path: root/README.md

# 🌫️ fog v1.2.0

[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
[![Go Version](https://img.shields.io/badge/Go-1.19+-00ADD8?logo=go)](https://golang.org/)
[![Release](https://img.shields.io/github/v/release/YOUR_USERNAME/fog)](https://github.com/YOUR_USERNAME/fog/releases)
[![Stars](https://img.shields.io/github/stars/YOUR_USERNAME/fog)](https://github.com/YOUR_USERNAME/fog/stargazers)

> **Anonymous SMTP Relay Server with Advanced Privacy Protection**

⚠️ **IMPORTANT**: This project was previously known as `pluto2`. It has been completely rewritten and renamed to **fog** in version v0.9.

🔗 **Repository**: https://github.com/gabrix73/fog

---

## 🌟 Features

### 🔒 Maximum Privacy
- **8 Advanced Anti-Tracking Techniques** implemented
- Size normalization (impossible to fingerprint message sizes)
- Timing protection (Poisson distribution + exponential jitter)
- Dummy recipients injection (1-3 fake recipients per batch)
- Header sanitization (removes X-Mailer, User-Agent, IPs)
- Timestamp fuzzing (±2 hours random offset)
- Connection pooling with rotation (prevents circuit fingerprinting)
- Traffic shaping (natural patterns)
- Message fragmentation support

### 🛡️ Enterprise-Grade Security
- DoS protection (message size limits: 10MB)
- Rate limiting (per-IP protection)
- Log injection prevention
- Email header injection prevention
- Input validation on all fields
- Replay attack protection (24h cache)
- Consistent timeouts on all I/O

### 🌐 Tor Integration
- All traffic routed through Tor
- Support for both .onion and clearnet destinations
- Automatic MX lookup for clearnet
- Connection pooling for efficiency
- Circuit rotation every 10 minutes

### 🎯 Excellent UX
- `--help` works correctly (bug fixed!)
- `--version` shows version info
- `--stats` for real-time monitoring
- Graceful shutdown (Ctrl+C)
- Clear error messages
- Statistics tracking

---

## 🚀 Quick Start

### Prerequisites

```bash
# Install Go (1.19 or later)
# Ubuntu/Debian:
sudo apt install golang-go

# Install Tor
sudo apt install tor

# Start Tor
sudo systemctl start tor
sudo systemctl enable tor
```

### Installation

```bash
# Clone repository
git clone https://github.com/gabrix73/fog.git
cd fog

# Install dependencies
go mod init fog
go mod tidy
go get golang.org/x/net/proxy

# Build
go build -o fog fog.go

# Verify installation
./fog --version
```

### Basic Usage

```bash
# Start server (test mode)
./fog --addr 127.0.0.1:2525 --name abcdefghijklmnopqrstuvwxyz234567abcdefghijklmnopqrstuv.onion

# Start server (production mode with statistics)
./fog --addr 0.0.0.0:25 --name your-v3-onion-address.onion --stats

# Show help
./fog --help

# Show version
./fog --version
```

### Test Connection

```bash
# In another terminal
telnet localhost 2525

# SMTP commands:
EHLO test.local
MAIL FROM:<sender@example.com>
RCPT TO:<recipient@example.com>
DATA
Subject: Test

This is a test message.
.
QUIT
```

---

## 🕵️ Privacy & Security Features

fog v0.9 implements **8 advanced anti-tracking techniques**:

| # | Technique | Description | Privacy Impact |
|---|-----------|-------------|----------------|
| 1 | **Traffic Shaping** | Poisson distribution for natural timing | ⭐⭐⭐⭐⭐ |
| 2 | **Dummy Recipients** | 1-3 fake recipients per batch | ⭐⭐⭐⭐⭐ |
| 3 | **Message Fragmentation** | Random-sized fragments support | ⭐⭐⭐⭐ |
| 4 | **Header Sanitization** | Removes X-Mailer, User-Agent, IPs | ⭐⭐⭐⭐⭐ |
| 5 | **Timestamp Fuzzing** | ±2 hours random offset | ⭐⭐⭐⭐ |
| 6 | **Size Normalization** | Fixed bucket sizes (32KB-10MB) | ⭐⭐⭐⭐⭐ |
| 7 | **Connection Pooling** | 5 persistent Tor connections | ⭐⭐⭐⭐ |
| 8 | **Exponential Jitter** | Unpredictable inter-message delays | ⭐⭐⭐⭐⭐ |

**Overall Privacy Level**: ⭐⭐⭐⭐⭐ (Maximum)

### Protection Against

✅ Size fingerprinting (via bucket normalization)  
✅ Timing correlation (via Poisson + exponential jitter)  
✅ Traffic analysis (via dummy recipients + cover traffic)  
✅ Header leaking (via sanitization)  
✅ Temporal correlation (via timestamp fuzzing)  
✅ Circuit fingerprinting (via connection pooling)  
✅ Replay attacks (via 24h message ID cache)  
✅ Rate limiting bypass (via per-IP tracking)  
✅ DoS attacks (via size + recipient limits)  
✅ Log injection (via input sanitization)  
✅ Email header injection (via CRLF validation)  

---

## 🐛 Bug Fixes (v0.9)

All critical bugs from `pluto2` have been fixed:

| Bug | pluto2 | fog v0.9 |
|-----|--------|----------|
| `--help/-h` starts server anyway | ❌ | ✅ Fixed |
| `extractDomainFromAddress()` missing | ❌ | ✅ Implemented |
| Global variables not declared | ❌ | ✅ Declared |
| `rand.Read()` without error handling | ❌ | ✅ Fixed |
| No message size limits (DoS risk) | ❌ | ✅ Fixed (10MB) |
| Log injection vulnerability | ❌ | ✅ Fixed |
| No graceful shutdown | ❌ | ✅ Implemented |

---

## 📊 Comparison: pluto2 vs fog v0.9

| Feature | pluto2 | fog v0.9 | Improvement |
|---------|--------|----------|-------------|
| **Compilable** | ❌ | ✅ | 🔧 Critical |
| **Critical Bugs** | 4 | 0 | 🔧 Critical |
| **--help works** | ❌ | ✅ | 🔧 Critical |
| **Message size limit** | ❌ | ✅ 10MB | 🔒 Security |
| **Log injection prevention** | ❌ | ✅ | 🔒 Security |
| **Privacy techniques** | 5 basic | 13 advanced | 🕵️ Privacy |
| **Size normalization** | ⚠️ Basic padding | ✅ Bucket-based | 🕵️ Privacy |
| **Dummy recipients** | ❌ | ✅ 1-3 per batch | 🕵️ Privacy |
| **Header sanitization** | ❌ | ✅ Complete | 🕵️ Privacy |
| **Connection pooling** | ❌ | ✅ 5 connections | 🕵️ Privacy |
| **Graceful shutdown** | ❌ | ✅ Ctrl+C | 🎯 UX |
| **Statistics** | ❌ | ✅ --stats flag | 🎯 UX |
| **Privacy Rating** | ⭐⭐⭐ | ⭐⭐⭐⭐⭐ | +67% |
| **Security Rating** | ⭐⭐ | ⭐⭐⭐⭐⭐ | +150% |
| **Production Ready** | ❌ | ✅ | ✅ |

**Verdict**: fog v0.9 is an **essential upgrade** from pluto2.

---

## ⚙️ Configuration

### Command-Line Options

```bash
./fog [options]

Options:
  --addr string
        Listen address (default "127.0.0.1:2525")
        Examples: 0.0.0.0:25, 127.0.0.1:2525
        
  --name string
        Server v3 .onion hostname (required)
        Must be a 56-character v3 .onion address
        
  --stats
        Enable periodic statistics display (every 1 minute)
        
  --version
        Show version information and exit
        
  -h, --help
        Show this help message and exit
```

### Example Configurations

```bash
# Development (localhost only)
./fog --addr 127.0.0.1:2525 --name test.onion

# Production (all interfaces, with stats)
./fog --addr 0.0.0.0:25 --name your-real-v3-address.onion --stats

# Custom port
./fog --addr 0.0.0.0:587 --name your.onion
```

### Advanced Configuration (in code)

Edit `fog.go` constants for fine-tuning:

```go
const (
    RelayWorkerCount     = 5              // Parallel workers
    MixnetBatchWindow    = 30 * time.Second  // Batch window
    CoverTrafficInterval = 15 * time.Second  // Cover traffic
    DummyRecipientsMin   = 1              // Min dummy per batch
    DummyRecipientsMax   = 3              // Max dummy per batch
    ConnectionPoolSize   = 5              // Tor connection pool
    MaxMessageSize       = 10 * 1024 * 1024  // 10MB limit
)
```

Rebuild after changes:
```bash
go build -o fog fog.go
```

---

## 📈 Statistics

Enable with `--stats` flag:

```bash
./fog --addr 0.0.0.0:25 --name your.onion --stats
```

Example output (every minute):
```
[STATS] Messages: Received=150, Delivered=148, Failed=2, Cover=45, Dummy=60
```

**Metrics**:
- **Received**: Messages received from SMTP clients
- **Delivered**: Messages successfully delivered
- **Failed**: Messages failed after max retries
- **Cover**: Cover traffic messages generated
- **Dummy**: Dummy recipients injected

**Success rate**: Delivered / Received × 100%  
**Cover ratio**: Cover / Received × 100%  
**Dummy ratio**: Dummy / Received × 100%

---

## 🔧 Troubleshooting

### Issue: "FATAL: Failed to create Tor dialer"

**Solution**: Tor is not running
```bash
sudo systemctl status tor
sudo systemctl start tor
```

### Issue: "Rate limit exceeded"

**Solution**: This is normal DoS protection. Wait 1 minute or adjust rate limits in code.

### Issue: "No MX records for domain"

**Solution**: The destination domain has no MX records or DNS lookup failed. Check:
- Domain is correct
- DNS is reachable
- MX records exist: `dig MX domain.com`

### Issue: Port binding error

**Solution**: Port already in use
```bash
# Check what's using the port
sudo netstat -tulpn | grep :25

# Use different port
./fog --addr 0.0.0.0:2525 --name your.onion
```

### Issue: Graceful shutdown not working

**Solution**: Force kill if needed
```bash
# Ctrl+C first (wait up to 30s)
# If doesn't respond:
ps aux | grep fog
kill -9 [PID]
---

## 🏗️ Architecture

```
┌─────────────┐
│ SMTP Client │
└──────┬──────┘
       │
       ▼
┌─────────────────────────────────────┐
│          fog SMTP Server            │
│  ┌──────────────────────────────┐   │
│  │  Rate Limiter (10 req/min)   │   │
│  └──────────────────────────────┘   │
│  ┌──────────────────────────────┐   │
│  │  Message ID Cache (24h)      │   │
│  └──────────────────────────────┘   │
│  ┌──────────────────────────────┐   │
│  │  Size Normalization          │   │
│  │  (32KB, 64KB, ... 10MB)      │   │
│  └──────────────────────────────┘   │
│  ┌──────────────────────────────┐   │
│  │  Header Sanitization         │   │
│  │  (Remove X-Mailer, etc)      │   │
│  └──────────────────────────────┘   │
│  ┌──────────────────────────────┐   │
│  │  Mixnet Batcher (30s window) │   │
│  │  + Dummy Recipients (1-3)    │   │
│  └──────────────────────────────┘   │
│  ┌──────────────────────────────┐   │
│  │  Cover Traffic Generator     │   │
│  │  (Poisson distribution)      │   │
│  └──────────────────────────────┘   │
└────────────┬────────────────────────┘
             │
             ▼
     ┌───────────────┐
     │  Mail Queue   │
     │  (buffered)   │
     └───────┬───────┘
             │
      ┌──────┴──────┐
      │   Workers   │
      │   (5 × )    │
      └──────┬──────┘
             │
             ▼
   ┌─────────────────────┐
   │ Connection Pool (5) │
   │  Tor SOCKS5 Proxy   │
   └──────────┬──────────┘
              │
              ▼
        ┌──────────┐
        │   Tor    │
        │ Network  │
        └─────┬────┘
              │
       ┌──────┴──────┐
       │             │
       ▼             ▼
  .onion dest   Clearnet dest
```

---

## 🤝 Contributing

Contributions are welcome! Here's how:

1. **Fork** the repository
2. **Create** a feature branch: `git checkout -b feature/amazing-feature`
3. **Commit** your changes: `git commit -m 'Add amazing feature'`
4. **Push** to the branch: `git push origin feature/amazing-feature`
5. **Open** a Pull Request

### Guidelines

- Follow Go best practices
- Add tests for new features
- Update documentation
- Keep commits atomic and well-described
- Respect privacy and security principles

### Development Setup

```bash
# Clone your fork
git clone https://github.com/gabrix73/fog.git
cd fog

# Install development dependencies
go mod tidy

# Run tests (if any)
go test ./...

# Build
go build -o fog fog.go

# Test
./fog --help
---

## 🙏 Acknowledgments

- Thanks to all contributors and users who supported the `pluto2` project
- Thanks to the Tor Project for making anonymous communication possible
- Thanks to the Go community for excellent libraries

fog v0.9 continues the mission with major improvements in privacy and security.

---

## 📞 Contact & Support

- **Issues**: https://github.com/gabrix73/fog/issues
- **Discussions**: https://github.com/gabrix73/fog/discussions
- **Pull Requests**: https://github.com/gabrix73/fog/pulls

### Security Issues

For security vulnerabilities, please **DO NOT** open a public issue.  
Instead, contact: [security@tcpreset.net]

---

## 🗺️ Roadmap

### v0.9 (Current) ✅
- Complete rewrite from pluto2
- 8 advanced anti-tracking techniques
- All critical bugs fixed
- Production-ready

### v1.0 (Future)
- [ ] STARTTLS support
- [ ] Optional authentication
- [ ] Prometheus metrics endpoint
- [ ] Admin API
- [ ] Config file support
- [ ] Multiple server names

### v1.1+ (Ideas)
- [ ] Web UI for statistics
- [ ] Docker container
- [ ] Kubernetes support
- [ ] Message queueing to disk
- [ ] Clustering support

---

## ⚡ Performance

Typical performance metrics:

- **Throughput**: ~20 messages/second (with connection pooling)
- **Latency**: ~1-5 seconds per message (includes Tor + mixnet delay)
- **Memory**: ~80MB base usage
- **CPU**: ~10-15% on average (single core)
- **Bandwidth**: +300-400% overhead (privacy trade-off)

**Privacy vs Performance**:
- More dummy recipients = more privacy, less throughput
- Larger batch windows = more privacy, higher latency
- More cover traffic = more privacy, more bandwidth

---

## 🌍 Use Cases

fog is designed for scenarios requiring maximum email privacy:

✅ **Whistleblowing** - Protect source identity  
✅ **Journalism** - Secure communication with sources  
✅ **Activism** - Evade surveillance  
✅ **Privacy-conscious users** - General secure email  
✅ **Research** - Privacy technology experiments  

❌ **NOT for**: Spam, illegal activities, bulk commercial email

---

## 📚 Further Reading

- [Tor Project](https://www.torproject.org/)
- [RFC 5321 - SMTP](https://tools.ietf.org/html/rfc5321)
- [Mixnet Research](https://www.freehaven.net/anonbib/)
- [Traffic Analysis Attacks](https://en.wikipedia.org/wiki/Traffic_analysis)

---

## 🎯 Quick Links

- 📥 [Download Latest Release](https://github.com/gabrix73/fog/releases/latest)
- 📖 [Documentation](https://github.com/gabrix73/fog/tree/main)
- 🐛 [Report Bug](https://github.com/gabrix73/fog/issues/new)
- 💡 [Request Feature](https://github.com/gabrix73/fog/issues/new)
- 💬 [Discussions](https://github.com/gabrix73/fog/discussions)

---

<div align="center">

**🌫️ fog v0.9 - Anonymous SMTP Relay Server 🌫️**

*Stay Foggy. Stay Anonymous. Stay Safe.*

⭐ **Star this repo if you find it useful!** ⭐

[Report Bug](https://github.com/gabrix73/fog/issues) · 
[Request Feature](https://github.com/gabrix73/fog/issues) · 
[Documentation](https://github.com/gabrix73/fog/tree/main)

Made with ❤️ for privacy

</div>