search

subgraph / roflcoptor

Tor Control Port Filter and State Tracker Daemon
BSD 3-Clause "New" or "Revised" License
25 stars 8 forks source link

Write filter for TorBrowser #4

Closed xSmurf closed 8 years ago

david415 commented 8 years ago

oh dear, the browser actually discovered the tor circuit's exit relay ip address. this seems very wrong. this is way more authority than the browser needs.

here's the log output from roflcoptor running in watch mode during the browser startup:

ROFLCopTor 2016/04/21 16:48:44 INFO/tor: New ctrl connection from: 127.0.0.1:42134 ROFLCopTor 2016/04/21 16:48:44 A->T: [authenticate xxx] ROFLCopTor 2016/04/21 16:48:44 A->T: [setevents stream] ROFLCopTor 2016/04/21 16:48:44 A<-T: [250 OK] ROFLCopTor 2016/04/21 16:48:44 A<-T: [250 OK] ROFLCopTor 2016/04/21 16:48:44 INFO/tor: New ctrl connection from: 127.0.0.1:42138 ROFLCopTor 2016/04/21 16:48:44 A->T: [AUTHENTICATE xxx] ROFLCopTor 2016/04/21 16:48:44 A<-T: [250 OK] ROFLCopTor 2016/04/21 16:48:44 A->T: [GETINFO net/listeners/socks] ROFLCopTor 2016/04/21 16:48:44 A<-T: [250-net/listeners/socks="127.0.0.1:9050"] ROFLCopTor 2016/04/21 16:48:44 A<-T: [250 OK] ROFLCopTor 2016/04/21 16:48:44 A<-T: [650 STREAM 8564 NEW 0 www.torproject.org:443 SOURCE_ADDR=127.0.0.1:44260 PURPOSE=USER] ROFLCopTor 2016/04/21 16:48:46 A<-T: [650 STREAM 8564 SENTCONNECT 5880 www.torproject.org:443] ROFLCopTor 2016/04/21 16:48:46 A<-T: [650 STREAM 8564 REMAP 5880 93.95.227.222:443 SOURCE=EXIT] ROFLCopTor 2016/04/21 16:48:46 A<-T: [650 STREAM 8564 SUCCEEDED 5880 93.95.227.222:443] ROFLCopTor 2016/04/21 16:48:47 A<-T: [650 STREAM 8565 NEW 0 ocsp.digicert.com:80 SOURCE_ADDR=127.0.0.1:44264 PURPOSE=USER] ROFLCopTor 2016/04/21 16:48:47 A<-T: [650 STREAM 8565 SENTCONNECT 5881 ocsp.digicert.com:80] ROFLCopTor 2016/04/21 16:48:47 A<-T: [650 STREAM 8565 REMAP 5881 93.184.220.29:80 SOURCE=EXIT] ROFLCopTor 2016/04/21 16:48:47 A<-T: [650 STREAM 8565 SUCCEEDED 5881 93.184.220.29:80] ROFLCopTor 2016/04/21 16:48:48 A<-T: [650 STREAM 8566 NEW 0 dist.torproject.org:443 SOURCE_ADDR=127.0.0.1:44268 PURPOSE=USER] ROFLCopTor 2016/04/21 16:48:48 A<-T: [650 STREAM 8566 SENTCONNECT 5882 dist.torproject.org:443] ROFLCopTor 2016/04/21 16:48:48 A<-T: [650 STREAM 8566 REMAP 5882 38.229.72.16:443 SOURCE=EXIT] ROFLCopTor 2016/04/21 16:48:48 A<-T: [650 STREAM 8566 SUCCEEDED 5882 38.229.72.16:443] ROFLCopTor 2016/04/21 16:48:50 A<-T: [650 STREAM 8568 NEW 0 145.220.0.15.$9CD77810A49B52A333666689B334447DCAD40591.exit:9001 PURPOSE=DIR_FETCH] ROFLCopTor 2016/04/21 16:48:50 A<-T: [650 STREAM 8568 SENTCONNECT 5883 145.220.0.15.$9CD77810A49B52A333666689B334447DCAD40591.exit:9001] ROFLCopTor 2016/04/21 16:48:50 A<-T: [650 STREAM 8530 CLOSED 5859 216.58.209.133:443 REASON=DONE] ROFLCopTor 2016/04/21 16:48:50 A<-T: [650 STREAM 8561 CLOSED 5879 check.torproject.org:443 REASON=DONE] ROFLCopTor 2016/04/21 16:48:50 A<-T: [650 STREAM 8568 SUCCEEDED 5883 145.220.0.15.$9CD77810A49B52A333666689B334447DCAD40591.exit:9001] ROFLCopTor 2016/04/21 16:48:50 INFO/tor: Closed client connection from: 127.0.0.1:42134: EOF

here's watch mode again when the browser's new identity feature is selected:

ROFLCopTor 2016/04/21 16:48:00 INFO/tor: New ctrl connection from: 127.0.0.1:42126 ROFLCopTor 2016/04/21 16:48:00 A->T: [AUTHENTICATE xxx] ROFLCopTor 2016/04/21 16:48:00 A<-T: [250 OK] ROFLCopTor 2016/04/21 16:48:00 A->T: [SIGNAL NEWNYM] ROFLCopTor 2016/04/21 16:48:00 A<-T: [250 OK]

david415 commented 8 years ago

ok... i've tricked tor browser into thinking everything is ok. in this dev branch: https://github.com/david415/roflcoptor/tree/13.add_multi_oz_listener.0 this rule set right here: https://github.com/david415/roflcoptor/blob/13.add_multi_oz_listener.0/filters/tbb.json

however it requires that issue #13 be resolved first... that would be this pull request pending review and merge: https://github.com/subgraph/roflcoptor/pull/14

david415 commented 8 years ago

@leif pointed out that my Tor Browser filter rules were too restrictive in not letting the browser see the circuit building info messages that contain the IP addresses of each tor relay hop in the circuit built.... so I fixed that. Here:

https://github.com/subgraph/roflcoptor/commit/b9ecc6c538273e8e6c3d5f0e264f521e70c8aa52

And I also noticed I had previously forced TBB to do NULL auth so I changed it to allow any authentication.