-
-
Notifications
You must be signed in to change notification settings - Fork 61
Add IPv6 blocking feature to prevent IP leaks from proxied applications #88
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
|
@wiresock 👋 This repository doesn't have Copilot instructions. With Copilot instructions, I can understand the repository better, work faster and produce higher quality PRs. I can generate a .github/copilot-instructions.md file for you automatically. Click here to open a pre-filled issue and assign it to me. I'll write the instructions, and then tag you for review. |
Co-authored-by: wiresock <20592735+wiresock@users.noreply.github.com>
Co-authored-by: wiresock <20592735+wiresock@users.noreply.github.com>
Co-authored-by: wiresock <20592735+wiresock@users.noreply.github.com>
wiresock
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
blockIPv6 must be per-proxy, because different behavior might be needed for different apps
| [JsonProperty("excludes", NullValueHandling = NullValueHandling.Ignore)] | ||
| public List<string> ExcludedList { get; } | ||
| [JsonProperty("blockIPv6", NullValueHandling = NullValueHandling.Ignore)] | ||
| public bool BlockIPv6 { get; set; } = false; |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This should be per proxy, not a global one.
| ```json | ||
| { | ||
| "logLevel": "Error", | ||
| "blockIPv6": true, |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This should be per proxy, not a global one
This PR implements IPv6 blocking functionality to address IP leakage issues where proxied applications inadvertently expose their real IPv6 addresses while IPv4 traffic is properly routed through the SOCKS proxy.
Problem
Users reported that applications like Discord would leak their real IPv6 addresses even when using ProxiFyre to proxy traffic. This occurred because:
ETH_P_IP) in the packet filterETH_P_IPV6) were allowed to pass through unprocessedThis created security issues and caused problems with services like Discord voice channels that rely on consistent IP addressing.
Solution
Added a new
blockIPv6configuration option that, when enabled, drops all IPv6 packets from proxied applications:{ "logLevel": "Info", "blockIPv6": true, "proxies": [...], "excludes": [...] }Implementation Details
Configuration Layer:
blockIPv6property toProxiFyreSettingsclass with JSON deserialization supportC++/CLI Interface:
SetIPv6Blocking(bool enabled)method toSocksifierclassCore Packet Processing:
socks_local_routerto detect IPv6 packetsipv6_blocking_enabled_to track blocking stateFilter Management:
add_ipv6_drop_filters()andremove_ipv6_drop_filters()Testing
Created validation tests confirming the logic works correctly:
Usage
Users experiencing IPv6 leaks (like Discord voice channel issues) can now add
"blockIPv6": trueto their configuration. This will:Example configuration and documentation have been added to guide users.
Fixes #65.
✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.