Archives
/
obfs4
mirror of https://gitlab.com/yawning/obfs4
2
0
Fork 0
Code Issues Projects Releases Wiki Activity
202 Commits
1 Branch
14 Tags
709 KiB
master
obfs4proxy-0.0.14
obfs4proxy-0.0.13
obfs4proxy-0.0.12
obfs4proxy-0.0.11
obfs4proxy-0.0.10
obfs4proxy-0.0.9
obfs4proxy-0.0.8
obfs4proxy-0.0.7
obfs4proxy-0.0.6
obfs4proxy-0.0.5
obfs4proxy-0.0.4
obfs4proxy-0.0.3
obfs4proxy-0.0.2
obfs4proxy-0.0.1
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from 'master'
${ noResults }
Commit Graph

202 Commits (master)
 

Author SHA1 Message Date
Yawning Angel f4b3821292 Fix constants in the spec to reflect the code. 10 years ago
Yawning Angel 8d61c6bcc6 Use the new goptlib goodies. 
As of `15b960d55905877a840fe605a41a8139bffb5329` goptlib supports
IsClient, IsServer, and handling the StateLocation.

Yes this means you need to use goptlib out of git.
 10 years ago
Yawning Angel 19f34317ba Change the MSS to 1448 bytes, because timestamps are a thing. 
This breaks wireprotocol compatibility.
 10 years ago
Yawning Angel 7c37109c48 Add support for a log scrubber and log a session id. 
This fixes #6.
 10 years ago
Yawning Angel b50a8bdf24 Finish adding godoc comments to all public interfaces. 10 years ago
Yawning Angel 676e0428e7 Allow logging to be disabled (default). 
Part of #6, still need to make logs nicer.
 10 years ago
Yawning Angel 66edb786db Tweak the obfs4 handshake code. 
* Fixed where the code wasn't ensuring that the MAC_[C,S] was present.
 * Optimized the server side to only look at the tail of the (possibly
   incomplete handshakeRequest).
 10 years ago
Yawning Angel a853a1f0aa Actually keep the delay/threshold in the listener struct. 
This makes it consistent across all incoming connections, for real this
time (oops).
 10 years ago
Yawning Angel efb9d17c8c Change the server failure close delay/discard length to be consistent. 
It will vary per bridge as it is based off the DRBG, but ever attempt
at poking at any given bridge will exhibit consistent behavior.
 10 years ago
Yawning Angel 745d414645 Change the client connection timeout to 30 sec. 
This is more common than 15 seconds (It's what Firefox uses for the
request timeout).
 10 years ago
Yawning Angel a60f92cf95 Update the spec with feedback from arma (No functional changes). 10 years ago
Yawning Angel fc5e39a4ef Update README (No functional changes). 10 years ago
Yawning Angel b4f445233c Add a protocol specification. 
This fixes #4.
 10 years ago
Yawning Angel 08439afd13 Treat the PrngSeed frame as part of the handshake. 
Clients will now always add 87 bytes of padding to the clientRequest,
and Servers will always send the PRNG seed frame unpadded, and bundled
with the serverResponse.

Why 87 bytes?  The amount of data that the server sends is 87.

This fixes #5.
 10 years ago
Yawning Angel 8a431a64cb Validate that the padding length is greater than the minimum. 10 years ago
Yawning Angel 1fee9678c6 Change the length field obfscation. 
Instead of including the previous secretbox in the input when
calculating the  SipHash-2-4 digest used to generate the obfuscation
mask, use only the nonce.  This is significantly faster, and if someone
breaks obfs4 by exploiting the low amount of input entropy between each
invocation (a counter incrementing by 1), I hope they publish the
attack on the PRF.

This breaks wire protocol compatibility.
 10 years ago
Yawning Angel f4877920f8 Change the handshake wire format. 
* HMAC-SHA256 -> HMAC-SHA256-128.
 * Mark/MAC are now both caluclated using Public Key | NodeID.

This breaks wire protocol compatibility.
 10 years ago
Yawning Angel 7709069617 Send the DRBG seed as a packetTypePrngSeed post server handshake. 
This fixes #3, and brings the code to be on par with the delopyed
versions of ScrambleSuit in terms of features.
 10 years ago
Yawning Angel 6f875c99a9 Load the drbg-seed from the ServerTransportOptions args. 
This also adds the drgb-seed option to the `-gen` obfs4proxy output.
 10 years ago
Yawning Angel f1b1dcdb10 Change hashDrbg to take a drbgSeed for initialization. 
This paves the way for having servers use the same seed for all
incoming connections, across multiple startup/shutdown cycles.  As
opposed to the current situation where each Obfs4Listener will
randomly generate it's seed at creation time.

Additionally, use 256 bit seeds (128 bit SipHash-2-4 key + 16 bytes of
initial material).
 10 years ago
Yawning Angel b9e3aedfb1 Make the output from "-gen" be more useful. 10 years ago
Yawning Angel 50cc180084 Use os.MkdirAll() for creating the pt state directory. 10 years ago
Yawning Angel 013c3c7c4d Fix up how Read() errors were processed where appropriate. 10 years ago
Yawning Angel 79a7ad7f2b Changed the taglne to "The obfourscator", per dcf's suggestion. 10 years ago
Yawning Angel 8e552dbd48 Remove a newline to make godoc work (No functional changes). 10 years ago
Yawning Angel 48c6f06d04 Change the framing Encoder/Decoder to take the destination slice. 
In theory this is easier on the garbage collector.  Probably could
reuse more of the intermediary buffers by stashing them in the
connection state, but that makes the code kind of messy.  This should
be an improvement.
 10 years ago
Yawning Angel 89d5338eed Fix comment (No functional changes). 10 years ago
Yawning Angel 659efbc044 Update README (No functional changes). 10 years ago
Yawning Angel ded3f6948c Kill Obfs4Conn.isOk with fire, and replace it with a state var. 10 years ago
Yawning Angel 557e746815 First pass at cleaning up the write code. 10 years ago
Yawning Angel 731a926172 Implement the io.WriterTo interface. 10 years ago
Yawning Angel 582aa3a366 First pass at cleaning up the read code. 10 years ago
Yawning Angel ece57277db Minor stylistic fixes, no functional changes. 10 years ago
Yawning Angel 64212e1029 Add vim modelines to some files (No functional changes). 10 years ago
Yawning Angel 8daf42a13e Fix up import. 10 years ago
Yawning Angel d2b2e383fd Fix copyLoop to break out the other goroutine on graceful exit. 
This should fix sockets getting stuck in CLOSE_WAIT.
 10 years ago
Yawning Angel 7a7b2af516 Fix e-mail address in the copyright notice. 10 years ago
Yawning Angel 9bfdd77f72 Add preliminary support for packet length obfuscation. 
The same algorithm as ScrambleSuit is used, except:
 * SipHash-2-4 in OFB mode is used to create the distribution.
 * The system CSPRNG is used when sampling the distribution.

This fixes most of #3, all that remains is generating and sending a
persistent distribution on the server side to the client.
 10 years ago
Yawning Angel 51a8dd5a86 Fix logging again. 
On second thought instead of using log.Panicf(), panic() and do the
logging with recover().  This somewhat centralizes logging in
obfs4proxy, which will be easier to change when I invariably decide to
do logging differently in the future.
 10 years ago
Yawning Angel c3acefb7e5 Log and propagate errors between the 2 goroutines in copyLoop. 
This fixes #1.
 10 years ago
Yawning Angel 433ff8027d Fix a comment (No functional changes). 10 years ago
Yawning Angel 9712aec73b Preliminary support padding, log on panic. 
This adds preliminary support for data padding by adding another layer
of encapsulation inside each AEAD frame containing a type and length.
For now, data is still sent unpadded, but the infrastructure for
supporting it is mostly there.

Additionally, use log.Panic[f]() instead of panic through out the code
so that some panics are logged.
 10 years ago
Yawning Angel 8a1f58cd5a Remove support for Write deadlines since it wasn't working. 
Write timeouts are obnoxious to handle as the frame encoder state
already is updated to cover the entire payload for the Write() call
that timed out.  In theory it is possible to buffer the pending data,
but that causes Write() to voilate the semantics of the interface.
 10 years ago
Yawning Angel cca49e01a3 Set a timeout on outgoing handshakes as well. 10 years ago
Yawning Angel 9b6b3f825b Reject clients that do not authenticate quickly enough. 
The current timeout value before the server fails the handshake is
15 s.  This may need to be increased for clients over slow links.
 10 years ago
Yawning Angel 06a95ff1e0 Close connections that fail to authenticate after a while. 
Like ScrambleSuit, a random interval between 1x and 5x of additional
data from the peer is read and immediately discarded before closing.

Additionally, obfs4 will close off invalid connections anywhere between
0 and 60 seconds after it determines that the incoming connection will
never complete the handshake successfully.
 10 years ago
Yawning Angel c2f1e8ecb7 Clean up the logging a bit. 10 years ago
Yawning Angel 68c48cb383 Run go fmt on obfs4proxy.go (No functional changes). 10 years ago
Yawning Angel 8e14ed44ad Move to a unified client/server binary, and fix bugs. 
* The old and the busted: obfs4-[client,server].
 * The new hotness: obfs4client.
 * Add obfs4.ServerHandshake() that servers need to call after a
   successful return from Accept().  This allows implementations to
   move the handshake into a goroutine or whatever.
 10 years ago
Yawning Angel f76f142340 Change documentation/comments to reflect reality (No functional changes). 10 years ago