+ Onionr Web Control Panel
+ + Home +
Friend Manager
+ +Friend List:
+None Yet :(
+ 
+
+
+Node statistics
+
+
+
+Friend/contact manager
+
+
+
+Encrypted, metadata-masking mail application.
+
# Install and Run on Linux
The following applies to Ubuntu Bionic. Other distros may have different package or command names.
-* Have python3.5+, python3-pip, Tor (daemon, not browser) installed (python3-dev recommended)
+* Have python3.6+, python3-pip, Tor (daemon, not browser) installed (python3-dev recommended)
* Clone the git repo: `$ git clone https://gitlab.com/beardog/onionr`
* cd into install direction: `$ cd onionr/`
-* Install the Python dependencies ([virtualenv strongly recommended](https://virtualenv.pypa.io/en/stable/userguide/)): `$ pip3 install -r requirements.txt`
+* Install the Python dependencies ([virtualenv strongly recommended](https://virtualenv.pypa.io/en/stable/userguide/)): `$ pip3 install --require-hashes -r requirements.txt`
+
+(--require-hashes is intended to prevent exploitation via compromise of Pypi/CA certificates)
## Help out
Everyone is welcome to help out. Help is wanted for the following:
* Development (Get in touch first)
- * Creation of a lib for use from other languages and faster proof-of-work
+ * Creation of a shared lib for use from other languages and faster proof-of-work
* Android and IOS development
- * Windows and Mac support
+ * Windows and Mac support (already partially supported, testers needed)
* General bug fixes and development of new features
* Testing
+* UI/UX design
* Running stable nodes
* Security review/audit
* Automatic I2P setup
-Bitcoin: [1onion55FXzm6h8KQw3zFw2igpHcV7LPq](bitcoin:1onion55FXzm6h8KQw3zFw2igpHcV7LPq)
-USD: [Ko-Fi](https://www.ko-fi.com/beardogkf)
+Contribute money:
+
+Donating at least $5 gets you cool Onionr stickers. Get in touch if you want them.
+
+Bitcoin: [1onion55FXzm6h8KQw3zFw2igpHcV7LPq](bitcoin:1onion55FXzm6h8KQw3zFw2igpHcV7LPq) (Contact us for privacy coins like Monero)
+
+USD (Card/Paypal): [Ko-Fi](https://www.ko-fi.com/beardogkf)
+
+Note: probably not tax deductible
+
+## Contact
+
+beardog [ at ] mailbox.org
## Disclaimer
-The Tor Project, I2P developers, and anyone else do not own, create, or endorse this project, and are not otherwise involved.
+The Tor Project and I2P developers do not own, create, or endorse this project, and are not otherwise involved.
-The 'open source badge' is by Maik Ellerbrock and is licensed under a Creative Commons Attribution 4.0 International License.
\ No newline at end of file
+Tor is a trademark for the Tor Project. We do not own it.
+
+The 'open source badge' is by Maik Ellerbrock and is licensed under a Creative Commons Attribution 4.0 International License.
+
+## Logo
+
+The Onionr logo was created by [Anhar Ismail](https://github.com/anharismail) under the [Creative Commons Attribution 4.0 International License](https://creativecommons.org/licenses/by/4.0/).
+
+If you modify and redistribute our code ("forking"), please use a different logo and project name to avoid confusion. Please do not use our logo in a way that makes it seem like we endorse you without permission.
\ No newline at end of file
diff --git a/docs/network-comparison.png b/docs/network-comparison.png
new file mode 100644
index 00000000..0d1f42e6
Binary files /dev/null and b/docs/network-comparison.png differ
diff --git a/docs/onionr-1.png b/docs/onionr-1.png
new file mode 100644
index 00000000..c498fe8f
Binary files /dev/null and b/docs/onionr-1.png differ
diff --git a/docs/onionr-2.png b/docs/onionr-2.png
new file mode 100644
index 00000000..1407d96d
Binary files /dev/null and b/docs/onionr-2.png differ
diff --git a/docs/onionr-3.png b/docs/onionr-3.png
new file mode 100644
index 00000000..d31230d5
Binary files /dev/null and b/docs/onionr-3.png differ
diff --git a/docs/whitepaper.md b/docs/whitepaper.md
index 8c5d0f96..ca2eb080 100755
--- a/docs/whitepaper.md
+++ b/docs/whitepaper.md
@@ -1,25 +1,25 @@
-
+
Anonymous, Decentralized, Distributed Network
# Introduction -One of the most important things in the modern world is information. The ability to communicate freely with others is crucial for maintaining personal liberties. The internet has provided humanity with the ability to spread information globally, but there are many people who try (and sometimes succeed) to stifle the flow of information. +We believe that the ability to communicate freely with others is crucial for maintaining societal and personal liberty. The internet has provided humanity with the ability to spread information globally, but there are many persons and organizations who try to stifle the flow of information, sometimes with success. -Internet censorship comes in many forms, state censorship, corporate consolidation of media, threats of violence, network exploitation (e.g. denial of service attacks). +Internet censorship comes in many forms, state censorship, corporate consolidation of media, threats of violence, network exploitation (e.g. denial of service attacks) and other threats. -To prevent censorship or loss of information, these measures must be in place: +We hold that in order to protect individual privacy, users must have the ability to communicate anonymously and with decentralization. -* Resistance to censorship of underlying infrastructure or of network hosts +We believe that in order to prevent censorship and loss of information, these measures must be in place: + +* Resistance to censorship of underlying infrastructure or of particular network hosts * Anonymization of users by default - * The Inability to coerce human users (personal threats/"doxxing", or totalitarian regime censorship) + * The Inability to coerce users (personal threats/"doxxing", or totalitarian regime censorship) * Economic availability. A system should not rely on a single device to be constantly online, and should not be overly expensive to use. The majority of people in the world own cell phones, but comparatively few own personal computers, particularly in developing countries. Internet connectivity can be slow or spotty in many areas. -There are many great projects that tackle decentralization and privacy issues, but there are none which tackle all of the above issues. Some of the existing networks have also not worked well in practice, or are more complicated than they need to be. - # Onionr Design Goals When designing Onionr we had these main goals in mind: @@ -91,6 +91,54 @@ In addition, randomness beacons such as the one operated by [NIST](https://beaco # Direct Connections -We propose a method of using Onionr's block sync system to enable direct connections between peers by having one peer request to connect to another using the peer's public key. Since the request is within a standard block, proof of work must be used to request connection. If the requested peer is available and wishes to accept the connection,Onionr will generate a temporary .onion address for the other peer to connect to. Alternatively, a reverse connection may be formed, which is faster to establish but requires a message brokering system instead of a standard socket. +We propose a method of using Onionr's block sync system to enable direct connections between peers by having one peer request to connect to another using the peer's public key. Since the request is within a standard block, proof of work must be used to request connection. If the requested peer is available and wishes to accept the connection, Onionr will generate a temporary .onion address for the other peer to connect to. Alternatively, a reverse connection may be formed, which is faster to establish but requires a message brokering system instead of a standard socket. -The benefits of such a system are increased privacy, and the ability to anonymously communicate from multiple devices at once. In a traditional onion service, one's online status can be monitored and more easily correlated. \ No newline at end of file +The benefits of such a system are increased privacy, and the ability to anonymously communicate from multiple devices at once. In a traditional onion service, one's online status can be monitored and more easily correlated. + +# Threat Model + +The goal of Onionr is to provide a method of distributing information in a manner in which the difficulty of discovering the identity of those sending and receiving the information is greatly increased. In this section we detail what information we want to protect and who we're protecting it from. + +In this threat model, "protected" means available in plaintext only to those which it was intended, and regardless non-malleable + +## Threat Actors + +Onionr assumes that traffic/data is being surveilled by powerful actors on every level but the user's device. + +We also assume that the actors are capable of the following: + +* Running tens of thousands of Onionr nodes +* Surveiling most of the Tor and I2P networks + +## Protected Data + +We seek to protect the following information: + +* Contents of private data. E.g. 'mail' messages and secret files +* Relationship metadata. Unless something is desired to be published publicly, we seek to hide the creator and recipients of such data. +* Physical location/IP address of nodes on the network +* All block data from tampering + +### Data we cannot or do not protect + +* Data specifically inserted as plaintext is available to the public +* The public key of signed plaintext blocks +* The fact that one is using Tor or I2P + * The fact that one is using Onionr specifically can likely be discovered using long term traffic analysis + * Intense traffic analysis may be able to discover what node created a block. For this reason we offer a high security setting to only share blocks via uploads that we recommend for those who need the best privacy. + +## Assumptions + +We assume that Tor onion services (v3) and I2P services cannot be trivially deanonymized, and that the underlying cryptographic primitives we employ cannot be broken in any manner faster than brute force unless a quantum computer is used. + +Once quantum safe algorithms are more mature and have decent high level libraries, they will be deployed. + +# Comparisons to other P2P software + +Since Onionr is far from the first to implement many of these ideas (on their own), this section compares Onionr to other networks, using points we consider to be the most important. + + + +# Conclusion + +If successful, Onionr will be a complete decentralized platform for anonymous computing, complete with limited metadata exposure, both node and user anonymity, and spam prevention \ No newline at end of file diff --git a/onionr/__init__.py b/onionr/__init__.py old mode 100644 new mode 100755 diff --git a/onionr/api.py b/onionr/api.py index 2e6ff46d..79694238 100755 --- a/onionr/api.py +++ b/onionr/api.py @@ -21,10 +21,13 @@ from gevent.pywsgi import WSGIServer, WSGIHandler from gevent import Timeout import flask, cgi, uuid from flask import request, Response, abort, send_from_directory -import sys, random, threading, hmac, hashlib, base64, time, math, os, json, socket +import sys, random, threading, hmac, base64, time, os, json, socket import core from onionrblockapi import Block -import onionrutils, onionrexceptions, onionrcrypto, blockimporter, onionrevents as events, logger, config, onionr +import onionrutils, onionrexceptions, onionrcrypto, blockimporter, onionrevents as events, logger, config +import httpapi +from httpapi import friendsapi, simplecache +import onionr class FDSafeHandler(WSGIHandler): '''Our WSGI handler. Doesn't do much non-default except timeouts''' @@ -38,22 +41,22 @@ class FDSafeHandler(WSGIHandler): def setBindIP(filePath): '''Set a random localhost IP to a specified file (intended for private or public API localhost IPs)''' - hostOctets = [str(127), str(random.randint(0x02, 0xFF)), str(random.randint(0x02, 0xFF)), str(random.randint(0x02, 0xFF))] - data = '.'.join(hostOctets) - - # Try to bind IP. Some platforms like Mac block non normal 127.x.x.x - s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) - try: - s.bind((data, 0)) - except OSError: - # if mac/non-bindable, show warning and default to 127.0.0.1 - logger.warn('Your platform appears to not support random local host addresses 127.x.x.x. Falling back to 127.0.0.1.') + if config.get('general.random_bind_ip', True): + hostOctets = [str(127), str(random.randint(0x02, 0xFF)), str(random.randint(0x02, 0xFF)), str(random.randint(0x02, 0xFF))] + data = '.'.join(hostOctets) + # Try to bind IP. Some platforms like Mac block non normal 127.x.x.x + s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) + try: + s.bind((data, 0)) + except OSError: + # if mac/non-bindable, show warning and default to 127.0.0.1 + logger.warn('Your platform appears to not support random local host addresses 127.x.x.x. Falling back to 127.0.0.1.') + data = '127.0.0.1' + s.close() + else: data = '127.0.0.1' - s.close() - with open(filePath, 'w') as bindFile: bindFile.write(data) - return data class PublicAPI: @@ -173,7 +176,7 @@ class PublicAPI: try: newNode = request.form['node'].encode() except KeyError: - logger.warn('No block specified for upload') + logger.warn('No node specified for upload') pass else: try: @@ -230,7 +233,7 @@ class PublicAPI: while self.torAdder == '': clientAPI._core.refreshFirstStartVars() self.torAdder = clientAPI._core.hsAddress - time.sleep(1) + time.sleep(0.1) self.httpServer = WSGIServer((self.host, self.bindPort), app, log=None, handler_class=FDSafeHandler) self.httpServer.serve_forever() @@ -248,9 +251,6 @@ class API: This initilization defines all of the API entry points and handlers for the endpoints and errors This also saves the used host (random localhost IP address) to the data folder in host.txt ''' - # assert isinstance(onionrInst, onionr.Onionr) - # configure logger and stuff - onionr.Onionr.setupConfig('data/', self = self) self.debug = debug self._core = onionrInst.onionrCore @@ -262,7 +262,7 @@ class API: self.bindPort = bindPort # Be extremely mindful of this. These are endpoints available without a password - self.whitelistEndpoints = ('site', 'www', 'onionrhome', 'board', 'boardContent', 'sharedContent', 'mail', 'mailindex') + self.whitelistEndpoints = ('site', 'www', 'onionrhome', 'board', 'boardContent', 'sharedContent', 'mail', 'mailindex', 'friends', 'friendsindex') self.clientToken = config.get('client.webpassword') self.timeBypassToken = base64.b16encode(os.urandom(32)).decode() @@ -276,6 +276,9 @@ class API: self.pluginResponses = {} # Responses for plugin endpoints self.queueResponse = {} onionrInst.setClientAPIInst(self) + app.register_blueprint(friendsapi.friends) + app.register_blueprint(simplecache.simplecache) + httpapi.load_plugin_blueprints(app) @app.before_request def validateRequest(): @@ -287,9 +290,11 @@ class API: return try: if not hmac.compare_digest(request.headers['token'], self.clientToken): - abort(403) + if not hmac.compare_digest(request.form['token'], self.clientToken): + abort(403) except KeyError: - abort(403) + if not hmac.compare_digest(request.form['token'], self.clientToken): + abort(403) @app.after_request def afterReq(resp): @@ -315,6 +320,14 @@ class API: @app.route('/mail/', endpoint='mailindex') def loadMailIndex(): return send_from_directory('static-data/www/mail/', 'index.html') + + @app.route('/friends/
Onionr Mail ✉️
-
- Onionr Web Control Panel
+ Onionr Web Control Panel
+ Uptime:
Last Received Connection: Unknown
@@ -30,5 +35,6 @@ +