dan
/
tor-android
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

fixes for transproxy to fix DNS leaks in some cases 

latest RC was leaking DNS due to updates iptables/xtables binary
and need for new iptables rules format
This commit is contained in:
Nathan Freitas 2014-04-15 00:22:52 -04:00
parent 915ff8a7f3
commit c68ce2ce1e
1 changed files with 105 additions and 85 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

190
src/org/torproject/android/service/TorTransProxy.java
View File

@ -303,12 +303,24 @@ public class TorTransProxy implements TorServiceConstants {
logMessage("enabling transproxy for app: " + tApp.getUsername() + "(" + tApp.getUid() + ")"); logMessage("enabling transproxy for app: " + tApp.getUsername() + "(" + tApp.getUid() + ")");
// Allow loopback
script.append(ipTablesPath);
script.append(" -t filter");
script.append(" -A ").append(srcChainName);
script.append(" -m owner --uid-owner ");
script.append(tApp.getUid());
script.append(" -o lo");
script.append(" -j ACCEPT");
executeCommand (shell, script.toString());
script = new StringBuilder();
// Set up port redirection // Set up port redirection
script.append(ipTablesPath); script.append(ipTablesPath);
script.append(" -t nat"); script.append(" -t nat");
script.append(" -A ").append(srcChainName); script.append(" -A ").append(srcChainName);
script.append(" -p tcp"); script.append(" -p tcp");
script.append(" ! -d 127.0.0.1"); //allow access to localhost
script.append(" -m owner --uid-owner "); script.append(" -m owner --uid-owner ");
script.append(tApp.getUid()); script.append(tApp.getUid());
script.append(" -m tcp --syn"); script.append(" -m tcp --syn");
@ -320,20 +332,23 @@ public class TorTransProxy implements TorServiceConstants {
// Same for DNS // Same for DNS
script.append(ipTablesPath); script.append(ipTablesPath);
script.append(" -t nat"); script.append(" -t nat");
script.append(" -A ").append(srcChainName); script.append(" -A ").append(srcChainName);
script.append(" -p udp -m owner --uid-owner "); script.append(" -p udp");
script.append(" ! -d 127.0.0.1"); //allow access to localhost
script.append(" -m owner ! --uid-owner ");
script.append(tApp.getUid()); script.append(tApp.getUid());
script.append(" -m udp --dport "); script.append(" -m udp --dport ");
script.append(STANDARD_DNS_PORT); script.append(STANDARD_DNS_PORT);
script.append(" -j REDIRECT --to-ports "); script.append(" -j REDIRECT --to-ports ");
script.append(TOR_DNS_PORT); script.append(TOR_DNS_PORT);
executeCommand (shell, script.toString()); executeCommand (shell, script.toString());
script = new StringBuilder(); script = new StringBuilder();
int[] ports = {TOR_DNS_PORT,TOR_TRANSPROXY_PORT,PORT_SOCKS,PORT_HTTP}; int[] ports = {TOR_TRANSPROXY_PORT,PORT_SOCKS,PORT_HTTP};
for (int port : ports) for (int port : ports)
{ {
@ -341,57 +356,38 @@ public class TorTransProxy implements TorServiceConstants {
script.append(ipTablesPath); script.append(ipTablesPath);
script.append(" -t filter"); script.append(" -t filter");
script.append(" -A ").append(srcChainName); script.append(" -A ").append(srcChainName);
script.append(" -p tcp");
script.append(" -m owner --uid-owner "); script.append(" -m owner --uid-owner ");
script.append(tApp.getUid()); script.append(tApp.getUid());
script.append(" -p tcp");
script.append(" -d 127.0.0.1");
script.append(" --dport "); script.append(" --dport ");
script.append(port); script.append(port);
script.append(" -j ACCEPT"); script.append(" -j ACCEPT");
executeCommand (shell, script.toString()); executeCommand (shell, script.toString());
script = new StringBuilder(); script = new StringBuilder();
} }
// Allow loopback // Allow packets to localhost (contains all the port-redirected ones)
script.append(ipTablesPath); script.append(ipTablesPath);
script.append(" -t filter"); script.append(" -t filter");
script.append(" -A ").append(srcChainName); script.append(" -A ").append(srcChainName);
script.append(" -m owner --uid-owner ");
script.append(tApp.getUid());
script.append(" -p tcp");
script.append(" -o lo");
script.append(" -j ACCEPT");
executeCommand (shell, script.toString());
script = new StringBuilder();
// Reject all other outbound TCP packets
script.append(ipTablesPath);
script.append(" -t filter");
script.append(" -A ").append(srcChainName);
script.append(" -m owner --uid-owner ");
script.append(tApp.getUid());
script.append(" -p tcp");
script.append(" ! -d 127.0.0.1"); //allow access to localhost
script.append(" -j REJECT");
executeCommand (shell, script.toString());
script = new StringBuilder();
// Reject all other outbound UDP packets
script.append(ipTablesPath);
script.append(" -t filter");
script.append(" -A ").append(srcChainName);
script.append(" -m owner --uid-owner ");
script.append(tApp.getUid());
script.append(" -p udp"); script.append(" -p udp");
script.append(" ! -d 127.0.0.1"); //allow access to localhost script.append(" -m owner --uid-owner ");
script.append(" -j REJECT"); script.append(tApp.getUid());
script.append(" --dport ");
script.append(TOR_DNS_PORT);
script.append(" -j ACCEPT");
executeCommand (shell, script.toString());
script = new StringBuilder();
// Reject all other outbound packets
script.append(ipTablesPath);
script.append(" -t filter");
script.append(" -A ").append(srcChainName);
script.append(" -m owner --uid-owner ");
script.append(tApp.getUid());
script.append(" -j DROP");
lastExit = executeCommand (shell, script.toString()); lastExit = executeCommand (shell, script.toString());
script = new StringBuilder(); script = new StringBuilder();
@ -400,8 +396,6 @@ public class TorTransProxy implements TorServiceConstants {
} }
} }
fixTransproxyLeak (context);
shell.close(); shell.close();
return lastExit; return lastExit;
@ -546,8 +540,9 @@ public class TorTransProxy implements TorServiceConstants {
StringBuilder script = new StringBuilder(); StringBuilder script = new StringBuilder();
// Allow everything for Tor // Allow everything for Tor
script.append(ipTablesPath); script.append(ipTablesPath);
script.append(" -t filter"); script.append(" -t nat");
script.append(" -A ").append(srcChainName); script.append(" -A ").append(srcChainName);
script.append(" -m owner --uid-owner "); script.append(" -m owner --uid-owner ");
script.append(torUid); script.append(torUid);
@ -555,7 +550,17 @@ public class TorTransProxy implements TorServiceConstants {
executeCommand (shell, script.toString()); executeCommand (shell, script.toString());
script = new StringBuilder(); script = new StringBuilder();
// Allow loopback
script.append(ipTablesPath);
script.append(" -t nat");
script.append(" -A ").append(srcChainName);
script.append(" -o lo");
script.append(" -j ACCEPT");
executeCommand (shell, script.toString());
script = new StringBuilder();
// Set up port redirection // Set up port redirection
script.append(ipTablesPath); script.append(ipTablesPath);
@ -589,38 +594,6 @@ public class TorTransProxy implements TorServiceConstants {
script = new StringBuilder(); script = new StringBuilder();
/**
int[] ports = {TOR_DNS_PORT,TOR_TRANSPROXY_PORT,PORT_SOCKS,PORT_HTTP};
for (int port : ports)
{
// Allow packets to localhost (contains all the port-redirected ones)
script.append(ipTablesPath);
script.append(" -t filter");
script.append(" -A ").append(srcChainName);
script.append(" -m owner ! --uid-owner ");
script.append(torUid);
script.append(" -p tcp");
script.append(" -d 127.0.0.1");
script.append(" --dport ");
script.append(port);
script.append(" -j ACCEPT");
script.append(" || exit\n");
}**/
// Allow loopback
script.append(ipTablesPath);
script.append(" -t filter");
script.append(" -A ").append(srcChainName);
script.append(" -p tcp");
script.append(" -o lo");
script.append(" -j ACCEPT");
executeCommand (shell, script.toString());
script = new StringBuilder();
if (TorService.ENABLE_DEBUG_LOG) if (TorService.ENABLE_DEBUG_LOG)
{ {
//XXX: Comment the following rules for non-debug builds //XXX: Comment the following rules for non-debug builds
@ -650,32 +623,79 @@ public class TorTransProxy implements TorServiceConstants {
} }
// Reject all other outbound TCP packets //allow access to transproxy port
script.append(ipTablesPath); script.append(ipTablesPath);
script.append(" -t filter"); script.append(" -t filter");
script.append(" -A ").append(srcChainName); script.append(" -A ").append(srcChainName);
script.append(" -m owner ! --uid-owner ");
script.append(torUid);
script.append(" -p tcp"); script.append(" -p tcp");
script.append(" ! -d 127.0.0.1"); //allow access to localhost script.append(" -m tcp");
script.append(" -j REJECT"); script.append(" --dport ").append(TOR_TRANSPROXY_PORT);
script.append(" -j ACCEPT");
executeCommand (shell, script.toString()); executeCommand (shell, script.toString());
script = new StringBuilder(); script = new StringBuilder();
//allow access to local SOCKS port
script.append(ipTablesPath);
script.append(" -t filter");
script.append(" -A ").append(srcChainName);
script.append(" -p tcp");
script.append(" -m tcp");
script.append(" --dport ").append(PORT_SOCKS);
script.append(" -j ACCEPT");
executeCommand (shell, script.toString());
script = new StringBuilder();
//allow access to local SOCKS port
script.append(ipTablesPath);
script.append(" -t filter");
script.append(" -A ").append(srcChainName);
script.append(" -p tcp");
script.append(" -m tcp");
script.append(" --dport ").append(PORT_HTTP);
script.append(" -j ACCEPT");
executeCommand (shell, script.toString());
script = new StringBuilder();
//allow access to local DNS port
script.append(ipTablesPath);
script.append(" -t filter");
script.append(" -A ").append(srcChainName);
script.append(" -p udp");
script.append(" -m udp");
script.append(" --dport ").append(TOR_DNS_PORT);
script.append(" -j ACCEPT");
executeCommand (shell, script.toString());
script = new StringBuilder();
//allow access to local DNS port
script.append(ipTablesPath);
script.append(" -t filter");
script.append(" -A ").append(srcChainName);
script.append(" -p udp");
script.append(" -m udp");
script.append(" --dport ").append(TOR_DNS_PORT);
script.append(" -j ACCEPT");
executeCommand (shell, script.toString());
script = new StringBuilder();
// Reject all other outbound UDP packets // Reject all other outbound UDP packets
script.append(ipTablesPath); script.append(ipTablesPath);
script.append(" -t filter"); script.append(" -t filter");
script.append(" -A ").append(srcChainName); script.append(" -A ").append(srcChainName);
script.append(" -m owner ! --uid-owner "); script.append(" -m owner ! --uid-owner ");
script.append(torUid); script.append(torUid);
script.append(" -p udp"); script.append(" -j DROP");
script.append(" ! -d 127.0.0.1"); //allow access to localhost
script.append(" -j REJECT");
int lastExit = executeCommand (shell, script.toString()); int lastExit = executeCommand (shell, script.toString());
fixTransproxyLeak (context); fixTransproxyLeak (context);
shell.close(); shell.close();
return lastExit; return lastExit;