Should it work from behind Tor (orjail)

[dpc]

So I'm playing with an iroh-based app that I put in orjail to enforce all networking goes through tor proxy. That makes UDP impossible, and probably only relay-based communication would ever work.

This seem to works for connecting to other endpoints (non-Tor ones), but my own endpoint does not seem to be able to accept connections with behind Tor at all (even from non-Tor ones).

I tried:

sudo orjail -n orjail-x env RUST_LOG=debug sendme send --ticket-type relay testfile

and this also seems to just effectively hang, with Iroh trying bunch of things under the hood.

Do you think peers behind Tor should eventually work?

[flub]

Privacy has not been a focus so far. That said, I agree it would be nice if the relay connections worked over tor.

Just thinking about the problem I don't see any reason why two nodes over tor should not work. If both nodes are successfully connected to the same relay server they should be able to communicate? Do the logs show anything useful? Usually I start with looking at ERROR and WARN, the look at iroh::_events on debug.

(I quickly tried orjail but the debian package is outdated and I'm not about to go though the auditing to trust a make install on my system.)

[dpc]

This is not a pressing issue for me, and just wanted to bring it to your attention, and see if there's any fundamental aspects that make it impossible. I think it might be a relatively easy test case too, and possibly iroh-net could even borrow some parts e.g. to set up multiple local network namespaces that act like separate machines, etc.

As for installing it. orjail is like 600 lines of bash just running somewhat standard Linux commands establishing network namespaces, etc. https://github.com/orjail/orjail/blob/master/usr/sbin/orjail . Half of it is handling command line args. There isn't much to install, probably will work downloaded and started from current directory. But yeah - it requires root to run some of these commands.

[dpc]

Turns out I was using old version. I was using iroh-net, and thus 0.28. After I was pointed out my mistake (thanks joshisan!), I upgraded and tried again, and it works. I have both client and server behind orjail and they are able to ping each other, I think through the relay, round trip is 2.5s, but it's beautiful.