Release Notes - Transparent Tor Proxy (TTP) v0.4.0

This release introduces native IPv6 routing, firewall rule reordering to mitigate DNS leaks, enhanced watchdog daemon resilience, and extended DNS-over-HTTPS (DoH) mitigation.

Technical Highlights

Dual-Stack IPv6 Support

TTP now supports native IPv6 routing alongside IPv4.

• Automatic detection of IPv6 loopback interfaces.
• Dynamic generation of dual-stack or IPv4-only Tor configurations depending on kernel availability.
• Redirection of IPv6 DNS and TCP traffic through Tor via dedicated nftables rules in [firewall.py](file:///home/onyks/Documents/GitHub/TransparentTorProxy/ttp/firewall.py).
• Bypassing of IPv6 local ranges (RFC 4193 and RFC 3927) to maintain local device connectivity.

DNS Leak Mitigation (Firewall Rule Reordering)

A critical security issue where cached DNS requests could bypass Tor has been resolved.

• Issue: The nftables output chain evaluated the LAN bypass rule before the DNS redirect rule. Browsers caching the local gateway IP as the system DNS resolver would have their queries accepted directly by the LAN bypass rule, bypassing Tor and leaking the real ISP DNS resolver.
• Fix: In both the output and prerouting chains, the DNS redirect rules have been placed before the LAN bypass rules, ensuring all DNS traffic is intercepted.

Watchdog Resilience & Active Checks

The background watchdog daemon ([watchdog.py](file:///home/onyks/Documents/GitHub/TransparentTorProxy/ttp/watchdog.py)) has been refactored for increased system reliability:

• Network Link-State Handling: Watchdog checks are suspended during physical network carrier drops or default route removals to prevent false-positive emergency lockouts.
• Active Health Queries: Replaced local socket connection checks with an active get_info("status/bootstrap-phase") query via the Tor control socket to detect crashed or unresponsive Tor daemons with stale socket files.
• Immediate Killswitch: If an auto-healing operation returns a failure status, the emergency killswitch is triggered immediately without stabilization delays.

DNS-over-HTTPS (DoH) Prevention

To prevent web browsers from bypassing system DNS settings via embedded resolvers:

• The torrc canary domain configuration has been extended to include Cloudflare, Google, Quad9, OpenDNS, and AdGuard.
• Added packet filtering rules to reject outgoing TCP port 443 traffic destined for known public DoH resolver IPs.

Detailed Changelog

Added

• Native IPv6 transparent routing and loopback/local bypass.
• Network interface and route drop detection in the watchdog loop.
• Global --log-format json option for structured log output.
• Cloudflare, Google, Quad9, OpenDNS, and AdGuard DoH canary domain mapping.
• IP-level blocking for common public DoH resolvers on TCP port 443.
• Format verification check using Ruff in scripts/verify.sh.

Fixed

• Reordered firewall rules to prevent DNS query leaks to the LAN gateway.
• Changed watchdog Tor health validation to an active query to detect stale sockets.
• Forced immediate killswitch activation on auto-healing failure.
• Updated SELinux module verification in scripts/install.sh to check for version 1.1.

Upgrade Instructions

Source Installation

Pull the latest source code and execute the install script:

git pull origin main
sudo ./scripts/install.sh

Package Installation

Install the updated package corresponding to the target Linux distribution:

• Debian/Ubuntu: sudo apt install ./packaging/transparent-tor-proxy_0.4.0_all.deb
• Fedora: sudo dnf upgrade ./packaging/transparent-tor-proxy-0.4.0-1.fc43.noarch.rpm
• Arch Linux: cd packaging && makepkg -si