automatically remove socks proxies during a kill/close command for a session

Bump tailscale.com from 1.66.3 to 1.66.4

client/command/kill/kill.go

@@ -26,6 +26,7 @@ import (
 	"github.com/spf13/cobra"
 
 	"github.com/bishopfox/sliver/client/console"
+	"github.com/bishopfox/sliver/client/core"
 	"github.com/bishopfox/sliver/protobuf/clientpb"
 	"github.com/bishopfox/sliver/protobuf/commonpb"
 	"github.com/bishopfox/sliver/protobuf/sliverpb"
@@ -74,6 +75,16 @@ func KillSession(session *clientpb.Session, cmd *cobra.Command, con *console.Sli
 	timeout, _ := cmd.Flags().GetInt64("timeout")
 	force, _ := cmd.Flags().GetBool("force")
 
+	// remove any active socks proxies
+	socks := core.SocksProxies.List()
+	if len(socks) != 0 {
+		for _, p := range socks {
+			if p.SessionID == session.ID {
+				core.SocksProxies.Remove(p.ID)
+			}
+		}
+	}
+
 	_, err := con.Rpc.Kill(context.Background(), &sliverpb.KillReq{
 		Request: &commonpb.Request{
 			SessionID: session.ID,

client/command/server.go

@@ -43,6 +43,7 @@ import (
 	"github.com/bishopfox/sliver/client/command/sessions"
 	"github.com/bishopfox/sliver/client/command/settings"
 	sgn "github.com/bishopfox/sliver/client/command/shikata-ga-nai"
+	"github.com/bishopfox/sliver/client/command/socks"
 	"github.com/bishopfox/sliver/client/command/taskmany"
 	"github.com/bishopfox/sliver/client/command/update"
 	"github.com/bishopfox/sliver/client/command/use"
@@ -105,6 +106,7 @@ func ServerCommands(con *client.SliverClient, serverCmds func() []*cobra.Command
 			websites.Commands,
 			wireguard.Commands,
 			c2profiles.Commands,
+			socks.RootCommands,
 		)
 
 		// Payloads

client/command/sessions/close.go

@@ -22,6 +22,7 @@ import (
 	"context"
 
 	"github.com/bishopfox/sliver/client/console"
+	"github.com/bishopfox/sliver/client/core"
 	"github.com/bishopfox/sliver/protobuf/sliverpb"
 	"github.com/spf13/cobra"
 )
@@ -35,6 +36,16 @@ func CloseSessionCmd(cmd *cobra.Command, con *console.SliverClient, args []strin
 		return
 	}
 
+	// remove any active socks proxies
+	socks := core.SocksProxies.List()
+	if len(socks) != 0 {
+		for _, p := range socks {
+			if p.SessionID == session.ID {
+				core.SocksProxies.Remove(p.ID)
+			}
+		}
+	}
+
 	// Close the session
 	_, err := con.Rpc.CloseSession(context.Background(), &sliverpb.CloseSession{
 		Request: con.ActiveTarget.Request(cmd),

client/command/socks/rootCommands.go

@@ -0,0 +1,46 @@
+package socks
+
+import (
+	"github.com/bishopfox/sliver/client/command/flags"
+	"github.com/bishopfox/sliver/client/command/help"
+	"github.com/bishopfox/sliver/client/console"
+	consts "github.com/bishopfox/sliver/client/constants"
+	"github.com/rsteube/carapace"
+	"github.com/spf13/cobra"
+	"github.com/spf13/pflag"
+)
+
+// Commands returns the “ command and its subcommands.
+func RootCommands(con *console.SliverClient) []*cobra.Command {
+	socksCmd := &cobra.Command{
+		Use:         consts.Socks5Str,
+		Short:       "In-band SOCKS5 Proxy",
+		Long:        help.GetHelpFor([]string{consts.Socks5Str}),
+		GroupID:     consts.NetworkHelpGroup,
+		Annotations: flags.RestrictTargets(consts.SessionCmdsFilter),
+		Run: func(cmd *cobra.Command, args []string) {
+			SocksCmd(cmd, con, args)
+		},
+	}
+	flags.Bind("", true, socksCmd, func(f *pflag.FlagSet) {
+		f.Int64P("timeout", "t", flags.DefaultTimeout, "grpc timeout in seconds")
+	})
+
+	socksStopCmd := &cobra.Command{
+		Use:   consts.StopStr,
+		Short: "Stop a SOCKS5 proxy",
+		Long:  help.GetHelpFor([]string{consts.Socks5Str}),
+		Run: func(cmd *cobra.Command, args []string) {
+			SocksStopCmd(cmd, con, args)
+		},
+	}
+	socksCmd.AddCommand(socksStopCmd)
+	flags.Bind("", false, socksStopCmd, func(f *pflag.FlagSet) {
+		f.Uint64P("id", "i", 0, "id of portfwd to remove")
+	})
+	flags.BindFlagCompletions(socksStopCmd, func(comp *carapace.ActionMap) {
+		(*comp)["id"] = SocksIDCompleter(con)
+	})
+
+	return []*cobra.Command{socksCmd}
+}

client/command/socks/socks.go

@@ -42,6 +42,8 @@ func SocksCmd(cmd *cobra.Command, con *console.SliverClient, args []string) {
 		return socks[i].ID < socks[j].ID
 	})
 
+	session := con.ActiveTarget.GetSession()
+
 	tw := table.NewWriter()
 	tw.SetStyle(settings.GetTableStyle(con))
 	tw.AppendHeader(table.Row{
@@ -52,6 +54,10 @@ func SocksCmd(cmd *cobra.Command, con *console.SliverClient, args []string) {
 		"Passwords",
 	})
 	for _, p := range socks {
+		// if we're in an active session, just display socks proxies for the session
+		if session != nil && session.ID != p.SessionID {
+			continue
+		}
 		tw.AppendRow(table.Row{p.ID, p.SessionID, p.BindAddr, p.Username, p.Password})
 	}
 

go.mod

@@ -64,7 +64,7 @@ require (
 	gorm.io/gorm v1.25.10
 	gvisor.dev/gvisor v0.0.0-20240306221502-ee1e1f6070e3
 	modernc.org/sqlite v1.29.10
-	tailscale.com v1.66.3
+	tailscale.com v1.66.4
 )
 
 require (

go.sum

@@ -625,5 +625,5 @@ nhooyr.io/websocket v1.8.10 h1:mv4p+MnGrLDcPlBoWsvPP7XCzTYMXP9F9eIGoKbgx7Q=
 nhooyr.io/websocket v1.8.10/go.mod h1:rN9OFWIUwuxg4fR5tELlYC04bXYowCP9GX47ivo2l+c=
 software.sslmate.com/src/go-pkcs12 v0.4.0 h1:H2g08FrTvSFKUj+D309j1DPfk5APnIdAQAB8aEykJ5k=
 software.sslmate.com/src/go-pkcs12 v0.4.0/go.mod h1:Qiz0EyvDRJjjxGyUQa2cCNZn/wMyzrRJ/qcDXOQazLI=
-tailscale.com v1.66.3 h1:jpWat+hiobTtCosSV/c8D6S/ubgROf/S59MaIBdM9pY=
-tailscale.com v1.66.3/go.mod h1:99BIV4U3UPw36Sva04xK2ZsEpVRUkY9jCdEDSAhaNGM=
+tailscale.com v1.66.4 h1:V0vTQah3xi2/zbsxJeOfl5QbO1WJPeD9TMlfL0daXqc=
+tailscale.com v1.66.4/go.mod h1:99BIV4U3UPw36Sva04xK2ZsEpVRUkY9jCdEDSAhaNGM=

vendor/modules.txt

@@ -1196,7 +1196,7 @@ nhooyr.io/websocket/internal/errd
 nhooyr.io/websocket/internal/util
 nhooyr.io/websocket/internal/wsjs
 nhooyr.io/websocket/internal/xsync
-# tailscale.com v1.66.3
+# tailscale.com v1.66.4
 ## explicit; go 1.22.0
 tailscale.com
 tailscale.com/appc

vendor/tailscale.com/VERSION.txt

@@ -1 +1 @@
-1.66.3
+1.66.4

vendor/tailscale.com/ipn/ipnlocal/local.go

@@ -4189,18 +4189,7 @@ func (b *LocalBackend) routerConfig(cfg *wgcfg.Config, prefs ipn.PrefsView, oneC
 	}
 
 	var doStatefulFiltering bool
-	if v, ok := prefs.NoStatefulFiltering().Get(); !ok {
-		// The stateful filtering preference isn't explicitly set; this is
-		// unexpected since we expect it to be set during the profile
-		// backfill, but to be safe let's enable stateful filtering
-		// absent further information.
-		doStatefulFiltering = true
-		b.logf("[unexpected] NoStatefulFiltering preference not set; enabling stateful filtering")
-	} else if v {
-		// The preferences explicitly say "no stateful filtering", so
-		// we don't do it.
-		doStatefulFiltering = false
-	} else {
+	if v, ok := prefs.NoStatefulFiltering().Get(); ok && !v {
 		// The preferences explicitly "do stateful filtering" is turned
 		// off, or to expand the double negative, to do stateful
 		// filtering. Do so.

vendor/tailscale.com/ipn/ipnlocal/profiles.go

@@ -354,10 +354,6 @@ func (pm *profileManager) loadSavedPrefs(key ipn.StateKey) (ipn.PrefsView, error
 		return ipn.PrefsView{}, err
 	}
 	savedPrefs := ipn.NewPrefs()
-	// NewPrefs sets a default NoStatefulFiltering, but we want to actually see
-	// if the saved state had an empty value. The empty value gets migrated
-	// based on NoSNAT, while a default "false" does not.
-	savedPrefs.NoStatefulFiltering = ""
 	if err := ipn.PrefsFromBytes(bs, savedPrefs); err != nil {
 		return ipn.PrefsView{}, fmt.Errorf("parsing saved prefs: %v", err)
 	}
@@ -382,32 +378,6 @@ func (pm *profileManager) loadSavedPrefs(key ipn.StateKey) (ipn.PrefsView, error
 		savedPrefs.AutoUpdate.Apply.Clear()
 	}
 
-	// Backfill a missing NoStatefulFiltering field based on the value of
-	// the NoSNAT field; we want to apply stateful filtering in all cases
-	// *except* where the user has disabled SNAT.
-	//
-	// Only backfill if the user hasn't set a value for
-	// NoStatefulFiltering, however.
-	_, haveNoStateful := savedPrefs.NoStatefulFiltering.Get()
-	if !haveNoStateful {
-		if savedPrefs.NoSNAT {
-			pm.logf("backfilling NoStatefulFiltering field to true because NoSNAT is set")
-
-			// No SNAT: no stateful filtering
-			savedPrefs.NoStatefulFiltering.Set(true)
-		} else {
-			pm.logf("backfilling NoStatefulFiltering field to false because NoSNAT is not set")
-
-			// SNAT (default): apply stateful filtering
-			savedPrefs.NoStatefulFiltering.Set(false)
-		}
-
-		// Write back to the preferences store now that we've updated it.
-		if err := pm.writePrefsToStore(key, savedPrefs.View()); err != nil {
-			return ipn.PrefsView{}, err
-		}
-	}
-
 	return savedPrefs.View(), nil
 }
 

vendor/tailscale.com/ipn/prefs.go

@@ -203,17 +203,16 @@ type Prefs struct {
 	// Linux-only.
 	NoSNAT bool
 
-	// NoStatefulFiltering specifies whether to apply stateful filtering
-	// when advertising routes in AdvertiseRoutes. The default is to apply
+	// NoStatefulFiltering specifies whether to apply stateful filtering when
+	// advertising routes in AdvertiseRoutes. The default is to not apply
 	// stateful filtering.
 	//
 	// To allow inbound connections from advertised routes, both NoSNAT and
 	// NoStatefulFiltering must be true.
 	//
-	// This is an opt.Bool because it was added after NoSNAT, but is backfilled
-	// based on the value of that parameter. We need to treat it as a tristate:
-	// true, false, or unset, and backfill based on that value. See
-	// ipn/ipnlocal for more details on the backfill.
+	// This is an opt.Bool because it was first added after NoSNAT, with a
+	// backfill based on the value of that parameter. The backfill has been
+	// removed since then, but the field remains an opt.Bool.
 	//
 	// Linux-only.
 	NoStatefulFiltering opt.Bool `json:",omitempty"`
@@ -667,7 +666,7 @@ func NewPrefs() *Prefs {
 		CorpDNS:             true,
 		WantRunning:         false,
 		NetfilterMode:       preftype.NetfilterOn,
-		NoStatefulFiltering: opt.NewBool(false),
+		NoStatefulFiltering: opt.NewBool(true),
 		AutoUpdate: AutoUpdatePrefs{
 			Check: true,
 			Apply: opt.Bool("unset"),

vendor/tailscale.com/net/tstun/wrap.go

@@ -915,8 +915,6 @@ func (t *Wrapper) Read(buffs [][]byte, sizes []int, offset int) (int, error) {
 	for _, data := range res.data {
 		p.Decode(data[res.dataOffset:])
 
-		pc.snat(p)
-
 		if m := t.destIPActivity.Load(); m != nil {
 			if fn := m[p.Dst.Addr()]; fn != nil {
 				fn()
@@ -932,6 +930,10 @@ func (t *Wrapper) Read(buffs [][]byte, sizes []int, offset int) (int, error) {
 				continue
 			}
 		}
+
+		// Make sure to do SNAT after filtering, so that any flow tracking in
+		// the filter sees the original source address. See #12133.
+		pc.snat(p)
 		n := copy(buffs[buffsPos][offset:], p.Buffer())
 		if n != len(data)-res.dataOffset {
 			panic(fmt.Sprintf("short copy: %d != %d", n, len(data)-res.dataOffset))

vendor/tailscale.com/wgengine/router/router_linux.go

@@ -469,7 +469,7 @@ func (r *linuxRouter) updateStatefulFilteringWithDockerWarning(cfg *Config) {
 		if _, found := ifstate.Interface["docker0"]; found {
 			r.health.SetWarnable(warnStatefulFilteringWithDocker, fmt.Errorf(""+
 				"Stateful filtering is enabled and Docker was detected; this may prevent Docker containers "+
-				"on this host from connecting to Tailscale nodes. "+
+				"on this host from resolving DNS and connecting to Tailscale nodes. "+
 				"See https://tailscale.com/s/stateful-docker",
 			))
 			return