center2055/OnionHop v3.10

OnionHop 3.10

on GitHub

The command line version for Raspberry Pi and other ARM Linux boards, TUN mode on Linux without running OnionHop as root, and a Smart Connect that checks every route at once.

Smart Connect

• Checks every route before connecting, all at once. In censored countries Smart Connect first checks which routes answer. It checked them one after another, so on a slow network often only the first got checked in time, and it skipped Snowflake, meek, conjure and dnstt, the routes that matter most where censorship is heaviest. All routes are now checked side by side, those four by a real TLS connection to the domain fronts, Amazon SQS queue or DNS resolver they actually connect to. Routes where nothing answers are tried last.
• Tells your networks apart where the address lookups are blocked (#89). Smart Connect remembers what works per network, keyed on your public address. Where that lookup is blocked, every network in the country shared one memory. It now goes by the router your computer connects through, so a home connection and a phone's hotspot keep separate memories.
• A timed-out attempt says where it stopped (#89). Instead of "Connection canceled or timed out.", a timeout names the step Tor had reached and what that means, for example "Timed out at 5% (Connecting to a relay): no connection to a bridge or relay got through", with how many connections the transport reported failing.

Linux

• TUN mode without running OnionHop as root (#90). TUN/VPN mode told you to relaunch the whole app with sudo. OnionHop now asks for your password through polkit (pkexec) when the tunnel starts, as the macOS app does, and runs only the tunnel as root. This works in the CLI too. The kill switch and the system DNS settings still need OnionHop itself to run as root.

Command line

• Builds for ARM Linux (#89). The CLI is now also published for 64-bit ARM (linux-arm64) and 32-bit ARMv7 (linux-arm), for example for a Raspberry Pi that shares Tor with its network.
• Works like the app (#89). It runs the same route check as the app, tries what failed on your network recently last and what worked there first, and reports how each attempt went, with its time and reason.
• Shares Tor with your network. connect --lan on shares the SOCKS and HTTP proxy on every interface and lists the addresses other devices can use. --lan-interface wlan0 shares it on that one interface only, such as a router's LAN side.
• Runs as a service. SIGTERM and SIGHUP now disconnect and stop Tor like Ctrl+C, the output stays readable under systemd, and the CLI starts without libicu. The README shows how to run it as a systemd service.
• --bridge-type is tried first with Smart Connect on, --sni host1,host2 sets the fronts for snowflake, meek and webtunnel bridges, and --help works.

Fixed

• The Snowflake proxy's traffic numbers show correctly on Windows (#91). The arrows in its traffic summary came out as garbage such as "鈫?" on Chinese Windows.
• The exit IP shows up on slow connections. Over a slow bridge it showed as --.--.--.-- for the whole session; the lookup is now tried again in the background.
• The Scanner page works in short windows. The page scrolls, and its results list keeps a usable height.
• Every package ships the same sing-box. The Windows portable zip and the macOS DMGs took whatever sing-box was newest when they were built. All packages now bundle sing-box 1.13.13, and the builds check the sing-box and Xray downloads against pinned checksums.
• The Linux CLI works for a service user. It crashed on an account that had never run it, and the package's Tor files could only be read by whoever unpacked it. Both broke the README's systemd setup.

Downloads