OpenBSD, Tor transparent local proxy.

Background

Just in the case that you've missed our last article we're speaking about OpenBSD, the most secure open source system operative in the world, and Tor, a free software for enabling anonymous communication.
In our first post we have done an introduction and a first configuration creating a tor service with only one local socks port opened for a static user configuration.
We've also introduced the concept of FVEY that we will continue to analyze as soon as possible.
What we don't touch last time is the important fact that this two fabolous softwares have got a strange difficult history of interoperability between them. OpenBSD is in ours life from middle of the nineteen and Tor, the onion router project, from september 2002.

But only with the birth of the torbsd proyect the configuration of the anonymizing daemon is something simple and easy as it have to be. We can study read and fork the work of the torbsd fellowes at github.

Tor daemon in a OpenBSD system

Starting from a clean OpenBSD install we will install Tor from packages:

$ doas pkg_add -U tor
$ doas pkg_add -U arm # ncurse control tool

To see what files were added to our operative system with the install of those two packages simply use (package tor in the example):

$ pkg_info -L tor
Information for inst:tor-0.3.0.10
Files:
/usr/local/bin/tor
/usr/local/bin/tor-gencert
/usr/local/bin/tor-resolve
/usr/local/man/man1/tor-gencert.1
/usr/local/man/man1/tor-resolve.1
/usr/local/man/man1/tor.1
/usr/local/share/doc/tor/tor-gencert.html
/usr/local/share/doc/tor/tor-resolve.html
/usr/local/share/doc/tor/tor.html
/usr/local/share/examples/tor/torrc.sample
/usr/local/share/tor/geoip
/usr/local/share/tor/geoip6
/etc/rc.d/tor

The torrc file

tor network

Now we have to configure the torrc file in /etc/tor/torrc :

$ doas cat <<EOF >> /etc/tor/torrc
User _tor
RunAsDaemon 1
AvoidDiskWrites 1
GeoIPFile /usr/local/share/tor/geoip
GeoIPv6File /usr/local/share/tor/geoip6
VirtualAddrNetwork 10.192.0.0/10
AutomapHostsOnResolve 1
TransPort 127.0.0.1:9040
DNSPort 127.0.0.1:53
DataDirectory /var/tor 
Log notice file /var/log/tor_log 
ControlPort 127.0.0.1:9051           
CookieAuthentication 1        
ExcludeNodes {AU}, {CA}, {US}, {NZ}, {GB}, {DK}, {FR}, {NL}, {NO}, {BE}, {DE}, {IT}, {ES}, {SE}
NodeFamily {AU}, {CA}, {US}, {NZ}, {GB}, {DK}, {FR}, {NL}, {NO}, {BE}, {DE}, {IT}, {ES}, {SE}
StrictNodes 1
GeoIPExcludeUnknown 1
SocksPort 127.0.0.1:9900
PathsNeededToBuildCircuits 0.95
EOF

Prepare the environment:

$ doas mkdir /var/tor
$ doas chown -R _tor:_tor /var/tor
$ doas chown _tor:_tor /dev/pf
$ doas touch /var/log/tor_log
$ doas chown _tor:_tor /var/log/tor_log

Let's explain every option in the torrc :

User: after open the sockets the daemon will work under the UID of.
RunAsDaemon: to launch or not the daemon in the background.
AvoidDiskWrites: try to write to disk less frequently.
GeoIpFile: where is in the fs tree.
GeoIpv6File: where is in the fs tree.
VirtualAddrNetwork: will try to explain later.
AutomapHostsOnResolve: control VirtualAddrNetwork.
TransPort: transparent proxy port where tor communicate with pf.
DnsPort: port where tor dns resolver accept queries.
DataDirectory: where tor put his session stuff.
Log notice file: log file (don't know why accept spaces here).
ControlPort: port where arm or others have to connect to control tor.
CookieAuthentication: bool to indicate the authentication mode in control port.
ExcludeNodes: where we don't want to go in ours tor circuits using ISO 3166 country code.
NodeFamily: build a unique family with those codes.
StrictNodes: strictly respect our ExcludeNodes list.
GeoIPExcludeUnknown: if it don't know where is the tor relay simply don't use it.
SocksPort: static port socks 4/5 listener (will deepen later).
PathsNeededToBuildCircuits: tor won’t build circuits until it has enough descriptors or microdescriptors to construct that fraction of possible paths.

Now we've to be sure that dhclientwill not rewrite /etc/resolv.conf. In OpenBSD we've to add this to /etc/dhcpclient.conf:

$ doas cat <<EOF >> /etc/dhclient.conf
    supersede domain-name-servers 127.0.0.1;
EOF
$ doas sh /etc/netstart

The pf.conf file

the pf firewall

OpenBSD was the first system operative to use one of the most powerful firewall, pf.
In others POST we will better analyze how to properly use this monster, but for now simply use this pf.conf to create a transparent firewall in an OpenBSD system newer than the 4.7 version.
We create another loopback interface in our system to play a little with internal routing:

$ doas ifconfig lo1 create up 127.0.0.2
$ doas cat <<EOF >> /etc/hostname.lo1
inet 127.0.0.2
EOF

And use those directives in our pf.conf :

$ doas cat <<EOF >> /etc/pf.conf
# destinations you don't want routed through Tor
non_tor = "{ 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 }"
# Tor's TransPort
trans_port = "9040"

match in all scrub (no-df random-id reassemble tcp)
antispoof for egress inet
block return log on egress all

pass in quick on lo1 inet proto tcp all flags S/SA modulate state rdr-to 127.0.0.1 port $trans_port
pass in quick on lo1 inet proto udp to port domain rdr-to 127.0.0.1 port domain

pass quick on { lo0 lo1 }

pass out quick inet proto tcp user _tor flags S/SA modulate state
pass out quick inet proto udp to port domain route-to lo1
pass out quick inet to $non_tor
pass out inet proto tcp all route-to lo1
EOF