{"action":"created","issue":{"url":"https://api.github.com/repos/TokTok/c-toxcore/issues/419","repository_url":"https://api.github.com/repos/TokTok/c-toxcore","labels_url":"https://api.github.com/repos/TokTok/c-toxcore/issues/419/labels{/name}","comments_url":"https://api.github.com/repos/TokTok/c-toxcore/issues/419/comments","events_url":"https://api.github.com/repos/TokTok/c-toxcore/issues/419/events","html_url":"https://github.com/TokTok/c-toxcore/issues/419","id":200202622,"number":419,"title":"Message bytes and sizes sent over the network should be indistinguishable from the random stream","user":{"login":"yurivict","id":271906,"avatar_url":"https://avatars.githubusercontent.com/u/271906?v=3","gravatar_id":"","url":"https://api.github.com/users/yurivict","html_url":"https://github.com/yurivict","followers_url":"https://api.github.com/users/yurivict/followers","following_url":"https://api.github.com/users/yurivict/following{/other_user}","gists_url":"https://api.github.com/users/yurivict/gists{/gist_id}","starred_url":"https://api.github.com/users/yurivict/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/yurivict/subscriptions","organizations_url":"https://api.github.com/users/yurivict/orgs","repos_url":"https://api.github.com/users/yurivict/repos","events_url":"https://api.github.com/users/yurivict/events{/privacy}","received_events_url":"https://api.github.com/users/yurivict/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":5,"created_at":"2017-01-11T20:46:02Z","updated_at":"2017-01-11T21:02:13Z","closed_at":null,"body":"I am looking at what Tox sends over the network. Here are 3 sample sent packets:\r\n```\r\n 15771 qtox     GIO   fd 26 wrote 113 bytes\r\n       0x0000 0235 204f 8fbb 89ab c134 c4b7 2b80 245a 0b7d 8897 4e0e 8b4e 3f0e b22f 8651 eb3c 0dd3 532a a7fd c8fb 7acf  |.5 O.....4..+.$Z.}..N..N?../.Q.<..S*....z.|\r\n       0x002a c827 d3af 784b 9eaa 108f 181a 2087 f2bb eb22 880c 75e7 e332 a6a2 a047 9a0c 78dd 0a4c cae6 65fc b28e 68f3  |.'..xK...... ....\"..u..2...G..x..L..e...h.|\r\n       0x0054 96c6 b582 52bc ba79 a652 6e38 a335 da63 5365 61d0 9874 203e 2c17 6dd5 1b                                  |....R..y.Rn8.5.cSea..t >,.m..|\r\n\r\n 15771 qtox     GIO   fd 26 wrote 113 bytes\r\n       0x0000 0235 204f 8fbb 89ab c134 c4b7 2b80 245a 0b7d 8897 4e0e 8b4e 3f0e b22f 8651 eb3c 0ddc c552 c874 db4d 9802  |.5 O.....4..+.$Z.}..N..N?../.Q.<...R.t.M..|\r\n       0x002a ac47 04e1 5fe3 526d 6397 524d 4468 f620 f0b7 3194 9eee 43b9 1d60 21d9 49fd 2f33 cba4 00ce 5968 ab13 6249  |.G.._.Rmc.RMDh. ..1...C..`!.I./3....Yh..bI|\r\n       0x0054 1dfb b178 82cc ae9d 0cb8 4352 38f6 ebcc c7b1 b332 6612 3afe a02e cc23 74                                  |...x......CR8......2f.:....#t|\r\n\r\n 15771 qtox     GIO   fd 26 wrote 113 bytes\r\n       0x0000 0235 204f 8fbb 89ab c134 c4b7 2b80 245a 0b7d 8897 4e0e 8b4e 3f0e b22f 8651 eb3c 0d23 eaec 998f 047b 0196  |.5 O.....4..+.$Z.}..N..N?../.Q.<.#.....{..|\r\n       0x002a 8496 04ef 7a04 35c2 8d27 f54d 6a8e faf1 2f37 d464 0bcb fa77 64fc 39e0 3a5b 6592 a112 a859 1e4b f7b5 1bf2  |....z.5..'.Mj.../7.d...wd.9.:[e....Y.K....|\r\n       0x0054 29d2 953d 557f 2888 2d97 23e6 485e 7741 319a ed3a e176 16a4 2dc8 f0c8 fb                                  |)..=U.(.-.#.H^wA1..:.v..-....|\r\n\r\n```\r\n\r\nMany first bytes are same in different messages. Message sizes are all 113. (probably DHT traffix). UDP ports are also the same, 33445. This makes Tox traffic easily identifiable, and therefore blockable by rogue authority bodies.\r\n\r\nHere is how it should be: every peer has its private and public key. Peer IP is distributed along with its public key. Every message sent to it, including DHT messages, is randomly oversized, and encrypted with the destination peer's public key. Small message sizes should be random within some size range. This size range should be configurable in the advanced settings page.\r\n\r\nCurrently Tox can be easily blocked.\r\n\r\nIf the app sends packets with random-looking content, with packets having different sizes and sent on different ports, it makes identification of Tox traffic very hard.\r\n"},"comment":{"url":"https://api.github.com/repos/TokTok/c-toxcore/issues/comments/271993260","html_url":"https://github.com/TokTok/c-toxcore/issues/419#issuecomment-271993260","issue_url":"https://api.github.com/repos/TokTok/c-toxcore/issues/419","id":271993260,"user":{"login":"iphydf","id":10647936,"avatar_url":"https://avatars.githubusercontent.com/u/10647936?v=3","gravatar_id":"","url":"https://api.github.com/users/iphydf","html_url":"https://github.com/iphydf","followers_url":"https://api.github.com/users/iphydf/followers","following_url":"https://api.github.com/users/iphydf/following{/other_user}","gists_url":"https://api.github.com/users/iphydf/gists{/gist_id}","starred_url":"https://api.github.com/users/iphydf/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/iphydf/subscriptions","organizations_url":"https://api.github.com/users/iphydf/orgs","repos_url":"https://api.github.com/users/iphydf/repos","events_url":"https://api.github.com/users/iphydf/events{/privacy}","received_events_url":"https://api.github.com/users/iphydf/received_events","type":"User","site_admin":false},"created_at":"2017-01-11T21:02:13Z","updated_at":"2017-01-11T21:02:13Z","body":"I wasn't aware. That is very interesting! Do you have access to a Chinese IP or know a person who does so we can investigate how they are doing it? There are several ways to do it, and changing the packet length is only one of them. Here are a few ways:\r\n- Detecting packet lengths. Requires a stateful firewall to recognise patterns - you can't just block all packets of length 113.\r\n- Detecting other patterns in the protocol, e.g. we have plain text public keys always in the same place in DHT packets. Also requires stateful firewall.\r\n- Block port 33445. No stateful firewall needed, just a simple UDP port block.\r\n- Block any access to any of the bootstrap nodes. This is quite likely to be the thing China is doing, given that this is usually the way China blocks anything."}}
{"actor":{"display_login":"iphydf"}}