upgrade tor package from v0.4.8.18-r2 to v0.4.8.19-r0

https://web.archive.org/web/20251011051716/https://gitlab.torproject.org/tpo/core/tor/-/raw/release-0.4.8/ReleaseNotes

.github/dependabot.yml

@@ -0,0 +1,18 @@
+# sync with https://github.com/fphammerle/docker-onion-service/blob/master/.github/dependabot.yml
+
+version: 2
+
+updates:
+- package-ecosystem: docker
+  directory: /
+  schedule:
+    interval: weekly
+    day: friday
+- package-ecosystem: github-actions
+  directory: /
+  # > YAML aliases are not supported
+  schedule:
+    interval: weekly
+    day: friday
+
+# https://docs.github.com/en/free-pro-team@latest/github/administering-a-repository/configuration-options-for-dependency-updates

.github/workflows/container-image.yml

@@ -0,0 +1,56 @@
+---
+name: container image
+
+on:
+  push:
+  pull_request:
+  schedule:
+  - cron: '0 20 * * 5'
+
+jobs:
+  docker-build:
+    runs-on: ubuntu-24.04
+    permissions: {packages: write}
+    steps:
+    - id: meta
+      # > "automatic" tag management and OCI Image Format Spec… for labels
+      # https://web.archive.org/web/20250103123053/https://docs.docker.com/build/ci/github-actions/manage-tags-labels/
+      uses: docker/metadata-action@v5
+      with:
+        # see comment on `push: true` below
+        images: ghcr.io/${{ github.repository_owner }}/tor-proxy
+        # https://web.archive.org/web/20250103130404/https://github.com/docker/metadata-action?tab=readme-ov-file#tags-input
+        tags: |
+          type=ref,event=branch
+          type=ref,event=pr
+          type=sha,format=long
+          type=raw,value=latest,enable=false
+    - uses: docker/setup-qemu-action@v3.6.0
+    - uses: docker/login-action@v3
+      with:
+        registry: ghcr.io
+        username: ${{ github.actor }}
+        password: ${{ secrets.GITHUB_TOKEN }}
+    - uses: docker/setup-buildx-action@v3.11.1
+    # > By default, this action uses the Git context so you don't need to use
+    # > the actions/checkout action to checkout the repository because this
+    # > will be done directly by buildkit. [...]
+    # > any file mutation in the steps that precede [...] will be ignored,
+    # > including processing of the .dockerignore file
+    # https://github.com/marketplace/actions/build-and-push-docker-images
+    # > The commit history is not preserved.
+    # https://docs.docker.com/engine/reference/commandline/build/#git-repositories
+    - uses: docker/build-push-action@v6.18.0
+      with:
+        platforms: |
+          linux/amd64
+          linux/arm/v6
+          linux/arm/v7
+          linux/arm64
+        # > Require approval for all external contributors
+        # > All users that are not a member or owner of this repository will
+        # > require approval to run workflows.
+        # https://github.com/fphammerle/docker-tor-proxy/settings/actions
+        push: true
+        tags: ${{ steps.meta.outputs.tags }}
+        labels: ${{ steps.meta.outputs.labels }}

CHANGELOG.md

@@ -5,31 +5,108 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
+### Added
+- support for enabling `SafeSocks` option by assigning `1` to environment
+  variable `SAFE_SOCKS` (instructs tor to block socks connections when provided
+  with remote ip address instead of domain name to detect dns leaks due to
+  applications resolving domain names without tor)
+
+## [4.5.1] - 2022-02-27
+### Fixed
+- "sed: write error" for large values of `EXIT_NODES` and `EXCLUDE_EXIT_NODES`
+
+## [4.5.0] - 2021-09-06
+### Added
+- added ability to select exit nodes explicitly via `EXIT_NODES` environment variable
+
+## [4.4.0] - 2021-07-07
+### Added
+- added ability to exclude exit nodes via `EXCLUDE_EXIT_NODES` environment variable
+
+## [4.3.1] - 2021-05-15
+### Fixed
+- create prerouting chain if not already created by container runtime
+  (fixes dns proxy with direct routing & transparent proxy on some hosts)
+
+## [4.3.0] - 2021-05-07
+### Added
+- when running entrypoint as `uid=0`:
+  add `nftables` rule forwarding udp dns requests (port 53) to tor
+  (alternative for less flexible `docker run --publish 53:9053 …`)
+
+## [4.2.0] - 2021-04-30
+### Added
+- when running entrypoint as `uid=0`:
+  add `nftables` rule redirecting `tcp` traffic to transparent proxy
+
+## [4.1.0] - 2021-03-03
+### Added
+- enabled transparent proxy, listening on port `9040` (requires netfilter rules)
+- image labels:
+  - `org.opencontainers.image.revision` (git commit hash via build arg)
+  - `org.opencontainers.image.source` (repo url)
+  - `org.opencontainers.image.title`
+
+## [4.0.0] - 2021-01-01
+### Changed
+- healthcheck: replace periodic http requests with probing
+  [network-liveness](https://gitweb.torproject.org/torspec.git/tree/control-spec.txt)
+  to improve privacy (keeping dns requests for faster updates)
+- changed log level of `control` domain to `warn`
+  (to avoid log spam by healthcheck connecting to control listener)
+- added message domains to log messages
+
+### Removed
+- `curl`
+- `bind-tools` package including `dig`
+
+## [3.0.0] - 2020-10-03
+### Added
+- create mount point at `/var/lib/tor`
+  to be able to make container's root filesystem read-only
+
+### Changed
+- moved tor's data directory from `/home/onion/.tor` to `/var/lib/tor`
+- run `tor` as user `tor` (uid=100) instead of `onion` (uid=101)
+- docker-compose & ansible-playbook: read-only root filesystem
+
+### Fixed
+- ansible-playbook: drop capabilities
+
+## [2.1.0] - 2020-09-27
+### Added
+- enable [tor control](https://gitweb.torproject.org/torspec.git/tree/control-spec.txt)
+  listener on port `9051`
+  (listening on loopback device only)
 
 ## [2.0.0] - 2020-03-24
 ### Changed
-- Changed DNS port from 53 to 9053
-
-### Fixed
-- Run as unprivileged user
+- changed DNS port from 53 to 9053
+- run as unprivileged user
 
 ## [1.1.1] - 2020-03-21
 ### Fixed
-- Fix invalid torrc path
+- fix invalid torrc path
 
 ## [1.1.0] - 2020-03-21
 ### Added
-- Change `SocksTimeout` option by setting `$SOCKS_TIMEOUT_SECONDS`
-
-### Fixed
-- upgrade default tor version: 0.4.1.6 -> 0.4.1.9
-  (non-breaking, fixes only, https://gitweb.torproject.org/tor.git/plain/ChangeLog)
+- change `SocksTimeout` option by setting `$SOCKS_TIMEOUT_SECONDS`
 
 ## [1.0.0] - 2019-10-12
 ### Added
-- Tor Socks5 & DNS proxy
+- tor socks5 & DNS proxy
 
-[Unreleased]: https://github.com/fphammerle/docker-tor-proxy/compare/v2.0.0...HEAD
+[Unreleased]: https://github.com/fphammerle/docker-tor-proxy/compare/v4.5.1...HEAD
+[4.5.1]: https://github.com/fphammerle/docker-tor-proxy/compare/v4.5.0...v4.5.1
+[4.5.0]: https://github.com/fphammerle/docker-tor-proxy/compare/v4.4.0...v4.5.0
+[4.4.0]: https://github.com/fphammerle/docker-tor-proxy/compare/v4.3.1...v4.4.0
+[4.3.1]: https://github.com/fphammerle/docker-tor-proxy/compare/v4.3.0...v4.3.1
+[4.3.0]: https://github.com/fphammerle/docker-tor-proxy/compare/v4.2.0...v4.3.0
+[4.2.0]: https://github.com/fphammerle/docker-tor-proxy/compare/v4.1.0...v4.2.0
+[4.1.0]: https://github.com/fphammerle/docker-tor-proxy/compare/v4.0.0...v4.1.0
+[4.0.0]: https://github.com/fphammerle/docker-tor-proxy/compare/v3.0.0...v4.0.0
+[3.0.0]: https://github.com/fphammerle/docker-tor-proxy/compare/v2.1.0...v3.0.0
+[2.1.0]: https://github.com/fphammerle/docker-tor-proxy/compare/v2.0.0...v2.1.0
 [2.0.0]: https://github.com/fphammerle/docker-tor-proxy/compare/v1.1.1...v2.0.0
 [1.1.1]: https://github.com/fphammerle/docker-tor-proxy/compare/v1.1.0...v1.1.1
 [1.1.0]: https://github.com/fphammerle/docker-tor-proxy/compare/1.0.0...v1.1.0

Dockerfile

@@ -1,31 +1,49 @@
-FROM alpine:3.11
+FROM docker.io/alpine:3.22.1
 
-ARG CURL_PACKAGE_VERSION=7.67.0-r0
-ARG BIND_TOOLS_PACKAGE_VERSION=9.14.8-r5
-ARG TOR_PACKAGE_VERSION=0.4.1.9-r0
-RUN adduser -S onion \
-    && apk add --no-cache \
-        curl=$CURL_PACKAGE_VERSION \
-        bind-tools=$BIND_TOOLS_PACKAGE_VERSION `# dig` \
+# https://gitweb.torproject.org/tor.git/plain/ChangeLog
+# https://gitlab.torproject.org/tpo/core/tor/-/raw/release-0.4.8/ReleaseNotes
+# https://git.alpinelinux.org/aports/log/community/tor?h=3.22-stable
+ARG TOR_PACKAGE_VERSION=0.4.8.19-r0
+# nftables + dependencies add 2.3MB to image
+# https://www.netfilter.org/projects/nftables/downloads.html
+# https://git.alpinelinux.org/aports/log/main/nftables?h=3.22-stable
+ARG NFTABLES_PACKAGE_VERSION=1.1.3-r0
+RUN apk add --no-cache \
+        nftables=$NFTABLES_PACKAGE_VERSION \
         tor=$TOR_PACKAGE_VERSION
+VOLUME /var/lib/tor
 
-# RUN apk add --no-cache \
-#         less \
-#         man \
-#         tor-doc=$TOR_PACKAGE_VERSION
-# ENV PAGER=less
+#RUN apk add --no-cache \
+#        less \
+#        man-db \
+#        strace \
+#        tor-doc=$TOR_PACKAGE_VERSION
+#ENV PAGER=less
 
 EXPOSE 9050/tcp
 EXPOSE 9053/udp
 COPY torrc.template entrypoint.sh /
-ENV SOCKS_TIMEOUT_SECONDS=
-ENTRYPOINT ["/entrypoint.sh"]
 RUN chmod -c a+rX /torrc.template /entrypoint.sh
+ENV SOCKS_TIMEOUT_SECONDS= \
+    SAFE_SOCKS=0 \
+    EXIT_NODES= \
+    EXCLUDE_EXIT_NODES=
+ENTRYPOINT ["/entrypoint.sh"]
 
-USER onion
+# entrypoint.sh drops privileges after configuring nftables for transparent proxy
+#USER tor
 CMD ["tor", "-f", "/tmp/torrc"]
 
+# keeping dns requests as network-liveness is too optimistic
+# https://gitweb.torproject.org/torspec.git/tree/control-spec.txt
 HEALTHCHECK CMD \
-    curl --silent --socks5 localhost:9050 https://google.com > /dev/null \
-    && [ ! -z "$(dig -p 9053 +notcp +short one.one.one.one @localhost)" ] \
+    printf "AUTHENTICATE\nGETINFO network-liveness\nQUIT\n" | nc localhost 9051 \
+        | grep -q network-liveness=up \
+    && nslookup -port=9053 google.com localhost | grep -v NXDOMAIN | grep -q google \
     || exit 1
+
+# https://github.com/opencontainers/image-spec/blob/v1.0.1/annotations.md
+ARG REVISION=
+LABEL org.opencontainers.image.title="tor socks, dns & transparent proxy" \
+    org.opencontainers.image.source="https://github.com/fphammerle/docker-tor-proxy" \
+    org.opencontainers.image.revision="$REVISION"

README.md

@@ -1,22 +1,23 @@
 # docker: tor socks & dns proxy 🌐 🐳
 
-docker hub: https://hub.docker.com/r/fphammerle/tor-proxy
+Docker Hub: https://hub.docker.com/r/fphammerle/tor-proxy
 
-signed tags: https://github.com/fphammerle/docker-tor-proxy/tags
+Signed image tags: https://github.com/fphammerle/docker-tor-proxy/tags
 
 ```sh
-$ docker run --rm --name tor-proxy \
+$ sudo docker run --rm --name tor_proxy \
     -p 127.0.0.1:9050:9050/tcp \
-    -p 127.0.0.1:53:53/udp \
+    -p 127.0.0.1:53:9053/udp \
     fphammerle/tor-proxy
 ```
 
 or after cloning the repository 🐙
 ```sh
-$ docker-compose up
+$ sudo docker-compose up
 ```
 
-test proxies:
+### Test Proxies
+
 ```sh
 $ curl --proxy socks5h://localhost:9050 ipinfo.io
 $ torsocks wget -O - ipinfo.io
@@ -27,12 +28,57 @@ $ ssh -o 'ProxyCommand nc -x localhost:9050 -v %h %p' abcdefghi.onion
 $ chromium-browser --proxy-server=socks5://localhost:9050 ipinfo.io
 ```
 
-isolate:
+### Read-only Root Filesystem
+
+Optionally add
 ```sh
-iptables -A OUTPUT ! -o lo -j REJECT --reject-with icmp-admin-prohibited
+$ sudo docker run --read-only -v tor_proxy_data:/var/lib/tor --tmpfs /tmp:rw,size=4k` …
+```
+to make the container's root filesystem read-only.
+
+### Isolate Host
+
+```sh
+sudo iptables -A OUTPUT ! -o lo -j REJECT --reject-with icmp-admin-prohibited
 ```
 
-change `SocksTimeout` option:
+### Change `SocksTimeout` Option
+
 ```sh
-$ docker run -e SOCKS_TIMEOUT_SECONDS=60 …
+$ sudo docker run -e SOCKS_TIMEOUT_SECONDS=60 …
+```
+
+### Select Exit Nodes
+
+```sh
+$ sudo docker run -e EXIT_NODES=1.2.3.4,1.2.3.5,{at} …
+```
+
+### Exclude Exit Nodes
+
+```sh
+$ sudo docker run -e EXCLUDE_EXIT_NODES=1.2.3.4,1.2.3.5 …
+```
+
+### Show Circuits
+
+```sh
+$ printf 'AUTHENTICATE\nGETINFO circuit-status\nQUIT\n' \
+    | sudo docker exec -i tor_proxy nc localhost 9051
+```
+relay search: https://metrics.torproject.org/rs.html
+
+or using [onioncircuits](https://gitlab.tails.boum.org/tails/onioncircuits) ([debian repo](https://salsa.debian.org/pkg-privacy-team/onioncircuits)):
+```sh
+$ sudo apt-get install --no-install-recommends onioncircuits
+$ sudo nsenter --target "$(sudo docker inspect --format='{{.State.Pid}}' tor_proxy)" --net \
+    sudo -u $USER onioncircuits
+```
+
+### Troubleshooting
+
+Disable `SafeLogging` (temporarily) to log IP addresses instead of `[scrubbed]`:
+```
+$ printf 'AUTHENTICATE\nSETCONF SafeLogging=0\nGETCONF SafeLogging\nQUIT\n' \
+    | sudo docker exec -i tor_proxy nc localhost 9051
 ```

ansible-playbook.yml

@@ -7,16 +7,30 @@
         com.docker.network.bridge.name: tor
   - docker_container:
       name: tor_proxy
-      # 1.0.0-tor0.4.1.6-amd64
-      image: fphammerle/tor-proxy@sha256:ad55d07b1b21c35fa044dc3e1ea6c7d8494f39eb89491ddad35c245340f7cd4b
+      # object 9d8903fbee049c379537c5e291cfa88f57b049f2
+      # tag docker/3.0.0-tor0.4.3.5-amd64
+      image: docker.io/fphammerle/tor-proxy@sha256:501c5b5432156f25ecfce9e48ebfe0827f7702a1d32206af79f256cc94487a0f
+      mounts:
+      - type: volume
+        source: tor_proxy_data
+        target: /var/lib/tor
+        read_only: no
+      - type: tmpfs
+        target: /tmp # torrc
+        # nosuid,nodev,noexec added by default
+        tmpfs_mode: '1777'
+        tmpfs_size: 4k
+      read_only: yes
       networks:
       - name: tor_proxy_network
       purge_networks: yes
       ports:
       - '127.0.0.1:9050:9050/tcp'
-      - '127.0.0.1:53:53/udp'
-      restart_policy: unless-stopped
+      - '127.0.0.1:53:9053/udp'
+      cap_drop: [ALL]
+      security_opts: [no-new-privileges]
       memory: 128M
+      restart_policy: unless-stopped
   - iptables:
       action: append
       table: filter

docker-compose.yml

@@ -1,18 +1,38 @@
-version: '2.2'
+version: '2.3'
+
+volumes:
+  data:
 
 services:
   tor_proxy:
     build: .
     image: fphammerle/tor-proxy
+    environment:
+      #SAFE_SOCKS: 1
+      SOCKS_TIMEOUT_SECONDS: 30
+      #EXIT_NODES: '1.2.3.4,1.2.3.5,{at}'
+      #EXCLUDE_EXIT_NODES: '{xx},{yy},1.2.3.4,128.0.0.0/1'
+    volumes:
+    - type: volume
+      source: data
+      target: /var/lib/tor
+      read_only: no
+    - type: tmpfs
+      target: /tmp # torrc
+      tmpfs:
+        # nosuid,nodev,noexec added by default
+        mode: '1777'
+        size: 5k
+    read_only: yes
     ports:
     - '127.0.0.1:9050:9050/tcp'
     - '127.0.0.1:53:9053/udp'
-    environment:
-      SOCKS_TIMEOUT_SECONDS: 240
-    security_opt: ['no-new-privileges']
-    restart: unless-stopped
+    cap_drop: [ALL]
+    # entrypoint.sh drops privileges after configuring nftables for transparent proxy
+    cap_add: [NET_ADMIN, SETUID, SETGID]
+    security_opt: [no-new-privileges]
     cpus: 0.5
     mem_limit: 128m
-    #cap_add: [SYS_PTRACE]
+    restart: unless-stopped
 
 # https://docs.docker.com/compose/compose-file/compose-file-v2/

entrypoint.sh

@@ -2,12 +2,33 @@
 
 set -e
 
+if [ "$(id -u)" -eq 0 ]; then
+    nft add chain ip nat PREROUTING { type nat hook prerouting priority dstnat \; } || true
+    nft add rule ip nat PREROUTING ip protocol tcp fib daddr type != local counter redirect to :9040 \
+        || echo 'warning: failed to configure nftables for transparent proxy (missing CAP_NET_ADMIN?)'
+    nft add rule ip nat PREROUTING fib daddr type local udp dport 53 counter redirect to :9053 \
+        || echo 'warning: failed to configure nftables for DNS proxy' \
+                '(alternative for less flexible `docker run --publish 53:9053 ...`)'
+    exec su -s /bin/sh tor -- "$0" "$@"
+fi
+
+sed -e "s/{safe_socks}/$SAFE_SOCKS/" /torrc.template > /tmp/torrc
 # default: 120 sec
 # https://github.com/torproject/tor/blob/tor-0.4.1.7/src/core/or/connection_edge.c#L1099
 if [ -z "$SOCKS_TIMEOUT_SECONDS" ]; then
-    sed -e '/{socks_timeout_seconds}/d' /torrc.template > /tmp/torrc
+    sed -ie '/{socks_timeout_seconds}/d' /tmp/torrc
 else
-    sed -e "s/{socks_timeout_seconds}/$SOCKS_TIMEOUT_SECONDS/" /torrc.template > /tmp/torrc
+    sed -ie "s/{socks_timeout_seconds}/$SOCKS_TIMEOUT_SECONDS/" /tmp/torrc
+fi
+
+# > list of identity fingerprints, country codes, and address patterns
+if [ ! -z "$EXIT_NODES" ]; then
+    echo -n 'ExitNodes ' >> /tmp/torrc
+    printenv EXIT_NODES >> /tmp/torrc
+fi
+if [ ! -z "$EXCLUDE_EXIT_NODES" ]; then
+    echo -n 'ExcludeExitNodes ' >> /tmp/torrc
+    printenv EXCLUDE_EXIT_NODES >> /tmp/torrc
 fi
 
 exec "$@"

nftables-changelog.url

@@ -0,0 +1 @@
+https://www.netfilter.org/projects/nftables/downloads.html

nftables-package-log.url

@@ -0,0 +1 @@
+https://git.alpinelinux.org/aports/log/main/nftables?h=3.18-stable

torrc.template

@@ -1,9 +1,50 @@
-Log notice stdout
+# https://www.torproject.org/docs/tor-manual.html.en
+
+# hide healthchecks:
+# > [notice] {CONTROL} New control connection opened from 127.0.0.1.
+Log [~control]notice warn stdout
+LogMessageDomains 1
+
+# default: ~/.tor
+DataDirectory /var/lib/tor
+
+# https://gitweb.torproject.org/torspec.git/tree/control-spec.txt
+ControlPort localhost:9051
 
-SocksPort 0.0.0.0:9050
 DNSPort 0.0.0.0:9053
 
+# IsolateClientAddr & IsolateSOCKSAuth enabled by default
+# https://web.archive.org/web/20230113155700/https://gitweb.torproject.org/tor.git/tree/doc/man/tor.1.txt?h=tor-0.4.7.13&id=7c1601fb6edd780ffef386936217ede9531c26e6#n1483
+SocksPort 0.0.0.0:9050 IsolateClientAddr IsolateSOCKSAuth
+# > reject application connections [...] that only provide an IP address [...]
+# > not doing remote DNS
+# with `SafeSocks 1`:
+# $ for p in socks4 socks4a socks5 socks5h; do \
+#   echo -n "$p: ";
+#   curl -o /dev/null --no-progress-meter -x $p://127.0.0.1:9050 https://ipinfo.tw
+#     && echo success;
+#   done
+# > socks4: curl: (97) Can't complete SOCKS4 connection to 0.0.0.0:0. (91), request rejected or failed.
+# > socks4a: success
+# > socks5: curl: (97) Can't complete SOCKS5 connection to ipinfo.tw. (2)
+# > socks5h: success
+# log:
+# > [warn] {APP} Your application (using socks4 to port 443) is giving Tor only
+# . an IP address. Applications that do DNS resolves themselves may leak
+# . information. Consider using Socks4A [...]
+# > [warn] {APP} Your application (using socks5 to port 443) is giving Tor [...]
+SafeSocks {safe_socks}
 SocksTimeout {socks_timeout_seconds}
 
+# requires netfilter rules
+# socks5 with auth-based circuit isolation (tor browser, torsocks --isolate) should be preferred
+# cave: IsolateDestAddr & IsolateDestPort are not enabled
+# https://gitlab.torproject.org/legacy/trac/-/wikis/doc/TransparentProxy
+# https://github.com/epidemics-scepticism/writing/blob/b6733379d653b30771d578ace04c262600345122/misconception.md#transparent-proxying-lacks-context
+# https://lists.torproject.org/pipermail/tor-talk/2014-March/032507.html
+# https://gitweb.torproject.org/tor.git/tree/src/or/connection_edge.c?id=6285d9bdcf7f210c56abd25f75133e30d05a7473#n1423
+# https://github.com/mitmproxy/mitmproxy/blob/v6.0.2/mitmproxy/platform/linux.py#L27
+TransPort 0.0.0.0:9040 IsolateClientAddr IsolateClientProtocol
+
 # try to
 HardwareAccel 1