNJvJRHr5 9LaWFU9JioWqyT9qu19+UOCK/uDkCCzSSuh6n8YHcYHQp4YFr+TOPvaCxtJbs9ls oVFQvsCZ8J8P41Yg74rPQsUGxtwQ5pm/a42CeafhFzxSpzaa1CDpa+cdH2OW163B 6dHzFPdXQmQMcGhq0L2I8PKjZ2AGSM8A2FOiCmF+NmPE9vx0vN3JPmuwGkn8Pxvz 4p+DoSzUQkJyFGjM7ZHN9WncFFfTBI91f2C9MgAX0ah6HFYAZY2BZcSGA/WmcUsX UzRkFaNFb8V/c5SP654V =uy6i -----END PGP SIGNATURE-----

[thedrow]

It was False. With requests you have to use the socks5h:// schema to enable rdns which was my problem. I didn't need this patch.

[polski-g]

There's a workaround at http://fitblip.pub/2012/11/13/proxying-dns-with-python/ . It seems it just skips the DNS lookup, under the assumption that the SOCKS proxy can handle the DNS lookup itself. Maybe that would be helpful?

That page no longer exists. I extracted it from archive.is and attached it here.

Proxying DNS with python.pdf