410 lines
11 KiB
Java
410 lines
11 KiB
Java
package org.torproject.android.service;
|
|
|
|
import org.torproject.android.TorifiedApp;
|
|
|
|
import android.content.Context;
|
|
import android.util.Log;
|
|
|
|
public class TorTransProxy implements TorServiceConstants {
|
|
|
|
private final static String TAG = TorServiceConstants.TAG;
|
|
|
|
//private static String BASE_DIR = "/data/data/" + TorServiceConstants.TOR_APP_USERNAME + "/";
|
|
|
|
private static void logNotice (String msg)
|
|
{
|
|
if (LOG_OUTPUT_TO_DEBUG)
|
|
Log.d(TAG, msg);
|
|
}
|
|
|
|
/**
|
|
* Check if we have root access
|
|
* @return boolean true if we have root
|
|
*/
|
|
public static String getIPTablesVersion() {
|
|
|
|
|
|
StringBuilder log = new StringBuilder();
|
|
|
|
try {
|
|
|
|
// Run an empty script just to check root access
|
|
String[] cmd = {"iptables -v"};
|
|
int code = TorServiceUtils.doShellCommand(cmd, log, true, true);
|
|
String msg = log.toString();
|
|
logNotice(cmd[0] + ";errCode=" + code + ";resp=" + msg);
|
|
|
|
|
|
String out = log.toString();
|
|
if (out.indexOf(" v")!=-1)
|
|
{
|
|
|
|
out = out.substring(out.indexOf(" v")+2);
|
|
out = out.substring(0,out.indexOf(":"));
|
|
|
|
return out.trim();
|
|
}
|
|
|
|
|
|
} catch (Exception e) {
|
|
Log.w(TAG,"Error checking iptables version: " + e.getMessage() ,e);
|
|
}
|
|
|
|
logNotice("Could not acquire check iptables: " + log.toString());
|
|
return null;
|
|
}
|
|
|
|
|
|
private static String findBaseDir ()
|
|
{
|
|
|
|
return ""; //just blank for now
|
|
/*
|
|
String[] cmds = {"/system/bin/iptables -t nat --list"};
|
|
StringBuilder res = new StringBuilder();
|
|
|
|
int code;
|
|
try {
|
|
code = TorServiceUtils.doShellCommand(cmds, res, true, true);
|
|
|
|
|
|
if (code != 0) {
|
|
return BASE_DIR;
|
|
}
|
|
else
|
|
return "/system/bin/";
|
|
|
|
} catch (Exception e) {
|
|
return BASE_DIR;
|
|
}
|
|
|
|
return "";
|
|
|
|
*/
|
|
}
|
|
|
|
|
|
public static int purgeIptables(Context context, TorifiedApp[] apps) throws Exception {
|
|
|
|
//restoreDNSResolvConf(); //not working yet
|
|
|
|
String baseDir = findBaseDir();
|
|
|
|
final StringBuilder script = new StringBuilder();
|
|
|
|
StringBuilder res = new StringBuilder();
|
|
int code = -1;
|
|
|
|
for (int i = 0; i < apps.length; i++)
|
|
{
|
|
|
|
//flush nat for every app
|
|
script.append(baseDir);
|
|
script.append("iptables -t nat -m owner --uid-owner ");
|
|
script.append(apps[i].getUid());
|
|
script.append(" -F || exit\n");
|
|
script.append("iptables -t filter -m owner --uid-owner ");
|
|
script.append(apps[i].getUid());
|
|
script.append(" -F || exit\n");
|
|
|
|
}
|
|
|
|
|
|
String[] cmd = {script.toString()};
|
|
code = TorServiceUtils.doShellCommand(cmd, res, true, true);
|
|
String msg = res.toString();
|
|
logNotice(cmd[0] + ";errCode=" + code + ";resp=" + msg);
|
|
|
|
|
|
return code;
|
|
|
|
}
|
|
|
|
/*
|
|
// 9/19/2010 - NF This code is in process... /etc path on System partition
|
|
// is read-only on Android for now.
|
|
public static int redirectDNSResolvConf () throws Exception
|
|
{
|
|
StringBuilder script = new StringBuilder();
|
|
StringBuilder res = new StringBuilder();
|
|
int code = -1;
|
|
|
|
//mv resolv.conf to resolve.conf.bak
|
|
String cmd = "mv /etc/resolv.conf /etc/resolv.conf.bak";
|
|
script.append(cmd);
|
|
|
|
//create new resolve.conf pointing to localhost/127.0.0.1
|
|
cmd = "echo \"nameserver 127.0.0.1\" > /etc/resolv.conf";
|
|
script.append(cmd);
|
|
|
|
String[] cmdFlush = {script.toString()};
|
|
code = TorServiceUtils.doShellCommand(cmdFlush, res, true, true);
|
|
//String msg = res.toString(); //get stdout from command
|
|
|
|
|
|
return code;
|
|
}
|
|
|
|
public static int restoreDNSResolvConf () throws Exception
|
|
{
|
|
StringBuilder script = new StringBuilder();
|
|
StringBuilder res = new StringBuilder();
|
|
int code = -1;
|
|
|
|
//mv resolv.conf to resolve.conf.bak
|
|
String cmd = "mv /etc/resolv.conf.bak /etc/resolv.conf";
|
|
script.append(cmd);
|
|
script.append(" || exit\n");
|
|
|
|
String[] cmdFlush = {script.toString()};
|
|
code = TorServiceUtils.doShellCommand(cmdFlush, res, true, true);
|
|
//String msg = res.toString(); //get stdout from command
|
|
|
|
return code;
|
|
}
|
|
*/
|
|
|
|
public static int setTransparentProxyingByApp(Context context, TorifiedApp[] apps, boolean forceAll) throws Exception
|
|
{
|
|
|
|
//android.os.Debug.waitForDebugger();
|
|
|
|
//redirectDNSResolvConf(); //not working yet
|
|
|
|
String baseDir = findBaseDir();
|
|
|
|
String iptablesVersion = getIPTablesVersion();
|
|
logNotice( "iptables version: " + iptablesVersion);
|
|
|
|
boolean ipTablesOld = false;
|
|
if (iptablesVersion != null && iptablesVersion.startsWith("1.3")){
|
|
ipTablesOld = true;
|
|
}
|
|
|
|
StringBuilder script = new StringBuilder();
|
|
|
|
StringBuilder res = new StringBuilder();
|
|
int code = -1;
|
|
|
|
for (int i = 0; i < apps.length; i++)
|
|
{
|
|
|
|
//flush nat for every app
|
|
script.append(baseDir);
|
|
script.append("iptables -t nat -m owner --uid-owner ");
|
|
script.append(apps[i].getUid());
|
|
script.append(" -F || exit\n");
|
|
script.append("iptables -t filter -m owner --uid-owner ");
|
|
script.append(apps[i].getUid());
|
|
script.append(" -F || exit\n");
|
|
|
|
}
|
|
|
|
String[] cmdFlush = {script.toString()};
|
|
code = TorServiceUtils.doShellCommand(cmdFlush, res, true, true);
|
|
//String msg = res.toString(); //get stdout from command
|
|
|
|
script = new StringBuilder();
|
|
|
|
//build up array of shell cmds to execute under one root context
|
|
for (int i = 0; i < apps.length; i++)
|
|
{
|
|
|
|
if (forceAll || apps[i].isTorified()) //if "Tor Everything" on or app is set to true
|
|
{
|
|
|
|
if (apps[i].getUsername().equals(TorServiceConstants.TOR_APP_USERNAME))
|
|
{
|
|
//should never trans proxy the Orbot app (and Tor or Privoxy) itself
|
|
continue;
|
|
}
|
|
|
|
logNotice("enabling transproxy for app: " + apps[i].getUsername() + "(" + apps[i].getUid() + ")");
|
|
|
|
/*
|
|
* iptables -t nat -A OUTPUT -p tcp -m owner --uid-owner anonymous -m tcp --syn -j REDIRECT --to-ports 9040
|
|
iptables -t nat -A OUTPUT -p udp -m owner --uid-owner anonymous -m udp --dport 53 -j REDIRECT --to-ports 53
|
|
iptables -t nat -A OUTPUT -m owner --uid-owner anonymous -j DROP
|
|
*/
|
|
|
|
|
|
//iptables -t nat -A output -p tcp -m owner --uid-owner 100 -m tcp --sync -j REDIRECT --to-ports 9040
|
|
|
|
//TCP
|
|
script.append(baseDir);
|
|
script.append("iptables -t nat");
|
|
script.append(" -A OUTPUT -p tcp");
|
|
script.append(" -m owner --uid-owner ");
|
|
script.append(apps[i].getUid());
|
|
script.append(" -m tcp --syn");
|
|
|
|
if (ipTablesOld)
|
|
script.append(" -j DNAT --to 127.0.0.1:");
|
|
else
|
|
script.append(" -j REDIRECT --to-ports ");
|
|
|
|
script.append(TOR_TRANSPROXY_PORT);
|
|
|
|
script.append(" || exit\n");
|
|
|
|
//DNS
|
|
script.append(baseDir);
|
|
script.append("iptables -t nat");
|
|
script.append(" -A OUTPUT -p udp -m owner --uid-owner ");
|
|
script.append(apps[i].getUid());
|
|
script.append(" -m udp --dport ");
|
|
script.append(STANDARD_DNS_PORT);
|
|
|
|
if (ipTablesOld)
|
|
script.append(" -j DNAT --to 127.0.0.1:");
|
|
else
|
|
script.append(" -j REDIRECT --to-ports ");
|
|
|
|
script.append(TOR_DNS_PORT);
|
|
|
|
script.append(" || exit\n");
|
|
|
|
|
|
//EVERYTHING ELSE - DROP!
|
|
if (ipTablesOld) //for some reason this doesn't work on iptables 1.3.7
|
|
{
|
|
|
|
script.append("iptables -t nat");
|
|
script.append(" -A OUTPUT -m owner --uid-owner ");
|
|
script.append(apps[i].getUid());
|
|
script.append(" -j DROP");
|
|
script.append(" || exit\n");
|
|
}
|
|
else
|
|
{
|
|
script.append(baseDir);
|
|
script.append("iptables -t filter");
|
|
script.append(" -A OUTPUT -p tcp");
|
|
script.append(" -m owner --uid-owner ");
|
|
script.append(apps[i].getUid());
|
|
script.append(" -m tcp --dport ");
|
|
script.append(TOR_TRANSPROXY_PORT);
|
|
script.append(" -j ACCEPT");
|
|
script.append(" || exit\n");
|
|
|
|
script.append(baseDir);
|
|
script.append("iptables -t filter");
|
|
script.append(" -A OUTPUT -p udp");
|
|
script.append(" -m owner --uid-owner ");
|
|
script.append(apps[i].getUid());
|
|
script.append(" -m udp --dport ");
|
|
script.append(TOR_DNS_PORT);
|
|
script.append(" -j ACCEPT");
|
|
script.append(" || exit\n");
|
|
|
|
script.append(baseDir);
|
|
script.append("iptables");
|
|
script.append(" -t filter -A OUTPUT -m owner --uid-owner ");
|
|
script.append(apps[i].getUid());
|
|
script.append(" -j DROP"); //drop all other packets as Tor won't handle them
|
|
script.append(" || exit\n");
|
|
|
|
}
|
|
|
|
}
|
|
}
|
|
|
|
|
|
String[] cmdAdd = {script.toString()};
|
|
code = TorServiceUtils.doShellCommand(cmdAdd, res, true, true);
|
|
String msg = res.toString();
|
|
logNotice(cmdAdd[0] + ";errCode=" + code + ";resp=" + msg);
|
|
|
|
return code;
|
|
}
|
|
|
|
public static int setTransparentProxyingByPort(Context context, int port) throws Exception
|
|
{
|
|
|
|
//android.os.Debug.waitForDebugger();
|
|
|
|
//redirectDNSResolvConf(); //not working yet
|
|
|
|
String baseDir = findBaseDir();
|
|
|
|
String iptablesVersion = getIPTablesVersion();
|
|
logNotice( "iptables version: " + iptablesVersion);
|
|
|
|
boolean ipTablesOld = false;
|
|
if (iptablesVersion != null && iptablesVersion.startsWith("1.3")){
|
|
ipTablesOld = true;
|
|
}
|
|
|
|
StringBuilder script = new StringBuilder();
|
|
|
|
StringBuilder res = new StringBuilder();
|
|
int code = -1;
|
|
|
|
String[] cmdFlush = {script.toString()};
|
|
code = TorServiceUtils.doShellCommand(cmdFlush, res, true, true);
|
|
//String msg = res.toString(); //get stdout from command
|
|
|
|
script = new StringBuilder();
|
|
|
|
//TCP
|
|
//iptables -t nat -A PREROUTING -i eth0 -p tcp --dport $srcPortNumber -j REDIRECT --to-port $dstPortNumbe
|
|
|
|
script.append(baseDir);
|
|
script.append("iptables -t nat");
|
|
script.append(" -A OUTPUT -p tcp");
|
|
script.append(" --dport ");
|
|
script.append(port);
|
|
//script.append(" -m tcp --syn");
|
|
|
|
if (ipTablesOld)
|
|
script.append(" -j DNAT --to 127.0.0.1:");
|
|
else
|
|
script.append(" -j REDIRECT --to-ports ");
|
|
|
|
script.append(TOR_TRANSPROXY_PORT);
|
|
|
|
script.append(" || exit\n");
|
|
|
|
script.append(baseDir);
|
|
script.append("iptables -t nat");
|
|
script.append(" -A OUTPUT -p udp");
|
|
script.append(" --dport ");
|
|
script.append(port);
|
|
|
|
if (ipTablesOld)
|
|
script.append(" -j DNAT --to 127.0.0.1:");
|
|
else
|
|
script.append(" -j REDIRECT --to-ports ");
|
|
|
|
script.append(TOR_TRANSPROXY_PORT);
|
|
|
|
script.append(" || exit\n");
|
|
|
|
//DNS
|
|
script.append(baseDir);
|
|
script.append("iptables -t nat");
|
|
script.append(" -A OUTPUT -p udp ");
|
|
script.append(" -m udp --dport ");
|
|
script.append(STANDARD_DNS_PORT);
|
|
|
|
if (ipTablesOld)
|
|
script.append(" -j DNAT --to 127.0.0.1:");
|
|
else
|
|
script.append(" -j REDIRECT --to-ports ");
|
|
|
|
script.append(TOR_DNS_PORT);
|
|
|
|
script.append(" || exit\n");
|
|
|
|
|
|
String[] cmdAdd = {script.toString()};
|
|
code = TorServiceUtils.doShellCommand(cmdAdd, res, true, true);
|
|
String msg = res.toString();
|
|
logNotice(cmdAdd[0] + ";errCode=" + code + ";resp=" + msg);
|
|
|
|
return code;
|
|
}
|
|
|
|
|
|
}
|