From db9609494e020cbc7f37396c30fcd626b2b7f1d7 Mon Sep 17 00:00:00 2001
From: Fabian Peter Hammerle <fabian@hammerle.me>
Date: Fri, 30 Apr 2021 12:35:15 +0200
Subject: [PATCH] add nft rule redirecting tcp traffic to transparent proxy

---
 CHANGELOG.md       | 3 +++
 Dockerfile         | 9 +++++++--
 docker-compose.yml | 3 ++-
 entrypoint.sh      | 6 ++++++
 4 files changed, 18 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2de9273..809bd61 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,9 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
+### Added
+- when started as `uid=0`:
+  add `nftables` rule redirecting `tcp` traffic to transparent proxy
 
 ## [4.1.0] - 2021-03-03
 ### Added
diff --git a/Dockerfile b/Dockerfile
index 34d39c0..48611ac 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,7 +1,11 @@
 FROM docker.io/alpine:3.13.5
 
+# nftables + dependencies add 2.3MB to image
 ARG TOR_PACKAGE_VERSION=0.4.4.8-r0
-RUN apk add --no-cache tor=$TOR_PACKAGE_VERSION
+ARG NFTABLES_PACKAGE_VERSION=0.9.7-r0
+RUN apk add --no-cache \
+        nftables=$NFTABLES_PACKAGE_VERSION \
+        tor=$TOR_PACKAGE_VERSION
 VOLUME /var/lib/tor
 
 #RUN apk add --no-cache \
@@ -17,7 +21,8 @@ RUN chmod -c a+rX /torrc.template /entrypoint.sh
 ENV SOCKS_TIMEOUT_SECONDS=
 ENTRYPOINT ["/entrypoint.sh"]
 
-USER tor
+# entrypoint.sh drops privileges after configuring nftables for transparent proxy
+#USER tor
 CMD ["tor", "-f", "/tmp/torrc"]
 
 # keeping dns requests as network-liveness is too optimistic
diff --git a/docker-compose.yml b/docker-compose.yml
index 857b58e..d33b781 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -25,7 +25,8 @@ services:
     - '127.0.0.1:9050:9050/tcp'
     - '127.0.0.1:53:9053/udp'
     cap_drop: [ALL]
-    #cap_add: [SYS_PTRACE]
+    # entrypoint.sh drops privileges after configuring nftables for transparent proxy
+    cap_add: [NET_ADMIN, SETUID, SETGID]
     security_opt: [no-new-privileges]
     cpus: 0.5
     mem_limit: 128m
diff --git a/entrypoint.sh b/entrypoint.sh
index 8316b69..c76ca00 100755
--- a/entrypoint.sh
+++ b/entrypoint.sh
@@ -2,6 +2,12 @@
 
 set -e
 
+if [ "$(id -u)" -eq 0 ]; then
+    nft add rule ip nat PREROUTING ip protocol tcp fib daddr type != local counter redirect to :9040 \
+        || echo 'failed to configure nftables for transparent proxy (missing CAP_NET_ADMIN?)'
+    exec su -s /bin/sh tor -- "$0" "$@"
+fi
+
 # default: 120 sec
 # https://github.com/torproject/tor/blob/tor-0.4.1.7/src/core/or/connection_edge.c#L1099
 if [ -z "$SOCKS_TIMEOUT_SECONDS" ]; then