From efc6d95314660c2c4a33408f2775cdae0a3dca70 Mon Sep 17 00:00:00 2001
From: n8fr8 <nathan@freitas.net>
Date: Sun, 30 Sep 2012 23:57:59 +0530
Subject: [PATCH] fixing transproxy to set/clear on rule by rule basis

---
 src/org/torproject/android/Orbot.java         |  18 +-
 .../android/service/.TorServiceUtils.java.swp | Bin 16384 -> 0 bytes
 .../android/service/TorService.java           |  40 +--
 .../android/service/TorTransProxy.java        | 301 ++++++++++++++----
 .../android/settings/SettingsPreferences.java |   2 +-
 5 files changed, 265 insertions(+), 96 deletions(-)
 delete mode 100644 src/org/torproject/android/service/.TorServiceUtils.java.swp

diff --git a/src/org/torproject/android/Orbot.java b/src/org/torproject/android/Orbot.java
index 59112dae..d952cc4c 100644
--- a/src/org/torproject/android/Orbot.java
+++ b/src/org/torproject/android/Orbot.java
@@ -710,7 +710,6 @@ public class Orbot extends Activity implements TorConstants, OnLongClickListener
         	Message msg = Message.obtain();
 			msg.what = TorServiceConstants.MESSAGE_TRAFFIC_COUNT;
 			
-			
 			Bundle data = new Bundle();
 			data.putLong("upload", upload);
 			data.putLong("download", download);
@@ -775,12 +774,19 @@ public class Orbot extends Activity implements TorConstants, OnLongClickListener
             			Log.d(TAG,"Total bandwidth error"+e.getMessage());
             		}
             		
-            		downloadText.setText(formatCount(datacount.Download) + " / " + formatTotal(Long.parseLong(TotalDownload)));
-            		uploadText.setText(formatCount(datacount.Upload) + " / " + formatTotal(Long.parseLong(TotalUpload)));
+            		try
+            		{
+	            		downloadText.setText(formatCount(datacount.Download) + " / " + formatTotal(Long.parseLong(TotalDownload)));
+	            		uploadText.setText(formatCount(datacount.Upload) + " / " + formatTotal(Long.parseLong(TotalUpload)));
+	            		
+	            		downloadText.invalidate();
+	            		uploadText.invalidate();
+            		}
+            		catch (NumberFormatException nfe)
+            		{
+            			//just ignore/swallow
+            		}
             		
-            		downloadText.invalidate();
-            		uploadText.invalidate();
-           		 		
             		break;
                 		
                 default:
diff --git a/src/org/torproject/android/service/.TorServiceUtils.java.swp b/src/org/torproject/android/service/.TorServiceUtils.java.swp
deleted file mode 100644
index b9f0c9e0ec6e79dcdde9cea85e9f86f0419c1644..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 16384
zcmeI2ZHy#E8GxHR!5ifGI3m$#V%?zb?A_kX>;VB;E(&{lu*u%-dV2>Zcwo;=%}ld1
z-9vw{w_J|+N291Q3Py|uBPKx3gdeE<zyxDVH2&~|D3QcOBf$?yP!WyjAAR2HkLj6N
zIL;V9Vt4l0?&+$2yXvi~x9WYX8}%C(52`DxmsuPa^0()&%b(ryjCJ)}Ez7;C?O!GL
zPjj@KmfZ}U=4rB7cNu}TmcFCb8Pt3|@PeA>H@vVG_)V@lwb1hizIU5$hBe!5`JU6N
z1=_#EY3kY$&tHu%kA_Y!sNQDZVV~}WMS7uuLIXJsY_~4kJ6pfByi;Ag<7n=Faam}f
z&_JPqLIZ^c3Jnw*C^S%LpwPhog9gIE7VGa+bPL=IXC-Xqd=Ng9{N_{~g$4=@6dEWr
zP-vjgK%s#`1BC_(4HOzEG*D=u(7^ww2JDt)T|wDDCjkKV|0M=+-vyS{gZ(fMZ-)!u
zrSmQ8Nq7W44j+SC;TBkc{csMP4O`)7+b!#9cnVIzL-0lTJgmdJVG1sR9q^0uEbF`Q
z7(5DhgAaW;4BOzvH(1us;VJkwJOPix{csmt0kiOC_~E&v!J}{rz62kFS$MHzSuenI
z@FaW+ZiK_I3>U(7I2Zo5&9eRie}<RfTkr&Y1s;Y6;C{Fr`tUy31JiIZTmai(D?I&r
z%la{V10Dkx9MI5!_rf7qf-B(pb1dsO@GLwDKY&y40DKfa3`b!Xyl^&UgRj8~Tn?AP
z7I^t}mi2ph27U@(hTGu-a1>@>C;WuK&-dV)@F<*ud*IXXN%#b8z${c@H@pen2rtry
zo`WC3_u)a1esv$5@u6~um0t64NOL7n`;=eR$91!^dc(rf(yj9c_usm*Iz4BVO8l*m
zM+bq*^14y4Cut%?G8~TF(CKUCBPY48c669rR#G{R8yXplE%NP|jisNkN`t7;bDAm$
zZ9aKXlB?~wt>mqXt(%;%yRuqY4SmP$sHWHN^Cio)3cJ3y9;k)mO+5%5&$UXmS`=tC
zH3+8CTo$D}X=Ro5br|_>Qii$oc6z2VN@YJzW>-ic!5pR1@S~Y(&+B9_uaqO#ZuGPY
zJvFd>iXqA}N^@FQtFqdydXB4SG`dJ+snUtzWz!CuT~#?0^&8qh;Q4(!%w#J)J<OOd
zOT*XpT25X`-f5J(=!UwZ{i-PnKPvL_DhljZrt>90WntF|OxaY>^`c%&-4+F*YEYBz
zuo6ydSb|)sLw_T?pIr>o*SiiHshF2b57TywGRbL);!u*E`=lpL4;v_HV<{~U#NA9K
z$8}M=t$p1(Y{VqeB$r-SqiGenwdf9_5P90}$4^w^?kgQLmqsaa3XxY?$@^5T7C#|H
zpBNmA`<D-xem$N?-W^xt=40waZaB#kGpb<+`jFk%C(XmPTH85JXLV_sMilCn>TjsN
zv*rcLbJgDZY`r?Ww>n#Aj3uf`pHC`&01a2tAt6;0+1Y?wN&6sYGsyn~1J`LSx6feg
zIxVj~HhfE^v2kmR(n)l}$mCyX$?H_tD~!x}&&7ziVNgAC?e#O|quG!|F=jw2r={AS
z9}mbxZ8LhWX$yuUvXX(A8+?1Ghi{U`HUn%k1C=&|*tJ-gjF0$oQmjagi~rh%I&Eco
zu@pfps41De?Nvk={pX7&)r<?q#iU6-y*-|2O|i0KXS0TC+r2=G8sfiEn|TncXm@m_
zJa5d6>xIg0-X1wV^M}Wef%f}O5Ma@RvS}EE7)2$vs;_M~z&hEXm?)mYez{)!EY=sx
z)wNry;))UN^)`%-MoW-2Zl%27`<}0wUEN%h$%VcV3$mMHyvxR3Z`LWMm8j7ai}Neb
z3a?FmYKG6WYAW#5x>oC+I~6LXBW1fA*mJidWm8F?TU^fS%S>X*9a}gu$%RzH+(^zP
zOsknDLq9T&I9|Q10Znu1<4zC;7`7;+8A26AG>P5t_&L#%CF#IC5YBro4E#P-kIN(d
z#B{}Bni@7){B>%}TkYyzZ$6&>E6sjuMyfocOlO->QrdVNXV#ZIn8_1m<{>86AS$1f
zK8dpDrM*pKPX*DGYB;X#ZzxF<Osi&nd8h?Vr<U|ADeLAGK3}n&QZbWLhS$HOPKo(v
zN=Yk~RYy9ad4HR^VD%_7l{5(Rn%s}?<tK}BE!YS`-LFyW8bV^7nbMB8yHx57h1!Dw
zLTPwbVt&;gto<|cWm01aD7D$N<nof$O<q!~skmh+_(;060XmUN0>;mb0xsjOa$V%~
zSecj+6t5>n?x)i!iXL65HaxF~F~R^H#&E587%i576%=n-NzP`^X5l>6mzC2W^mJb{
zQRR}d$&12S<nVk9WBkc>HR1#9D%0FtmcqB))iC?EyP9U?O_`iwX8E!^mJwI%h_|L)
z=T7a<r7to$9Iv_@h1s&{Cf^A+$&y<<#S5zmAvudPktS_BadUL}M!5%ebB#Gdy+SRM
zFWBd-+Ag)KwOU%7UpTb7U`8~agmwcl=8lUwXCci@qIT6J@4PqI@SRRKRF&p5%d7gk
zX4D~@sl-(WeC>obc5GQbpI0??gyrw`k?pq}Qdi<n=+z$84a33JwVF3Tfi2BES7mOk
zb<&KyNBsW>@iTviZz}%(K~7)5*Z&}_!vVMk&WEk=GJgHza1VS0mf%{b!#m(DumjG8
zv*3CB`sd)+@GLw74z!^OOK>Gz4hsH=kN;bE9KH@6xCQF)PIv^r{vo&<2GE9Ma07_n
zUj_vi!FDLYukiPO3EzP`VGZ5`7r}Y34I~!uRd^Uq!Xa3M1(<?M;cajUNL=7g=u2V&
ze*n?l3s4+|1_})n8YnbSXrR!*f1?I)mL>zNsmn8rO<Kmo<R6Rf%xg}wvB;MIMs?kG
zLSmosdRtcNi7O_4h<La7RVH323w3-8mSC+)BWlm6`iuz&#;!~nbtLlF+9&^#n4@H!
zo)#elPK*OUT!}1o;}pgj6L(``iEE-R5?(X@Jd0?eiYAgu8O7@$RuK{ZmXK*V2zjGl
zmg4^#svsU_t{M|1AB~evBxe=NrMybT@anUQ5dyP&gidT9-@lD#8oN$%<L24=F{4!!
zAnvI&VA8na9F<DQskVDj(2d(#ey)qRQ7KEGc)u%NW7=az@}@Vl)Lc9~CuLNEd0i|Y
z?>V^HIhKg0g;IfIA)GA6A)6w2U$_&2gdfEHPNIjgBm(>8Ips(0wZ;kDCz1Z_mq|=2
zZc<Vu3~M)xmP_oZBF*Wb$@(0pYvgS~wWr-q*yYCV-NTIlQ}ELAguABDLedhGiCJss
zlT34q8e)+qmWYJS_Hp7Ucsb~%?Nc%_5qUU{L7wJ06KycLrAK6HqEASt7z>uf8$@_s
z+1``XE7^Inq+gAC<MQ}ekSO+c<Ddzy-H2Bo2ai%0J}V1>ti-EN+lo;=zR?tiJB_}i
zHe=ywxh02X{twUD4MJ{7lET7em!*mQoLrh1$j!HQg0Sl9<Dv2CE7O~8^5n#fW}Zv-
zIFz^UYCo54EKI=GT+*k;63o`lOj)J<LF$qpRKwnFY=GH?Vrx$yXHQ^CO));w$n?&A
v63&+A<rqGfTJvN}C^plZ?IFbv=CmCbHQw4vJ5HKuG~h65BS+KDd@t!A8j`70

diff --git a/src/org/torproject/android/service/TorService.java b/src/org/torproject/android/service/TorService.java
index 23921a98..73c0d717 100644
--- a/src/org/torproject/android/service/TorService.java
+++ b/src/org/torproject/android/service/TorService.java
@@ -55,7 +55,7 @@ import android.util.Log;
 public class TorService extends Service implements TorServiceConstants, TorConstants, Runnable, EventHandler
 {
 	
-	public static boolean ENABLE_DEBUG_LOG = true;
+	public static boolean ENABLE_DEBUG_LOG = false;
 	
 	private static int currentStatus = STATUS_OFF;
 		
@@ -85,6 +85,8 @@ public class TorService extends Service implements TorServiceConstants, TorConst
     private File filePrivoxy;
     private File fileObfsProxy;
     
+    private TorTransProxy mTransProxy;
+    private boolean mTransProxyAll = false;
     
     public static void logMessage(String msg)
     {
@@ -611,54 +613,53 @@ public class TorService extends Service implements TorServiceConstants, TorConst
  		boolean hasRoot = prefs.getBoolean(PREF_HAS_ROOT,false);
  		boolean enableTransparentProxy = prefs.getBoolean("pref_transparent", false);
  		
- 		TorTransProxy ttProxy = new TorTransProxy();
+ 		if (mTransProxy == null)
+ 			mTransProxy = new TorTransProxy();
  		
  		if (hasRoot && enableTransparentProxy)
     	{
 	 		
-	 		boolean transProxyAll = prefs.getBoolean("pref_transparent_all", false);
-	 		boolean transProxyPortFallback = prefs.getBoolean("pref_transparent_port_fallback", false);
+	 		mTransProxyAll = prefs.getBoolean("pref_transparent_all", false);
 	 		boolean transProxyTethering = prefs.getBoolean("pref_transparent_tethering", false);
 	 		
 	     	TorService.logMessage ("Transparent Proxying: " + enableTransparentProxy);
 	     	
-	     	String portProxyList = prefs.getString("pref_port_list", "");
+	     	//String portProxyList = prefs.getString("pref_port_list", "");
 	
 	 		
  			//TODO: Find a nice place for the next (commented) line
 			//TorTransProxy.setDNSProxying(); 
 			
 			int code = 0; // Default state is "okay"
-				
+			/*	
 			if(transProxyPortFallback)
 			{
-				
 				showToolbarNotification(getString(R.string.setting_up_port_based_transparent_proxying_), TRANSPROXY_NOTIFY_ID, R.drawable.ic_stat_notify, -1);
 				StringTokenizer st = new StringTokenizer(portProxyList, ",");
 				int status = code;
 				while (st.hasMoreTokens())
 				{
-					status = ttProxy.setTransparentProxyingByPort(this, Integer.parseInt(st.nextToken()));
+					status = mTransProxy.setTransparentProxyingByPort(this, Integer.parseInt(st.nextToken()));
 					if(status != 0)
 						code = status;
 				}
 			}
 			else
-			{
-				if(transProxyAll)
+			{*/
+				if(mTransProxyAll)
 				{
 					showToolbarNotification(getString(R.string.setting_up_full_transparent_proxying_), TRANSPROXY_NOTIFY_ID, R.drawable.ic_stat_notify, -1);
 
-					code = ttProxy.setTransparentProxyingAll(this);
+					code = mTransProxy.setTransparentProxyingAll(this);
 				}
 				else
 				{
 					showToolbarNotification(getString(R.string.setting_up_app_based_transparent_proxying_), TRANSPROXY_NOTIFY_ID, R.drawable.ic_stat_notify, -1);
 
-					code = ttProxy.setTransparentProxyingByApp(this,AppManager.getApps(this));
+					code = mTransProxy.setTransparentProxyingByApp(this,AppManager.getApps(this));
 				}
 				
-			}
+			//}
 		
 			TorService.logMessage ("TorTransProxy resp code: " + code);
 			
@@ -670,7 +671,7 @@ public class TorService extends Service implements TorServiceConstants, TorConst
 				{
 					showToolbarNotification(getString(R.string.transproxy_enabled_for_tethering_), TRANSPROXY_NOTIFY_ID, R.drawable.ic_stat_notify, -1);
 
-					ttProxy.enableTetheringRules(this);
+					mTransProxy.enableTetheringRules(this);
 					  
 				}
 			}
@@ -699,14 +700,16 @@ public class TorService extends Service implements TorServiceConstants, TorConst
  		boolean hasRoot = prefs.getBoolean(PREF_HAS_ROOT,false);
  		boolean enableTransparentProxy = prefs.getBoolean("pref_transparent", false);
  		
- 		
  		if (hasRoot && enableTransparentProxy)
     	{
 	 		
 	     	TorService.logMessage ("Clearing TransProxy rules");
 	     	
-	     	new TorTransProxy().flushIptables(this);
-	     	
+	     	if (mTransProxyAll)
+	     		mTransProxy.clearTransparentProxyingAll(this);
+	     	else
+	    		mTransProxy.clearTransparentProxyingByApp(this,AppManager.getApps(this));
+		     		
 			showToolbarNotification(getString(R.string.transproxy_rules_cleared), TRANSPROXY_NOTIFY_ID, R.drawable.ic_stat_notify, -1);
 
 	     	
@@ -1185,7 +1188,6 @@ public class TorService extends Service implements TorServiceConstants, TorConst
     	
     	prefPersistNotifications = prefs.getBoolean(TorConstants.PREF_PERSIST_NOTIFICATIONS, true);
     	
-    	
     	new Thread ()
     	{
     		
@@ -1499,7 +1501,7 @@ public class TorService extends Service implements TorServiceConstants, TorConst
     	
     	SharedPreferences prefs = PreferenceManager.getDefaultSharedPreferences(this);
 		
-    	ENABLE_DEBUG_LOG = prefs.getBoolean("pref_enable_logging",true);
+    	ENABLE_DEBUG_LOG = prefs.getBoolean("pref_enable_logging",false);
     	Log.i(TAG,"debug logging:" + ENABLE_DEBUG_LOG);
     		
 		boolean useBridges = prefs.getBoolean(TorConstants.PREF_BRIDGES_ENABLED, false);
diff --git a/src/org/torproject/android/service/TorTransProxy.java b/src/org/torproject/android/service/TorTransProxy.java
index 5269a495..18eec844 100644
--- a/src/org/torproject/android/service/TorTransProxy.java
+++ b/src/org/torproject/android/service/TorTransProxy.java
@@ -17,9 +17,8 @@ public class TorTransProxy implements TorServiceConstants {
 
 	public String getIpTablesPath (Context context)
 	{
-	
-		if (ipTablesPath == null)
-		{
+		android.os.Debug.waitForDebugger();
+		
 			SharedPreferences prefs = PreferenceManager.getDefaultSharedPreferences(context);
 			
 			if (prefs.getBoolean(TorConstants.PREF_USE_SYSTEM_IPTABLES, false))
@@ -50,13 +49,12 @@ public class TorTransProxy implements TorServiceConstants {
 				ipTablesPath = new File(context.getDir("bin", 0),"iptables").getAbsolutePath();
 			}
 			
-		}
 			
 		return ipTablesPath;
 		
 	}
 	
-	public int flushIptables(Context context) throws Exception {
+	public int flushIptablesAll(Context context) throws Exception {
 		
 		String ipTablesPath = getIpTablesPath(context);
 	
@@ -220,19 +218,10 @@ public class TorTransProxy implements TorServiceConstants {
     	StringBuilder res = new StringBuilder();
     	int code = -1;
     	
-    	flushIptables(context);
+    //	flushIptables(context);
 				
     	int torUid = context.getApplicationInfo().uid;
 
-		// Allow everything for Tor
-		script.append(ipTablesPath);
-		script.append(" -t filter");
-		script.append(" -A OUTPUT");
-		script.append(" -m owner --uid-owner ");
-		script.append(torUid);
-		script.append(" -j ACCEPT");
-		script.append(" || exit\n");
-
 		//build up array of shell cmds to execute under one root context
 		for (TorifiedApp tApp:apps)
 		{
@@ -244,11 +233,12 @@ public class TorTransProxy implements TorServiceConstants {
 			{
 				
 				TorService.logMessage("enabling transproxy for app: " + tApp.getUsername() + "(" + tApp.getUid() + ")");
-
-			 	// Set up port redirection
-				script.append(ipTablesPath);
+			 
+				// Set up port redirection
+		    	script.append(ipTablesPath);
+				script.append(" -A OUTPUT");
 				script.append(" -t nat");
-				script.append(" -A OUTPUT -p tcp");
+				script.append(" -p tcp");
 				script.append(" ! -d 127.0.0.1"); //allow access to localhost
 				script.append(" -m owner --uid-owner ");
 				script.append(tApp.getUid());
@@ -259,37 +249,24 @@ public class TorTransProxy implements TorServiceConstants {
 				
 				// Same for DNS
 				script.append(ipTablesPath);
+				script.append(" -A OUTPUT");
 				script.append(" -t nat");
-				script.append(" -A OUTPUT -p udp");
-				script.append(" -m owner --uid-owner ");
+				script.append(" -p udp -m owner --uid-owner ");
 				script.append(tApp.getUid());
 				script.append(" -m udp --dport "); 
 				script.append(STANDARD_DNS_PORT);
 				script.append(" -j REDIRECT --to-ports ");
 				script.append(TOR_DNS_PORT);
 				script.append(" || exit\n");
-
-				// Allow loopback
-				script.append(ipTablesPath);
-				script.append(" -t filter");
-				script.append(" -A OUTPUT");
-				script.append(" -m owner --uid-owner ");
-				script.append(tApp.getUid());
-				script.append(" -o lo");
-				script.append(" -j ACCEPT");
-				script.append(" || exit\n");
-
-				/* 	
-				//Outgoing loopback already allowed (23/7/12)
-
+				
 				int[] ports = {TOR_DNS_PORT,TOR_TRANSPROXY_PORT,PORT_SOCKS,PORT_HTTP};
 				
 				for (int port : ports)
 				{
 					// Allow packets to localhost (contains all the port-redirected ones)
 					script.append(ipTablesPath);
-					script.append(" -t filter");
 					script.append(" -A OUTPUT");
+					script.append(" -t filter");
 					script.append(" -m owner --uid-owner ");
 					script.append(tApp.getUid());
 					script.append(" -p tcp");
@@ -299,12 +276,34 @@ public class TorTransProxy implements TorServiceConstants {
 					script.append(" -j ACCEPT");
 					script.append(" || exit\n");				
 				}
-				*/
-
+				
+				// Allow loopback
+				script.append(ipTablesPath);
+				script.append(" -A OUTPUT");
+				script.append(" -t filter");
+				script.append(" -m owner --uid-owner ");
+				script.append(tApp.getUid());
+				script.append(" -p tcp");
+				script.append(" -o lo");
+				script.append(" -j ACCEPT");
+				script.append(" || exit\n");
+				
+				// Reject DNS that is not from Tor (order is important - first matched rule counts!)
+				script.append(ipTablesPath);
+				script.append(" -A OUTPUT");
+				script.append(" -t filter");
+				script.append(" -m owner --uid-owner ");
+				script.append(tApp.getUid());
+				script.append(" -p udp");
+				script.append(" --dport ");
+				script.append(STANDARD_DNS_PORT);
+				script.append(" -j REJECT");
+				script.append(" || exit\n");
+				
 				// Reject all other outbound TCP packets
 				script.append(ipTablesPath);
-				script.append(" -t filter");
 				script.append(" -A OUTPUT");
+				script.append(" -t filter");
 				script.append(" -m owner --uid-owner ");
 				script.append(tApp.getUid());
 				script.append(" -p tcp");
@@ -317,8 +316,8 @@ public class TorTransProxy implements TorServiceConstants {
 
 		// Allow everything for Tor
 		script.append(ipTablesPath);
-		script.append(" -t filter");
 		script.append(" -A OUTPUT");
+		script.append(" -t filter");
 		script.append(" -m owner --uid-owner ");
 		script.append(torUid);
 		script.append(" -j ACCEPT");
@@ -330,10 +329,108 @@ public class TorTransProxy implements TorServiceConstants {
 		String msg = res.toString();
 		TorService.logMessage(cmdAdd[0] + ";errCode=" + code + ";resp=" + msg);
 		
-		
 		return code;
     }	
 	
+	public int clearTransparentProxyingByApp(Context context, ArrayList<TorifiedApp> apps) throws Exception
+	{
+
+		boolean runRoot = true;
+    	boolean waitFor = true;
+    	
+		//redirectDNSResolvConf(); //not working yet
+		
+		String ipTablesPath = getIpTablesPath(context);
+		
+    	StringBuilder script = new StringBuilder();
+    	
+    	StringBuilder res = new StringBuilder();
+    	int code = -1;
+    	
+    	int torUid = context.getApplicationInfo().uid;
+
+		//build up array of shell cmds to execute under one root context
+		for (TorifiedApp tApp:apps)
+		{
+
+			if (tApp.isTorified()
+					&& (!tApp.getUsername().equals(TorServiceConstants.TOR_APP_USERNAME))
+					&& (!tApp.getUsername().equals(TorServiceConstants.ORWEB_APP_USERNAME))
+					) //if app is set to true
+			{
+				
+				TorService.logMessage("clear transproxy for app: " + tApp.getUsername() + "(" + tApp.getUid() + ")");
+			 
+				// Set up port redirection
+		    	script.append(ipTablesPath);
+				script.append(" -D OUTPUT");
+				script.append(" -t nat");
+				script.append(" -p tcp");
+				script.append(" ! -d 127.0.0.1"); //allow access to localhost
+				script.append(" -m owner --uid-owner ");
+				script.append(tApp.getUid());
+				script.append(" -m tcp --syn");
+				script.append(" -j REDIRECT --to-ports ");
+				script.append(TOR_TRANSPROXY_PORT);
+				script.append(" || exit\n");
+				
+				// Same for DNS
+				script.append(ipTablesPath);
+				script.append(" -D OUTPUT");
+				script.append(" -t nat");
+				script.append(" -p udp -m owner --uid-owner ");
+				script.append(tApp.getUid());
+				script.append(" -m udp --dport "); 
+				script.append(STANDARD_DNS_PORT);
+				script.append(" -j REDIRECT --to-ports ");
+				script.append(TOR_DNS_PORT);
+				script.append(" || exit\n");
+				
+				// Reject DNS that is not from Tor (order is important - first matched rule counts!)
+				script.append(ipTablesPath);
+				script.append(" -D OUTPUT");
+				script.append(" -t filter");
+				script.append(" -m owner --uid-owner ");
+				script.append(tApp.getUid());
+				script.append(" -p udp");
+				script.append(" --dport ");
+				script.append(STANDARD_DNS_PORT);
+				script.append(" -j REJECT");
+				script.append(" || exit\n");
+				
+				// Reject all other outbound TCP packets
+				script.append(ipTablesPath);
+				script.append(" -D OUTPUT");
+				script.append(" -t filter");
+				script.append(" -m owner --uid-owner ");
+				script.append(tApp.getUid());
+				script.append(" -p tcp");
+				script.append(" -j REJECT");
+				script.append(" || exit\n");
+				
+			}		
+		}			
+		
+
+		// Allow everything for Tor
+		script.append(ipTablesPath);
+		script.append(" -D OUTPUT");
+		script.append(" -t filter");
+		script.append(" -m owner --uid-owner ");
+		script.append(torUid);
+		script.append(" -j ACCEPT");
+		script.append(" || exit\n");
+		
+		String[] cmdAdd = {script.toString()};    	
+    		
+		code = TorServiceUtils.doShellCommand(cmdAdd, res, runRoot, waitFor);
+		String msg = res.toString();
+		TorService.logMessage(cmdAdd[0] + ";errCode=" + code + ";resp=" + msg);
+		
+		return code;
+    }	
+	/*
+	// this is a bad idea so removing
 	public int setTransparentProxyingByPort(Context context, int port) throws Exception
 	{
 
@@ -348,7 +445,7 @@ public class TorTransProxy implements TorServiceConstants {
     	
     	StringBuilder res = new StringBuilder();
     	int code = -1;
-    	flushIptables(context);
+    	//flushIptables(context);
 		
 		//TCP
 		//iptables -t nat -A PREROUTING -i eth0 -p tcp --dport $srcPortNumber -j REDIRECT --to-port $dstPortNumbe
@@ -390,7 +487,8 @@ public class TorTransProxy implements TorServiceConstants {
 		
 		return code;
     }
-
+	*/
+	
 	public int enableTetheringRules (Context context) throws Exception
 	{
 		
@@ -447,12 +545,12 @@ public class TorTransProxy implements TorServiceConstants {
     	StringBuilder res = new StringBuilder();
     	int code = -1;
     	
-    	flushIptables(context);
+    	//flushIptables(context);
     	
     	int torUid = context.getApplicationInfo().uid;
 
-		// Set up port redirection
-		script.append(ipTablesPath);
+    	// Set up port redirection
+    	script.append(ipTablesPath);
 		script.append(" -t nat");
 		script.append(" -A OUTPUT -p tcp");
 		script.append(" ! -d 127.0.0.1"); //allow access to localhost
@@ -466,36 +564,14 @@ public class TorTransProxy implements TorServiceConstants {
 		// Same for DNS
 		script.append(ipTablesPath);
 		script.append(" -t nat");
-		script.append(" -A OUTPUT -p udp");
-		script.appent(" -m owner ! --uid-owner ");
+		script.append(" -A OUTPUT -p udp -m owner ! --uid-owner ");
 		script.append(torUid);
 		script.append(" -m udp --dport "); 
 		script.append(STANDARD_DNS_PORT);
 		script.append(" -j REDIRECT --to-ports ");
 		script.append(TOR_DNS_PORT);
 		script.append(" || exit\n");
-
-		// Allow loopback
-		script.append(ipTablesPath);
-		script.append(" -t filter");
-		script.append(" -A OUTPUT");
-		script.append(" -o lo");
-		script.append(" -j ACCEPT");
-		script.append(" || exit\n");
 		
-		// Allow everything for Tor
-		script.append(ipTablesPath);
-		script.append(" -t filter");
-		script.append(" -A OUTPUT");
-		script.append(" -m owner --uid-owner ");
-		script.append(torUid);
-		script.append(" -j ACCEPT");
-		script.append(" || exit\n");
-	
-
-		/* 	
-		//Outgoing loopback already allowed (23/7/12)
-
 		int[] ports = {TOR_DNS_PORT,TOR_TRANSPROXY_PORT,PORT_SOCKS,PORT_HTTP};
 		
 		for (int port : ports)
@@ -513,8 +589,25 @@ public class TorTransProxy implements TorServiceConstants {
 			script.append(" -j ACCEPT");
 			script.append(" || exit\n");
 		
-		} */
+		}
 		
+		// Allow loopback
+		script.append(ipTablesPath);
+		script.append(" -t filter");
+		script.append(" -A OUTPUT");
+		script.append(" -p tcp");
+		script.append(" -o lo");
+		script.append(" -j ACCEPT");
+		script.append(" || exit\n");
+		
+		// Allow everything for Tor
+		script.append(ipTablesPath);
+		script.append(" -t filter");
+		script.append(" -A OUTPUT");
+		script.append(" -m owner --uid-owner ");
+		script.append(torUid);
+		script.append(" -j ACCEPT");
+		script.append(" || exit\n");
 		
 		if (TorService.ENABLE_DEBUG_LOG)
 		{
@@ -563,6 +656,74 @@ public class TorTransProxy implements TorServiceConstants {
 		String msg = res.toString();
 		TorService.logMessage(cmdAdd[0] + ";errCode=" + code + ";resp=" + msg);
 		
+    	return code;
+	}	
+	
+	public int clearTransparentProxyingAll(Context context) throws Exception 
+	{
+		boolean runRoot = true;
+    	boolean waitFor = true;
+    	
+		//redirectDNSResolvConf(); //not working yet
+		
+		String ipTablesPath = getIpTablesPath(context);
+		
+    	StringBuilder script = new StringBuilder();
+    	
+    	StringBuilder res = new StringBuilder();
+    	int code = -1;
+    	
+    	
+    	int torUid = context.getApplicationInfo().uid;
+
+    	// Set up port redirection
+    	script.append(ipTablesPath);
+		script.append(" -D OUTPUT -p tcp");
+		script.append(" -t nat");
+		script.append(" ! -d 127.0.0.1"); //allow access to localhost
+		script.append(" -m owner ! --uid-owner ");
+		script.append(torUid);
+		script.append(" -m tcp --syn");
+		script.append(" -j REDIRECT --to-ports ");
+		script.append(TOR_TRANSPROXY_PORT);
+		script.append(" || exit\n");
+		
+		// Same for DNS
+		script.append(ipTablesPath);
+		script.append(" -D OUTPUT");
+		script.append(" -t nat");
+		script.append(" -p udp -m owner ! --uid-owner ");
+		script.append(torUid);
+		script.append(" -m udp --dport "); 
+		script.append(STANDARD_DNS_PORT);
+		script.append(" -j REDIRECT --to-ports ");
+		script.append(TOR_DNS_PORT);
+		script.append(" || exit\n");
+		
+		// Reject DNS that is not from Tor (order is important - first matched rule counts!)
+		script.append(ipTablesPath);
+		script.append(" -D OUTPUT");
+		script.append(" -t filter");
+		script.append(" -p udp");
+		script.append(" --dport ");
+		script.append(STANDARD_DNS_PORT);
+		script.append(" -j REJECT");
+		script.append(" || exit\n");
+		
+		// Reject all other outbound TCP packets
+		script.append(ipTablesPath);
+		script.append(" -D OUTPUT");
+		script.append(" -t filter");
+		script.append(" -p tcp");
+		script.append(" -j REJECT");
+		script.append(" || exit\n");
+		
+		String[] cmdAdd = {script.toString()};    	
+    	
+		code = TorServiceUtils.doShellCommand(cmdAdd, res, runRoot, waitFor);
+		String msg = res.toString();
+		TorService.logMessage(cmdAdd[0] + ";errCode=" + code + ";resp=" + msg);
+		
     	
     	
     	return code;
diff --git a/src/org/torproject/android/settings/SettingsPreferences.java b/src/org/torproject/android/settings/SettingsPreferences.java
index afac094b..46a2211e 100644
--- a/src/org/torproject/android/settings/SettingsPreferences.java
+++ b/src/org/torproject/android/settings/SettingsPreferences.java
@@ -203,7 +203,7 @@ public class SettingsPreferences
 	private void clearTransProxyState ()
 	{
 		try {
-			new TorTransProxy().flushIptables(this);
+			new TorTransProxy().clearTransparentProxyingAll(this);
 		} catch (Exception e) {
 			Log.e(TorConstants.TAG,"error flushing iptables",e);
 		}