Merge branch 'http_tunnel_squashed' (73b0e2e6) · Commits · Mike Perry / Tor

changes/feature22407

0 → 100644

+5 −0

Original line number	Diff line number	Diff line
		o Minor features (client):
		- You can now use Tor as a tunneled HTTP proxy: use the HTTPTunnelPort
		option to open a port that accepts HTTP CONNECT requests.
		Closes ticket 22407.

doc/tor.1.txt

+13 −2

Original line number	Diff line number	Diff line
		@@ -786,7 +786,8 @@ CLIENT OPTIONS
		--------------

		The following options are useful only for clients (that is, if
		SocksPort, TransPort, DNSPort, or NATDPort is non-zero):
		SocksPort, HTTPTunnelPort, TransPort, DNSPort, or
		NATDPort is non-zero):

		[[Bridge]] Bridge [__transport__] __IP__:__ORPort__ [__fingerprint__]::
		When set along with UseBridges, instructs Tor to use the relay at
		@@ -1110,7 +1111,9 @@ The following options are useful only for clients (that is, if
		Unsupported and force-disabled when using Unix domain sockets.)
		IsolateSOCKSAuth;;
		Don't share circuits with streams for which different
		SOCKS authentication was provided. (On by default;
		SOCKS authentication was provided. (For HTTPTunnelPort
		connections, this option looks at the Proxy-Authorization and
		X-Tor-Stream-Isolation headers. On by default;
		you can disable it with NoIsolateSOCKSAuth.)
		IsolateClientProtocol;;
		Don't share circuits with streams using a different protocol.
		@@ -1331,6 +1334,14 @@ The following options are useful only for clients (that is, if
		the node "foo". Disabled by default since attacking websites and exit
		relays can use it to manipulate your path selection. (Default: 0)

		[[HTTPTunnelPort]] HTTPTunnelPort \['address':]__port__\|auto [_isolation flags_]::
		Open this port to listen for proxy connections using the "HTTP CONNECT"
		protocol instead of SOCKS. Set this to 0
		0 if you don't want to allow "HTTP CONNECT" connections. Set the port
		to "auto" to have Tor pick a port for you. This directive can be
		specified multiple times to bind to multiple addresses/ports. See
		SOCKSPort for an explanation of isolation flags. (Default: 0)

		[[TransPort]] TransPort \['address':]__port__\|auto [_isolation flags_]::
		Open this port to listen for transparent proxy connections. Set this to
		0 if you don't want to allow transparent proxy connections. Set the port

scripts/codegen/fuzzing_include_am.py

+1 −0

Original line number	Diff line number	Diff line
		@@ -8,6 +8,7 @@ FUZZERS = """
		extrainfo
		hsdescv2
		http
		http-connect
		iptsv2
		microdesc
		vrs

src/or/config.c

+14 −1

Original line number	Diff line number	Diff line
		@@ -372,6 +372,7 @@ static config_var_t option_vars_[] = {
		V(HTTPProxyAuthenticator, STRING, NULL),
		V(HTTPSProxy, STRING, NULL),
		V(HTTPSProxyAuthenticator, STRING, NULL),
		VPORT(HTTPTunnelPort),
		V(IPv6Exit, BOOL, "0"),
		VAR("ServerTransportPlugin", LINELIST, ServerTransportPlugin, NULL),
		V(ServerTransportListenAddr, LINELIST, NULL),
		@@ -2915,7 +2916,8 @@ options_validate_single_onion(or_options_t options, char *msg)
		const int client_port_set = (options->SocksPort_set \|\|
		options->TransPort_set \|\|
		options->NATDPort_set \|\|
		options->DNSPort_set);
		options->DNSPort_set \|\|
		options->HTTPTunnelPort_set);
		if (rend_service_non_anonymous_mode_enabled(options) && client_port_set &&
		!options->Tor2webMode) {
		REJECT("HiddenServiceNonAnonymousMode is incompatible with using Tor as "
		@@ -7000,6 +7002,15 @@ parse_ports(or_options_t *options, int validate_only,
		*msg = tor_strdup("Invalid NatdPort configuration");
		goto err;
		}
		if (parse_port_config(ports,
		options->HTTPTunnelPort_lines,
		"HTTP Tunnel", CONN_TYPE_AP_HTTP_CONNECT_LISTENER,
		"127.0.0.1", 0,
		((validate_only ? 0 : CL_PORT_WARN_NONLOCAL)
		\| CL_PORT_TAKES_HOSTNAMES \| gw_flag)) < 0) {
		*msg = tor_strdup("Invalid HTTPTunnelPort configuration");
		goto err;
		}
		{
		unsigned control_port_flags = CL_PORT_NO_STREAM_OPTIONS \|
		CL_PORT_WARN_NONLOCAL;
		@@ -7077,6 +7088,8 @@ parse_ports(or_options_t *options, int validate_only,
		!! count_real_listeners(ports, CONN_TYPE_AP_TRANS_LISTENER, 1);
		options->NATDPort_set =
		!! count_real_listeners(ports, CONN_TYPE_AP_NATD_LISTENER, 1);
		options->HTTPTunnelPort_set =
		!! count_real_listeners(ports, CONN_TYPE_AP_HTTP_CONNECT_LISTENER, 1);
		/* Use options->ControlSocket to test if a control socket is set */
		options->ControlPort_set =
		!! count_real_listeners(ports, CONN_TYPE_CONTROL_LISTENER, 0);

src/or/connection.c

+7 −1

Original line number	Diff line number	Diff line
		@@ -162,7 +162,8 @@ static smartlist_t *outgoing_addrs = NULL;
		case CONN_TYPE_CONTROL_LISTENER: \
		case CONN_TYPE_AP_TRANS_LISTENER: \
		case CONN_TYPE_AP_NATD_LISTENER: \
		case CONN_TYPE_AP_DNS_LISTENER
		case CONN_TYPE_AP_DNS_LISTENER: \
		case CONN_TYPE_AP_HTTP_CONNECT_LISTENER

		/**************************************************************/

		@@ -189,6 +190,7 @@ conn_type_to_string(int type)
		case CONN_TYPE_CONTROL: return "Control";
		case CONN_TYPE_EXT_OR: return "Extended OR";
		case CONN_TYPE_EXT_OR_LISTENER: return "Extended OR listener";
		case CONN_TYPE_AP_HTTP_CONNECT_LISTENER: return "HTTP tunnel listener";
		default:
		log_warn(LD_BUG, "unknown connection type %d", type);
		tor_snprintf(buf, sizeof(buf), "unknown [%d]", type);
		@@ -1706,6 +1708,8 @@ connection_init_accepted_conn(connection_t *conn,
		TO_ENTRY_CONN(conn)->is_transparent_ap = 1;
		conn->state = AP_CONN_STATE_NATD_WAIT;
		break;
		case CONN_TYPE_AP_HTTP_CONNECT_LISTENER:
		conn->state = AP_CONN_STATE_HTTP_CONNECT_WAIT;
		}
		break;
		case CONN_TYPE_DIR:
		@@ -3398,6 +3402,7 @@ connection_handle_read_impl(connection_t *conn)
		case CONN_TYPE_AP_LISTENER:
		case CONN_TYPE_AP_TRANS_LISTENER:
		case CONN_TYPE_AP_NATD_LISTENER:
		case CONN_TYPE_AP_HTTP_CONNECT_LISTENER:
		return connection_handle_listener_read(conn, CONN_TYPE_AP);
		case CONN_TYPE_DIR_LISTENER:
		return connection_handle_listener_read(conn, CONN_TYPE_DIR);
		@@ -4313,6 +4318,7 @@ connection_is_listener(connection_t *conn)
		conn->type == CONN_TYPE_AP_TRANS_LISTENER \|\|
		conn->type == CONN_TYPE_AP_DNS_LISTENER \|\|
		conn->type == CONN_TYPE_AP_NATD_LISTENER \|\|
		conn->type == CONN_TYPE_AP_HTTP_CONNECT_LISTENER \|\|
		conn->type == CONN_TYPE_DIR_LISTENER \|\|
		conn->type == CONN_TYPE_CONTROL_LISTENER)
		return 1;