April 2014 - tor-commits - lists.torproject.org

[meek/extension] Add processterminate-buffer program.
by dcf＠torproject.org 08 Apr '14

08 Apr '14

commit 82a68236b1a150961d777ef9073044c88a9f9aa4 Author: David Fifield <david(a)bamsoftware.com> Date: Mon Apr 7 23:24:17 2014 -0700 Add processterminate-buffer program. This program insulates a transport plugin from tor on Windows, so that the transport plugin can clean up after itself. --- .gitignore | 1 + processterminate-buffer/main.go | 33 +++++++++++++++++++++++++++++++++ 2 files changed, 34 insertions(+) diff --git a/.gitignore b/.gitignore index 3d5729c..d442bd2 100644 --- a/.gitignore +++ b/.gitignore @@ -1,3 +1,4 @@ /meek-client/meek-client /meek-client-torbrowser/meek-client-torbrowser /meek-server/meek-server +/processterminate-buffer/processterminate-buffer diff --git a/processterminate-buffer/main.go b/processterminate-buffer/main.go new file mode 100644 index 0000000..cb68ee4 --- /dev/null +++ b/processterminate-buffer/main.go @@ -0,0 +1,33 @@ +// This program is designed to sit between tor and a transport plugin on +// Windows. On Windows, transport plugins are killed with a ProcessTerminate, +// which doesn't give them a chance to clean up before exiting. +// https://trac.torproject.org/projects/tor/ticket/9330 +// The idea of this program is that the transport plugin can read from its +// standard input, which will be closed when this program is terminated. The +// transport plugin can then treat the stdin-closed event like a SIGTERM. +package main + +import ( + "log" + "os" + "os/exec" +) + +func main() { + args := os.Args[1:] + if len(args) < 1 { + log.Fatalf("%s needs a command to run", os.Args[0]) + } + cmd := exec.Command(args[0], args[1:]...) + cmd.Stdin = os.Stdin + cmd.Stdout = os.Stdout + cmd.Stderr = os.Stderr + err := cmd.Start() + if err != nil { + log.Fatal(err) + } + err = cmd.Wait() + if err != nil { + log.Fatal(err) + } +}

1 0

[meek/extension] Don't inherit stdin.
by dcf＠torproject.org 08 Apr '14

08 Apr '14

commit e4c566c24041d22d869485c104f06e9ddd0ff5d8 Author: David Fifield <david(a)bamsoftware.com> Date: Tue Apr 8 00:40:58 2014 -0700 Don't inherit stdin. --- processterminate-buffer/main.go | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/processterminate-buffer/main.go b/processterminate-buffer/main.go index cb68ee4..05d586d 100644 --- a/processterminate-buffer/main.go +++ b/processterminate-buffer/main.go @@ -8,6 +8,7 @@ package main import ( + "io" "log" "os" "os/exec" @@ -19,13 +20,17 @@ func main() { log.Fatalf("%s needs a command to run", os.Args[0]) } cmd := exec.Command(args[0], args[1:]...) - cmd.Stdin = os.Stdin + stdin, err := cmd.StdinPipe() + if err != nil { + log.Fatal(err) + } cmd.Stdout = os.Stdout cmd.Stderr = os.Stderr - err := cmd.Start() + err = cmd.Start() if err != nil { log.Fatal(err) } + io.Copy(stdin, os.Stdin) err = cmd.Wait() if err != nil { log.Fatal(err)

1 0

[meek/extension] Synthesize a SIGTERM on stdin close.
by dcf＠torproject.org 08 Apr '14

08 Apr '14

commit 8611e7da4bd50d2849daeabe0013576117ae613e Author: David Fifield <david(a)bamsoftware.com> Date: Mon Apr 7 23:30:12 2014 -0700 Synthesize a SIGTERM on stdin close. --- meek-client-torbrowser/main.go | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/meek-client-torbrowser/main.go b/meek-client-torbrowser/main.go index 8890f6d..c4989c3 100644 --- a/meek-client-torbrowser/main.go +++ b/meek-client-torbrowser/main.go @@ -141,6 +141,18 @@ func main() { } defer logKill(meekClientCmd.Process) + // On Windows, we don't get a SIGINT or SIGTERM, rather we are killed + // without a chance to clean up our subprocesses. When run inside + // processterminate-buffer, it is instead processterminate-buffer that + // is killed, and we can detect that event by that our stdout gets + // closed. + // https://trac.torproject.org/projects/tor/ticket/9330 + go func() { + io.Copy(ioutil.Discard, os.Stdin) + log.Printf("synthesizing SIGTERM because of stdin close") + sigChan <-syscall.SIGTERM + }() + sig := <-sigChan log.Printf("sig %s", sig) err = logSignal(meekClientCmd.Process, sig)

1 0

[meek/extension] Log meek-client-torbrowser output to a file.
by dcf＠torproject.org 08 Apr '14

08 Apr '14

commit d9734e12cc51788bfa8310b519dd06c4cee9dd42 Author: David Fifield <david(a)bamsoftware.com> Date: Mon Apr 7 23:34:14 2014 -0700 Log meek-client-torbrowser output to a file. --- meek-client-torbrowser/main.go | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/meek-client-torbrowser/main.go b/meek-client-torbrowser/main.go index c4989c3..18f165b 100644 --- a/meek-client-torbrowser/main.go +++ b/meek-client-torbrowser/main.go @@ -109,6 +109,13 @@ func runMeekClient(helperAddr string) (cmd *exec.Cmd, err error) { func main() { var err error + f, err := os.OpenFile("meek-client-torbrowser.log", os.O_CREATE|os.O_APPEND|os.O_WRONLY, 0600) + if err != nil { + log.Fatal(err) + } + defer f.Close() + log.SetOutput(f) + sigChan := make(chan os.Signal, 1) signal.Notify(sigChan, syscall.SIGINT, syscall.SIGTERM)

1 0

[orbot/master] update to support specific permissions for Service
by n8fr8＠torproject.org 08 Apr '14

08 Apr '14

commit e78486a41f8fd4e2c1f5a14fe7c6b6e11eb89779 Author: Nathan Freitas <nathan(a)freitas.net> Date: Tue Apr 8 01:12:35 2014 -0400 update to support specific permissions for Service this is an attempted fix for Samsung S3/Note3 issues --- AndroidManifest.xml | 17 +++++++++++------ res/values/strings.xml | 3 +++ src/org/torproject/android/Orbot.java | 2 +- 3 files changed, 15 insertions(+), 7 deletions(-) diff --git a/AndroidManifest.xml b/AndroidManifest.xml index 453921a..95239a7 100644 --- a/AndroidManifest.xml +++ b/AndroidManifest.xml @@ -1,16 +1,20 @@ <?xml version="1.0" encoding="utf-8"?> <manifest xmlns:android="http://schemas.android.com/apk/res/android" package="org.torproject.android" - android:versionName="13.0.6-BETA-3" - android:versionCode="73" + android:versionName="13.0.6-BETA-3a" + android:versionCode="74" android:installLocation="auto" - > <uses-permission android:name="android.permission.INTERNET" /> - <uses-permission android:name="android.permission.RECEIVE_BOOT_COMPLETED"/> - <uses-permission android:name="android.permission.ACCESS_NETWORK_STATE" /> - <uses-permission android:name="android.permission.ACCESS_SUPERUSER"/> + > <uses-sdk android:minSdkVersion="9" android:targetSdkVersion="19"/> + <permission android:name="org.torproject.android.MANAGE_TOR" android:label="@string/permission_manage_tor_label" android:description="@string/permission_manage_tor_description" android:protectionLevel="signature"></permission> + <uses-permission android:name="android.permission.INTERNET" /> + <uses-permission android:name="android.permission.RECEIVE_BOOT_COMPLETED"/> + <uses-permission android:name="android.permission.ACCESS_NETWORK_STATE" /> + <uses-permission android:name="android.permission.ACCESS_SUPERUSER"/> + <uses-permission android:name="org.torproject.android.MANAGE_TOR"/> + <application android:name=".OrbotApp" android:icon="@drawable/ic_launcher" android:label="@string/app_name" android:configChanges="locale|orientation|screenSize" @@ -78,6 +82,7 @@ android:name=".service.TorService" android:exported="false" android:process=":remote" + android:permission="org.torproject.android.MANAGE_TOR" > <intent-filter> <action android:name="org.torproject.android.service.ITorService" /> diff --git a/res/values/strings.xml b/res/values/strings.xml index 8e40b05..f6ee084 100644 --- a/res/values/strings.xml +++ b/res/values/strings.xml @@ -244,5 +244,8 @@ <string name="menu_verify_browser">Check Browser</string> <string name="menu_use_chatsecure">Use ChatSecure</string> + + <string name="permission_manage_tor_label">Manage Tor</string> + <string name="permission_manage_tor_description">Enable this app to control the Tor service</string> </resources> diff --git a/src/org/torproject/android/Orbot.java b/src/org/torproject/android/Orbot.java index f48e0a9..14a865f 100644 --- a/src/org/torproject/android/Orbot.java +++ b/src/org/torproject/android/Orbot.java @@ -1137,7 +1137,7 @@ public class Orbot extends ActionBarActivity implements TorConstants, OnLongClic { Intent iTorService = new Intent(this, TorService.class); - + getApplication().getApplicationContext().startService(iTorService); //since its auto create, we prob don't ever need to call startService

1 0

[orbot/master] fix Shell calls so that we close() shell when done
by n8fr8＠torproject.org 08 Apr '14

08 Apr '14

commit c9bf8d25856e012762382be6491c2016b91c0e93 Author: Nathan Freitas <nathan(a)freitas.net> Date: Tue Apr 8 01:12:56 2014 -0400 fix Shell calls so that we close() shell when done --- src/org/torproject/android/service/TorService.java | 17 +++++++---------- .../torproject/android/service/TorTransProxy.java | 18 ++++++++++++++++-- 2 files changed, 23 insertions(+), 12 deletions(-) diff --git a/src/org/torproject/android/service/TorService.java b/src/org/torproject/android/service/TorService.java index 23c0a4c..fc49df1 100644 --- a/src/org/torproject/android/service/TorService.java +++ b/src/org/torproject/android/service/TorService.java @@ -434,10 +434,8 @@ public class TorService extends Service implements TorServiceConstants, TorConst } - private void killTorProcess () throws Exception { - StringBuilder log = new StringBuilder(); int procId = -1; if (conn != null) @@ -457,7 +455,6 @@ public class TorService extends Service implements TorServiceConstants, TorConst conn = null; } - int killDelayMs = 300; int maxTry = 5; int currTry = 0; @@ -481,7 +478,6 @@ public class TorService extends Service implements TorServiceConstants, TorConst { logNotice("Found Privoxy PID=" + procId + " - killing now..."); - tb.killAll(filePrivoxy.getCanonicalPath()); } @@ -489,14 +485,11 @@ public class TorService extends Service implements TorServiceConstants, TorConst { logNotice("Found ObfsProxy PID=" + procId + " - killing now..."); - tb.killAll(fileObfsProxy.getCanonicalPath()); } } - else - { - throw new Exception("*** Unable to kill existing Tor process. Please REBOOT your device. ***"); - } + + shell.close(); } private void logNotice (String msg) @@ -569,6 +562,8 @@ public class TorService extends Service implements TorServiceConstants, TorConst File fileTest = new File(fileBin.getCanonicalPath()); logNotice(fileTest.getName() + ": POST: Is binary exec? " + fileTest.canExecute()); + + shell.close(); } return fileBin.canExecute(); @@ -751,6 +746,8 @@ public class TorService extends Service implements TorServiceConstants, TorConst } } + shell.close(); + if (procId == -1) { @@ -809,7 +806,7 @@ public class TorService extends Service implements TorServiceConstants, TorConst logNotice("Privoxy process id=" + privoxyProcId); - + shell.close(); } diff --git a/src/org/torproject/android/service/TorTransProxy.java b/src/org/torproject/android/service/TorTransProxy.java index 931366e..5438d16 100644 --- a/src/org/torproject/android/service/TorTransProxy.java +++ b/src/org/torproject/android/service/TorTransProxy.java @@ -393,6 +393,8 @@ public class TorTransProxy implements TorServiceConstants { fixTransproxyLeak (context); + shell.close(); + return 1; } @@ -431,6 +433,8 @@ public class TorTransProxy implements TorServiceConstants { } + + shell.close(); return 0; } @@ -471,7 +475,11 @@ public class TorTransProxy implements TorServiceConstants { shell.add(cmd); - return cmd.getExitCode(); + int exitCode = cmd.getExitCode(); + + shell.close(); + + return exitCode; } public int fixTransproxyLeak (Context context) throws Exception @@ -490,6 +498,8 @@ public class TorTransProxy implements TorServiceConstants { script.append(" -I OUTPUT ! -o lo ! -d 127.0.0.1 ! -s 127.0.0.1 -p tcp -m tcp --tcp-flags ACK,RST ACK,RST -j DROP"); shell.add(new SimpleCommand(script.toString())); + shell.close(); + return 1; } @@ -642,7 +652,11 @@ public class TorTransProxy implements TorServiceConstants { fixTransproxyLeak (context); - return cmd.getExitCode(); + int exitCode = cmd.getExitCode(); + + shell.close(); + + return exitCode; }

1 0

[orbot/master] update to BETA-4 for Permission changes
by n8fr8＠torproject.org 08 Apr '14

08 Apr '14

commit b32992067b3599d792326e9a7ed7135aa0a0c549 Author: Nathan Freitas <nathan(a)freitas.net> Date: Tue Apr 8 01:54:35 2014 -0400 update to BETA-4 for Permission changes --- AndroidManifest.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/AndroidManifest.xml b/AndroidManifest.xml index 95239a7..35795c1 100644 --- a/AndroidManifest.xml +++ b/AndroidManifest.xml @@ -1,7 +1,7 @@ <?xml version="1.0" encoding="utf-8"?> <manifest xmlns:android="http://schemas.android.com/apk/res/android" package="org.torproject.android" - android:versionName="13.0.6-BETA-3a" + android:versionName="13.0.6-BETA-4" android:versionCode="74" android:installLocation="auto" >

1 0

[orbot/master] update version to 13.0.6-BETA-3
by n8fr8＠torproject.org 08 Apr '14

08 Apr '14

commit 7990644ecd136fb987b6aa34cdc736996c293759 Author: Nathan Freitas <nathan(a)freitas.net> Date: Mon Apr 7 23:37:33 2014 -0400 update version to 13.0.6-BETA-3 --- AndroidManifest.xml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/AndroidManifest.xml b/AndroidManifest.xml index b80ffc7..453921a 100644 --- a/AndroidManifest.xml +++ b/AndroidManifest.xml @@ -1,8 +1,8 @@ <?xml version="1.0" encoding="utf-8"?> <manifest xmlns:android="http://schemas.android.com/apk/res/android" package="org.torproject.android" - android:versionName="13.0.6-BETA-2" - android:versionCode="72" + android:versionName="13.0.6-BETA-3" + android:versionCode="73" android:installLocation="auto" > <uses-permission android:name="android.permission.INTERNET" /> <uses-permission android:name="android.permission.RECEIVE_BOOT_COMPLETED"/>

1 0

[orbot/master] fix for mikeperry transproxy leak bug find
by n8fr8＠torproject.org 08 Apr '14

08 Apr '14

commit 917ea6e09f2a05b83d7bffaf88340abc5fb983ba Author: Nathan Freitas <nathan(a)freitas.net> Date: Mon Apr 7 23:36:10 2014 -0400 fix for mikeperry transproxy leak bug find https://lists.torproject.org/pipermail/tor-talk/2014-March/032503.html --- .../torproject/android/service/TorTransProxy.java | 49 ++++++++++++++------ 1 file changed, 34 insertions(+), 15 deletions(-) diff --git a/src/org/torproject/android/service/TorTransProxy.java b/src/org/torproject/android/service/TorTransProxy.java index 0a9ae6f..931366e 100644 --- a/src/org/torproject/android/service/TorTransProxy.java +++ b/src/org/torproject/android/service/TorTransProxy.java @@ -19,13 +19,9 @@ public class TorTransProxy implements TorServiceConstants { private TorService mTorService = null; private File mFileXtables = null; - public TorTransProxy (TorService torService) + public TorTransProxy (TorService torService, File fileXTables) { mTorService = torService; - } - - public void setXTables (File fileXTables) - { mFileXtables = fileXTables; } @@ -395,6 +391,8 @@ public class TorTransProxy implements TorServiceConstants { } } + fixTransproxyLeak (context); + return 1; } @@ -469,22 +467,41 @@ public class TorTransProxy implements TorServiceConstants { script.append(" -t filter"); script.append(" -F ").append(chainName); //delete previous user-defined chain - shell.add(new SimpleCommand(script.toString())); + SimpleCommand cmd = new SimpleCommand(script.toString()); + + shell.add(cmd); + + return cmd.getExitCode(); + } + + public int fixTransproxyLeak (Context context) throws Exception + { + String ipTablesPath = getIpTablesPath(context); + + Shell shell = Shell.startRootShell(); - return 0; + StringBuilder script = new StringBuilder(); + script.append(ipTablesPath); + script.append(" -I OUTPUT ! -o lo ! -d 127.0.0.1 ! -s 127.0.0.1 -p tcp -m tcp --tcp-flags ACK,FIN ACK,FIN -j DROP"); + shell.add(new SimpleCommand(script.toString())); + + script = new StringBuilder(); + script.append(ipTablesPath); + script.append(" -I OUTPUT ! -o lo ! -d 127.0.0.1 ! -s 127.0.0.1 -p tcp -m tcp --tcp-flags ACK,RST ACK,RST -j DROP"); + shell.add(new SimpleCommand(script.toString())); + + return 1; + } public int setTransparentProxyingAll(Context context) throws Exception { - boolean runRoot = true; - boolean waitFor = true; //redirectDNSResolvConf(); //not working yet String ipTablesPath = getIpTablesPath(context); - Shell shell = Shell.startRootShell(); int torUid = context.getApplicationInfo().uid; @@ -563,7 +580,7 @@ public class TorTransProxy implements TorServiceConstants { script.append(" -p tcp"); script.append(" -o lo"); script.append(" -j ACCEPT"); - + shell.add(new SimpleCommand(script.toString())); script = new StringBuilder(); @@ -596,8 +613,7 @@ public class TorTransProxy implements TorServiceConstants { script = new StringBuilder(); } - - + // Reject all other outbound TCP packets script.append(ipTablesPath); script.append(" -t filter"); @@ -621,9 +637,12 @@ public class TorTransProxy implements TorServiceConstants { script.append(" ! -d 127.0.0.1"); //allow access to localhost script.append(" -j REJECT"); - shell.add(new SimpleCommand(script.toString())); + SimpleCommand cmd = new SimpleCommand(script.toString()); + shell.add(cmd); + + fixTransproxyLeak (context); - return 0; + return cmd.getExitCode(); }

1 0

[orbot/master] updated to openssl 1.0.1g
by n8fr8＠torproject.org 08 Apr '14

08 Apr '14

commit 7229c52f9cc360a31ef3446bf8413368fadda1db Author: Nathan Freitas <nathan(a)freitas.net> Date: Mon Apr 7 22:42:59 2014 -0400 updated to openssl 1.0.1g --- external/openssl | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/external/openssl b/external/openssl index 46ebd9e..b2d951e 160000 --- a/external/openssl +++ b/external/openssl @@ -1 +1 @@ -Subproject commit 46ebd9e3bb623d3c15ef2203038956f3f7213620 +Subproject commit b2d951e4232d2f90168f9a3dd0b7df9ecf2d81a8

1 0