RbOR - Rust-based Onion Router

A minimal onion routing implementation in Rust for educational purposes. RbOR implements core Tor-like concepts including telescoping circuit construction, layered encryption, and anonymous communication.

Documentation

See docs/DOCUMENTATION.md for detailed protocol documentation, architecture overview, and flowcharts.

Requirements

• Rust 1.85+ (2024 edition)
• Linux, macOS, or Windows

Installation

Install Rust

curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
source $HOME/.cargo/env

Build RbOR

git clone https://codeberg.org/phin/rbor
cd rbor
cargo build --release

The binary will be at target/release/rbor.

Cargo Commands

cargo build # Build debug binary
cargo build --release # Build optimized release binary
cargo test # Run all tests
cargo run -- directory # Run directory server
cargo run -- relay # Run relay node
cargo run -- client # Run client
cargo update # Update dependencies

Configuration

To configure, edit the config.toml file. More information on the fields within is in the config file.

Usage

Directory Server

Maintains the list of active relays:

./target/release/rbor directory

Relay Node

Participates in the onion routing network:

./target/release/rbor relay

Client

Provides a SOCKS5 proxy for anonymous connections:

./target/release/rbor client

Then configure your browser or application to use socks5://127.0.0.1:19050.

Testing

Run Unit and Integration Tests

cargo test

Test with curl

# Start client first, then:
curl -x socks5h://127.0.0.1:19050 http://httpbin.org/ip

Browser Test (Python/Playwright)

pip install playwright
playwright install chromium
python tests/browser_test.py

Architecture

┌────────┐ ┌───────────┐ ┌───────┐ ┌────────┐ ┌─────────────┐
│ Client │────>│ Entry │────>│ Middle│────>│ Exit │────>│ Destination │
└────────┘ │ Relay │ │ Relay │ │ Relay │ └─────────────┘
 └───────────┘ └───────┘ └────────┘

• Directory Server: Tracks active relays, computes relay flags (stable, fast)
• Relay Nodes: Forward encrypted traffic, decrypt one layer per hop
• Client: Builds 3-hop circuits, provides SOCKS5 proxy interface

Cryptography

• Key Exchange: X25519 ECDH
• Encryption: AES-256-CTR
• Authentication: HMAC-SHA256
• Key Derivation: HKDF-SHA256