rex-socket 0.1.65 → 0.1.66

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 541410639347398150238fdd7bbc7ea008927cd838094a9b93319f3ed6793548
-  data.tar.gz: 3478989cca0e4993334f9168a6e281dcdacc2c74b18637f59c211962defc26c9
+  metadata.gz: a71de87f105663943e10753e3a5b6189e28db3d0ee792b92669bda8f064d291d
+  data.tar.gz: bb9f07894fad3f5cbf111e2869e6213d852bf39f9f1e1cb6db8ffb01822a4041
 SHA512:
-  metadata.gz: f9ab385de8ae209798b6a6b55d7325b8afa4c3e4a31effb96b3467ba35f48fed4b2d11b8049ab2eccb45366ceb3e7c3b65e4ef390babd4485009f22dee69e33b
-  data.tar.gz: 67c58ea1bf7605db720034adc9d5a02d8ffc974365fdb07f0192b999e087ae5953a9fc61430e3422c8a6e05e160c960a54af2f826bb80c9e4d7551ca7da2b525
+  metadata.gz: 801d1877c1841113ddb0981c5f195bb89c952de7400caef780a80c40df94758a55a142e25a9853fd8a54b94b4c4c8b94bd84481811b81cdae7e0b34bb848c775
+  data.tar.gz: a29bf5d722df87d7c736601b6cdb5b85586ef8fa8d13d2e8e99328f1c14a8bd2e97f6398d682d4c42321e17cb793763a0050c36635151083eab998cac005a37f

data/lib/rex/socket/comm/local.rb

@@ -158,6 +158,47 @@ class Rex::Socket::Comm::Local
     # Notify handlers of the before socket create event.
     self.instance.notify_before_socket_create(self, param)
 
+    # Binding to a specific interface while routing through a proxy is not
+    # supported. The proxy comm handles its own socket creation and ignores
+    # the interface option entirely, so we fail fast here rather than
+    # silently binding to the wrong interface.
+    if param.interface && !param.interface.empty? && param.proxies?
+      raise Rex::BindFailed.new(param.localhost, param.localport,
+        reason: 'Interface option is incompatible with proxy use'), caller
+    end
+
+    # On Windows, interface binding is handled by resolving the interface
+    # name to an IP address and overriding localhost before socket creation.
+    # No setsockopt-based interface binding is used.
+    if param.interface && !param.interface.empty? && Rex::Compat.is_windows
+      iface_ip = nil
+      begin
+        ifaddrs = ::Socket.getifaddrs.select { |ifaddr| ifaddr.name == param.interface }
+        iface = ifaddrs.find do |ifaddr|
+          if param.v6
+            ifaddr.addr&.ipv6?
+          else
+            ifaddr.addr&.ipv4?
+          end
+        end
+        iface_ip = iface&.addr&.ip_address
+      rescue ::SystemCallError, ::SocketError => e
+        raise Rex::BindFailed.new(param.localhost, param.localport,
+          reason: "Failed to enumerate interfaces: #{e.message}"), caller
+      end
+      if iface_ip.nil?
+        reason = if ifaddrs.empty?
+          "Interface #{param.interface} not found"
+        else
+          "Interface #{param.interface} has no #{param.v6 ? 'IPv6' : 'IPv4'} address"
+        end
+        raise Rex::BindFailed.new(param.localhost, param.localport,
+          reason: reason), caller
+      end
+      param = param.dup  # avoid mutating the caller's instance
+      param.localhost = iface_ip
+    end
+
     # Create the socket
     sock = nil
     if param.v6
@@ -166,6 +207,52 @@ class Rex::Socket::Comm::Local
       sock = ::Socket.new(::Socket::AF_INET, type, proto)
     end
 
+    # Apply interface binding BEFORE sock.bind() so the socket appears in netstat
+    # and accepts connections on the specified interface
+    if param.interface && !param.interface.empty?
+      if Rex::Compat.is_linux
+        begin
+          sock.setsockopt(::Socket::SOL_SOCKET, ::Socket::SO_BINDTODEVICE, param.interface)
+        rescue ::Errno::ENODEV, ::Errno::ENXIO
+          sock.close
+          raise Rex::BindFailed.new(param.localhost, param.localport,
+            reason: "Interface #{param.interface} not found"), caller
+        rescue ::Errno::EPERM
+          sock.close
+          raise Rex::BindFailed.new(param.localhost, param.localport,
+            reason: "Binding to interface #{param.interface} requires elevated privileges"), caller
+        rescue ::SystemCallError
+          sock.close
+          raise
+        end
+      elsif Rex::Compat.is_macosx
+        begin
+          # IP_BOUND_IF may not be defined in Ruby builds on macOS,
+          # so we fallback to raw value 25 which is stable across versions.
+          ip_bound_if = defined?(::Socket::IP_BOUND_IF) ? ::Socket::IP_BOUND_IF : 25
+          iface = ::Socket.getifaddrs.find { |ifaddr| ifaddr.name == param.interface }
+          idx = iface&.ifindex
+          if idx.nil?
+            sock.close
+            raise Rex::BindFailed.new(param.localhost, param.localport,
+              reason: "Interface #{param.interface} not found"), caller
+          end
+          sock.setsockopt(::Socket::IPPROTO_IP, ip_bound_if, [idx].pack('I'))
+        rescue ::SocketError, ::Errno::ENXIO
+          sock.close
+          raise Rex::BindFailed.new(param.localhost, param.localport,
+            reason: "Interface #{param.interface} not found"), caller
+        rescue ::SystemCallError
+          sock.close
+          raise
+        end
+      elsif !Rex::Compat.is_windows
+        sock.close
+        raise Rex::BindFailed.new(param.localhost, param.localport,
+          reason: 'Interface binding is not supported on this platform'), caller
+      end
+    end
+
     # Bind to a given local address and/or port if they are supplied
     if param.localport || param.localhost
       begin

data/lib/rex/socket/parameters.rb

@@ -81,6 +81,9 @@ class Rex::Socket::Parameters
   #   retried.
   # @option hash [Fixnum] 'Timeout' The number of seconds before a connection
   #   should time out
+  # @option hash [String] 'Interface' The network interface name to bind the socket to
+  #   (e.g. 'eth0'). Only honoured by the local Comm; raises Rex::BindFailed if combined
+  #   with a proxy.
   def initialize(hash = {})
     if (hash['PeerHost'])
       self.peerhost = hash['PeerHost']
@@ -203,6 +206,8 @@ class Rex::Socket::Parameters
       self.timeout = hash['Timeout'].to_i
     end
 
+    self.interface = hash['Interface'].to_s.strip if hash['Interface'] && !hash['Interface'].strip.empty?
+
     # Whether to force IPv6 addressing
     if hash['IPv6'].nil?
       # if IPv6 isn't specified and at least one host is an IPv6 address and the
@@ -486,6 +491,10 @@ class Rex::Socket::Parameters
   # @return [Array]
   attr_accessor :proxies
 
+  # The network interface name to bind the socket to (e.g. 'eth0'). nil means no binding.
+  # @return [String, nil]
+  attr_accessor :interface
+
   def proxies?
     proxies && !proxies.empty?
   end

data/lib/rex/socket/version.rb

@@ -1,5 +1,5 @@
 module Rex
   module Socket
-    VERSION = "0.1.65"
+    VERSION = "0.1.66"
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rex-socket
 version: !ruby/object:Gem::Version
-  version: 0.1.65
+  version: 0.1.66
 platform: ruby
 authors:
 - Metasploit Hackers