# Tor Browser Integration & NetGuard Security Architecture

Subsystem: Snigdha Privacy Suite
Application: Official Tor Project Tor Browser
Distribution: Snigdha OS Decentralized

---

# 1. Architectural Challenge: Avoiding Tor-over-Tor

Tor Browser bundles its own tor binary, designed under the assumption of running on clearnet systems. On an anonymity distribution like Snigdha OS, Snigdha NetGuard already runs a system Tor daemon (UID 43) with kernel nftables packet redirection (TransPort 9040).

If Tor Browser is allowed to execute its bundled tor binary:

1. The bundled Tor (running as user snigdha, UID 1000) creates outbound TLS connections to Tor directory authorities and guard relays.
2. Kernel nftables intercepts those connections and transparently redirects them to NetGuard's TransPort 9040.
3. The bundled Tor builds circuits inside system Tor's circuits.
4. Result: Catastrophic Tor-over-Tor nested routing loops. This destroys performance, causes high circuit teardown rates, introduces severe traffic correlation vulnerabilities, and can result in connection deadlocks.

Conversely, exempting the browser user from firewall redirection would allow malicious browser exploits to make direct Internet connections, violating NetGuard's fail-closed guarantee.

---

# 2. Supported Upstream Integration Method

Snigdha OS solves this using upstream Tor Project supported environment controls:

+-------------------------------------------------------------------------------+
|                       Tor Browser Process (firefox.real)                      |
|           Environment: TOR_SKIP_LAUNCH=1  TOR_SOCKS_PORT=9050                 |
|                        TOR_CONTROL_PORT=9051                                  |
+-------------------------------------------------------------------------------+
         | (SOCKS5 + IsolateSOCKSAuth)              | (Filtered Control Protocol)
         v                                          v
+-----------------------------+            +------------------------------------+
| NetGuard Tor Daemon (UID 43)|            | Snigdha Tor Control Broker         |
| TransPort 9040 (Transparent)|            | 127.0.0.1:9051                     |
| DNSPort 5353 (Onion DNS)    |            | Whitelist Filter (NEWNYM allowed)  |
| SocksPort 127.0.0.1:9050    |            +------------------------------------+
+-----------------------------+                             |
         |                                                  v
         |                                         +----------------------------+
         |                                         | Tor ControlSocket (/run/tor|
         |                                         +----------------------------+
         v
+-------------------------------------------------------------------------------+
|                        Tor Network (3-Hop Circuits)                           |
+-------------------------------------------------------------------------------+

# Key Parameters:

1. TOR_SKIP_LAUNCH=1: Prevents the start script from launching the internal bundled Tor daemon.
2. TOR_SOCKS_PORT=9050: Directs the browser's SOCKS proxy client to system Tor on loopback.
3. TOR_SOCKS_HOST=127.0.0.1: Explicitly binds proxy resolution to local loopback.
4. TOR_CONTROL_PORT=9051: Directs Tor Browser control queries to snigdha-tor-broker, permitting the "New Identity" (SIGNAL NEWNYM) feature.

---

# 3. Installation, Signature Verification & Amnesia

Tor Browser is provisioned via torbrowser-launcher (from official Arch Linux extra):

1. Download Source: Fetches exclusively from official Tor Project mirrors (dist.torproject.org).
2. Cryptographic Verification: Automatically validates the Tor Project developer OpenPGP signature (.asc) against embedded signing keys before archive extraction. Checksums without independent cryptographic signatures are rejected.
3. Volatile Runtime Target: Extracted to ~/.local/share/torbrowser/ inside the RAM-backed tmpfs user home.
4. Zero Disk Persistence: No browser history, cache, cookies, open tabs, or session state survive reboot. Every boot provides an authentic, pristine browser session.

---

# 4. Browser Security Configuration & Fingerprinting

Upstream defaults are strictly preserved:

• No Third-Party Extensions: Additional extensions (even ad blockers or password managers) modify browser canvas fingerprints and increase attack surface.
• Default Font & Viewport Protections: Letterboxing and default window geometries prevent screen resolution fingerprinting.
• Security Levels:
  • Standard (Default): All browser features enabled with Tor protections.
  • Safer: Disables JavaScript on non-HTTPS sites; audio/video require click-to-play.
  • Safest: Disables JavaScript globally; disables some fonts and icons.

---

# 5. Security Limitations

• Tor Browser does not prevent users from deanonymizing themselves by entering personal credentials or real-name accounts.
• Maximizing browser windows alters the viewport dimensions away from the standardized letterboxed canvas size.