#relay #privacy #oblivious #http-request #gateway #ip #ohttp

bin+lib ohttp-relay

Relay Oblivious HTTP requests to protect IP metadata

8 releases

0.0.8 Mar 27, 2024
0.0.7 Mar 19, 2024
0.0.2 Feb 20, 2024

#4 in #oblivious

Download history 264/week @ 2024-06-22 44/week @ 2024-06-29 127/week @ 2024-07-06 148/week @ 2024-07-13 22/week @ 2024-07-20 140/week @ 2024-07-27 68/week @ 2024-08-03 139/week @ 2024-08-10 70/week @ 2024-08-17 15/week @ 2024-08-24 18/week @ 2024-08-31 54/week @ 2024-09-07 8/week @ 2024-09-14 36/week @ 2024-09-21 33/week @ 2024-09-28 64/week @ 2024-10-05

143 downloads per month
Used in 2 crates

MITNFA license

29KB
558 lines

OHTTP Relay

A rust implementation of an Oblivious HTTP relay resource.

This work is undergoing active revision in the IETF and so are these implementations. Use at your own risk.

Usage

Run ohttp-relay by setting PORT and GATEWAY_ORIGIN environment vaiables. For example, to relay from port 3000 to an OHTTP Gateway Resource at https://payjo.in, run the following.

PORT=3000 GATEWAY_ORIGIN='https://payjo.in' cargo run

Alternatively, set UNIX_SOCKET to bind to a unix socket path instead of a TCP port.

This crate is intended to be run behind a reverse proxy like NGINX that can handle TLS for you. Tests specifically cover this integration using nginx.conf.template.

Bootstrap Feature

The Oblivious HTTP specification requires clients obtain a Key Configuration from the OHTTP Gateway but leaves a mechanism for doing so explicitly unspecified. This feature hosts HTTPS-in-WebSocket and HTTPS-in-CONNECT proxies to allow web clients to GET a gateway's ohttp-keys via Direct Discovery in an end-to-end-encrypted, authenticated manner using the OHTTP relay as a tunnel so as not to reveal their IP address. The bootstrap feature to host these proxies is enabled by default. The ws-bootstrap and connect-bootstrap features enable each proxy individually.

How does it work?

Both bootstrap features enable the server to forward packets directly to and from the OHTTP Gateway's TCP socket to negotiate a TLS session between the client and gateway. By doing so, the OHTTP Relay is prevented from conducting a man-in-the-middle attack to compromise the TLS session.

Dependencies

~13–23MB
~333K SLoC