Torsocks vs Proxychains?

Question

I often alternate between torsocks/proxychains when using wget, youtube-dl, gpg2, ssh, pacman and more [non-multithreading] applications. If torsocks breaks or seems abnormally slow, I'll likely try proxychains and vice versa. Other applications like curl I use the built-in proxy flags. But I wonder how certain applications handle dns requests. It seems safer to proxy the entire command.

What are some notable pros/cons to using torsocks/proxychains with any of the above applications? Should torsocks be priority over proxychains? Is one better with dns leaks than the other? Or should I just continue to use my patented whatever-fucking-works method?

Some examples of usage:

$ cat /etc/pacman.conf

XferCommand = /usr/bin/torsocks /usr/bin/wget --passive-ftp -c -O %o %u

$ proxychains youtube-dl --no-part https://www.youtube.com/lamevideo

$ torsocks ssh -i somekey [email protected] -p 54321

$ torsocks gpg2 --keyserver pool.sks-keyservers.net --recv-keys 0x4E2C6E8793298290

$ proxychains wget --https-only https://website.com/download.tar

Answer 1

You should prefer torsocks over proxychains, since torsocks is intended to block potential leaks.

Especially in cases with tools like youtube-dl which might try to pass over execution to programs that can make network connections of their own in unexpected or attacker controlled ways.

Specifically with proxychains, if anything wrapped in proxychains tries to make any call to connect on an address that isn't a TCP internet connection, it will allow it to go through.

Looking at libproxychains.c from the source code, we see the following...

Here it finds the original "connect" function and creates a "true_connect" function to provide the original "connect" call, which it has replaced with it's own "connect" function:

static void init_lib()
{
...
    true_connect = (connect_t) dlsym(RTLD_NEXT, "connect");
...
}

Here, inside their replacement "connect" function it looks at the type of socket it's being asked to connect, if it is not an internet TCP connection, it passes it to the "true_connect" function, allowing the connection through without proxying:

int connect (int sock, const struct sockaddr *addr, unsigned int len)
{
...
    getsockopt(sock,SOL_SOCKET,SO_TYPE,&socktype,&optlen);
    if (! (SOCKFAMILY(*addr)==AF_INET  && socktype==SOCK_STREAM))
        return true_connect(sock,addr,len);
...
}

This means applications could accidentally connect or leak information about Tor usage or link Tor usage to your real connection. Similarly if you do not explicitly tell it to proxy DNS requests it will perform DNS lookups outside of Tor instead.

Conversely, torsocks will deny such connection attempts stopping such accidental leaks and will use tor to perform the DNS resolution.