Built My own L7 anti-DDoS system — looking for suggestions to improve it ! !

forest

@itzsenu said:

@forest said: The fix is definitely an L7 mitigation, but it'll have to be integrated within Tor itself, e.g. closing any circuit that sends more than a few BEGIN_DIR requests. Dunno.

I guess the tricky part would be setting the limit without affecting legitimate directory requests.

Definitely, although at least you could expect that a legitimate requester won't be sending the request through the same circuit over and over. Most existing built-in DoS mitigations work similarly to that.

tauseef

@forest said:

@itzsenu said: yaa, a Tor relay only sees encrypted Tor cells and circuit level metadata. it doesnt see the actual HTTP request, destination URL, etc, or what the user is requesting. so there’s nothing meaningful for an L7 WAF to classify.

Yep, it's Tor itself that would have to implement the mitigations.

thats the ideal solution, anyway if you are interested in testing the one i built let me know

fatchan

@fm06 said:
Why use your vibecoded crap over something battle-tested like https://gitgud.io/fatchan/haproxy-protection or https://github.com/techaroHQ/anubis?

Hey thats my project
For OP, even without seeing the source, one criticism I would have (and to a lesser extent anubis, because it works a bit different) is that you should reconsider making your own reverse proxy like you did in golang.

In haproxy-protection, the main reason to go with HAProxy as a base rather than a self built one is that it's actually designed to be a reverse proxy. HAProxy has historically been quite secure, is very performant, compatible and has an unbelievable amount of features and options. The kind of stuff that you will need if you want it to be truly flexible and able to productise it, that would take a very long time to match in a home grown proxy.

Just for example, let's say you wanted to sell your service and let people configure timeouts for their website. There isn't just one kind of timeout in a proxy. There's a timeout for the client request headers being received, the full client request to be received, timeouts to send requests to the backend, receive response from the backend, timeout for idle websocket connections, the full request timeout, etc. In HAProxy it would be trivial to make that configurable in a very performant way with maps, using the set-timeout and dynamically update those via the runtime api+dataplaneapi. The same principle applies for all aspects of the operation of a proxy.

But anyways, good luck, at least have fun making it

tauseef

@fatchan said:

@fm06 said:
Why use your vibecoded crap over something battle-tested like https://gitgud.io/fatchan/haproxy-protection or https://github.com/techaroHQ/anubis?

Hey thats my project
But anyways, good luck, at least have fun making it

that was the essense of my post, it was fun to make it and was genuinely looking for suggestions to improve it and monitize , kudos to you your project is cool one