Fix multiple port emulation bypasses, DoS, and stability issues

Co-authored-by: drk1wi <2052966+drk1wi@users.noreply.github.com>

Author: Copilot

plan.md

@@ -0,0 +1,3 @@
+- [ ] Fix IPv6 and TPROXY bypass in destination port resolution
+- [ ] Fix CPU exhaustion (O(N) search) when maxfd is reached by using the min-heap
+- [ ] Fix sockaddr truncation in accept() by using sockaddr_storage

src/Server.cpp

@@ -102,47 +102,67 @@ Server::Server(Configuration* configuration)
     epoll_ctl(epfd, EPOLL_CTL_ADD, shutfd, &ev);
 
     /* tcp listen socket */
-    listenfd = socket(PF_INET, SOCK_STREAM | SOCK_NONBLOCK, 0);
-    if (listenfd == -1)
-    {
-        perror("Socket creation error");
-        exit(1);
-    }
-
-    int reuse = 1;
-    setsockopt(listenfd, SOL_SOCKET, SO_REUSEADDR, &reuse, sizeof(reuse));
-
-    memset(&my_name, 0, sizeof(my_name));
-    my_name.sin_family = PF_INET;
+    struct addrinfo hints, *res, *p;
+    memset(&hints, 0, sizeof(hints));
+    hints.ai_family = AF_UNSPEC;
+    hints.ai_socktype = SOCK_STREAM;
+    hints.ai_flags = AI_PASSIVE;
 
+    const char* ip_str = NULL;
     if (configuration->getConfigValue(OPT_IP))
     {
-        fprintf(stdout, "-> Binding to iface: %s\n",
-                configuration->getBindIP().c_str());
-        inet_aton(configuration->getBindIP().c_str(), &my_name.sin_addr);
+        ip_str = configuration->getBindIP().c_str();
+        fprintf(stdout, "-> Binding to iface: %s\n", ip_str);
     }
     else
     {
-        my_name.sin_addr.s_addr = INADDR_ANY;
+        // If binding to any interface, prefer IPv6 (which handles IPv4 via v4-mapped)
+        hints.ai_family = AF_INET6;
     }
-
+    
+    char port_str[16];
+    snprintf(port_str, sizeof(port_str), "%d", configuration->getConfigValue(OPT_PORT) ? configuration->getPort() : DEFAULT_PORT);
+    
     if (configuration->getConfigValue(OPT_PORT))
     {
-        fprintf(stdout, "-> Binding to port: %d\n",
-                configuration->getPort());
-        my_name.sin_port = htons(configuration->getPort());
+        fprintf(stdout, "-> Binding to port: %s\n", port_str);
     }
-    else
+
+    if (getaddrinfo(ip_str, port_str, &hints, &res) != 0)
     {
-        my_name.sin_port = htons(DEFAULT_PORT);
+        perror("getaddrinfo error");
+        exit(1);
     }
 
-    status = bind(listenfd, (struct sockaddr*)&my_name, sizeof(my_name));
-    if (status == -1)
+    for (p = res; p != NULL; p = p->ai_next)
+    {
+        listenfd = socket(p->ai_family, p->ai_socktype | SOCK_NONBLOCK, p->ai_protocol);
+        if (listenfd == -1)
+            continue;
+
+        int reuse = 1;
+        setsockopt(listenfd, SOL_SOCKET, SO_REUSEADDR, &reuse, sizeof(reuse));
+        
+        if (p->ai_family == AF_INET6)
+        {
+            int no = 0;
+            setsockopt(listenfd, IPPROTO_IPV6, IPV6_V6ONLY, &no, sizeof(no));
+        }
+
+        if (bind(listenfd, p->ai_addr, p->ai_addrlen) == 0)
+            break;
+
+        close(listenfd);
+    }
+
+    if (p == NULL)
     {
         perror("Binding error");
+        freeaddrinfo(res);
         exit(1);
     }
+    
+    freeaddrinfo(res);
 
     status = listen(listenfd, 1024);
     if (status == -1)

src/Server.h

@@ -43,6 +43,7 @@
 #include <sys/resource.h>
 #include <sys/eventfd.h>
 #include <netinet/in.h>
+#include <netdb.h>
 #include <stdio.h>
 #include <unistd.h>
 #include <signal.h>

src/connection.cpp

@@ -42,6 +42,10 @@
 #include "connection.h"
 #include "Configuration.h"
 
+#ifndef IP6T_SO_ORIGINAL_DST
+#define IP6T_SO_ORIGINAL_DST 80
+#endif
+
 extern Configuration* configuration;
 
 struct timeout_entry
@@ -130,9 +134,9 @@ static void conn_close(int fd, int epfd, struct conn_state* cs, int* nactive)
 static void do_accept(int listenfd, int epfd, struct conn_state* cs,
                       int maxfd, Configuration* conf, int* nactive, timeout_heap& heap)
 {
-    struct sockaddr_in peer;
+    struct sockaddr_storage peer;
     socklen_t peerlen;
-    struct sockaddr_in orig;
+    struct sockaddr_storage orig;
     socklen_t origlen;
     int fd;
     uint64_t now = mono_now();
@@ -145,6 +149,29 @@ static void do_accept(int listenfd, int epfd, struct conn_state* cs,
         {
             if (errno == EAGAIN || errno == EWOULDBLOCK)
                 break;
+            if (errno == EMFILE || errno == ENFILE)
+            {
+                int victim = -1;
+                while (!heap.empty())
+                {
+                    const timeout_entry& top = heap.top();
+                    int v = top.fd;
+                    uint32_t gen = top.gen;
+                    heap.pop();
+                    
+                    if (cs[v].phase != 0 && cs[v].gen == gen)
+                    {
+                        victim = v;
+                        break;
+                    }
+                }
+                if (victim >= 0)
+                {
+                    conn_close(victim, epfd, cs, nactive);
+                    continue;
+                }
+                // If no connections to evict, we have a leak or something else took fds. Break to avoid spin.
+            }
             perror("accept");
             break;
         }
@@ -156,16 +183,17 @@ static void do_accept(int listenfd, int epfd, struct conn_state* cs,
              * free a slot for the next accept() call. */
             close(fd);
             int victim = -1;
-            uint64_t earliest = UINT64_MAX;
-            for (int v = 0; v < maxfd; v++)
+            while (!heap.empty())
             {
-                if (cs[v].phase == 0)
-                    continue;
-                uint64_t exp = cs[v].t_accept + cs[v].t_timeout;
-                if (exp < earliest)
+                const timeout_entry& top = heap.top();
+                int v = top.fd;
+                uint32_t gen = top.gen;
+                heap.pop();
+                
+                if (cs[v].phase != 0 && cs[v].gen == gen)
                 {
-                    earliest = exp;
                     victim = v;
+                    break;
                 }
             }
             if (victim >= 0)
@@ -177,11 +205,26 @@ static void do_accept(int listenfd, int epfd, struct conn_state* cs,
 
         /* get the port the scanner was actually aiming for */
         origlen = sizeof(orig);
-        uint16_t dport = DEFAULT_PORT;
-        if (getsockopt(fd, SOL_IP, SO_ORIGINAL_DST,
-                       (struct sockaddr*)&orig, &origlen) == 0)
+        uint16_t dport = conf->getPort() ? conf->getPort() : DEFAULT_PORT;
+
+        if (getsockopt(fd, SOL_IP, SO_ORIGINAL_DST, &orig, &origlen) == 0)
+        {
+            dport = ntohs(((struct sockaddr_in*)&orig)->sin_port);
+        }
+        else if (getsockopt(fd, SOL_IPV6, IP6T_SO_ORIGINAL_DST, &orig, &origlen) == 0)
+        {
+            dport = ntohs(((struct sockaddr_in6*)&orig)->sin6_port);
+        }
+        else
         {
-            dport = ntohs(orig.sin_port);
+            origlen = sizeof(orig);
+            if (getsockname(fd, (struct sockaddr*)&orig, &origlen) == 0)
+            {
+                if (orig.ss_family == AF_INET)
+                    dport = ntohs(((struct sockaddr_in*)&orig)->sin_port);
+                else if (orig.ss_family == AF_INET6)
+                    dport = ntohs(((struct sockaddr_in6*)&orig)->sin6_port);
+            }
         }
 
         /* look up the banner for this port */