TransProxyType replaces TransTPROXY option

I'm making this change now since ipfw will want its own option too,
and proliferating options here isn't sensible.

(See #10582 and #10267)

diff --git a/changes/10582_tproxy b/changes/10582_tproxy
index 3609d568a8c7d3325799461e5910a3f694e72d2c..8eed6a29ba41276e07d10458d0c9f6d2ba1ce521 100644 (file)
--- a/changes/10582_tproxy
+++ b/changes/10582_tproxy
@@ -1,7 +1,7 @@
   o Minor features:
 
     - Add support for the TPROXY transparent proxying facility on Linux.
-      See documentation for the new TransTRPOXY option for more details.
+      See documentation for the new TransProxyType option for more details.
       Implementation by "thomo". Closes ticket 10582.
 
 

diff --git a/doc/tor.1.txt b/doc/tor.1.txt
index 69452a02f9ad82e093c4ccb9de5f33ca06beac53..ee1e0866e35cb4ae56e610024ce5201d5df115c2 100644 (file)
--- a/doc/tor.1.txt
+++ b/doc/tor.1.txt
@@ -1183,18 +1183,22 @@ The following options are useful only for clients (that is, if
     compatibility, TransListenAddress is only allowed when TransPort is just
     a port number.)
 
-[[TransTPROXY]] **TransTPROXY** **0**|**1**::
-    TransTPROXY may only be enabled when there is transparent proxy listener
-    enabled and only for Linux.
+[[TransProxyType]] **TransProxyTYpe** **default**|**TPROXY**::
+    TransProxyType may only be enabled when there is transparent proxy listener
+    enabled.
  +
-    Set this 1 if you wish to be able to use the TPROXY linux module to
+    Set this to TPROXY if you wish to be able to use the TPROXY Linux module to
     transparently proxy connections that are configured using the TransPort
     option. This setting lets the listener on the TransPort accept connections
     for all addresses, even when the TransListenAddress is configured for an
     internal address. Detailed information on how to configure the TPROXY
-    feature can be found in the Linux kernel source tree in the file  
+    feature can be found in the Linux kernel source tree in the file
     Documentation/networking/tproxy.txt.
-    (Default: 0)
+ +
+    Set this to "default", or leave it unconfigured, to use regular IPTables
+    on Linux, or to use pf on the *BSD operating systems.
+ +
+    (Default: "default".)
 
 [[NATDPort]] **NATDPort** \['address':]__port__|**auto** [_isolation flags_]::
     Open this port to listen for connections from old versions of ipfw (as

diff --git a/src/or/config.c b/src/or/config.c
index b76243b7097573cb66a04135faac0f791c677bd4..e7847d5830816c64723374ff52d15555c87cd069 100644 (file)
--- a/src/or/config.c
+++ b/src/or/config.c
@@ -408,7 +408,7 @@ static config_var_t option_vars_[] = {
   OBSOLETE("TrafficShaping"),
   V(TransListenAddress,          LINELIST, NULL),
   VPORT(TransPort,                   LINELIST, NULL),
-  V(TransTPROXY,                 BOOL,     "0"),
+  V(TransProxyType,              STRING,   "default"),
   V(TunnelDirConns,              BOOL,     "1"),
   V(UpdateBridgesFromAuthority,  BOOL,     "0"),
   V(UseBridges,                  BOOL,     "0"),
@@ -2517,19 +2517,30 @@ options_validate(or_options_t *old_options, or_options_t *options,
         "undefined, and there aren't any hidden services configured.  "
         "Tor will still run, but probably won't do anything.");
 
+  options->TransProxyType_parsed = TPT_DEFAULT;
 #ifdef USE_TRANSPARENT
-  if (options->TransTPROXY) {
+  if (options->TransProxyType) {
+    if (!strcasecmp(options->TransProxyType, "default")) {
+      options->TransProxyType_parsed = TPT_DEFAULT;
+    } else if (!strcasecmp(options->TransProxyType, "tproxy")) {
 #ifndef __linux__
-    REJECT("TransTPROXY is a Linux-specific feature.")
+      REJECT("TPROXY is a Linux-specific feature.");
+#else
+      options->TransProxyType_parsed = TPT_TPROXY;
 #endif
-    if (!options->TransPort_set) {
-      REJECT("Cannot use TransTPROXY without any valid TransPort or "
+    } else {
+      REJECT("Unrecognized value for TransProxyType");
+    }
+
+    if (strcasecmp(options->TransProxyType, "default") &&
+        !options->TransPort_set) {
+      REJECT("Cannot use TransProxyType without any valid TransPort or "
              "TransListenAddress.");
     }
   }
 #else
-  if (options->TransPort_set || options->TransTPROXY)
-    REJECT("TransPort, TransListenAddress, and TransTPROXY are disabled "
+  if (options->TransPort_set)
+    REJECT("TransPort and TransListenAddress are disabled "
            "in this build.");
 #endif
 

diff --git a/src/or/connection.c b/src/or/connection.c
index 6dbba668c663e7700e00757b6940fd3031024da7..942bfc598fe3bafd031a727ce40695b158962b3d 100644 (file)
--- a/src/or/connection.c
+++ b/src/or/connection.c
@@ -1036,7 +1036,8 @@ connection_listener_new(const struct sockaddr *listensockaddr,
     make_socket_reuseable(s);
 
 #if defined USE_TRANSPARENT && defined(IP_TRANSPARENT)
-    if (options->TransTPROXY && type == CONN_TYPE_AP_TRANS_LISTENER) {
+    if (options->TransProxyType_parsed == TPT_TPROXY &&
+        type == CONN_TYPE_AP_TRANS_LISTENER) {
       int one = 1;
       if (setsockopt(s, SOL_IP, IP_TRANSPARENT, &one, sizeof(one)) < 0) {
         const char *extra = "";

diff --git a/src/or/or.h b/src/or/or.h
index 40fc567f5e825b3f0b5169cd1085636ef99431aa..b63b1ffcbe90ebdcf2c0afc38f0192185c20c4db 100644 (file)
--- a/src/or/or.h
+++ b/src/or/or.h
@@ -3498,8 +3498,10 @@ typedef struct {
   config_line_t *SocksPort_lines;
   /** Ports to listen on for transparent pf/netfilter connections. */
   config_line_t *TransPort_lines;
-  int TransTPROXY; /** < Boolean: are we going to listen for all destinations
-                    * on the TransPort_lines are required for TPROXY? */
+  const char *TransProxyType; /**< What kind of transparent proxy
+                               * implementation are we using? */
+  /** Parsed value of TransProxyType. */
+  enum { TPT_DEFAULT, TPT_TPROXY } TransProxyType_parsed;
   config_line_t *NATDPort_lines; /**< Ports to listen on for transparent natd
                             * connections. */
   config_line_t *ControlPort_lines; /**< Ports to listen on for control