rack-tor-tag 0.0.5 → 0.0.7

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 63d7e1b87377867aa008c60820bd02ede6f32a17
-  data.tar.gz: a80f5026ebe074da7ee24dfb0310440f4c1fd1de
+  metadata.gz: 1fd11e7a9e96f55497a03c47e8ff355439d6df61
+  data.tar.gz: a818227dd6bc4674359eba20faf07ac41161c68d
 SHA512:
-  metadata.gz: f1e82ee67fa8cfbb51ccd937fd6a03c09865a74c8af71837643f0b71b4b715d35f378008bea91090a08fb8dc979b041147c66e11e3806558ef1a43a6c553261c
-  data.tar.gz: 49d6866e945b236496ec8d311d02f7ae598f18d2f646e6c6a53d1cd1ac9067f837c5a1c2c5e8cf080950a4cf53d94d21496ff4d4f3ec408f29409e636d09f368
+  metadata.gz: 33499550d86997dcdf5d0a83d2997d10d4688004f850300e2c66d21c97ddec17f13ce184bdda79f2a78327fb90a1d279339fe5211756dbba58904b48156ff13d
+  data.tar.gz: 24efd7df0fed9fbfe094869bfdbd72ca233044fab0cf0118e085939363922f3d2e8002669b460d0197d23118d098124ed9c2e36a35be5c35f390ee54a559a96e

data/lib/rack/tor_tag.rb

@@ -1,23 +1,68 @@
 require 'rack'
-require 'rack/ip'
+require 'resolv'
 
 module Rack
   class TorTag
+    DEFAULT_PARAMS = {
+      # You could run your own if you want.
+      # https://www.torproject.org/projects/tordnsel.html.en
+      :dnsel => 'ip-port.exitlist.torproject.org', 
+      :host_ips => nil, # will get from env
+      :host_port => nil
+    }
     
-    # DEFAULT_REDIRECT = 'https://sorry.google.com' #We're sorry from Google
-
-    def initialize(app)
+    def initialize(app, params = {})
       @app = app
+      @params = DEFAULT_PARAMS.merge(params)
     end
 
     def call(env)
-      puts "env", env
-      req = Rack::Request.new(env)
-      puts "req", req.inspect
-      # return [302, {'Content-Type' => 'text', 'Location' => DEFAULT_REDIRECT}, [] ] if Rack::IP.new(env['action_dispatch.remote_ip'] || req.ip).is_tor?
-        
-      #Normal processing
+      ip = env['action_dispatch.remote_ip']
+      # Getting the right IP is hard. Let's punt. 
+      # http://api.rubyonrails.org/classes/ActionDispatch/RemoteIp.html
+      # http://blog.gingerlime.com/2012/rails-ip-spoofing-vulnerabilities-and-protection/
+      raise 'Must run after ActionDispatch::RemoteIp' if ip.blank?
+      
+      case is_tor?(ip, env)
+      when true
+        env['tor'] = true
+        env['tor_ip'] = ip # stick it elsewhere
+        env['action_dispatch.remote_ip'] = '127.0.0.2' # make all Tor IPs look alike
+      when false
+        env['tor'] = false
+      else
+        env['tor'] = nil # i.e. unknown
+      end
+      
+      # Continue normal processing
       @app.call(env)
     end
+    
+    # see https://www.torproject.org/projects/tordnsel.html.en
+    def is_tor? ip, env
+      # We're a hidden service! Of course it's Tor.
+      return true if env['HTTP_HOST'] =~ /\.onion\z/ 
+      
+      host_ips = @params[:host_ips] || Resolv.getaddresses(
+        env['HTTP_HOST'] ? env['HTTP_HOST'].sub(/:.*/,'') : env['SERVER_NAME']).
+      select{|i| i[Resolv::IPv4::Regex]} # DNEL only works with IPv4
+      
+      host_ips.each do |host_ip| 
+        tor_hostname = [reverse_ip_octets(ip), @params[:host_port] || env['SERVER_PORT'], reverse_ip_octets(host_ip), @params[:dnsel]].join('.')
+        begin
+          return true if (Resolv.getaddress(tor_hostname) == '127.0.0.2')
+        rescue Resolv::ResolvError => e
+          false # It's supposed to not get a response if it's not a tor host
+        end
+      end
+      false
+    
+    rescue Errno::EHOSTUNREACH, Errno::ENETUNREACH => e
+      return nil      
+    end
+    
+    def reverse_ip_octets(ip)
+      ip.to_s.split('.').reverse.join('.')
+    end
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rack-tor-tag
 version: !ruby/object:Gem::Version
-  version: 0.0.5
+  version: 0.0.7
 platform: ruby
 authors:
 - Sai
@@ -47,7 +47,6 @@ extensions: []
 extra_rdoc_files: []
 files:
 - lib/rack-tor-tag.rb
-- lib/rack/ip.rb
 - lib/rack/tor_tag.rb
 homepage: https://makeyourlaws.org
 licenses: []

data/lib/rack/ip.rb

@@ -1,34 +0,0 @@
-require 'resolv'
-
-module Rack
-  class IP
-    
-    TOR_POSITIVE_IP = '127.0.0.2' #In case the DNS look up is positive, this is the IP address returned
-    TOR_DNSEL = 'ip-port.exitlist.torproject.org' #https://www.torproject.org/projects/tordnsel.html.en
-    
-    GOOGLE_DNS_ADDR = '8.8.8.8'
-    GOOGLE_DNS_PORT = '53'
-    
-    # client_addr is the address of the remote client we want to test to be an TOR node
-    # server_addr is the address of a public IP server we want to reach passing through client_addr
-    # server_port is a TCP port running on server_addr to test for positiviness to TOR network
-    def initialize(client_addr, server_addr = GOOGLE_DNS_ADDR, server_port=GOOGLE_DNS_PORT)
-      @client_addr, @server_port, @server_addr = client_addr.to_s, server_port.to_s, server_addr.to_s
-    end
-    
-    def is_tor? #Implements https://www.torproject.org/projects/tordnsel.html.en
-      Resolv.getaddress(tor_hostname) == TOR_POSITIVE_IP
-    rescue Errno::EHOSTUNREACH, Errno::ENETUNREACH, Resolv::ResolvError => e
-      false
-    end
-    
-    def tor_hostname
-      [reverse_ip_octets(@client_addr), @server_port, reverse_ip_octets(@server_addr), TOR_DNSEL].join('.')
-    end
-
-    def reverse_ip_octets(ip)
-      ip.split('.').reverse.join('.')
-    end
-    
-  end
-end