search

bugfest / tor-controller

Tor toolkit for Kubernetes (Tor instances, onion services and more)
Apache License 2.0
102 stars 16 forks source link

[REQUEST] Force all traffic on the namespace where controller is deployed though Tor #7

Closed samip5 closed 2 years ago

samip5 commented 2 years ago

Is your feature request related to a problem? Please describe. Traffic to the internet from the onions leak though the normal internet connection

Describe the solution you'd like I would like all traffic in that namespace to route though the Tor network

Describe alternatives you've considered N/A

Additional context It would probably be an value that one could set.

bugfest commented 2 years ago

Hi @samip5,

AFAIK TOR can only transport TCP traffic so you'll still face data leaks for UDP traffic. Forwarding all the namespace traffic to a tor instance probably requires a custom CNI plugin in your k8s cluster. Multus does a great job there, but probably will be too complex.

Other possible approach is that if your apps can use a sock proxy, we can implement a Tor socks port to be available in the namespace as a cluster service. If socks is not suportted, but your app(s) talk http and can use an HTTP proxy; one could use an http-to-socks proxy (e.g privoxy) sidecar to let pod get to Internet thru it (container -> sidecar http -> tor socks -> (tor network) -> tor exit node -> internet).

Can you explain a bit more your use case?

samip5 commented 2 years ago

I want a Tor mail server onion, which needs traffic routed though Tor by default. Preferably all traffic from a namespace.

bugfest commented 2 years ago

is your mail server capable of using a socks v4/v5 service?

samip5 commented 2 years ago

is your mail server capable of using a socks v4/v5 service?

That would be a no, as Postfix doesn't seem to have support for it.

bugfest commented 2 years ago

You might try tsocks to reroute the traffic thru a socks service: https://man.archlinux.org/man/extra/tsocks/tsocks.1.en - if that works, you have two options: A new TOR deployment/pod exposing the socks port and your app using it for outgoing traffic or enable socks port in the pod the one the OnionService spins to get your hidden service set up.

bugfest commented 2 years ago

I'm preparing a new CRD to create a Tor socks service. That should help to fulfill this requirement

bugfest commented 2 years ago

I'm still working on it - I'm close to release the feature

bugfest commented 2 years ago

Hi @samip5,

A similar feature was asked in #19

I've just pushed a Tor object implementation that you can use to spin a Tor instance exposing Socks/HTTPTunnel/DNS and NATD services in your cluster with traffic being routed thru the Tor network. Branch: tor-crd-0.6.1.

As soon as I finish the build/tests I'll merge the changes.