release v4.0.0

partial revert of commit 8d1a635ddc.

.github/dependabot.yml

@@ -0,0 +1,10 @@
+version: 2
+
+updates:
+- package-ecosystem: docker
+  directory: /
+  schedule:
+    interval: weekly
+    day: friday
+
+# https://docs.github.com/en/free-pro-team@latest/github/administering-a-repository/configuration-options-for-dependency-updates

CHANGELOG.md

@@ -4,14 +4,62 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## Unreleased
+## [Unreleased]
+
+## [4.0.0] - 2021-01-01
+### Changed
+- healthcheck: replace periodic http requests with probing
+  [network-liveness](https://gitweb.torproject.org/torspec.git/tree/control-spec.txt)
+  to improve privacy (keeping dns requests for faster updates)
+- changed log level of `control` domain to `warn`
+  (to avoid log spam by healthcheck connecting to control listener)
+- added message domains to log messages
+
+### Removed
+- `curl`
+- `bind-tools` package including `dig`
+
+## [3.0.0] - 2020-10-03
+### Added
+- create mount point at `/var/lib/tor`
+  to be able to make container's root filesystem read-only
+
+### Changed
+- moved tor's data directory from `/home/onion/.tor` to `/var/lib/tor`
+- run `tor` as user `tor` (uid=100) instead of `onion` (uid=101)
+- docker-compose & ansible-playbook: read-only root filesystem
+
 ### Fixed
-- upgrade default tor version: 0.4.1.6 -> 0.4.1.7
-  (non-breaking, fixes only, https://gitweb.torproject.org/tor.git/plain/ChangeLog)
+- ansible-playbook: drop capabilities
+
+## [2.1.0] - 2020-09-27
+### Added
+- enable [tor control](https://gitweb.torproject.org/torspec.git/tree/control-spec.txt)
+  listener on port `9051`
+  (listening on loopback device only)
+
+## [2.0.0] - 2020-03-24
+### Changed
+- changed DNS port from 53 to 9053
+- run as unprivileged user
+
+## [1.1.1] - 2020-03-21
+### Fixed
+- fix invalid torrc path
+
+## [1.1.0] - 2020-03-21
+### Added
+- change `SocksTimeout` option by setting `$SOCKS_TIMEOUT_SECONDS`
 
 ## [1.0.0] - 2019-10-12
 ### Added
-- Tor Socks5 & DNS proxy
+- tor socks5 & DNS proxy
 
-[Unreleased]: https://github.com/fphammerle/docker-tor-proxy/compare/1.0.0...HEAD
+[Unreleased]: https://github.com/fphammerle/docker-tor-proxy/compare/v4.0.0...HEAD
+[4.0.0]: https://github.com/fphammerle/docker-tor-proxy/compare/v3.0.0...v4.0.0
+[3.0.0]: https://github.com/fphammerle/docker-tor-proxy/compare/v2.1.0...v3.0.0
+[2.1.0]: https://github.com/fphammerle/docker-tor-proxy/compare/v2.0.0...v2.1.0
+[2.0.0]: https://github.com/fphammerle/docker-tor-proxy/compare/v1.1.1...v2.0.0
+[1.1.1]: https://github.com/fphammerle/docker-tor-proxy/compare/v1.1.0...v1.1.1
+[1.1.0]: https://github.com/fphammerle/docker-tor-proxy/compare/1.0.0...v1.1.0
 [1.0.0]: https://github.com/fphammerle/docker-tor-proxy/releases/tag/1.0.0

Dockerfile

@@ -1,26 +1,29 @@
-FROM alpine:3.11
+FROM alpine:3.12.3
 
-ARG CURL_PACKAGE_VERSION=7.67.0-r0
-ARG BIND_TOOLS_PACKAGE_VERSION=9.14.8-r5
-ARG TOR_PACKAGE_VERSION=0.4.1.7-r0
-RUN adduser -S onion \
-    && apk add --no-cache \
-        curl=$CURL_PACKAGE_VERSION \
-        bind-tools=$BIND_TOOLS_PACKAGE_VERSION `# dig` \
-        tor=$TOR_PACKAGE_VERSION
+ARG TOR_PACKAGE_VERSION=0.4.3.7-r0
+RUN apk add --no-cache tor=$TOR_PACKAGE_VERSION
+VOLUME /var/lib/tor
 
-# RUN apk add --no-cache man less \
-#     && apk add --no-cache tor-doc=$TOR_PACKAGE_VERSION \
-#        --repository $TOR_PACKAGE_REPOSITORY
-# ENV PAGER=less
+#RUN apk add --no-cache \
+#        less \
+#        man-db \
+#        tor-doc=$TOR_PACKAGE_VERSION
+#ENV PAGER=less
 
 EXPOSE 9050/tcp
-EXPOSE 53/udp
-COPY torrc /etc/tor/torrc
+EXPOSE 9053/udp
+COPY torrc.template entrypoint.sh /
+RUN chmod -c a+rX /torrc.template /entrypoint.sh
+ENV SOCKS_TIMEOUT_SECONDS=
+ENTRYPOINT ["/entrypoint.sh"]
 
-CMD ["tor"]
+USER tor
+CMD ["tor", "-f", "/tmp/torrc"]
 
+# keeping dns requests as network-liveness is too optimistic
+# https://gitweb.torproject.org/torspec.git/tree/control-spec.txt
 HEALTHCHECK CMD \
-    curl --silent --socks5 localhost:9050 https://google.com > /dev/null \
-    && [ ! -z "$(dig +notcp +short one.one.one.one @localhost)" ] \
+    printf "AUTHENTICATE\nGETINFO network-liveness\nQUIT\n" | nc localhost 9051 \
+        | grep -q network-liveness=up \
+    && nslookup -port=9053 google.com localhost | grep -v NXDOMAIN | grep -q google \
     || exit 1

README.md

@@ -5,18 +5,19 @@ docker hub: https://hub.docker.com/r/fphammerle/tor-proxy
 signed tags: https://github.com/fphammerle/docker-tor-proxy/tags
 
 ```sh
-$ docker run --rm --name tor-proxy \
+$ sudo docker run --rm --name tor_proxy \
     -p 127.0.0.1:9050:9050/tcp \
-    -p 127.0.0.1:53:53/udp \
+    -p 127.0.0.1:53:9053/udp \
     fphammerle/tor-proxy
 ```
 
 or after cloning the repository 🐙
 ```sh
-$ docker-compose up
+$ sudo docker-compose up
 ```
 
-test proxies:
+### test proxies
+
 ```sh
 $ curl --proxy socks5h://localhost:9050 ipinfo.io
 $ torsocks wget -O - ipinfo.io
@@ -27,7 +28,30 @@ $ ssh -o 'ProxyCommand nc -x localhost:9050 -v %h %p' abcdefghi.onion
 $ chromium-browser --proxy-server=socks5://localhost:9050 ipinfo.io
 ```
 
-isolate:
+### read-only root filesystem
+
+optionally add
 ```sh
-iptables -A OUTPUT ! -o lo -j REJECT --reject-with icmp-admin-prohibited
+$ sudo docker run --read-only -v tor_proxy_data:/var/lib/tor --tmpfs /tmp:rw,size=4k` …
 ```
+to make the container's root filesystem read-only
+
+### isolate
+
+```sh
+sudo iptables -A OUTPUT ! -o lo -j REJECT --reject-with icmp-admin-prohibited
+```
+
+### change `SocksTimeout` option
+
+```sh
+$ sudo docker run -e SOCKS_TIMEOUT_SECONDS=60 …
+```
+
+### show circuits
+
+```sh
+$ sudo docker exec tor_proxy \
+    sh -c 'printf "AUTHENTICATE\nGETINFO circuit-status\nQUIT\n" | nc localhost 9051'
+```
+relay search: https://metrics.torproject.org/rs.html

ansible-playbook.yml

@@ -7,16 +7,30 @@
         com.docker.network.bridge.name: tor
   - docker_container:
       name: tor_proxy
-      # 1.0.0-tor0.4.1.6-amd64
-      image: fphammerle/tor-proxy@sha256:ad55d07b1b21c35fa044dc3e1ea6c7d8494f39eb89491ddad35c245340f7cd4b
+      # object 9d8903fbee049c379537c5e291cfa88f57b049f2
+      # tag docker/3.0.0-tor0.4.3.5-amd64
+      image: docker.io/fphammerle/tor-proxy@sha256:501c5b5432156f25ecfce9e48ebfe0827f7702a1d32206af79f256cc94487a0f
+      mounts:
+      - type: volume
+        source: tor_proxy_data
+        target: /var/lib/tor
+        read_only: no
+      - type: tmpfs
+        target: /tmp # torrc
+        # nosuid,nodev,noexec added by default
+        tmpfs_mode: '1777'
+        tmpfs_size: 4k
+      read_only: yes
       networks:
       - name: tor_proxy_network
       purge_networks: yes
       ports:
       - '127.0.0.1:9050:9050/tcp'
-      - '127.0.0.1:53:53/udp'
-      restart_policy: unless-stopped
+      - '127.0.0.1:53:9053/udp'
+      cap_drop: [ALL]
+      security_opts: [no-new-privileges]
       memory: 128M
+      restart_policy: unless-stopped
   - iptables:
       action: append
       table: filter

docker-compose.yml

@@ -1,15 +1,34 @@
-version: '2.2'
+version: '2.3'
+
+volumes:
+  data:
 
 services:
   tor_proxy:
     build: .
     image: fphammerle/tor-proxy
+    environment:
+      SOCKS_TIMEOUT_SECONDS: 30
+    volumes:
+    - type: volume
+      source: data
+      target: /var/lib/tor
+      read_only: no
+    - type: tmpfs
+      target: /tmp # torrc
+      tmpfs:
+        # nosuid,nodev,noexec added by default
+        mode: '1777'
+        size: 4k
+    read_only: yes
     ports:
     - '127.0.0.1:9050:9050/tcp'
-    - '127.0.0.1:53:53/udp'
-    security_opt: ['no-new-privileges']
-    restart: unless-stopped
+    - '127.0.0.1:53:9053/udp'
+    cap_drop: [ALL]
+    #cap_add: [SYS_PTRACE]
+    security_opt: [no-new-privileges]
     cpus: 0.5
     mem_limit: 128m
+    restart: unless-stopped
 
 # https://docs.docker.com/compose/compose-file/compose-file-v2/

entrypoint.sh

@@ -0,0 +1,13 @@
+#!/bin/sh
+
+set -e
+
+# default: 120 sec
+# https://github.com/torproject/tor/blob/tor-0.4.1.7/src/core/or/connection_edge.c#L1099
+if [ -z "$SOCKS_TIMEOUT_SECONDS" ]; then
+    sed -e '/{socks_timeout_seconds}/d' /torrc.template > /tmp/torrc
+else
+    sed -e "s/{socks_timeout_seconds}/$SOCKS_TIMEOUT_SECONDS/" /torrc.template > /tmp/torrc
+fi
+
+exec "$@"

torrc

@@ -1,7 +0,0 @@
-Log notice stdout
-
-SocksPort 0.0.0.0:9050
-DNSPort 0.0.0.0:53
-
-# try to
-HardwareAccel 1

torrc.template

@@ -0,0 +1,18 @@
+# hide healthchecks:
+# > [notice] {CONTROL} New control connection opened from 127.0.0.1.
+Log [~control]notice warn stdout
+LogMessageDomains 1
+
+# default: ~/.tor
+DataDirectory /var/lib/tor
+
+# https://gitweb.torproject.org/torspec.git/tree/control-spec.txt
+ControlPort localhost:9051
+
+DNSPort 0.0.0.0:9053
+
+SocksPort 0.0.0.0:9050
+SocksTimeout {socks_timeout_seconds}
+
+# try to
+HardwareAccel 1