TTP 0.4.8 – transparent Tor proxy for Linux, and the leak tests that were passing for the wrong reason

I maintain TTP, a Linux CLI that routes system TCP and DNS through Tor using nftables. That part isn't novel – kalitorify, nipe and others do it.

What I want feedback on is the verification, because I found my own test suite was lying to me.

assert len(leaks) == 0 is also true when the sniffer never started, when the interface name was wrong, or when the traffic never left the process. It passes whether or not the firewall works. So every containment test now runs its stimulus twice: once with the ruleset flushed, where the packet MUST be captured, and then with the ruleset loaded, where it must not. A harness that cannot see a leak now fails instead of passing.

Ten tests, each in an ephemeral network namespace: DNS over UDP and TCP, plain TCP, DoT on 853, QUIC DoH on UDP/443 (the path NAT redirection can't touch), ICMP, arbitrary UDP, IPv6 – plus the reverse assertion that a bypassed UID still reaches the LAN, so a firewall that blocked everything couldn't pass either.

Doing this broke things, which is the point. Tightening the probes turned three passes into failures: nftables reject returns EPERM to the local socket, so a refused send was the firewall working correctly and I had been reading it as a broken test.

Caveat up front: this is not Whonix and not Tails. Transparent proxying routes connections; it does nothing about browser fingerprints, TLS client hellos, or any application-layer identifier. If your threat model is a state adversary, use Tails, Whonix, or others.

Code: https://github.com/onyks-os/TransparentTorProxy Docs: https://onyks-os.github.io/ttp/

Tell me what else in there could pass without being true.