From 3f558b72740886a9b8dcf037c226f1966bc2b64f Mon Sep 17 00:00:00 2001 From: Ilia Ilin Date: Mon, 27 Jul 2026 22:54:17 +0300 Subject: [PATCH] fix: register TCPClientTunnel BindAddress as landlock.BindTCP, not ConnectTCP TCPClientTunnel listens on BindAddress (net.ListenTCP), but lockNetwork() registered it as a landlock.ConnectTCP rule instead of landlock.BindTCP. On kernels supporting Landlock network ABI v4 (Linux 6.7+), this makes wireproxy's own Landlock self-sandboxing deny its own bind() on BindAddress, regardless of host environment. Fixes #218 --- cmd/wireproxy/main.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/cmd/wireproxy/main.go b/cmd/wireproxy/main.go index 77d18670..e993e880 100644 --- a/cmd/wireproxy/main.go +++ b/cmd/wireproxy/main.go @@ -176,7 +176,7 @@ func lockNetwork(sections []wireproxy.RoutineSpawner, infoAddr *string) { case *wireproxy.HTTPConfig: rules = append(rules, landlock.BindTCP(extractPort(section.BindAddress))) case *wireproxy.TCPClientTunnelConfig: - rules = append(rules, landlock.ConnectTCP(uint16(section.BindAddress.Port))) + rules = append(rules, landlock.BindTCP(uint16(section.BindAddress.Port))) case *wireproxy.Socks5Config: rules = append(rules, landlock.BindTCP(extractPort(section.BindAddress))) case *wireproxy.SNIConfig: