{"action":"opened","issue":{"url":"https://api.github.com/repos/Bylon/TOR_Middlebox/issues/4","repository_url":"https://api.github.com/repos/Bylon/TOR_Middlebox","labels_url":"https://api.github.com/repos/Bylon/TOR_Middlebox/issues/4/labels{/name}","comments_url":"https://api.github.com/repos/Bylon/TOR_Middlebox/issues/4/comments","events_url":"https://api.github.com/repos/Bylon/TOR_Middlebox/issues/4/events","html_url":"https://github.com/Bylon/TOR_Middlebox/issues/4","id":277434287,"number":4,"title":"DNS resolution blocked (UDP blockage?)","user":{"login":"libBletchley","id":18015852,"avatar_url":"https://avatars1.githubusercontent.com/u/18015852?v=4","gravatar_id":"","url":"https://api.github.com/users/libBletchley","html_url":"https://github.com/libBletchley","followers_url":"https://api.github.com/users/libBletchley/followers","following_url":"https://api.github.com/users/libBletchley/following{/other_user}","gists_url":"https://api.github.com/users/libBletchley/gists{/gist_id}","starred_url":"https://api.github.com/users/libBletchley/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/libBletchley/subscriptions","organizations_url":"https://api.github.com/users/libBletchley/orgs","repos_url":"https://api.github.com/users/libBletchley/repos","events_url":"https://api.github.com/users/libBletchley/events{/privacy}","received_events_url":"https://api.github.com/users/libBletchley/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2017-11-28T15:49:26Z","updated_at":"2017-11-28T15:49:26Z","closed_at":null,"author_association":"NONE","body":"When using _firejail_ to sandbox a _wget_ session over the TOR middlebox, the DNS resolution fails when the host is not something I've recently accessed (and thus the IP is not cached):\r\n```\r\n# firejail --noprofile --net=vnet0 wget 'https://raw.githubusercontent.com/netblue30/firejail/master/etc/fetchmail.profile'\r\nParent pid 31690, child pid 31691\r\nThe new log directory is /proc/31691/root/var/log\r\n\r\nInterface        MAC                IP               Mask             Status\r\nlo                                  127.0.0.1        255.0.0.0        UP\r\neth0             xx:xx:xx:xx:xx:xx  172.16.0.244     255.255.255.0    UP\r\nDefault gateway 172.16.0.1\r\n\r\nChild process initialized\r\n--2017-11-28 16:29:06--  https://raw.githubusercontent.com/netblue30/firejail/master/etc/fetchmail.profile\r\nResolving raw.githubusercontent.com (raw.githubusercontent.com)... failed: Name or service not known.\r\nwget: unable to resolve host address ‘raw.githubusercontent.com’\r\n\r\nParent is shutting down, bye...\r\n```\r\nSo it seems the TOR middlebox is somehow botching the DNS lookup.  I understand that DNS requests are at least sometimes UDP, which middlebox is probably dropping.  However, there must be a way to deal with this.. to force the lookup to happen over TCP, because _torsocks_ works, and so does _tor-resolve_.\r\n\r\nI have a slight suspicion that it's similar to this bug: https://github.com/netblue30/firejail/issues/1591.  But in that case it can be addressed by firejail.  In the case of forcing a firejail over tor, there can be no expectation that the sandboxed app be aware of `tor-resolve`.  Is this something that can be solved in the middlebox?"}}
{"actor":{"display_login":"libBletchley"}}