b3nw/zerogravity
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: add macOS DNS redirect preload for MITM

Browse Source 
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-opencode)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
This commit is contained in:
trifatale
2026-02-18 13:22:59 -09:00
parent 7982aebcd7
commit 511c486a5e
2 changed files with 25 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
src/standalone/mod.rs
View File

@@ -65,12 +65,12 @@ pub fn discover_main_ls_config() -> Result<MainLSConfig, String> {
discovery::discover_main_ls_config() discovery::discover_main_ls_config()
} }
/// Build the dns_redirect.so preload library if it doesn't already exist. /// Build the dns_redirect preload library if it doesn't already exist.
/// ///
/// Linux only — hooks `getaddrinfo()` via LD_PRELOAD to redirect Google API /// Linux/macOS — hooks `getaddrinfo()` via LD_PRELOAD/DYLD_INSERT_LIBRARIES
/// domain lookups to 127.0.0.1. /// to redirect Google API domain lookups to 127.0.0.1.
/// ///
/// Returns the path to the .so on success, None on failure. /// Returns the path to the shared library on success, None on failure.
fn build_dns_redirect_so() -> Option<String> { fn build_dns_redirect_so() -> Option<String> {
if !platform::supports_ld_preload() { if !platform::supports_ld_preload() {
return None; return None;
@@ -91,10 +91,15 @@ fn build_dns_redirect_so() -> Option<String> {
return None; return None;
} }
// Compile: gcc -shared -fPIC -o dns_redirect.so dns_redirect.c -ldl let output = if cfg!(target_os = "macos") {
let output = Command::new("gcc") Command::new("cc")
.args(["-shared", "-fPIC", "-o", so_path.as_str(), &c_path, "-ldl"]) .args(["-dynamiclib", "-o", so_path.as_str(), &c_path])
.output(); .output()
} else {
Command::new("gcc")
.args(["-shared", "-fPIC", "-o", so_path.as_str(), &c_path, "-ldl"])
.output()
};
match output { match output {
Ok(out) if out.status.success() => { Ok(out) if out.status.success() => {

16
src/standalone/spawn.rs
View File

@@ -281,15 +281,23 @@ impl StandaloneLS {
// even the CodeAssistClient which has Proxy:nil hardcoded. // even the CodeAssistClient which has Proxy:nil hardcoded.
let so_path = build_dns_redirect_so(); let so_path = build_dns_redirect_so();
if let Some(ref so) = so_path { if let Some(ref so) = so_path {
info!(path = %so, "Enabling LD_PRELOAD DNS redirect for headless MITM"); info!(path = %so, "Enabling DNS redirect preload for headless MITM");
env_vars.push(("LD_PRELOAD".into(), so.clone())); #[cfg(target_os = "macos")]
{
env_vars.push(("DYLD_INSERT_LIBRARIES".into(), so.clone()));
env_vars.push(("DYLD_FORCE_FLAT_NAMESPACE".into(), "1".into()));
}
#[cfg(not(target_os = "macos"))]
{
env_vars.push(("LD_PRELOAD".into(), so.clone()));
}
env_vars.push(( env_vars.push((
"DNS_REDIRECT_LOG".into(), "DNS_REDIRECT_LOG".into(),
format!("{data_dir}/dns-redirect.log"), format!("{data_dir}/dns-redirect.log"),
)); ));
// Force Go binaries to use cgo (libc) DNS resolver instead of // Force Go binaries to use cgo (libc) DNS resolver instead of
// the pure-Go resolver. Without this, LD_PRELOAD getaddrinfo() // the pure-Go resolver. Without this, getaddrinfo hooks are
// hooks are bypassed because Go resolves DNS internally. // bypassed because Go resolves DNS internally.
env_vars.push(("GODEBUG".into(), "netdns=cgo".into())); env_vars.push(("GODEBUG".into(), "netdns=cgo".into()));
} }