release v4.4.0

Bumps [docker/build-push-action](https://github.com/docker/build-push-action) from 2.5.0 to 2.6.1.
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](https://github.com/docker/build-push-action/compare/v2.5.0...v2.6.1)

---
updated-dependencies:
- dependency-name: docker/build-push-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

.github/dependabot.yml

@@ -1,3 +1,5 @@
+# sync with https://github.com/fphammerle/docker-onion-service/blob/master/.github/dependabot.yml
+
 version: 2
 
 updates:
@@ -6,5 +8,11 @@ updates:
   schedule:
     interval: weekly
     day: friday
+- package-ecosystem: github-actions
+  directory: /
+  # > YAML aliases are not supported
+  schedule:
+    interval: weekly
+    day: friday
 
 # https://docs.github.com/en/free-pro-team@latest/github/administering-a-repository/configuration-options-for-dependency-updates

.github/workflows/container-image.yml

@@ -0,0 +1,26 @@
+# sync with https://github.com/fphammerle/docker-onion-service/blob/master/.github/workflows/container-image.yml
+
+name: container image
+
+on:
+  push:
+  pull_request:
+  schedule:
+  - cron: '0 20 * * 5'
+
+jobs:
+  docker-build:
+    runs-on: ubuntu-20.04
+    steps:
+    - uses: docker/setup-qemu-action@v1.2.0
+    - uses: docker/setup-buildx-action@v1.4.1
+    # > By default, this action uses the Git context so you don't need to use
+    # > the actions/checkout action to checkout the repository because this
+    # > will be done directly by buildkit. [...]
+    # > any file mutation in the steps that precede [...] will be ignored
+    # https://github.com/marketplace/actions/build-and-push-docker-images
+    - uses: docker/build-push-action@v2.6.1
+      with:
+        platforms: |
+          linux/amd64
+          linux/arm/v7

CHANGELOG.md

@@ -6,6 +6,21 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [4.4.0] - 2021-07-07
+### Added
+- added ability to exclude exit nodes via `EXCLUDE_EXIT_NODES` environment variable
+
+## [4.3.1] - 2021-05-15
+### Fixed
+- create prerouting chain if not already created by container runtime
+  (fixes dns proxy with direct routing & transparent proxy on some hosts)
+
+## [4.3.0] - 2021-05-07
+### Added
+- when running entrypoint as `uid=0`:
+  add `nftables` rule forwarding udp dns requests (port 53) to tor
+  (alternative for less flexible `docker run --publish 53:9053 …`)
+
 ## [4.2.0] - 2021-04-30
 ### Added
 - when running entrypoint as `uid=0`:
@@ -68,7 +83,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Added
 - tor socks5 & DNS proxy
 
-[Unreleased]: https://github.com/fphammerle/docker-tor-proxy/compare/v4.2.0...HEAD
+[Unreleased]: https://github.com/fphammerle/docker-tor-proxy/compare/v4.4.0...HEAD
+[4.4.0]: https://github.com/fphammerle/docker-tor-proxy/compare/v4.3.1...v4.4.0
+[4.3.1]: https://github.com/fphammerle/docker-tor-proxy/compare/v4.3.0...v4.3.1
+[4.3.0]: https://github.com/fphammerle/docker-tor-proxy/compare/v4.2.0...v4.3.0
 [4.2.0]: https://github.com/fphammerle/docker-tor-proxy/compare/v4.1.0...v4.2.0
 [4.1.0]: https://github.com/fphammerle/docker-tor-proxy/compare/v4.0.0...v4.1.0
 [4.0.0]: https://github.com/fphammerle/docker-tor-proxy/compare/v3.0.0...v4.0.0

Dockerfile

@@ -1,8 +1,8 @@
-FROM docker.io/alpine:3.13.5
+FROM docker.io/alpine:3.14.0
 
 # nftables + dependencies add 2.3MB to image
-ARG TOR_PACKAGE_VERSION=0.4.4.8-r0
-ARG NFTABLES_PACKAGE_VERSION=0.9.7-r0
+ARG TOR_PACKAGE_VERSION=0.4.5.9-r0
+ARG NFTABLES_PACKAGE_VERSION=0.9.9-r0
 RUN apk add --no-cache \
         nftables=$NFTABLES_PACKAGE_VERSION \
         tor=$TOR_PACKAGE_VERSION
@@ -11,6 +11,7 @@ VOLUME /var/lib/tor
 #RUN apk add --no-cache \
 #        less \
 #        man-db \
+#        strace \
 #        tor-doc=$TOR_PACKAGE_VERSION
 #ENV PAGER=less
 

README.md

@@ -48,6 +48,12 @@ sudo iptables -A OUTPUT ! -o lo -j REJECT --reject-with icmp-admin-prohibited
 $ sudo docker run -e SOCKS_TIMEOUT_SECONDS=60 …
 ```
 
+### Exclude Exit Nodes
+
+```sh
+$ sudo docker run -e EXCLUDE_EXIT_NODES=1.2.3.4,1.2.3.5 …
+```
+
 ### Show Circuits
 
 ```sh

docker-compose.yml

@@ -9,6 +9,7 @@ services:
     image: fphammerle/tor-proxy
     environment:
       SOCKS_TIMEOUT_SECONDS: 30
+      #EXCLUDE_EXIT_NODES: '{xx},{yy},1.2.3.4,128.0.0.0/1'
     volumes:
     - type: volume
       source: data
@@ -19,7 +20,7 @@ services:
       tmpfs:
         # nosuid,nodev,noexec added by default
         mode: '1777'
-        size: 4k
+        size: 5k
     read_only: yes
     ports:
     - '127.0.0.1:9050:9050/tcp'

entrypoint.sh

@@ -3,8 +3,12 @@
 set -e
 
 if [ "$(id -u)" -eq 0 ]; then
+    nft add chain ip nat PREROUTING { type nat hook prerouting priority dstnat \; } || true
     nft add rule ip nat PREROUTING ip protocol tcp fib daddr type != local counter redirect to :9040 \
-        || echo 'failed to configure nftables for transparent proxy (missing CAP_NET_ADMIN?)'
+        || echo 'warning: failed to configure nftables for transparent proxy (missing CAP_NET_ADMIN?)'
+    nft add rule ip nat PREROUTING fib daddr type local udp dport 53 counter redirect to :9053 \
+        || echo 'warning: failed to configure nftables for DNS proxy' \
+                '(alternative for less flexible `docker run --publish 53:9053 ...`)'
     exec su -s /bin/sh tor -- "$0" "$@"
 fi
 
@@ -16,4 +20,10 @@ else
     sed -e "s/{socks_timeout_seconds}/$SOCKS_TIMEOUT_SECONDS/" /torrc.template > /tmp/torrc
 fi
 
+if [ -z "$EXCLUDE_EXIT_NODES" ]; then
+    sed --in-place -e '/{exclude_exit_nodes}/d' /tmp/torrc
+else
+    sed --in-place -e "s#{exclude_exit_nodes}#$EXCLUDE_EXIT_NODES#" /tmp/torrc
+fi
+
 exec "$@"

torrc.template

@@ -26,5 +26,7 @@ SocksTimeout {socks_timeout_seconds}
 # https://github.com/mitmproxy/mitmproxy/blob/v6.0.2/mitmproxy/platform/linux.py#L27
 TransPort 0.0.0.0:9040 IsolateClientAddr IsolateClientProtocol
 
+ExcludeExitNodes {exclude_exit_nodes}
+
 # try to
 HardwareAccel 1