go.psiphon.dev/tunnel-core
Psiphon is an Internet censorship circumvention system.
The tunnel core project includes a tunneling client and server, which together implement key aspects of evading blocking and relaying client traffic through Psiphon and beyond censorship.
All Psiphon open source projects, including the complete open source code for Android, iOS, and Windows clients may be found at www.github.com/Psiphon-Inc/psiphon.
For more information about Psiphon Inc., please visit our web site at www.psiphon.ca.
psiphon-tunnel-core
└── ClientLibrary General client libraries
└── ConsoleClient CLI client program
└── MobileLibrary Android/iOS client libraries
└── Server Server program
└── psiphon Client code package
└── common\... Common code packages
└── server Server code package
Psiphon tunnels Internet traffic through a network of proxy servers with the goal of circumventing Internet censorship.
Users run a client program which connects to a proxy server and routes client host Internet traffic through a tunnel established to the proxy. Traffic egresses from the proxy, which is located beyond the entity censoring the user's Internet.
Psiphon has multiple routing modes:
At the core of all tunnels is an SSH connection which protects the confidentiality and integrity of client traffic between the client host and the proxy server. Clients authenticate the SSH server using pre-shared public keys, ensuring clients connect only to authentic Psiphon servers.
Server connection information, including SSH public keys, addresses, and obfuscation parameters are distributed to clients in the form of a list of "server entries". Each server entry fully describes one Psiphon server.
Clients binaries may be built with embedded server lists. Clients may also "discover" new server entries when they successfully connect to a server.
Psiphon also uses out-of-band server list delivery mechanisms, including fetching server lists from drops which are configured in the clients. All out-of-band mechanisms perform additional server list verification using public keys configured in the clients.
All delivery mechanisms use partitioning to prevent trivial enumeration of all server entries.
Some out-of-band server server lists, called "obfuscated server lists", are encrypted and only clients that have been granted sufficient required keys can access the included servers.
The core SSH protocol is wrapped in optional obfuscation layers which transform traffic in order to evade blocking of Psiphon servers. Mitigated attacks include endpoint blocking, keyword-based blocking, DPI-based blocking, and more.
Obfuscation techniques include:
To minimize connection time, Psiphon makes multiple concurrent connection attempts to different servers using different obfuscation techniques. This process generally selects the fastest working obfuscation technique and server. This process is how Psiphon load balances clients across its network of servers without using a centralized load balancing mechanism.
A successful connection may be subject to further quality tests before selection. The Psiphon client remembers which servers and which obfuscation techniques and parameters are successful and prioritizes using the same on subsequent connections.
Psiphon uses a mechanism called "tactics" to remotely deliver targeted, optimized configuration and obfuscation parameters to clients.
Official binaries are avaiable at:
For these instructions, use:
Run the "generate" mode of psiphond to generate configs, setting the IP address as appropriate; this is the address the client will use to connect to the server.
$ ./psiphond -ipaddress 127.0.0.1 -protocol OSSH:9999 -protocol generate
$ ls
psiphond
psiphond.config
psiphond-osl.config
psiphond-tactics.config
psiphond-traffic-rules.config
server-entry.dat
Create a client config file, copying the contents of server-entry.dat to the TargetServerEntry field.
$ cat server-entry.dat
3132372e302e302e31202020207b22746167223a22222c2269[...]
$ cat client.config
{
"LocalHttpProxyPort" : 8080,
"LocalSocksProxyPort" : 1080,
"PropagationChannelId" : "24BCA4EE20BEB92C",
"SponsorId" : "721AE60D76700F5A",
"TargetServerEntry" : "3132372e302e302e31202020207b22746167223a22222c2269[...]"
}
$ ./psiphond run
{"localAddress":"127.0.0.1:9999","msg":"listening","tunnelProtocol":"OSSH",[...]}
{"localAddress":"127.0.0.1:9999","msg":"running","tunnelProtocol":"OSSH",[...]}
[...]
$ ./ConsoleClient -config ./client.config
{"data":{"port":1080},"noticeType":"ListeningSocksProxyPort",[...]}
{"data":{"port":8080},"noticeType":"ListeningHttpProxyPort",[...]}
[...]
{"data":{"count":1},"noticeType":"Tunnels",[...]}
Use the local SOCKS proxy (port 1080) or HTTP proxy (port 8080) to tunnel traffic.
Psiphon Tunnel Core uses:
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.
Research
Security News
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
Security News
NVD’s backlog surpasses 20,000 CVEs as analysis slows and NIST announces new system updates to address ongoing delays.