[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
[tor-bugs] #10896 [Tor]: Add support for pf divert-to sockets
#10896: Add support for pf divert-to sockets
-------------------------+------------------------------------
Reporter: _x3j11 | Owner:
Type: enhancement | Status: new
Priority: normal | Milestone: Tor: 0.2.5.x-final
Component: Tor | Version:
Keywords: | Actual Points:
Parent ID: | Points:
-------------------------+------------------------------------
Since OpenBSD 4.4, the pf firewall introduced support for `divert-to`
rules alongside `rdr-to` rules. The latter form of rules translate and
modify packets and requires Tor to communicate with pf via ioctls on its
privileged device node `/dev/pf` to get the original untranslated
destination address. `divert-to` rules however do not require access to
the firewall via ioctl and the original destination address information is
accessible via a getsockname(2) call.
The attached patch adds a single new TransProxyType `pf-divert` to signify
that the firewall is operating with a `divert-to` rule configured to
divert traffic to Tor's transparent proxy listener (discussion on the
nomenclature of TransProxyTypes may be required). To avoid bloating
connection_ap_get_original_destination too much, the existing logic is
factored out into two additional functions, which get the destination
address information via firewall (if using traditional `rdr-to` rules), or
via the socket itself (if on Linux or using `divert-to` rules).
At the moment, the `default` TransProxyType assumes `rdr-to` rules and
behaviour to avoid breaking existing installations. An additional
TransProxyType can be added in future (`pf-rdr`) and the meaning of the
`default` TransProxyType can be changed to default to assume divert rules.
Note that this means that when using pf and `divert-to` rules, Tor can run
completely nonprivileged. This feature is not "advertised" in the
documentation modification, because it has only lightly been tested and
there may be other instances where Tor needs privileges that haven't been
triggered in testing this patch. If admins are using `rdr-to` rules to
begin with, they need to specify a User and start Tor as root (in order to
access `/dev/pf`, which is mode 600 root:wheel), and making a change to
use `divert-to` rules and ''remaining'' running Tor as root should need no
other configuration changes. If admins want to run Tor as a regular
nonprivileged user and do not remove the User clause, they will be
prompted to do so. If it is determined there are no other instances where
Tor needs privileges in this case, then this feature could be further
publicised.
--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/10896>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs