-
Notifications
You must be signed in to change notification settings - Fork 3
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feat(ss): enhance the anti-detection capability
- Loading branch information
Showing
12 changed files
with
291 additions
and
32 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
9 changes: 9 additions & 0 deletions
9
...-spork-common/src/com/urbanspork/common/codec/shadowsocks/tcp/RepeatedNonceException.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,9 @@ | ||
| package com.urbanspork.common.codec.shadowsocks.tcp; | ||
|
|
||
| import io.netty.handler.codec.DecoderException; | ||
|
|
||
| class RepeatedNonceException extends DecoderException { | ||
| RepeatedNonceException(String message) { | ||
| super(message); | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
9 changes: 9 additions & 0 deletions
9
...spork-common/src/com/urbanspork/common/codec/shadowsocks/tcp/TooShortHeaderException.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,9 @@ | ||
| package com.urbanspork.common.codec.shadowsocks.tcp; | ||
|
|
||
| import io.netty.handler.codec.DecoderException; | ||
|
|
||
| class TooShortHeaderException extends DecoderException { | ||
| TooShortHeaderException(String message) { | ||
| super(message); | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
123 changes: 123 additions & 0 deletions
123
urban-spork-test/src/com/urbanspork/test/tool/TcpCapture.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,123 @@ | ||
| package com.urbanspork.test.tool; | ||
|
|
||
| import com.urbanspork.common.channel.DefaultChannelInboundHandler; | ||
| import io.netty.bootstrap.Bootstrap; | ||
| import io.netty.bootstrap.ServerBootstrap; | ||
| import io.netty.buffer.ByteBuf; | ||
| import io.netty.buffer.ByteBufUtil; | ||
| import io.netty.channel.Channel; | ||
| import io.netty.channel.ChannelFutureListener; | ||
| import io.netty.channel.ChannelHandlerContext; | ||
| import io.netty.channel.ChannelInboundHandlerAdapter; | ||
| import io.netty.channel.ChannelOption; | ||
| import io.netty.channel.ChannelPromise; | ||
| import io.netty.channel.EventLoopGroup; | ||
| import io.netty.channel.nio.NioEventLoopGroup; | ||
| import io.netty.channel.socket.ServerSocketChannel; | ||
| import io.netty.channel.socket.SocketChannel; | ||
| import io.netty.channel.socket.nio.NioServerSocketChannel; | ||
| import io.netty.channel.socket.nio.NioSocketChannel; | ||
| import io.netty.handler.logging.LoggingHandler; | ||
| import io.netty.util.concurrent.Promise; | ||
| import org.slf4j.Logger; | ||
| import org.slf4j.LoggerFactory; | ||
|
|
||
| import java.net.InetAddress; | ||
| import java.util.ArrayList; | ||
| import java.util.List; | ||
| import java.util.concurrent.ExecutionException; | ||
| import java.util.function.BiConsumer; | ||
|
|
||
| public class TcpCapture { | ||
| private static final Logger logger = LoggerFactory.getLogger(TcpCapture.class); | ||
| private final EventLoopGroup bossGroup = new NioEventLoopGroup(); | ||
| private final EventLoopGroup workerGroup = new NioEventLoopGroup(); | ||
| private final List<byte[]> outboundCapture = new ArrayList<>(); | ||
| private final int remotePort; | ||
| private final boolean block; | ||
| private final ServerSocketChannel localChannel; | ||
| private final Promise<List<byte[]>> outboundPromise; | ||
|
|
||
| public TcpCapture(int remotePort, boolean block) { | ||
| this.remotePort = remotePort; | ||
| this.block = block; | ||
| this.localChannel = startup(); | ||
| this.outboundPromise = bossGroup.next().newPromise(); | ||
| } | ||
|
|
||
| public List<byte[]> nextOutboundCapture() throws InterruptedException, ExecutionException { | ||
| return outboundPromise.get(); | ||
| } | ||
|
|
||
| public ServerSocketChannel getLocalChannel() { | ||
| return localChannel; | ||
| } | ||
|
|
||
| public void send(byte[] msg, BiConsumer<SocketChannel, byte[]> func) throws InterruptedException { | ||
| SocketChannel channel = (SocketChannel) new Bootstrap().group(bossGroup) | ||
| .option(ChannelOption.TCP_NODELAY, true) | ||
| .channel(NioSocketChannel.class) | ||
| .handler(new LoggingHandler() { | ||
| @Override | ||
| public void exceptionCaught(ChannelHandlerContext ctx, Throwable cause) { | ||
| TcpCapture.logger.error("{}: {}", ctx.channel(), cause.getMessage()); | ||
| ctx.close(); | ||
| } | ||
| }) | ||
| .connect(InetAddress.getLoopbackAddress(), remotePort) | ||
| .sync().channel(); | ||
| func.accept(channel, msg); | ||
| channel.closeFuture().sync(); | ||
| } | ||
|
|
||
| private ServerSocketChannel startup() { | ||
| return (ServerSocketChannel) new ServerBootstrap().group(bossGroup, workerGroup) | ||
| .channel(NioServerSocketChannel.class) | ||
| .childHandler(new ChannelInboundHandlerAdapter() { | ||
| private ChannelPromise promise; | ||
|
|
||
| @Override | ||
| public void handlerAdded(ChannelHandlerContext ctx) { | ||
| promise = ctx.newPromise(); | ||
| Channel inbound = ctx.channel(); | ||
| new Bootstrap().group(inbound.eventLoop()) | ||
| .channel(inbound.getClass()) | ||
| .handler(new DefaultChannelInboundHandler(inbound)) | ||
| .connect(InetAddress.getLoopbackAddress(), remotePort).addListener((ChannelFutureListener) future -> { | ||
| if (future.isSuccess()) { | ||
| Channel outbound = future.channel(); | ||
| inbound.pipeline().addLast(new DefaultChannelInboundHandler(outbound)); | ||
| promise.setSuccess(); | ||
| } else { | ||
| logger.error("Connect target localhost:{} failed", remotePort, future.cause()); | ||
| promise.setFailure(future.cause()); | ||
| ctx.close(); | ||
| } | ||
| } | ||
| ); | ||
| } | ||
|
|
||
| @Override | ||
| public void channelRead(ChannelHandlerContext ctx, Object msg) { | ||
| if (msg instanceof ByteBuf buf) { | ||
| logger.info("captured outbound: {} bytes", buf.readableBytes()); | ||
| outboundCapture.add(ByteBufUtil.getBytes(buf)); | ||
| if (!outboundPromise.isDone()) { | ||
| outboundPromise.setSuccess(outboundCapture); | ||
| } | ||
| if (block) { | ||
| return; | ||
| } | ||
| if (promise.isDone()) { | ||
| ctx.fireChannelRead(buf); | ||
| } else { | ||
| promise.addListener(c -> ctx.fireChannelRead(buf)); | ||
| } | ||
| } else { | ||
| ctx.fireChannelRead(msg); | ||
| } | ||
| } | ||
| }) | ||
| .bind(0).syncUninterruptibly().channel(); | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
97 changes: 97 additions & 0 deletions
97
urban-spork-test/test/com/urbanspork/test/TcpPreventionTest.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,97 @@ | ||
| package com.urbanspork.test; | ||
|
|
||
| import com.urbanspork.client.Client; | ||
| import com.urbanspork.common.codec.CipherKind; | ||
| import com.urbanspork.common.config.ClientConfig; | ||
| import com.urbanspork.common.config.ClientConfigTest; | ||
| import com.urbanspork.common.config.ServerConfig; | ||
| import com.urbanspork.common.config.ServerConfigTest; | ||
| import com.urbanspork.common.config.ServerUserConfig; | ||
| import com.urbanspork.common.protocol.Protocol; | ||
| import com.urbanspork.server.Server; | ||
| import com.urbanspork.test.template.TcpTestTemplate; | ||
| import com.urbanspork.test.tool.TcpCapture; | ||
| import io.netty.buffer.Unpooled; | ||
| import io.netty.channel.Channel; | ||
| import io.netty.util.NetUtil; | ||
| import org.junit.jupiter.api.Assertions; | ||
| import org.junit.jupiter.api.Test; | ||
|
|
||
| import java.util.ArrayList; | ||
| import java.util.Arrays; | ||
| import java.util.List; | ||
| import java.util.concurrent.ExecutionException; | ||
| import java.util.concurrent.TimeoutException; | ||
|
|
||
| class TcpPreventionTest extends TcpTestTemplate { | ||
| private List<Server.Instance> server; | ||
| private TcpCapture capture; | ||
| private Client.Instance client; | ||
|
|
||
| @Test | ||
| void testTooShortHeader() throws InterruptedException, ExecutionException { | ||
| setUp(true); | ||
| Channel channel = connect(client.tcp().localAddress()); | ||
| String request = "GET http://" + NetUtil.toSocketAddressString(dstAddress) + "/?a=b&c=d HTTP/1.1\r\n\r\n"; | ||
| channel.writeAndFlush(Unpooled.wrappedBuffer(request.getBytes())).sync(); | ||
| byte[] msg = capture.nextOutboundCapture().getLast(); | ||
| capture.send(msg, (c, m) -> { | ||
| byte[] header = Arrays.copyOf(m, 42); | ||
| c.writeAndFlush(Unpooled.wrappedBuffer(header)); | ||
| int i = 42; | ||
| for (; i < m.length; i++) { | ||
| if (!c.isActive()) { | ||
| c.writeAndFlush(Unpooled.wrappedBuffer(new byte[]{msg[i]})); | ||
| } | ||
| } | ||
| Assertions.assertEquals(msg.length, i); | ||
| }); | ||
| closeServer(server); | ||
| client.close(); | ||
| } | ||
|
|
||
| @Test | ||
| void testReplayAttack() throws ExecutionException, InterruptedException, TimeoutException { | ||
| setUp(false); | ||
| checkHttpSendBytes(client.tcp().localAddress()); | ||
| byte[] msg = capture.nextOutboundCapture().getLast(); | ||
| capture.send(msg, (c, m) -> { | ||
| byte[] header = Arrays.copyOf(m, 75); | ||
| c.writeAndFlush(Unpooled.wrappedBuffer(header)); | ||
| int count = 75; | ||
| for (int i = 75; i < m.length; i++) { | ||
| if (c.isWritable()) { | ||
| count++; | ||
| c.writeAndFlush(Unpooled.wrappedBuffer(new byte[]{m[i]})); | ||
| } else { | ||
| break; | ||
| } | ||
| } | ||
| Assertions.assertEquals(msg.length, count); | ||
| }); | ||
| closeServer(server); | ||
| client.close(); | ||
| } | ||
|
|
||
| void setUp(boolean block) throws ExecutionException, InterruptedException { | ||
| ServerConfig serverConfig = ServerConfigTest.testConfig(0); | ||
| Protocol protocol = Protocol.shadowsocks; | ||
| CipherKind cipher = CipherKind.aead2022_blake3_aes_256_gcm; | ||
| serverConfig.setProtocol(protocol); | ||
| serverConfig.setCipher(cipher); | ||
| String clientPassword = TestDice.rollPassword(protocol, cipher); | ||
| String serverPassword = TestDice.rollPassword(protocol, cipher); | ||
| serverConfig.setPassword(serverPassword); | ||
| List<ServerUserConfig> user = new ArrayList<>(); | ||
| user.add(new ServerUserConfig(TestDice.rollString(10), clientPassword)); | ||
| serverConfig.setUser(user); | ||
| server = launchServer(List.of(serverConfig)); | ||
| capture = new TcpCapture(serverConfig.getPort(), block); | ||
| ClientConfig config = ClientConfigTest.testConfig(0, capture.getLocalChannel().localAddress().getPort()); | ||
| ServerConfig current = config.getCurrent(); | ||
| current.setCipher(serverConfig.getCipher()); | ||
| current.setProtocol(serverConfig.getProtocol()); | ||
| current.setPassword(serverPassword + ":" + clientPassword); | ||
| client = launchClient(config); | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.