Impact:
Tor Browser developers plan changes that would break Whonix's Tor over Tor prevention. Changes, that would make it hard for manually downloaded, unmodified TBB tarballs to work in Whonix out of the box while preventing Tor over Tor.
Details:
The current implementation of anon-ws-disable-stacked-tor using rinetd (design documentation, see footnote) will not work forever.
Tor implemented [SocksSocket](https://trac.torproject.org/projects/tor/ticket/12585) option (unix domain sockets) version 0.2.6.3-alpha. Tor Browser will start using . (Reference)
To make things worse, currently the environment variables TOR_SOCKS_HOST and TOR_SOCKS_PORT are broken. (upstream bug report)
Related Upstream Bug:
torrc's SocksSocket breaks tor-service-defaults-torrc's SocksPort
Solution?
We might be able to solve this using socat. Because socat is apparently able to man-in-the-middle unix domain sockets. By using something like this (untested). (source)
sudo mv /path/to/sock /path/to/sock.original sudo socat -t100 -x -v UNIX-LISTEN:/path/to/sock,mode=777,reuseaddr,fork UNIX-CONNECT:/path/to/sock.original
We might be able to redirect that unix domain socket to Whonix-Gateway.
Either directly to Whonix-Gateway (if we want to abolish rinetd).
sudo socat -t100 -x -v UNIX-LISTEN:/path/to/sock,mode=777,reuseaddr,fork TCP4:10.152.152.10:9150
Or to existing rinetd to keep things simpler for custom gateway IP's and Qubes.
sudo socat -t100 -x -v UNIX-LISTEN:/path/to/sock,mode=777,reuseaddr,fork TCP4:127.0.0.1:9150
Timing the renaming of TBB's unix domain socket file so we can intercept and redirect it seems difficult and error prone. Therefore it would be best if TBB supported an environment variable to connect to existing unix domain socket files. -> upstream feature request
Dev Test Toolbox:
For installation of Tor that comes with the SocksSocket option. /etc/apt/sources.list.d/torproject.list
deb http://deb.torproject.org/torproject.org tor-experimental-0.2.6.x-wheezy main
/etc/apparmor.d/local/system_tor AppArmor permission.
/{,var/}run/tor/socket rw,/etc/tor/torrc
SocksSocketsGroupWritable 1 SocksPort unix:/var/run/tor/socket
Test if the socket can be talked to.
socat - UNIX-CONNECT:/var/run/tor/socket GET
Create unix domain socket file /home/user/test.socket and forward to /var/run/tor/socket as proof of concept.
sudo socat -t100 -x -v UNIX-LISTEN:/home/user/test.socket,mode=777,reuseaddr,fork UNIX-CONNECT:/var/run/tor/socket
Test if the socket can be talked to.
socat - UNIX-CONNECT:./test.socket GET
Proof of concept is functional.
Forum user support thread:
https://forums.whonix.org/t/tor-browser-6-5a4-connectivity-broken-blocked-by-apparmor-profile-since-tbb-changed-to-sockssocket