commit 2628565b45a6a757e8e8f48605b7d2f31a3b515b
Author: Nathan Freitas <[email protected]>
Date: Thu Apr 17 11:34:31 2014 -0400
fix issues with per-app filtering and ipv6
---
.../torproject/android/service/TorTransProxy.java | 93 +++++++++-----------
1 file changed, 44 insertions(+), 49 deletions(-)
diff --git a/src/org/torproject/android/service/TorTransProxy.java
b/src/org/torproject/android/service/TorTransProxy.java
index aa30bd2..f7fd535 100644
--- a/src/org/torproject/android/service/TorTransProxy.java
+++ b/src/org/torproject/android/service/TorTransProxy.java
@@ -330,6 +330,8 @@ public class TorTransProxy implements TorServiceConstants {
String srcChainName = "OUTPUT";
+ int torUid = context.getApplicationInfo().uid;
+
//run the delete commands in a separate process as it might error out
//String[] cmdExecClear = {script.toString()};
//code = TorServiceUtils.doShellCommand(cmdExecClear, res,
runRoot, waitFor);
@@ -338,6 +340,10 @@ public class TorTransProxy implements TorServiceConstants {
Shell shell = Shell.startRootShell();
int lastExit = -1;
+ StringBuilder script;
+
+
+ // Allow everything for Tor
//build up array of shell cmds to execute under one root context
for (TorifiedApp tApp:apps)
@@ -348,10 +354,12 @@ public class TorTransProxy implements TorServiceConstants
{
) //if app is set to true
{
- StringBuilder script = new StringBuilder();
logMessage("enabling transproxy for app: " +
tApp.getUsername() + "(" + tApp.getUid() + ")");
+ dropAllIPv6Traffic(context, tApp.getUid());
+
+ script = new StringBuilder();
// Allow loopback
script.append(ipTablesPath);
@@ -385,7 +393,6 @@ public class TorTransProxy implements TorServiceConstants {
script.append(" -t nat");
script.append(" -A ").append(srcChainName);
script.append(" -p udp");
- script.append(ALLOW_LOCAL); //allow access to
localhost
script.append(" -m owner ! --uid-owner ");
script.append(tApp.getUid());
script.append(" -m udp --dport ");
@@ -393,40 +400,6 @@ public class TorTransProxy implements TorServiceConstants {
script.append(" -j REDIRECT --to-ports ");
script.append(TOR_DNS_PORT);
-
- executeCommand (shell, script.toString());
- script = new StringBuilder();
-
-
- int[] ports =
{TOR_TRANSPROXY_PORT,PORT_SOCKS,PORT_HTTP};
-
- for (int port : ports)
- {
- // Allow packets to localhost (contains
all the port-redirected ones)
- script.append(ipTablesPath);
- script.append(" -t filter");
- script.append(" -A ").append(srcChainName);
- script.append(" -p tcp");
- script.append(" -m owner --uid-owner ");
- script.append(tApp.getUid());
- script.append(" --dport ");
- script.append(port);
- script.append(" -j ACCEPT");
-
- executeCommand (shell,
script.toString());
- script = new StringBuilder();
- }
-
- script.append(ipTablesPath);
- script.append(" -t filter");
- script.append(" -A ").append(srcChainName);
- script.append(" -p udp");
- script.append(" -m owner --uid-owner ");
- script.append(tApp.getUid());
- script.append(" --dport ");
- script.append(TOR_DNS_PORT);
- script.append(" -j ACCEPT");
-
executeCommand (shell, script.toString());
script = new StringBuilder();
@@ -437,10 +410,9 @@ public class TorTransProxy implements TorServiceConstants {
script.append(" -m owner --uid-owner ");
script.append(tApp.getUid());
script.append(ALLOW_LOCAL);
- script.append(" -j DROP");
+ script.append(" -j REJECT");
lastExit = executeCommand (shell,
script.toString());
- script = new StringBuilder();
}
@@ -455,8 +427,7 @@ public class TorTransProxy implements TorServiceConstants {
{
SimpleCommand cmd = new SimpleCommand(cmdString + "|| exit");
shell.add(cmd);
- cmd.waitForFinish();
- logMessage(cmdString + "; exit=" + cmd.getExitCode() +
";output=" + cmd.getOutput());
+ logMessage(cmdString);// + "; exit=" + cmd.getExitCode() +
";output=" + cmd.getOutput());
return cmd.getExitCode();
}
@@ -543,6 +514,8 @@ public class TorTransProxy implements TorServiceConstants {
int lastExit = executeCommand (shell, script.toString());
shell.close();
+
+ clearAllIPv6Filters(context);
return lastExit;
}
@@ -573,7 +546,7 @@ public class TorTransProxy implements TorServiceConstants {
}
- public int dropAllIPv6Traffic (Context context) throws Exception
+ public int dropAllIPv6Traffic (Context context, int appUid) throws
Exception
{
String ip6tablesPath = getIp6TablesPath(context);
@@ -581,17 +554,39 @@ public class TorTransProxy implements TorServiceConstants
{
StringBuilder script;
-
- // Allow everything for Tor
-
- script = new StringBuilder();
+
+ script = new StringBuilder();
script.append(ip6tablesPath);
- script.append(" -A INPUT -j DROP");
- executeCommand (shell, script.toString());
+ script.append(" -A OUTPUT");
+
+ if (appUid != -1)
+ {
+ script.append(" -m owner --uid-owner ");
+ script.append(appUid);
+ }
+
+ script.append(" -j DROP");
+
+ int lastExit = executeCommand (shell, script.toString());
+
+ shell.close();
+
+ return lastExit;
+ }
+
+ public int clearAllIPv6Filters (Context context) throws Exception
+ {
+
+ String ip6tablesPath = getIp6TablesPath(context);
+ Shell shell = Shell.startRootShell();
+
+
+ StringBuilder script;
script = new StringBuilder();
script.append(ip6tablesPath);
- script.append(" -A OUTPUT -j DROP");
+ script.append(" -t filter");
+ script.append(" -F OUTPUT");
int lastExit = executeCommand (shell, script.toString());
shell.close();
@@ -602,7 +597,7 @@ public class TorTransProxy implements TorServiceConstants {
public int setTransparentProxyingAll(Context context) throws Exception
{
- dropAllIPv6Traffic(context);
+ dropAllIPv6Traffic(context,-1);
String ipTablesPath = getIpTablesPath(context);
_______________________________________________
tor-commits mailing list
[email protected]
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-commits
