mirror of
https://github.com/jmcorgan/fips.git
synced 2026-07-22 07:48:26 +00:00
6c90cf6c02
Add TorTransport in src/transport/tor/ supporting three operating modes: Outbound (socks5 mode): - Non-blocking SOCKS5 connect via tokio-socks with per-destination circuit isolation (IsolateSOCKSAuth) - TorAddr enum for .onion and clearnet address types - Connection pool with per-connection receive tasks, reuses TCP stream FMP framing - connect_async()/connection_state_sync()/promote_connection() follow the same non-blocking polling pattern as TCP transport Inbound (directory mode — recommended for production): - Tor manages the onion service via HiddenServiceDir in torrc - FIPS reads .onion address from hostname file at startup - No control port needed — enables Tor Sandbox 1 (seccomp-bpf) - Accept loop mirrors TCP pattern with DirectoryServiceConfig Monitoring (control_port mode and optional in directory mode): - Async control port client supporting TCP and Unix socket connections via Box<dyn AsyncRead/Write> trait objects - AUTHENTICATE with cookie or password auth - 8 GETINFO queries: bootstrap, circuits, traffic, liveness, version, dormant state, SOCKS listeners - Background monitoring task polls every 10s, caches TorMonitoringInfo in Arc<RwLock> for synchronous query access - Bootstrap milestone logging (25/50/75/100%), stall warning (>60s), network liveness transitions, dormant mode entry - Directory mode optionally connects to control port when control_addr is configured (non-fatal on failure) Operator visibility: - show_transports query exposes tor_mode, onion_address, tor_monitoring (bootstrap, circuit_established, traffic, liveness, version, dormant) - fipstop transport detail view: Tor mode, onion address, SOCKS5/control errors, connection stats, Tor daemon status section - fipstop table view: tor(mode) label with truncated onion address hint Security hardening: - Per-destination circuit isolation via IsolateSOCKSAuth - Unix socket default for control port (/run/tor/control) - Reference torrc with HiddenServiceDir, VanguardsLiteEnabled, ConnectionPadding, DoS protections (PoW + intro rate limiting) Config: - TorConfig with socks5, control_port, and directory modes - DirectoryServiceConfig: hostname_file, bind_addr - control_addr, control_auth, cookie_path, connect_timeout, max_inbound_connections Testing: - 69 unit + integration tests with mock SOCKS5 and control servers - Docker tests: socks5-outbound (clearnet via Tor) and directory-mode (HiddenServiceDir onion service) Documentation: - Transport layer design doc: Tor architecture, directory mode - Configuration doc: Tor config tables and examples
84 lines
3.0 KiB
Plaintext
84 lines
3.0 KiB
Plaintext
### FIPS-specific Tor configuration ###
|
|
###
|
|
### Reference torrc for running Tor alongside the FIPS daemon.
|
|
### Uses HiddenServiceDir (directory mode) for the onion service,
|
|
### which enables Sandbox mode — the strongest single hardening option.
|
|
###
|
|
### Install: cp torrc.fips /etc/tor/torrc
|
|
### Verify: tor --verify-config -f /etc/tor/torrc
|
|
###
|
|
### The corresponding fips.yaml transport section should be:
|
|
###
|
|
### transports:
|
|
### tor:
|
|
### mode: "directory"
|
|
### directory_service:
|
|
### hostname_file: "/var/lib/tor/fips_onion_service/hostname"
|
|
### bind_addr: "127.0.0.1:8443"
|
|
|
|
## Identity
|
|
DataDirectory /var/lib/tor
|
|
User debian-tor
|
|
|
|
## SOCKS proxy (for outbound peer connections)
|
|
## IsolateSOCKSAuth: username/password fields serve as circuit isolation
|
|
## keys — each FIPS peer destination gets its own Tor circuit.
|
|
## IsolateDestAddr + IsolateDestPort: additional isolation by destination.
|
|
## IsolateSOCKSAuth: required — FIPS uses SOCKS5 username/password fields
|
|
## as per-destination circuit isolation keys (not real authentication).
|
|
##
|
|
## SafeSocks 1 rejects SOCKS5 CONNECT to raw IP addresses. FIPS supports
|
|
## DNS hostnames in peer addresses — when clearnet peers use hostnames,
|
|
## they are passed through SOCKS5 for Tor-side resolution (no local DNS
|
|
## leak). Enable SafeSocks 1 when all clearnet peers use hostnames or
|
|
## when running .onion-only. Not enabled by default for compatibility
|
|
## with IP-addressed peers.
|
|
SocksPort 127.0.0.1:9050 IsolateSOCKSAuth
|
|
#TestSocks 1 # Enable during development only
|
|
|
|
## Control access (Unix socket, not TCP — filesystem permission control)
|
|
## Only needed if fips uses control_port mode. In directory mode, the
|
|
## control socket is not required but can be useful for monitoring.
|
|
ControlSocket /run/tor/control GroupWritable RelaxDirModeCheck
|
|
ControlSocketsGroupWritable 1
|
|
## Do NOT use ControlPort 9051 — TCP control ports are accessible to any
|
|
## local process that authenticates. Use Unix socket only.
|
|
|
|
## Authentication
|
|
CookieAuthentication 1
|
|
CookieAuthFileGroupReadable 1
|
|
CookieAuthFile /run/tor/control.authcookie
|
|
|
|
## Onion service (persistent, filesystem-managed by Tor)
|
|
## Tor manages the key in HiddenServiceDir. FIPS reads the .onion
|
|
## address from the hostname file at startup.
|
|
HiddenServiceDir /var/lib/tor/fips_onion_service
|
|
HiddenServicePort 8443 127.0.0.1:8443
|
|
|
|
## Onion service hardening
|
|
HiddenServiceMaxStreams 100
|
|
HiddenServiceMaxStreamsCloseCircuit 1
|
|
|
|
## Onion service DoS protection (Tor 0.4.8+)
|
|
## Intro point rate limiting — prevents introduction cell floods.
|
|
HiddenServiceEnableIntroDoSDefense 1
|
|
HiddenServiceEnableIntroDoSRatePerSec 25
|
|
HiddenServiceEnableIntroDoSBurstPerSec 200
|
|
|
|
## Proof-of-work defense — auto-scaling computational puzzle for clients.
|
|
## Minimal cost to legitimate peers, expensive for flood attacks.
|
|
HiddenServicePoWDefensesEnabled 1
|
|
HiddenServicePoWQueueRate 250
|
|
HiddenServicePoWQueueBurst 2500
|
|
|
|
## Security
|
|
ExitRelay 0
|
|
ExitPolicy reject *:*
|
|
Sandbox 1
|
|
VanguardsLiteEnabled 1
|
|
ConnectionPadding 1
|
|
SafeLogging 1
|
|
|
|
## Logging
|
|
Log notice syslog
|