From bb1b04ac244357b8c9d97417bcff157655e5093e Mon Sep 17 00:00:00 2001 From: Fabian Peter Hammerle Date: Fri, 13 Jan 2023 18:08:05 +0100 Subject: [PATCH] add support for enabling `SafeSocks` option via environment variable `SAFE_SOCKS` (to detect dns leaks) --- CHANGELOG.md | 5 +++++ Dockerfile | 1 + docker-compose.yml | 1 + entrypoint.sh | 5 +++-- torrc.template | 18 ++++++++++++++++++ 5 files changed, 28 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 9c020eb..ca7f396 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,6 +5,11 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). ## [Unreleased] +### Added +- support for enabling `SafeSocks` option by assigning `1` to environment + variable `SAFE_SOCKS` (instructs tor to block socks connections when provided + with remote ip address instead of domain name to detect dns leaks due to + applications resolving domain names without tor) ## [4.5.1] - 2022-02-27 ### Fixed diff --git a/Dockerfile b/Dockerfile index 8a21059..727dd9b 100644 --- a/Dockerfile +++ b/Dockerfile @@ -20,6 +20,7 @@ EXPOSE 9053/udp COPY torrc.template entrypoint.sh / RUN chmod -c a+rX /torrc.template /entrypoint.sh ENV SOCKS_TIMEOUT_SECONDS= \ + SAFE_SOCKS=0 \ EXIT_NODES= \ EXCLUDE_EXIT_NODES= ENTRYPOINT ["/entrypoint.sh"] diff --git a/docker-compose.yml b/docker-compose.yml index 3c92c7b..e5f47a2 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -8,6 +8,7 @@ services: build: . image: fphammerle/tor-proxy environment: + #SAFE_SOCKS: 1 SOCKS_TIMEOUT_SECONDS: 30 #EXIT_NODES: '1.2.3.4,1.2.3.5,{at}' #EXCLUDE_EXIT_NODES: '{xx},{yy},1.2.3.4,128.0.0.0/1' diff --git a/entrypoint.sh b/entrypoint.sh index 6619e95..f5f514f 100755 --- a/entrypoint.sh +++ b/entrypoint.sh @@ -12,12 +12,13 @@ if [ "$(id -u)" -eq 0 ]; then exec su -s /bin/sh tor -- "$0" "$@" fi +sed -e "s/{safe_socks}/$SAFE_SOCKS/" /torrc.template > /tmp/torrc # default: 120 sec # https://github.com/torproject/tor/blob/tor-0.4.1.7/src/core/or/connection_edge.c#L1099 if [ -z "$SOCKS_TIMEOUT_SECONDS" ]; then - sed -e '/{socks_timeout_seconds}/d' /torrc.template > /tmp/torrc + sed -ie '/{socks_timeout_seconds}/d' /tmp/torrc else - sed -e "s/{socks_timeout_seconds}/$SOCKS_TIMEOUT_SECONDS/" /torrc.template > /tmp/torrc + sed -ie "s/{socks_timeout_seconds}/$SOCKS_TIMEOUT_SECONDS/" /tmp/torrc fi # > list of identity fingerprints, country codes, and address patterns diff --git a/torrc.template b/torrc.template index e41a53c..d5d48c0 100644 --- a/torrc.template +++ b/torrc.template @@ -16,6 +16,24 @@ DNSPort 0.0.0.0:9053 # IsolateClientAddr & IsolateSOCKSAuth enabled by default # https://web.archive.org/web/20230113155700/https://gitweb.torproject.org/tor.git/tree/doc/man/tor.1.txt?h=tor-0.4.7.13&id=7c1601fb6edd780ffef386936217ede9531c26e6#n1483 SocksPort 0.0.0.0:9050 IsolateClientAddr IsolateSOCKSAuth +# > reject application connections [...] that only provide an IP address [...] +# > not doing remote DNS +# with `SafeSocks 1`: +# $ for p in socks4 socks4a socks5 socks5h; do \ +# echo -n "$p: "; +# curl -o /dev/null --no-progress-meter -x $p://127.0.0.1:9050 https://ipinfo.tw +# && echo success; +# done +# > socks4: curl: (97) Can't complete SOCKS4 connection to 0.0.0.0:0. (91), request rejected or failed. +# > socks4a: success +# > socks5: curl: (97) Can't complete SOCKS5 connection to ipinfo.tw. (2) +# > socks5h: success +# log: +# > [warn] {APP} Your application (using socks4 to port 443) is giving Tor only +# . an IP address. Applications that do DNS resolves themselves may leak +# . information. Consider using Socks4A [...] +# > [warn] {APP} Your application (using socks5 to port 443) is giving Tor [...] +SafeSocks {safe_socks} SocksTimeout {socks_timeout_seconds} # requires netfilter rules