2

I tried to use the hidden service of an email provider with claws mail. I start the client with torify claws mail, but it doesn't work. I only get:

Connection to hiddenmailservice.onion:995 failed.

Network log writes:

 Account 'Hidden mail service': Connecting to POP3 server: hiddenmailservice.onion:995...

The console additionally threw:

WARNING torsocks[14724]: [connect] Connection to a local address are denied since it might be a TCP DNS query to a local DNS server. Rejecting it for safety reasons. (in tsocks_connect() at connect.c:177)
connect: Operation not permitted

** (claws-mail:14724): WARNING **: can't connect to server.

This message appears instantly, so it seems that claws-mail didn't even try to connect. When I change the server to its clearnet name it works though. Is there any possibility to use claws-mail with onion services?

Improve this question
2
  • My guess is that .onion resolves to a localhost address and so torsocks won't work in that case, you could add AllowOutboundLocalhost 1 to /etc/tor/torsocks.conf.
    – cacahuatl
    Sep 6, 2016 at 20:21
  • lol strangely I can reproduce this but only for POP3, IMAP works fine. Will investigate and see if I can find anything...
    – cacahuatl
    Sep 7, 2016 at 6:59

2 Answers 2

Reset to default
1

claws-mail is conflicting with torsocks.

First, how torsocks handles .onion. torsocks works by intercepting certain function calls, mostly related to network functionality. One of those it intercepts is the getaddrinfo call, which resolves a DNS address to it's corresponding IP address. When it receives a request for an .onion it instead of resolving it returns an IP address (by default 127.42.42.0 through to 127.42.42.255) and stores the IP address and the .onion together in a table in the processes memory. If, in the future it sees a request to connect to an IP in it's special range, it first tries to find it in the table, if it exists it connects to the corresponding .onion it saw trying to be resolved before.

The problem is that claws-mail is creating a second process, then resolving the address to connect to and then telling the second process the IP. The second process didn't inherit the table mapping the .onion to the IP address (because it was fork()ed before the lookup happened), so it thinks it's trying to connect to a local address (because the second process can't find it in its copy of the table) and fails it.

This only happens with POP3, my testing suggests IMAP works fine. Unfortunately this means POP3 with claws-mail simply will not work with torsocks. There is a similar known issue with irssi (the IRC client) and how it resolves the address it intends to connect to.

Improve this answer
2
  • Thanks for the answer. Well, it's a pity. For some reasons I prefered POP over IMAP, not only because of this security issue However, this seems to be fixed in newer versions of claws-mail.
    – frosty2
    Sep 7, 2016 at 20:35
  • If you want to you can try performing Transparent Proxying for onions, but I wouldn't do it without other packet filter rules to enforce Tor usage. Sylpheed is another lightweight FLOSS mail client, it has native SOCKS5 support and may be worth a look.
    – cacahuatl
    Sep 8, 2016 at 2:07
0

Maybe using other mail client can solve the problem, for example thunderbird which can be run on Windows and *nix systems. My tutorial about configuring thunderbird in order to be used in TOR network, can be found here.

If you are looking for a mail client on Android, check my contribution in K9 Android mail client. You can find the source code on my GitHub.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .