[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]

Re: [tor-bugs] #6609 [Tor Client]: Proposal to add tor-connect utility to tor-core distribution

#6609: Proposal to add tor-connect utility to tor-core distribution
-------------------------+--------------------------------------------------
 Reporter:  tri          |          Owner:     
     Type:  enhancement  |         Status:  new
 Priority:  normal       |      Milestone:     
Component:  Tor Client   |        Version:     
 Keywords:               |         Parent:     
   Points:               |   Actualpoints:     
-------------------------+--------------------------------------------------

Comment(by tri):

 Even though proxy command functionality in software is somehow a bit
 kludgy, there is something to be said about it. It's trivial to implement.
 And in some cases you can do cool things with it, like enabling creating
 automatically nested ssh connections with openssh.

 Just patched together an example code that can be used in opening a
 connection (returning a socket) but instead of really connecting
 somewhere, just creating a socketpair and executing the proxy process in
 the other end.

 {{{
 int proxy_command_connect(const char *proxy_command)
 {
 Â int s[2];
 Â pid_t pid;
 Â char * const av[4] = { "/bin/sh", "-c", (char *)proxy_command, NULL };
 Â char * const ev[1] = { NULL };

 Â if (socketpair(AF_LOCAL, SOCK_STREAM, 0, s) != 0)
 Â Â return -1;
 Â pid = fork();
 Â if (pid < 0) {
 Â Â close(s[0]);
 Â Â close(s[1]);
 Â Â return -1;
 Â }

 Â if (pid == 0) {
 #if 0
 Â Â /* This is just an example of how to drop possible root
 Â Â Â Âprivileges. ÂMore subtle approach is advisable. */
 Â Â setgroups(0, NULL);
 Â Â setgid(-1);
 Â Â setegid(-1);
 Â Â setuid(-1);
 Â Â seteuid(-1);
 #endif
 Â Â close(s[0]);
 Â Â if (dup2(s[1], fileno(stdin)) < 0)
 Â Â Â goto child_error;
 Â Â if (dup2(s[1], fileno(stdout)) < 0)
 Â Â Â goto child_error;
 Â Â close(s[1]);
 Â Â s[1] = -1;
 Â Â execve(av[0], av, ev);
 Â child_error:
 Â Â if (s[1] >= 0)
 Â Â Â close(s[1]);
 Â Â close(fileno(stdin));
 Â Â close(fileno(stdout));
 Â Â close(fileno(stderr));
 Â Â exit(-1);
 Â }
 Â close(s[1]);
 Â return s[0];
 }
 }}}
 One annoying thing exists, and that is almost no system can create TCP
 sockets with socketpair, and if the endpoint for some reason really must
 be a TCP socket, it's not nearly as trivial as the code above.

-- 
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/6609#comment:13>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs