In my setup I have main process, which is Node.js app and there should be torified worker, which basically a child process.

I spawn it using follwoing command spawn('torsocks nodejs torworker ')

The goal is to setup IPC channel between parent process and child worker process. Net sockets are not working: connection refused.

is there a way to establish an IPC channel?


Extending after cacahuatl.

Torsocks and SOCKS5 integration can both have issues. Setting up a transparent proxy instead ensures that (1) torsocks isn't evaded by accidentally unsetting the LD_PRELOAD and (2) does not rely on the software knowing about and correctly using SOCKS5.

Without libtorsocks.so restricting the syscalls and networking your software is less likely to trip on the transproxy.

Usually the transparent proxy configuration is to forward all TCP traffic from all users (excluding the dedicated tor daemon itself) and drop all UDP traffic, except for DNS which is resolved via tor. You may configure this such that only a special user's traffic traverses tor.

If you'd like to take this the next step further, you may move the tor gateway from your computer to the router such that a local compromise does not reveal your IP. However a local compromise may reveal mac addresses and serial numbers which can be traced. Tails, Whonix and QubesOS each take their own attempt to mitigate the risks without hardware isolation.

  • Transparent proxying however, lacks context and can result in applications sharing circuits and linking identities together in ways the user wouldn't expect. The torsocks wrapper script avoids situations where LD_PRELOAD would be stripped, e.g. when a process is setuid or setcap enabled. – cacahuatl Mar 13 '18 at 0:15
  • @cacahuatl Incorrect. You can divide users between transparent ports. Or divide based on process trees, or any filter that iptables supports. – cypherfox Mar 13 '18 at 2:40
  • There is approximately no documentation for those and given that users applications run under the same user uid, isolation by uid isn't so great. It can still link identities together. – cacahuatl Mar 13 '18 at 23:13
  • @cacahuatl All the documentation for IPTABLES is easily available. I do agree that we need better tooling for this. I have a custom script that I run on my laptop and another custom script for my phone. On Android this is a lot easier because each application has its own user. SImilarly, the way I use my laptop I have multiple users for basic de-cluttering of the filesystem, network isolation isjust another benefit. I might consider publishing these and simplifying the configuration from editing the script to a simple configuration. Would you be intersted in this? – cypherfox Mar 14 '18 at 2:16
  • @cacahuatl And as I said you can use process trees via cgroups for sub-user isolation; I haven't implemented this as I don't need to. But it is not so different from selecting users by uid. – cypherfox Mar 14 '18 at 2:18

torsocks blocks specific connection types to ensure that applications do not leak.

For this reason it is incompatible with certain applications, it seems that whatever inter-process channel method Node is using is one such connection method.

torsocks itself should produce output to stderr to notify you if it blocked some function call and if so which and why. This should give you the necessary information to find a suitable solution.

One solution would be to get the node application to use a native SOCKS proxy, instead of using torsocks to wrap the entire nodejs process.

A worse solution might be to look at setting exceptions to the anti-leak protections put in place by torsocks through tweaking torsocks.conf (by default located at /etc/tor/torsocks.conf), by for example setting AllowOutboundLocalhost 1 or if that still doesn't work AllowOutboundLocalhost 2, where 1 allows you to make TCP connections to localhost, and 2 allows you to make both TCP and UDP connections to localhost. For more information, check out man 5 torsocks.conf.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.