2010-02-28 00:56:46 +01:00
|
|
|
package org.torproject.android.service;
|
|
|
|
|
2011-04-15 18:37:33 +02:00
|
|
|
import java.io.File;
|
2014-04-09 15:12:00 +02:00
|
|
|
import java.io.IOException;
|
2012-06-20 02:45:25 +02:00
|
|
|
import java.util.ArrayList;
|
2014-04-07 17:10:31 +02:00
|
|
|
import org.sufficientlysecure.rootcommands.Shell;
|
|
|
|
import org.sufficientlysecure.rootcommands.command.SimpleCommand;
|
2015-03-28 05:39:58 +01:00
|
|
|
import org.torproject.android.OrbotConstants;
|
2015-06-09 04:57:42 +02:00
|
|
|
import org.torproject.android.Prefs;
|
2011-10-28 06:29:57 +02:00
|
|
|
import org.torproject.android.settings.TorifiedApp;
|
2010-02-28 00:56:46 +01:00
|
|
|
|
|
|
|
import android.content.Context;
|
2012-01-13 02:58:21 +01:00
|
|
|
import android.content.SharedPreferences;
|
2010-02-28 00:56:46 +01:00
|
|
|
|
2010-09-10 00:09:01 +02:00
|
|
|
public class TorTransProxy implements TorServiceConstants {
|
2010-02-28 00:56:46 +01:00
|
|
|
|
2012-10-25 11:59:55 +02:00
|
|
|
private String mSysIptables = null;
|
|
|
|
private TorService mTorService = null;
|
2014-01-15 05:57:20 +01:00
|
|
|
private File mFileXtables = null;
|
2012-10-25 11:59:55 +02:00
|
|
|
|
2014-09-14 22:07:18 +02:00
|
|
|
private final static String ALLOW_LOCAL = " ! -d 127.0.0.1";
|
2014-04-17 16:16:03 +02:00
|
|
|
|
2014-06-17 21:42:54 +02:00
|
|
|
private int mTransProxyPort = TorServiceConstants.TOR_TRANSPROXY_PORT_DEFAULT;
|
|
|
|
private int mDNSPort = TorServiceConstants.TOR_DNS_PORT_DEFAULT;
|
|
|
|
|
2014-04-08 05:36:10 +02:00
|
|
|
public TorTransProxy (TorService torService, File fileXTables)
|
2012-10-25 11:59:55 +02:00
|
|
|
{
|
|
|
|
mTorService = torService;
|
2014-08-21 15:47:01 +02:00
|
|
|
mFileXtables = fileXTables;
|
2014-06-17 21:42:54 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
public void setTransProxyPort (int transProxyPort)
|
|
|
|
{
|
|
|
|
mTransProxyPort = transProxyPort;
|
|
|
|
}
|
|
|
|
|
|
|
|
public void setDNSPort (int dnsPort)
|
|
|
|
{
|
|
|
|
mDNSPort = dnsPort;
|
2012-10-25 11:59:55 +02:00
|
|
|
}
|
|
|
|
|
2012-01-13 02:58:21 +01:00
|
|
|
public String getIpTablesPath (Context context)
|
|
|
|
{
|
2012-10-25 11:59:55 +02:00
|
|
|
|
2012-10-01 09:05:31 +02:00
|
|
|
String ipTablesPath = null;
|
2013-08-23 22:44:15 +02:00
|
|
|
|
2015-06-09 04:57:42 +02:00
|
|
|
if (Prefs.useSystemIpTables())
|
2012-10-01 09:05:31 +02:00
|
|
|
{
|
|
|
|
ipTablesPath = findSystemIPTables();
|
|
|
|
}
|
|
|
|
else
|
|
|
|
{
|
2014-01-15 05:57:20 +01:00
|
|
|
ipTablesPath = mFileXtables.getAbsolutePath();
|
2013-12-28 15:21:25 +01:00
|
|
|
ipTablesPath += " iptables"; //append subcommand since we are using xtables now
|
2012-01-13 02:58:21 +01:00
|
|
|
|
2012-10-01 09:05:31 +02:00
|
|
|
}
|
2012-01-13 02:58:21 +01:00
|
|
|
|
|
|
|
return ipTablesPath;
|
2012-10-01 09:05:31 +02:00
|
|
|
}
|
2014-04-17 16:16:03 +02:00
|
|
|
|
|
|
|
public String getIp6TablesPath (Context context)
|
|
|
|
{
|
|
|
|
|
|
|
|
String ipTablesPath = null;
|
|
|
|
|
2015-06-09 04:57:42 +02:00
|
|
|
if (Prefs.useSystemIpTables())
|
2014-04-17 16:16:03 +02:00
|
|
|
{
|
|
|
|
ipTablesPath = findSystemIP6Tables();
|
|
|
|
}
|
|
|
|
else
|
|
|
|
{
|
|
|
|
ipTablesPath = mFileXtables.getAbsolutePath();
|
|
|
|
ipTablesPath += " ip6tables"; //append subcommand since we are using xtables now
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
return ipTablesPath;
|
|
|
|
|
|
|
|
}
|
|
|
|
|
2012-10-01 09:05:31 +02:00
|
|
|
private String findSystemIPTables ()
|
|
|
|
{
|
2012-10-25 11:59:55 +02:00
|
|
|
if (mSysIptables != null)
|
|
|
|
{
|
|
|
|
return mSysIptables;
|
|
|
|
}
|
2012-10-01 09:05:31 +02:00
|
|
|
else
|
|
|
|
{
|
2011-04-15 18:37:33 +02:00
|
|
|
|
2012-10-25 11:59:55 +02:00
|
|
|
//if the user wants us to use the built-in iptables, then we have to find it
|
2013-08-20 19:25:42 +02:00
|
|
|
File fileIpt = new File("/system/xbin/iptables");
|
2012-10-01 09:05:31 +02:00
|
|
|
|
|
|
|
if (fileIpt.exists())
|
2012-10-25 11:59:55 +02:00
|
|
|
mSysIptables = fileIpt.getAbsolutePath();
|
|
|
|
else
|
|
|
|
{
|
|
|
|
|
2013-08-20 19:25:42 +02:00
|
|
|
fileIpt = new File("/system/bin/iptables");
|
2012-10-25 11:59:55 +02:00
|
|
|
|
|
|
|
if (fileIpt.exists())
|
|
|
|
mSysIptables = fileIpt.getAbsolutePath();
|
|
|
|
}
|
2012-10-01 09:05:31 +02:00
|
|
|
}
|
|
|
|
|
2012-10-25 11:59:55 +02:00
|
|
|
return mSysIptables;
|
2012-01-13 02:58:21 +01:00
|
|
|
}
|
|
|
|
|
2014-04-17 16:16:03 +02:00
|
|
|
|
|
|
|
|
|
|
|
private String findSystemIP6Tables ()
|
|
|
|
{
|
|
|
|
|
|
|
|
//if the user wants us to use the built-in iptables, then we have to find it
|
|
|
|
File fileIpt = new File("/system/xbin/ip6tables");
|
|
|
|
|
|
|
|
if (fileIpt.exists())
|
|
|
|
mSysIptables = fileIpt.getAbsolutePath();
|
|
|
|
else
|
|
|
|
{
|
|
|
|
|
|
|
|
fileIpt = new File("/system/bin/ip6tables");
|
|
|
|
|
|
|
|
if (fileIpt.exists())
|
|
|
|
mSysIptables = fileIpt.getAbsolutePath();
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
return mSysIptables;
|
|
|
|
}
|
|
|
|
|
2012-10-01 10:16:08 +02:00
|
|
|
/*
|
2012-09-30 20:27:59 +02:00
|
|
|
public int flushIptablesAll(Context context) throws Exception {
|
2011-04-15 18:37:33 +02:00
|
|
|
|
2012-01-13 02:58:21 +01:00
|
|
|
String ipTablesPath = getIpTablesPath(context);
|
|
|
|
|
2011-04-15 18:37:33 +02:00
|
|
|
final StringBuilder script = new StringBuilder();
|
|
|
|
|
2010-07-31 17:43:56 +02:00
|
|
|
StringBuilder res = new StringBuilder();
|
2011-04-15 18:37:33 +02:00
|
|
|
int code = -1;
|
2010-07-31 17:43:56 +02:00
|
|
|
|
2011-04-15 18:37:33 +02:00
|
|
|
script.append(ipTablesPath);
|
|
|
|
script.append(" -t nat");
|
|
|
|
script.append(" -F || exit\n");
|
2010-07-31 17:43:56 +02:00
|
|
|
|
2011-04-15 18:37:33 +02:00
|
|
|
script.append(ipTablesPath);
|
|
|
|
script.append(" -t filter");
|
|
|
|
script.append(" -F || exit\n");
|
|
|
|
|
|
|
|
String[] cmd = {script.toString()};
|
|
|
|
code = TorServiceUtils.doShellCommand(cmd, res, true, true);
|
|
|
|
String msg = res.toString();
|
2011-04-17 08:04:27 +02:00
|
|
|
|
|
|
|
TorService.logMessage(cmd[0] + ";errCode=" + code + ";resp=" + msg);
|
2011-04-15 18:37:33 +02:00
|
|
|
|
2010-07-31 17:43:56 +02:00
|
|
|
|
2011-04-15 18:37:33 +02:00
|
|
|
return code;
|
|
|
|
|
2012-10-01 10:16:08 +02:00
|
|
|
}*/
|
2010-09-09 22:39:52 +02:00
|
|
|
|
2011-04-15 18:37:33 +02:00
|
|
|
/*
|
|
|
|
public static int purgeIptablesByApp(Context context, TorifiedApp[] apps) throws Exception {
|
2010-08-14 07:08:55 +02:00
|
|
|
|
2010-09-17 18:52:41 +02:00
|
|
|
//restoreDNSResolvConf(); //not working yet
|
|
|
|
|
2011-04-17 08:04:27 +02:00
|
|
|
String ipTablesPath = new File(context.getDir("bin", 0),"iptables").getAbsolutePath();
|
2010-08-14 07:08:55 +02:00
|
|
|
|
|
|
|
final StringBuilder script = new StringBuilder();
|
|
|
|
|
|
|
|
StringBuilder res = new StringBuilder();
|
|
|
|
int code = -1;
|
|
|
|
|
2010-09-21 03:26:40 +02:00
|
|
|
for (int i = 0; i < apps.length; i++)
|
|
|
|
{
|
|
|
|
//flush nat for every app
|
2011-04-15 18:37:33 +02:00
|
|
|
script.append(ipTablesPath);
|
|
|
|
script.append(" -t nat -m owner --uid-owner ");
|
2012-06-20 02:45:25 +02:00
|
|
|
script.append(tApp.getUid());
|
2010-09-21 03:26:40 +02:00
|
|
|
script.append(" -F || exit\n");
|
2011-04-15 18:37:33 +02:00
|
|
|
|
|
|
|
script.append(ipTablesPath);
|
|
|
|
script.append(" -t filter -m owner --uid-owner ");
|
2012-06-20 02:45:25 +02:00
|
|
|
script.append(tApp.getUid());
|
2010-09-21 03:26:40 +02:00
|
|
|
script.append(" -F || exit\n");
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
String[] cmd = {script.toString()};
|
|
|
|
code = TorServiceUtils.doShellCommand(cmd, res, true, true);
|
|
|
|
String msg = res.toString();
|
|
|
|
logNotice(cmd[0] + ";errCode=" + code + ";resp=" + msg);
|
2010-08-14 07:08:55 +02:00
|
|
|
|
|
|
|
|
|
|
|
return code;
|
|
|
|
|
2011-04-15 18:37:33 +02:00
|
|
|
}*/
|
|
|
|
|
2010-08-14 07:08:55 +02:00
|
|
|
|
2010-09-21 03:26:40 +02:00
|
|
|
/*
|
|
|
|
// 9/19/2010 - NF This code is in process... /etc path on System partition
|
|
|
|
// is read-only on Android for now.
|
2010-09-17 18:52:41 +02:00
|
|
|
public static int redirectDNSResolvConf () throws Exception
|
|
|
|
{
|
|
|
|
StringBuilder script = new StringBuilder();
|
|
|
|
StringBuilder res = new StringBuilder();
|
|
|
|
int code = -1;
|
|
|
|
|
|
|
|
//mv resolv.conf to resolve.conf.bak
|
|
|
|
String cmd = "mv /etc/resolv.conf /etc/resolv.conf.bak";
|
|
|
|
script.append(cmd);
|
|
|
|
|
|
|
|
//create new resolve.conf pointing to localhost/127.0.0.1
|
|
|
|
cmd = "echo \"nameserver 127.0.0.1\" > /etc/resolv.conf";
|
|
|
|
script.append(cmd);
|
|
|
|
|
|
|
|
String[] cmdFlush = {script.toString()};
|
|
|
|
code = TorServiceUtils.doShellCommand(cmdFlush, res, true, true);
|
|
|
|
//String msg = res.toString(); //get stdout from command
|
|
|
|
|
|
|
|
|
|
|
|
return code;
|
|
|
|
}
|
|
|
|
|
|
|
|
public static int restoreDNSResolvConf () throws Exception
|
|
|
|
{
|
|
|
|
StringBuilder script = new StringBuilder();
|
|
|
|
StringBuilder res = new StringBuilder();
|
|
|
|
int code = -1;
|
|
|
|
|
|
|
|
//mv resolv.conf to resolve.conf.bak
|
|
|
|
String cmd = "mv /etc/resolv.conf.bak /etc/resolv.conf";
|
|
|
|
script.append(cmd);
|
|
|
|
script.append(" || exit\n");
|
|
|
|
|
|
|
|
String[] cmdFlush = {script.toString()};
|
|
|
|
code = TorServiceUtils.doShellCommand(cmdFlush, res, true, true);
|
|
|
|
//String msg = res.toString(); //get stdout from command
|
|
|
|
|
|
|
|
return code;
|
|
|
|
}
|
2010-09-21 03:26:40 +02:00
|
|
|
*/
|
2013-08-20 19:25:42 +02:00
|
|
|
/*
|
2012-10-01 09:05:31 +02:00
|
|
|
public int testOwnerModule(Context context, String ipTablesPath) throws Exception
|
2010-07-28 06:43:58 +02:00
|
|
|
{
|
2010-09-09 22:39:52 +02:00
|
|
|
|
2012-01-13 02:58:21 +01:00
|
|
|
TorBinaryInstaller.assertIpTablesBinaries(context, false);
|
|
|
|
|
2011-04-17 08:04:27 +02:00
|
|
|
boolean runRoot = true;
|
|
|
|
boolean waitFor = true;
|
|
|
|
|
2011-05-03 07:56:04 +02:00
|
|
|
int torUid = context.getApplicationInfo().uid;
|
|
|
|
|
|
|
|
StringBuilder script = new StringBuilder();
|
|
|
|
|
|
|
|
StringBuilder res = new StringBuilder();
|
|
|
|
int code = -1;
|
|
|
|
|
|
|
|
// Allow everything for Tor
|
|
|
|
script.append(ipTablesPath);
|
|
|
|
script.append(" -A OUTPUT");
|
2012-10-22 10:13:13 +02:00
|
|
|
script.append(" -t filter");
|
|
|
|
script.append(" -m owner --uid-owner ");
|
|
|
|
script.append(torUid);
|
|
|
|
script.append(" -j ACCEPT");
|
|
|
|
script.append(" || exit\n");
|
|
|
|
|
|
|
|
script.append(ipTablesPath);
|
|
|
|
script.append(" -D OUTPUT");
|
|
|
|
script.append(" -t filter");
|
2011-05-03 07:56:04 +02:00
|
|
|
script.append(" -m owner --uid-owner ");
|
|
|
|
script.append(torUid);
|
|
|
|
script.append(" -j ACCEPT");
|
|
|
|
script.append(" || exit\n");
|
|
|
|
|
|
|
|
String[] cmdAdd = {script.toString()};
|
|
|
|
|
|
|
|
code = TorServiceUtils.doShellCommand(cmdAdd, res, runRoot, waitFor);
|
|
|
|
String msg = res.toString();
|
2012-10-25 11:59:55 +02:00
|
|
|
|
|
|
|
if (mTorService != null)
|
|
|
|
logMessage(cmdAdd[0] + ";errCode=" + code + ";resp=" + msg);
|
2011-05-03 07:56:04 +02:00
|
|
|
|
2010-09-17 18:52:41 +02:00
|
|
|
|
2011-05-03 07:56:04 +02:00
|
|
|
return code;
|
|
|
|
}
|
2013-08-20 19:25:42 +02:00
|
|
|
*/
|
2011-05-03 07:56:04 +02:00
|
|
|
|
2013-08-23 22:44:15 +02:00
|
|
|
/*
|
2012-10-01 10:16:08 +02:00
|
|
|
public int clearTransparentProxyingByApp (Context context, ArrayList<TorifiedApp> apps) throws Exception
|
|
|
|
{
|
2013-08-23 18:46:54 +02:00
|
|
|
boolean runRoot = true;
|
|
|
|
boolean waitFor = true;
|
|
|
|
|
|
|
|
String ipTablesPath = getIpTablesPath(context);
|
|
|
|
|
|
|
|
StringBuilder script = new StringBuilder();
|
|
|
|
|
|
|
|
StringBuilder res = new StringBuilder();
|
|
|
|
int code = -1;
|
|
|
|
|
|
|
|
String chainName = "ORBOT";
|
|
|
|
String jumpChainName = "OUTPUT";
|
|
|
|
|
|
|
|
script.append(ipTablesPath);
|
|
|
|
script.append(" --flush ").append(chainName); //delete previous user-defined chain
|
|
|
|
script.append(" || exit\n");
|
|
|
|
|
|
|
|
script.append(ipTablesPath);
|
|
|
|
script.append(" -D ").append(jumpChainName);
|
|
|
|
script.append(" -j ").append(chainName);
|
|
|
|
script.append(" || exit\n");
|
|
|
|
|
|
|
|
script.append(ipTablesPath);
|
|
|
|
script.append(" -X ").append(chainName); //delete previous user-defined chain
|
|
|
|
script.append(" || exit\n");
|
|
|
|
|
|
|
|
String[] cmdAdd = {script.toString()};
|
|
|
|
|
|
|
|
code = TorServiceUtils.doShellCommand(cmdAdd, res, runRoot, waitFor);
|
|
|
|
String msg = res.toString();
|
|
|
|
|
|
|
|
logMessage(cmdAdd[0] + ";errCode=" + code + ";resp=" + msg);
|
|
|
|
|
|
|
|
return code;
|
2013-08-23 22:44:15 +02:00
|
|
|
}*/
|
2011-05-03 07:56:04 +02:00
|
|
|
|
2015-06-09 02:42:18 +02:00
|
|
|
public int setTransparentProxyingByApp(Context context, ArrayList<TorifiedApp> apps, boolean enableRule, Shell shell)
|
2011-05-03 07:56:04 +02:00
|
|
|
{
|
2012-01-13 02:58:21 +01:00
|
|
|
String ipTablesPath = getIpTablesPath(context);
|
2010-02-28 00:56:46 +01:00
|
|
|
|
2014-04-07 17:10:31 +02:00
|
|
|
//StringBuilder script = new StringBuilder();
|
2010-02-28 00:56:46 +01:00
|
|
|
|
2014-08-07 21:33:57 +02:00
|
|
|
String action = " -A ";
|
2014-04-07 17:10:31 +02:00
|
|
|
String srcChainName = "OUTPUT";
|
2014-04-17 17:34:31 +02:00
|
|
|
|
2014-08-07 21:33:57 +02:00
|
|
|
if (!enableRule)
|
|
|
|
action = " -D ";
|
|
|
|
|
2013-08-23 18:46:54 +02:00
|
|
|
//run the delete commands in a separate process as it might error out
|
2014-04-07 17:10:31 +02:00
|
|
|
//String[] cmdExecClear = {script.toString()};
|
|
|
|
//code = TorServiceUtils.doShellCommand(cmdExecClear, res, runRoot, waitFor);
|
2013-08-23 18:46:54 +02:00
|
|
|
|
|
|
|
//reset script
|
2014-04-07 17:10:31 +02:00
|
|
|
|
2014-04-09 15:12:00 +02:00
|
|
|
int lastExit = -1;
|
2014-04-17 17:34:31 +02:00
|
|
|
StringBuilder script;
|
|
|
|
|
2014-09-14 22:07:18 +02:00
|
|
|
|
|
|
|
// Same for DNS
|
|
|
|
script = new StringBuilder();
|
|
|
|
script.append(ipTablesPath);
|
|
|
|
script.append(" -t nat");
|
|
|
|
script.append(action).append(srcChainName);
|
|
|
|
script.append(" -p udp");
|
|
|
|
//script.append(" -m owner --uid-owner ");
|
|
|
|
//script.append(tApp.getUid());
|
|
|
|
//script.append(" -m udp --dport ");
|
|
|
|
script.append(" --dport ");
|
|
|
|
script.append(STANDARD_DNS_PORT);
|
|
|
|
script.append(" -j REDIRECT --to-ports ");
|
|
|
|
script.append(mDNSPort);
|
|
|
|
executeCommand (shell, script.toString());
|
|
|
|
|
2014-04-17 17:34:31 +02:00
|
|
|
// Allow everything for Tor
|
2014-04-07 17:10:31 +02:00
|
|
|
|
2010-09-09 22:39:52 +02:00
|
|
|
//build up array of shell cmds to execute under one root context
|
2012-06-20 02:45:25 +02:00
|
|
|
for (TorifiedApp tApp:apps)
|
2010-08-14 07:08:55 +02:00
|
|
|
{
|
|
|
|
|
2014-09-14 22:07:18 +02:00
|
|
|
if (((!enableRule) || tApp.isTorified())
|
2012-06-20 02:45:25 +02:00
|
|
|
&& (!tApp.getUsername().equals(TorServiceConstants.TOR_APP_USERNAME))
|
2012-01-17 04:54:07 +01:00
|
|
|
) //if app is set to true
|
2010-02-28 00:56:46 +01:00
|
|
|
{
|
2010-08-14 07:08:55 +02:00
|
|
|
|
2014-04-07 17:10:31 +02:00
|
|
|
|
2014-09-14 22:07:18 +02:00
|
|
|
logMessage("transproxy for app: " + tApp.getUsername() + " (" + tApp.getUid() + "): enable=" + enableRule);
|
2014-06-27 19:02:21 +02:00
|
|
|
|
2014-09-14 22:07:18 +02:00
|
|
|
dropAllIPv6Traffic(context, tApp.getUid(),enableRule, shell);
|
2014-04-17 17:34:31 +02:00
|
|
|
|
|
|
|
script = new StringBuilder();
|
2014-04-15 06:22:52 +02:00
|
|
|
|
|
|
|
// Allow loopback
|
2014-09-14 22:07:18 +02:00
|
|
|
/**
|
2014-04-15 06:22:52 +02:00
|
|
|
script.append(ipTablesPath);
|
|
|
|
script.append(" -t filter");
|
2014-08-07 21:33:57 +02:00
|
|
|
script.append(action).append(srcChainName);
|
2014-04-15 06:22:52 +02:00
|
|
|
script.append(" -m owner --uid-owner ");
|
|
|
|
script.append(tApp.getUid());
|
|
|
|
script.append(" -o lo");
|
|
|
|
script.append(" -j ACCEPT");
|
|
|
|
|
|
|
|
executeCommand (shell, script.toString());
|
|
|
|
script = new StringBuilder();
|
2014-09-14 22:07:18 +02:00
|
|
|
**/
|
2014-04-15 06:22:52 +02:00
|
|
|
|
2012-09-30 20:27:59 +02:00
|
|
|
// Set up port redirection
|
|
|
|
script.append(ipTablesPath);
|
2013-08-23 18:46:54 +02:00
|
|
|
script.append(" -t nat");
|
2014-08-07 21:33:57 +02:00
|
|
|
script.append(action).append(srcChainName);
|
2012-09-30 20:27:59 +02:00
|
|
|
script.append(" -p tcp");
|
2014-04-17 16:16:03 +02:00
|
|
|
script.append(ALLOW_LOCAL);
|
2010-08-14 07:08:55 +02:00
|
|
|
script.append(" -m owner --uid-owner ");
|
2012-06-20 02:45:25 +02:00
|
|
|
script.append(tApp.getUid());
|
2010-09-09 22:39:52 +02:00
|
|
|
script.append(" -m tcp --syn");
|
2011-05-03 07:56:04 +02:00
|
|
|
script.append(" -j REDIRECT --to-ports ");
|
2014-06-17 21:42:54 +02:00
|
|
|
script.append(mTransProxyPort);
|
2014-04-07 17:10:31 +02:00
|
|
|
|
2014-04-09 15:12:00 +02:00
|
|
|
executeCommand (shell, script.toString());
|
2010-08-14 07:08:55 +02:00
|
|
|
|
2014-09-14 22:07:18 +02:00
|
|
|
|
2014-04-07 17:10:31 +02:00
|
|
|
script = new StringBuilder();
|
2010-08-14 07:08:55 +02:00
|
|
|
|
2014-04-15 06:22:52 +02:00
|
|
|
// Reject all other outbound packets
|
2012-09-30 20:48:22 +02:00
|
|
|
script.append(ipTablesPath);
|
|
|
|
script.append(" -t filter");
|
2014-08-07 21:33:57 +02:00
|
|
|
script.append(action).append(srcChainName);
|
2012-09-30 20:48:22 +02:00
|
|
|
script.append(" -m owner --uid-owner ");
|
2014-04-15 06:22:52 +02:00
|
|
|
script.append(tApp.getUid());
|
2014-04-17 16:16:03 +02:00
|
|
|
script.append(ALLOW_LOCAL);
|
2014-04-17 17:34:31 +02:00
|
|
|
script.append(" -j REJECT");
|
2014-04-07 17:10:31 +02:00
|
|
|
|
2014-04-09 15:12:00 +02:00
|
|
|
lastExit = executeCommand (shell, script.toString());
|
|
|
|
|
2014-04-07 17:10:31 +02:00
|
|
|
|
2010-08-14 07:08:55 +02:00
|
|
|
}
|
2012-10-25 11:59:55 +02:00
|
|
|
}
|
2012-09-30 18:29:29 +02:00
|
|
|
|
2014-04-09 15:12:00 +02:00
|
|
|
return lastExit;
|
2010-02-28 00:56:46 +01:00
|
|
|
}
|
2010-03-18 04:15:20 +01:00
|
|
|
|
2015-06-09 02:42:18 +02:00
|
|
|
private int executeCommand (Shell shell, String cmdString) {
|
2014-09-14 22:07:18 +02:00
|
|
|
SimpleCommand cmd = new SimpleCommand(cmdString);
|
2015-06-09 02:42:18 +02:00
|
|
|
try {
|
|
|
|
shell.add(cmd);
|
|
|
|
} catch (IOException e) {
|
|
|
|
e.printStackTrace();
|
|
|
|
}
|
2014-06-27 19:02:21 +02:00
|
|
|
int exitCode = cmd.getExitCode();
|
|
|
|
String output = cmd.getOutput();
|
|
|
|
|
|
|
|
logMessage(cmdString + "; exit=" + exitCode + ";output=" + output);
|
2014-04-09 15:12:00 +02:00
|
|
|
|
2014-06-27 19:02:21 +02:00
|
|
|
return exitCode;
|
2014-04-09 15:12:00 +02:00
|
|
|
}
|
|
|
|
|
2012-09-30 20:27:59 +02:00
|
|
|
|
2014-09-14 22:07:18 +02:00
|
|
|
public int enableTetheringRules (Context context, Shell shell) throws Exception
|
2011-05-10 04:08:16 +02:00
|
|
|
{
|
|
|
|
|
2012-01-13 02:58:21 +01:00
|
|
|
String ipTablesPath = getIpTablesPath(context);
|
2011-05-10 04:08:16 +02:00
|
|
|
|
|
|
|
StringBuilder script = new StringBuilder();
|
|
|
|
|
2011-06-02 22:21:50 +02:00
|
|
|
String[] hwinterfaces = {"usb0","wl0.1"};
|
|
|
|
|
2014-04-07 17:10:31 +02:00
|
|
|
|
2014-04-09 15:12:00 +02:00
|
|
|
int lastExit = -1;
|
|
|
|
|
2011-06-02 22:21:50 +02:00
|
|
|
for (int i = 0; i < hwinterfaces.length; i++)
|
|
|
|
{
|
2014-04-07 17:10:31 +02:00
|
|
|
|
|
|
|
script = new StringBuilder();
|
2011-06-02 22:21:50 +02:00
|
|
|
script.append(ipTablesPath);
|
|
|
|
script.append(" -t nat -A PREROUTING -i ");
|
|
|
|
script.append(hwinterfaces[i]);
|
|
|
|
script.append(" -p udp --dport 53 -j REDIRECT --to-ports ");
|
2014-06-17 21:42:54 +02:00
|
|
|
script.append(mDNSPort);
|
2011-06-02 22:21:50 +02:00
|
|
|
|
2014-04-09 15:12:00 +02:00
|
|
|
executeCommand (shell, script.toString());
|
|
|
|
script = new StringBuilder();
|
|
|
|
|
2014-04-07 17:10:31 +02:00
|
|
|
|
|
|
|
script = new StringBuilder();
|
2011-06-02 22:21:50 +02:00
|
|
|
script.append(ipTablesPath);
|
|
|
|
script.append(" -t nat -A PREROUTING -i ");
|
|
|
|
script.append(hwinterfaces[i]);
|
|
|
|
script.append(" -p tcp -j REDIRECT --to-ports ");
|
2014-06-17 21:42:54 +02:00
|
|
|
script.append(mTransProxyPort);
|
2014-04-07 17:10:31 +02:00
|
|
|
|
2014-04-09 15:12:00 +02:00
|
|
|
lastExit = executeCommand (shell, script.toString());
|
|
|
|
script = new StringBuilder();
|
|
|
|
|
2014-04-07 17:10:31 +02:00
|
|
|
|
2011-06-02 22:21:50 +02:00
|
|
|
}
|
2015-04-09 19:04:28 +02:00
|
|
|
|
2014-04-09 15:12:00 +02:00
|
|
|
return lastExit;
|
2011-05-10 04:08:16 +02:00
|
|
|
}
|
|
|
|
|
2012-10-25 11:59:55 +02:00
|
|
|
private void logMessage (String msg)
|
|
|
|
{
|
|
|
|
if (mTorService != null)
|
2014-07-14 15:19:30 +02:00
|
|
|
mTorService.debug(msg);
|
2012-10-25 11:59:55 +02:00
|
|
|
}
|
|
|
|
|
2012-10-01 10:16:08 +02:00
|
|
|
|
2014-04-08 05:36:10 +02:00
|
|
|
|
2014-09-14 22:07:18 +02:00
|
|
|
public int fixTransproxyLeak (Context context, Shell shell) throws Exception
|
2014-04-08 05:36:10 +02:00
|
|
|
{
|
|
|
|
String ipTablesPath = getIpTablesPath(context);
|
|
|
|
|
|
|
|
StringBuilder script = new StringBuilder();
|
|
|
|
script.append(ipTablesPath);
|
|
|
|
script.append(" -I OUTPUT ! -o lo ! -d 127.0.0.1 ! -s 127.0.0.1 -p tcp -m tcp --tcp-flags ACK,FIN ACK,FIN -j DROP");
|
2014-04-09 15:12:00 +02:00
|
|
|
|
|
|
|
executeCommand (shell, script.toString());
|
|
|
|
script = new StringBuilder();
|
2014-04-08 05:36:10 +02:00
|
|
|
|
|
|
|
script = new StringBuilder();
|
|
|
|
script.append(ipTablesPath);
|
|
|
|
script.append(" -I OUTPUT ! -o lo ! -d 127.0.0.1 ! -s 127.0.0.1 -p tcp -m tcp --tcp-flags ACK,RST ACK,RST -j DROP");
|
2014-04-09 15:12:00 +02:00
|
|
|
|
|
|
|
int lastExit = executeCommand (shell, script.toString());
|
|
|
|
script = new StringBuilder();
|
2014-04-08 05:36:10 +02:00
|
|
|
|
2014-04-09 15:12:00 +02:00
|
|
|
return lastExit;
|
2014-04-08 05:36:10 +02:00
|
|
|
|
2012-10-01 10:16:08 +02:00
|
|
|
}
|
|
|
|
|
2015-06-09 02:42:18 +02:00
|
|
|
public int dropAllIPv6Traffic (Context context, int appUid, boolean enableDrop, Shell shell) {
|
2014-04-17 16:16:03 +02:00
|
|
|
|
2014-08-21 15:47:01 +02:00
|
|
|
String action = " -A ";
|
|
|
|
String chain = "OUTPUT";
|
|
|
|
|
|
|
|
if (!enableDrop)
|
|
|
|
action = " -D ";
|
|
|
|
|
2014-04-17 16:16:03 +02:00
|
|
|
String ip6tablesPath = getIp6TablesPath(context);
|
|
|
|
|
|
|
|
StringBuilder script;
|
2014-04-17 17:34:31 +02:00
|
|
|
|
|
|
|
script = new StringBuilder();
|
2014-04-17 16:16:03 +02:00
|
|
|
script.append(ip6tablesPath);
|
2014-08-21 15:47:01 +02:00
|
|
|
script.append(action);
|
|
|
|
script.append(chain);
|
2014-04-17 17:34:31 +02:00
|
|
|
|
|
|
|
if (appUid != -1)
|
|
|
|
{
|
|
|
|
script.append(" -m owner --uid-owner ");
|
|
|
|
script.append(appUid);
|
|
|
|
}
|
|
|
|
|
|
|
|
script.append(" -j DROP");
|
|
|
|
|
|
|
|
int lastExit = executeCommand (shell, script.toString());
|
|
|
|
|
|
|
|
return lastExit;
|
|
|
|
}
|
|
|
|
|
2014-08-21 15:47:01 +02:00
|
|
|
/*
|
2014-04-17 17:34:31 +02:00
|
|
|
public int clearAllIPv6Filters (Context context) throws Exception
|
|
|
|
{
|
|
|
|
|
|
|
|
String ip6tablesPath = getIp6TablesPath(context);
|
|
|
|
Shell shell = Shell.startRootShell();
|
|
|
|
|
|
|
|
StringBuilder script;
|
2014-04-17 16:16:03 +02:00
|
|
|
|
|
|
|
script = new StringBuilder();
|
|
|
|
script.append(ip6tablesPath);
|
2014-04-17 17:34:31 +02:00
|
|
|
script.append(" -t filter");
|
|
|
|
script.append(" -F OUTPUT");
|
2014-04-17 16:16:03 +02:00
|
|
|
int lastExit = executeCommand (shell, script.toString());
|
|
|
|
|
|
|
|
shell.close();
|
|
|
|
|
|
|
|
return lastExit;
|
2014-08-21 15:47:01 +02:00
|
|
|
}*/
|
|
|
|
|
2015-06-09 02:42:18 +02:00
|
|
|
public int flushTransproxyRules (Context context) throws IOException {
|
2014-08-21 15:47:01 +02:00
|
|
|
int exit = -1;
|
2014-09-14 22:07:18 +02:00
|
|
|
|
2014-08-21 15:47:01 +02:00
|
|
|
String ipTablesPath = getIpTablesPath(context);
|
2014-09-14 22:07:18 +02:00
|
|
|
Shell shell = Shell.startRootShell();
|
|
|
|
|
2014-08-21 15:47:01 +02:00
|
|
|
StringBuilder script = new StringBuilder();
|
|
|
|
script.append(ipTablesPath);
|
2014-09-14 22:07:18 +02:00
|
|
|
script.append(" -t nat ");
|
2014-08-21 15:47:01 +02:00
|
|
|
script.append(" -F ");
|
|
|
|
|
2014-09-14 22:07:18 +02:00
|
|
|
executeCommand (shell, script.toString());
|
2014-08-21 15:47:01 +02:00
|
|
|
|
|
|
|
script = new StringBuilder();
|
|
|
|
script.append(ipTablesPath);
|
2014-09-14 22:07:18 +02:00
|
|
|
script.append(" -t filter ");
|
2014-08-21 15:47:01 +02:00
|
|
|
script.append(" -F ");
|
2014-09-14 22:07:18 +02:00
|
|
|
executeCommand (shell, script.toString());
|
2014-08-21 15:47:01 +02:00
|
|
|
|
2014-09-14 22:07:18 +02:00
|
|
|
dropAllIPv6Traffic(context,-1,false, shell);
|
2014-08-21 15:47:01 +02:00
|
|
|
|
2015-04-09 19:04:28 +02:00
|
|
|
shell.close();
|
|
|
|
|
2014-08-21 15:47:01 +02:00
|
|
|
return exit;
|
2014-04-17 16:16:03 +02:00
|
|
|
}
|
|
|
|
|
2014-09-14 22:07:18 +02:00
|
|
|
public int setTransparentProxyingAll(Context context, boolean enable, Shell shell) throws Exception
|
2014-04-17 16:16:03 +02:00
|
|
|
{
|
2014-08-07 21:33:57 +02:00
|
|
|
|
|
|
|
String action = " -A ";
|
|
|
|
String srcChainName = "OUTPUT";
|
|
|
|
|
|
|
|
if (!enable)
|
|
|
|
action = " -D ";
|
2014-09-14 22:07:18 +02:00
|
|
|
|
|
|
|
dropAllIPv6Traffic(context,-1,enable, shell);
|
2011-05-03 07:56:04 +02:00
|
|
|
|
2012-01-13 02:58:21 +01:00
|
|
|
String ipTablesPath = getIpTablesPath(context);
|
2011-05-03 07:56:04 +02:00
|
|
|
|
|
|
|
|
|
|
|
int torUid = context.getApplicationInfo().uid;
|
2012-10-25 11:59:55 +02:00
|
|
|
|
2014-04-07 17:10:31 +02:00
|
|
|
StringBuilder script = new StringBuilder();
|
|
|
|
|
2012-10-22 10:13:13 +02:00
|
|
|
// Allow everything for Tor
|
2014-04-15 06:22:52 +02:00
|
|
|
|
2013-08-23 22:44:15 +02:00
|
|
|
script.append(ipTablesPath);
|
2014-04-15 06:22:52 +02:00
|
|
|
script.append(" -t nat");
|
2014-08-07 21:33:57 +02:00
|
|
|
script.append(action).append(srcChainName);
|
2012-10-22 10:13:13 +02:00
|
|
|
script.append(" -m owner --uid-owner ");
|
|
|
|
script.append(torUid);
|
|
|
|
script.append(" -j ACCEPT");
|
2014-04-07 17:10:31 +02:00
|
|
|
|
2014-04-09 15:12:00 +02:00
|
|
|
executeCommand (shell, script.toString());
|
2014-04-07 17:10:31 +02:00
|
|
|
script = new StringBuilder();
|
2014-04-15 06:22:52 +02:00
|
|
|
|
|
|
|
// Allow loopback
|
2012-10-22 10:13:13 +02:00
|
|
|
|
2014-04-15 06:22:52 +02:00
|
|
|
script.append(ipTablesPath);
|
|
|
|
script.append(" -t nat");
|
2014-08-07 21:33:57 +02:00
|
|
|
script.append(action).append(srcChainName);
|
2014-04-15 06:22:52 +02:00
|
|
|
script.append(" -o lo");
|
|
|
|
script.append(" -j ACCEPT");
|
|
|
|
|
|
|
|
executeCommand (shell, script.toString());
|
|
|
|
script = new StringBuilder();
|
2014-04-09 15:12:00 +02:00
|
|
|
|
2013-08-23 18:46:54 +02:00
|
|
|
// Set up port redirection
|
2013-08-23 22:44:15 +02:00
|
|
|
script.append(ipTablesPath);
|
2011-05-03 07:56:04 +02:00
|
|
|
script.append(" -t nat");
|
2014-08-07 21:33:57 +02:00
|
|
|
script.append(action).append(srcChainName);
|
2012-10-01 10:16:08 +02:00
|
|
|
script.append(" -p tcp");
|
2014-04-17 16:16:03 +02:00
|
|
|
script.append(ALLOW_LOCAL); //allow access to localhost
|
2011-05-03 07:56:04 +02:00
|
|
|
script.append(" -m owner ! --uid-owner ");
|
|
|
|
script.append(torUid);
|
|
|
|
script.append(" -m tcp --syn");
|
|
|
|
script.append(" -j REDIRECT --to-ports ");
|
2014-06-17 21:42:54 +02:00
|
|
|
script.append(mTransProxyPort);
|
2014-04-07 17:10:31 +02:00
|
|
|
|
2014-04-09 15:12:00 +02:00
|
|
|
executeCommand (shell, script.toString());
|
2014-04-07 17:10:31 +02:00
|
|
|
script = new StringBuilder();
|
2011-05-03 07:56:04 +02:00
|
|
|
|
|
|
|
// Same for DNS
|
|
|
|
script.append(ipTablesPath);
|
|
|
|
script.append(" -t nat");
|
2014-08-07 21:33:57 +02:00
|
|
|
script.append(action).append(srcChainName);
|
2014-03-03 16:37:35 +01:00
|
|
|
script.append(" -p udp");
|
2014-04-17 16:16:03 +02:00
|
|
|
script.append(ALLOW_LOCAL); //allow access to localhost
|
2014-03-03 16:37:35 +01:00
|
|
|
script.append(" -m owner ! --uid-owner ");
|
2011-05-03 07:56:04 +02:00
|
|
|
script.append(torUid);
|
2014-09-14 22:07:18 +02:00
|
|
|
//script.append(" -m udp --dport ");
|
|
|
|
script.append(" --dport ");
|
2011-05-03 07:56:04 +02:00
|
|
|
script.append(STANDARD_DNS_PORT);
|
|
|
|
script.append(" -j REDIRECT --to-ports ");
|
2014-06-17 21:42:54 +02:00
|
|
|
script.append(mDNSPort);
|
2014-04-07 17:10:31 +02:00
|
|
|
|
2014-04-09 15:12:00 +02:00
|
|
|
executeCommand (shell, script.toString());
|
2014-04-07 17:10:31 +02:00
|
|
|
script = new StringBuilder();
|
2014-04-09 15:12:00 +02:00
|
|
|
|
2011-05-03 07:56:04 +02:00
|
|
|
|
2015-06-09 04:57:42 +02:00
|
|
|
if (Prefs.useDebugLogging())
|
2011-05-03 07:56:04 +02:00
|
|
|
{
|
|
|
|
//XXX: Comment the following rules for non-debug builds
|
2013-08-23 22:44:15 +02:00
|
|
|
script.append(ipTablesPath);
|
2011-05-03 07:56:04 +02:00
|
|
|
script.append(" -t filter");
|
2014-08-07 21:33:57 +02:00
|
|
|
script.append(action).append(srcChainName);
|
2011-05-03 07:56:04 +02:00
|
|
|
script.append(" -p udp");
|
|
|
|
script.append(" --dport ");
|
|
|
|
script.append(STANDARD_DNS_PORT);
|
|
|
|
script.append(" -j LOG");
|
|
|
|
script.append(" --log-prefix='ORBOT_DNSLEAK_PROTECTION'");
|
|
|
|
script.append(" --log-uid");
|
2014-04-07 17:10:31 +02:00
|
|
|
|
2014-04-09 15:12:00 +02:00
|
|
|
executeCommand (shell, script.toString());
|
2014-04-07 17:10:31 +02:00
|
|
|
script = new StringBuilder();
|
2014-04-09 15:12:00 +02:00
|
|
|
|
2013-08-23 22:44:15 +02:00
|
|
|
script.append(ipTablesPath);
|
2013-08-23 18:46:54 +02:00
|
|
|
script.append(" -t filter");
|
2014-08-07 21:33:57 +02:00
|
|
|
script.append(action).append(srcChainName);
|
2012-10-25 11:59:55 +02:00
|
|
|
script.append(" -p tcp");
|
2011-05-03 07:56:04 +02:00
|
|
|
script.append(" -j LOG");
|
|
|
|
script.append(" --log-prefix='ORBOT_TCPLEAK_PROTECTION'");
|
|
|
|
script.append(" --log-uid");
|
2014-04-07 17:10:31 +02:00
|
|
|
|
2014-04-09 15:12:00 +02:00
|
|
|
executeCommand (shell, script.toString());
|
2014-04-07 17:10:31 +02:00
|
|
|
script = new StringBuilder();
|
2014-04-09 15:12:00 +02:00
|
|
|
|
2011-05-03 07:56:04 +02:00
|
|
|
}
|
2014-04-08 05:36:10 +02:00
|
|
|
|
2014-04-15 06:22:52 +02:00
|
|
|
//allow access to transproxy port
|
2012-09-30 18:29:29 +02:00
|
|
|
script.append(ipTablesPath);
|
|
|
|
script.append(" -t filter");
|
2014-08-07 21:33:57 +02:00
|
|
|
script.append(action).append(srcChainName);
|
2012-09-30 18:29:29 +02:00
|
|
|
script.append(" -p tcp");
|
2014-04-15 06:22:52 +02:00
|
|
|
script.append(" -m tcp");
|
2014-06-17 21:42:54 +02:00
|
|
|
script.append(" --dport ").append(mTransProxyPort);
|
2014-04-15 06:22:52 +02:00
|
|
|
script.append(" -j ACCEPT");
|
|
|
|
|
|
|
|
executeCommand (shell, script.toString());
|
|
|
|
script = new StringBuilder();
|
|
|
|
|
2014-08-21 15:47:01 +02:00
|
|
|
//allow access to local HTTP port
|
2014-04-15 06:22:52 +02:00
|
|
|
script.append(ipTablesPath);
|
|
|
|
script.append(" -t filter");
|
2014-08-07 21:33:57 +02:00
|
|
|
script.append(action).append(srcChainName);
|
2014-04-15 06:22:52 +02:00
|
|
|
script.append(" -p tcp");
|
|
|
|
script.append(" -m tcp");
|
2014-08-21 15:47:01 +02:00
|
|
|
script.append(" --dport ").append(mTorService.getHTTPPort());
|
2014-04-15 06:22:52 +02:00
|
|
|
script.append(" -j ACCEPT");
|
|
|
|
|
|
|
|
executeCommand (shell, script.toString());
|
|
|
|
script = new StringBuilder();
|
|
|
|
|
|
|
|
//allow access to local SOCKS port
|
|
|
|
script.append(ipTablesPath);
|
|
|
|
script.append(" -t filter");
|
2014-08-07 21:33:57 +02:00
|
|
|
script.append(action).append(srcChainName);
|
2014-04-15 06:22:52 +02:00
|
|
|
script.append(" -p tcp");
|
|
|
|
script.append(" -m tcp");
|
2014-08-21 15:47:01 +02:00
|
|
|
script.append(" --dport ").append(mTorService.getSOCKSPort());
|
2014-04-15 06:22:52 +02:00
|
|
|
script.append(" -j ACCEPT");
|
2014-04-07 17:10:31 +02:00
|
|
|
|
2014-04-09 15:12:00 +02:00
|
|
|
executeCommand (shell, script.toString());
|
2014-04-07 17:10:31 +02:00
|
|
|
script = new StringBuilder();
|
2014-04-09 15:12:00 +02:00
|
|
|
|
2014-04-15 06:22:52 +02:00
|
|
|
//allow access to local DNS port
|
|
|
|
script.append(ipTablesPath);
|
|
|
|
script.append(" -t filter");
|
2014-08-07 21:33:57 +02:00
|
|
|
script.append(action).append(srcChainName);
|
2014-04-15 06:22:52 +02:00
|
|
|
script.append(" -p udp");
|
|
|
|
script.append(" -m udp");
|
2014-06-17 21:42:54 +02:00
|
|
|
script.append(" --dport ").append(mDNSPort);
|
2014-04-15 06:22:52 +02:00
|
|
|
script.append(" -j ACCEPT");
|
|
|
|
|
|
|
|
executeCommand (shell, script.toString());
|
|
|
|
script = new StringBuilder();
|
|
|
|
|
2014-04-17 16:16:03 +02:00
|
|
|
// Reject all other packets
|
2012-09-30 20:48:22 +02:00
|
|
|
script.append(ipTablesPath);
|
|
|
|
script.append(" -t filter");
|
2014-08-07 21:33:57 +02:00
|
|
|
script.append(action).append(srcChainName);
|
2012-10-04 07:57:17 +02:00
|
|
|
script.append(" -m owner ! --uid-owner ");
|
|
|
|
script.append(torUid);
|
2014-04-17 16:16:03 +02:00
|
|
|
script.append(ALLOW_LOCAL); //allow access to localhost
|
|
|
|
script.append(" -j REJECT");
|
2014-04-07 17:10:31 +02:00
|
|
|
|
2014-04-09 15:12:00 +02:00
|
|
|
int lastExit = executeCommand (shell, script.toString());
|
2014-04-08 05:36:10 +02:00
|
|
|
|
2014-04-17 16:16:03 +02:00
|
|
|
// fixTransproxyLeak (context);
|
2014-04-15 06:22:52 +02:00
|
|
|
|
2014-04-09 15:12:00 +02:00
|
|
|
return lastExit;
|
2012-09-30 20:27:59 +02:00
|
|
|
}
|
|
|
|
|
2010-03-18 04:15:20 +01:00
|
|
|
|
2010-02-28 00:56:46 +01:00
|
|
|
}
|