Pure

pure is a collection of software and tools that I use to manage my network and my storage.

Directory tree:

cmd/dnsd is meant to be an intercepting DNS caching proxy
- I'm willingly not implementing support for most record types
- The forwarder for A and AAAA records is loosely inspired by
  - Introducing DNS Resolver for Tor
  - DoHoT: better security, privacy, and integrity via load-balanced DNS over HTTPS over Tor
- The cache is in-memory and it never performs record eviction, the purpose is to
  - minimize the latency introduced by DoHoT
  - reduce the amount of information deducible from the logs via pattern of life analysis
pkg/nfqueue is a network interference tool that uses NFQUEUE
- It modifies the window size of TCP packets with the SYN or the ACK flag set
- Middleboxes that do not support stream reassembly will be unable to collect the metadata of the TLS streams
- References:
  - brdgrd (Bridge Guard)
  - About Geneva - How it Works
pkg/sni is a proxy for TLS that does not terminate
- it refuses non-TLS traffic and connections to bare IP addresses
- checks the geographical location of the remote endpoints
- logs the Server Name Indication
pkg/shsh is a http proxy tailor-made to support the "signed hash protocol"
- https://www.theiphonewiki.com/wiki/SHSH
- it also forwards the traffic of some OCSP hosts
- and redirects everything else towards HTTPS
pkg/sntp is a sntp v4 server that relays the time of the system on which it is running
- https://www.rfc-editor.org/rfc/rfc2030
the rest of the project is just basic ansible

tgragnato/pure