neko-obfs: a TCP tunnel with packet length obfuscation

This is a package candidate release! Here you can preview how this package release will appear once published to the main package index (which can be accomplished via the 'maintain' link below). Please note that once a package has been published to the main package index it cannot be undone! Please consult the package uploading documentation for more information.

[maintain] [Publish]

Just another tool that helps accessing the internet

[Skip to Readme]

Properties

Versions	0.1.0.0, 0.1.0.1, 0.1.0.2, 0.1.0.4, 0.1.0.4
Change log	ChangeLog.md
Dependencies	async, attoparsec, base (>=4.11 && <7), binary, bytestring, lens, network, network-simple, optparse-generic, pipes, pipes-attoparsec, pipes-network, pipes-safe, random, text, transformers [details]
License	Apache-2.0
Author	Jinjing Wang
Maintainer	nfjinjing@gmail.com
Category	Network
Home page	http://github.com/nfjinjing/neko-obfs
Uploaded	by JinjingWang at 2019-11-23T08:28:29Z

Downloads

neko-obfs-0.1.0.4.tar.gz [browse] (Cabal source package)
Package description (as included in the package)

Maintainer's Corner

Package maintainers

JinjingWang

For package maintainers and hackage trustees

edit package information

Readme for neko-obfs-0.1.0.4

[back to package description]

Protocol

payload

-> 

n | padding | m | payload

n (word32be): the number of bytes of padding
padding: n bytes of noise
m (word32be): the number of bytes of the original payload
payload: the original packet

Implementation

n is deduced from a randomly generated i = n + m for each packet.
When a random i is less then m, payload is split to p1 and p2 to satisfy the constrain, where the length of p1 is equal to i and p1 + p2 = payload. p2 will be sent in the next iteration by the same algorithm.
i is bounded by a maximum r, configurable by the --randomnessInBytes argument.
To reduce overhead, n is set to 0 whenever m is greater then r.

Usage

local:

  neko-obfs --localHost TEXT --localPort INTEGER --remoteHost TEXT --remotePort INTEGER

remote:

  neko-obfs --role remote --remoteHost TEXT --remotePort INTEGER --forwardHost TEXT --forwardPort INTEGER

This tunnel should be used inside an encrypted tunnel.

For example:

  ss-local (rc4)

    -> neko-obfs -> ss-tunnel (aes-256-cfb)

      -> gfw -> internet

    -> ss-tunnel (aes-256-cfb) -> neko-obfs 

  -> ss-server (rc4)

Note it's the ss-tunnel layer that protects the obfuscation, otherwise data and noise length are clearly visible.

Performance

No noticeable slow down yet (Jul 24, 2017)