dan
/
tor-android
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Modified iptables rules for transproxying. UDP is now blocked. Also removed some redundant rules and reordered others. I reordered by the idea that its generally easier to specifically allow traffic before your reject it. 

Signed-off-by: n8fr8 <nathan@freitas.net>
This commit is contained in:
patch 2012-07-23 16:12:55 -04:00 committed by n8fr8
parent eb2f1c22df
commit c2f3f77053
1 changed files with 70 additions and 75 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

123
src/org/torproject/android/service/TorTransProxy.java
View File

@ -224,6 +224,15 @@ public class TorTransProxy implements TorServiceConstants {
int torUid = context.getApplicationInfo().uid; int torUid = context.getApplicationInfo().uid;
// Allow everything for Tor
script.append(ipTablesPath);
script.append(" -t filter");
script.append(" -A OUTPUT");
script.append(" -m owner --uid-owner ");
script.append(torUid);
script.append(" -j ACCEPT");
script.append(" || exit\n");
//build up array of shell cmds to execute under one root context //build up array of shell cmds to execute under one root context
for (TorifiedApp tApp:apps) for (TorifiedApp tApp:apps)
{ {
@ -251,7 +260,8 @@ public class TorTransProxy implements TorServiceConstants {
// Same for DNS // Same for DNS
script.append(ipTablesPath); script.append(ipTablesPath);
script.append(" -t nat"); script.append(" -t nat");
script.append(" -A OUTPUT -p udp -m owner --uid-owner "); script.append(" -A OUTPUT -p udp");
script.append(" -m owner --uid-owner ");
script.append(tApp.getUid()); script.append(tApp.getUid());
script.append(" -m udp --dport "); script.append(" -m udp --dport ");
script.append(STANDARD_DNS_PORT); script.append(STANDARD_DNS_PORT);
@ -259,6 +269,19 @@ public class TorTransProxy implements TorServiceConstants {
script.append(TOR_DNS_PORT); script.append(TOR_DNS_PORT);
script.append(" || exit\n"); script.append(" || exit\n");
// Allow loopback
script.append(ipTablesPath);
script.append(" -t filter");
script.append(" -A OUTPUT");
script.append(" -m owner --uid-owner ");
script.append(tApp.getUid());
script.append(" -o lo");
script.append(" -j ACCEPT");
script.append(" || exit\n");
/*
//Outgoing loopback already allowed (23/7/12)
int[] ports = {TOR_DNS_PORT,TOR_TRANSPROXY_PORT,PORT_SOCKS,PORT_HTTP}; int[] ports = {TOR_DNS_PORT,TOR_TRANSPROXY_PORT,PORT_SOCKS,PORT_HTTP};
for (int port : ports) for (int port : ports)
@ -276,29 +299,7 @@ public class TorTransProxy implements TorServiceConstants {
script.append(" -j ACCEPT"); script.append(" -j ACCEPT");
script.append(" || exit\n"); script.append(" || exit\n");
} }
*/
// Allow loopback
script.append(ipTablesPath);
script.append(" -t filter");
script.append(" -A OUTPUT");
script.append(" -m owner --uid-owner ");
script.append(tApp.getUid());
script.append(" -p tcp");
script.append(" -o lo");
script.append(" -j ACCEPT");
script.append(" || exit\n");
// Reject DNS that is not from Tor (order is important - first matched rule counts!)
script.append(ipTablesPath);
script.append(" -t filter");
script.append(" -A OUTPUT");
script.append(" -m owner --uid-owner ");
script.append(tApp.getUid());
script.append(" -p udp");
script.append(" --dport ");
script.append(STANDARD_DNS_PORT);
script.append(" -j REJECT");
script.append(" || exit\n");
// Reject all other outbound TCP packets // Reject all other outbound TCP packets
script.append(ipTablesPath); script.append(ipTablesPath);
@ -310,19 +311,20 @@ public class TorTransProxy implements TorServiceConstants {
script.append(" -j REJECT"); script.append(" -j REJECT");
script.append(" || exit\n"); script.append(" || exit\n");
} // Reject all other outbound UDP packets
}
// Allow everything for Tor
script.append(ipTablesPath); script.append(ipTablesPath);
script.append(" -t filter"); script.append(" -t filter");
script.append(" -A OUTPUT"); script.append(" -A OUTPUT");
script.append(" -m owner --uid-owner "); script.append(" -m owner --uid-owner ");
script.append(torUid); script.append(tApp.getUid());
script.append(" -j ACCEPT"); script.append(" -p udp");
script.append(" -j REJECT");
script.append(" || exit\n"); script.append(" || exit\n");
}
}
String[] cmdAdd = {script.toString()}; String[] cmdAdd = {script.toString()};
code = TorServiceUtils.doShellCommand(cmdAdd, res, runRoot, waitFor); code = TorServiceUtils.doShellCommand(cmdAdd, res, runRoot, waitFor);
@ -465,7 +467,8 @@ public class TorTransProxy implements TorServiceConstants {
// Same for DNS // Same for DNS
script.append(ipTablesPath); script.append(ipTablesPath);
script.append(" -t nat"); script.append(" -t nat");
script.append(" -A OUTPUT -p udp -m owner ! --uid-owner "); script.append(" -A OUTPUT -p udp");
script.appent(" -m owner ! --uid-owner ");
script.append(torUid); script.append(torUid);
script.append(" -m udp --dport "); script.append(" -m udp --dport ");
script.append(STANDARD_DNS_PORT); script.append(STANDARD_DNS_PORT);
@ -473,6 +476,27 @@ public class TorTransProxy implements TorServiceConstants {
script.append(TOR_DNS_PORT); script.append(TOR_DNS_PORT);
script.append(" || exit\n"); script.append(" || exit\n");
// Allow loopback
script.append(ipTablesPath);
script.append(" -t filter");
script.append(" -A OUTPUT");
script.append(" -o lo");
script.append(" -j ACCEPT");
script.append(" || exit\n");
// Allow everything for Tor
script.append(ipTablesPath);
script.append(" -t filter");
script.append(" -A OUTPUT");
script.append(" -m owner --uid-owner ");
script.append(torUid);
script.append(" -j ACCEPT");
script.append(" || exit\n");
/*
//Outgoing loopback already allowed (23/7/12)
int[] ports = {TOR_DNS_PORT,TOR_TRANSPROXY_PORT,PORT_SOCKS,PORT_HTTP}; int[] ports = {TOR_DNS_PORT,TOR_TRANSPROXY_PORT,PORT_SOCKS,PORT_HTTP};
for (int port : ports) for (int port : ports)
@ -490,25 +514,8 @@ public class TorTransProxy implements TorServiceConstants {
script.append(" -j ACCEPT"); script.append(" -j ACCEPT");
script.append(" || exit\n"); script.append(" || exit\n");
} } */
// Allow loopback
script.append(ipTablesPath);
script.append(" -t filter");
script.append(" -A OUTPUT");
script.append(" -p tcp");
script.append(" -o lo");
script.append(" -j ACCEPT");
script.append(" || exit\n");
// Allow everything for Tor
script.append(ipTablesPath);
script.append(" -t filter");
script.append(" -A OUTPUT");
script.append(" -m owner --uid-owner ");
script.append(torUid);
script.append(" -j ACCEPT");
script.append(" || exit\n");
if (TorService.ENABLE_DEBUG_LOG) if (TorService.ENABLE_DEBUG_LOG)
{ {
@ -533,22 +540,10 @@ public class TorTransProxy implements TorServiceConstants {
script.append(" || exit\n"); script.append(" || exit\n");
} }
// Reject DNS that is not from Tor (order is important - first matched rule counts!) // Reject all other outbound packets by default
script.append(ipTablesPath); script.append(ipTablesPath);
script.append(" -t filter"); script.append(" -t filter");
script.append(" -A OUTPUT"); script.append(" -P OUTPUT DROP");
script.append(" -p udp");
script.append(" --dport ");
script.append(STANDARD_DNS_PORT);
script.append(" -j REJECT");
script.append(" || exit\n");
// Reject all other outbound TCP packets
script.append(ipTablesPath);
script.append(" -t filter");
script.append(" -A OUTPUT");
script.append(" -p tcp");
script.append(" -j REJECT");
script.append(" || exit\n"); script.append(" || exit\n");
String[] cmdAdd = {script.toString()}; String[] cmdAdd = {script.toString()};