dan
/
tor-android
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

fixing transproxy to set/clear on rule by rule basis

This commit is contained in:
n8fr8 2012-09-30 23:57:59 +05:30
parent 1d8efbfca4
commit efc6d95314
5 changed files with 265 additions and 96 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
src/org/torproject/android/Orbot.java
View File

@ -710,7 +710,6 @@ public class Orbot extends Activity implements TorConstants, OnLongClickListener
Message msg = Message.obtain(); Message msg = Message.obtain();
msg.what = TorServiceConstants.MESSAGE_TRAFFIC_COUNT; msg.what = TorServiceConstants.MESSAGE_TRAFFIC_COUNT;
Bundle data = new Bundle(); Bundle data = new Bundle();
data.putLong("upload", upload); data.putLong("upload", upload);
data.putLong("download", download); data.putLong("download", download);
@ -775,11 +774,18 @@ public class Orbot extends Activity implements TorConstants, OnLongClickListener
Log.d(TAG,"Total bandwidth error"+e.getMessage()); Log.d(TAG,"Total bandwidth error"+e.getMessage());
} }
downloadText.setText(formatCount(datacount.Download) + " / " + formatTotal(Long.parseLong(TotalDownload))); try
uploadText.setText(formatCount(datacount.Upload) + " / " + formatTotal(Long.parseLong(TotalUpload))); {
downloadText.setText(formatCount(datacount.Download) + " / " + formatTotal(Long.parseLong(TotalDownload)));
uploadText.setText(formatCount(datacount.Upload) + " / " + formatTotal(Long.parseLong(TotalUpload)));
downloadText.invalidate(); downloadText.invalidate();
uploadText.invalidate(); uploadText.invalidate();
}
catch (NumberFormatException nfe)
{
//just ignore/swallow
}
break; break;

BIN
src/org/torproject/android/service/.TorServiceUtils.java.swp
View File

Binary file not shown.

38
src/org/torproject/android/service/TorService.java
View File

@ -55,7 +55,7 @@ import android.util.Log;
public class TorService extends Service implements TorServiceConstants, TorConstants, Runnable, EventHandler public class TorService extends Service implements TorServiceConstants, TorConstants, Runnable, EventHandler
{ {
public static boolean ENABLE_DEBUG_LOG = true; public static boolean ENABLE_DEBUG_LOG = false;
private static int currentStatus = STATUS_OFF; private static int currentStatus = STATUS_OFF;
@ -85,6 +85,8 @@ public class TorService extends Service implements TorServiceConstants, TorConst
private File filePrivoxy; private File filePrivoxy;
private File fileObfsProxy; private File fileObfsProxy;
private TorTransProxy mTransProxy;
private boolean mTransProxyAll = false;
public static void logMessage(String msg) public static void logMessage(String msg)
{ {
@ -611,54 +613,53 @@ public class TorService extends Service implements TorServiceConstants, TorConst
boolean hasRoot = prefs.getBoolean(PREF_HAS_ROOT,false); boolean hasRoot = prefs.getBoolean(PREF_HAS_ROOT,false);
boolean enableTransparentProxy = prefs.getBoolean("pref_transparent", false); boolean enableTransparentProxy = prefs.getBoolean("pref_transparent", false);
TorTransProxy ttProxy = new TorTransProxy(); if (mTransProxy == null)
mTransProxy = new TorTransProxy();
if (hasRoot && enableTransparentProxy) if (hasRoot && enableTransparentProxy)
{ {
boolean transProxyAll = prefs.getBoolean("pref_transparent_all", false); mTransProxyAll = prefs.getBoolean("pref_transparent_all", false);
boolean transProxyPortFallback = prefs.getBoolean("pref_transparent_port_fallback", false);
boolean transProxyTethering = prefs.getBoolean("pref_transparent_tethering", false); boolean transProxyTethering = prefs.getBoolean("pref_transparent_tethering", false);
TorService.logMessage ("Transparent Proxying: " + enableTransparentProxy); TorService.logMessage ("Transparent Proxying: " + enableTransparentProxy);
String portProxyList = prefs.getString("pref_port_list", ""); //String portProxyList = prefs.getString("pref_port_list", "");
//TODO: Find a nice place for the next (commented) line //TODO: Find a nice place for the next (commented) line
//TorTransProxy.setDNSProxying(); //TorTransProxy.setDNSProxying();
int code = 0; // Default state is "okay" int code = 0; // Default state is "okay"
/*
if(transProxyPortFallback) if(transProxyPortFallback)
{ {
showToolbarNotification(getString(R.string.setting_up_port_based_transparent_proxying_), TRANSPROXY_NOTIFY_ID, R.drawable.ic_stat_notify, -1); showToolbarNotification(getString(R.string.setting_up_port_based_transparent_proxying_), TRANSPROXY_NOTIFY_ID, R.drawable.ic_stat_notify, -1);
StringTokenizer st = new StringTokenizer(portProxyList, ","); StringTokenizer st = new StringTokenizer(portProxyList, ",");
int status = code; int status = code;
while (st.hasMoreTokens()) while (st.hasMoreTokens())
{ {
status = ttProxy.setTransparentProxyingByPort(this, Integer.parseInt(st.nextToken())); status = mTransProxy.setTransparentProxyingByPort(this, Integer.parseInt(st.nextToken()));
if(status != 0) if(status != 0)
code = status; code = status;
} }
} }
else else
{ {*/
if(transProxyAll) if(mTransProxyAll)
{ {
showToolbarNotification(getString(R.string.setting_up_full_transparent_proxying_), TRANSPROXY_NOTIFY_ID, R.drawable.ic_stat_notify, -1); showToolbarNotification(getString(R.string.setting_up_full_transparent_proxying_), TRANSPROXY_NOTIFY_ID, R.drawable.ic_stat_notify, -1);
code = ttProxy.setTransparentProxyingAll(this); code = mTransProxy.setTransparentProxyingAll(this);
} }
else else
{ {
showToolbarNotification(getString(R.string.setting_up_app_based_transparent_proxying_), TRANSPROXY_NOTIFY_ID, R.drawable.ic_stat_notify, -1); showToolbarNotification(getString(R.string.setting_up_app_based_transparent_proxying_), TRANSPROXY_NOTIFY_ID, R.drawable.ic_stat_notify, -1);
code = ttProxy.setTransparentProxyingByApp(this,AppManager.getApps(this)); code = mTransProxy.setTransparentProxyingByApp(this,AppManager.getApps(this));
} }
} //}
TorService.logMessage ("TorTransProxy resp code: " + code); TorService.logMessage ("TorTransProxy resp code: " + code);
@ -670,7 +671,7 @@ public class TorService extends Service implements TorServiceConstants, TorConst
{ {
showToolbarNotification(getString(R.string.transproxy_enabled_for_tethering_), TRANSPROXY_NOTIFY_ID, R.drawable.ic_stat_notify, -1); showToolbarNotification(getString(R.string.transproxy_enabled_for_tethering_), TRANSPROXY_NOTIFY_ID, R.drawable.ic_stat_notify, -1);
ttProxy.enableTetheringRules(this); mTransProxy.enableTetheringRules(this);
} }
} }
@ -699,13 +700,15 @@ public class TorService extends Service implements TorServiceConstants, TorConst
boolean hasRoot = prefs.getBoolean(PREF_HAS_ROOT,false); boolean hasRoot = prefs.getBoolean(PREF_HAS_ROOT,false);
boolean enableTransparentProxy = prefs.getBoolean("pref_transparent", false); boolean enableTransparentProxy = prefs.getBoolean("pref_transparent", false);
if (hasRoot && enableTransparentProxy) if (hasRoot && enableTransparentProxy)
{ {
TorService.logMessage ("Clearing TransProxy rules"); TorService.logMessage ("Clearing TransProxy rules");
new TorTransProxy().flushIptables(this); if (mTransProxyAll)
mTransProxy.clearTransparentProxyingAll(this);
else
mTransProxy.clearTransparentProxyingByApp(this,AppManager.getApps(this));
showToolbarNotification(getString(R.string.transproxy_rules_cleared), TRANSPROXY_NOTIFY_ID, R.drawable.ic_stat_notify, -1); showToolbarNotification(getString(R.string.transproxy_rules_cleared), TRANSPROXY_NOTIFY_ID, R.drawable.ic_stat_notify, -1);
@ -1185,7 +1188,6 @@ public class TorService extends Service implements TorServiceConstants, TorConst
prefPersistNotifications = prefs.getBoolean(TorConstants.PREF_PERSIST_NOTIFICATIONS, true); prefPersistNotifications = prefs.getBoolean(TorConstants.PREF_PERSIST_NOTIFICATIONS, true);
new Thread () new Thread ()
{ {
@ -1499,7 +1501,7 @@ public class TorService extends Service implements TorServiceConstants, TorConst
SharedPreferences prefs = PreferenceManager.getDefaultSharedPreferences(this); SharedPreferences prefs = PreferenceManager.getDefaultSharedPreferences(this);
ENABLE_DEBUG_LOG = prefs.getBoolean("pref_enable_logging",true); ENABLE_DEBUG_LOG = prefs.getBoolean("pref_enable_logging",false);
Log.i(TAG,"debug logging:" + ENABLE_DEBUG_LOG); Log.i(TAG,"debug logging:" + ENABLE_DEBUG_LOG);
boolean useBridges = prefs.getBoolean(TorConstants.PREF_BRIDGES_ENABLED, false); boolean useBridges = prefs.getBoolean(TorConstants.PREF_BRIDGES_ENABLED, false);

291
src/org/torproject/android/service/TorTransProxy.java
View File

@ -17,9 +17,8 @@ public class TorTransProxy implements TorServiceConstants {
public String getIpTablesPath (Context context) public String getIpTablesPath (Context context)
{ {
android.os.Debug.waitForDebugger();
if (ipTablesPath == null)
{
SharedPreferences prefs = PreferenceManager.getDefaultSharedPreferences(context); SharedPreferences prefs = PreferenceManager.getDefaultSharedPreferences(context);
if (prefs.getBoolean(TorConstants.PREF_USE_SYSTEM_IPTABLES, false)) if (prefs.getBoolean(TorConstants.PREF_USE_SYSTEM_IPTABLES, false))
@ -50,13 +49,12 @@ public class TorTransProxy implements TorServiceConstants {
ipTablesPath = new File(context.getDir("bin", 0),"iptables").getAbsolutePath(); ipTablesPath = new File(context.getDir("bin", 0),"iptables").getAbsolutePath();
} }
}
return ipTablesPath; return ipTablesPath;
} }
public int flushIptables(Context context) throws Exception { public int flushIptablesAll(Context context) throws Exception {
String ipTablesPath = getIpTablesPath(context); String ipTablesPath = getIpTablesPath(context);
@ -220,19 +218,10 @@ public class TorTransProxy implements TorServiceConstants {
StringBuilder res = new StringBuilder(); StringBuilder res = new StringBuilder();
int code = -1; int code = -1;
flushIptables(context); // flushIptables(context);
int torUid = context.getApplicationInfo().uid; int torUid = context.getApplicationInfo().uid;
// Allow everything for Tor
script.append(ipTablesPath);
script.append(" -t filter");
script.append(" -A OUTPUT");
script.append(" -m owner --uid-owner ");
script.append(torUid);
script.append(" -j ACCEPT");
script.append(" || exit\n");
//build up array of shell cmds to execute under one root context //build up array of shell cmds to execute under one root context
for (TorifiedApp tApp:apps) for (TorifiedApp tApp:apps)
{ {
@ -245,10 +234,11 @@ public class TorTransProxy implements TorServiceConstants {
TorService.logMessage("enabling transproxy for app: " + tApp.getUsername() + "(" + tApp.getUid() + ")"); TorService.logMessage("enabling transproxy for app: " + tApp.getUsername() + "(" + tApp.getUid() + ")");
// Set up port redirection // Set up port redirection
script.append(ipTablesPath); script.append(ipTablesPath);
script.append(" -A OUTPUT");
script.append(" -t nat"); script.append(" -t nat");
script.append(" -A OUTPUT -p tcp"); script.append(" -p tcp");
script.append(" ! -d 127.0.0.1"); //allow access to localhost script.append(" ! -d 127.0.0.1"); //allow access to localhost
script.append(" -m owner --uid-owner "); script.append(" -m owner --uid-owner ");
script.append(tApp.getUid()); script.append(tApp.getUid());
@ -259,9 +249,9 @@ public class TorTransProxy implements TorServiceConstants {
// Same for DNS // Same for DNS
script.append(ipTablesPath); script.append(ipTablesPath);
script.append(" -A OUTPUT");
script.append(" -t nat"); script.append(" -t nat");
script.append(" -A OUTPUT -p udp"); script.append(" -p udp -m owner --uid-owner ");
script.append(" -m owner --uid-owner ");
script.append(tApp.getUid()); script.append(tApp.getUid());
script.append(" -m udp --dport "); script.append(" -m udp --dport ");
script.append(STANDARD_DNS_PORT); script.append(STANDARD_DNS_PORT);
@ -269,27 +259,14 @@ public class TorTransProxy implements TorServiceConstants {
script.append(TOR_DNS_PORT); script.append(TOR_DNS_PORT);
script.append(" || exit\n"); script.append(" || exit\n");
// Allow loopback
script.append(ipTablesPath);
script.append(" -t filter");
script.append(" -A OUTPUT");
script.append(" -m owner --uid-owner ");
script.append(tApp.getUid());
script.append(" -o lo");
script.append(" -j ACCEPT");
script.append(" || exit\n");
/*
//Outgoing loopback already allowed (23/7/12)
int[] ports = {TOR_DNS_PORT,TOR_TRANSPROXY_PORT,PORT_SOCKS,PORT_HTTP}; int[] ports = {TOR_DNS_PORT,TOR_TRANSPROXY_PORT,PORT_SOCKS,PORT_HTTP};
for (int port : ports) for (int port : ports)
{ {
// Allow packets to localhost (contains all the port-redirected ones) // Allow packets to localhost (contains all the port-redirected ones)
script.append(ipTablesPath); script.append(ipTablesPath);
script.append(" -t filter");
script.append(" -A OUTPUT"); script.append(" -A OUTPUT");
script.append(" -t filter");
script.append(" -m owner --uid-owner "); script.append(" -m owner --uid-owner ");
script.append(tApp.getUid()); script.append(tApp.getUid());
script.append(" -p tcp"); script.append(" -p tcp");
@ -299,12 +276,34 @@ public class TorTransProxy implements TorServiceConstants {
script.append(" -j ACCEPT"); script.append(" -j ACCEPT");
script.append(" || exit\n"); script.append(" || exit\n");
} }
*/
// Allow loopback
script.append(ipTablesPath);
script.append(" -A OUTPUT");
script.append(" -t filter");
script.append(" -m owner --uid-owner ");
script.append(tApp.getUid());
script.append(" -p tcp");
script.append(" -o lo");
script.append(" -j ACCEPT");
script.append(" || exit\n");
// Reject DNS that is not from Tor (order is important - first matched rule counts!)
script.append(ipTablesPath);
script.append(" -A OUTPUT");
script.append(" -t filter");
script.append(" -m owner --uid-owner ");
script.append(tApp.getUid());
script.append(" -p udp");
script.append(" --dport ");
script.append(STANDARD_DNS_PORT);
script.append(" -j REJECT");
script.append(" || exit\n");
// Reject all other outbound TCP packets // Reject all other outbound TCP packets
script.append(ipTablesPath); script.append(ipTablesPath);
script.append(" -t filter");
script.append(" -A OUTPUT"); script.append(" -A OUTPUT");
script.append(" -t filter");
script.append(" -m owner --uid-owner "); script.append(" -m owner --uid-owner ");
script.append(tApp.getUid()); script.append(tApp.getUid());
script.append(" -p tcp"); script.append(" -p tcp");
@ -317,8 +316,8 @@ public class TorTransProxy implements TorServiceConstants {
// Allow everything for Tor // Allow everything for Tor
script.append(ipTablesPath); script.append(ipTablesPath);
script.append(" -t filter");
script.append(" -A OUTPUT"); script.append(" -A OUTPUT");
script.append(" -t filter");
script.append(" -m owner --uid-owner "); script.append(" -m owner --uid-owner ");
script.append(torUid); script.append(torUid);
script.append(" -j ACCEPT"); script.append(" -j ACCEPT");
@ -330,10 +329,108 @@ public class TorTransProxy implements TorServiceConstants {
String msg = res.toString(); String msg = res.toString();
TorService.logMessage(cmdAdd[0] + ";errCode=" + code + ";resp=" + msg); TorService.logMessage(cmdAdd[0] + ";errCode=" + code + ";resp=" + msg);
return code; return code;
} }
public int clearTransparentProxyingByApp(Context context, ArrayList<TorifiedApp> apps) throws Exception
{
boolean runRoot = true;
boolean waitFor = true;
//redirectDNSResolvConf(); //not working yet
String ipTablesPath = getIpTablesPath(context);
StringBuilder script = new StringBuilder();
StringBuilder res = new StringBuilder();
int code = -1;
int torUid = context.getApplicationInfo().uid;
//build up array of shell cmds to execute under one root context
for (TorifiedApp tApp:apps)
{
if (tApp.isTorified()
&& (!tApp.getUsername().equals(TorServiceConstants.TOR_APP_USERNAME))
&& (!tApp.getUsername().equals(TorServiceConstants.ORWEB_APP_USERNAME))
) //if app is set to true
{
TorService.logMessage("clear transproxy for app: " + tApp.getUsername() + "(" + tApp.getUid() + ")");
// Set up port redirection
script.append(ipTablesPath);
script.append(" -D OUTPUT");
script.append(" -t nat");
script.append(" -p tcp");
script.append(" ! -d 127.0.0.1"); //allow access to localhost
script.append(" -m owner --uid-owner ");
script.append(tApp.getUid());
script.append(" -m tcp --syn");
script.append(" -j REDIRECT --to-ports ");
script.append(TOR_TRANSPROXY_PORT);
script.append(" || exit\n");
// Same for DNS
script.append(ipTablesPath);
script.append(" -D OUTPUT");
script.append(" -t nat");
script.append(" -p udp -m owner --uid-owner ");
script.append(tApp.getUid());
script.append(" -m udp --dport ");
script.append(STANDARD_DNS_PORT);
script.append(" -j REDIRECT --to-ports ");
script.append(TOR_DNS_PORT);
script.append(" || exit\n");
// Reject DNS that is not from Tor (order is important - first matched rule counts!)
script.append(ipTablesPath);
script.append(" -D OUTPUT");
script.append(" -t filter");
script.append(" -m owner --uid-owner ");
script.append(tApp.getUid());
script.append(" -p udp");
script.append(" --dport ");
script.append(STANDARD_DNS_PORT);
script.append(" -j REJECT");
script.append(" || exit\n");
// Reject all other outbound TCP packets
script.append(ipTablesPath);
script.append(" -D OUTPUT");
script.append(" -t filter");
script.append(" -m owner --uid-owner ");
script.append(tApp.getUid());
script.append(" -p tcp");
script.append(" -j REJECT");
script.append(" || exit\n");
}
}
// Allow everything for Tor
script.append(ipTablesPath);
script.append(" -D OUTPUT");
script.append(" -t filter");
script.append(" -m owner --uid-owner ");
script.append(torUid);
script.append(" -j ACCEPT");
script.append(" || exit\n");
String[] cmdAdd = {script.toString()};
code = TorServiceUtils.doShellCommand(cmdAdd, res, runRoot, waitFor);
String msg = res.toString();
TorService.logMessage(cmdAdd[0] + ";errCode=" + code + ";resp=" + msg);
return code;
}
/*
// this is a bad idea so removing
public int setTransparentProxyingByPort(Context context, int port) throws Exception public int setTransparentProxyingByPort(Context context, int port) throws Exception
{ {
@ -348,7 +445,7 @@ public class TorTransProxy implements TorServiceConstants {
StringBuilder res = new StringBuilder(); StringBuilder res = new StringBuilder();
int code = -1; int code = -1;
flushIptables(context); //flushIptables(context);
//TCP //TCP
//iptables -t nat -A PREROUTING -i eth0 -p tcp --dport $srcPortNumber -j REDIRECT --to-port $dstPortNumbe //iptables -t nat -A PREROUTING -i eth0 -p tcp --dport $srcPortNumber -j REDIRECT --to-port $dstPortNumbe
@ -390,6 +487,7 @@ public class TorTransProxy implements TorServiceConstants {
return code; return code;
} }
*/
public int enableTetheringRules (Context context) throws Exception public int enableTetheringRules (Context context) throws Exception
{ {
@ -447,12 +545,12 @@ public class TorTransProxy implements TorServiceConstants {
StringBuilder res = new StringBuilder(); StringBuilder res = new StringBuilder();
int code = -1; int code = -1;
flushIptables(context); //flushIptables(context);
int torUid = context.getApplicationInfo().uid; int torUid = context.getApplicationInfo().uid;
// Set up port redirection // Set up port redirection
script.append(ipTablesPath); script.append(ipTablesPath);
script.append(" -t nat"); script.append(" -t nat");
script.append(" -A OUTPUT -p tcp"); script.append(" -A OUTPUT -p tcp");
script.append(" ! -d 127.0.0.1"); //allow access to localhost script.append(" ! -d 127.0.0.1"); //allow access to localhost
@ -466,8 +564,7 @@ public class TorTransProxy implements TorServiceConstants {
// Same for DNS // Same for DNS
script.append(ipTablesPath); script.append(ipTablesPath);
script.append(" -t nat"); script.append(" -t nat");
script.append(" -A OUTPUT -p udp"); script.append(" -A OUTPUT -p udp -m owner ! --uid-owner ");
script.appent(" -m owner ! --uid-owner ");
script.append(torUid); script.append(torUid);
script.append(" -m udp --dport "); script.append(" -m udp --dport ");
script.append(STANDARD_DNS_PORT); script.append(STANDARD_DNS_PORT);
@ -475,27 +572,6 @@ public class TorTransProxy implements TorServiceConstants {
script.append(TOR_DNS_PORT); script.append(TOR_DNS_PORT);
script.append(" || exit\n"); script.append(" || exit\n");
// Allow loopback
script.append(ipTablesPath);
script.append(" -t filter");
script.append(" -A OUTPUT");
script.append(" -o lo");
script.append(" -j ACCEPT");
script.append(" || exit\n");
// Allow everything for Tor
script.append(ipTablesPath);
script.append(" -t filter");
script.append(" -A OUTPUT");
script.append(" -m owner --uid-owner ");
script.append(torUid);
script.append(" -j ACCEPT");
script.append(" || exit\n");
/*
//Outgoing loopback already allowed (23/7/12)
int[] ports = {TOR_DNS_PORT,TOR_TRANSPROXY_PORT,PORT_SOCKS,PORT_HTTP}; int[] ports = {TOR_DNS_PORT,TOR_TRANSPROXY_PORT,PORT_SOCKS,PORT_HTTP};
for (int port : ports) for (int port : ports)
@ -513,8 +589,25 @@ public class TorTransProxy implements TorServiceConstants {
script.append(" -j ACCEPT"); script.append(" -j ACCEPT");
script.append(" || exit\n"); script.append(" || exit\n");
} */ }
// Allow loopback
script.append(ipTablesPath);
script.append(" -t filter");
script.append(" -A OUTPUT");
script.append(" -p tcp");
script.append(" -o lo");
script.append(" -j ACCEPT");
script.append(" || exit\n");
// Allow everything for Tor
script.append(ipTablesPath);
script.append(" -t filter");
script.append(" -A OUTPUT");
script.append(" -m owner --uid-owner ");
script.append(torUid);
script.append(" -j ACCEPT");
script.append(" || exit\n");
if (TorService.ENABLE_DEBUG_LOG) if (TorService.ENABLE_DEBUG_LOG)
{ {
@ -563,6 +656,74 @@ public class TorTransProxy implements TorServiceConstants {
String msg = res.toString(); String msg = res.toString();
TorService.logMessage(cmdAdd[0] + ";errCode=" + code + ";resp=" + msg); TorService.logMessage(cmdAdd[0] + ";errCode=" + code + ";resp=" + msg);
return code;
}
public int clearTransparentProxyingAll(Context context) throws Exception
{
boolean runRoot = true;
boolean waitFor = true;
//redirectDNSResolvConf(); //not working yet
String ipTablesPath = getIpTablesPath(context);
StringBuilder script = new StringBuilder();
StringBuilder res = new StringBuilder();
int code = -1;
int torUid = context.getApplicationInfo().uid;
// Set up port redirection
script.append(ipTablesPath);
script.append(" -D OUTPUT -p tcp");
script.append(" -t nat");
script.append(" ! -d 127.0.0.1"); //allow access to localhost
script.append(" -m owner ! --uid-owner ");
script.append(torUid);
script.append(" -m tcp --syn");
script.append(" -j REDIRECT --to-ports ");
script.append(TOR_TRANSPROXY_PORT);
script.append(" || exit\n");
// Same for DNS
script.append(ipTablesPath);
script.append(" -D OUTPUT");
script.append(" -t nat");
script.append(" -p udp -m owner ! --uid-owner ");
script.append(torUid);
script.append(" -m udp --dport ");
script.append(STANDARD_DNS_PORT);
script.append(" -j REDIRECT --to-ports ");
script.append(TOR_DNS_PORT);
script.append(" || exit\n");
// Reject DNS that is not from Tor (order is important - first matched rule counts!)
script.append(ipTablesPath);
script.append(" -D OUTPUT");
script.append(" -t filter");
script.append(" -p udp");
script.append(" --dport ");
script.append(STANDARD_DNS_PORT);
script.append(" -j REJECT");
script.append(" || exit\n");
// Reject all other outbound TCP packets
script.append(ipTablesPath);
script.append(" -D OUTPUT");
script.append(" -t filter");
script.append(" -p tcp");
script.append(" -j REJECT");
script.append(" || exit\n");
String[] cmdAdd = {script.toString()};
code = TorServiceUtils.doShellCommand(cmdAdd, res, runRoot, waitFor);
String msg = res.toString();
TorService.logMessage(cmdAdd[0] + ";errCode=" + code + ";resp=" + msg);
return code; return code;

2
src/org/torproject/android/settings/SettingsPreferences.java
View File

@ -203,7 +203,7 @@ public class SettingsPreferences
private void clearTransProxyState () private void clearTransProxyState ()
{ {
try { try {
new TorTransProxy().flushIptables(this); new TorTransProxy().clearTransparentProxyingAll(this);
} catch (Exception e) { } catch (Exception e) {
Log.e(TorConstants.TAG,"error flushing iptables",e); Log.e(TorConstants.TAG,"error flushing iptables",e);
} }