Enabling Tor hidden services and other non-Internet networks via a dedicated IPv6 range and a DNS server

[ivucica]

Is your feature request related to a problem? tun2socks would be a cool way to access not just the public Internet over SOCKS proxies including Tor, but also Tor hidden services -- and do so with programs that are otherwise unaware of SOCKS4A or SOCKS5. In fact, it could transparently tunnel other devices on the network.

However, this means IP-based systems need to be able to resolve the hostnames to some IP address before even attempting the connection, and tun2socks needs to be aware of what hostname to use in the request from the SOCKS server (as the IP address would simply not work).

Tor happens to use either:

• v2 hostnames: base32-encoded 16 characters representing first 80 bits of the 160 bit SHA1 hash of the DER-encoded ASN.1 public key
• v3 hostnames: base32-encoded 56 characters representing a SHA3 hash including a version byte

Describe the solution you'd like v2 hostnames are mappable to IPv6: 80 bits fits into a /48. This was previously done by @benjojo: a small nameserver resolving AAAA records, and an ip6tables-based redirection to a small Go program, which then tunnels traffic over SOCKS5 to Tor. See six-onions. The IPv6 netblock would be configurable.

It feels like building this DNS server and the mapping-back-to-hostnames process into this tun2socks would be a cleaner solution. Perhaps it could listen for UDP+TCP traffic on a configurable IPv4 or IPv6 address, or be disabled and don't try to forcibly turn hostnames back into hostnames.

Since Tor's v3 hostnames mean the above hack conveniently fitting 80-bits into an IPv6 address won't work, a more generalized solution (which then works for non-Tor situations as well) would be better in either Ben's work, or here:

• use a map with maximum capacity, or with a TTL on each entry, mapping IPv6 address in the 'general traffic' netblock to a hostname
• for each DNS lookup (possibly restricted to a certain DNS zone), assign a completely arbitrary address within the 'general traffic' netblock, and store the IPv6 address->hostname mapping
• for each new TCPv6 connection known to be made towards the 'general traffic' netblock, check if there IPv6 is present in the map, and use appropriate hostname when talking to the SOCKS5 proxy accordingly
• if the Tor-specific hack makes sense to implement as well, for a v2 .onion hostname, use a slightly different IPv6 'v2 .onion' netblock so that the mapping can be done without maintaining the map

This might complicate the proxy/socks5.go code, so it may make sense to create a new wrapper around the socks5 implementation.

Describe alternatives you've considered Hypothetically all this could be done outside of tun2socks -- but it seems like tun2socks is the perfect place to inspect that map.

For instance, one could write a combined SOCKS5 proxy+local DNS server in front of the actual SOCKS5 proxy such as Tor, which would replace the IPv6 address provided by tun2socks with the hostname recorded by the DNS server during the AAAA record resolution, and only then pass on traffic to Tor.

Another alternative is to patch up @benjojo's work, but this seems like an even hackier approach.

All in all, I feel like this belongs inside tun2socks -- as long as it can be switched off for use cases that do not require this.

Additional context I've noticed that README_ZH.md is slightly different and that it explicitly says 'no DNS'. Machine translation:

tun2socks should only focus on forwarding TCP/UDP traffic at the network layer to the SOCKS server. Other module functions such as DNS (DoH) and DHCP should be implemented by third-party applications, so the DNS module is abandoned.

I mostly agree with the statement about DHCP, and I mostly agree about DNS: however, the need to record AAAA->hostname reverse mapping makes this a difficult thing to pull off outside tun2socks, since tun2socks is the one that decides what hostname to use when talking to Tor.

A priori, I don't know enough about gVisor nor about the old go-tun2socks implementation to judge whether tun2socks is really the best place to do this.

Would you say this is worth exploring?

[benjojo]

Amusingly I just shutdown six-onions since v2 services are end of life. I was thinking about how to do v3, and concluded a custom DNS server and (redirected IPv6 range + proxy translator) (just like in the original six-onions)

The idea being I think similar to what you suggested, is that you "mint" v6 addresses on demand that link the the much longer onion addresses to v6 addresses. And have some long ish TTL for them (like 24 hours) and a rate limit to prevent database growth based attacks.

[ivucica]

...hah, until your comment above, I thought 2a07:1500:fed5::/48 was used merely as an arbitrarily selected routable-looking range, and that people were meant to start up six-onions locally!

[benjojo]

Oh no you could have used the provided DNS server. And even CNAME to them. But you also could have run the DNS server locally if you wanted to

On Wed, 5 Jan 2022, 17:51 Ivan Vučica, @.***> wrote:

...hah, until your comment above, I thought 2a07:1500:fed5::/48 was used merely as an arbitrarily selected routable-looking range, and that people were meant to start up six-onions locally!

— Reply to this email directly, view it on GitHub https://github.com/xjasonlyu/tun2socks/issues/92#issuecomment-1005943784, or unsubscribe https://github.com/notifications/unsubscribe-auth/AALPK4SLYKVERANWSF44733UUSAI7ANCNFSM5LKIQAVQ . Triage notifications on the go with GitHub Mobile for iOS https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675 or Android https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub.

You are receiving this because you were mentioned.Message ID: @.***>

[github-actions[bot]]

This issue is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 7 days

[KnockKnockWho]

Tor supports --AutomapHostsOnResolve 1. It should do what you want to achieve. You need to use it together with --DNSPort which allows you to specify an address which a DNS server is bound to. Then you configure your system to use that DNS server. The Tor SOCKS layer will then handle the mapping for you without requiring changes to tun2socks.