release v4.3.1

Bumps alpine from 3.13.4 to 3.13.5.

Signed-off-by: dependabot[bot] <support@github.com>

CHANGELOG.md

@@ -6,6 +6,22 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [4.3.1] - 2021-05-15
+### Fixed
+- create prerouting chain if not already created by container runtime
+  (fixes dns proxy with direct routing & transparent proxy on some hosts)
+
+## [4.3.0] - 2021-05-07
+### Added
+- when running entrypoint as `uid=0`:
+  add `nftables` rule forwarding udp dns requests (port 53) to tor
+  (alternative for less flexible `docker run --publish 53:9053 …`)
+
+## [4.2.0] - 2021-04-30
+### Added
+- when running entrypoint as `uid=0`:
+  add `nftables` rule redirecting `tcp` traffic to transparent proxy
+
 ## [4.1.0] - 2021-03-03
 ### Added
 - enabled transparent proxy, listening on port `9040` (requires netfilter rules)
@@ -63,7 +79,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Added
 - tor socks5 & DNS proxy
 
-[Unreleased]: https://github.com/fphammerle/docker-tor-proxy/compare/v4.1.0...HEAD
+[Unreleased]: https://github.com/fphammerle/docker-tor-proxy/compare/v4.3.1...HEAD
+[4.3.1]: https://github.com/fphammerle/docker-tor-proxy/compare/v4.3.0...v4.3.1
+[4.3.0]: https://github.com/fphammerle/docker-tor-proxy/compare/v4.2.0...v4.3.0
+[4.2.0]: https://github.com/fphammerle/docker-tor-proxy/compare/v4.1.0...v4.2.0
 [4.1.0]: https://github.com/fphammerle/docker-tor-proxy/compare/v4.0.0...v4.1.0
 [4.0.0]: https://github.com/fphammerle/docker-tor-proxy/compare/v3.0.0...v4.0.0
 [3.0.0]: https://github.com/fphammerle/docker-tor-proxy/compare/v2.1.0...v3.0.0

Dockerfile

@@ -1,7 +1,11 @@
-FROM docker.io/alpine:3.13.2
+FROM docker.io/alpine:3.13.5
 
-ARG TOR_PACKAGE_VERSION=0.4.4.7-r1
-RUN apk add --no-cache tor=$TOR_PACKAGE_VERSION
+# nftables + dependencies add 2.3MB to image
+ARG TOR_PACKAGE_VERSION=0.4.4.8-r0
+ARG NFTABLES_PACKAGE_VERSION=0.9.7-r0
+RUN apk add --no-cache \
+        nftables=$NFTABLES_PACKAGE_VERSION \
+        tor=$TOR_PACKAGE_VERSION
 VOLUME /var/lib/tor
 
 #RUN apk add --no-cache \
@@ -17,7 +21,8 @@ RUN chmod -c a+rX /torrc.template /entrypoint.sh
 ENV SOCKS_TIMEOUT_SECONDS=
 ENTRYPOINT ["/entrypoint.sh"]
 
-USER tor
+# entrypoint.sh drops privileges after configuring nftables for transparent proxy
+#USER tor
 CMD ["tor", "-f", "/tmp/torrc"]
 
 # keeping dns requests as network-liveness is too optimistic

README.md

@@ -1,8 +1,8 @@
 # docker: tor socks & dns proxy 🌐 🐳
 
-docker hub: https://hub.docker.com/r/fphammerle/tor-proxy
+Docker Hub: https://hub.docker.com/r/fphammerle/tor-proxy
 
-signed tags: https://github.com/fphammerle/docker-tor-proxy/tags
+Signed image tags: https://github.com/fphammerle/docker-tor-proxy/tags
 
 ```sh
 $ sudo docker run --rm --name tor_proxy \
@@ -16,7 +16,7 @@ or after cloning the repository 🐙
 $ sudo docker-compose up
 ```
 
-### test proxies
+### Test Proxies
 
 ```sh
 $ curl --proxy socks5h://localhost:9050 ipinfo.io
@@ -28,30 +28,45 @@ $ ssh -o 'ProxyCommand nc -x localhost:9050 -v %h %p' abcdefghi.onion
 $ chromium-browser --proxy-server=socks5://localhost:9050 ipinfo.io
 ```
 
-### read-only root filesystem
+### Read-only Root Filesystem
 
-optionally add
+Optionally add
 ```sh
 $ sudo docker run --read-only -v tor_proxy_data:/var/lib/tor --tmpfs /tmp:rw,size=4k` …
 ```
-to make the container's root filesystem read-only
+to make the container's root filesystem read-only.
 
-### isolate
+### Isolate Host
 
 ```sh
 sudo iptables -A OUTPUT ! -o lo -j REJECT --reject-with icmp-admin-prohibited
 ```
 
-### change `SocksTimeout` option
+### Change `SocksTimeout` Option
 
 ```sh
 $ sudo docker run -e SOCKS_TIMEOUT_SECONDS=60 …
 ```
 
-### show circuits
+### Show Circuits
 
 ```sh
-$ sudo docker exec tor_proxy \
-    sh -c 'printf "AUTHENTICATE\nGETINFO circuit-status\nQUIT\n" | nc localhost 9051'
+$ printf 'AUTHENTICATE\nGETINFO circuit-status\nQUIT\n' \
+    | sudo docker exec -i tor_proxy nc localhost 9051
 ```
 relay search: https://metrics.torproject.org/rs.html
+
+or using [onioncircuits](https://gitlab.tails.boum.org/tails/onioncircuits) ([debian repo](https://salsa.debian.org/pkg-privacy-team/onioncircuits)):
+```sh
+$ sudo apt-get install --no-install-recommends onioncircuits
+$ sudo nsenter --target "$(sudo docker inspect --format='{{.State.Pid}}' tor_proxy)" --net \
+    sudo -u $USER onioncircuits
+```
+
+### Troubleshooting
+
+Disable `SafeLogging` (temporarily) to log IP addresses instead of `[scrubbed]`:
+```
+$ printf 'AUTHENTICATE\nSETCONF SafeLogging=0\nGETCONF SafeLogging\nQUIT\n' \
+    | sudo docker exec -i tor_proxy nc localhost 9051
+```

docker-compose.yml

@@ -25,7 +25,8 @@ services:
     - '127.0.0.1:9050:9050/tcp'
     - '127.0.0.1:53:9053/udp'
     cap_drop: [ALL]
-    #cap_add: [SYS_PTRACE]
+    # entrypoint.sh drops privileges after configuring nftables for transparent proxy
+    cap_add: [NET_ADMIN, SETUID, SETGID]
     security_opt: [no-new-privileges]
     cpus: 0.5
     mem_limit: 128m

entrypoint.sh

@@ -2,6 +2,16 @@
 
 set -e
 
+if [ "$(id -u)" -eq 0 ]; then
+    nft add chain ip nat PREROUTING { type nat hook prerouting priority dstnat \; } || true
+    nft add rule ip nat PREROUTING ip protocol tcp fib daddr type != local counter redirect to :9040 \
+        || echo 'warning: failed to configure nftables for transparent proxy (missing CAP_NET_ADMIN?)'
+    nft add rule ip nat PREROUTING fib daddr type local udp dport 53 counter redirect to :9053 \
+        || echo 'warning: failed to configure nftables for DNS proxy' \
+                '(alternative for less flexible `docker run --publish 53:9053 ...`)'
+    exec su -s /bin/sh tor -- "$0" "$@"
+fi
+
 # default: 120 sec
 # https://github.com/torproject/tor/blob/tor-0.4.1.7/src/core/or/connection_edge.c#L1099
 if [ -z "$SOCKS_TIMEOUT_SECONDS" ]; then