Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

MITM program breaks socketpair, causes getaddrinfo() thread fail to start #10144

Closed
SerusDev opened this issue Dec 22, 2022 · 3 comments
Closed
Labels
Windows Windows-specific

Comments

@SerusDev
Copy link

I did this

curl https://www.google.com/

I expected the following

Instead of a success, curl always returns:
curl: (6) getaddrinfo() thread failed to start

curl/libcurl version

curl 7.83.1 (Windows) libcurl/7.83.1 Schannel
Release-Date: 2022-05-13
Protocols: dict file ftp ftps http https imap imaps pop3 pop3s smtp smtps telnet tftp
Features: AsynchDNS HSTS IPv6 Kerberos Largefile NTLM SPNEGO SSL SSPI UnixSockets

operating system

Windows 10 x64

possible cause

I was able to trace this problem to https://github.com/curl/curl/blob/master/lib/socketpair.c#L126

Apparently, curl on Windows simulates unix socket pair with a pair of regular TCP sockets on 127.0.0.1.
If the system (like in my case) runs a program that works as a proxy for this connection, socket addresses (ports) mismatch and Curl_socketpair fails.

I guess, the problem is widespread and cryptic. There is a number of antiviruses, firewalls, tunneling and monitoring software that proxy 127.0.0.1 connections and can cause this problem. At the same time, Curl_socketpair call does not provide any error messages. The top level getaddrinfo() error is very hard to track to this.
I experienced this problem when using git for Windows (curl based) together with Proxifier tool.

I propose to remove a.inaddr.sin_port != a2.inaddr.sin_port condition or perform peer validation with a chunk of a random data transmitted over the socket (recv/send calls).

@bagder bagder added the Windows Windows-specific label Dec 23, 2022
@bagder
Copy link
Member

bagder commented Dec 23, 2022

You could of course also argue that Proxifier is the one breaking curl here...

@bagder bagder changed the title getaddrinfo() thread failed to start MITM program breaks socketpair, causes getaddrinfo() thread fail to start Dec 23, 2022
@SerusDev
Copy link
Author

You could of course also argue that Proxifier is the one breaking curl here...

There is no program to blame. :)
The problem is not Proxifier specific. As you correctly stated any MITM tool including some antiviruses can cause this. The problem is that it is almost impossible to track the original error with the MITM tool.

The fix for this is very easy. Socketpair code should not check the source port. Honestly, I do not see any security or stability issues here because everything happens within loopback IP.
As far as I know, many other Windows programs (e.g., Firefox and VMWare) use the same loopback approach to emulate unix socketpair, but they do not check source port and work fine with a MITM program.

@bagder
Copy link
Member

bagder commented Dec 23, 2022

There is no program to blame. :)

I disagree, but that doesn't help much.

Someone needs to adjust the code so that users can keep running intrusive programs that MITM localhost connections.

bagder added a commit that referenced this issue Dec 27, 2022
Windows allow programs to MITM connections to localhost. The previous
check here would detect that and error out. This new method writes data
to verify the pipe thus allowing MITM.

Reported-by: SerusDev on github
Fixes #10144
@bagder bagder closed this as completed in 7fa449c Dec 28, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Windows Windows-specific
Development

Successfully merging a pull request may close this issue.

2 participants