From 6e45cab8ee8b221f15899ae101fc9bf90e6e1311 Mon Sep 17 00:00:00 2001
From: n8fr8 <nathan@freitas.net>
Date: Thu, 4 Oct 2012 11:27:17 +0530
Subject: [PATCH] allows UDP packets to localhost for DNS

---
 .../android/service/TorTransProxy.java           | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/src/org/torproject/android/service/TorTransProxy.java b/src/org/torproject/android/service/TorTransProxy.java
index 6db0437e..bd2c58ab 100644
--- a/src/org/torproject/android/service/TorTransProxy.java
+++ b/src/org/torproject/android/service/TorTransProxy.java
@@ -309,6 +309,7 @@ public class TorTransProxy implements TorServiceConstants {
 				script.append(" || exit\n");
 				
 				// Reject DNS that is not from Tor (order is important - first matched rule counts!)
+				/*
 				script.append(ipTablesPath);
 				script.append(modCmd);
 				script.append(" -t filter");
@@ -319,6 +320,7 @@ public class TorTransProxy implements TorServiceConstants {
 				script.append(STANDARD_DNS_PORT);
 				script.append(" -j REJECT");
 				script.append(" || exit\n");
+				*/
 				
 				// Reject all other outbound TCP packets
 				script.append(ipTablesPath);
@@ -327,6 +329,7 @@ public class TorTransProxy implements TorServiceConstants {
 				script.append(" -m owner --uid-owner ");
 				script.append(tApp.getUid());
 				script.append(" -p tcp");
+				script.append(" ! -d 127.0.0.1"); //allow access to localhost
 				script.append(" -j REJECT");
 				script.append(" || exit\n");
 				
@@ -337,6 +340,7 @@ public class TorTransProxy implements TorServiceConstants {
 				script.append(" -m owner --uid-owner ");
 				script.append(tApp.getUid());
 				script.append(" -p udp");
+				script.append(" ! -d 127.0.0.1"); //allow access to localhost
 				script.append(" -j REJECT");
 				script.append(" || exit\n");
 				
@@ -493,7 +497,7 @@ public class TorTransProxy implements TorServiceConstants {
     	//flushIptables(context);
     	
     	int torUid = context.getApplicationInfo().uid;
-
+    	
     	// Set up port redirection
     	script.append(ipTablesPath);
     	script.append(" -" + cmd + " OUTPUT");
@@ -580,20 +584,27 @@ public class TorTransProxy implements TorServiceConstants {
 		}
 		
 		// Reject DNS that is not from Tor (order is important - first matched rule counts!)
+		/*
 		script.append(ipTablesPath);
     	script.append(" -" + cmd + " OUTPUT");
 		script.append(" -t filter");
+		script.append(" -m owner ! --uid-owner ");
+		script.append(torUid);
 		script.append(" -p udp");
 		script.append(" --dport ");
 		script.append(STANDARD_DNS_PORT);
 		script.append(" -j REJECT");
 		script.append(" || exit\n");
+		*/
 		
 		// Reject all other outbound TCP packets
 		script.append(ipTablesPath);
     	script.append(" -" + cmd + " OUTPUT");
 		script.append(" -t filter");
+		script.append(" -m owner ! --uid-owner ");
+		script.append(torUid);
 		script.append(" -p tcp");
+		script.append(" ! -d 127.0.0.1"); //allow access to localhost
 		script.append(" -j REJECT");
 		script.append(" || exit\n");
 
@@ -601,7 +612,10 @@ public class TorTransProxy implements TorServiceConstants {
 		script.append(ipTablesPath);
     	script.append(" -" + cmd + " OUTPUT");
 		script.append(" -t filter");
+		script.append(" -m owner ! --uid-owner ");
+		script.append(torUid);
 		script.append(" -p udp");
+		script.append(" ! -d 127.0.0.1"); //allow access to localhost
 		script.append(" -j REJECT");
 		script.append(" || exit\n");