# Keeps the sandboxed Tor Browser's user (tor-browser) off your computer and your local
# network (Wren Linux extras/tor-browser.sh). Only its traffic is touched.
# It may reach the internet, which its Tor needs. It doesn't force anything through Tor:
# browser and Tor are one user, so a hacked browser could go straight out and show your
# address. Whonix is what stops that.
# DNS goes only to the resolver this computer uses (parts/sandbox-dns.sh), for bridges
# given as names.
#
# On this computer it may reach only itself: its browser talks to its Tor (9150, 9151), and
# its Tor to a bridge's program, which listens on a port the system picks. No rule can tell
# that port from one of yours, so each such connection is marked, and the listener's answer
# gets out only if the listener is this user too. A program of yours never answers it, so
# nothing of yours is reached, on those ports or any other. The other way round too: its own
# listeners answer only connections it opened (marked), so a program of yours that connects
# to 127.0.0.1:9150, say, gets no answer from a hacked browser that took that port first.

table inet wren_tor_browser
delete table inet wren_tor_browser

table inet wren_tor_browser {
    # The resolver this computer uses, kept up to date by wren-sandbox-dns
    set resolvers {
        type ipv4_addr
    }
    chain output {
        type filter hook output priority 0; policy accept;
        # A listener that isn't this user, answering this user's marked connection
        ct mark 0x5752 oifname "lo" meta skuid != "tor-browser" reject with tcp reset
        meta skuid "tor-browser" jump tor_browser
    }

    chain tor_browser {
        # Its own programs answering each other. Answers only: a new connection comes from
        # such a port too, and would go out here unmarked, to anything on this computer. And
        # only on a connection it opened itself (marked below): not to one of yours
        ct direction reply ct mark 0x5752 ip saddr 127.0.0.1 tcp sport { 9150, 9151, 32768-60999 } accept
        ip daddr @resolvers udp dport 53 accept
        ip daddr @resolvers tcp dport 53 accept
        ip daddr 127.0.0.1 tcp dport { 9150, 9151, 32768-60999 } ct mark set 0x5752 accept
        # Anything addressed to this computer itself goes out through "lo"
        # (admin-prohibited: how bin/sandbox-net-check tells this from a closed port)
        oifname "lo" reject with icmpx admin-prohibited
        ip daddr { 0.0.0.0/8, 10.0.0.0/8, 100.64.0.0/10, 127.0.0.0/8,
                   169.254.0.0/16, 172.16.0.0/12, 192.168.0.0/16,
                   224.0.0.0/4, 255.255.255.255 } reject
        # No IPv6 at all: on a network with global addresses, the router and other
        # computers have addresses no fixed rule can tell from the internet's
        meta nfproto ipv6 reject
    }
}