Archives
/
obfs4
mirror of https://gitlab.com/yawning/obfs4
2
0
Fork 0
Code Issues Projects Releases Wiki Activity
170 Commits
1 Branch
14 Tags
520 KiB
master
obfs4proxy-0.0.14
obfs4proxy-0.0.13
obfs4proxy-0.0.12
obfs4proxy-0.0.11
obfs4proxy-0.0.10
obfs4proxy-0.0.9
obfs4proxy-0.0.8
obfs4proxy-0.0.7
obfs4proxy-0.0.6
obfs4proxy-0.0.5
obfs4proxy-0.0.4
obfs4proxy-0.0.3
obfs4proxy-0.0.2
obfs4proxy-0.0.1
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from '8a19b4fcb1'
${ noResults }
Commit Graph

170 Commits (8a19b4fcb16d6e75932a6aa91c414594fdd92562)
 

Author SHA1 Message Date
Yawning Angel bd2bef2ead Fix import lines so other people using go get works. 10 years ago
Yawning Angel b579f6f4d4 Use io.ReadFull in places where it is appropriate. 10 years ago
Yawning Angel 49d3f6e8bb Run go fmt on proxy_http.go (No functional changes). 10 years ago
Yawning Angel c05a7a2e34 Add support for HTTP CONNECT proxies. 
Joining a SOCKS dialer on the list of things the Golang runtime really
should have is a HTTP CONNECT dialer.  There's a full fledged HTTP
client and server there, but not this.  Why?  Who knows.

This fixes issue #7.
 10 years ago
Yawning Angel f0d8923a9a Move the SOCKS4 code off into it's own little getto. 
Part of issue #7.
 10 years ago
Yawning Angel 3c64e04e02 Add support for SOCKS4. 
Despite the unfortunate scheme name, this really is SOCKS4, and not 4a,
as the torrc Socks4Proxy option only supports addresses and not FQDNs.

Part of issue #7.
 10 years ago
Yawning Angel f0090b5127 Rename to be consistent. 10 years ago
Yawning Angel 92494597ce Wire in go.net/proxy, enabling SOCKS5 via TOR_PT_PROXY. 
With tor patched to support 8402, obfs4 bootstraps via a SOCKSv5 proxy
now.  Other schemes will bail with a PROXY-ERROR, as the go.net/proxy
package does not support them, and I have not gotten around to writing
dialers for them yet (next on my TODO list).

Part of issue #7.
 10 years ago
Yawning Angel b3d17c327b Validate the host component of the proxy URI. 
Part of issue #7.
 10 years ago
Yawning Angel d5c3a25dec Parse TOR_PT_PROXY and support sending DONE/PROXY-ERROR. 
Currently obfs4proxy is hardcoded to always PROXY-ERROR, despite a
valid proxy uri being passed in the env var.  Once the dialer portion
of the code is done, this will be changed.

Part of issue #7.
 10 years ago
Yawning Angel f04fd166ac Move the supplemental pt config routines to pt_extra.go 10 years ago
Yawning Angel 3e3b07c4e8 Don't use math/big when generating random numbers. 10 years ago
Yawning Angel 8cd2e1f0f9 Randomize length when the decoder receives an out-of-bound value. 
This makes the length error and MAC error indistinguishable to an
external attacker.
 10 years ago
Yawning Angel b3f0f51775 Move utils.go to csrand/csrand.go, and clean up the interface. 
All of the obfs4 code except unit tests now uses the csrand wrapper
routines.
 10 years ago
Yawning Angel e77ddddf4d Add support for IAT obfuscation (disabled by default). 
When enabled, inter-packet delay will be randomized between 0 and 10
ms in 100 usec intervals.  As experiences from ScrambleSuit (and back
of the envelope math based on how networks work) show, this is
extremely expensive and artificially limits the throughput of the link.

When enabled, bulk transfer throughput will be limited to an average of
278 KiB/s.
 10 years ago
Yawning Angel 272fb852e7 Change the maximm handshake length to 8192 bytes. 
* handhake_ntor_test now is considerably more comprehensive.
 * The padding related constants in the spec were clarified.

This breaks wireprotocol compatibility.
 10 years ago
Yawning Angel fd4e3c7c74 Add replay detection to handshakes. 
This is done by maintaining a map keyed off the SipHash-2-4 digest of
the MAC_C component of the handshake.  Collisions, while possible are
unlikely in the extreme and are thus treated as replays.

In concept this is fairly similar to the ScrambleSuit `replay.py` code,
with a few modifications:

 * There is a upper bound on how large the replay filter can grow.
   Currently this is set to 102400 entries, though it is unlikely that
   this limit will be hit.

 * A doubly linked list is also maintained parallel to the map, so the
   filter compaction process does not need to iterate over the entire
   filter.
 10 years ago
Yawning Angel 7dd875fe4c Revert "Use the new goptlib goodies." 
This reverts commit 8d61c6bcc6.

On second thought, don't do this.  API not final, and some of the stuff
might not be a good idea after all.
 10 years ago
Yawning Angel f4b3821292 Fix constants in the spec to reflect the code. 10 years ago
Yawning Angel 8d61c6bcc6 Use the new goptlib goodies. 
As of `15b960d55905877a840fe605a41a8139bffb5329` goptlib supports
IsClient, IsServer, and handling the StateLocation.

Yes this means you need to use goptlib out of git.
 10 years ago
Yawning Angel 19f34317ba Change the MSS to 1448 bytes, because timestamps are a thing. 
This breaks wireprotocol compatibility.
 10 years ago
Yawning Angel 7c37109c48 Add support for a log scrubber and log a session id. 
This fixes #6.
 10 years ago
Yawning Angel b50a8bdf24 Finish adding godoc comments to all public interfaces. 10 years ago
Yawning Angel 676e0428e7 Allow logging to be disabled (default). 
Part of #6, still need to make logs nicer.
 10 years ago
Yawning Angel 66edb786db Tweak the obfs4 handshake code. 
* Fixed where the code wasn't ensuring that the MAC_[C,S] was present.
 * Optimized the server side to only look at the tail of the (possibly
   incomplete handshakeRequest).
 10 years ago
Yawning Angel a853a1f0aa Actually keep the delay/threshold in the listener struct. 
This makes it consistent across all incoming connections, for real this
time (oops).
 10 years ago
Yawning Angel efb9d17c8c Change the server failure close delay/discard length to be consistent. 
It will vary per bridge as it is based off the DRBG, but ever attempt
at poking at any given bridge will exhibit consistent behavior.
 10 years ago
Yawning Angel 745d414645 Change the client connection timeout to 30 sec. 
This is more common than 15 seconds (It's what Firefox uses for the
request timeout).
 10 years ago
Yawning Angel a60f92cf95 Update the spec with feedback from arma (No functional changes). 10 years ago
Yawning Angel fc5e39a4ef Update README (No functional changes). 10 years ago
Yawning Angel b4f445233c Add a protocol specification. 
This fixes #4.
 10 years ago
Yawning Angel 08439afd13 Treat the PrngSeed frame as part of the handshake. 
Clients will now always add 87 bytes of padding to the clientRequest,
and Servers will always send the PRNG seed frame unpadded, and bundled
with the serverResponse.

Why 87 bytes?  The amount of data that the server sends is 87.

This fixes #5.
 10 years ago
Yawning Angel 8a431a64cb Validate that the padding length is greater than the minimum. 10 years ago
Yawning Angel 1fee9678c6 Change the length field obfscation. 
Instead of including the previous secretbox in the input when
calculating the  SipHash-2-4 digest used to generate the obfuscation
mask, use only the nonce.  This is significantly faster, and if someone
breaks obfs4 by exploiting the low amount of input entropy between each
invocation (a counter incrementing by 1), I hope they publish the
attack on the PRF.

This breaks wire protocol compatibility.
 10 years ago
Yawning Angel f4877920f8 Change the handshake wire format. 
* HMAC-SHA256 -> HMAC-SHA256-128.
 * Mark/MAC are now both caluclated using Public Key | NodeID.

This breaks wire protocol compatibility.
 10 years ago
Yawning Angel 7709069617 Send the DRBG seed as a packetTypePrngSeed post server handshake. 
This fixes #3, and brings the code to be on par with the delopyed
versions of ScrambleSuit in terms of features.
 10 years ago
Yawning Angel 6f875c99a9 Load the drbg-seed from the ServerTransportOptions args. 
This also adds the drgb-seed option to the `-gen` obfs4proxy output.
 10 years ago
Yawning Angel f1b1dcdb10 Change hashDrbg to take a drbgSeed for initialization. 
This paves the way for having servers use the same seed for all
incoming connections, across multiple startup/shutdown cycles.  As
opposed to the current situation where each Obfs4Listener will
randomly generate it's seed at creation time.

Additionally, use 256 bit seeds (128 bit SipHash-2-4 key + 16 bytes of
initial material).
 10 years ago
Yawning Angel b9e3aedfb1 Make the output from "-gen" be more useful. 10 years ago
Yawning Angel 50cc180084 Use os.MkdirAll() for creating the pt state directory. 10 years ago
Yawning Angel 013c3c7c4d Fix up how Read() errors were processed where appropriate. 10 years ago
Yawning Angel 79a7ad7f2b Changed the taglne to "The obfourscator", per dcf's suggestion. 10 years ago
Yawning Angel 8e552dbd48 Remove a newline to make godoc work (No functional changes). 10 years ago
Yawning Angel 48c6f06d04 Change the framing Encoder/Decoder to take the destination slice. 
In theory this is easier on the garbage collector.  Probably could
reuse more of the intermediary buffers by stashing them in the
connection state, but that makes the code kind of messy.  This should
be an improvement.
 10 years ago
Yawning Angel 89d5338eed Fix comment (No functional changes). 10 years ago
Yawning Angel 659efbc044 Update README (No functional changes). 10 years ago
Yawning Angel ded3f6948c Kill Obfs4Conn.isOk with fire, and replace it with a state var. 10 years ago
Yawning Angel 557e746815 First pass at cleaning up the write code. 10 years ago
Yawning Angel 731a926172 Implement the io.WriterTo interface. 10 years ago
Yawning Angel 582aa3a366 First pass at cleaning up the read code. 10 years ago