[tor-commits] [tor/master] Remove tor-fw-helper code
nickm at torproject.org
nickm at torproject.org
Tue Aug 4 18:01:02 UTC 2015
commit d2cb92332009567ae778b3570e8fd3420c207446
Author: Nick Mathewson <nickm at torproject.org>
Date: Tue Jul 14 14:48:22 2015 -0400
Remove tor-fw-helper code
It did a good idea, but the code-quality of libupnpc and libnatpnp
is so dodgy that I'm not really comfortable including them alongside
Tor proper. Instead, we'll recommend that people do the pure-go
reimplementation instead. Closes ticket 13338.
---
changes/ticket13338 | 6 +
configure.ac | 77 ----
src/tools/include.am | 4 +-
src/tools/tor-fw-helper/README | 10 +
src/tools/tor-fw-helper/include.am | 36 --
src/tools/tor-fw-helper/tor-fw-helper-natpmp.c | 240 ------------
src/tools/tor-fw-helper/tor-fw-helper-natpmp.h | 47 ---
src/tools/tor-fw-helper/tor-fw-helper-upnp.c | 193 ---------
src/tools/tor-fw-helper/tor-fw-helper-upnp.h | 44 ---
src/tools/tor-fw-helper/tor-fw-helper.c | 501 ------------------------
src/tools/tor-fw-helper/tor-fw-helper.h | 59 ---
11 files changed, 17 insertions(+), 1200 deletions(-)
diff --git a/changes/ticket13338 b/changes/ticket13338
new file mode 100644
index 0000000..a1d242f
--- /dev/null
+++ b/changes/ticket13338
@@ -0,0 +1,6 @@
+ o Removed code:
+ - The internal pure-C tor-fw-helper tool is now removed from the
+ Tor distribution, in favor of the pure-Go clone available from
+ https://github.com/Yawning/tor-fw-helper . The libraries used
+ by the C tor-fw-helper are not, in our opinion, very confidence-
+ inspiring in their secure-proggramming techniques. Closes ticket 13338.
diff --git a/configure.ac b/configure.ac
index 214b7e6..029dbbc 100644
--- a/configure.ac
+++ b/configure.ac
@@ -81,24 +81,6 @@ AC_ARG_ENABLE(asciidoc,
*) AC_MSG_ERROR(bad value for --disable-asciidoc) ;;
esac], [asciidoc=true])
-# By default, we're not ready to ship a NAT-PMP aware Tor
-AC_ARG_ENABLE(nat-pmp,
- AS_HELP_STRING(--enable-nat-pmp, [enable NAT-PMP support]),
- [case "${enableval}" in
- yes) natpmp=true ;;
- no) natpmp=false ;;
- * ) AC_MSG_ERROR(bad value for --enable-nat-pmp) ;;
- esac], [natpmp=false])
-
-# By default, we're not ready to ship a UPnP aware Tor
-AC_ARG_ENABLE(upnp,
- AS_HELP_STRING(--enable-upnp, [enable UPnP support]),
- [case "${enableval}" in
- yes) upnp=true ;;
- no) upnp=false ;;
- * ) AC_MSG_ERROR(bad value for --enable-upnp) ;;
- esac], [upnp=false])
-
# systemd notify support
AC_ARG_ENABLE(systemd,
AS_HELP_STRING(--enable-systemd, [enable systemd notification support]),
@@ -768,65 +750,6 @@ dnl we should try to add -fasynchronous-unwind-tables so that our backtrace
dnl code will work.
TOR_CHECK_CFLAGS(-fasynchronous-unwind-tables)
-dnl ------------------------------------------------------
-dnl Where do you live, libnatpmp? And how do we call you?
-dnl There are no packages for Debian or Redhat as of this patch
-
-if test "$natpmp" = "true"; then
- AC_DEFINE(NAT_PMP, 1, [Define to 1 if we are building with nat-pmp.])
- TOR_SEARCH_LIBRARY(libnatpmp, $trylibnatpmpdir, [-lnatpmp $TOR_LIB_WS32 $TOR_LIB_IPHLPAPI],
- [#include <natpmp.h>],
- [#ifdef _WIN32
- #define STATICLIB
- #endif
- #include <natpmp.h>],
- [ int r;
- natpmp_t natpmp;
- natpmpresp_t response;
- r = initnatpmp(&natpmp, 0, 0);],
- [printf("initnatpmp() returned %d (%s)\n", r, r?"FAILED":"SUCCESS");
- exit(0);],
- [--with-libnatpmp-dir],
- [/usr/lib/])
-fi
-
-
-dnl ------------------------------------------------------
-dnl Where do you live, libminiupnpc? And how do we call you?
-dnl There are no packages for Debian or Redhat as of this patch
-
-if test "$upnp" = "true"; then
- AC_DEFINE(MINIUPNPC, 1, [Define to 1 if we are building with UPnP.])
-
- dnl Before we call TOR_SEARCH_LIBRARY we'll do a quick compile test
- dnl to see if we have miniupnpc-1.5 or -1.6
- AC_COMPILE_IFELSE([AC_LANG_PROGRAM([#include <miniupnpc/miniupnpc.h>],
- [upnpDiscover(1, 0, 0, 0);exit(0);])],[miniupnpc15="true"],[miniupnpc15="false"])
-
- if test "$miniupnpc15" = "true" ; then
- AC_DEFINE([MINIUPNPC15],[1],[libminiupnpc version 1.5 found])
- TOR_SEARCH_LIBRARY(libminiupnpc, $trylibminiupnpcdir, [-lminiupnpc $TOR_LIB_WS32 $TOR_LIB_IPHLPAPI],
- [#include <miniupnpc/miniwget.h>
- #include <miniupnpc/miniupnpc.h>
- #include <miniupnpc/upnpcommands.h>],
- [void upnpDiscover(int delay, const char * multicastif,
- const char * minissdpdsock, int sameport);],
- [upnpDiscover(1, 0, 0, 0); exit(0);],
- [--with-libminiupnpc-dir],
- [/usr/lib/])
- else
- TOR_SEARCH_LIBRARY(libminiupnpc, $trylibminiupnpcdir, [-lminiupnpc $TOR_LIB_WS32 $TOR_LIB_IPHLPAPI],
- [#include <miniupnpc/miniwget.h>
- #include <miniupnpc/miniupnpc.h>
- #include <miniupnpc/upnpcommands.h>],
- [void upnpDiscover(int delay, const char * multicastif,
- const char * minissdpdsock, int sameport, int ipv6, int * error);],
- [upnpDiscover(1, 0, 0, 0, 0, 0); exit(0);],
- [--with-libminiupnpc-dir],
- [/usr/lib/])
- fi
-fi
-
dnl ============================================================
dnl Check for libseccomp
diff --git a/src/tools/include.am b/src/tools/include.am
index 5d778c1..ebdd349 100644
--- a/src/tools/include.am
+++ b/src/tools/include.am
@@ -43,6 +43,4 @@ src_tools_tor_checkkey_LDADD = src/common/libor.a src/common/libor-crypto.a \
@TOR_LIB_MATH@ @TOR_ZLIB_LIBS@ @TOR_OPENSSL_LIBS@ \
@TOR_LIB_WS32@ @TOR_LIB_GDI@ @CURVE25519_LIBS@
-include src/tools/tor-fw-helper/include.am
-
-
+EXTRA_DIST += src/tools/tor-fw-helper/README
diff --git a/src/tools/tor-fw-helper/README b/src/tools/tor-fw-helper/README
new file mode 100644
index 0000000..3868cc2
--- /dev/null
+++ b/src/tools/tor-fw-helper/README
@@ -0,0 +1,10 @@
+
+We no longer recommend the use of this tool. Instead, please use the
+pure-Go version of tor-fw-helper available at
+ https://github.com/Yawning/tor-fw-helper
+
+Why?
+
+The C code here was fine, but frankly: we don't trust the underlying
+libraries. They don't seem to have been written with network security
+in mind, and we have very little faith in their safety.
diff --git a/src/tools/tor-fw-helper/include.am b/src/tools/tor-fw-helper/include.am
deleted file mode 100644
index 1f862e6..0000000
--- a/src/tools/tor-fw-helper/include.am
+++ /dev/null
@@ -1,36 +0,0 @@
-if USE_FW_HELPER
-bin_PROGRAMS+= src/tools/tor-fw-helper/tor-fw-helper
-endif
-
-src_tools_tor_fw_helper_tor_fw_helper_SOURCES = \
- src/tools/tor-fw-helper/tor-fw-helper.c \
- src/tools/tor-fw-helper/tor-fw-helper-natpmp.c \
- src/tools/tor-fw-helper/tor-fw-helper-upnp.c
-noinst_HEADERS+= \
- src/tools/tor-fw-helper/tor-fw-helper.h \
- src/tools/tor-fw-helper/tor-fw-helper-natpmp.h \
- src/tools/tor-fw-helper/tor-fw-helper-upnp.h
-
-if NAT_PMP
-nat_pmp_ldflags = @TOR_LDFLAGS_libnatpmp@
-nat_pmp_ldadd = -lnatpmp @TOR_LIB_IPHLPAPI@
-nat_pmp_cppflags = @TOR_CPPFLAGS_libnatpmp@
-else
-nat_pmp_ldflags =
-nat_pmp_ldadd =
-nat_pmp_cppflags =
-endif
-
-if MINIUPNPC
-miniupnpc_ldflags = @TOR_LDFLAGS_libminiupnpc@
-miniupnpc_ldadd = -lminiupnpc @TOR_LIB_IPHLPAPI@
-miniupnpc_cppflags = @TOR_CPPFLAGS_libminiupnpc@
-else
-miniupnpc_ldflags =
-miniupnpc_ldadd =
-miniupnpc_cppflags =
-endif
-
-src_tools_tor_fw_helper_tor_fw_helper_LDFLAGS = $(nat_pmp_ldflags) $(miniupnpc_ldflags)
-src_tools_tor_fw_helper_tor_fw_helper_LDADD = src/common/libor.a $(nat_pmp_ldadd) $(miniupnpc_ldadd) -lm @TOR_LIB_WS32@
-src_tools_tor_fw_helper_tor_fw_helper_CPPFLAGS = $(nat_pmp_cppflags) $(miniupnpc_cppflags) -I"$(top_srcdir)/src/ext"
diff --git a/src/tools/tor-fw-helper/tor-fw-helper-natpmp.c b/src/tools/tor-fw-helper/tor-fw-helper-natpmp.c
deleted file mode 100644
index 6369966..0000000
--- a/src/tools/tor-fw-helper/tor-fw-helper-natpmp.c
+++ /dev/null
@@ -1,240 +0,0 @@
-/* Copyright (c) 2010, Jacob Appelbaum, Steven J. Murdoch.
- * Copyright (c) 2010-2015, The Tor Project, Inc. */
-/* See LICENSE for licensing information */
-
-/**
- * \file tor-fw-helper-natpmp.c
- * \brief The implementation of our NAT-PMP firewall helper.
- **/
-
-#include "orconfig.h"
-#ifdef NAT_PMP
-#ifdef _WIN32
-#define STATICLIB
-#endif
-#include <stdint.h>
-#include <stdio.h>
-#include <string.h>
-#include <errno.h>
-#ifndef _WIN32
-#include <arpa/inet.h>
-#endif
-
-// debugging stuff
-#include <assert.h>
-
-#include "compat.h"
-
-#include "tor-fw-helper.h"
-#include "tor-fw-helper-natpmp.h"
-
-/** This hooks NAT-PMP into our multi-backend API. */
-static tor_fw_backend_t tor_natpmp_backend = {
- "natpmp",
- sizeof(struct natpmp_state_t),
- tor_natpmp_init,
- tor_natpmp_cleanup,
- tor_natpmp_fetch_public_ip,
- tor_natpmp_add_tcp_mapping
-};
-
-/** Return the backend for NAT-PMP. */
-const tor_fw_backend_t *
-tor_fw_get_natpmp_backend(void)
-{
- return &tor_natpmp_backend;
-}
-
-/** Initialize the NAT-PMP backend and store the results in
- * <b>backend_state</b>.*/
-int
-tor_natpmp_init(tor_fw_options_t *tor_fw_options, void *backend_state)
-{
- natpmp_state_t *state = (natpmp_state_t *) backend_state;
- int r = 0;
-
- memset(&(state->natpmp), 0, sizeof(natpmp_t));
- memset(&(state->response), 0, sizeof(natpmpresp_t));
- state->init = 0;
- state->protocol = NATPMP_PROTOCOL_TCP;
- state->lease = NATPMP_DEFAULT_LEASE;
-
- if (tor_fw_options->verbose)
- fprintf(stderr, "V: natpmp init...\n");
-
- r = initnatpmp(&(state->natpmp), 0, 0);
- if (r == 0) {
- state->init = 1;
- fprintf(stderr, "V: natpmp initialized...\n");
- return r;
- } else {
- fprintf(stderr, "V: natpmp failed to initialize...\n");
- return r;
- }
-}
-
-/** Tear down the NAT-PMP connection stored in <b>backend_state</b>.*/
-int
-tor_natpmp_cleanup(tor_fw_options_t *tor_fw_options, void *backend_state)
-{
- natpmp_state_t *state = (natpmp_state_t *) backend_state;
- int r = 0;
- if (tor_fw_options->verbose)
- fprintf(stderr, "V: natpmp cleanup...\n");
- r = closenatpmp(&(state->natpmp));
- if (tor_fw_options->verbose)
- fprintf(stderr, "V: closing natpmp socket: %d\n", r);
- return r;
-}
-
-/** Use select() to wait until we can read on fd. */
-static int
-wait_until_fd_readable(tor_socket_t fd, struct timeval *timeout)
-{
- int r;
- fd_set fds;
-
-#ifndef WIN32
- if (fd >= FD_SETSIZE) {
- fprintf(stderr, "E: NAT-PMP FD_SETSIZE error %d\n", fd);
- return -1;
- }
-#endif
-
- FD_ZERO(&fds);
- FD_SET(fd, &fds);
- r = select(fd+1, &fds, NULL, NULL, timeout);
- if (r == -1) {
- fprintf(stderr, "V: select failed in wait_until_fd_readable: %s\n",
- tor_socket_strerror(tor_socket_errno(fd)));
- return -1;
- }
- /* XXXX we should really check to see whether fd was readable, or we timed
- out. */
- return 0;
-}
-
-int
-tor_natpmp_add_tcp_mapping(uint16_t internal_port, uint16_t external_port,
- int is_verbose, void *backend_state)
-{
- int r = 0;
- int x = 0;
- int sav_errno;
- natpmp_state_t *state = (natpmp_state_t *) backend_state;
-
- struct timeval timeout;
-
- if (is_verbose)
- fprintf(stderr, "V: sending natpmp portmapping request...\n");
- r = sendnewportmappingrequest(&(state->natpmp), state->protocol,
- internal_port,
- external_port,
- state->lease);
- if (is_verbose)
- fprintf(stderr, "tor-fw-helper: NAT-PMP sendnewportmappingrequest "
- "returned %d (%s)\n", r, r==12?"SUCCESS":"FAILED");
-
- do {
- getnatpmprequesttimeout(&(state->natpmp), &timeout);
- x = wait_until_fd_readable(state->natpmp.s, &timeout);
- if (x == -1)
- return -1;
-
- if (is_verbose)
- fprintf(stderr, "V: attempting to readnatpmpreponseorretry...\n");
- r = readnatpmpresponseorretry(&(state->natpmp), &(state->response));
- sav_errno = tor_socket_errno(state->natpmp.s);
-
- if (r<0 && r!=NATPMP_TRYAGAIN) {
- fprintf(stderr, "E: readnatpmpresponseorretry failed %d\n", r);
- fprintf(stderr, "E: errno=%d '%s'\n", sav_errno,
- tor_socket_strerror(sav_errno));
- }
-
- } while (r == NATPMP_TRYAGAIN);
-
- if (r != 0) {
- /* XXX TODO: NATPMP_* should be formatted into useful error strings */
- fprintf(stderr, "E: NAT-PMP It appears that something went wrong:"
- " %d\n", r);
- if (r == -51)
- fprintf(stderr, "E: NAT-PMP It appears that the request was "
- "unauthorized\n");
- return r;
- }
-
- if (r == NATPMP_SUCCESS) {
- fprintf(stderr, "tor-fw-helper: NAT-PMP mapped public port %hu to"
- " localport %hu liftime %u\n",
- (state->response).pnu.newportmapping.mappedpublicport,
- (state->response).pnu.newportmapping.privateport,
- (state->response).pnu.newportmapping.lifetime);
- }
-
- return (r == NATPMP_SUCCESS) ? 0 : -1;
-}
-
-/** Fetch our likely public IP from our upstream NAT-PMP enabled NAT device.
- * Use the connection context stored in <b>backend_state</b>. */
-int
-tor_natpmp_fetch_public_ip(tor_fw_options_t *tor_fw_options,
- void *backend_state)
-{
- int r = 0;
- int x = 0;
- int sav_errno;
- natpmp_state_t *state = (natpmp_state_t *) backend_state;
-
- struct timeval timeout;
-
- r = sendpublicaddressrequest(&(state->natpmp));
- fprintf(stderr, "tor-fw-helper: NAT-PMP sendpublicaddressrequest returned"
- " %d (%s)\n", r, r==2?"SUCCESS":"FAILED");
-
- do {
- getnatpmprequesttimeout(&(state->natpmp), &timeout);
-
- x = wait_until_fd_readable(state->natpmp.s, &timeout);
- if (x == -1)
- return -1;
-
- if (tor_fw_options->verbose)
- fprintf(stderr, "V: NAT-PMP attempting to read reponse...\n");
- r = readnatpmpresponseorretry(&(state->natpmp), &(state->response));
- sav_errno = tor_socket_errno(state->natpmp.s);
-
- if (tor_fw_options->verbose)
- fprintf(stderr, "V: NAT-PMP readnatpmpresponseorretry returned"
- " %d\n", r);
-
- if ( r < 0 && r != NATPMP_TRYAGAIN) {
- fprintf(stderr, "E: NAT-PMP readnatpmpresponseorretry failed %d\n",
- r);
- fprintf(stderr, "E: NAT-PMP errno=%d '%s'\n", sav_errno,
- tor_socket_strerror(sav_errno));
- }
-
- } while (r == NATPMP_TRYAGAIN );
-
- if (r != 0) {
- fprintf(stderr, "E: NAT-PMP It appears that something went wrong:"
- " %d\n", r);
- return r;
- }
-
- fprintf(stderr, "tor-fw-helper: ExternalIPAddress = %s\n",
- inet_ntoa((state->response).pnu.publicaddress.addr));
- tor_fw_options->public_ip_status = 1;
-
- if (tor_fw_options->verbose) {
- fprintf(stderr, "V: result = %u\n", r);
- fprintf(stderr, "V: type = %u\n", (state->response).type);
- fprintf(stderr, "V: resultcode = %u\n", (state->response).resultcode);
- fprintf(stderr, "V: epoch = %u\n", (state->response).epoch);
- }
-
- return r;
-}
-#endif
-
diff --git a/src/tools/tor-fw-helper/tor-fw-helper-natpmp.h b/src/tools/tor-fw-helper/tor-fw-helper-natpmp.h
deleted file mode 100644
index abc5e11..0000000
--- a/src/tools/tor-fw-helper/tor-fw-helper-natpmp.h
+++ /dev/null
@@ -1,47 +0,0 @@
-/* Copyright (c) 2010, Jacob Appelbaum, Steven J. Murdoch.
- * Copyright (c) 2010-2015, The Tor Project, Inc. */
-/* See LICENSE for licensing information */
-
-/**
- * \file tor-fw-helper-natpmp.h
- **/
-
-#ifdef NAT_PMP
-#ifndef TOR_TOR_FW_HELPER_NATPMP_H
-#define TOR_TOR_FW_HELPER_NATPMP_H
-
-#include <natpmp.h>
-
-/** This is the default NAT-PMP lease time in seconds. */
-#define NATPMP_DEFAULT_LEASE 3600
-/** NAT-PMP has many codes for success; this is one of them. */
-#define NATPMP_SUCCESS 0
-
-/** This is our NAT-PMP meta structure - it holds our request data, responses,
- * various NAT-PMP parameters, and of course the status of the motion in the
- * NAT-PMP ocean. */
-typedef struct natpmp_state_t {
- natpmp_t natpmp;
- natpmpresp_t response;
- int fetch_public_ip;
- int status;
- int init; /**< Have we been initialized? */
- int protocol; /**< This will only be TCP. */
- int lease;
-} natpmp_state_t;
-
-const tor_fw_backend_t *tor_fw_get_natpmp_backend(void);
-
-int tor_natpmp_init(tor_fw_options_t *tor_fw_options, void *backend_state);
-
-int tor_natpmp_cleanup(tor_fw_options_t *tor_fw_options, void *backend_state);
-
-int tor_natpmp_add_tcp_mapping(uint16_t internal_port, uint16_t external_port,
- int is_verbose, void *backend_state);
-
-int tor_natpmp_fetch_public_ip(tor_fw_options_t *tor_fw_options,
- void *backend_state);
-
-#endif
-#endif
-
diff --git a/src/tools/tor-fw-helper/tor-fw-helper-upnp.c b/src/tools/tor-fw-helper/tor-fw-helper-upnp.c
deleted file mode 100644
index e5495c9..0000000
--- a/src/tools/tor-fw-helper/tor-fw-helper-upnp.c
+++ /dev/null
@@ -1,193 +0,0 @@
-/* Copyright (c) 2010, Jacob Appelbaum, Steven J. Murdoch.
- * Copyright (c) 2010-2015, The Tor Project, Inc. */
-/* See LICENSE for licensing information */
-
-/**
- * \file tor-fw-helper-upnp.c
- * \brief The implementation of our UPnP firewall helper.
- **/
-
-#include "orconfig.h"
-#ifdef MINIUPNPC
-#ifdef _WIN32
-#define STATICLIB
-#endif
-#include <stdint.h>
-#include <string.h>
-#include <stdio.h>
-
-#include <assert.h>
-
-#include "compat.h"
-#include "tor-fw-helper.h"
-#include "tor-fw-helper-upnp.h"
-
-/** UPnP timeout value. */
-#define UPNP_DISCOVER_TIMEOUT 2000
-/** Description of the port mapping in the UPnP table. */
-#define UPNP_DESC "Tor relay"
-
-/* XXX TODO: We should print these as a useful user string when we return the
- * number to a user */
-/** Magic numbers as miniupnpc return codes. */
-#define UPNP_ERR_SUCCESS 0
-#define UPNP_ERR_NODEVICESFOUND 1
-#define UPNP_ERR_NOIGDFOUND 2
-#define UPNP_ERR_ADDPORTMAPPING 3
-#define UPNP_ERR_GETPORTMAPPING 4
-#define UPNP_ERR_DELPORTMAPPING 5
-#define UPNP_ERR_GETEXTERNALIP 6
-#define UPNP_ERR_INVAL 7
-#define UPNP_ERR_OTHER 8
-#define UPNP_SUCCESS 1
-
-/** This hooks miniupnpc into our multi-backend API. */
-static tor_fw_backend_t tor_miniupnp_backend = {
- "miniupnp",
- sizeof(struct miniupnpc_state_t),
- tor_upnp_init,
- tor_upnp_cleanup,
- tor_upnp_fetch_public_ip,
- tor_upnp_add_tcp_mapping
-};
-
-/** Return the backend for miniupnp. */
-const tor_fw_backend_t *
-tor_fw_get_miniupnp_backend(void)
-{
- return &tor_miniupnp_backend;
-}
-
-/** Initialize the UPnP backend and store the results in
- * <b>backend_state</b>.*/
-int
-tor_upnp_init(tor_fw_options_t *options, void *backend_state)
-{
- /*
- This leaks the user agent from the client to the router - perhaps we don't
- want to do that? eg:
-
- User-Agent: Ubuntu/10.04, UPnP/1.0, MiniUPnPc/1.4
-
- */
- miniupnpc_state_t *state = (miniupnpc_state_t *) backend_state;
- struct UPNPDev *devlist;
- int r;
-
- memset(&(state->urls), 0, sizeof(struct UPNPUrls));
- memset(&(state->data), 0, sizeof(struct IGDdatas));
- state->init = 0;
-
-#ifdef MINIUPNPC15
- devlist = upnpDiscover(UPNP_DISCOVER_TIMEOUT, NULL, NULL, 0);
-#else
- devlist = upnpDiscover(UPNP_DISCOVER_TIMEOUT, NULL, NULL, 0, 0, NULL);
-#endif
- if (NULL == devlist) {
- fprintf(stderr, "E: upnpDiscover returned: NULL\n");
- return UPNP_ERR_NODEVICESFOUND;
- }
-
- assert(options);
- r = UPNP_GetValidIGD(devlist, &(state->urls), &(state->data),
- state->lanaddr, UPNP_LANADDR_SZ);
- fprintf(stderr, "tor-fw-helper: UPnP GetValidIGD returned: %d (%s)\n", r,
- r==UPNP_SUCCESS?"SUCCESS":"FAILED");
-
- freeUPNPDevlist(devlist);
-
- if (r != 1 && r != 2)
- return UPNP_ERR_NOIGDFOUND;
-
- state->init = 1;
- return UPNP_ERR_SUCCESS;
-}
-
-/** Tear down the UPnP connection stored in <b>backend_state</b>.*/
-int
-tor_upnp_cleanup(tor_fw_options_t *options, void *backend_state)
-{
-
- miniupnpc_state_t *state = (miniupnpc_state_t *) backend_state;
- assert(options);
-
- if (state->init)
- FreeUPNPUrls(&(state->urls));
- state->init = 0;
-
- return UPNP_ERR_SUCCESS;
-}
-
-/** Fetch our likely public IP from our upstream UPnP IGD enabled NAT device.
- * Use the connection context stored in <b>backend_state</b>. */
-int
-tor_upnp_fetch_public_ip(tor_fw_options_t *options, void *backend_state)
-{
- miniupnpc_state_t *state = (miniupnpc_state_t *) backend_state;
- int r;
- char externalIPAddress[16];
-
- if (!state->init) {
- r = tor_upnp_init(options, state);
- if (r != UPNP_ERR_SUCCESS)
- return r;
- }
-
- r = UPNP_GetExternalIPAddress(state->urls.controlURL,
- state->data.first.servicetype,
- externalIPAddress);
-
- if (r != UPNPCOMMAND_SUCCESS)
- goto err;
-
- if (externalIPAddress[0]) {
- fprintf(stderr, "tor-fw-helper: ExternalIPAddress = %s\n",
- externalIPAddress); tor_upnp_cleanup(options, state);
- options->public_ip_status = 1;
- return UPNP_ERR_SUCCESS;
- } else {
- goto err;
- }
-
- err:
- tor_upnp_cleanup(options, state);
- return UPNP_ERR_GETEXTERNALIP;
-}
-
-int
-tor_upnp_add_tcp_mapping(uint16_t internal_port, uint16_t external_port,
- int is_verbose, void *backend_state)
-{
- int retval;
- char internal_port_str[6];
- char external_port_str[6];
- miniupnpc_state_t *state = (miniupnpc_state_t *) backend_state;
-
- if (!state->init) {
- fprintf(stderr, "E: %s but state is not initialized.\n", __func__);
- return -1;
- }
-
- if (is_verbose)
- fprintf(stderr, "V: UPnP: internal port: %u, external port: %u\n",
- internal_port, external_port);
-
- tor_snprintf(internal_port_str, sizeof(internal_port_str),
- "%u", internal_port);
- tor_snprintf(external_port_str, sizeof(external_port_str),
- "%u", external_port);
-
- retval = UPNP_AddPortMapping(state->urls.controlURL,
- state->data.first.servicetype,
- external_port_str, internal_port_str,
-#ifdef MINIUPNPC15
- state->lanaddr, UPNP_DESC, "TCP", 0);
-#else
- state->lanaddr, UPNP_DESC, "TCP", 0, 0);
-#endif
-
- return (retval == UPNP_ERR_SUCCESS) ? 0 : -1;
-}
-
-#endif
-
diff --git a/src/tools/tor-fw-helper/tor-fw-helper-upnp.h b/src/tools/tor-fw-helper/tor-fw-helper-upnp.h
deleted file mode 100644
index bc9476e..0000000
--- a/src/tools/tor-fw-helper/tor-fw-helper-upnp.h
+++ /dev/null
@@ -1,44 +0,0 @@
-/* Copyright (c) 2010, Jacob Appelbaum, Steven J. Murdoch.
- * Copyright (c) 2010-2015, The Tor Project, Inc. */
-/* See LICENSE for licensing information */
-
-/**
- * \file tor-fw-helper-upnp.h
- * \brief The main header for our firewall helper.
- **/
-
-#ifdef MINIUPNPC
-#ifndef TOR_TOR_FW_HELPER_UPNP_H
-#define TOR_TOR_FW_HELPER_UPNP_H
-
-#include <miniupnpc/miniwget.h>
-#include <miniupnpc/miniupnpc.h>
-#include <miniupnpc/upnpcommands.h>
-#include <miniupnpc/upnperrors.h>
-
-/** This is a magic number for miniupnpc lan address size. */
-#define UPNP_LANADDR_SZ 64
-
-/** This is our miniupnpc meta structure - it holds our request data,
- * responses, and various miniupnpc parameters. */
-typedef struct miniupnpc_state_t {
- struct UPNPUrls urls;
- struct IGDdatas data;
- char lanaddr[UPNP_LANADDR_SZ];
- int init;
-} miniupnpc_state_t;
-
-const tor_fw_backend_t *tor_fw_get_miniupnp_backend(void);
-
-int tor_upnp_init(tor_fw_options_t *options, void *backend_state);
-
-int tor_upnp_cleanup(tor_fw_options_t *options, void *backend_state);
-
-int tor_upnp_fetch_public_ip(tor_fw_options_t *options, void *backend_state);
-
-int tor_upnp_add_tcp_mapping(uint16_t internal_port, uint16_t external_port,
- int is_verbose, void *backend_state);
-
-#endif
-#endif
-
diff --git a/src/tools/tor-fw-helper/tor-fw-helper.c b/src/tools/tor-fw-helper/tor-fw-helper.c
deleted file mode 100644
index fdc0e1a..0000000
--- a/src/tools/tor-fw-helper/tor-fw-helper.c
+++ /dev/null
@@ -1,501 +0,0 @@
-/* Copyright (c) 2010, Jacob Appelbaum, Steven J. Murdoch.
- * Copyright (c) 2010-2015, The Tor Project, Inc. */
-/* See LICENSE for licensing information */
-
-/**
- * \file tor-fw-helper.c
- * \brief The main wrapper around our firewall helper logic.
- **/
-
-/*
- * tor-fw-helper is a tool for opening firewalls with NAT-PMP and UPnP; this
- * tool is designed to be called by hand or by Tor by way of a exec() at a
- * later date.
- */
-
-#include "orconfig.h"
-#include <stdio.h>
-#include <stdint.h>
-#include <stdlib.h>
-#include <getopt.h>
-#include <time.h>
-#include <string.h>
-#include <assert.h>
-
-#include "container.h"
-
-#ifdef _WIN32
-#include <winsock2.h>
-#endif
-
-#include "tor-fw-helper.h"
-#ifdef NAT_PMP
-#include "tor-fw-helper-natpmp.h"
-#endif
-#ifdef MINIUPNPC
-#include "tor-fw-helper-upnp.h"
-#endif
-
-/** This is our meta storage type - it holds information about each helper
- including the total number of helper backends, function pointers, and helper
- state. */
-typedef struct backends_t {
- /** The total number of backends */
- int n_backends;
- /** The backend functions as an array */
- tor_fw_backend_t backend_ops[MAX_BACKENDS];
- /** The internal backend state */
- void *backend_state[MAX_BACKENDS];
-} backends_t;
-
-/** Initialize each backend helper with the user input stored in <b>options</b>
- * and put the results in the <b>backends</b> struct. */
-static int
-init_backends(tor_fw_options_t *options, backends_t *backends)
-{
- int n_available = 0;
- int i, r, n;
- tor_fw_backend_t *backend_ops_list[MAX_BACKENDS];
- void *data = NULL;
- /* First, build a list of the working backends. */
- n = 0;
-#ifdef MINIUPNPC
- backend_ops_list[n++] = (tor_fw_backend_t *) tor_fw_get_miniupnp_backend();
-#endif
-#ifdef NAT_PMP
- backend_ops_list[n++] = (tor_fw_backend_t *) tor_fw_get_natpmp_backend();
-#endif
- n_available = n;
-
- /* Now, for each backend that might work, try to initialize it.
- * That's how we roll, initialized.
- */
- n = 0;
- for (i=0; i<n_available; ++i) {
- data = calloc(1, backend_ops_list[i]->state_len);
- if (!data) {
- perror("calloc");
- exit(1);
- }
- r = backend_ops_list[i]->init(options, data);
- if (r == 0) {
- backends->backend_ops[n] = *backend_ops_list[i];
- backends->backend_state[n] = data;
- n++;
- } else {
- free(data);
- }
- }
- backends->n_backends = n;
-
- return n;
-}
-
-/** Return the proper commandline switches when the user needs information. */
-static void
-usage(void)
-{
- fprintf(stderr, "tor-fw-helper usage:\n"
- " [-h|--help]\n"
- " [-T|--test-commandline]\n"
- " [-v|--verbose]\n"
- " [-g|--fetch-public-ip]\n"
- " [-p|--forward-port ([<external port>]:<internal port>)]\n");
-}
-
-/** Log commandline options to a hardcoded file <b>tor-fw-helper.log</b> in the
- * current working directory. */
-static int
-log_commandline_options(int argc, char **argv)
-{
- int i, retval;
- FILE *logfile;
- time_t now;
-
- /* Open the log file */
- logfile = fopen("tor-fw-helper.log", "a");
- if (NULL == logfile)
- return -1;
-
- /* Send all commandline arguments to the file */
- now = time(NULL);
- retval = fprintf(logfile, "START: %s\n", ctime(&now));
- for (i = 0; i < argc; i++) {
- retval = fprintf(logfile, "ARG: %d: %s\n", i, argv[i]);
- if (retval < 0)
- goto error;
-
- retval = fprintf(stderr, "ARG: %d: %s\n", i, argv[i]);
- if (retval < 0)
- goto error;
- }
- now = time(NULL);
- retval = fprintf(logfile, "END: %s\n", ctime(&now));
-
- /* Close and clean up */
- retval = fclose(logfile);
- return retval;
-
- /* If there was an error during writing */
- error:
- fclose(logfile);
- return -1;
-}
-
-/** Iterate over over each of the supported <b>backends</b> and attempt to
- * fetch the public ip. */
-static void
-tor_fw_fetch_public_ip(tor_fw_options_t *tor_fw_options,
- backends_t *backends)
-{
- int i;
- int r = 0;
-
- if (tor_fw_options->verbose)
- fprintf(stderr, "V: tor_fw_fetch_public_ip\n");
-
- for (i=0; i<backends->n_backends; ++i) {
- if (tor_fw_options->verbose) {
- fprintf(stderr, "V: running backend_state now: %i\n", i);
- fprintf(stderr, "V: size of backend state: %u\n",
- (int)(backends->backend_ops)[i].state_len);
- fprintf(stderr, "V: backend state name: %s\n",
- (char *)(backends->backend_ops)[i].name);
- }
- r = backends->backend_ops[i].fetch_public_ip(tor_fw_options,
- backends->backend_state[i]);
- fprintf(stderr, "tor-fw-helper: tor_fw_fetch_public_ip backend %s "
- " returned: %i\n", (char *)(backends->backend_ops)[i].name, r);
- }
-}
-
-/** Print a spec-conformant string to stdout describing the results of
- * the TCP port forwarding operation from <b>external_port</b> to
- * <b>internal_port</b>. */
-static void
-tor_fw_helper_report_port_fw_results(uint16_t internal_port,
- uint16_t external_port,
- int succeded,
- const char *message)
-{
- char *report_string = NULL;
-
- tor_asprintf(&report_string, "%s %s %u %u %s %s\n",
- "tor-fw-helper",
- "tcp-forward",
- external_port, internal_port,
- succeded ? "SUCCESS" : "FAIL",
- message);
- fprintf(stdout, "%s", report_string);
- fflush(stdout);
- tor_free(report_string);
-}
-
-#define tor_fw_helper_report_port_fw_fail(i, e, m) \
- tor_fw_helper_report_port_fw_results((i), (e), 0, (m))
-
-#define tor_fw_helper_report_port_fw_success(i, e, m) \
- tor_fw_helper_report_port_fw_results((i), (e), 1, (m))
-
-/** Return a heap-allocated string containing the list of our
- * backends. It can be used in log messages. Be sure to free it
- * afterwards! */
-static char *
-get_list_of_backends_string(backends_t *backends)
-{
- char *backend_names = NULL;
- int i;
- smartlist_t *backend_names_sl = smartlist_new();
-
- assert(backends->n_backends);
-
- for (i=0; i<backends->n_backends; ++i)
- smartlist_add(backend_names_sl, (char *) backends->backend_ops[i].name);
-
- backend_names = smartlist_join_strings(backend_names_sl, ", ", 0, NULL);
- smartlist_free(backend_names_sl);
-
- return backend_names;
-}
-
-/** Iterate over each of the supported <b>backends</b> and attempt to add a
- * port forward for the port stored in <b>tor_fw_options</b>. */
-static void
-tor_fw_add_ports(tor_fw_options_t *tor_fw_options,
- backends_t *backends)
-{
- int i;
- int r = 0;
- int succeeded = 0;
-
- if (tor_fw_options->verbose)
- fprintf(stderr, "V: %s\n", __func__);
-
- /** Loop all ports that need to be forwarded, and try to use our
- * backends for each port. If a backend succeeds, break the loop,
- * report success and get to the next port. If all backends fail,
- * report failure for that port. */
- SMARTLIST_FOREACH_BEGIN(tor_fw_options->ports_to_forward,
- port_to_forward_t *, port_to_forward) {
-
- succeeded = 0;
-
- for (i=0; i<backends->n_backends; ++i) {
- if (tor_fw_options->verbose) {
- fprintf(stderr, "V: running backend_state now: %i\n", i);
- fprintf(stderr, "V: size of backend state: %u\n",
- (int)(backends->backend_ops)[i].state_len);
- fprintf(stderr, "V: backend state name: %s\n",
- (const char *) backends->backend_ops[i].name);
- }
-
- r =
- backends->backend_ops[i].add_tcp_mapping(port_to_forward->internal_port,
- port_to_forward->external_port,
- tor_fw_options->verbose,
- backends->backend_state[i]);
- if (r == 0) { /* backend success */
- tor_fw_helper_report_port_fw_success(port_to_forward->internal_port,
- port_to_forward->external_port,
- backends->backend_ops[i].name);
- succeeded = 1;
- break;
- }
-
- fprintf(stderr, "tor-fw-helper: tor_fw_add_port backend %s "
- "returned: %i\n",
- (const char *) backends->backend_ops[i].name, r);
- }
-
- if (!succeeded) { /* all backends failed */
- char *list_of_backends_str = get_list_of_backends_string(backends);
- char *fail_msg = NULL;
- tor_asprintf(&fail_msg, "All port forwarding backends (%s) failed.",
- list_of_backends_str);
- tor_fw_helper_report_port_fw_fail(port_to_forward->internal_port,
- port_to_forward->external_port,
- fail_msg);
- tor_free(list_of_backends_str);
- tor_free(fail_msg);
- }
-
- } SMARTLIST_FOREACH_END(port_to_forward);
-}
-
-/** Called before we make any calls to network-related functions.
- * (Some operating systems require their network libraries to be
- * initialized.) (from common/compat.c) */
-static int
-tor_fw_helper_network_init(void)
-{
-#ifdef _WIN32
- /* This silly exercise is necessary before windows will allow
- * gethostbyname to work. */
- WSADATA WSAData;
- int r;
- r = WSAStartup(0x101, &WSAData);
- if (r) {
- fprintf(stderr, "E: Error initializing Windows network layer "
- "- code was %d", r);
- return -1;
- }
- /* WSAData.iMaxSockets might show the max sockets we're allowed to use.
- * We might use it to complain if we're trying to be a server but have
- * too few sockets available. */
-#endif
- return 0;
-}
-
-/** Parse the '-p' argument of tor-fw-helper. Its format is
- * [<external port>]:<internal port>, and <external port> is optional.
- * Return NULL if <b>arg</b> was c0rrupted. */
-static port_to_forward_t *
-parse_port(const char *arg)
-{
- smartlist_t *sl = smartlist_new();
- port_to_forward_t *port_to_forward = NULL;
- char *port_str = NULL;
- int ok;
- int port;
-
- smartlist_split_string(sl, arg, ":", 0, 0);
- if (smartlist_len(sl) != 2)
- goto err;
-
- port_to_forward = tor_malloc(sizeof(port_to_forward_t));
- if (!port_to_forward)
- goto err;
-
- port_str = smartlist_get(sl, 0); /* macroify ? */
- port = (int)tor_parse_long(port_str, 10, 1, 65535, &ok, NULL);
- if (!ok && strlen(port_str)) /* ":1555" is valid */
- goto err;
- port_to_forward->external_port = port;
-
- port_str = smartlist_get(sl, 1);
- port = (int)tor_parse_long(port_str, 10, 1, 65535, &ok, NULL);
- if (!ok)
- goto err;
- port_to_forward->internal_port = port;
-
- goto done;
-
- err:
- tor_free(port_to_forward);
-
- done:
- SMARTLIST_FOREACH(sl, char *, cp, tor_free(cp));
- smartlist_free(sl);
-
- return port_to_forward;
-}
-
-/** Report a failure of epic proportions: We didn't manage to
- * initialize any port forwarding backends. */
-static void
-report_full_fail(const smartlist_t *ports_to_forward)
-{
- if (!ports_to_forward)
- return;
-
- SMARTLIST_FOREACH_BEGIN(ports_to_forward,
- const port_to_forward_t *, port_to_forward) {
- tor_fw_helper_report_port_fw_fail(port_to_forward->internal_port,
- port_to_forward->external_port,
- "All backends (NAT-PMP, UPnP) failed "
- "to initialize!"); /* XXX hardcoded */
- } SMARTLIST_FOREACH_END(port_to_forward);
-}
-
-int
-main(int argc, char **argv)
-{
- int r = 0;
- int c = 0;
-
- tor_fw_options_t tor_fw_options;
- backends_t backend_state;
-
- memset(&tor_fw_options, 0, sizeof(tor_fw_options));
- memset(&backend_state, 0, sizeof(backend_state));
-
- // Parse CLI arguments.
- while (1) {
- int option_index = 0;
- static struct option long_options[] =
- {
- {"verbose", 0, 0, 'v'},
- {"help", 0, 0, 'h'},
- {"port", 1, 0, 'p'},
- {"fetch-public-ip", 0, 0, 'g'},
- {"test-commandline", 0, 0, 'T'},
- {0, 0, 0, 0}
- };
-
- c = getopt_long(argc, argv, "vhp:gT",
- long_options, &option_index);
- if (c == -1)
- break;
-
- switch (c) {
- case 'v': tor_fw_options.verbose = 1; break;
- case 'h': tor_fw_options.help = 1; usage(); exit(1); break;
- case 'p': {
- port_to_forward_t *port_to_forward = parse_port(optarg);
- if (!port_to_forward) {
- fprintf(stderr, "E: Failed to parse '%s'.\n", optarg);
- usage();
- exit(1);
- }
-
- /* If no external port was given (it's optional), set it to be
- * equal with the internal port. */
- if (!port_to_forward->external_port) {
- assert(port_to_forward->internal_port);
- if (tor_fw_options.verbose)
- fprintf(stderr, "V: No external port was given. Setting to %u.\n",
- port_to_forward->internal_port);
- port_to_forward->external_port = port_to_forward->internal_port;
- }
-
- if (!tor_fw_options.ports_to_forward)
- tor_fw_options.ports_to_forward = smartlist_new();
-
- smartlist_add(tor_fw_options.ports_to_forward, port_to_forward);
-
- break;
- }
- case 'g': tor_fw_options.fetch_public_ip = 1; break;
- case 'T': tor_fw_options.test_commandline = 1; break;
- case '?': break;
- default : fprintf(stderr, "Unknown option!\n"); usage(); exit(1);
- }
- }
-
- { // Verbose output
-
- if (tor_fw_options.verbose)
- fprintf(stderr, "V: tor-fw-helper version %s\n"
- "V: We were called with the following arguments:\n"
- "V: verbose = %d, help = %d, fetch_public_ip = %u\n",
- tor_fw_version, tor_fw_options.verbose, tor_fw_options.help,
- tor_fw_options.fetch_public_ip);
-
- if (tor_fw_options.verbose && tor_fw_options.ports_to_forward) {
- fprintf(stderr, "V: TCP forwarding:\n");
- SMARTLIST_FOREACH(tor_fw_options.ports_to_forward,
- const port_to_forward_t *, port_to_forward,
- fprintf(stderr, "V: External: %u, Internal: %u\n",
- port_to_forward->external_port,
- port_to_forward->internal_port));
- }
- }
-
- if (tor_fw_options.test_commandline) {
- return log_commandline_options(argc, argv);
- }
-
- // See if the user actually wants us to do something.
- if (!tor_fw_options.fetch_public_ip && !tor_fw_options.ports_to_forward) {
- fprintf(stderr, "E: We require a port to be forwarded or "
- "fetch_public_ip request!\n");
- usage();
- exit(1);
- }
-
- // Initialize networking
- if (tor_fw_helper_network_init())
- exit(1);
-
- // Initalize the various fw-helper backend helpers
- r = init_backends(&tor_fw_options, &backend_state);
- if (!r) { // all backends failed:
- // report our failure
- report_full_fail(tor_fw_options.ports_to_forward);
- fprintf(stderr, "tor-fw-helper: All backends failed.\n");
- exit(1);
- } else { // some backends succeeded:
- fprintf(stderr, "tor-fw-helper: %i NAT traversal helper(s) loaded\n", r);
- }
-
- // Forward TCP ports.
- if (tor_fw_options.ports_to_forward) {
- tor_fw_add_ports(&tor_fw_options, &backend_state);
- }
-
- // Fetch our public IP.
- if (tor_fw_options.fetch_public_ip) {
- tor_fw_fetch_public_ip(&tor_fw_options, &backend_state);
- }
-
- // Cleanup and exit.
- if (tor_fw_options.ports_to_forward) {
- SMARTLIST_FOREACH(tor_fw_options.ports_to_forward,
- port_to_forward_t *, port,
- tor_free(port));
- smartlist_free(tor_fw_options.ports_to_forward);
- }
-
- exit(0);
-}
-
diff --git a/src/tools/tor-fw-helper/tor-fw-helper.h b/src/tools/tor-fw-helper/tor-fw-helper.h
deleted file mode 100644
index 4ebc75d..0000000
--- a/src/tools/tor-fw-helper/tor-fw-helper.h
+++ /dev/null
@@ -1,59 +0,0 @@
-/* Copyright (c) 2010, Jacob Appelbaum, Steven J. Murdoch.
- * Copyright (c) 2010-2015, The Tor Project, Inc. */
-/* See LICENSE for licensing information */
-
-/**
- * \file tor-fw-helper.h
- * \brief The main header for our firewall helper.
- **/
-
-#ifndef TOR_TOR_FW_HELPER_H
-#define TOR_TOR_FW_HELPER_H
-
-#include <stdint.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <getopt.h>
-#include <time.h>
-
-/** The current version of tor-fw-helper. */
-#define tor_fw_version "0.2"
-
-/** This is an arbitrary hard limit - We currently have two (NAT-PMP and UPnP).
- We're likely going to add the Intel UPnP library but nothing else comes to
- mind at the moment. */
-#define MAX_BACKENDS 23
-
-/** Forward traffic received in port <b>external_port</b> in the
- * external side of our NAT to <b>internal_port</b> in this host. */
-typedef struct {
- uint16_t external_port;
- uint16_t internal_port;
-} port_to_forward_t;
-
-/** This is where we store parsed commandline options. */
-typedef struct {
- int verbose;
- int help;
- int test_commandline;
- struct smartlist_t *ports_to_forward;
- int fetch_public_ip;
- int nat_pmp_status;
- int upnp_status;
- int public_ip_status;
-} tor_fw_options_t;
-
-/** This is our main structure that defines our backend helper API; each helper
- * must conform to these public methods if it expects to be handled in a
- * non-special way. */
-typedef struct tor_fw_backend_t {
- const char *name;
- size_t state_len;
- int (*init)(tor_fw_options_t *options, void *backend_state);
- int (*cleanup)(tor_fw_options_t *options, void *backend_state);
- int (*fetch_public_ip)(tor_fw_options_t *options, void *backend_state);
- int (*add_tcp_mapping)(uint16_t internal_port, uint16_t external_port,
- int is_verbose, void *backend_state);
-} tor_fw_backend_t;
-#endif
-
More information about the tor-commits
mailing list