From 80a84875637ce9a439b73c852634367c649c0b41 Mon Sep 17 00:00:00 2001 From: Gijs Peskens Date: Fri, 9 Mar 2018 16:02:11 +0100 Subject: [PATCH] os-tor new exit settings (#567) * Quick fixes to allow IPv6 and Outboundbinding -allow specification of secondary ORPort (intended for IPv6) -allow specification of 2 source addresses via source IP fields, especially usefull for exits. -default directory port to 9030 and set to mandatory (needed for relay) All of the IPv6 fields use the same input verification as the HOST field, should perhaps be changed? * ... * forgot torrc.... * Include manual config in torrc file include optional /usr/local/etc/torrc.exitpolicy after after exit policies set via interface before default reject to allow easy config of custom exit policy. * Cleanup for merge * Scheduler KIST is Linux 2.6.39+ only, should not be enabled on BSD https://www.torproject.org/docs/tor-manual.html.en * Cleaning up torrc whitespaces, fixed regex * fixing up things * Do actual IPv4 validation (reject any invalid IPv4) * Provide dropdown menu on general settings tab to allow choice in scheduler order and schedulers with following options: -KISTLite,Vanilla (default) -Vanilla,KISTLite -KISTLite -Vanilla * fixed missing options * whitespace * removed comma from default option for scheduler * Delete opnsense.tgz * Adding settings for Exits to new Exit Settings tab. * Fixed ExitACL to allow wildcards. Removed usage of accept6/reject6 in favor of accept *4 and *6 Using 'any' for wildcard networks, which coincidentally won't break validation * Moved all exit options back to under relay pane. added some more options for exits * whitespaces * whitespace * remove leftover unused exit.xml exit.xml was leftover from approach with separate page for exit settings. Removing, is unused --- .../OPNsense/Tor/forms/acl_exitpolicy.xml | 3 +- .../controllers/OPNsense/Tor/forms/relay.xml | 28 +++++++++++++++---- .../app/models/OPNsense/Tor/ACLExitPolicy.xml | 3 +- .../mvc/app/models/OPNsense/Tor/Relay.xml | 12 ++++++++ .../service/templates/OPNsense/Tor/torrc | 14 ++++++++-- 5 files changed, 51 insertions(+), 9 deletions(-) diff --git a/security/tor/src/opnsense/mvc/app/controllers/OPNsense/Tor/forms/acl_exitpolicy.xml b/security/tor/src/opnsense/mvc/app/controllers/OPNsense/Tor/forms/acl_exitpolicy.xml index 5e33e3331..3d9acb211 100644 --- a/security/tor/src/opnsense/mvc/app/controllers/OPNsense/Tor/forms/acl_exitpolicy.xml +++ b/security/tor/src/opnsense/mvc/app/controllers/OPNsense/Tor/forms/acl_exitpolicy.xml @@ -9,12 +9,13 @@ exitpolicy.type dropdown + Leave at both when specifying network below, otherwise when using wildcards change to match desired network exitpolicy.network text - Network on which this ACL is appied. + Network on which this ACL is appied. Enter 'any' to use wildcard adressing exitpolicy.startport diff --git a/security/tor/src/opnsense/mvc/app/controllers/OPNsense/Tor/forms/relay.xml b/security/tor/src/opnsense/mvc/app/controllers/OPNsense/Tor/forms/relay.xml index 028e02c61..0ce2c4fe1 100644 --- a/security/tor/src/opnsense/mvc/app/controllers/OPNsense/Tor/forms/relay.xml +++ b/security/tor/src/opnsense/mvc/app/controllers/OPNsense/Tor/forms/relay.xml @@ -69,11 +69,6 @@ text - - relay.exitrejectprivateip - - checkbox - relay.relay @@ -85,4 +80,27 @@ checkbox + + relay.exitenabled + + checkbox + Act as an exit. + + + relay.exitipv6 + + checkbox + Allow Exit using IPv6 protocol + + + relay.exitrejectprivateip + + checkbox + Reject exiting to private IP space + + + relay.exitrejectlocalif + + checkbox + diff --git a/security/tor/src/opnsense/mvc/app/models/OPNsense/Tor/ACLExitPolicy.xml b/security/tor/src/opnsense/mvc/app/models/OPNsense/Tor/ACLExitPolicy.xml index f317fd09b..571c1d567 100644 --- a/security/tor/src/opnsense/mvc/app/models/OPNsense/Tor/ACLExitPolicy.xml +++ b/security/tor/src/opnsense/mvc/app/models/OPNsense/Tor/ACLExitPolicy.xml @@ -8,9 +8,10 @@ Y - v6 + both Y + both IPv4 IPv6 diff --git a/security/tor/src/opnsense/mvc/app/models/OPNsense/Tor/Relay.xml b/security/tor/src/opnsense/mvc/app/models/OPNsense/Tor/Relay.xml index 517f6c5be..5048bcaf3 100644 --- a/security/tor/src/opnsense/mvc/app/models/OPNsense/Tor/Relay.xml +++ b/security/tor/src/opnsense/mvc/app/models/OPNsense/Tor/Relay.xml @@ -67,5 +67,17 @@ 0 Y + + 0 + Y + + + 0 + N + + + 1 + Y + diff --git a/security/tor/src/opnsense/service/templates/OPNsense/Tor/torrc b/security/tor/src/opnsense/service/templates/OPNsense/Tor/torrc index 95ffe7321..8853dddef 100644 --- a/security/tor/src/opnsense/service/templates/OPNsense/Tor/torrc +++ b/security/tor/src/opnsense/service/templates/OPNsense/Tor/torrc @@ -202,10 +202,21 @@ DirPort {% if helpers.exists('OPNsense.tor.relay.host') and OPNsense.tor.relay.h ## distribution for a sample. #DirPortFrontPage /usr/local/etc/tor/tor-exit-notice.html +{% if helpers.exists('OPNsense.tor.relay.exitenabled') %} +ExitRelay {{ OPNsense.tor.relay.exitenabled }} +{% endif %} + +{% if helpers.exists('OPNsense.tor.relay.exitipv6') %} +IPv6Exit {{ OPNsense.tor.relay.exitipv6 }} +{% endif %} + {% if helpers.exists('OPNsense.tor.relay.exitrejectprivateip') %} ExitPolicyRejectPrivate {{ OPNsense.tor.relay.exitrejectprivateip }} {% endif %} +{% if helpers.exists('OPNsense.tor.relay.exitrejectlocalif') %} +ExitPolicyRejectLocalInterfaces {{ OPNsense.tor.relay.exitrejectlocalif }} +{% endif %} {% if helpers.exists('OPNsense.tor.exitpolicy') %} {% if helpers.exists('OPNsense.tor.exitpolicy.policy') %} @@ -213,8 +224,7 @@ ExitPolicyRejectPrivate {{ OPNsense.tor.relay.exitrejectprivateip }} {% for policy in helpers.toList('OPNsense.tor.exitpolicy.policy') %} {% if policy.enabled == '1' %} -ExitPolicy {{ policy.action }}{% if policy.type == 'v6' %}6{% endif - %} {% if policy.network == '' %}*{% if 'v' in policy.type %}{{ policy.type|replace('v','') }}{% endif%}{% else +ExitPolicy {{ policy.action }} {% if policy.network == 'any' %}*{% if 'v' in policy.type %}{{ policy.type|replace('v','') }}{% endif%}{% else %}{{ policy.network }}{% endif %}{% if 'startport' in policy %}:{{ policy.startport }}{% if 'endport' in policy %}-{{ policy.endport }}{% endif