1

In my setup I have main process, which is Node.js app and there should be torified worker, which basically a child process.

I spawn it using follwoing command spawn('torsocks nodejs torworker ')

The goal is to setup IPC channel between parent process and child worker process. Net sockets are not working: connection refused.

is there a way to establish an IPC channel?

Improve this question

2 Answers 2

Reset to default
1

Extending after cacahuatl.

Torsocks and SOCKS5 integration can both have issues. Setting up a transparent proxy instead ensures that (1) torsocks isn't evaded by accidentally unsetting the LD_PRELOAD and (2) does not rely on the software knowing about and correctly using SOCKS5.

Without libtorsocks.so restricting the syscalls and networking your software is less likely to trip on the transproxy.

Usually the transparent proxy configuration is to forward all TCP traffic from all users (excluding the dedicated tor daemon itself) and drop all UDP traffic, except for DNS which is resolved via tor. You may configure this such that only a special user's traffic traverses tor.

If you'd like to take this the next step further, you may move the tor gateway from your computer to the router such that a local compromise does not reveal your IP. However a local compromise may reveal mac addresses and serial numbers which can be traced. Tails, Whonix and QubesOS each take their own attempt to mitigate the risks without hardware isolation.

Improve this answer
8
  • Transparent proxying however, lacks context and can result in applications sharing circuits and linking identities together in ways the user wouldn't expect. The torsocks wrapper script avoids situations where LD_PRELOAD would be stripped, e.g. when a process is setuid or setcap enabled.
    – cacahuatl
    Mar 13, 2018 at 0:15
  • @cacahuatl Incorrect. You can divide users between transparent ports. Or divide based on process trees, or any filter that iptables supports.
    – cypherfox
    Mar 13, 2018 at 2:40
  • There is approximately no documentation for those and given that users applications run under the same user uid, isolation by uid isn't so great. It can still link identities together.
    – cacahuatl
    Mar 13, 2018 at 23:13
  • @cacahuatl All the documentation for IPTABLES is easily available. I do agree that we need better tooling for this. I have a custom script that I run on my laptop and another custom script for my phone. On Android this is a lot easier because each application has its own user. SImilarly, the way I use my laptop I have multiple users for basic de-cluttering of the filesystem, network isolation isjust another benefit. I might consider publishing these and simplifying the configuration from editing the script to a simple configuration. Would you be intersted in this?
    – cypherfox
    Mar 14, 2018 at 2:16
  • @cacahuatl And as I said you can use process trees via cgroups for sub-user isolation; I haven't implemented this as I don't need to. But it is not so different from selecting users by uid.
    – cypherfox
    Mar 14, 2018 at 2:18
0

torsocks blocks specific connection types to ensure that applications do not leak.

For this reason it is incompatible with certain applications, it seems that whatever inter-process channel method Node is using is one such connection method.

torsocks itself should produce output to stderr to notify you if it blocked some function call and if so which and why. This should give you the necessary information to find a suitable solution.

One solution would be to get the node application to use a native SOCKS proxy, instead of using torsocks to wrap the entire nodejs process.

A worse solution might be to look at setting exceptions to the anti-leak protections put in place by torsocks through tweaking torsocks.conf (by default located at /etc/tor/torsocks.conf), by for example setting AllowOutboundLocalhost 1 or if that still doesn't work AllowOutboundLocalhost 2, where 1 allows you to make TCP connections to localhost, and 2 allows you to make both TCP and UDP connections to localhost. For more information, check out man 5 torsocks.conf.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .