release v4.5.1

Bumps [docker/build-push-action](https://github.com/docker/build-push-action) from 2.8.0 to 2.9.0.
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](https://github.com/docker/build-push-action/compare/v2.8.0...v2.9.0)

---
updated-dependencies:
- dependency-name: docker/build-push-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

.github/dependabot.yml

@@ -1,3 +1,5 @@
+# sync with https://github.com/fphammerle/docker-onion-service/blob/master/.github/dependabot.yml
+
 version: 2
 
 updates:
@@ -6,5 +8,11 @@ updates:
   schedule:
     interval: weekly
     day: friday
+- package-ecosystem: github-actions
+  directory: /
+  # > YAML aliases are not supported
+  schedule:
+    interval: weekly
+    day: friday
 
 # https://docs.github.com/en/free-pro-team@latest/github/administering-a-repository/configuration-options-for-dependency-updates

.github/workflows/container-image.yml

@@ -0,0 +1,26 @@
+# sync with https://github.com/fphammerle/docker-onion-service/blob/master/.github/workflows/container-image.yml
+
+name: container image
+
+on:
+  push:
+  pull_request:
+  schedule:
+  - cron: '0 20 * * 5'
+
+jobs:
+  docker-build:
+    runs-on: ubuntu-20.04
+    steps:
+    - uses: docker/setup-qemu-action@v1.2.0
+    - uses: docker/setup-buildx-action@v1.6.0
+    # > By default, this action uses the Git context so you don't need to use
+    # > the actions/checkout action to checkout the repository because this
+    # > will be done directly by buildkit. [...]
+    # > any file mutation in the steps that precede [...] will be ignored
+    # https://github.com/marketplace/actions/build-and-push-docker-images
+    - uses: docker/build-push-action@v2.9.0
+      with:
+        platforms: |
+          linux/amd64
+          linux/arm/v7

CHANGELOG.md

@@ -6,6 +6,42 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [4.5.1] - 2022-02-27
+### Fixed
+- "sed: write error" for large values of `EXIT_NODES` and `EXCLUDE_EXIT_NODES`
+
+## [4.5.0] - 2021-09-06
+### Added
+- added ability to select exit nodes explicitly via `EXIT_NODES` environment variable
+
+## [4.4.0] - 2021-07-07
+### Added
+- added ability to exclude exit nodes via `EXCLUDE_EXIT_NODES` environment variable
+
+## [4.3.1] - 2021-05-15
+### Fixed
+- create prerouting chain if not already created by container runtime
+  (fixes dns proxy with direct routing & transparent proxy on some hosts)
+
+## [4.3.0] - 2021-05-07
+### Added
+- when running entrypoint as `uid=0`:
+  add `nftables` rule forwarding udp dns requests (port 53) to tor
+  (alternative for less flexible `docker run --publish 53:9053 …`)
+
+## [4.2.0] - 2021-04-30
+### Added
+- when running entrypoint as `uid=0`:
+  add `nftables` rule redirecting `tcp` traffic to transparent proxy
+
+## [4.1.0] - 2021-03-03
+### Added
+- enabled transparent proxy, listening on port `9040` (requires netfilter rules)
+- image labels:
+  - `org.opencontainers.image.revision` (git commit hash via build arg)
+  - `org.opencontainers.image.source` (repo url)
+  - `org.opencontainers.image.title`
+
 ## [4.0.0] - 2021-01-01
 ### Changed
 - healthcheck: replace periodic http requests with probing
@@ -55,7 +91,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Added
 - tor socks5 & DNS proxy
 
-[Unreleased]: https://github.com/fphammerle/docker-tor-proxy/compare/v4.0.0...HEAD
+[Unreleased]: https://github.com/fphammerle/docker-tor-proxy/compare/v4.5.1...HEAD
+[4.5.1]: https://github.com/fphammerle/docker-tor-proxy/compare/v4.5.0...v4.5.1
+[4.5.0]: https://github.com/fphammerle/docker-tor-proxy/compare/v4.4.0...v4.5.0
+[4.4.0]: https://github.com/fphammerle/docker-tor-proxy/compare/v4.3.1...v4.4.0
+[4.3.1]: https://github.com/fphammerle/docker-tor-proxy/compare/v4.3.0...v4.3.1
+[4.3.0]: https://github.com/fphammerle/docker-tor-proxy/compare/v4.2.0...v4.3.0
+[4.2.0]: https://github.com/fphammerle/docker-tor-proxy/compare/v4.1.0...v4.2.0
+[4.1.0]: https://github.com/fphammerle/docker-tor-proxy/compare/v4.0.0...v4.1.0
 [4.0.0]: https://github.com/fphammerle/docker-tor-proxy/compare/v3.0.0...v4.0.0
 [3.0.0]: https://github.com/fphammerle/docker-tor-proxy/compare/v2.1.0...v3.0.0
 [2.1.0]: https://github.com/fphammerle/docker-tor-proxy/compare/v2.0.0...v2.1.0

Dockerfile

@@ -1,12 +1,17 @@
-FROM alpine:3.12.3
+FROM docker.io/alpine:3.15.0
 
-ARG TOR_PACKAGE_VERSION=0.4.3.7-r0
-RUN apk add --no-cache tor=$TOR_PACKAGE_VERSION
+# nftables + dependencies add 2.3MB to image
+ARG TOR_PACKAGE_VERSION=0.4.6.9-r0
+ARG NFTABLES_PACKAGE_VERSION=1.0.1-r0
+RUN apk add --no-cache \
+        nftables=$NFTABLES_PACKAGE_VERSION \
+        tor=$TOR_PACKAGE_VERSION
 VOLUME /var/lib/tor
 
 #RUN apk add --no-cache \
 #        less \
 #        man-db \
+#        strace \
 #        tor-doc=$TOR_PACKAGE_VERSION
 #ENV PAGER=less
 
@@ -14,10 +19,13 @@ EXPOSE 9050/tcp
 EXPOSE 9053/udp
 COPY torrc.template entrypoint.sh /
 RUN chmod -c a+rX /torrc.template /entrypoint.sh
-ENV SOCKS_TIMEOUT_SECONDS=
+ENV SOCKS_TIMEOUT_SECONDS= \
+    EXIT_NODES= \
+    EXCLUDE_EXIT_NODES=
 ENTRYPOINT ["/entrypoint.sh"]
 
-USER tor
+# entrypoint.sh drops privileges after configuring nftables for transparent proxy
+#USER tor
 CMD ["tor", "-f", "/tmp/torrc"]
 
 # keeping dns requests as network-liveness is too optimistic
@@ -27,3 +35,9 @@ HEALTHCHECK CMD \
         | grep -q network-liveness=up \
     && nslookup -port=9053 google.com localhost | grep -v NXDOMAIN | grep -q google \
     || exit 1
+
+# https://github.com/opencontainers/image-spec/blob/v1.0.1/annotations.md
+ARG REVISION=
+LABEL org.opencontainers.image.title="tor socks, dns & transparent proxy" \
+    org.opencontainers.image.source="https://github.com/fphammerle/docker-tor-proxy" \
+    org.opencontainers.image.revision="$REVISION"

Makefile

@@ -0,0 +1,32 @@
+IMAGE_NAME := docker.io/fphammerle/tor-proxy
+PROJECT_VERSION = $(shell git describe --match=v* --abbrev=0 --dirty | sed -e 's/^v//')
+TOR_PACKAGE_VERSION = $(shell grep -Po 'TOR_PACKAGE_VERSION=\K.+' Dockerfile | tr -d -)
+ARCH = $(shell arch)
+# architecture[arm_variant]
+# https://github.com/opencontainers/image-spec/blob/v1.0.1/image-index.md#image-index-property-descriptions
+IMAGE_TAG_ARCH_aarch64 = arm64
+IMAGE_TAG_ARCH_armv6l = armv6
+IMAGE_TAG_ARCH_armv7l = armv7
+IMAGE_TAG_ARCH_x86_64 = amd64
+IMAGE_TAG_ARCH = ${IMAGE_TAG_ARCH_${ARCH}}
+IMAGE_TAG = ${PROJECT_VERSION}-tor${TOR_PACKAGE_VERSION}-${IMAGE_TAG_ARCH}
+BUILD_PARAMS = --tag="${IMAGE_NAME}:${IMAGE_TAG}" \
+	--build-arg=REVISION="$(shell git rev-parse HEAD)"
+
+.PHONY: worktree-clean docker-build podman-build docker-push
+
+worktree-clean:
+	git diff --exit-code
+	git diff --staged --exit-code
+
+docker-build: worktree-clean
+	sudo docker build ${BUILD_PARAMS} .
+
+podman-build: worktree-clean
+	# --format=oci (default) not fully supported by hub.docker.com
+	# https://github.com/docker/hub-feedback/issues/1871#issuecomment-748924149
+	podman build --format=docker ${BUILD_PARAMS} .
+
+docker-push: docker-build
+	sudo docker push "${IMAGE_NAME}:${IMAGE_TAG}"
+	@echo git tag --sign --message '$(shell sudo docker image inspect --format '{{join .RepoDigests "\n"}}' "${IMAGE_NAME}:${IMAGE_TAG}" | sed "s/@/:${IMAGE_TAG}@/")' docker/${IMAGE_TAG} $(shell git rev-parse HEAD)

README.md

@@ -1,8 +1,8 @@
 # docker: tor socks & dns proxy 🌐 🐳
 
-docker hub: https://hub.docker.com/r/fphammerle/tor-proxy
+Docker Hub: https://hub.docker.com/r/fphammerle/tor-proxy
 
-signed tags: https://github.com/fphammerle/docker-tor-proxy/tags
+Signed image tags: https://github.com/fphammerle/docker-tor-proxy/tags
 
 ```sh
 $ sudo docker run --rm --name tor_proxy \
@@ -16,7 +16,7 @@ or after cloning the repository 🐙
 $ sudo docker-compose up
 ```
 
-### test proxies
+### Test Proxies
 
 ```sh
 $ curl --proxy socks5h://localhost:9050 ipinfo.io
@@ -28,30 +28,57 @@ $ ssh -o 'ProxyCommand nc -x localhost:9050 -v %h %p' abcdefghi.onion
 $ chromium-browser --proxy-server=socks5://localhost:9050 ipinfo.io
 ```
 
-### read-only root filesystem
+### Read-only Root Filesystem
 
-optionally add
+Optionally add
 ```sh
 $ sudo docker run --read-only -v tor_proxy_data:/var/lib/tor --tmpfs /tmp:rw,size=4k` …
 ```
-to make the container's root filesystem read-only
+to make the container's root filesystem read-only.
 
-### isolate
+### Isolate Host
 
 ```sh
 sudo iptables -A OUTPUT ! -o lo -j REJECT --reject-with icmp-admin-prohibited
 ```
 
-### change `SocksTimeout` option
+### Change `SocksTimeout` Option
 
 ```sh
 $ sudo docker run -e SOCKS_TIMEOUT_SECONDS=60 …
 ```
 
-### show circuits
+### Select Exit Nodes
 
 ```sh
-$ sudo docker exec tor_proxy \
-    sh -c 'printf "AUTHENTICATE\nGETINFO circuit-status\nQUIT\n" | nc localhost 9051'
+$ sudo docker run -e EXIT_NODES=1.2.3.4,1.2.3.5,{at} …
+```
+
+### Exclude Exit Nodes
+
+```sh
+$ sudo docker run -e EXCLUDE_EXIT_NODES=1.2.3.4,1.2.3.5 …
+```
+
+### Show Circuits
+
+```sh
+$ printf 'AUTHENTICATE\nGETINFO circuit-status\nQUIT\n' \
+    | sudo docker exec -i tor_proxy nc localhost 9051
 ```
 relay search: https://metrics.torproject.org/rs.html
+
+or using [onioncircuits](https://gitlab.tails.boum.org/tails/onioncircuits) ([debian repo](https://salsa.debian.org/pkg-privacy-team/onioncircuits)):
+```sh
+$ sudo apt-get install --no-install-recommends onioncircuits
+$ sudo nsenter --target "$(sudo docker inspect --format='{{.State.Pid}}' tor_proxy)" --net \
+    sudo -u $USER onioncircuits
+```
+
+### Troubleshooting
+
+Disable `SafeLogging` (temporarily) to log IP addresses instead of `[scrubbed]`:
+```
+$ printf 'AUTHENTICATE\nSETCONF SafeLogging=0\nGETCONF SafeLogging\nQUIT\n' \
+    | sudo docker exec -i tor_proxy nc localhost 9051
+```

docker-compose.yml

@@ -9,6 +9,8 @@ services:
     image: fphammerle/tor-proxy
     environment:
       SOCKS_TIMEOUT_SECONDS: 30
+      #EXIT_NODES: '1.2.3.4,1.2.3.5,{at}'
+      #EXCLUDE_EXIT_NODES: '{xx},{yy},1.2.3.4,128.0.0.0/1'
     volumes:
     - type: volume
       source: data
@@ -19,13 +21,14 @@ services:
       tmpfs:
         # nosuid,nodev,noexec added by default
         mode: '1777'
-        size: 4k
+        size: 5k
     read_only: yes
     ports:
     - '127.0.0.1:9050:9050/tcp'
     - '127.0.0.1:53:9053/udp'
     cap_drop: [ALL]
-    #cap_add: [SYS_PTRACE]
+    # entrypoint.sh drops privileges after configuring nftables for transparent proxy
+    cap_add: [NET_ADMIN, SETUID, SETGID]
     security_opt: [no-new-privileges]
     cpus: 0.5
     mem_limit: 128m

entrypoint.sh

@@ -2,6 +2,16 @@
 
 set -e
 
+if [ "$(id -u)" -eq 0 ]; then
+    nft add chain ip nat PREROUTING { type nat hook prerouting priority dstnat \; } || true
+    nft add rule ip nat PREROUTING ip protocol tcp fib daddr type != local counter redirect to :9040 \
+        || echo 'warning: failed to configure nftables for transparent proxy (missing CAP_NET_ADMIN?)'
+    nft add rule ip nat PREROUTING fib daddr type local udp dport 53 counter redirect to :9053 \
+        || echo 'warning: failed to configure nftables for DNS proxy' \
+                '(alternative for less flexible `docker run --publish 53:9053 ...`)'
+    exec su -s /bin/sh tor -- "$0" "$@"
+fi
+
 # default: 120 sec
 # https://github.com/torproject/tor/blob/tor-0.4.1.7/src/core/or/connection_edge.c#L1099
 if [ -z "$SOCKS_TIMEOUT_SECONDS" ]; then
@@ -10,4 +20,14 @@ else
     sed -e "s/{socks_timeout_seconds}/$SOCKS_TIMEOUT_SECONDS/" /torrc.template > /tmp/torrc
 fi
 
+# > list of identity fingerprints, country codes, and address patterns
+if [ ! -z "$EXIT_NODES" ]; then
+    echo -n 'ExitNodes ' >> /tmp/torrc
+    printenv EXIT_NODES >> /tmp/torrc
+fi
+if [ ! -z "$EXCLUDE_EXIT_NODES" ]; then
+    echo -n 'ExcludeExitNodes ' >> /tmp/torrc
+    printenv EXCLUDE_EXIT_NODES >> /tmp/torrc
+fi
+
 exec "$@"

nftables-package-log.url

@@ -0,0 +1 @@
+https://git.alpinelinux.org/aports/log/main/nftables?h=3.15-stable

tor-changelog.url

@@ -0,0 +1 @@
+https://gitweb.torproject.org/tor.git/plain/ChangeLog

tor-package-log.url

@@ -0,0 +1 @@
+https://git.alpinelinux.org/aports/log/community/tor?h=3.15-stable

torrc.template

@@ -1,3 +1,5 @@
+# https://www.torproject.org/docs/tor-manual.html.en
+
 # hide healthchecks:
 # > [notice] {CONTROL} New control connection opened from 127.0.0.1.
 Log [~control]notice warn stdout
@@ -14,5 +16,15 @@ DNSPort 0.0.0.0:9053
 SocksPort 0.0.0.0:9050
 SocksTimeout {socks_timeout_seconds}
 
+# requires netfilter rules
+# socks5 with auth-based circuit isolation (tor browser, torsocks --isolate) should be preferred
+# cave: IsolateDestAddr & IsolateDestPort are not enabled
+# https://gitlab.torproject.org/legacy/trac/-/wikis/doc/TransparentProxy
+# https://github.com/epidemics-scepticism/writing/blob/b6733379d653b30771d578ace04c262600345122/misconception.md#transparent-proxying-lacks-context
+# https://lists.torproject.org/pipermail/tor-talk/2014-March/032507.html
+# https://gitweb.torproject.org/tor.git/tree/src/or/connection_edge.c?id=6285d9bdcf7f210c56abd25f75133e30d05a7473#n1423
+# https://github.com/mitmproxy/mitmproxy/blob/v6.0.2/mitmproxy/platform/linux.py#L27
+TransPort 0.0.0.0:9040 IsolateClientAddr IsolateClientProtocol
+
 # try to
 HardwareAccel 1