- tor-commits - lists.torproject.org

[vidalia/master] Update README.debs to match current Debian repository layout.
by chiiph＠torproject.org 12 Aug '11

12 Aug '11

commit 53567a2d9825e746e8866faf86ef63ddf44d6730 Author: intrigeri <intrigeri(a)boum.org> Date: Sat Jul 30 12:31:00 2011 +0200 Update README.debs to match current Debian repository layout. --- debian/README.debs | 12 ++++++++---- 1 files changed, 8 insertions(+), 4 deletions(-) diff --git a/debian/README.debs b/debian/README.debs index 8dabfaf..bdf85d2 100644 --- a/debian/README.debs +++ b/debian/README.debs @@ -12,12 +12,15 @@ https://www.torproject.org/docs/debian-vidalia.html.en Building your own -------------------------------- If you would like to build your own packages, you can get the current -debian/ directory by cloning the git repository: +Debian source by cloning the Git repository. -git clone http://git.debian.org/git/collab-maint/vidalia.git +If you want to use git-buildpackage: + gbp-clone http://git.debian.org/git/collab-maint/vidalia.git +then use git-buildpackage to build packages. -Then move everything from the debian/0.2.x directory into the -vidalia-x.x.x/debian/ directory and build packages as normal. +Else, just clone the repository "normally": + git clone http://git.debian.org/git/collab-maint/vidalia.git +then build packages as normal. Instructions -------------------------------- @@ -29,3 +32,4 @@ the following documentation: 3. https://www.netfort.gr.jp/~dancer/software/pbuilder-doc/pbuilder-doc.html 4. https://wiki.ubuntu.com/PackagingGuide/Complete 5. https://wiki.ubuntu.com/PbuilderHowto +6. http://honk.sigxcpu.org/projects/git-buildpackage/manual-html/gbp.html

1 0

[vidalia/master] Add auto configuration of the control host:port to stable
by chiiph＠torproject.org 12 Aug '11

12 Aug '11

commit 64a20eadb3d10980fe86ed154c065f3e2132c61b Author: Tomas Touceda <chiiph(a)torproject.org> Date: Wed Jul 27 11:01:02 2011 -0300 Add auto configuration of the control host:port to stable This is just a hand-rebase of the bug3077_auto branch. --- src/vidalia/MainWindow.cpp | 54 +++++++++++++++++++++++++++-------- src/vidalia/config/AdvancedPage.cpp | 12 ++++++++ src/vidalia/config/AdvancedPage.h | 3 ++ src/vidalia/config/AdvancedPage.ui | 17 ++++++++--- src/vidalia/config/TorSettings.cpp | 14 +++++++++ src/vidalia/config/TorSettings.h | 7 ++++ 6 files changed, 90 insertions(+), 17 deletions(-) diff --git a/src/vidalia/MainWindow.cpp b/src/vidalia/MainWindow.cpp index 052d5ac..7ef08c8 100644 --- a/src/vidalia/MainWindow.cpp +++ b/src/vidalia/MainWindow.cpp @@ -1002,8 +1002,8 @@ MainWindow::start() /* Check if Tor is already running separately */ if(settings.getControlMethod() == ControlMethod::Port) { - if (net_test_connect(settings.getControlAddress(), - settings.getControlPort())) { + if(!settings.autoControlPort() && net_test_connect(settings.getControlAddress(), + settings.getControlPort())) { started(); return; } @@ -1036,14 +1036,21 @@ MainWindow::start() /* Specify Tor's data directory, if different from the default */ QString dataDirectory = settings.getDataDirectory(); + QString expDataDirectory = expand_filename(dataDirectory); if (!dataDirectory.isEmpty()) - args << "DataDirectory" << expand_filename(dataDirectory); + args << "DataDirectory" << expDataDirectory; if(settings.getControlMethod() == ControlMethod::Port) { - /* Add the intended control port value */ - quint16 controlPort = settings.getControlPort(); - if (controlPort) - args << "ControlPort" << QString::number(controlPort); + if(settings.autoControlPort()) { + args << "ControlPort" << "auto"; + args << "SocksPort" << "auto"; + args << "ControlPortWriteToFile" << QString("%1/port.conf").arg(expDataDirectory); + } else { + /* Add the intended control port value */ + quint16 controlPort = settings.getControlPort(); + if (controlPort) + args << "ControlPort" << QString::number(controlPort); + } } else { QString path = settings.getSocketPath(); args << "ControlSocket" << path; @@ -1137,11 +1144,34 @@ MainWindow::started() /* Remember whether we started Tor or not */ _isVidaliaRunningTor = _torControl->isVidaliaRunningTor(); /* Try to connect to Tor's control port */ - if(settings.getControlMethod() == ControlMethod::Port) - _torControl->connect(settings.getControlAddress(), - settings.getControlPort()); - else - _torControl->connect(settings.getSocketPath()); + if(settings.autoControlPort()) { + QString dataDirectory = settings.getDataDirectory(); + QFile file(QString("%1/port.conf").arg(expand_filename(dataDirectory))); + if (!file.open(QIODevice::ReadOnly | QIODevice::Text)) + return; + + QTextStream in(&file); + if(!in.atEnd()) { + QString line = in.readLine(); + QStringList parts = line.split("="); + if(parts.size() != 2) return; + if(parts[0].trimmed() != "PORT") return; + + QStringList addrPort = parts[1].split(":"); + if(addrPort.size() != 2) return; + + QHostAddress addr(addrPort.at(0)); + quint16 port = addrPort.at(1).toInt(); + _torControl->connect(addr, port); + } + } else { + /* Try to connect to Tor's control port */ + if(settings.getControlMethod() == ControlMethod::Port) + _torControl->connect(settings.getControlAddress(), + settings.getControlPort()); + else + _torControl->connect(settings.getSocketPath()); + } setStartupProgress(STARTUP_PROGRESS_CONNECTING, tr("Connecting to Tor")); } diff --git a/src/vidalia/config/AdvancedPage.cpp b/src/vidalia/config/AdvancedPage.cpp index a879ecc..4e7c3f6 100644 --- a/src/vidalia/config/AdvancedPage.cpp +++ b/src/vidalia/config/AdvancedPage.cpp @@ -64,6 +64,7 @@ AdvancedPage::AdvancedPage(QWidget *parent) this, SLOT(displayTorrcDialog())); connect(ui.rdoControlPort, SIGNAL(toggled(bool)), this, SLOT(toggleControl(bool))); connect(ui.btnBrowseSocketPath, SIGNAL(clicked()), this, SLOT(browseSocketPath())); + connect(ui.chkAuto, SIGNAL(toggled(bool)), this, SLOT(toggleAuto(bool))); /* Hide platform specific features */ #if defined(Q_WS_WIN) @@ -187,6 +188,7 @@ AdvancedPage::save(QString &errmsg) _settings->setControlAddress(controlAddress); _settings->setControlPort(ui.lineControlPort->text().toUShort()); _settings->setSocketPath(ui.lineSocketPath->text()); + _settings->setAutoControlPort(ui.chkAuto->isChecked()); _settings->setAuthenticationMethod(authMethod); _settings->setUseRandomPassword(ui.chkRandomPassword->isChecked()); @@ -212,6 +214,7 @@ AdvancedPage::load() ui.lineControlPort->setText(QString::number(_settings->getControlPort())); ui.lineTorConfig->setText(_settings->getTorrc()); ui.lineTorDataDirectory->setText(_settings->getDataDirectory()); + ui.chkAuto->setChecked(_settings->autoControlPort()); ui.cmbAuthMethod->setCurrentIndex( authMethodToIndex(_settings->getAuthenticationMethod())); @@ -402,3 +405,12 @@ AdvancedPage::toggleControl(bool) #endif } } + +void +AdvancedPage::toggleAuto(bool) +{ + ui.lblAddress->setEnabled(!ui.chkAuto->isChecked()); + ui.lineControlAddress->setEnabled(!ui.chkAuto->isChecked()); + ui.label->setEnabled(!ui.chkAuto->isChecked()); + ui.lineControlPort->setEnabled(!ui.chkAuto->isChecked()); +} diff --git a/src/vidalia/config/AdvancedPage.h b/src/vidalia/config/AdvancedPage.h index 4ba26cc..4510310 100644 --- a/src/vidalia/config/AdvancedPage.h +++ b/src/vidalia/config/AdvancedPage.h @@ -75,6 +75,9 @@ private slots: * a more advanced way */ void displayTorrcDialog(); + /** Called when the user checks "Configure ControlPort automatically" */ + void toggleAuto(bool); + private: /** Returns the authentication method for the given <b>index</b>. */ TorSettings::AuthenticationMethod indexToAuthMethod(int index); diff --git a/src/vidalia/config/AdvancedPage.ui b/src/vidalia/config/AdvancedPage.ui index add13c0..9473a81 100644 --- a/src/vidalia/config/AdvancedPage.ui +++ b/src/vidalia/config/AdvancedPage.ui @@ -31,7 +31,7 @@ <property name="verticalSpacing"> <number>6</number> </property> - <item row="4" column="0"> + <item row="5" column="0"> <widget class="QLabel" name="lblAuth"> <property name="text"> <string>Authentication:</string> @@ -51,7 +51,7 @@ </property> </widget> </item> - <item row="4" column="2" colspan="3"> + <item row="5" column="2" colspan="3"> <layout class="QHBoxLayout"> <property name="spacing"> <number>2</number> @@ -185,7 +185,7 @@ </property> </widget> </item> - <item row="3" column="0"> + <item row="4" column="0"> <widget class="QLabel" name="lblPath"> <property name="enabled"> <bool>false</bool> @@ -198,7 +198,7 @@ </property> </widget> </item> - <item row="3" column="1" colspan="2"> + <item row="4" column="1" colspan="2"> <widget class="QLineEdit" name="lineSocketPath"> <property name="enabled"> <bool>false</bool> @@ -212,7 +212,7 @@ </property> </widget> </item> - <item row="3" column="3"> + <item row="4" column="3"> <widget class="QPushButton" name="btnBrowseSocketPath"> <property name="enabled"> <bool>false</bool> @@ -222,6 +222,13 @@ </property> </widget> </item> + <item row="3" column="2"> + <widget class="QCheckBox" name="chkAuto"> + <property name="text"> + <string>Configure ControlPort automatically</string> + </property> + </widget> + </item> </layout> </item> </layout> diff --git a/src/vidalia/config/TorSettings.cpp b/src/vidalia/config/TorSettings.cpp index b05b428..42e036f 100644 --- a/src/vidalia/config/TorSettings.cpp +++ b/src/vidalia/config/TorSettings.cpp @@ -44,6 +44,7 @@ #define SETTING_REJECT_PLAINTEXT_PORTS "RejectPlaintextPorts" #define SETTING_BOOTSTRAP "Bootstrap" #define SETTING_BOOTSTRAP_FROM "BootstrapFrom" +#define SETTING_AUTOCONTROL "AutoControl" /** Default to using hashed password authentication */ #define DEFAULT_AUTH_METHOD PasswordAuth @@ -92,6 +93,7 @@ TorSettings::TorSettings(TorControl *torControl) setDefault(SETTING_REJECT_PLAINTEXT_PORTS, QList<QVariant>()); setDefault(SETTING_BOOTSTRAP, false); setDefault(SETTING_BOOTSTRAP_FROM, ""); + setDefault(SETTING_AUTOCONTROL, true); } /** Applies any changes to Tor's control port or authentication settings. */ @@ -450,3 +452,15 @@ TorSettings::bootstrapFrom() const { return QDir::convertSeparators(value(SETTING_BOOTSTRAP_FROM).toString()); } + +bool +TorSettings::autoControlPort() const +{ + return value(SETTING_AUTOCONTROL).toBool(); +} + +void +TorSettings::setAutoControlPort(const bool autoControl) +{ + setValue(SETTING_AUTOCONTROL, autoControl); +} diff --git a/src/vidalia/config/TorSettings.h b/src/vidalia/config/TorSettings.h index a4f8ec9..5038c3d 100644 --- a/src/vidalia/config/TorSettings.h +++ b/src/vidalia/config/TorSettings.h @@ -72,6 +72,13 @@ public: /** Get the current control method */ ControlMethod::Method getControlMethod() const; + /** Returns true if Vidalia will get the ControlPort automatically from + * Tor */ + bool autoControlPort() const; + + /** Sets whether Vidalia should get the ControlPort from Tor */ + void setAutoControlPort(const bool auto); + /** Set the control method */ void setControlMethod(ControlMethod::Method method);

1 0

[vidalia/master] Improve changelog
by chiiph＠torproject.org 12 Aug '11

12 Aug '11

commit 51df13516d1a7d0f21c52e35067444b1abfe5cbf Author: Tomas Touceda <chiiph(a)torproject.org> Date: Sat Jun 11 14:46:38 2011 -0300 Improve changelog --- CHANGELOG | 6 +++--- 1 files changed, 3 insertions(+), 3 deletions(-) diff --git a/CHANGELOG b/CHANGELOG index 2eb169f..9a3d8d4 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -2,12 +2,12 @@ o Add a way to bootstrap Tor's torrc file (copy the torrc to a given directory before Vidalia starts) so that packages such as Bridge-by-default portable bundles for OSX don't violate the directory - structure of the operative system. Fixes bug 2821. + structure of the operating system. Fixes bug 2821. o Add the proper CA Certificates so that the "Find Bridges" button works again. Fixes bug 2835. o Update the useful links help page. Fixes bug 2809. - o Reintegrate Breakpad, and make it available in other platforms other - than Windows. Resolves bug 2105. + o Reintegrate Breakpad, and make it available in platforms other than + Windows. Resolves bug 2105. o Fix bandwidth assigned to relays on the Network Map. A lot of relays are displaying an erroneous bandwidth and since they are ordered by that value in the Network Map, it leads to confusion. Vidalia now specifies

1 0

[vidalia/master] Provides the controlport and passwd as an env var
by chiiph＠torproject.org 12 Aug '11

12 Aug '11

commit bb0e264a3a48e3c148a78468459748d2a5d8c2f8 Author: Tomas Touceda <chiiph(a)torproject.org> Date: Thu Jul 28 13:50:41 2011 -0300 Provides the controlport and passwd as an env var If Vidalia's configured to use ControlPort and PasswordAuth then it creates TOR_CONTROL_PORT and TOR_CONTROL_PASSWD for TorButton. --- src/vidalia/MainWindow.cpp | 10 ++++++++-- src/vidalia/MainWindow.h | 2 ++ 2 files changed, 10 insertions(+), 2 deletions(-) diff --git a/src/vidalia/MainWindow.cpp b/src/vidalia/MainWindow.cpp index 9f64163..0173c69 100644 --- a/src/vidalia/MainWindow.cpp +++ b/src/vidalia/MainWindow.cpp @@ -1156,8 +1156,8 @@ MainWindow::started() if(addrPort.size() != 2) return; QHostAddress addr(addrPort.at(0)); - quint16 port = addrPort.at(1).toInt(); - _torControl->connect(addr, port); + _autoControlPort = addrPort.at(1).toInt(); + _torControl->connect(addr, _autoControlPort); } } else { /* Try to connect to Tor's control port */ @@ -2032,5 +2032,11 @@ MainWindow::updateBrowserEnv() { env << QString("TOR_SOCKS_PORT=%1").arg(port); } + if(settings.getAuthenticationMethod() == TorSettings::PasswordAuth) { + env << QString("TOR_CONTROL_PASSWD=%1").arg(settings.getControlPassword()); + env << QString("TOR_CONTROL_PORT=%1").arg(_autoControlPort); + qWarning() << env; + } + return env; } diff --git a/src/vidalia/MainWindow.h b/src/vidalia/MainWindow.h index 1412ec5..dc251e1 100644 --- a/src/vidalia/MainWindow.h +++ b/src/vidalia/MainWindow.h @@ -288,6 +288,8 @@ private: QAction* _actionShowNetworkMap; QAction* _actionNewIdentity; + quint16 _autoControlPort; + Ui::MainWindow ui; /**< Qt Designer generated object. */ };

1 0

[vidalia/master] Provide the socks port to the browser
by chiiph＠torproject.org 12 Aug '11

12 Aug '11

commit b46dfc3a3ebbf38f52010db12b0a1781d392074e Author: Tomas Touceda <chiiph(a)torproject.org> Date: Wed Jul 27 11:54:09 2011 -0300 Provide the socks port to the browser --- src/vidalia/MainWindow.cpp | 35 ++++++++++++++++++++++++++++------- src/vidalia/MainWindow.h | 3 +++ 2 files changed, 31 insertions(+), 7 deletions(-) diff --git a/src/vidalia/MainWindow.cpp b/src/vidalia/MainWindow.cpp index 7ef08c8..9f64163 100644 --- a/src/vidalia/MainWindow.cpp +++ b/src/vidalia/MainWindow.cpp @@ -595,12 +595,7 @@ MainWindow::launchBrowserFromDirectory() QString browserDirectory = settings.getBrowserDirectory(); QString browserDirectoryFilename = settings.getBrowserExecutable(); - /* Set TZ=UTC (to stop leaking timezone information) and - * MOZ_NO_REMOTE=1 (to allow multiple instances of Firefox */ - QStringList env = QProcess::systemEnvironment(); - env << "TZ=UTC"; - env << "MOZ_NO_REMOTE=1"; - _browserProcess->setEnvironment(env); + _browserProcess->setEnvironment(updateBrowserEnv()); /* The browser is in <browserDirectory>/App/Firefox/<browserDirectoryFilename> */ QString browserExecutable = @@ -648,7 +643,7 @@ MainWindow::startSubprocesses() launchBrowserFromDirectory(); } else if (!(subprocess = settings.getBrowserExecutable()).isEmpty()) { /* BrowserDirectory is not set, but BrowserExecutable is; use this */ - _browserProcess->setEnvironment(QProcess::systemEnvironment() << "TZ=UTC"); + _browserProcess->setEnvironment(updateBrowserEnv()); _browserProcess->start(subprocess, QStringList()); } @@ -2013,3 +2008,29 @@ MainWindow::installUpdatesFailed(const QString &errmsg) #endif +QStringList +MainWindow::updateBrowserEnv() { + TorSettings settings; + QStringList env = QProcess::systemEnvironment(); + env << "TZ=UTC"; + env << "MOZ_NO_REMOTE=1"; + + if(settings.autoControlPort()) { + QString errmsg, socks; + if(!(_torControl->getInfo("net/listeners/socks", socks, &errmsg))) { + vInfo(errmsg); + return env; + } + + QStringList addrPort = socks.split(":"); + if(addrPort.size() != 2) return env; + + QHostAddress addr(addrPort.at(0)); + quint16 port = addrPort.at(1).toInt(); + + env << QString("TOR_SOCKS_HOST=%1").arg(addr.toString()); + env << QString("TOR_SOCKS_PORT=%1").arg(port); + } + + return env; +} diff --git a/src/vidalia/MainWindow.h b/src/vidalia/MainWindow.h index 6bdfec0..1412ec5 100644 --- a/src/vidalia/MainWindow.h +++ b/src/vidalia/MainWindow.h @@ -225,6 +225,9 @@ private: /** Sets the progress bar completion value to <b>progressValue</b> and sets * the status text to <b>description</b>. */ void setStartupProgress(int percentComplete, const QString &description); + /** Adds the needed variables to the environment that the browser will + * need */ + QStringList updateBrowserEnv(); /** The current status of Tor. */ TorStatus _status;

1 0

[vidalia/master] Improve how the advance settings behave with the autoport
by chiiph＠torproject.org 12 Aug '11

12 Aug '11

commit 42d54925deda01e29b2c0f9c1027f0a1c55e0141 Author: Tomas Touceda <chiiph(a)torproject.org> Date: Thu Jul 28 14:12:03 2011 -0300 Improve how the advance settings behave with the autoport Tries to avoid confusion by just not displaying what host and port is being used, so that it's completely transparent to the user. --- src/vidalia/config/AdvancedPage.cpp | 16 ++++++++++------ src/vidalia/config/AdvancedPage.ui | 16 ++++++++-------- 2 files changed, 18 insertions(+), 14 deletions(-) diff --git a/src/vidalia/config/AdvancedPage.cpp b/src/vidalia/config/AdvancedPage.cpp index 4e7c3f6..12842bc 100644 --- a/src/vidalia/config/AdvancedPage.cpp +++ b/src/vidalia/config/AdvancedPage.cpp @@ -185,8 +185,10 @@ AdvancedPage::save(QString &errmsg) _settings->setDataDirectory(dataDir); } - _settings->setControlAddress(controlAddress); - _settings->setControlPort(ui.lineControlPort->text().toUShort()); + if(!ui.chkAuto->isChecked()) { + _settings->setControlAddress(controlAddress); + _settings->setControlPort(ui.lineControlPort->text().toUShort()); + } _settings->setSocketPath(ui.lineSocketPath->text()); _settings->setAutoControlPort(ui.chkAuto->isChecked()); @@ -394,6 +396,7 @@ AdvancedPage::toggleControl(bool) ui.lblPath->setEnabled(false); ui.lineSocketPath->setEnabled(false); ui.btnBrowseSocketPath->setEnabled(false); + ui.chkAuto->setEnabled(true); } else { #if !defined(Q_OS_WIN32) ui.lblAddress->setEnabled(false); @@ -402,6 +405,7 @@ AdvancedPage::toggleControl(bool) ui.lblPath->setEnabled(true); ui.lineSocketPath->setEnabled(true); ui.btnBrowseSocketPath->setEnabled(true); + ui.chkAuto->setEnabled(false); #endif } } @@ -409,8 +413,8 @@ AdvancedPage::toggleControl(bool) void AdvancedPage::toggleAuto(bool) { - ui.lblAddress->setEnabled(!ui.chkAuto->isChecked()); - ui.lineControlAddress->setEnabled(!ui.chkAuto->isChecked()); - ui.label->setEnabled(!ui.chkAuto->isChecked()); - ui.lineControlPort->setEnabled(!ui.chkAuto->isChecked()); + ui.lblAddress->setVisible(!ui.chkAuto->isChecked()); + ui.lineControlAddress->setVisible(!ui.chkAuto->isChecked()); + ui.label->setVisible(!ui.chkAuto->isChecked()); + ui.lineControlPort->setVisible(!ui.chkAuto->isChecked()); } diff --git a/src/vidalia/config/AdvancedPage.ui b/src/vidalia/config/AdvancedPage.ui index 9473a81..fbaac49 100644 --- a/src/vidalia/config/AdvancedPage.ui +++ b/src/vidalia/config/AdvancedPage.ui @@ -31,7 +31,7 @@ <property name="verticalSpacing"> <number>6</number> </property> - <item row="5" column="0"> + <item row="6" column="0"> <widget class="QLabel" name="lblAuth"> <property name="text"> <string>Authentication:</string> @@ -51,7 +51,7 @@ </property> </widget> </item> - <item row="5" column="2" colspan="3"> + <item row="6" column="2" colspan="3"> <layout class="QHBoxLayout"> <property name="spacing"> <number>2</number> @@ -168,7 +168,7 @@ <property name="sizeHint" stdset="0"> <size> <width>40</width> - <height>20</height> + <height>0</height> </size> </property> </spacer> @@ -185,7 +185,7 @@ </property> </widget> </item> - <item row="4" column="0"> + <item row="5" column="0"> <widget class="QLabel" name="lblPath"> <property name="enabled"> <bool>false</bool> @@ -198,21 +198,21 @@ </property> </widget> </item> - <item row="4" column="1" colspan="2"> + <item row="5" column="1" colspan="2"> <widget class="QLineEdit" name="lineSocketPath"> <property name="enabled"> <bool>false</bool> </property> </widget> </item> - <item row="2" column="2"> + <item row="3" column="2"> <widget class="QRadioButton" name="rdoControlSocket"> <property name="text"> <string>Use Unix domain socket (ControlSocket)</string> </property> </widget> </item> - <item row="4" column="3"> + <item row="5" column="3"> <widget class="QPushButton" name="btnBrowseSocketPath"> <property name="enabled"> <bool>false</bool> @@ -222,7 +222,7 @@ </property> </widget> </item> - <item row="3" column="2"> + <item row="2" column="2"> <widget class="QCheckBox" name="chkAuto"> <property name="text"> <string>Configure ControlPort automatically</string>

1 0

[torouter/master] add some configs and shell scripts
by ioerror＠torproject.org 12 Aug '11

12 Aug '11

commit 2196124bf23eb9a9e4b708b2ed098011eb54df2c Author: Jacob Appelbaum <jacob(a)appelbaum.net> Date: Sat Aug 13 04:36:54 2011 +0200 add some configs and shell scripts --- packages/torouter-prep/configs/dnsmasq.conf | 556 ++++++++++++++++++++ packages/torouter-prep/configs/interfaces | 38 ++ packages/torouter-prep/configs/sources.list | 14 + packages/torouter-prep/configs/sshd_config | 87 +++ .../torouter-prep/configs/tor-wireless-firewall.sh | 20 + packages/torouter-prep/configs/torrc | 177 +++++++ packages/torouter-prep/configs/udhcpd.conf | 26 + 7 files changed, 918 insertions(+), 0 deletions(-) diff --git a/packages/torouter-prep/configs/dnsmasq.conf b/packages/torouter-prep/configs/dnsmasq.conf new file mode 100644 index 0000000..8845e80 --- /dev/null +++ b/packages/torouter-prep/configs/dnsmasq.conf @@ -0,0 +1,556 @@ +# Configuration file for dnsmasq. +# +# Format is one option per line, legal options are the same +# as the long options legal on the command line. See +# "/usr/sbin/dnsmasq --help" or "man 8 dnsmasq" for details. + +# The following two options make you a better netizen, since they +# tell dnsmasq to filter out queries which the public DNS cannot +# answer, and which load the servers (especially the root servers) +# uneccessarily. If you have a dial-on-demand link they also stop +# these requests from bringing up the link uneccessarily. + +# Never forward plain names (without a dot or domain part) +#domain-needed +# Never forward addresses in the non-routed address spaces. +#bogus-priv + + +# Uncomment this to filter useless windows-originated DNS requests +# which can trigger dial-on-demand links needlessly. +# Note that (amongst other things) this blocks all SRV requests, +# so don't use it if you use eg Kerberos, SIP, XMMP or Google-talk. +# This option only affects forwarding, SRV records originating for +# dnsmasq (via srv-host= lines) are not suppressed by it. +#filterwin2k + +# Change this line if you want dns to get its upstream servers from +# somewhere other that /etc/resolv.conf +#resolv-file= + +# By default, dnsmasq will send queries to any of the upstream +# servers it knows about and tries to favour servers to are known +# to be up. Uncommenting this forces dnsmasq to try each query +# with each server strictly in the order they appear in +# /etc/resolv.conf +#strict-order + +# If you don't want dnsmasq to read /etc/resolv.conf or any other +# file, getting its servers from this file instead (see below), then +# uncomment this. +#no-resolv + +# If you don't want dnsmasq to poll /etc/resolv.conf or other resolv +# files for changes and re-read them then uncomment this. +no-poll + +# Add other name servers here, with domain specs if they are for +# non-public domains. +#server=/localnet/192.168.0.1 + +# Example of routing PTR queries to nameservers: this will send all +# address->name queries for 192.168.3/24 to nameserver 10.1.2.3 +#server=/3.168.192.in-addr.arpa/10.1.2.3 + +# Add local-only domains here, queries in these domains are answered +# from /etc/hosts or DHCP only. +#local=/localnet/ + +# Add domains which you want to force to an IP address here. +# The example below send any host in doubleclick.net to a local +# webserver. +#address=/doubleclick.net/127.0.0.1 + +# --address (and --server) work with IPv6 addresses too. +#address=/www.thekelleys.org.uk/fe80::20d:60ff:fe36:f83 + +# You can control how dnsmasq talks to a server: this forces +# queries to 10.1.2.3 to be routed via eth1 +# server=10.1.2.3@eth1 + +# and this sets the source (ie local) address used to talk to +# 10.1.2.3 to 192.168.1.1 port 55 (there must be a interface with that +# IP on the machine, obviously). +# server=10.1.2.3(a)192.168.1.1#55 + +# If you want dnsmasq to change uid and gid to something other +# than the default, edit the following lines. +#user= +#group= + +# If you want dnsmasq to listen for DHCP and DNS requests only on +# specified interfaces (and the loopback) give the name of the +# interface (eg eth0) here. +# Repeat the line for more than one interface. +interface=eth1 +#interface=uap0 +# Or you can specify which interface _not_ to listen on +except-interface=eth0 +# Or which to listen on by address (remember to include 127.0.0.1 if +# you use this.) +#listen-address= +# If you want dnsmasq to provide only DNS service on an interface, +# configure it as shown above, and then use the following line to +# disable DHCP on it. +#no-dhcp-interface= +#no-dns-interface=uap0 + +# On systems which support it, dnsmasq binds the wildcard address, +# even when it is listening on only some interfaces. It then discards +# requests that it shouldn't reply to. This has the advantage of +# working even when interfaces come and go and change address. If you +# want dnsmasq to really bind only the interfaces it is listening on, +# uncomment this option. About the only time you may need this is when +# running another nameserver on the same machine. +bind-interfaces + +# If you don't want dnsmasq to read /etc/hosts, uncomment the +# following line. +#no-hosts +# or if you want it to read another file, as well as /etc/hosts, use +# this. +#addn-hosts=/etc/banner_add_hosts + +# Set this (and domain: see below) if you want to have a domain +# automatically added to simple names in a hosts-file. +#expand-hosts + +# Set the domain for dnsmasq. this is optional, but if it is set, it +# does the following things. +# 1) Allows DHCP hosts to have fully qualified domain names, as long +# as the domain part matches this setting. +# 2) Sets the "domain" DHCP option thereby potentially setting the +# domain of all systems configured by DHCP +# 3) Provides the domain part for "expand-hosts" +#domain=thekelleys.org.uk + +# Set a different domain for a particular subnet +#domain=wireless.thekelleys.org.uk,192.168.2.0/24 + +# Same idea, but range rather then subnet +#domain=reserved.thekelleys.org.uk,192.68.3.100,192.168.3.200 + +# Uncomment this to enable the integrated DHCP server, you need +# to supply the range of addresses available for lease and optionally +# a lease time. If you have more than one network, you will need to +# repeat this for each network on which you want to supply DHCP +# service. +#dhcp-range=192.168.0.50,192.168.0.150,12h +dhcp-range=10.23.42.10,10.23.42.254,255.255.255.0,12h +dhcp-range=172.16.23.10,172.16.23.254,255.255.255.0,12h + +# This is an example of a DHCP range where the netmask is given. This +# is needed for networks we reach the dnsmasq DHCP server via a relay +# agent. If you don't know what a DHCP relay agent is, you probably +# don't need to worry about this. +#dhcp-range=192.168.0.50,192.168.0.150,255.255.255.0,12h + +# This is an example of a DHCP range which sets a tag, so that +# some DHCP options may be set only for this network. +#dhcp-range=set:red,192.168.0.50,192.168.0.150 + +# Use this DHCP range only when the tag "green" is set. +#dhcp-range=tag:green,192.168.0.50,192.168.0.150,12h + +# Specify a subnet which can't be used for dynamic address allocation, +# is available for hosts with matching --dhcp-host lines. Note that +# dhcp-host declarations will be ignored unless there is a dhcp-range +# of some type for the subnet in question. +# In this case the netmask is implied (it comes from the network +# configuration on the machine running dnsmasq) it is possible to give +# an explict netmask instead. +#dhcp-range=192.168.0.0,static + +# Supply parameters for specified hosts using DHCP. There are lots +# of valid alternatives, so we will give examples of each. Note that +# IP addresses DO NOT have to be in the range given above, they just +# need to be on the same network. The order of the parameters in these +# do not matter, it's permissble to give name,adddress and MAC in any order + +# Always allocate the host with ethernet address 11:22:33:44:55:66 +# The IP address 192.168.0.60 +#dhcp-host=11:22:33:44:55:66,192.168.0.60 + +# Always set the name of the host with hardware address +# 11:22:33:44:55:66 to be "fred" +#dhcp-host=11:22:33:44:55:66,fred + +# Always give the host with ethernet address 11:22:33:44:55:66 +# the name fred and IP address 192.168.0.60 and lease time 45 minutes +#dhcp-host=11:22:33:44:55:66,fred,192.168.0.60,45m + +# Give a host with ethernet address 11:22:33:44:55:66 or +# 12:34:56:78:90:12 the IP address 192.168.0.60. Dnsmasq will assume +# that these two ethernet interfaces will never be in use at the same +# time, and give the IP address to the second, even if it is already +# in use by the first. Useful for laptops with wired and wireless +# addresses. +#dhcp-host=11:22:33:44:55:66,12:34:56:78:90:12,192.168.0.60 + +# Give the machine which says its name is "bert" IP address +# 192.168.0.70 and an infinite lease +#dhcp-host=bert,192.168.0.70,infinite + +# Always give the host with client identifier 01:02:02:04 +# the IP address 192.168.0.60 +#dhcp-host=id:01:02:02:04,192.168.0.60 + +# Always give the host with client identifier "marjorie" +# the IP address 192.168.0.60 +#dhcp-host=id:marjorie,192.168.0.60 + +# Enable the address given for "judge" in /etc/hosts +# to be given to a machine presenting the name "judge" when +# it asks for a DHCP lease. +#dhcp-host=judge + +# Never offer DHCP service to a machine whose ethernet +# address is 11:22:33:44:55:66 +#dhcp-host=11:22:33:44:55:66,ignore + +# Ignore any client-id presented by the machine with ethernet +# address 11:22:33:44:55:66. This is useful to prevent a machine +# being treated differently when running under different OS's or +# between PXE boot and OS boot. +#dhcp-host=11:22:33:44:55:66,id:* + +# Send extra options which are tagged as "red" to +# the machine with ethernet address 11:22:33:44:55:66 +#dhcp-host=11:22:33:44:55:66,set:red + +# Send extra options which are tagged as "red" to +# any machine with ethernet address starting 11:22:33: +#dhcp-host=11:22:33:*:*:*,set:red + +# Ignore any clients which are specified in dhcp-host lines +# or /etc/ethers. Equivalent to ISC "deny unkown-clients". +# This relies on the special "known" tag which is set when +# a host is matched. +#dhcp-ignore=tag:!known + +# Send extra options which are tagged as "red" to any machine whose +# DHCP vendorclass string includes the substring "Linux" +#dhcp-vendorclass=set:red,Linux + +# Send extra options which are tagged as "red" to any machine one +# of whose DHCP userclass strings includes the substring "accounts" +#dhcp-userclass=set:red,accounts + +# Send extra options which are tagged as "red" to any machine whose +# MAC address matches the pattern. +#dhcp-mac=set:red,00:60:8C:*:*:* + +# If this line is uncommented, dnsmasq will read /etc/ethers and act +# on the ethernet-address/IP pairs found there just as if they had +# been given as --dhcp-host options. Useful if you keep +# MAC-address/host mappings there for other purposes. +#read-ethers + +# Send options to hosts which ask for a DHCP lease. +# See RFC 2132 for details of available options. +# Common options can be given to dnsmasq by name: +# run "dnsmasq --help dhcp" to get a list. +# Note that all the common settings, such as netmask and +# broadcast address, DNS server and default route, are given +# sane defaults by dnsmasq. You very likely will not need +# any dhcp-options. If you use Windows clients and Samba, there +# are some options which are recommended, they are detailed at the +# end of this section. + +# Override the default route supplied by dnsmasq, which assumes the +# router is the same machine as the one running dnsmasq. +#dhcp-option=3,1.2.3.4 + +# Do the same thing, but using the option name +#dhcp-option=option:router,1.2.3.4 + +# Override the default route supplied by dnsmasq and send no default +# route at all. Note that this only works for the options sent by +# default (1, 3, 6, 12, 28) the same line will send a zero-length option +# for all other option numbers. +#dhcp-option=3 + +# Set the NTP time server addresses to 192.168.0.4 and 10.10.0.5 +#dhcp-option=option:ntp-server,192.168.0.4,10.10.0.5 + +# Set the NTP time server address to be the same machine as +# is running dnsmasq +#dhcp-option=42,0.0.0.0 + +# Set the NIS domain name to "welly" +#dhcp-option=40,welly + +# Set the default time-to-live to 50 +#dhcp-option=23,50 + +# Set the "all subnets are local" flag +#dhcp-option=27,1 + +# Send the etherboot magic flag and then etherboot options (a string). +#dhcp-option=128,e4:45:74:68:00:00 +#dhcp-option=129,NIC=eepro100 + +# Specify an option which will only be sent to the "red" network +# (see dhcp-range for the declaration of the "red" network) +# Note that the tag: part must precede the option: part. +#dhcp-option = tag:red, option:ntp-server, 192.168.1.1 + +# The following DHCP options set up dnsmasq in the same way as is specified +# for the ISC dhcpcd in +# http://www.samba.org/samba/ftp/docs/textdocs/DHCP-Server-Configuration.txt +# adapted for a typical dnsmasq installation where the host running +# dnsmasq is also the host running samba. +# you may want to uncomment some or all of them if you use +# Windows clients and Samba. +#dhcp-option=19,0 # option ip-forwarding off +#dhcp-option=44,0.0.0.0 # set netbios-over-TCP/IP nameserver(s) aka WINS server(s) +#dhcp-option=45,0.0.0.0 # netbios datagram distribution server +#dhcp-option=46,8 # netbios node type + +# Send RFC-3397 DNS domain search DHCP option. WARNING: Your DHCP client +# probably doesn't support this...... +#dhcp-option=option:domain-search,eng.apple.com,marketing.apple.com + +# Send RFC-3442 classless static routes (note the netmask encoding) +#dhcp-option=121,192.168.1.0/24,1.2.3.4,10.0.0.0/8,5.6.7.8 + +# Send vendor-class specific options encapsulated in DHCP option 43. +# The meaning of the options is defined by the vendor-class so +# options are sent only when the client supplied vendor class +# matches the class given here. (A substring match is OK, so "MSFT" +# matches "MSFT" and "MSFT 5.0"). This example sets the +# mtftp address to 0.0.0.0 for PXEClients. +#dhcp-option=vendor:PXEClient,1,0.0.0.0 + +# Send microsoft-specific option to tell windows to release the DHCP lease +# when it shuts down. Note the "i" flag, to tell dnsmasq to send the +# value as a four-byte integer - that's what microsoft wants. See +# http://technet2.microsoft.com/WindowsServer/en/library/a70f1bb7-d2d4-49f0-9… +#dhcp-option=vendor:MSFT,2,1i + +# Send the Encapsulated-vendor-class ID needed by some configurations of +# Etherboot to allow is to recognise the DHCP server. +#dhcp-option=vendor:Etherboot,60,"Etherboot" + +# Send options to PXELinux. Note that we need to send the options even +# though they don't appear in the parameter request list, so we need +# to use dhcp-option-force here. +# See http://syslinux.zytor.com/pxe.php#special for details. +# Magic number - needed before anything else is recognised +#dhcp-option-force=208,f1:00:74:7e +# Configuration file name +#dhcp-option-force=209,configs/common +# Path prefix +#dhcp-option-force=210,/tftpboot/pxelinux/files/ +# Reboot time. (Note 'i' to send 32-bit value) +#dhcp-option-force=211,30i + +# Set the boot filename for netboot/PXE. You will only need +# this is you want to boot machines over the network and you will need +# a TFTP server; either dnsmasq's built in TFTP server or an +# external one. (See below for how to enable the TFTP server.) +#dhcp-boot=pxelinux.0 + +# Boot for Etherboot gPXE. The idea is to send two different +# filenames, the first loads gPXE, and the second tells gPXE what to +# load. The dhcp-match sets the gpxe tag for requests from gPXE. +#dhcp-match=set:gpxe,175 # gPXE sends a 175 option. +#dhcp-boot=tag:!gpxe,undionly.kpxe +#dhcp-boot=mybootimage + +# Encapsulated options for Etherboot gPXE. All the options are +# encapsulated within option 175 +#dhcp-option=encap:175, 1, 5b # priority code +#dhcp-option=encap:175, 176, 1b # no-proxydhcp +#dhcp-option=encap:175, 177, string # bus-id +#dhcp-option=encap:175, 189, 1b # BIOS drive code +#dhcp-option=encap:175, 190, user # iSCSI username +#dhcp-option=encap:175, 191, pass # iSCSI password + +# Test for the architecture of a netboot client. PXE clients are +# supposed to send their architecture as option 93. (See RFC 4578) +#dhcp-match=peecees, option:client-arch, 0 #x86-32 +#dhcp-match=itanics, option:client-arch, 2 #IA64 +#dhcp-match=hammers, option:client-arch, 6 #x86-64 +#dhcp-match=mactels, option:client-arch, 7 #EFI x86-64 + +# Do real PXE, rather than just booting a single file, this is an +# alternative to dhcp-boot. +#pxe-prompt="What system shall I netboot?" +# or with timeout before first available action is taken: +#pxe-prompt="Press F8 for menu.", 60 + +# Available boot services. for PXE. +#pxe-service=x86PC, "Boot from local disk" + +# Loads <tftp-root>/pxelinux.0 from dnsmasq TFTP server. +#pxe-service=x86PC, "Install Linux", pxelinux + +# Loads <tftp-root>/pxelinux.0 from TFTP server at 1.2.3.4. +# Beware this fails on old PXE ROMS. +#pxe-service=x86PC, "Install Linux", pxelinux, 1.2.3.4 + +# Use bootserver on network, found my multicast or broadcast. +#pxe-service=x86PC, "Install windows from RIS server", 1 + +# Use bootserver at a known IP address. +#pxe-service=x86PC, "Install windows from RIS server", 1, 1.2.3.4 + +# If you have multicast-FTP available, +# information for that can be passed in a similar way using options 1 +# to 5. See page 19 of +# http://download.intel.com/design/archives/wfm/downloads/pxespec.pdf + + +# Enable dnsmasq's built-in TFTP server +#enable-tftp + +# Set the root directory for files availble via FTP. +#tftp-root=/var/ftpd + +# Make the TFTP server more secure: with this set, only files owned by +# the user dnsmasq is running as will be send over the net. +#tftp-secure + +# This option stops dnsmasq from negotiating a larger blocksize for TFTP +# transfers. It will slow things down, but may rescue some broken TFTP +# clients. +#tftp-no-blocksize + +# Set the boot file name only when the "red" tag is set. +#dhcp-boot=net:red,pxelinux.red-net + +# An example of dhcp-boot with an external TFTP server: the name and IP +# address of the server are given after the filename. +# Can fail with old PXE ROMS. Overridden by --pxe-service. +#dhcp-boot=/var/ftpd/pxelinux.0,boothost,192.168.0.3 + +# Set the limit on DHCP leases, the default is 150 +#dhcp-lease-max=150 + +# The DHCP server needs somewhere on disk to keep its lease database. +# This defaults to a sane location, but if you want to change it, use +# the line below. +#dhcp-leasefile=/var/lib/misc/dnsmasq.leases + +# Set the DHCP server to authoritative mode. In this mode it will barge in +# and take over the lease for any client which broadcasts on the network, +# whether it has a record of the lease or not. This avoids long timeouts +# when a machine wakes up on a new network. DO NOT enable this if there's +# the slighest chance that you might end up accidentally configuring a DHCP +# server for your campus/company accidentally. The ISC server uses +# the same option, and this URL provides more information: +# http://www.isc.org/index.pl?/sw/dhcp/authoritative.php +#dhcp-authoritative + +# Run an executable when a DHCP lease is created or destroyed. +# The arguments sent to the script are "add" or "del", +# then the MAC address, the IP address and finally the hostname +# if there is one. +#dhcp-script=/bin/echo + +# Set the cachesize here. +#cache-size=150 + +# If you want to disable negative caching, uncomment this. +#no-negcache + +# Normally responses which come form /etc/hosts and the DHCP lease +# file have Time-To-Live set as zero, which conventionally means +# do not cache further. If you are happy to trade lower load on the +# server for potentially stale date, you can set a time-to-live (in +# seconds) here. +#local-ttl= + +# If you want dnsmasq to detect attempts by Verisign to send queries +# to unregistered .com and .net hosts to its sitefinder service and +# have dnsmasq instead return the correct NXDOMAIN response, uncomment +# this line. You can add similar lines to do the same for other +# registries which have implemented wildcard A records. +#bogus-nxdomain=64.94.110.11 + +# If you want to fix up DNS results from upstream servers, use the +# alias option. This only works for IPv4. +# This alias makes a result of 1.2.3.4 appear as 5.6.7.8 +#alias=1.2.3.4,5.6.7.8 +# and this maps 1.2.3.x to 5.6.7.x +#alias=1.2.3.0,5.6.7.0,255.255.255.0 +# and this maps 192.168.0.10->192.168.0.40 to 10.0.0.10->10.0.0.40 +#alias=192.168.0.10-192.168.0.40,10.0.0.0,255.255.255.0 + +# Change these lines if you want dnsmasq to serve MX records. + +# Return an MX record named "maildomain.com" with target +# servermachine.com and preference 50 +#mx-host=maildomain.com,servermachine.com,50 + +# Set the default target for MX records created using the localmx option. +#mx-target=servermachine.com + +# Return an MX record pointing to the mx-target for all local +# machines. +#localmx + +# Return an MX record pointing to itself for all local machines. +#selfmx + +# Change the following lines if you want dnsmasq to serve SRV +# records. These are useful if you want to serve ldap requests for +# Active Directory and other windows-originated DNS requests. +# See RFC 2782. +# You may add multiple srv-host lines. +# The fields are <name>,<target>,<port>,<priority>,<weight> +# If the domain part if missing from the name (so that is just has the +# service and protocol sections) then the domain given by the domain= +# config option is used. (Note that expand-hosts does not need to be +# set for this to work.) + +# A SRV record sending LDAP for the example.com domain to +# ldapserver.example.com port 389 +#srv-host=_ldap._tcp.example.com,ldapserver.example.com,389 + +# A SRV record sending LDAP for the example.com domain to +# ldapserver.example.com port 389 (using domain=) +#domain=example.com +#srv-host=_ldap._tcp,ldapserver.example.com,389 + +# Two SRV records for LDAP, each with different priorities +#srv-host=_ldap._tcp.example.com,ldapserver.example.com,389,1 +#srv-host=_ldap._tcp.example.com,ldapserver.example.com,389,2 + +# A SRV record indicating that there is no LDAP server for the domain +# example.com +#srv-host=_ldap._tcp.example.com + +# The following line shows how to make dnsmasq serve an arbitrary PTR +# record. This is useful for DNS-SD. (Note that the +# domain-name expansion done for SRV records _does_not +# occur for PTR records.) +#ptr-record=_http._tcp.dns-sd-services,"New Employee Page._http._tcp.dns-sd-services" + +# Change the following lines to enable dnsmasq to serve TXT records. +# These are used for things like SPF and zeroconf. (Note that the +# domain-name expansion done for SRV records _does_not +# occur for TXT records.) + +#Example SPF. +#txt-record=example.com,"v=spf1 a -all" + +#Example zeroconf +#txt-record=_http._tcp.example.com,name=value,paper=A4 + +# Provide an alias for a "local" DNS name. Note that this _only_ works +# for targets which are names from DHCP or /etc/hosts. Give host +# "bert" another name, bertrand +#cname=bertand,bert + +# For debugging purposes, log each DNS query as it passes through +# dnsmasq. +#log-queries + +# Log lots of extra information about DHCP transactions. +#log-dhcp + +# Include a another lot of configuration options. +#conf-file=/etc/dnsmasq.more.conf +#conf-dir=/etc/dnsmasq.d diff --git a/packages/torouter-prep/configs/interfaces b/packages/torouter-prep/configs/interfaces new file mode 100644 index 0000000..d1a5fa6 --- /dev/null +++ b/packages/torouter-prep/configs/interfaces @@ -0,0 +1,38 @@ +# This file describes the network interfaces available on your system +# and how to activate them. For more information, see interfaces(5). + +# The loopback network interface +auto lo +iface lo inet loopback + +# The primary network interface +auto eth0 +iface eth0 inet dhcp + post-up ifup uap0 + post-down ifdown uap0 + +auto eth1 +iface eth1 inet static + address 10.23.42.1 + netmask 255.255.255.0 + network 10.23.42.0 + broadcast 10.23.42.255 + post-up echo 1 > /proc/sys/net/ipv4/ip_forward + # this must happen after have brought up uap0 because it clears the nat tables + post-up iptables -t nat -A POSTROUTING -s 10.23.42.0/24 -o eth0 -j MASQUERADE + post-up /etc/init.d/dnsmasq restart + +# The magic Tor wireless network +iface uap0 inet static + address 172.16.23.1 + netmask 255.255.255.0 + network 172.16.23.0 + broadcast 172.16.23.255 + pre-up ifconfig uap0 hw ether 00:66:66:66:66:66 + post-up /etc/init.d/tor reload + #post-up /etc/init.d/udhcpd restart + post-up /etc/init.d/dnsmasq restart + post-up /root/tor-wireless-firewall.sh + post-up /root/uaputl/uaputl sys_cfg_ssid "torproject" + post-up /root/uaputl/uaputl bss_start + pre-down /root/uaputl/uaputl bss_stop diff --git a/packages/torouter-prep/configs/sources.list b/packages/torouter-prep/configs/sources.list new file mode 100644 index 0000000..f6c7c0b --- /dev/null +++ b/packages/torouter-prep/configs/sources.list @@ -0,0 +1,14 @@ +deb http://ftp.de.debian.org/pub/debian/ squeeze main non-free contrib +deb-src http://ftp.de.debian.org/pub/debian/ squeeze main non-free contrib +deb http://security.debian.org/ squeeze/updates main + +# experimental for natpmp +deb http://ftp.debian.org/debian experimental main +deb-src http://ftp.debian.org/debian experimental main + +# backports for upnp +deb http://backports.debian.org/debian-backports squeeze-backports main + +# Tor project repo +deb http://deb.torproject.org/torproject.org/ squeeze main +deb-src http://deb.torproject.org/torproject.org squeeze main diff --git a/packages/torouter-prep/configs/sshd_config b/packages/torouter-prep/configs/sshd_config new file mode 100644 index 0000000..d079ac0 --- /dev/null +++ b/packages/torouter-prep/configs/sshd_config @@ -0,0 +1,87 @@ +# Package generated configuration file +# See the sshd_config(5) manpage for details + +# What ports, IPs and protocols we listen for +Port 22 +# Use these options to restrict which interfaces/protocols sshd will bind to +#ListenAddress :: +#ListenAddress 0.0.0.0 +Protocol 2 +# HostKeys for protocol version 2 +HostKey /etc/ssh/ssh_host_rsa_key +HostKey /etc/ssh/ssh_host_dsa_key +#Privilege Separation is turned on for security +UsePrivilegeSeparation yes + +# Lifetime and size of ephemeral version 1 server key +KeyRegenerationInterval 3600 +ServerKeyBits 768 + +# Logging +SyslogFacility AUTH +LogLevel INFO + +# Authentication: +LoginGraceTime 120 +PermitRootLogin yes +StrictModes yes + +RSAAuthentication yes +PubkeyAuthentication yes +#AuthorizedKeysFile %h/.ssh/authorized_keys + +# Don't read the user's ~/.rhosts and ~/.shosts files +IgnoreRhosts yes +# For this to work you will also need host keys in /etc/ssh_known_hosts +RhostsRSAAuthentication no +# similar for protocol version 2 +HostbasedAuthentication no +# Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication +#IgnoreUserKnownHosts yes + +# To enable empty passwords, change to yes (NOT RECOMMENDED) +PermitEmptyPasswords no + +# Change to yes to enable challenge-response passwords (beware issues with +# some PAM modules and threads) +ChallengeResponseAuthentication no + +# Change to no to disable tunnelled clear text passwords +#PasswordAuthentication yes + +# Kerberos options +#KerberosAuthentication no +#KerberosGetAFSToken no +#KerberosOrLocalPasswd yes +#KerberosTicketCleanup yes + +# GSSAPI options +#GSSAPIAuthentication no +#GSSAPICleanupCredentials yes + +X11Forwarding yes +X11DisplayOffset 10 +PrintMotd no +PrintLastLog yes +TCPKeepAlive yes +#UseLogin no + +#MaxStartups 10:30:60 +#Banner /etc/issue.net + +# Allow client to pass locale environment variables +AcceptEnv LANG LC_* + +Subsystem sftp /usr/lib/openssh/sftp-server + +# Set this to 'yes' to enable PAM authentication, account processing, +# and session processing. If this is enabled, PAM authentication will +# be allowed through the ChallengeResponseAuthentication and +# PasswordAuthentication. Depending on your PAM configuration, +# PAM authentication via ChallengeResponseAuthentication may bypass +# the setting of "PermitRootLogin without-password". +# If you just want the PAM account and session checks to run without +# PAM authentication, then enable this but set PasswordAuthentication +# and ChallengeResponseAuthentication to 'no'. +UsePAM yes +AddressFamily inet diff --git a/packages/torouter-prep/configs/tor-wireless-firewall.sh b/packages/torouter-prep/configs/tor-wireless-firewall.sh new file mode 100755 index 0000000..4310e7b --- /dev/null +++ b/packages/torouter-prep/configs/tor-wireless-firewall.sh @@ -0,0 +1,20 @@ +#!/bin/sh + +# destinations you don't want routed through Tor +NON_TOR="10.0.2.0/24 10.23.42.0/24 172.16.23.0/24" + +# Tor's TransPort +TRANS_PORT="9040" + +# your internal interface +INT_IF="uap0" + +iptables -F +iptables -t nat -F + +for NET in $NON_TOR; do + iptables -t nat -A PREROUTING -i $INT_IF -d $NET -j RETURN +done +iptables -t nat -A PREROUTING -i $INT_IF -p udp --dport 53 -j REDIRECT --to-ports 5353 +#iptables -t nat -A PREROUTING -i $INT_IF -p udp --dport 67 -j REDIRECT --to-ports 67 +iptables -t nat -A PREROUTING -i $INT_IF -p tcp --syn -j REDIRECT --to-ports $TRANS_PORT diff --git a/packages/torouter-prep/configs/torrc b/packages/torouter-prep/configs/torrc new file mode 100644 index 0000000..b4c5de3 --- /dev/null +++ b/packages/torouter-prep/configs/torrc @@ -0,0 +1,177 @@ +## Configuration file for a typical Tor user +## Last updated 12 April 2009 for Tor 0.2.1.14-rc. +## (May or may not work for much older or much newer versions of Tor.) +## +## Lines that begin with "## " try to explain what's going on. Lines +## that begin with just "#" are disabled commands: you can enable them +## by removing the "#" symbol. +## +## See 'man tor', or https://www.torproject.org/tor-manual.html, +## for more options you can use in this file. +## +## Tor will look for this file in various places based on your platform: +## https://wiki.torproject.org/noreply/TheOnionRouter/TorFAQ#torrc + + +## Replace this with "SocksPort 0" if you plan to run Tor only as a +## relay, and not make any local application connections yourself. +SocksPort 9050 # what port to open for local application connections +SocksListenAddress 127.0.0.1 # accept connections only from localhost +#SocksListenAddress 192.168.0.1:9100 # listen on this IP:port also + +## Entry policies to allow/deny SOCKS requests based on IP address. +## First entry that matches wins. If no SocksPolicy is set, we accept +## all (and only) requests from SocksListenAddress. +#SocksPolicy accept 192.168.0.0/16 +#SocksPolicy reject * + +## Logs go to stdout at level "notice" unless redirected by something +## else, like one of the below lines. You can have as many Log lines as +## you want. +## +## We advise using "notice" in most cases, since anything more verbose +## may provide sensitive information to an attacker who obtains the logs. +## +## Send all messages of level 'notice' or higher to /var/log/tor/notices.log +Log notice file /var/log/tor/notices.log +## Send every possible message to /var/log/tor/debug.log +Log debug file /var/log/tor/debug.log +## Use the system log instead of Tor's logfiles +#Log notice syslog +## To send all messages to stderr: +#Log debug stderr + +## Uncomment this to start the process in the background... or use +## --runasdaemon 1 on the command line. This is ignored on Windows; +## see the FAQ entry if you want Tor to run as an NT service. +RunAsDaemon 1 + +## The directory for keeping all the keys/etc. By default, we store +## things in $HOME/.tor on Unix, and in Application Data\tor on Windows. +DataDirectory /var/lib/tor + +## The port on which Tor will listen for local connections from Tor +## controller applications, as documented in control-spec.txt. +#ControlPort 9051 +## If you enable the controlport, be sure to enable one of these +## authentication methods, to prevent attackers from accessing it. +#HashedControlPassword 16:872860B76453A77D60CA2BB8C1A7042072093276A3D701AD684053EC4C +#CookieAuthentication 1 + +############### This section is just for location-hidden services ### + +## Once you have configured a hidden service, you can look at the +## contents of the file ".../hidden_service/hostname" for the address +## to tell people. +## +## HiddenServicePort x y:z says to redirect requests on port x to the +## address y:z. + +HiddenServiceDir /var/lib/tor/hidden_service/ +HiddenServicePort 22 127.0.0.1:22 + +#HiddenServiceDir /var/lib/tor/other_hidden_service/ +#HiddenServicePort 80 127.0.0.1:80 +#HiddenServicePort 22 127.0.0.1:22 + +################ This section is just for relays ##################### +# +## See https://www.torproject.org/docs/tor-doc-relay for details. + +## Required: what port to advertise for incoming Tor connections. +ORPort 9001 +## If you want to listen on a port other than the one advertised +## in ORPort (e.g. to advertise 443 but bind to 9090), uncomment the +## line below too. You'll need to do ipchains or other port forwarding +## yourself to make this work. +#ORListenAddress 0.0.0.0:9090 + +## A handle for your relay, so people don't have to refer to it by key. +#Nickname ididnteditheconfig + +## The IP address or full DNS name for your relay. Leave commented out +## and Tor will guess. +#Address noname.example.com + +## Define these to limit how much relayed traffic you will allow. Your +## own traffic is still unthrottled. Note that RelayBandwidthRate must +## be at least 20 KBytes. +#RelayBandwidthRate 100 KBytes # Throttle traffic to 100KB/s (800Kbps) +#RelayBandwidthBurst 200 KBytes # But allow bursts up to 200KB/s (1600Kbps) + +## Contact info to be published in the directory, so we can contact you +## if your relay is misconfigured or something else goes wrong. Google +## indexes this, so spammers might also collect it. +#ContactInfo Random Person <nobody AT example dot com> +## You might also include your PGP or GPG fingerprint if you have one: +#ContactInfo 1234D/FFFFFFFF Random Person <nobody AT example dot com> + +## Uncomment this to mirror directory information for others. Please do +## if you have enough bandwidth. +#DirPort 9030 # what port to advertise for directory connections +## If you want to listen on a port other than the one advertised +## in DirPort (e.g. to advertise 80 but bind to 9091), uncomment the line +## below too. You'll need to do ipchains or other port forwarding yourself +## to make this work. +#DirListenAddress 0.0.0.0:9091 +## Uncomment to return an arbitrary blob of html on your DirPort. Now you +## can explain what Tor is if anybody wonders why your IP address is +## contacting them. See contrib/tor-exit-notice.html for a sample. +#DirPortFrontPage /etc/tor/exit-notice.html + +## Uncomment this if you run more than one Tor relay, and add the identity +## key fingerprint of each Tor relay you control, even if they're on +## different networks. You declare it here so Tor clients can avoid +## using more than one of your relays in a single circuit. See +## https://wiki.torproject.org/noreply/TheOnionRouter/TorFAQ#MultipleServers +#MyFamily $keyid,$keyid,... + +## A comma-separated list of exit policies. They're considered first +## to last, and the first match wins. If you want to _replace_ +## the default exit policy, end this with either a reject *:* or an +## accept *:*. Otherwise, you're _augmenting_ (prepending to) the +## default exit policy. Leave commented to just use the default, which is +## described in the man page or at +## https://www.torproject.org/documentation.html +## +## Look at https://www.torproject.org/faq-abuse.html#TypicalAbuses +## for issues you might encounter if you use the default exit policy. +## +## If certain IPs and ports are blocked externally, e.g. by your firewall, +## you should update your exit policy to reflect this -- otherwise Tor +## users will be told that those destinations are down. +## +#ExitPolicy accept *:6660-6667,reject *:* # allow irc ports but no more +#ExitPolicy accept *:119 # accept nntp as well as default exit policy +#ExitPolicy reject *:* # no exits allowed +# +## Bridge relays (or "bridges") are Tor relays that aren't listed in the +## main directory. Since there is no complete public list of them, even if an +## ISP is filtering connections to all the known Tor relays, they probably +## won't be able to block all the bridges. Also, websites won't treat you +## differently because they won't know you're running Tor. If you can +## be a real relay, please do; but if not, be a bridge! +#BridgeRelay 1 +ExitPolicy reject *:* + +AvoidDiskWrites 1 + +# middle box stuff +VirtualAddrNetwork 10.192.0.0/10 +AutomapHostsOnResolve 1 +TransPort 9040 +TransListenAddress 172.16.23.1 +DNSPort 5353 +DNSListenAddress 172.16.23.1 + +User debian-tor + +PortForwarding 1 +PortForwardingHelper /usr/local/bin/tor-fw-helper + +PIDFile /var/run/tor/tor.pid + +ControlPort 9051 +ControlListenAddress 127.0.0.1:9051 +CookieAuthentication 1 + diff --git a/packages/torouter-prep/configs/udhcpd.conf b/packages/torouter-prep/configs/udhcpd.conf new file mode 100644 index 0000000..04160aa --- /dev/null +++ b/packages/torouter-prep/configs/udhcpd.conf @@ -0,0 +1,26 @@ +# Sample udhcpd configuration file (/etc/udhcpd.conf) + +# The start and end of the IP lease block +start 172.16.23.10 +end 172.16.23.254 + +# The interface that udhcpd will use +interface uap0 + +# The maximim number of leases (includes addressesd reserved +# by OFFER's, DECLINE's, and ARP conficts +max_leases 244 + +# If remaining is true (default), udhcpd will store the time +# remaining for each lease in the udhcpd leases file. This is +# for embedded systems that cannot keep time between reboots. +# If you set remaining to no, the absolute time that the lease +# expires at will be stored in the dhcpd.leases file. +remaining no + +# Use Tor's DNSPort and route via Tor +opt dns 172.16.23.1 +option subnet 255.255.255.0 +opt router 172.16.23.1 +option domain local +option lease 864000 # 10 days of seconds

1 0

[torouter/master] Merge branch 'master' of ssh://git-rw.torproject.org/torouter
by ioerror＠torproject.org 12 Aug '11

12 Aug '11

commit a56b3841d2adb8c995d6fe4603a7e7751bfa6d78 Merge: 2196124 f54fe96 Author: Jacob Appelbaum <jacob(a)appelbaum.net> Date: Sat Aug 13 04:39:04 2011 +0200 Merge branch 'master' of ssh://git-rw.torproject.org/torouter packages/torouter-web/static/main.css | 10 +++- packages/torouter-web/tui/controllers/network.py | 56 ++++++--------- packages/torouter-web/tui/controllers/tor.py | 4 + packages/torouter-web/tui/utils/configuration.py | 85 ++++++++++++++++++++++ packages/torouter-web/tui/utils/parsing.py | 66 +++++++++++++++++ packages/torouter-web/tui/views/firewall.html | 8 ++- packages/torouter-web/tui/views/wired.html | 8 ++- 7 files changed, 200 insertions(+), 37 deletions(-)

1 0

[torouter/master] Add parsing function to read and write /etc/network/interfaces files.
by hellais＠torproject.org 12 Aug '11

12 Aug '11

commit f54fe96d36551fc61d746d875365e6722d56afd2 Author: Arturo Filastò <hellais(a)torproject.org> Date: Sat Aug 13 03:19:24 2011 +0200 Add parsing function to read and write /etc/network/interfaces files. --- packages/torouter-web/static/main.css | 10 +++- packages/torouter-web/tui/controllers/network.py | 2 +- packages/torouter-web/tui/utils/parsing.py | 66 ++++++++++++++++++++++ 3 files changed, 76 insertions(+), 2 deletions(-) diff --git a/packages/torouter-web/static/main.css b/packages/torouter-web/static/main.css index 41cb47f..5626e92 100644 --- a/packages/torouter-web/static/main.css +++ b/packages/torouter-web/static/main.css @@ -3,13 +3,17 @@ body { margin: 0;border: 0;padding: 0; } div.wrapper { + min-height: 300px; width: 800px; margin: 0 auto; } div.footer { - background-color: #CCC; + text-align: center; + background-color: #333; color: white; + padding-top: 20px; + padding-bottom: 20px; } div.header { @@ -22,8 +26,12 @@ div.header ul { } div.header ul li { + font-size: 20px; float: left; padding: 5px 10px; } +div.header ul#submenu li { + font-size: 15px; +} diff --git a/packages/torouter-web/tui/controllers/network.py b/packages/torouter-web/tui/controllers/network.py index 4eb1991..b5da4e3 100644 --- a/packages/torouter-web/tui/controllers/network.py +++ b/packages/torouter-web/tui/controllers/network.py @@ -15,7 +15,7 @@ def menu(n): else: a.append("") print a - return """<ul> + return """<ul id="submenu"> <li><a href="/network" class="%s">Main</a></li> <li><a href="/network/firewall" class="%s">Firewall</a></li> <li><a href="/network/wireless" class="%s">Wireless</a></li> diff --git a/packages/torouter-web/tui/utils/parsing.py b/packages/torouter-web/tui/utils/parsing.py new file mode 100644 index 0000000..c6ebe02 --- /dev/null +++ b/packages/torouter-web/tui/utils/parsing.py @@ -0,0 +1,66 @@ +# These functions are for parsing /etc/network/interface +# files, they will be used inside torouter to visualize +# and edit configuration +class interfaces: + def __init__(self,filename): + self.fp = open(filename, "r") + self.wifi = {} + self.eth1 = {} + self.eth0 = {} + + def parse_line(self, line, iface): + name = line.split(" ")[0] + values = " ".join(line.split(" ")[1:]).rstrip() + if iface == "uap0": + if self.wifi.has_key(name): + if type(self.wifi[name]) is list: + self.wifi[name].append(values) + else: + self.wifi[name] = [self.wifi[name],values] + else: + self.wifi.update({name : values}) + elif iface == "eth1": + if self.eth1.has_key(name): + if type(self.eth1[name]) is list: + self.eth1[name].append(values) + else: + self.eth1[name] = [self.eth1[name],values] + else: + self.eth1.update({name : values}) + elif iface == "eth0": + if self.eth0.has_key(name): + if type(self.eth0[name]) is list: + self.eth0[name].append(values) + else: + self.eth0[name] = [self.eth0[name],values] + else: + self.eth0.update({name : values}) + + def parse(self): + iface = None + for line in self.fp.readlines(): + line = line.lstrip() + if line.startswith("#") or line == "": + continue + if line.startswith("iface"): + iface = line.split(" ")[1] + if iface: + self.parse_line(line, iface) + + + def output(self, data): + print "iface %s" % data['iface'] + for item in data.items(): + if item[0] != "iface": + if type(item[1]) is list: + for i in item[1]: + print "%s %s" % (item[0], i) + else: + print "%s %s" % (item[0],item[1]) + +itfc = interfaces("/tmp/interfaces") +itfc.parse() +itfc.output(itfc.wifi) +itfc.output(itfc.eth1) +itfc.output(itfc.eth0) +

1 0

[torouter/master] Move the configuration read/write functions to separate class
by hellais＠torproject.org 12 Aug '11

12 Aug '11

commit 4f42f3bcd60505acfc712aae08c5726175978bb2 Author: Arturo Filastò <hellais(a)torproject.org> Date: Fri Aug 12 21:24:19 2011 +0200 Move the configuration read/write functions to separate class --- packages/torouter-web/tui/controllers/network.py | 36 +-------- packages/torouter-web/tui/utils/configuration.py | 85 ++++++++++++++++++++++ packages/torouter-web/tui/views/firewall.html | 8 ++- packages/torouter-web/tui/views/wired.html | 8 ++- 4 files changed, 103 insertions(+), 34 deletions(-) diff --git a/packages/torouter-web/tui/controllers/network.py b/packages/torouter-web/tui/controllers/network.py index 10b0c9d..4eb1991 100644 --- a/packages/torouter-web/tui/controllers/network.py +++ b/packages/torouter-web/tui/controllers/network.py @@ -1,7 +1,7 @@ import web import view, config from view import render -from tui.utils import session +from tui.utils import session,configuration """ This function is used to generate the network @@ -55,7 +55,7 @@ class firewall: def GET(self): if session.is_logged() > 0: - return render.base(render.main(),menu(0)) + return render.base(render.firewall(configuration.get_form("firewall")),menu(0)) else: return render.base(render.login()) @@ -72,41 +72,13 @@ class firewall: Wireless network configuration page """ class wireless: - def get_current_config(self): - conf = {'essid' : None, 'encryption' : None, 'key' : None} - - # XXX Dummy default config for testing purposes - # plugin here the actual code for config retreival - conf['essid'] = "Torouter" - conf['encryption'] = "WPA2" - conf['key'] = "ljdasjkbcuBH12389Ba" - - - return conf - - def build_form(self): - c = self.get_current_config() - ret_form = web.form.Form( - web.form.Textbox(name='essid', - description='Wireless ESSID', value=c['essid']), - web.form.Dropdown(name='enctype', args=['WPA2', 'WPA', 'WEP (not reccomended)', 'open'], - description='Wireless encryption scheme', value=c['encryption']), - web.form.Password(name='key', - description='key', value=c['key']), - web.form.Button('save') - ) - self.form = ret_form - - return True - # XXX do all the backend stuff def update_config(self, data): return True def GET(self): if session.is_logged() > 0: - if self.build_form(): - return render.base(render.wireless(self.form()),menu(2)) + return render.base(render.wireless(configuration.get_form("wireless")),menu(2)) else: return render.base(render.login()) @@ -128,7 +100,7 @@ class wired: def GET(self): if session.is_logged() > 0: - return render.base(render.wired(),menu(3)) + return render.base(render.wired(configuration.get_form("wired")),menu(3)) else: return render.base(render.login()) diff --git a/packages/torouter-web/tui/utils/configuration.py b/packages/torouter-web/tui/utils/configuration.py new file mode 100644 index 0000000..88bbc05 --- /dev/null +++ b/packages/torouter-web/tui/utils/configuration.py @@ -0,0 +1,85 @@ +import web +import config + +def get(name): + conf = {} + # XXX The content of these functions are just + # skeletons + if name == "wireless": + conf['essid'] = "Torouter" + conf['encryption'] = "WPA2" + conf['key'] = "ljdasjkbcuBH12389Ba" + return conf + elif name == "firewall": + conf['el1'] = "Element 1" + conf['el2'] = "Element 2" + conf['el3'] = "Element 3" + return conf + elif name == "wired": + conf['el1'] = "Element 1" + conf['el2'] = "Element 2" + conf['el3'] = "Element 3" + return conf + elif name == "tor": + conf['el1'] = "Element 1" + conf['el2'] = "Element 2" + conf['el3'] = "Element 3" + return conf + +def write(name, data): + if name == "wireless": + return True + elif name == "firewall": + return True + elif name == "wired": + return True + elif name == "tor": + return True + +def get_form(name): + # Also these are just skeletons + if name == "wireless": + c = get(name) + return web.form.Form( + web.form.Textbox(name='essid', + description='Wireless ESSID', value=c['essid']), + web.form.Dropdown(name='enctype', args=['WPA2', 'WPA', 'WEP (not reccomended)', 'open'], + description='Wireless encryption scheme', value=c['encryption']), + web.form.Password(name='key', + description='key', value=c['key']), + web.form.Button('save') + ) + elif name == "firewall": + c = get(name) + return web.form.Form( + web.form.Textbox(name='el1', + description='The first element', value=c['el2']), + web.form.Dropdown(name='el2', args=['WPA2', 'WPA', 'WEP (not reccomended)', 'open'], + description='The second selement', value=c['el2']), + web.form.Password(name='el3', + description='The third element', value=c['el3']), + web.form.Button('save') + ) + elif name == "wired": + c = get(name) + return web.form.Form( + web.form.Textbox(name='el1', + description='The first element', value=c['el2']), + web.form.Dropdown(name='el2', args=['WPA2', 'WPA', 'WEP (not reccomended)', 'open'], + description='The second selement', value=c['el2']), + web.form.Password(name='el3', + description='The third element', value=c['el3']), + web.form.Button('save') + ) + elif name == "tor": + c = get(name) + return web.form.Form( + web.form.Textbox(name='el1', + description='The first element', value=c['el2']), + web.form.Dropdown(name='el2', args=['WPA2', 'WPA', 'WEP (not reccomended)', 'open'], + description='The second selement', value=c['el2']), + web.form.Password(name='el3', + description='The third element', value=c['el3']), + web.form.Button('save') + ) + diff --git a/packages/torouter-web/tui/views/firewall.html b/packages/torouter-web/tui/views/firewall.html index c3a244d..30f5a9b 100644 --- a/packages/torouter-web/tui/views/firewall.html +++ b/packages/torouter-web/tui/views/firewall.html @@ -1 +1,7 @@ -the firewall page +$def with (form) + +<h2>Firewall configuration page</h2> + +<form action="" method="POST"> +$:form.render() +</form> diff --git a/packages/torouter-web/tui/views/wired.html b/packages/torouter-web/tui/views/wired.html index 3a517d1..3676f63 100644 --- a/packages/torouter-web/tui/views/wired.html +++ b/packages/torouter-web/tui/views/wired.html @@ -1 +1,7 @@ -the wired page +$def with (form) + +<h2>Wired configuration page</h2> + +<form action="" method="POST"> +$:form.render() +</form>

1 0