[tor-commits] [orbot/master] fixes for transproxy to fix DNS leaks in some cases

14 Apr 2014

commit c68ce2ce1e0030a0baa43e3a1ef0280ba3d13a61
Author: Nathan Freitas nathan@freitas.net
Date:   Tue Apr 15 00:22:52 2014 -0400
fixes for transproxy to fix DNS leaks in some cases
    latest RC was leaking DNS due to updates iptables/xtables binary
    and need for new iptables rules format
---
 .../torproject/android/service/TorTransProxy.java  |  170 +++++++++++---------
 1 file changed, 95 insertions(+), 75 deletions(-)

diff --git a/src/org/torproject/android/service/TorTransProxy.java b/src/org/torproject/android/service/TorTransProxy.java
index b813ac8..5a11ebf 100644
--- a/src/org/torproject/android/service/TorTransProxy.java
+++ b/src/org/torproject/android/service/TorTransProxy.java
@@ -303,12 +303,24 @@ public class TorTransProxy implements TorServiceConstants {
    			
    			logMessage("enabling transproxy for app: " + tApp.getUsername() + "(" + tApp.getUid() + ")");
    		 
+
+				// Allow loopback
+				script.append(ipTablesPath);
+				script.append(" -t filter");
+		        script.append(" -A ").append(srcChainName);
+				script.append(" -m owner --uid-owner ");
+				script.append(tApp.getUid());
+				script.append(" -o lo");
+				script.append(" -j ACCEPT");
+
+				executeCommand (shell, script.toString());
+				script = new StringBuilder();
+				
    			// Set up port redirection
    	    	script.append(ipTablesPath);
    	    	script.append(" -t nat");
    	    	script.append(" -A ").append(srcChainName);				
    			script.append(" -p tcp");
-				script.append(" ! -d 127.0.0.1"); //allow access to localhost
    			script.append(" -m owner --uid-owner ");
    			script.append(tApp.getUid());
    			script.append(" -m tcp --syn");
@@ -320,20 +332,23 @@ public class TorTransProxy implements TorServiceConstants {
    			
    			// Same for DNS
    			script.append(ipTablesPath);
-				script.append(" -t nat");				
-				script.append(" -A ").append(srcChainName);				
-				script.append(" -p udp -m owner --uid-owner ");
+				script.append(" -t nat");
+				script.append(" -A ").append(srcChainName);
+				script.append(" -p udp");
+				script.append(" ! -d 127.0.0.1"); //allow access to localhost
+				script.append(" -m owner ! --uid-owner ");
    			script.append(tApp.getUid());
    			script.append(" -m udp --dport "); 
    			script.append(STANDARD_DNS_PORT);
    			script.append(" -j REDIRECT --to-ports ");
    			script.append(TOR_DNS_PORT);
+
    			executeCommand (shell, script.toString());
    			script = new StringBuilder();
    			
    			
-				int[] ports = {TOR_DNS_PORT,TOR_TRANSPROXY_PORT,PORT_SOCKS,PORT_HTTP};
+				int[] ports = {TOR_TRANSPROXY_PORT,PORT_SOCKS,PORT_HTTP};
    			
    			for (int port : ports)
    			{
@@ -341,57 +356,38 @@ public class TorTransProxy implements TorServiceConstants {
    				script.append(ipTablesPath);
    				script.append(" -t filter");
    		        script.append(" -A ").append(srcChainName);
+					script.append(" -p tcp");
    				script.append(" -m owner --uid-owner ");
    				script.append(tApp.getUid());
-					script.append(" -p tcp");
-					script.append(" -d 127.0.0.1");
    				script.append(" --dport ");
    				script.append(port);	
    				script.append(" -j ACCEPT");
    				
    				executeCommand (shell, script.toString());
    				script = new StringBuilder();
-					
-		
    			}
    			
-				// Allow loopback
+				// Allow packets to localhost (contains all the port-redirected ones)
    			script.append(ipTablesPath);
    			script.append(" -t filter");
    	        script.append(" -A ").append(srcChainName);
+				script.append(" -p udp");
    			script.append(" -m owner --uid-owner ");
    			script.append(tApp.getUid());
-				script.append(" -p tcp");
-				script.append(" -o lo");
+				script.append(" --dport ");
+				script.append(TOR_DNS_PORT);	
    			script.append(" -j ACCEPT");
-
-				executeCommand (shell, script.toString());
-				script = new StringBuilder();
    			
-
-				// Reject all other outbound TCP packets
-				script.append(ipTablesPath);
-				script.append(" -t filter");
-		        script.append(" -A ").append(srcChainName);
-				script.append(" -m owner --uid-owner ");
-				script.append(tApp.getUid());
-				script.append(" -p tcp");
-				script.append(" ! -d 127.0.0.1"); //allow access to localhost
-				script.append(" -j REJECT");
-
    			executeCommand (shell, script.toString());
    			script = new StringBuilder();
    			
-				
-				// Reject all other outbound UDP packets
+				// Reject all other outbound packets
    			script.append(ipTablesPath);
    			script.append(" -t filter");
    	        script.append(" -A ").append(srcChainName);
    			script.append(" -m owner --uid-owner ");
-				script.append(tApp.getUid());
-				script.append(" -p udp");
-				script.append(" ! -d 127.0.0.1"); //allow access to localhost
-				script.append(" -j REJECT");
+				script.append(tApp.getUid());				
+				script.append(" -j DROP");
lastExit = executeCommand (shell, script.toString());
    			script = new StringBuilder();
@@ -400,8 +396,6 @@ public class TorTransProxy implements TorServiceConstants {
    		}		
    	}		
    	
-		fixTransproxyLeak (context);
-		
    	shell.close();
    	
    	return lastExit;
@@ -546,8 +540,9 @@ public class TorTransProxy implements TorServiceConstants {
     	StringBuilder script = new StringBuilder();
     	
    	// Allow everything for Tor
+    	
    	script.append(ipTablesPath);			
-		script.append(" -t filter");
+		script.append(" -t nat");
    	script.append(" -A ").append(srcChainName);
    	script.append(" -m owner --uid-owner ");
    	script.append(torUid);
@@ -555,7 +550,17 @@ public class TorTransProxy implements TorServiceConstants {
    	
    	executeCommand (shell, script.toString());
    	script = new StringBuilder();
+
+		// Allow loopback
    	
+		script.append(ipTablesPath);
+		script.append(" -t nat");
+		script.append(" -A ").append(srcChainName);
+		script.append(" -o lo");
+		script.append(" -j ACCEPT");
+
+		executeCommand (shell, script.toString());
+		script = new StringBuilder();
    	
     	// Set up port redirection    	
    	script.append(ipTablesPath);		
@@ -589,38 +594,6 @@ public class TorTransProxy implements TorServiceConstants {
    	script = new StringBuilder();
    	
    	
-		/**
-		int[] ports = {TOR_DNS_PORT,TOR_TRANSPROXY_PORT,PORT_SOCKS,PORT_HTTP};
-		
-		for (int port : ports)
-		{
-			// Allow packets to localhost (contains all the port-redirected ones)
-			script.append(ipTablesPath);			
-			script.append(" -t filter");
-			script.append(" -A ").append(srcChainName);
-			script.append(" -m owner ! --uid-owner ");
-			script.append(torUid);
-			script.append(" -p tcp");
-			script.append(" -d 127.0.0.1");
-			script.append(" --dport ");
-			script.append(port);	
-			script.append(" -j ACCEPT");
-			script.append(" || exit\n");
-		
-		}**/
-		
-		// Allow loopback
-		script.append(ipTablesPath);
-		script.append(" -t filter");
-		script.append(" -A ").append(srcChainName);
-		script.append(" -p tcp");
-		script.append(" -o lo");
-		script.append(" -j ACCEPT");
-
-		executeCommand (shell, script.toString());
-		script = new StringBuilder();
-		
-		
    	if (TorService.ENABLE_DEBUG_LOG)
    	{
    		//XXX: Comment the following rules for non-debug builds
@@ -650,32 +623,79 @@ public class TorTransProxy implements TorServiceConstants {
    		
    	}
-		// Reject all other outbound TCP packets
+		//allow access to transproxy port
    	script.append(ipTablesPath);
    	script.append(" -t filter");
    	script.append(" -A ").append(srcChainName);
-		script.append(" -m owner ! --uid-owner ");
-		script.append(torUid);
    	script.append(" -p tcp");
-		script.append(" ! -d 127.0.0.1"); //allow access to localhost
-		script.append(" -j REJECT");
+		script.append(" -m tcp");
+		script.append(" --dport ").append(TOR_TRANSPROXY_PORT);
+		script.append(" -j ACCEPT");
+
+		executeCommand (shell, script.toString());
+		script = new StringBuilder();
+		
+		//allow access to local SOCKS port
+		script.append(ipTablesPath);
+		script.append(" -t filter");
+		script.append(" -A ").append(srcChainName);
+		script.append(" -p tcp");
+		script.append(" -m tcp");
+		script.append(" --dport ").append(PORT_SOCKS);
+		script.append(" -j ACCEPT");
+
+		executeCommand (shell, script.toString());
+		script = new StringBuilder();
+		
+		//allow access to local SOCKS port
+		script.append(ipTablesPath);
+		script.append(" -t filter");
+		script.append(" -A ").append(srcChainName);
+		script.append(" -p tcp");
+		script.append(" -m tcp");
+		script.append(" --dport ").append(PORT_HTTP);
+		script.append(" -j ACCEPT");
+
+		executeCommand (shell, script.toString());
+		script = new StringBuilder();
+		
+		//allow access to local DNS port
+		script.append(ipTablesPath);
+		script.append(" -t filter");
+		script.append(" -A ").append(srcChainName);
+		script.append(" -p udp");
+		script.append(" -m udp");
+		script.append(" --dport ").append(TOR_DNS_PORT);
+		script.append(" -j ACCEPT");
executeCommand (shell, script.toString());
    	script = new StringBuilder();
    	
+		//allow access to local DNS port
+		script.append(ipTablesPath);
+		script.append(" -t filter");
+		script.append(" -A ").append(srcChainName);
+		script.append(" -p udp");
+		script.append(" -m udp");
+		script.append(" --dport ").append(TOR_DNS_PORT);
+		script.append(" -j ACCEPT");
+
+		executeCommand (shell, script.toString());
+		script = new StringBuilder();
+		
+		
    	// Reject all other outbound UDP packets
    	script.append(ipTablesPath);
    	script.append(" -t filter");
    	script.append(" -A ").append(srcChainName);
    	script.append(" -m owner ! --uid-owner ");
    	script.append(torUid);
-		script.append(" -p udp");
-		script.append(" ! -d 127.0.0.1"); //allow access to localhost
-		script.append(" -j REJECT");
+		script.append(" -j DROP");
int lastExit = executeCommand (shell, script.toString());
    	
    	fixTransproxyLeak (context);
+		
    	shell.close();
    	
     	return lastExit;

    

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

[tor-commits] [orbot/master] fixes for transproxy to fix DNS leaks in some cases