mirror of https://github.com/ospab/ostp.git
db65e3367f
Anti-DPI obfuscation the project wants to keep, ported from 0.3.x with the harmful UDP behaviour designed out from the start. - Junk: before the handshake on a UoT/TCP connection, send 2-5 random length-prefixed frames (100-1000 B). The server reads each as a frame, fails to authenticate it, drops it and keeps reading (drop-and-continue), so junk perturbs DPI flow analysis without breaking the connection. Junk is NEVER sent over UDP — there each junk would be a lone datagram indistinguishable from a port scan (probe-flood / wasted CPU / the very "self-ban" risk the plan calls out). Verified the server has no probe-based ban, and the unauthorized-probe log is already rate-limited (§B), so junk-over-UoT produces one debug line, not a flood. - TCP fragmentation: new `transport.tcp_fragmentation` flag (default off). When set, the writer splits the first real frame (the handshake) — length header byte-by-byte then payload in 2-byte chunks with short gaps — so DPI can't classify the handshake from a single read. - Ranges are hardcoded for now; §E fine-tuning (configurable Jc/Jmin/Jmax, S1/S2, H1..H4) is deferred. Verified by loopback E2E: a UoT client with tcp_fragmentation=true connects (junk logged as one rate-limited probe, then real handshake accepted) and curl via SOCKS5 tunnels HTTPS successfully. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| bin | ||
| transport | ||
| tui | ||
| tunnel | ||
| app.rs | ||
| bridge.rs | ||
| config.rs | ||
| lib.rs | ||
| logging.rs | ||
| runner.rs | ||
| signal.rs | ||
| sysproxy.rs | ||