627 lines
18 KiB
Java
627 lines
18 KiB
Java
package org.torproject.android.service;
|
|
|
|
import java.io.File;
|
|
import java.util.ArrayList;
|
|
|
|
import org.torproject.android.TorConstants;
|
|
import org.torproject.android.settings.TorifiedApp;
|
|
|
|
import android.content.Context;
|
|
import android.content.SharedPreferences;
|
|
import android.preference.PreferenceManager;
|
|
import android.util.Log;
|
|
|
|
public class TorTransProxy implements TorServiceConstants {
|
|
|
|
private boolean useSystemIpTables = false;
|
|
private String mSysIptables = null;
|
|
private TorService mTorService = null;
|
|
|
|
public TorTransProxy (TorService torService)
|
|
{
|
|
mTorService = torService;
|
|
}
|
|
|
|
public TorTransProxy ()
|
|
{
|
|
}
|
|
|
|
public String getIpTablesPath (Context context)
|
|
{
|
|
|
|
String ipTablesPath = null;
|
|
|
|
SharedPreferences prefs = TorService.getSharedPrefs(context.getApplicationContext());
|
|
|
|
useSystemIpTables = prefs.getBoolean(TorConstants.PREF_USE_SYSTEM_IPTABLES, false);
|
|
|
|
if (useSystemIpTables)
|
|
{
|
|
ipTablesPath = findSystemIPTables();
|
|
}
|
|
else
|
|
{
|
|
//use the bundled version
|
|
File appLibsHome = new File(context.getApplicationInfo().nativeLibraryDir);
|
|
ipTablesPath = new File(appLibsHome,IPTABLES_BINARY_ASSET_KEY).getAbsolutePath();
|
|
ipTablesPath += " iptables"; //append subcommand since we are using xtables now
|
|
|
|
}
|
|
|
|
return ipTablesPath;
|
|
}
|
|
|
|
private String findSystemIPTables ()
|
|
{
|
|
if (mSysIptables != null)
|
|
{
|
|
return mSysIptables;
|
|
}
|
|
else
|
|
{
|
|
|
|
//if the user wants us to use the built-in iptables, then we have to find it
|
|
File fileIpt = new File("/system/xbin/iptables");
|
|
|
|
if (fileIpt.exists())
|
|
mSysIptables = fileIpt.getAbsolutePath();
|
|
else
|
|
{
|
|
|
|
fileIpt = new File("/system/bin/iptables");
|
|
|
|
if (fileIpt.exists())
|
|
mSysIptables = fileIpt.getAbsolutePath();
|
|
}
|
|
}
|
|
|
|
return mSysIptables;
|
|
}
|
|
|
|
/*
|
|
public int flushIptablesAll(Context context) throws Exception {
|
|
|
|
String ipTablesPath = getIpTablesPath(context);
|
|
|
|
final StringBuilder script = new StringBuilder();
|
|
|
|
StringBuilder res = new StringBuilder();
|
|
int code = -1;
|
|
|
|
script.append(ipTablesPath);
|
|
script.append(" -t nat");
|
|
script.append(" -F || exit\n");
|
|
|
|
script.append(ipTablesPath);
|
|
script.append(" -t filter");
|
|
script.append(" -F || exit\n");
|
|
|
|
String[] cmd = {script.toString()};
|
|
code = TorServiceUtils.doShellCommand(cmd, res, true, true);
|
|
String msg = res.toString();
|
|
|
|
TorService.logMessage(cmd[0] + ";errCode=" + code + ";resp=" + msg);
|
|
|
|
|
|
return code;
|
|
|
|
}*/
|
|
|
|
/*
|
|
public static int purgeIptablesByApp(Context context, TorifiedApp[] apps) throws Exception {
|
|
|
|
//restoreDNSResolvConf(); //not working yet
|
|
|
|
String ipTablesPath = new File(context.getDir("bin", 0),"iptables").getAbsolutePath();
|
|
|
|
final StringBuilder script = new StringBuilder();
|
|
|
|
StringBuilder res = new StringBuilder();
|
|
int code = -1;
|
|
|
|
for (int i = 0; i < apps.length; i++)
|
|
{
|
|
//flush nat for every app
|
|
script.append(ipTablesPath);
|
|
script.append(" -t nat -m owner --uid-owner ");
|
|
script.append(tApp.getUid());
|
|
script.append(" -F || exit\n");
|
|
|
|
script.append(ipTablesPath);
|
|
script.append(" -t filter -m owner --uid-owner ");
|
|
script.append(tApp.getUid());
|
|
script.append(" -F || exit\n");
|
|
|
|
}
|
|
|
|
|
|
String[] cmd = {script.toString()};
|
|
code = TorServiceUtils.doShellCommand(cmd, res, true, true);
|
|
String msg = res.toString();
|
|
logNotice(cmd[0] + ";errCode=" + code + ";resp=" + msg);
|
|
|
|
|
|
return code;
|
|
|
|
}*/
|
|
|
|
|
|
/*
|
|
// 9/19/2010 - NF This code is in process... /etc path on System partition
|
|
// is read-only on Android for now.
|
|
public static int redirectDNSResolvConf () throws Exception
|
|
{
|
|
StringBuilder script = new StringBuilder();
|
|
StringBuilder res = new StringBuilder();
|
|
int code = -1;
|
|
|
|
//mv resolv.conf to resolve.conf.bak
|
|
String cmd = "mv /etc/resolv.conf /etc/resolv.conf.bak";
|
|
script.append(cmd);
|
|
|
|
//create new resolve.conf pointing to localhost/127.0.0.1
|
|
cmd = "echo \"nameserver 127.0.0.1\" > /etc/resolv.conf";
|
|
script.append(cmd);
|
|
|
|
String[] cmdFlush = {script.toString()};
|
|
code = TorServiceUtils.doShellCommand(cmdFlush, res, true, true);
|
|
//String msg = res.toString(); //get stdout from command
|
|
|
|
|
|
return code;
|
|
}
|
|
|
|
public static int restoreDNSResolvConf () throws Exception
|
|
{
|
|
StringBuilder script = new StringBuilder();
|
|
StringBuilder res = new StringBuilder();
|
|
int code = -1;
|
|
|
|
//mv resolv.conf to resolve.conf.bak
|
|
String cmd = "mv /etc/resolv.conf.bak /etc/resolv.conf";
|
|
script.append(cmd);
|
|
script.append(" || exit\n");
|
|
|
|
String[] cmdFlush = {script.toString()};
|
|
code = TorServiceUtils.doShellCommand(cmdFlush, res, true, true);
|
|
//String msg = res.toString(); //get stdout from command
|
|
|
|
return code;
|
|
}
|
|
*/
|
|
/*
|
|
public int testOwnerModule(Context context, String ipTablesPath) throws Exception
|
|
{
|
|
|
|
TorBinaryInstaller.assertIpTablesBinaries(context, false);
|
|
|
|
boolean runRoot = true;
|
|
boolean waitFor = true;
|
|
|
|
int torUid = context.getApplicationInfo().uid;
|
|
|
|
StringBuilder script = new StringBuilder();
|
|
|
|
StringBuilder res = new StringBuilder();
|
|
int code = -1;
|
|
|
|
// Allow everything for Tor
|
|
script.append(ipTablesPath);
|
|
script.append(" -A OUTPUT");
|
|
script.append(" -t filter");
|
|
script.append(" -m owner --uid-owner ");
|
|
script.append(torUid);
|
|
script.append(" -j ACCEPT");
|
|
script.append(" || exit\n");
|
|
|
|
script.append(ipTablesPath);
|
|
script.append(" -D OUTPUT");
|
|
script.append(" -t filter");
|
|
script.append(" -m owner --uid-owner ");
|
|
script.append(torUid);
|
|
script.append(" -j ACCEPT");
|
|
script.append(" || exit\n");
|
|
|
|
String[] cmdAdd = {script.toString()};
|
|
|
|
code = TorServiceUtils.doShellCommand(cmdAdd, res, runRoot, waitFor);
|
|
String msg = res.toString();
|
|
|
|
if (mTorService != null)
|
|
logMessage(cmdAdd[0] + ";errCode=" + code + ";resp=" + msg);
|
|
|
|
|
|
return code;
|
|
}
|
|
*/
|
|
|
|
/*
|
|
public int clearTransparentProxyingByApp (Context context, ArrayList<TorifiedApp> apps) throws Exception
|
|
{
|
|
boolean runRoot = true;
|
|
boolean waitFor = true;
|
|
|
|
String ipTablesPath = getIpTablesPath(context);
|
|
|
|
StringBuilder script = new StringBuilder();
|
|
|
|
StringBuilder res = new StringBuilder();
|
|
int code = -1;
|
|
|
|
String chainName = "ORBOT";
|
|
String jumpChainName = "OUTPUT";
|
|
|
|
script.append(ipTablesPath);
|
|
script.append(" --flush ").append(chainName); //delete previous user-defined chain
|
|
script.append(" || exit\n");
|
|
|
|
script.append(ipTablesPath);
|
|
script.append(" -D ").append(jumpChainName);
|
|
script.append(" -j ").append(chainName);
|
|
script.append(" || exit\n");
|
|
|
|
script.append(ipTablesPath);
|
|
script.append(" -X ").append(chainName); //delete previous user-defined chain
|
|
script.append(" || exit\n");
|
|
|
|
String[] cmdAdd = {script.toString()};
|
|
|
|
code = TorServiceUtils.doShellCommand(cmdAdd, res, runRoot, waitFor);
|
|
String msg = res.toString();
|
|
|
|
logMessage(cmdAdd[0] + ";errCode=" + code + ";resp=" + msg);
|
|
|
|
return code;
|
|
}*/
|
|
|
|
public int setTransparentProxyingByApp(Context context, ArrayList<TorifiedApp> apps) throws Exception
|
|
{
|
|
|
|
boolean runRoot = true;
|
|
boolean waitFor = true;
|
|
|
|
String ipTablesPath = getIpTablesPath(context);
|
|
|
|
StringBuilder script = new StringBuilder();
|
|
|
|
StringBuilder res = new StringBuilder();
|
|
int code = -1;
|
|
|
|
String srcChainName = "OUTPUT";
|
|
|
|
//run the delete commands in a separate process as it might error out
|
|
String[] cmdExecClear = {script.toString()};
|
|
code = TorServiceUtils.doShellCommand(cmdExecClear, res, runRoot, waitFor);
|
|
|
|
//reset script
|
|
script = new StringBuilder();
|
|
|
|
//build up array of shell cmds to execute under one root context
|
|
for (TorifiedApp tApp:apps)
|
|
{
|
|
|
|
if (tApp.isTorified()
|
|
&& (!tApp.getUsername().equals(TorServiceConstants.TOR_APP_USERNAME))
|
|
&& (!tApp.getUsername().equals(TorServiceConstants.ORWEB_APP_USERNAME))
|
|
) //if app is set to true
|
|
{
|
|
|
|
logMessage("enabling transproxy for app: " + tApp.getUsername() + "(" + tApp.getUid() + ")");
|
|
|
|
// Set up port redirection
|
|
script.append(ipTablesPath);
|
|
script.append(" -t nat");
|
|
script.append(" -A ").append(srcChainName);
|
|
script.append(" -p tcp");
|
|
script.append(" ! -d 127.0.0.1"); //allow access to localhost
|
|
script.append(" -m owner --uid-owner ");
|
|
script.append(tApp.getUid());
|
|
script.append(" -m tcp --syn");
|
|
script.append(" -j REDIRECT --to-ports ");
|
|
script.append(TOR_TRANSPROXY_PORT);
|
|
script.append(" || exit\n");
|
|
|
|
// Same for DNS
|
|
script.append(ipTablesPath);
|
|
script.append(" -t nat");
|
|
script.append(" -A ").append(srcChainName);
|
|
script.append(" -p udp -m owner --uid-owner ");
|
|
script.append(tApp.getUid());
|
|
script.append(" -m udp --dport ");
|
|
script.append(STANDARD_DNS_PORT);
|
|
script.append(" -j REDIRECT --to-ports ");
|
|
script.append(TOR_DNS_PORT);
|
|
script.append(" || exit\n");
|
|
|
|
int[] ports = {TOR_DNS_PORT,TOR_TRANSPROXY_PORT,PORT_SOCKS,PORT_HTTP};
|
|
|
|
for (int port : ports)
|
|
{
|
|
// Allow packets to localhost (contains all the port-redirected ones)
|
|
script.append(ipTablesPath);
|
|
script.append(" -t filter");
|
|
script.append(" -A ").append(srcChainName);
|
|
script.append(" -m owner --uid-owner ");
|
|
script.append(tApp.getUid());
|
|
script.append(" -p tcp");
|
|
script.append(" -d 127.0.0.1");
|
|
script.append(" --dport ");
|
|
script.append(port);
|
|
script.append(" -j ACCEPT");
|
|
script.append(" || exit\n");
|
|
}
|
|
|
|
// Allow loopback
|
|
script.append(ipTablesPath);
|
|
script.append(" -t filter");
|
|
script.append(" -A ").append(srcChainName);
|
|
script.append(" -m owner --uid-owner ");
|
|
script.append(tApp.getUid());
|
|
script.append(" -p tcp");
|
|
script.append(" -o lo");
|
|
script.append(" -j ACCEPT");
|
|
script.append(" || exit\n");
|
|
|
|
// Reject all other outbound TCP packets
|
|
script.append(ipTablesPath);
|
|
script.append(" -t filter");
|
|
script.append(" -A ").append(srcChainName);
|
|
script.append(" -m owner --uid-owner ");
|
|
script.append(tApp.getUid());
|
|
script.append(" -p tcp");
|
|
script.append(" ! -d 127.0.0.1"); //allow access to localhost
|
|
script.append(" -j REJECT");
|
|
script.append(" || exit\n");
|
|
|
|
// Reject all other outbound UDP packets
|
|
script.append(ipTablesPath);
|
|
script.append(" -t filter");
|
|
script.append(" -A ").append(srcChainName);
|
|
script.append(" -m owner --uid-owner ");
|
|
script.append(tApp.getUid());
|
|
script.append(" -p udp");
|
|
script.append(" ! -d 127.0.0.1"); //allow access to localhost
|
|
script.append(" -j REJECT");
|
|
script.append(" || exit\n");
|
|
|
|
}
|
|
}
|
|
|
|
String[] cmdAdd = {script.toString()};
|
|
|
|
code = TorServiceUtils.doShellCommand(cmdAdd, res, runRoot, waitFor);
|
|
String msg = res.toString();
|
|
|
|
logMessage(cmdAdd[0] + ";errCode=" + code + ";resp=" + msg);
|
|
|
|
return code;
|
|
}
|
|
|
|
|
|
public int enableTetheringRules (Context context) throws Exception
|
|
{
|
|
|
|
boolean runRoot = true;
|
|
boolean waitFor = true;
|
|
|
|
String ipTablesPath = getIpTablesPath(context);
|
|
|
|
StringBuilder script = new StringBuilder();
|
|
|
|
StringBuilder res = new StringBuilder();
|
|
int code = -1;
|
|
|
|
String[] hwinterfaces = {"usb0","wl0.1"};
|
|
|
|
for (int i = 0; i < hwinterfaces.length; i++)
|
|
{
|
|
script.append(ipTablesPath);
|
|
script.append(" -t nat -A PREROUTING -i ");
|
|
script.append(hwinterfaces[i]);
|
|
script.append(" -p udp --dport 53 -j REDIRECT --to-ports ");
|
|
script.append(TOR_DNS_PORT);
|
|
script.append(" || exit\n");
|
|
|
|
script.append(ipTablesPath);
|
|
script.append(" -t nat -A PREROUTING -i ");
|
|
script.append(hwinterfaces[i]);
|
|
script.append(" -p tcp -j REDIRECT --to-ports ");
|
|
script.append(TOR_TRANSPROXY_PORT);
|
|
script.append(" || exit\n");
|
|
}
|
|
|
|
String[] cmdAdd = {script.toString()};
|
|
|
|
code = TorServiceUtils.doShellCommand(cmdAdd, res, runRoot, waitFor);
|
|
String msg = res.toString();
|
|
logMessage(cmdAdd[0] + ";errCode=" + code + ";resp=" + msg);
|
|
|
|
|
|
return code;
|
|
}
|
|
|
|
private void logMessage (String msg)
|
|
{
|
|
if (mTorService != null)
|
|
mTorService.logMessage(msg);
|
|
else
|
|
Log.w(TorConstants.TAG,msg);
|
|
}
|
|
|
|
public int clearTransparentProxyingAll(Context context) throws Exception
|
|
{
|
|
|
|
boolean runRoot = true;
|
|
boolean waitFor = true;
|
|
|
|
String ipTablesPath = getIpTablesPath(context);
|
|
|
|
StringBuilder script = new StringBuilder();
|
|
StringBuilder res = new StringBuilder();
|
|
int code = -1;
|
|
|
|
String chainName = "OUTPUT";
|
|
|
|
script = new StringBuilder();
|
|
res = new StringBuilder();
|
|
script.append(ipTablesPath);
|
|
script.append(" -t nat");
|
|
script.append(" -F ").append(chainName); //delete previous user-defined chain
|
|
script.append(" || exit\n");
|
|
code = TorServiceUtils.doShellCommand(script.toString(), res, runRoot, waitFor);
|
|
logMessage("Exec resp: cmd> " + script.toString() + "; errCode=" + code + ";resp=" + res.toString());
|
|
|
|
script = new StringBuilder();
|
|
res = new StringBuilder();
|
|
script.append(ipTablesPath);
|
|
script.append(" -t filter");
|
|
script.append(" -F ").append(chainName); //delete previous user-defined chain
|
|
script.append(" || exit\n");
|
|
code = TorServiceUtils.doShellCommand(script.toString(), res, runRoot, waitFor);
|
|
logMessage("Exec resp: cmd> " + script.toString() + "; errCode=" + code + ";resp=" + res.toString());
|
|
|
|
return code;
|
|
}
|
|
|
|
public int setTransparentProxyingAll(Context context) throws Exception
|
|
{
|
|
|
|
boolean runRoot = true;
|
|
boolean waitFor = true;
|
|
|
|
//redirectDNSResolvConf(); //not working yet
|
|
|
|
String ipTablesPath = getIpTablesPath(context);
|
|
|
|
StringBuilder script = new StringBuilder();
|
|
|
|
StringBuilder res = new StringBuilder();
|
|
int code = -1;
|
|
|
|
int torUid = context.getApplicationInfo().uid;
|
|
|
|
String srcChainName = "OUTPUT";
|
|
|
|
// Allow everything for Tor
|
|
script.append(ipTablesPath);
|
|
script.append(" -t filter");
|
|
script.append(" -A ").append(srcChainName);
|
|
script.append(" -m owner --uid-owner ");
|
|
script.append(torUid);
|
|
script.append(" -j ACCEPT");
|
|
script.append(" || exit\n");
|
|
|
|
// Set up port redirection
|
|
script.append(ipTablesPath);
|
|
script.append(" -t nat");
|
|
script.append(" -A ").append(srcChainName);
|
|
script.append(" -p tcp");
|
|
script.append(" ! -d 127.0.0.1"); //allow access to localhost
|
|
script.append(" -m owner ! --uid-owner ");
|
|
script.append(torUid);
|
|
script.append(" -m tcp --syn");
|
|
script.append(" -j REDIRECT --to-ports ");
|
|
script.append(TOR_TRANSPROXY_PORT);
|
|
script.append(" || exit\n");
|
|
|
|
// Same for DNS
|
|
script.append(ipTablesPath);
|
|
script.append(" -t nat");
|
|
script.append(" -A ").append(srcChainName);
|
|
script.append(" -p udp -m owner ! --uid-owner ");
|
|
script.append(torUid);
|
|
script.append(" -m udp --dport ");
|
|
script.append(STANDARD_DNS_PORT);
|
|
script.append(" -j REDIRECT --to-ports ");
|
|
script.append(TOR_DNS_PORT);
|
|
script.append(" || exit\n");
|
|
|
|
int[] ports = {TOR_DNS_PORT,TOR_TRANSPROXY_PORT,PORT_SOCKS,PORT_HTTP};
|
|
|
|
for (int port : ports)
|
|
{
|
|
// Allow packets to localhost (contains all the port-redirected ones)
|
|
script.append(ipTablesPath);
|
|
script.append(" -t filter");
|
|
script.append(" -A ").append(srcChainName);
|
|
script.append(" -m owner ! --uid-owner ");
|
|
script.append(torUid);
|
|
script.append(" -p tcp");
|
|
script.append(" -d 127.0.0.1");
|
|
script.append(" --dport ");
|
|
script.append(port);
|
|
script.append(" -j ACCEPT");
|
|
script.append(" || exit\n");
|
|
|
|
}
|
|
|
|
// Allow loopback
|
|
script.append(ipTablesPath);
|
|
script.append(" -t filter");
|
|
script.append(" -A ").append(srcChainName);
|
|
script.append(" -p tcp");
|
|
script.append(" -o lo");
|
|
script.append(" -j ACCEPT");
|
|
script.append(" || exit\n");
|
|
|
|
|
|
if (TorService.ENABLE_DEBUG_LOG)
|
|
{
|
|
//XXX: Comment the following rules for non-debug builds
|
|
script.append(ipTablesPath);
|
|
script.append(" -t filter");
|
|
script.append(" -A ").append(srcChainName);
|
|
script.append(" -p udp");
|
|
script.append(" --dport ");
|
|
script.append(STANDARD_DNS_PORT);
|
|
script.append(" -j LOG");
|
|
script.append(" --log-prefix='ORBOT_DNSLEAK_PROTECTION'");
|
|
script.append(" --log-uid");
|
|
script.append(" || exit\n");
|
|
|
|
script.append(ipTablesPath);
|
|
script.append(" -t filter");
|
|
script.append(" -A ").append(srcChainName);
|
|
script.append(" -p tcp");
|
|
script.append(" -j LOG");
|
|
script.append(" --log-prefix='ORBOT_TCPLEAK_PROTECTION'");
|
|
script.append(" --log-uid");
|
|
script.append(" || exit\n");
|
|
}
|
|
|
|
|
|
// Reject all other outbound TCP packets
|
|
script.append(ipTablesPath);
|
|
script.append(" -t filter");
|
|
script.append(" -A ").append(srcChainName);
|
|
script.append(" -m owner ! --uid-owner ");
|
|
script.append(torUid);
|
|
script.append(" -p tcp");
|
|
script.append(" ! -d 127.0.0.1"); //allow access to localhost
|
|
script.append(" -j REJECT");
|
|
script.append(" || exit\n");
|
|
|
|
// Reject all other outbound UDP packets
|
|
script.append(ipTablesPath);
|
|
script.append(" -t filter");
|
|
script.append(" -A ").append(srcChainName);
|
|
script.append(" -m owner ! --uid-owner ");
|
|
script.append(torUid);
|
|
script.append(" -p udp");
|
|
script.append(" ! -d 127.0.0.1"); //allow access to localhost
|
|
script.append(" -j REJECT");
|
|
script.append(" || exit\n");
|
|
|
|
String[] cmdExec = {script.toString()};
|
|
|
|
code = TorServiceUtils.doShellCommand(cmdExec, res, runRoot, waitFor);
|
|
String msg = res.toString();
|
|
|
|
logMessage("Exec resp: errCode=" + code + ";resp=" + msg);
|
|
|
|
return code;
|
|
}
|
|
|
|
|
|
}
|