add nft rule redirecting tcp traffic to transparent proxy

CHANGELOG.md

@@ -5,6 +5,9 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
+### Added
+- when started as `uid=0`:
+  add `nftables` rule redirecting `tcp` traffic to transparent proxy
 
 ## [4.1.0] - 2021-03-03
 ### Added

Dockerfile

@@ -1,7 +1,11 @@
 FROM docker.io/alpine:3.13.5
 
+# nftables + dependencies add 2.3MB to image
 ARG TOR_PACKAGE_VERSION=0.4.4.8-r0
-RUN apk add --no-cache tor=$TOR_PACKAGE_VERSION
+ARG NFTABLES_PACKAGE_VERSION=0.9.7-r0
+RUN apk add --no-cache \
+        nftables=$NFTABLES_PACKAGE_VERSION \
+        tor=$TOR_PACKAGE_VERSION
 VOLUME /var/lib/tor
 
 #RUN apk add --no-cache \
@@ -17,7 +21,8 @@ RUN chmod -c a+rX /torrc.template /entrypoint.sh
 ENV SOCKS_TIMEOUT_SECONDS=
 ENTRYPOINT ["/entrypoint.sh"]
 
-USER tor
+# entrypoint.sh drops privileges after configuring nftables for transparent proxy
+#USER tor
 CMD ["tor", "-f", "/tmp/torrc"]
 
 # keeping dns requests as network-liveness is too optimistic

docker-compose.yml

@@ -25,7 +25,8 @@ services:
     - '127.0.0.1:9050:9050/tcp'
     - '127.0.0.1:53:9053/udp'
     cap_drop: [ALL]
-    #cap_add: [SYS_PTRACE]
+    # entrypoint.sh drops privileges after configuring nftables for transparent proxy
+    cap_add: [NET_ADMIN, SETUID, SETGID]
     security_opt: [no-new-privileges]
     cpus: 0.5
     mem_limit: 128m

entrypoint.sh

@@ -2,6 +2,12 @@
 
 set -e
 
+if [ "$(id -u)" -eq 0 ]; then
+    nft add rule ip nat PREROUTING ip protocol tcp fib daddr type != local counter redirect to :9040 \
+        || echo 'failed to configure nftables for transparent proxy (missing CAP_NET_ADMIN?)'
+    exec su -s /bin/sh tor -- "$0" "$@"
+fi
+
 # default: 120 sec
 # https://github.com/torproject/tor/blob/tor-0.4.1.7/src/core/or/connection_edge.c#L1099
 if [ -z "$SOCKS_TIMEOUT_SECONDS" ]; then