OnionGuard

OnionGuard is a robust open-source admission-control engine tailored specifically for anonymous services and Tor Onion Services. It operates on a production-grade, zero-trust model, ensuring secure HTTP request management without relying on traditional client-based mechanisms, which are ineffective in the context of Tor.

Overview

Traditional solutions like Cloudflare and AWS WAF falter when it comes to Tor networks due to:

• Absence of IP Addresses: All traffic originates from loopback or internal Tor daemon proxies.
• Tor Users Disable JavaScript: For enhanced security, many Tor Browser users opt for the 'Safest' mode, bypassing client-side challenges.
• Violation of Privacy: Browser fingerprinting techniques undermine anonymity, breaching fundamental privacy guarantees.

OnionGuard is specifically designed to tackle these challenges by enforcing advanced access control measures, including:

• Progressive access control strategies
• Proof-of-patience wait rooms
• Server-rendered zero-JS CAPTCHAs
• Cryptographic session management
• Distributed rate limiting, all while entirely circumventing client IP evaluations.

Key Features

• Zero-Trust Framework: Implements a sophisticated 4-tier identity model that entirely disregards client IPs, focusing on authenticated sessions and tokens.
• Optimized Performance: Achieves high throughput with minimal latency, significantly reducing Redis overhead by 66%.
• Completely No-JS: Employs an innovative Go-based CAPTCHA generator functioning effectively under stringent Tor security settings.
• Cryptographically Secure Sessions: Utilizes 256-bit session tokens, ensuring enhanced security against session hijacking.
• Modular Design with Zero Dependencies: The core library operates independently, resulting in a lightweight implementation with isolated modules.
• Comprehensive Rate Limiting: Offers multiple tiers of independent quotas for various visitor types, bolstering resource management and protection against abuse.
• Robust Anti-Bot Mechanisms: Automatically demotes repeated offenders to waiting states, refreshing their challenge timelines.
• Privacy-First Monitoring: Integrates Prometheus-compatible metrics to allow for observability without compromising user anonymity.

Architecture

OnionGuard’s architecture elegantly handles HTTP requests, utilizing middleware for secure processing:

                      ┌─────────────────────────────────────────────┐
                      │         HTTP Requests (Tor / Clear)         │
                      └──────────────────────┬──────────────────────┘
                                             │
              ┌──────────────────────────────┴──────────────────────────────┐
              ▼                                                             ▼
  ┌──────────────────────────┐                             ┌──────────────────────────┐
  │   net/http Middleware    │                             │  Fiber v2 Submodule      │
  │  - onionguard/middleware │                             │  - middleware/fiber      │
  └────────────┬─────────────┘                             └────────────┬─────────────┘
               └──────────────────────┬─────────────────────────────────┘
                                      ▼
                      ┌──────────────────────────────┐
                      │      OnionGuard Engine       │
                      │  - ResolveWithSession (1x)   │
                      │  - AuthorizeRequest          │
                      │  - EvaluateFresh             │
                      └──────────────┬───────────────┘
                                     │
        ┌────────────┬───────────────┼───────────────┬────────────┐
        ▼            ▼               ▼               ▼            ▼
   Identity      Session &      Wait Room &     Rate Limiter   Security
    Model       Admission      CAPTCHA Engine  (Token Bucket)  Headers
   (4 Tiers)    (7 States)     (Zero-JS PNG)   (Multi-Scope)   (CSP, no-store)

Quick Start

The setup for OnionGuard is straightforward, with support for both the Go standard library and the Fiber v2 framework. Below is a minimal example:

package main

import (
	"log"
	"net/http"
	"time"
	og "github.com/ihatemyfcklife/onionguard"
	"github.com/ihatemyfcklife/onionguard/middleware"
)

func main() {
	cfg := og.DefaultConfig()
	cfg.WaitRoom.Enabled = true
	cfg.WaitRoom.WaitTime = 5 * time.Second
	cfg.Captcha.Enabled = true

	engine, err := og.New(cfg)
	if err != nil {
		log.Fatalf("failed to initialize onionguard: %v", err)
	}
	defer engine.Close()

	mux := http.NewServeMux()
	mux.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
		if id, ok := og.ClientIdentityFromContext(r.Context()); ok {
			log.Printf("Admitted client: kind=%s, principal=%s", id.Kind, id.PrincipalID)
		}
		w.Header().Set("Content-Type", "text/plain; charset=utf-8")
		w.Write([]byte("Access granted: Welcome to OnionGuard protected service!\n"))
	})

	handler := middleware.Middleware(engine)(mux)

	srv := &http.Server{
		Addr:              ":8080",
		Handler:           handler,
		ReadHeaderTimeout: 5 * time.Second,
		ReadTimeout:       15 * time.Second,
		WriteTimeout:      15 * time.Second,
		IdleTimeout:       60 * time.Second,
		MaxHeaderBytes:    16 * 1024,
	}

	log.Printf("Server listening on http://localhost:8080")
	log.Fatal(srv.ListenAndServe())
}

Conclusion

OnionGuard represents a significant advancement in managing admission controls for anonymous services. With its zero-trust architecture, it provides a secure, reliable, and efficient method of ensuring user access while preserving the anonymity and privacy essential to the Tor ecosystem. Its innovative features and sophisticated security measures make it an optimal choice for developers ready to deploy robust solutions in anonymous environments.