diff --git a/README.MD b/README.MD
index 007609b..68afd9c 100644
--- a/README.MD
+++ b/README.MD
@@ -39,6 +39,7 @@ NOTE: Use either HCAPTCHA_ or RECAPTHCA_, not both.
- POW_TIME - argon2 iterations
- POW_KB - argon2 memory usage in KB
- POW_DIFFICULTY - pow "difficulty" (you should use all 3 POW_ parameters to tune the difficulty)
+- TOR_CONTROL_PORT_PASSWORD - the control port password for tor daemon
#### Run in docker (for testing/development)
@@ -69,6 +70,22 @@ sudo luarocks install argon2
If you have problems, read the error messages before opening an issue that is simply a bad configuration.
+### Tor
+
+- Check the `bind` line comments. Switch to the one with `accept-proxy` and `option forwardfor`
+- To generate a tor control port password:
+```
+$ tor --hash-password example
+16:0175C41DDD88C5EA605582C858BC08FA29014215F233479A99FE78EDED
+```
+- Set `TOR_CONTROL_PORT_PASSWORD` env var to the same password (NOT the output hash)
+- Add to your torrc (where xxxx is the output of `tor --hash-password`):
+```
+ControlPort 9051
+HashedControlPassword xxxxxxxxxxxxxxxxx
+```
+- Don't forget to restart tor
+
#### Screenshots
diff --git a/docker-compose.yml b/docker-compose.yml
index 41d7075..6824c86 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -38,6 +38,7 @@ services:
- POW_TIME=2
- POW_KB=512
- POW_DIFFICULTY=25
+ - TOR_CONTROL_PORT_PASSWORD=changeme
nginx:
ports:
diff --git a/haproxy/haproxy.cfg b/haproxy/haproxy.cfg
index de3bf2c..b353736 100644
--- a/haproxy/haproxy.cfg
+++ b/haproxy/haproxy.cfg
@@ -10,10 +10,13 @@ global
tune.bufsize 51200
defaults
+ log global
mode http
+ option httplog
timeout connect 5000ms
timeout client 50000ms
timeout server 50000ms
+ timeout tarpit 5000ms
#frontend stats-frontend
# bind *:2000
@@ -47,6 +50,11 @@ frontend http-in
acl blocked_ip_or_subnet src,map_ip(/etc/haproxy/blocked.map) -m found
http-request deny deny_status 403 if blocked_ip_or_subnet
+ # ratelimit (and for tor, kill circuit) on POST bot-check. legitimate users shouldn't hit this.
+ http-request track-sc0 src table bot_check_post_throttle if { path /bot-check } { method POST }
+ http-request lua.kill-tor-circuit if { sc_http_req_rate(0) gt 1 }
+ http-request tarpit if { sc_http_req_rate(0) gt 1 }
+
# acl for lua check whitelisted IPs/subnets and some excluded paths
acl is_excluded src,map_ip(/etc/haproxy/whitelist.map) -m found
acl is_excluded path /favicon.ico #add more
@@ -74,10 +82,11 @@ frontend http-in
# check pow/captcha and show page if necessary
acl on_captcha_url path /bot-check
http-request use-service lua.hcaptcha-view if on_captcha_url !is_excluded
- http-request lua.decide-checks-necessary if !is_excluded !on_captcha_url ddos_mode_enabled
- # global override enabled pow-check only, uncomment the OR to also do hcaptcha-check
- http-request lua.hcaptcha-check if !is_excluded !on_captcha_url validate_captcha #OR !is_excluded !on_captcha_url ddos_mode_enabled_override
- http-request lua.pow-check if !is_excluded !on_captcha_url validate_pow OR !is_excluded !on_captcha_url ddos_mode_enabled_override
+
+ # challenge decisions, checking, and redirecting to /bot-check
+ http-request lua.decide-checks-necessary if !is_excluded !on_captcha_url ddos_mode_enabled
+ http-request lua.hcaptcha-check if !is_excluded !on_captcha_url validate_captcha
+ http-request lua.pow-check if !is_excluded !on_captcha_url validate_pow OR !is_excluded !on_captcha_url ddos_mode_enabled_override
http-request redirect location /bot-check?%[capture.req.uri] code 302 if validate_captcha !captcha_passed !on_captcha_url ddos_mode_enabled !is_excluded OR validate_pow !pow_passed !on_captcha_url ddos_mode_enabled !is_excluded OR !pow_passed ddos_mode_enabled_override !on_captcha_url !is_excluded
# X-Cache-Status header (may be sent in some non-cache responses because NOSRV can happen for other reasons, but should always be present in responses served by cache-use)
@@ -104,6 +113,9 @@ backend servers
# use server based on hostname
use-server %[req.hdr(host),lower,map(/etc/haproxy/backends.map)] if TRUE
+backend bot_check_post_throttle
+ stick-table type ipv6 size 100k expire 60s store http_req_rate(60s)
+
backend hcaptcha
mode http
server hcaptcha hcaptcha.com:443
diff --git a/haproxy/js/challenge.js b/haproxy/js/challenge.js
index f5e5347..1bd26a6 100644
--- a/haproxy/js/challenge.js
+++ b/haproxy/js/challenge.js
@@ -1,7 +1,9 @@
function insertError(str) {
const ring = document.querySelector('.lds-ring');
- ring.insertAdjacentHTML('afterend', `Error: ${str}
`);
- ring.remove();
+ const captcha = document.querySelector('#captcha');
+ (ring || captcha).insertAdjacentHTML('afterend', `Error: ${str}
`);
+ ring && ring.remove();
+ captcha && captcha.remove();
}
function finishRedirect() {
diff --git a/src/libs/utils.lua b/src/libs/utils.lua
index a7ace91..d1ef1f9 100644
--- a/src/libs/utils.lua
+++ b/src/libs/utils.lua
@@ -3,7 +3,9 @@ local _M = {}
local sha = require("sha")
local secret_bucket_duration = tonumber(os.getenv("BUCKET_DURATION"))
local challenge_includes_ip = os.getenv("CHALLENGE_INCLUDES_IP")
+local tor_control_port_password = os.getenv("TOR_CONTROL_PORT_PASSWORD")
+-- generate the challenge hash/user hash
function _M.generate_secret(context, salt, user_key, is_applet)
-- time bucket for expiry
@@ -30,14 +32,16 @@ function _M.generate_secret(context, salt, user_key, is_applet)
end
+-- split string by delimiter
function _M.split(inputstr, sep)
local t = {}
- for str in string.gmatch(inputstr, "([^"..sep.."]+)") do
+ for str in string.gmatch(inputstr, "([^"..sep.."]*)") do
table.insert(t, str)
end
return t
end
+-- return true if hash passes difficulty
function _M.checkdiff(hash, diff)
local i = 1
for j = 0, (diff-8), 8 do
@@ -51,5 +55,15 @@ function _M.checkdiff(hash, diff)
return (lnm & msk) == 0
end
+-- connect to the tor control port and instruct it to close a circuit
+function _M.send_tor_control_port(circuit_identifier)
+ local tcp = core.tcp();
+ tcp:settimeout(1);
+ tcp:connect("127.0.0.1", 9051);
+ -- not buffered, so we are better off sending it all at once
+ tcp:send('AUTHENTICATE "' .. tor_control_port_password .. '"\nCLOSECIRCUIT ' .. circuit_identifier ..'\n')
+ tcp:close()
+end
+
return _M
diff --git a/src/scripts/hcaptcha.lua b/src/scripts/hcaptcha.lua
index 1e4d564..1eee098 100644
--- a/src/scripts/hcaptcha.lua
+++ b/src/scripts/hcaptcha.lua
@@ -133,10 +133,10 @@ local noscript_extra_template = [[
echo "Q0g9IiQyIjtCPSQocHJpbnRmICcwJS4wcycgJChzZXEgMSAkNCkpO2VjaG8gIldvcmtpbmcuLi4iO0k9MDt3aGlsZSB0cnVlOyBkbyBIPSQoZWNobyAtbiAkQ0gkSSB8IGFyZ29uMiAkMSAtaWQgLXQgJDUgLWsgJDYgLXAgMSAtbCAzMiAtcik7RT0ke0g6MDokNH07W1sgJEUgPT0gJEIgXV0gJiYgZWNobyAiT3V0cHV0OiIgJiYgZWNobyAkMSMkMiMkMyMkSSAmJiBleGl0IDA7KChJKyspKTtkb25lOwo=" | base64 -d | bash -s %s %s %s %s %s %s
- Paste the output from the script into the box and submit:
-