add support for enabling SafeSocks option via environment variable SAFE_SOCKS (to detect dns leaks)

CHANGELOG.md

@@ -5,6 +5,11 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
+### Added
+- support for enabling `SafeSocks` option by assigning `1` to environment
+  variable `SAFE_SOCKS` (instructs tor to block socks connections when provided
+  with remote ip address instead of domain name to detect dns leaks due to
+  applications resolving domain names without tor)
 
 ## [4.5.1] - 2022-02-27
 ### Fixed

Dockerfile

@@ -20,6 +20,7 @@ EXPOSE 9053/udp
 COPY torrc.template entrypoint.sh /
 RUN chmod -c a+rX /torrc.template /entrypoint.sh
 ENV SOCKS_TIMEOUT_SECONDS= \
+    SAFE_SOCKS=0 \
     EXIT_NODES= \
     EXCLUDE_EXIT_NODES=
 ENTRYPOINT ["/entrypoint.sh"]

docker-compose.yml

@@ -8,6 +8,7 @@ services:
     build: .
     image: fphammerle/tor-proxy
     environment:
+      #SAFE_SOCKS: 1
       SOCKS_TIMEOUT_SECONDS: 30
       #EXIT_NODES: '1.2.3.4,1.2.3.5,{at}'
       #EXCLUDE_EXIT_NODES: '{xx},{yy},1.2.3.4,128.0.0.0/1'

entrypoint.sh

@@ -12,12 +12,13 @@ if [ "$(id -u)" -eq 0 ]; then
     exec su -s /bin/sh tor -- "$0" "$@"
 fi
 
+sed -e "s/{safe_socks}/$SAFE_SOCKS/" /torrc.template > /tmp/torrc
 # default: 120 sec
 # https://github.com/torproject/tor/blob/tor-0.4.1.7/src/core/or/connection_edge.c#L1099
 if [ -z "$SOCKS_TIMEOUT_SECONDS" ]; then
-    sed -e '/{socks_timeout_seconds}/d' /torrc.template > /tmp/torrc
+    sed -ie '/{socks_timeout_seconds}/d' /tmp/torrc
 else
-    sed -e "s/{socks_timeout_seconds}/$SOCKS_TIMEOUT_SECONDS/" /torrc.template > /tmp/torrc
+    sed -ie "s/{socks_timeout_seconds}/$SOCKS_TIMEOUT_SECONDS/" /tmp/torrc
 fi
 
 # > list of identity fingerprints, country codes, and address patterns

torrc.template

@@ -16,6 +16,24 @@ DNSPort 0.0.0.0:9053
 # IsolateClientAddr & IsolateSOCKSAuth enabled by default
 # https://web.archive.org/web/20230113155700/https://gitweb.torproject.org/tor.git/tree/doc/man/tor.1.txt?h=tor-0.4.7.13&id=7c1601fb6edd780ffef386936217ede9531c26e6#n1483
 SocksPort 0.0.0.0:9050 IsolateClientAddr IsolateSOCKSAuth
+# > reject application connections [...] that only provide an IP address [...]
+# > not doing remote DNS
+# with `SafeSocks 1`:
+# $ for p in socks4 socks4a socks5 socks5h; do \
+#   echo -n "$p: ";
+#   curl -o /dev/null --no-progress-meter -x $p://127.0.0.1:9050 https://ipinfo.tw
+#     && echo success;
+#   done
+# > socks4: curl: (97) Can't complete SOCKS4 connection to 0.0.0.0:0. (91), request rejected or failed.
+# > socks4a: success
+# > socks5: curl: (97) Can't complete SOCKS5 connection to ipinfo.tw. (2)
+# > socks5h: success
+# log:
+# > [warn] {APP} Your application (using socks4 to port 443) is giving Tor only
+# . an IP address. Applications that do DNS resolves themselves may leak
+# . information. Consider using Socks4A [...]
+# > [warn] {APP} Your application (using socks5 to port 443) is giving Tor [...]
+SafeSocks {safe_socks}
 SocksTimeout {socks_timeout_seconds}
 
 # requires netfilter rules