tor-commits October 2012

tor-commits@lists.torproject.org

20 participants
1288 discussions

[tor/master] properly free the return values of rate_limit_log()
by nickm＠torproject.org 04 Oct '12

04 Oct '12

commit b1971d89c8776f06ddce7f44d98dde79c3dfc223 Author: Roger Dingledine <arma(a)torproject.org> Date: Wed Oct 3 13:15:27 2012 -0400 properly free the return values of rate_limit_log() resolves bug 7022. --- changes/bug7022 | 3 +++ src/or/circuitbuild.c | 27 ++++++++++++++++++--------- 2 files changed, 21 insertions(+), 9 deletions(-) diff --git a/changes/bug7022 b/changes/bug7022 new file mode 100644 index 0000000..10ac354 --- /dev/null +++ b/changes/bug7022 @@ -0,0 +1,3 @@ + o Minor bugfixes: + - Fix memory leaks whenever we logged any message about the "path + bias" detection. Fixes bug 7022; bugfix on 0.2.3.21-rc. diff --git a/src/or/circuitbuild.c b/src/or/circuitbuild.c index ffc7b5e..a7d370c 100644 --- a/src/or/circuitbuild.c +++ b/src/or/circuitbuild.c @@ -2655,12 +2655,13 @@ pathbias_count_first_hop(origin_circuit_t *circ) approx_time()))) { log_info(LD_BUG, "One-hop circuit has length %d. Path state is %s. " - "Circuit is a %s currently %s. %s", + "Circuit is a %s currently %s.%s", circ->build_state->desired_path_len, pathbias_state_to_string(circ->path_state), circuit_purpose_to_string(circ->_base.purpose), circuit_state_to_string(circ->_base.state), rate_msg); + tor_free(rate_msg); } tor_fragile_assert(); } @@ -2674,11 +2675,12 @@ pathbias_count_first_hop(origin_circuit_t *circ) approx_time()))) { log_info(LD_BUG, "Opened circuit is in strange path state %s. " - "Circuit is a %s currently %s. %s", + "Circuit is a %s currently %s.%s", pathbias_state_to_string(circ->path_state), circuit_purpose_to_string(circ->_base.purpose), circuit_state_to_string(circ->_base.state), rate_msg); + tor_free(rate_msg); } } @@ -2701,11 +2703,12 @@ pathbias_count_first_hop(origin_circuit_t *circ) approx_time()))) { log_info(LD_BUG, "Unopened circuit has strange path state %s. " - "Circuit is a %s currently %s. %s", + "Circuit is a %s currently %s.%s", pathbias_state_to_string(circ->path_state), circuit_purpose_to_string(circ->_base.purpose), circuit_state_to_string(circ->_base.state), rate_msg); + tor_free(rate_msg); } } } else { @@ -2713,10 +2716,11 @@ pathbias_count_first_hop(origin_circuit_t *circ) approx_time()))) { log_info(LD_BUG, "Unopened circuit has no known guard. " - "Circuit is a %s currently %s. %s", + "Circuit is a %s currently %s.%s", circuit_purpose_to_string(circ->_base.purpose), circuit_state_to_string(circ->_base.state), rate_msg); + tor_free(rate_msg); } } } @@ -2727,12 +2731,13 @@ pathbias_count_first_hop(origin_circuit_t *circ) approx_time()))) { log_info(LD_BUG, "A %s circuit is in cpath state %d (opened: %d). " - "Circuit is a %s currently %s. %s", + "Circuit is a %s currently %s.%s", pathbias_state_to_string(circ->path_state), circ->cpath->state, circ->has_opened, circuit_purpose_to_string(circ->_base.purpose), circuit_state_to_string(circ->_base.state), rate_msg); + tor_free(rate_msg); } } } @@ -2765,12 +2770,13 @@ pathbias_count_success(origin_circuit_t *circ) approx_time()))) { log_info(LD_BUG, "One-hop circuit has length %d. Path state is %s. " - "Circuit is a %s currently %s. %s", + "Circuit is a %s currently %s.%s", circ->build_state->desired_path_len, pathbias_state_to_string(circ->path_state), circuit_purpose_to_string(circ->_base.purpose), circuit_state_to_string(circ->_base.state), rate_msg); + tor_free(rate_msg); } tor_fragile_assert(); } @@ -2795,11 +2801,12 @@ pathbias_count_success(origin_circuit_t *circ) approx_time()))) { log_info(LD_BUG, "Succeeded circuit is in strange path state %s. " - "Circuit is a %s currently %s. %s", + "Circuit is a %s currently %s.%s", pathbias_state_to_string(circ->path_state), circuit_purpose_to_string(circ->_base.purpose), circuit_state_to_string(circ->_base.state), rate_msg); + tor_free(rate_msg); } } @@ -2814,10 +2821,11 @@ pathbias_count_success(origin_circuit_t *circ) approx_time()))) { log_info(LD_BUG, "Completed circuit has no known guard. " - "Circuit is a %s currently %s. %s", + "Circuit is a %s currently %s.%s", circuit_purpose_to_string(circ->_base.purpose), circuit_state_to_string(circ->_base.state), rate_msg); + tor_free(rate_msg); } } } else { @@ -2826,11 +2834,12 @@ pathbias_count_success(origin_circuit_t *circ) approx_time()))) { log_info(LD_BUG, "Opened circuit is in strange path state %s. " - "Circuit is a %s currently %s. %s", + "Circuit is a %s currently %s.%s", pathbias_state_to_string(circ->path_state), circuit_purpose_to_string(circ->_base.purpose), circuit_state_to_string(circ->_base.state), rate_msg); + tor_free(rate_msg); } } }

1 0

[tor/maint-0.2.3] properly free the return values of rate_limit_log()
by nickm＠torproject.org 04 Oct '12

04 Oct '12

1 0

[tor/master] pass the reason from the truncated cell to the controller
by nickm＠torproject.org 04 Oct '12

04 Oct '12

commit 10b43f4c46378c5d08aaba01ee00081c18002a44 Author: Roger Dingledine <arma(a)torproject.org> Date: Wed Oct 3 23:56:34 2012 -0400 pass the reason from the truncated cell to the controller (rather than just always declaring that the reason is END_CIRC_REASON_OR_CONN_CLOSED) resolves bug 7039. --- changes/bug7039 | 7 +++++++ src/or/circuitbuild.c | 4 ++-- src/or/circuitbuild.h | 3 ++- src/or/relay.c | 3 ++- 4 files changed, 13 insertions(+), 4 deletions(-) diff --git a/changes/bug7039 b/changes/bug7039 new file mode 100644 index 0000000..dc5111a --- /dev/null +++ b/changes/bug7039 @@ -0,0 +1,7 @@ + o Minor bugfixes: + - When a Tor client gets a "truncated" relay cell, the first byte of + its payload specifies why the circuit was truncated. We were + ignoring this 'reason' byte when tearing down the circuit, resulting + in the controller not being told why the circuit closed. Now we + pass the reason from the truncated cell to the controller. Bugfix + on 0.1.2.3-alpha; fixes bug 7039. diff --git a/src/or/circuitbuild.c b/src/or/circuitbuild.c index 09eef64..be97b7c 100644 --- a/src/or/circuitbuild.c +++ b/src/or/circuitbuild.c @@ -2999,7 +2999,7 @@ circuit_finish_handshake(origin_circuit_t *circ, uint8_t reply_type, * just give up: for circ to close, and return 0. */ int -circuit_truncated(origin_circuit_t *circ, crypt_path_t *layer) +circuit_truncated(origin_circuit_t *circ, crypt_path_t *layer, int reason) { // crypt_path_t *victim; // connection_t *stream; @@ -3012,7 +3012,7 @@ circuit_truncated(origin_circuit_t *circ, crypt_path_t *layer) * just give up. */ circuit_mark_for_close(TO_CIRCUIT(circ), - END_CIRC_REASON_FLAG_REMOTE|END_CIRC_REASON_OR_CONN_CLOSED); + END_CIRC_REASON_FLAG_REMOTE|reason); return 0; #if 0 diff --git a/src/or/circuitbuild.h b/src/or/circuitbuild.h index c3905ca..8ec48be 100644 --- a/src/or/circuitbuild.h +++ b/src/or/circuitbuild.h @@ -32,7 +32,8 @@ int circuit_init_cpath_crypto(crypt_path_t *cpath, const char *key_data, int reverse); int circuit_finish_handshake(origin_circuit_t *circ, uint8_t cell_type, const uint8_t *reply); -int circuit_truncated(origin_circuit_t *circ, crypt_path_t *layer); +int circuit_truncated(origin_circuit_t *circ, crypt_path_t *layer, + int reason); int onionskin_answer(or_circuit_t *circ, uint8_t cell_type, const char *payload, const char *keys); int circuit_all_predicted_ports_handled(time_t now, int *need_uptime, diff --git a/src/or/relay.c b/src/or/relay.c index 54f6634..4a50b71 100644 --- a/src/or/relay.c +++ b/src/or/relay.c @@ -1251,7 +1251,8 @@ connection_edge_process_relay_cell(cell_t *cell, circuit_t *circ, "'truncated' unsupported at non-origin. Dropping."); return 0; } - circuit_truncated(TO_ORIGIN_CIRCUIT(circ), layer_hint); + circuit_truncated(TO_ORIGIN_CIRCUIT(circ), layer_hint, + get_uint8(cell->payload + RELAY_HEADER_SIZE)); return 0; case RELAY_COMMAND_CONNECTED: if (conn) {

1 0

[translation/orbot] Update translations for orbot
by translation＠torproject.org 04 Oct '12

04 Oct '12

commit 7981e08206c7aa96f007e3815456cf0adfece051 Author: Translation commit bot <translation(a)torproject.org> Date: Thu Oct 4 10:15:05 2012 +0000 Update translations for orbot --- values-ru/strings.xml | 3 +++ 1 files changed, 3 insertions(+), 0 deletions(-) diff --git a/values-ru/strings.xml b/values-ru/strings.xml index 81078b2..aa89294 100644 --- a/values-ru/strings.xml +++ b/values-ru/strings.xml @@ -72,6 +72,9 @@ <string name="wizard_tips_msg">Мы советуем вам скачать и использовать приложения, которые умеют работать напрямую через Orbot. Нажмите на кнопки ниже, чтобы запустить процесс установки.</string> <string name="wizard_tips_otrchat">Gibberbot - Secure instant messaging client for Android</string> <string name="wizard_tips_proxy">Настройки прокси - узнайте как настроить приложения для работы с Orbot</string> + <string name="wizard_tips_duckgo">Приложение поисковой системы Duckduckgo</string> + <string name="wizard_tips_firefox">Firefox с дополнением Proxy Mobile (после отдельной установки)</string> + <string name="wizard_tips_twitter">Twitter поддерживает http прокси \"localhost:8118\"</string> <string name="wizard_proxy_help_info">Настройки Прокси</string> <string name="wizard_proxy_help_msg">Если используемое вами приложение для Android поддерживает HTTP или SOCKS прокси, то вы можете настроить его на подключение к Orbot и использование Tor.\n\n\n Значение хоста - 127.0.0.1 или \"localhost\". Для HTTP, номер порта - 8118. Для SOCKS прокси - 9050. По возможности используйте SOCKS4A или SOCKS5.\n\n \n Вы можете узнать больше о работе через прокси на Android, прочитав этот FAQ: http://tinyurl.com/proxyandroid\n </string> <string name="wizard_final">Программа Orbot готова к использованию!</string>

1 0

[orbot/master] fixes log layout for narrow screens
by n8fr8＠torproject.org 04 Oct '12

04 Oct '12

commit a593423e3a99f8ac72cf477ac1bfe426f3f00d42 Author: n8fr8 <nathan(a)freitas.net> Date: Thu Oct 4 11:26:12 2012 +0530 fixes log layout for narrow screens --- res/layout/layout_main.xml | 51 +++++++++++++++++++++++++++---------------- 1 files changed, 32 insertions(+), 19 deletions(-) diff --git a/res/layout/layout_main.xml b/res/layout/layout_main.xml index 909d250..1d1bc18 100644 --- a/res/layout/layout_main.xml +++ b/res/layout/layout_main.xml @@ -76,53 +76,66 @@ android:text="@string/menu_log" ></Button> <RelativeLayout android:id="@+id/trafficRow" - android:gravity="bottom" + android:gravity="top" android:layout_width="fill_parent" android:visibility="invisible" android:layout_height="wrap_content" android:padding="6dp" android:layout_marginTop="6dp" android:background="#ee333333"> + + <RelativeLayout + android:id="@+id/rowTrafficDown" android:layout_width="fill_parent" + android:layout_height="wrap_content" + android:orientation="horizontal" + > <TextView android:id="@+id/trafficDownLabel" android:textColor="#FFFFFFFF" android:layout_width="wrap_content" android:layout_height="wrap_content" - android:layout_alignParentLeft="true" - android:textSize="16sp" + android:layout_alignParentLeft="true" + android:textSize="20sp" android:text="@string/main_layout_download" - android:gravity="center_vertical|center_horizontal" + android:gravity="center_vertical" android:textStyle="bold" /> + <TextView - android:id="@+id/trafficUpLabel" - android:textColor="#FFFFFFFF" + android:id="@+id/trafficDown" + android:textColor="#FF00B627" android:layout_width="wrap_content" android:layout_height="wrap_content" - android:layout_alignParentRight="true" - android:text="@string/main_layout_upload" - android:textSize="16sp" - android:gravity="center_vertical|center_horizontal" + android:layout_alignParentRight="true" + android:textSize="20sp" + android:gravity="center_vertical" android:textStyle="bold" /> + </RelativeLayout> + <RelativeLayout + android:id="@+id/rowTrafficUp" + android:layout_width="fill_parent" + android:layout_height="wrap_content" + android:layout_below="@+id/rowTrafficDown" + > <TextView - android:id="@+id/trafficDown" - android:textColor="#FF00B627" + android:id="@+id/trafficUpLabel" + android:textColor="#FFFFFFFF" android:layout_width="wrap_content" android:layout_height="wrap_content" - android:layout_alignParentLeft="true" - android:layout_below="@+id/trafficDownLabel" + android:layout_alignParentLeft="true" + android:text="@string/main_layout_upload" android:textSize="20sp" - android:gravity="center_vertical|center_horizontal" + android:gravity="center_vertical" android:textStyle="bold" /> <TextView android:id="@+id/trafficUp" android:textColor="#FF00B627" android:layout_width="wrap_content" android:layout_height="wrap_content" - android:layout_alignParentRight="true" - android:layout_below="@+id/trafficUpLabel" + android:layout_alignParentRight="true" android:textSize="20sp" - android:gravity="center_vertical|center_horizontal" + android:gravity="center_vertical" android:textStyle="bold" /> + </RelativeLayout> <TextView android:id="@+id/orbotLog" android:textColor="#FFFFFF" @@ -131,7 +144,7 @@ android:layout_width="fill_parent" android:layout_height="wrap_content" android:layout_alignParentLeft="true" - android:layout_below="@+id/trafficDown" + android:layout_below="@+id/rowTrafficUp" android:layout_marginTop="10dp" android:textIsSelectable="true" />

1 0

[orbot/master] updated display for setting data transfer UI
by n8fr8＠torproject.org 04 Oct '12

04 Oct '12

commit db128fbc2a708a491c98b0f62f08e1d8be783e0a Author: n8fr8 <nathan(a)freitas.net> Date: Thu Oct 4 11:27:09 2012 +0530 updated display for setting data transfer UI --- src/org/torproject/android/Orbot.java | 38 +++++++++++++++++--------------- 1 files changed, 20 insertions(+), 18 deletions(-) diff --git a/src/org/torproject/android/Orbot.java b/src/org/torproject/android/Orbot.java index b4040fd..bdad7ae 100644 --- a/src/org/torproject/android/Orbot.java +++ b/src/org/torproject/android/Orbot.java @@ -824,27 +824,29 @@ public class Orbot extends Activity implements TorConstants, OnLongClickListener String TotalUpload = ""; String TotalDownload = ""; - try { - TotalUpload = mService.getInfo("traffic/written"); - TotalDownload = mService.getInfo("traffic/read"); - - } catch (RemoteException e) { - Log.d(TAG,"Total bandwidth error"+e.getMessage()); - } - - try + if (mService != null) { - downloadText.setText(formatCount(datacount.Download) + " / " + formatTotal(Long.parseLong(TotalDownload))); - uploadText.setText(formatCount(datacount.Upload) + " / " + formatTotal(Long.parseLong(TotalUpload))); + try { + TotalUpload = mService.getInfo("traffic/written"); + TotalDownload = mService.getInfo("traffic/read"); + + } catch (RemoteException e) { + Log.d(TAG,"Total bandwidth error"+e.getMessage()); + } - downloadText.invalidate(); - uploadText.invalidate(); + try + { + downloadText.setText(formatCount(datacount.Download) + " / " + formatTotal(Long.parseLong(TotalDownload))); + uploadText.setText(formatCount(datacount.Upload) + " / " + formatTotal(Long.parseLong(TotalUpload))); + + downloadText.invalidate(); + uploadText.invalidate(); + } + catch (NumberFormatException nfe) + { + //just ignore/swallow + } } - catch (NumberFormatException nfe) - { - //just ignore/swallow - } - break; default:

1 0

[orbot/master] allows UDP packets to localhost for DNS
by n8fr8＠torproject.org 04 Oct '12

04 Oct '12

commit 6e45cab8ee8b221f15899ae101fc9bf90e6e1311 Author: n8fr8 <nathan(a)freitas.net> Date: Thu Oct 4 11:27:17 2012 +0530 allows UDP packets to localhost for DNS --- .../torproject/android/service/TorTransProxy.java | 16 +++++++++++++++- 1 files changed, 15 insertions(+), 1 deletions(-) diff --git a/src/org/torproject/android/service/TorTransProxy.java b/src/org/torproject/android/service/TorTransProxy.java index 6db0437..bd2c58a 100644 --- a/src/org/torproject/android/service/TorTransProxy.java +++ b/src/org/torproject/android/service/TorTransProxy.java @@ -309,6 +309,7 @@ public class TorTransProxy implements TorServiceConstants { script.append(" || exit\n"); // Reject DNS that is not from Tor (order is important - first matched rule counts!) + /* script.append(ipTablesPath); script.append(modCmd); script.append(" -t filter"); @@ -319,6 +320,7 @@ public class TorTransProxy implements TorServiceConstants { script.append(STANDARD_DNS_PORT); script.append(" -j REJECT"); script.append(" || exit\n"); + */ // Reject all other outbound TCP packets script.append(ipTablesPath); @@ -327,6 +329,7 @@ public class TorTransProxy implements TorServiceConstants { script.append(" -m owner --uid-owner "); script.append(tApp.getUid()); script.append(" -p tcp"); + script.append(" ! -d 127.0.0.1"); //allow access to localhost script.append(" -j REJECT"); script.append(" || exit\n"); @@ -337,6 +340,7 @@ public class TorTransProxy implements TorServiceConstants { script.append(" -m owner --uid-owner "); script.append(tApp.getUid()); script.append(" -p udp"); + script.append(" ! -d 127.0.0.1"); //allow access to localhost script.append(" -j REJECT"); script.append(" || exit\n"); @@ -493,7 +497,7 @@ public class TorTransProxy implements TorServiceConstants { //flushIptables(context); int torUid = context.getApplicationInfo().uid; - + // Set up port redirection script.append(ipTablesPath); script.append(" -" + cmd + " OUTPUT"); @@ -580,20 +584,27 @@ public class TorTransProxy implements TorServiceConstants { } // Reject DNS that is not from Tor (order is important - first matched rule counts!) + /* script.append(ipTablesPath); script.append(" -" + cmd + " OUTPUT"); script.append(" -t filter"); + script.append(" -m owner ! --uid-owner "); + script.append(torUid); script.append(" -p udp"); script.append(" --dport "); script.append(STANDARD_DNS_PORT); script.append(" -j REJECT"); script.append(" || exit\n"); + */ // Reject all other outbound TCP packets script.append(ipTablesPath); script.append(" -" + cmd + " OUTPUT"); script.append(" -t filter"); + script.append(" -m owner ! --uid-owner "); + script.append(torUid); script.append(" -p tcp"); + script.append(" ! -d 127.0.0.1"); //allow access to localhost script.append(" -j REJECT"); script.append(" || exit\n"); @@ -601,7 +612,10 @@ public class TorTransProxy implements TorServiceConstants { script.append(ipTablesPath); script.append(" -" + cmd + " OUTPUT"); script.append(" -t filter"); + script.append(" -m owner ! --uid-owner "); + script.append(torUid); script.append(" -p udp"); + script.append(" ! -d 127.0.0.1"); //allow access to localhost script.append(" -j REJECT"); script.append(" || exit\n");

1 0

[orbot/master] updated change log for v11 RC1
by n8fr8＠torproject.org 04 Oct '12

04 Oct '12

commit 433f1cdeb95908a4f2181de91e8d2a316cba5e2c Author: n8fr8 <nathan(a)freitas.net> Date: Mon Oct 1 13:21:57 2012 +0530 updated change log for v11 RC1 --- CHANGELOG | 12 ++++++++++++ 1 files changed, 12 insertions(+), 0 deletions(-) diff --git a/CHANGELOG b/CHANGELOG index f01f6de..fafc51a 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -1,5 +1,17 @@ NOTE: Specific #s below correspond to Trac tickets logged and maintained at https://trac.torproject.org/projects/tor/ +1.0.11 +- Tor updated to 0.2.4-alpha +- libevent2 on 2.2.1-alpha +- added data up/down speed and totals display +- added new "Log" SlideDrawer log display +- added ability to copy logs by touching log (for emailing, debugging) +- fixed iptables Android 4/Jellybean compatible binary detection +- iptables add/delete now on specific rules; no more global FLUSHing +- transproxy ensures that UDP is blocked properly for all or selected apps +- wizard display is centered +- added network connectivity monitor to set Tor's DisableNetwork value + 1.0.9 - Tor now updated to 0.2.3.17-beta - Privoxy updated to 3.0.12

1 0

[orbot/master] collection of submitted patches
by n8fr8＠torproject.org 04 Oct '12

04 Oct '12

commit 3ff65d2eed91922ac5a88bd6a1c51cd412d8a271 Author: n8fr8 <nathan(a)freitas.net> Date: Thu Oct 4 11:28:47 2012 +0530 collection of submitted patches --- patches/UDP-block.patch | 243 +++++++++++++++++++++++++++++++++++++ patches/udptransproxyfinal.patch | 247 ++++++++++++++++++++++++++++++++++++++ 2 files changed, 490 insertions(+), 0 deletions(-) diff --git a/patches/UDP-block.patch b/patches/UDP-block.patch new file mode 100644 index 0000000..e16a957 --- /dev/null +++ b/patches/UDP-block.patch @@ -0,0 +1,243 @@ +From c2620d6939713762e30badc3ed5da981e296b742 Mon Sep 17 00:00:00 2001 +From: patch <patrickbx(a)gmail.com> +Date: Mon, 23 Jul 2012 16:12:55 -0400 +Subject: [PATCH] Modified iptables rules for transproxying. UDP is now + blocked. Also removed some redundant rules and reordered + others. I reordered by the idea that its generally easier + to specifically allow traffic before your reject it. + +--- + .../torproject/android/service/TorTransProxy.java | 133 ++++++++++---------- + 1 file changed, 64 insertions(+), 69 deletions(-) + +diff --git a/src/org/torproject/android/service/TorTransProxy.java b/src/org/torproject/android/service/TorTransProxy.java +index 2571123..c248a9f 100644 +--- a/src/org/torproject/android/service/TorTransProxy.java ++++ b/src/org/torproject/android/service/TorTransProxy.java +@@ -224,6 +224,15 @@ public class TorTransProxy implements TorServiceConstants { + + int torUid = context.getApplicationInfo().uid; + ++ // Allow everything for Tor ++ script.append(ipTablesPath); ++ script.append(" -t filter"); ++ script.append(" -A OUTPUT"); ++ script.append(" -m owner --uid-owner "); ++ script.append(torUid); ++ script.append(" -j ACCEPT"); ++ script.append(" || exit\n"); ++ + //build up array of shell cmds to execute under one root context + for (TorifiedApp tApp:apps) + { +@@ -235,9 +244,9 @@ public class TorTransProxy implements TorServiceConstants { + { + + TorService.logMessage("enabling transproxy for app: " + tApp.getUsername() + "(" + tApp.getUid() + ")"); +- +- // Set up port redirection +- script.append(ipTablesPath); ++ ++ // Set up port redirection ++ script.append(ipTablesPath); + script.append(" -t nat"); + script.append(" -A OUTPUT -p tcp"); + script.append(" ! -d 127.0.0.1"); //allow access to localhost +@@ -251,14 +260,28 @@ public class TorTransProxy implements TorServiceConstants { + // Same for DNS + script.append(ipTablesPath); + script.append(" -t nat"); +- script.append(" -A OUTPUT -p udp -m owner --uid-owner "); ++ script.append(" -A OUTPUT -p udp"); ++ script.append(" -m owner --uid-owner "); + script.append(tApp.getUid()); + script.append(" -m udp --dport "); + script.append(STANDARD_DNS_PORT); + script.append(" -j REDIRECT --to-ports "); + script.append(TOR_DNS_PORT); + script.append(" || exit\n"); +- ++ ++ // Allow loopback ++ script.append(ipTablesPath); ++ script.append(" -t filter"); ++ script.append(" -A OUTPUT"); ++ script.append(" -m owner --uid-owner "); ++ script.append(tApp.getUid()); ++ script.append(" -o lo"); ++ script.append(" -j ACCEPT"); ++ script.append(" || exit\n"); ++ ++ /* ++ //Outgoing loopback already allowed (23/7/12) ++ + int[] ports = {TOR_DNS_PORT,TOR_TRANSPROXY_PORT,PORT_SOCKS,PORT_HTTP}; + + for (int port : ports) +@@ -276,53 +299,32 @@ public class TorTransProxy implements TorServiceConstants { + script.append(" -j ACCEPT"); + script.append(" || exit\n"); + } +- +- // Allow loopback ++ */ ++ ++ // Reject all other outbound TCP packets + script.append(ipTablesPath); + script.append(" -t filter"); + script.append(" -A OUTPUT"); + script.append(" -m owner --uid-owner "); + script.append(tApp.getUid()); + script.append(" -p tcp"); +- script.append(" -o lo"); +- script.append(" -j ACCEPT"); +- script.append(" || exit\n"); +- +- // Reject DNS that is not from Tor (order is important - first matched rule counts!) +- script.append(ipTablesPath); +- script.append(" -t filter"); +- script.append(" -A OUTPUT"); +- script.append(" -m owner --uid-owner "); +- script.append(tApp.getUid()); +- script.append(" -p udp"); +- script.append(" --dport "); +- script.append(STANDARD_DNS_PORT); + script.append(" -j REJECT"); + script.append(" || exit\n"); +- +- // Reject all other outbound TCP packets ++ ++ // Reject all other outbound UDP packets + script.append(ipTablesPath); + script.append(" -t filter"); + script.append(" -A OUTPUT"); + script.append(" -m owner --uid-owner "); + script.append(tApp.getUid()); +- script.append(" -p tcp"); ++ script.append(" -p udp"); + script.append(" -j REJECT"); + script.append(" || exit\n"); ++ + + } + } +- + +- // Allow everything for Tor +- script.append(ipTablesPath); +- script.append(" -t filter"); +- script.append(" -A OUTPUT"); +- script.append(" -m owner --uid-owner "); +- script.append(torUid); +- script.append(" -j ACCEPT"); +- script.append(" || exit\n"); +- + String[] cmdAdd = {script.toString()}; + + code = TorServiceUtils.doShellCommand(cmdAdd, res, runRoot, waitFor); +@@ -450,8 +452,8 @@ public class TorTransProxy implements TorServiceConstants { + + int torUid = context.getApplicationInfo().uid; + +- // Set up port redirection +- script.append(ipTablesPath); ++ // Set up port redirection ++ script.append(ipTablesPath); + script.append(" -t nat"); + script.append(" -A OUTPUT -p tcp"); + script.append(" ! -d 127.0.0.1"); //allow access to localhost +@@ -465,14 +467,36 @@ public class TorTransProxy implements TorServiceConstants { + // Same for DNS + script.append(ipTablesPath); + script.append(" -t nat"); +- script.append(" -A OUTPUT -p udp -m owner ! --uid-owner "); ++ script.append(" -A OUTPUT -p udp"); ++ script.appent(" -m owner ! --uid-owner "); + script.append(torUid); + script.append(" -m udp --dport "); + script.append(STANDARD_DNS_PORT); + script.append(" -j REDIRECT --to-ports "); + script.append(TOR_DNS_PORT); + script.append(" || exit\n"); ++ ++ // Allow loopback ++ script.append(ipTablesPath); ++ script.append(" -t filter"); ++ script.append(" -A OUTPUT"); ++ script.append(" -o lo"); ++ script.append(" -j ACCEPT"); ++ script.append(" || exit\n"); + ++ // Allow everything for Tor ++ script.append(ipTablesPath); ++ script.append(" -t filter"); ++ script.append(" -A OUTPUT"); ++ script.append(" -m owner --uid-owner "); ++ script.append(torUid); ++ script.append(" -j ACCEPT"); ++ script.append(" || exit\n"); ++ ++ ++ /* ++ //Outgoing loopback already allowed (23/7/12) ++ + int[] ports = {TOR_DNS_PORT,TOR_TRANSPROXY_PORT,PORT_SOCKS,PORT_HTTP}; + + for (int port : ports) +@@ -490,25 +514,8 @@ public class TorTransProxy implements TorServiceConstants { + script.append(" -j ACCEPT"); + script.append(" || exit\n"); + +- } +- +- // Allow loopback +- script.append(ipTablesPath); +- script.append(" -t filter"); +- script.append(" -A OUTPUT"); +- script.append(" -p tcp"); +- script.append(" -o lo"); +- script.append(" -j ACCEPT"); +- script.append(" || exit\n"); ++ } */ + +- // Allow everything for Tor +- script.append(ipTablesPath); +- script.append(" -t filter"); +- script.append(" -A OUTPUT"); +- script.append(" -m owner --uid-owner "); +- script.append(torUid); +- script.append(" -j ACCEPT"); +- script.append(" || exit\n"); + + if (TorService.ENABLE_DEBUG_LOG) + { +@@ -532,23 +539,11 @@ public class TorTransProxy implements TorServiceConstants { + script.append(" --log-uid"); + script.append(" || exit\n"); + } +- +- // Reject DNS that is not from Tor (order is important - first matched rule counts!) +- script.append(ipTablesPath); +- script.append(" -t filter"); +- script.append(" -A OUTPUT"); +- script.append(" -p udp"); +- script.append(" --dport "); +- script.append(STANDARD_DNS_PORT); +- script.append(" -j REJECT"); +- script.append(" || exit\n"); +- +- // Reject all other outbound TCP packets ++ ++ // Reject all other outbound packets by default + script.append(ipTablesPath); + script.append(" -t filter"); +- script.append(" -A OUTPUT"); +- script.append(" -p tcp"); +- script.append(" -j REJECT"); ++ script.append(" -P OUTPUT DROP"); + script.append(" || exit\n"); + + String[] cmdAdd = {script.toString()}; +-- +1.7.9.5 + diff --git a/patches/transproxy.patch b/patches/transproxy.patch new file mode 100644 index 0000000..e69de29 diff --git a/patches/udptransproxyfinal.patch b/patches/udptransproxyfinal.patch new file mode 100644 index 0000000..32cc0e2 --- /dev/null +++ b/patches/udptransproxyfinal.patch @@ -0,0 +1,247 @@ +From a81741afe06ac2309b4306dedbd5a0ebf755b7e1 Mon Sep 17 00:00:00 2001 +From: patch <patrickbx(a)gmail.com> +Date: Fri, 31 Aug 2012 17:25:52 -0400 +Subject: [PATCH] Addendum to the last commit on UDP transproxy rules. Trying + to simplfy the iptables rules didn't work out so this is a + minimal change from the original TorTransProxy.java file. + UDP is blocked and tested as working. + +--- + .../torproject/android/service/TorTransProxy.java | 144 ++++++++++++-------- + 1 file changed, 84 insertions(+), 60 deletions(-) + +diff --git a/src/org/torproject/android/service/TorTransProxy.java b/src/org/torproject/android/service/TorTransProxy.java +index c248a9f..90bdc34 100644 +--- a/src/org/torproject/android/service/TorTransProxy.java ++++ b/src/org/torproject/android/service/TorTransProxy.java +@@ -224,15 +224,6 @@ public class TorTransProxy implements TorServiceConstants { + + int torUid = context.getApplicationInfo().uid; + +- // Allow everything for Tor +- script.append(ipTablesPath); +- script.append(" -t filter"); +- script.append(" -A OUTPUT"); +- script.append(" -m owner --uid-owner "); +- script.append(torUid); +- script.append(" -j ACCEPT"); +- script.append(" || exit\n"); +- + //build up array of shell cmds to execute under one root context + for (TorifiedApp tApp:apps) + { +@@ -244,9 +235,9 @@ public class TorTransProxy implements TorServiceConstants { + { + + TorService.logMessage("enabling transproxy for app: " + tApp.getUsername() + "(" + tApp.getUid() + ")"); +- +- // Set up port redirection +- script.append(ipTablesPath); ++ ++ // Set up port redirection ++ script.append(ipTablesPath); + script.append(" -t nat"); + script.append(" -A OUTPUT -p tcp"); + script.append(" ! -d 127.0.0.1"); //allow access to localhost +@@ -260,28 +251,14 @@ public class TorTransProxy implements TorServiceConstants { + // Same for DNS + script.append(ipTablesPath); + script.append(" -t nat"); +- script.append(" -A OUTPUT -p udp"); +- script.append(" -m owner --uid-owner "); ++ script.append(" -A OUTPUT -p udp -m owner --uid-owner "); + script.append(tApp.getUid()); + script.append(" -m udp --dport "); + script.append(STANDARD_DNS_PORT); + script.append(" -j REDIRECT --to-ports "); + script.append(TOR_DNS_PORT); + script.append(" || exit\n"); +- +- // Allow loopback +- script.append(ipTablesPath); +- script.append(" -t filter"); +- script.append(" -A OUTPUT"); +- script.append(" -m owner --uid-owner "); +- script.append(tApp.getUid()); +- script.append(" -o lo"); +- script.append(" -j ACCEPT"); +- script.append(" || exit\n"); +- +- /* +- //Outgoing loopback already allowed (23/7/12) +- ++ + int[] ports = {TOR_DNS_PORT,TOR_TRANSPROXY_PORT,PORT_SOCKS,PORT_HTTP}; + + for (int port : ports) +@@ -299,8 +276,30 @@ public class TorTransProxy implements TorServiceConstants { + script.append(" -j ACCEPT"); + script.append(" || exit\n"); + } +- */ +- ++ ++ // Allow loopback ++ script.append(ipTablesPath); ++ script.append(" -t filter"); ++ script.append(" -A OUTPUT"); ++ script.append(" -m owner --uid-owner "); ++ script.append(tApp.getUid()); ++ script.append(" -p tcp"); ++ script.append(" -o lo"); ++ script.append(" -j ACCEPT"); ++ script.append(" || exit\n"); ++ ++ // Reject DNS that is not from Tor (order is important - first matched rule counts!) ++ script.append(ipTablesPath); ++ script.append(" -t filter"); ++ script.append(" -A OUTPUT"); ++ script.append(" -m owner --uid-owner "); ++ script.append(tApp.getUid()); ++ script.append(" -p udp"); ++ script.append(" --dport "); ++ script.append(STANDARD_DNS_PORT); ++ script.append(" -j REJECT"); ++ script.append(" || exit\n"); ++ + // Reject all other outbound TCP packets + script.append(ipTablesPath); + script.append(" -t filter"); +@@ -321,10 +320,19 @@ public class TorTransProxy implements TorServiceConstants { + script.append(" -j REJECT"); + script.append(" || exit\n"); + +- + } + } ++ + ++ // Allow everything for Tor ++ script.append(ipTablesPath); ++ script.append(" -t filter"); ++ script.append(" -A OUTPUT"); ++ script.append(" -m owner --uid-owner "); ++ script.append(torUid); ++ script.append(" -j ACCEPT"); ++ script.append(" || exit\n"); ++ + String[] cmdAdd = {script.toString()}; + + code = TorServiceUtils.doShellCommand(cmdAdd, res, runRoot, waitFor); +@@ -452,8 +460,8 @@ public class TorTransProxy implements TorServiceConstants { + + int torUid = context.getApplicationInfo().uid; + +- // Set up port redirection +- script.append(ipTablesPath); ++ // Set up port redirection ++ script.append(ipTablesPath); + script.append(" -t nat"); + script.append(" -A OUTPUT -p tcp"); + script.append(" ! -d 127.0.0.1"); //allow access to localhost +@@ -467,36 +475,14 @@ public class TorTransProxy implements TorServiceConstants { + // Same for DNS + script.append(ipTablesPath); + script.append(" -t nat"); +- script.append(" -A OUTPUT -p udp"); +- script.appent(" -m owner ! --uid-owner "); ++ script.append(" -A OUTPUT -p udp -m owner ! --uid-owner "); + script.append(torUid); + script.append(" -m udp --dport "); + script.append(STANDARD_DNS_PORT); + script.append(" -j REDIRECT --to-ports "); + script.append(TOR_DNS_PORT); + script.append(" || exit\n"); +- +- // Allow loopback +- script.append(ipTablesPath); +- script.append(" -t filter"); +- script.append(" -A OUTPUT"); +- script.append(" -o lo"); +- script.append(" -j ACCEPT"); +- script.append(" || exit\n"); + +- // Allow everything for Tor +- script.append(ipTablesPath); +- script.append(" -t filter"); +- script.append(" -A OUTPUT"); +- script.append(" -m owner --uid-owner "); +- script.append(torUid); +- script.append(" -j ACCEPT"); +- script.append(" || exit\n"); +- +- +- /* +- //Outgoing loopback already allowed (23/7/12) +- + int[] ports = {TOR_DNS_PORT,TOR_TRANSPROXY_PORT,PORT_SOCKS,PORT_HTTP}; + + for (int port : ports) +@@ -514,8 +500,25 @@ public class TorTransProxy implements TorServiceConstants { + script.append(" -j ACCEPT"); + script.append(" || exit\n"); + +- } */ ++ } ++ ++ // Allow loopback ++ script.append(ipTablesPath); ++ script.append(" -t filter"); ++ script.append(" -A OUTPUT"); ++ script.append(" -p tcp"); ++ script.append(" -o lo"); ++ script.append(" -j ACCEPT"); ++ script.append(" || exit\n"); + ++ // Allow everything for Tor ++ script.append(ipTablesPath); ++ script.append(" -t filter"); ++ script.append(" -A OUTPUT"); ++ script.append(" -m owner --uid-owner "); ++ script.append(torUid); ++ script.append(" -j ACCEPT"); ++ script.append(" || exit\n"); + + if (TorService.ENABLE_DEBUG_LOG) + { +@@ -539,13 +542,34 @@ public class TorTransProxy implements TorServiceConstants { + script.append(" --log-uid"); + script.append(" || exit\n"); + } +- +- // Reject all other outbound packets by default ++ ++ // Reject DNS that is not from Tor (order is important - first matched rule counts!) + script.append(ipTablesPath); + script.append(" -t filter"); +- script.append(" -P OUTPUT DROP"); ++ script.append(" -A OUTPUT"); ++ script.append(" -p udp"); ++ script.append(" --dport "); ++ script.append(STANDARD_DNS_PORT); ++ script.append(" -j REJECT"); + script.append(" || exit\n"); + ++ // Reject all other outbound TCP packets ++ script.append(ipTablesPath); ++ script.append(" -t filter"); ++ script.append(" -A OUTPUT"); ++ script.append(" -p tcp"); ++ script.append(" -j REJECT"); ++ script.append(" || exit\n"); ++ ++ // Reject all other outbound UDP packets ++ script.append(ipTablesPath); ++ script.append(" -t filter"); ++ script.append(" -A OUTPUT"); ++ script.append(" -p udp"); ++ script.append(" -j REJECT"); ++ script.append(" || exit\n"); ++ ++ + String[] cmdAdd = {script.toString()}; + + code = TorServiceUtils.doShellCommand(cmdAdd, res, runRoot, waitFor); +-- +1.7.9.5 +

1 0

[orbot/master] cleaning up git
by n8fr8＠torproject.org 04 Oct '12

04 Oct '12

commit 7f1ef4eab6e76daf78751e52bb4c7507fe6c2fd3 Author: n8fr8 <nathan(a)freitas.net> Date: Thu Oct 4 11:29:58 2012 +0530 cleaning up git --- .gitignore | 19 +++++++++++++++++++ 1 files changed, 19 insertions(+), 0 deletions(-) diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..3a7c5c0 --- /dev/null +++ b/.gitignore @@ -0,0 +1,19 @@ +external/bin/ +external/include/ +external/iptables.foo/ +external/iptables/ +external/jtorctl-build-stamp +external/lib/ +external/libevent-build-stamp +external/obfsproxy-build-stamp +external/openssl-static-build-stamp +external/privoxy-build-stamp +external/privoxy/ +external/test.c +external/test.h.gch +external/tor-build-stamp +external/translation/ +bin +gen +native +local.properties

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

tor-commits October 2012