syscall: if $LD_PRELOAD is set, use connect(), execve() in libc #3744

gopherbot · 2012-06-16T03:20:38Z

by hongruiqi:

cgoLookupHost may return nil addrs with no err report, which leads to the index out of
range in the net.hostPortToIP by indexing addrs[0].

go version weekly.2012-03-27 +5e3661048f2e

davecheney · 2012-06-16T08:03:18Z

Comment 1:

Hi,
Can you please test this with go 1.0.2 (weekly.2012-03-27 is very old).
Can you also please update the issue with your OS, Arch and the full panic message.
Cheers
Dave

Status changed to WaitingForReply.

gopherbot · 2012-06-16T09:53:05Z

Comment 2 by hongruiqi:

+5e3661048f2e is the tip version now...
Gentoo Linux 64bit
uname -a
Linux HRQ-PC 3.2.12-gentoo #16 SMP Fri Jun 8 23:08:57 CST 2012 x86_64 Intel(R) Core(TM)
i3 CPU M 350 @ 2.27GHz GenuineIntel GNU/Linux
panic message:
panic: runtime error: index out of range
goroutine 1 [running]:
net.hostPortToIP(0x6f0704, 0x3, 0xf8400f6b60, 0x15, 0x0, ...)
    /usr/lib/go/src/pkg/net/ipsock.go:127 +0x3c8
net.ResolveTCPAddr(0x6f0704, 0x3, 0xf8400f6b60, 0x70637400000015, 0xf800000000, ...)
    /usr/lib/go/src/pkg/net/tcpsock.go:31 +0x51
net.resolveNetAddr(0x6fd05c, 0x6c61696400000004, 0x6f0704, 0xf800000003, 0xf8400f6b60,
...)
    /usr/lib/go/src/pkg/net/dial.go:50 +0x504
net.Dial(0x6f0704, 0x3, 0xf8400f6b60, 0x7ff900000015, 0x0, ...)
    /usr/lib/go/src/pkg/net/dial.go:92 +0x62
net/http.(*Transport).dial(0xf8400b0840, 0x6f0704, 0x70637400000003, 0xf8400f6b60, 0x15,
...)
    /usr/lib/go/src/pkg/net/http/transport.go:299 +0xd5
net/http.(*Transport).getConn(0xf8400b0840, 0xf8400f2420, 0xf8400f2420, 0x0, 0x0, ...)
    /usr/lib/go/src/pkg/net/http/transport.go:311 +0xbe
net/http.(*Transport).RoundTrip(0xf8400b0840, 0xf8400b8000, 0x3b, 0x0, 0x0, ...)
    /usr/lib/go/src/pkg/net/http/transport.go:155 +0x2ba
net/http.send(0xf8400b8000, 0xf840083030, 0xf8400b0840, 0x0, 0x0, ...)
    /usr/lib/go/src/pkg/net/http/client.go:133 +0x3ca
net/http.(*Client).doFollowingRedirects(0x8a0a80, 0xf8400b8000, 0x0, 0x0, 0x0, ...)
    /usr/lib/go/src/pkg/net/http/client.go:227 +0x61c
----- stack segment boundary -----
net/http.(*Client).Get(0x8a0a80, 0xf8400f7e00, 0x7ff90000003b, 0x34, 0x0, ...)
    /usr/lib/go/src/pkg/net/http/client.go:176 +0xb8
net/http.Get(0xf8400f7e00, 0x7d0000003b, 0xf8400f7e00, 0x0, 0x0, ...)
    /usr/lib/go/src/pkg/net/http/client.go:158 +0x51
main.httpGET(0xf8400f7e00, 0xf80000003b, 0x0, 0x0, 0x0, ...)
    /usr/lib/go/src/cmd/go/http.go:25 +0x77
main.bitbucketVCS(0xf8400f6b00, 0xf8400f6b00, 0x7025c4, 0x6f70657200000004)
    /usr/lib/go/src/cmd/go/vcs.go:645 +0xce
main.repoRootForImportPathStatic(0xf8400f6840, 0x7ff90000001e, 0x6ee114, 0x0, 0x400, ...)
    /usr/lib/go/src/cmd/go/vcs.go:388 +0x76f
main.repoRootForImportPath(0xf8400f6840, 0x1e, 0x4, 0x30, 0xf840000438, ...)
    /usr/lib/go/src/cmd/go/vcs.go:323 +0x4e
main.downloadPackage(0xf8400faa00, 0xf8400e5180, 0xf8400f6840, 0xf80000001e)
    /usr/lib/go/src/cmd/go/get.go:242 +0x1192
main.download(0xf8400f6840, 0x10000001e, 0x7ff9118cbdb0, 0x100000001, 0x100000000, ...)
    /usr/lib/go/src/cmd/go/get.go:161 +0x7ec
main.runGet(0x89b660, 0xf840083020, 0x100000001, 0x0)
    /usr/lib/go/src/cmd/go/get.go:68 +0xc6
main.main()
    /usr/lib/go/src/cmd/go/main.go:141 +0x48e
goroutine 2 [syscall]:
created by runtime.main
    /usr/lib/go/src/pkg/runtime/proc.c:221

gopherbot · 2012-06-16T09:56:08Z

Comment 3 by hongruiqi:

I use the proxychains4 to redirect the socks connection in go get, though useless in
pure go, but may be the cause lead to the error...

minux · 2012-06-16T11:50:25Z

Comment 4:

yes, i think proxychains4 is the root cause.
part of go net library calls libc's dns lookup functions, which get intercepted by
proxychains4;
but other part of go use networking syscalls directly, and won't be intercepted by
proxychains4.
there is no easy solutions to this problem. transparent socks proxy for 'go get' is
not possible, iiuc.

rsc · 2012-06-19T04:08:48Z

Comment 5:

Which system calls does a transparent socks proxy want to hook into?

gopherbot · 2012-06-19T04:17:49Z

Comment 6 by hongruiqi:

$ nm libproxychains4.so 
0000000000206d60 a _DYNAMIC
0000000000206fe8 a _GLOBAL_OFFSET_TABLE_
                 w _Jv_RegisterClasses
0000000000206d50 d __DTOR_END__
0000000000207220 A __bss_start
                 w __cxa_finalize@@GLIBC_2.2.5
0000000000207210 d __dso_handle
                 U __errno_location@@GLIBC_2.2.5
                 w __gmon_start__
0000000000207220 A _edata
00000000011843c8 A _end
0000000000005718 T _fini
0000000000001e28 T _init
                 U abort@@GLIBC_2.2.5
00000000002072a0 b addr_name
                 U atoi@@GLIBC_2.2.5
0000000000005740 r base64
00000000002092c0 b buf.5444
0000000000003819 t calc_alive
000000000000387a t chain_step
                 U close@@GLIBC_2.2.5
0000000000005116 T connect
00000000000039c7 T connect_proxy_chain
000000000000233c T dalias_hash
                 U dlerror@@GLIBC_2.2.5
                 U dlsym@@GLIBC_2.2.5
                 U dup2@@GLIBC_2.2.5
0000000000002579 t encode_base_64
                 U exit@@GLIBC_2.2.5
                 U fclose@@GLIBC_2.2.5
                 U fcntl@@GLIBC_2.2.5
                 U fflush@@GLIBC_2.2.5
                 U fgets@@GLIBC_2.2.5
                 U fopen@@GLIBC_2.2.5
                 U fprintf@@GLIBC_2.2.5
                 U fputs@@GLIBC_2.2.5
                 U free@@GLIBC_2.2.5
0000000000005481 T freeaddrinfo
                 U fwrite@@GLIBC_2.2.5
000000000000478d t get_chain_data
00000000000053f5 T getaddrinfo
                 U getenv@@GLIBC_2.2.5
00000000000055de T gethostbyaddr
00000000000053aa T gethostbyname
                 U gethostent@@GLIBC_2.2.5
                 U gethostname@@GLIBC_2.2.5
00000000000054e3 T getnameinfo
                 U getservbyname@@GLIBC_2.2.5
                 U getsockopt@@GLIBC_2.2.5
                 U gettimeofday@@GLIBC_2.2.5
00000000002092e0 b he.5447
0000000000207260 b hostent_space
                 U htons@@GLIBC_2.2.5
000000000000239f T index_from_internal_ip
                 U inet_addr@@GLIBC_2.2.5
                 U inet_aton@@GLIBC_2.2.5
                 U inet_ntop@@GLIBC_2.2.5
                 U inet_pton@@GLIBC_2.2.5
00000000002092b8 b init_l
00000000000044bc t init_lib
0000000000207240 B internal_ips
0000000000209360 B internal_ips_lock
0000000000209300 b ipv4.5445
0000000000209310 b list.5446
00000000000058ac r local_host
00000000011813c0 B localnet_addr
000000000000244b T make_internal_ip
                 U malloc@@GLIBC_2.2.5
                 U memcpy@@GLIBC_2.14
                 U memset@@GLIBC_2.2.5
                 U ntohl@@GLIBC_2.2.5
                 U ntohs@@GLIBC_2.2.5
00000000002092b0 B num_localnet_addr
                 U perror@@GLIBC_2.2.5
                 U poll@@GLIBC_2.2.5
0000000000002499 t poll_retry
0000000000004252 T proxy_getaddrinfo
0000000000003e91 T proxy_gethostbyname
00000000002093a0 B proxychains_ct
00000000002092a0 B proxychains_got_chain_data
0000000000207218 D proxychains_max_chain
00000000002093c0 B proxychains_pd
00000000002092ac B proxychains_proxy_count
00000000002092a4 B proxychains_quiet_mode
00000000002092a8 B proxychains_resolver
00000000000027cf T proxychains_write_log
                 U pthread_mutex_init@@GLIBC_2.2.5
                 U pthread_mutex_lock@@GLIBC_2.2.5
                 U pthread_mutex_unlock@@GLIBC_2.2.5
                 U rand@@GLIBC_2.2.5
                 U read@@GLIBC_2.2.5
000000000000295b t read_n_bytes
                 U realloc@@GLIBC_2.2.5
0000000000003780 t release_all
00000000000037be t release_busy
000000000020721c D remote_dns_subnet
0000000000207280 b resolved_addr
0000000000207290 b resolved_addr_p
0000000000003615 t select_proxy
                 U send@@GLIBC_2.2.5
                 U snprintf@@GLIBC_2.2.5
                 U socket@@GLIBC_2.2.5
                 U srand@@GLIBC_2.2.5
                 U sscanf@@GLIBC_2.2.5
00000000000034e3 t start_chain
                 U stderr@@GLIBC_2.2.5
                 U strcat@@GLIBC_2.2.5
                 U strchr@@GLIBC_2.2.5
                 U strcmp@@GLIBC_2.2.5
                 U strcpy@@GLIBC_2.2.5
00000000000023d9 T string_from_internal_ip
                 U strlen@@GLIBC_2.2.5
                 U strncpy@@GLIBC_2.2.5
                 U strspn@@GLIBC_2.2.5
                 U strstr@@GLIBC_2.2.5
00000000002093a4 B tcp_connect_time_out
00000000011843c0 B tcp_read_time_out
                 U time@@GLIBC_2.2.5
00000000000029f9 t timed_connect
0000000000209340 B true_connect
0000000000209330 B true_freeaddrinfo
0000000000209320 B true_getaddrinfo
0000000000209338 B true_gethostbyaddr
0000000000209348 B true_gethostbyname
0000000000209328 B true_getnameinfo
0000000000002aff t tunnel_to
                 U vsprintf@@GLIBC_2.2.5
                 U write@@GLIBC_2.2.5
00000000000028ec t write_n_bytes

minux · 2012-06-19T10:52:48Z

Comment 7:

Re #5, current transparent sock proxy only uses dynamic linker tricks
to hook libc implementation of socket functions, and it won't hook any
syscall calls (if it does, then this issue won't exist anymore.)

rsc · 2012-06-19T15:15:26Z

Comment 8:

I'm pretty reluctant, but one thing we could possibly do is say that
if $LD_PRELOAD is set, then we'll use cgo for the connect system call
too. It looks like that would be enough.
Russ

minux · 2012-08-21T06:55:03Z

Comment 9:

Labels changed: added priority-later, removed priority-triage.

Status changed to Accepted.

rsc · 2012-09-12T21:42:49Z

Comment 10:

Labels changed: added go1.1maybe.

minux · 2012-11-29T00:09:28Z

Comment 11:

From https://groups.google.com/forum/?fromgroups=#!topic/golang-nuts/3ZmHFXqiUA0:
maybe we need to also use execve from libc if LD_PRELOAD is set.

robpike · 2013-03-07T22:19:00Z

Comment 12:

Labels changed: removed go1.1maybe.

minux · 2013-06-19T19:08:54Z

Comment 13:

one complexity of this issue: syscall package couldn't rely on cgo
(or there will be circular dependencies between cmd/cgo and syscall).
of course, we can use the same bootstrap mechanism for cmd/go to solve
this problem, but i'd rather not to complicate the build mechanism for
such small feature.
any suggestions? could we move the connect hook to the net package?
but then, what about the execve hook?

rsc · 2013-06-21T18:48:01Z

Comment 14:

This is looking more and more like a mistake.
Unless someone shows me that it's super-simple, let's not do this.

minux · 2013-06-30T18:50:16Z

Comment 15:

i come up with a simple solution:
we make runtime/cgo pulls in connect and execve from libc (only on unix) privately,
and call it conditionally using 6c code in syscall.
if cgo is available, then runtime/cgo will always be there, so this will work whenever
possible.
what do you think, Russ?

rsc · 2013-07-08T15:40:11Z

Comment 16:

It would be easier to judge if you can show me the CL.

minux · 2013-07-08T21:05:29Z

Comment 17:

please take a look at https://golang.org/cl/11010043/ the preliminary version
that implements my idea.

minux · 2013-07-08T22:14:54Z

Comment 18:

CL 11010043 is finished and ready for test and review.
for transparent socks proxy to work, it must support nonblocking sockets.
(for example, tsocks 1.8 doesn't, so it has to be patched with the little
patch below:
--- tsocks-1.8/tsocks.c 2002-07-16 06:50:52.000000000 +0800
+++ tsocks-1.8-hacked/tsocks.c  2013-07-09 06:01:36.540725793 +0800
@@ -326,8 +326,13 @@
       errno = ECONNREFUSED;
       return(-1);
    } else {
+      int old_flag = fcntl(__fd, F_GETFL);
+      if(old_flag & O_NONBLOCK)
+             fcntl(__fd, F_SETFL, old_flag & ~O_NONBLOCK);
       /* Now we call the main function to handle the connect. */
       rc = handle_request(newconn);
+      if(old_flag & O_NONBLOCK)
+             fcntl(__fd, F_SETFL, old_flag);
       /* If the request completed immediately it mustn't have been
        * a non blocking socket, in this case we don't need to know
        * about this socket anymore. */
)

rsc · 2013-07-30T17:27:17Z

Comment 19:

Labels changed: added go1.2maybe.

rsc · 2013-07-30T22:41:28Z

Comment 20:

Labels changed: added feature.

rsc · 2013-08-01T20:54:00Z

Comment 21:

CL 11010043 looks okay, I guess, except that I'm still a bit creeped out by
the whole idea.

robpike · 2013-08-16T06:11:14Z

Comment 22:

Is this "fix" going to be in 1.2?

rsc · 2013-09-06T19:21:56Z

Comment 23:

I replied on the CL. Let's hold off on this.

Labels changed: added go1.3maybe, removed go1.2maybe.

rsc · 2013-11-27T20:29:15Z

Comment 24:

Labels changed: removed feature.

rsc · 2013-12-04T01:27:53Z

Comment 25:

Labels changed: added release-none, removed go1.3maybe.

rsc · 2013-12-04T01:49:19Z

Comment 26:

Labels changed: added repo-main.

ymmt2005 · 2016-08-08T23:44:53Z

FWIW, transparent proxy can be done without using LD_PRELOAD.
I have blogged one such solution using Go on Linux.
http://ymmt2005.hatenablog.com/entry/2016/03/13/Transparent_SOCKS_proxy_in_Go_to_replace_NAT

bradfitz · 2016-09-09T01:16:36Z

I don't think this is ever going to happen.

We don't like calling into C from Go more than we have to, and have moved to minimize when we do so (e.g. we prefer our own DNS resolver when possible).

I agree with the page that @ymmt2005 referenced, which says: "Using iptables is far better than LD_PRELOAD for transparent proxy."

gopherbot added accepted labels Dec 4, 2013

rsc added this to the Unplanned milestone Apr 10, 2015

rsc removed priority-later labels Apr 10, 2015

bradfitz closed this as completed Sep 9, 2016

golang locked and limited conversation to collaborators Sep 9, 2017

gopherbot added the FrozenDueToAge label Sep 9, 2017

syscall: if $LD_PRELOAD is set, use connect(), execve() in libc #3744

syscall: if $LD_PRELOAD is set, use connect(), execve() in libc #3744

gopherbot commented Jun 16, 2012

davecheney commented Jun 16, 2012

gopherbot commented Jun 16, 2012

gopherbot commented Jun 16, 2012

minux commented Jun 16, 2012

rsc commented Jun 19, 2012

gopherbot commented Jun 19, 2012

minux commented Jun 19, 2012

rsc commented Jun 19, 2012

minux commented Aug 21, 2012

rsc commented Sep 12, 2012

minux commented Nov 29, 2012

robpike commented Mar 7, 2013

minux commented Jun 19, 2013

rsc commented Jun 21, 2013

minux commented Jun 30, 2013

rsc commented Jul 8, 2013

minux commented Jul 8, 2013

minux commented Jul 8, 2013

rsc commented Jul 30, 2013

rsc commented Jul 30, 2013

rsc commented Aug 1, 2013

robpike commented Aug 16, 2013

rsc commented Sep 6, 2013

rsc commented Nov 27, 2013

rsc commented Dec 4, 2013

rsc commented Dec 4, 2013

ymmt2005 commented Aug 8, 2016

bradfitz commented Sep 9, 2016

syscall: if $LD_PRELOAD is set, use connect(), execve() in libc #3744

syscall: if $LD_PRELOAD is set, use connect(), execve() in libc #3744

Comments

gopherbot commented Jun 16, 2012

davecheney commented Jun 16, 2012

gopherbot commented Jun 16, 2012

gopherbot commented Jun 16, 2012

minux commented Jun 16, 2012

rsc commented Jun 19, 2012

gopherbot commented Jun 19, 2012

minux commented Jun 19, 2012

rsc commented Jun 19, 2012

minux commented Aug 21, 2012

rsc commented Sep 12, 2012

minux commented Nov 29, 2012

robpike commented Mar 7, 2013

minux commented Jun 19, 2013

rsc commented Jun 21, 2013

minux commented Jun 30, 2013

rsc commented Jul 8, 2013

minux commented Jul 8, 2013

minux commented Jul 8, 2013

rsc commented Jul 30, 2013

rsc commented Jul 30, 2013

rsc commented Aug 1, 2013

robpike commented Aug 16, 2013

rsc commented Sep 6, 2013

rsc commented Nov 27, 2013

rsc commented Dec 4, 2013

rsc commented Dec 4, 2013

ymmt2005 commented Aug 8, 2016

bradfitz commented Sep 9, 2016