mirror of
https://github.com/p4gefau1t/trojan-go.git
synced 2024-04-21 12:21:34 +00:00
192 lines
11 KiB
HTML
192 lines
11 KiB
HTML
<!DOCTYPE html>
|
||
<html lang="zh-CN">
|
||
<head><meta charset="utf-8">
|
||
<meta http-equiv="X-UA-Compatible" content="IE=edge">
|
||
<meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no">
|
||
<title>Websocket - Trojan-Go Docs</title>
|
||
<meta name="description" content="An unidentifiable mechanism that helps you bypass GFW. ">
|
||
<meta name="generator" content="Hugo 0.69.2" />
|
||
<link href="https://p4gefau1t.github.io/trojan-goindex.xml" rel="alternate" type="application/rss+xml">
|
||
<link rel="canonical" href="https://p4gefau1t.github.io/trojan-go/developer/websocket/">
|
||
<link rel="stylesheet" href="https://p4gefau1t.github.io/trojan-go/css/theme.min.css">
|
||
<script src="https://use.fontawesome.com/releases/v5.0.6/js/all.js"></script>
|
||
<link rel="stylesheet" href="https://p4gefau1t.github.io/trojan-go/css/chroma.min.css">
|
||
<script src="https://cdn.jsdelivr.net/npm/jquery@3.4.1/dist/jquery.min.js"></script>
|
||
<script src="https://cdn.jsdelivr.net/npm/jquery.easing@1.4.1/jquery.easing.min.js"></script>
|
||
<script src="https://p4gefau1t.github.io/trojan-go/js/bundle.js"></script><style>
|
||
:root {}
|
||
</style>
|
||
<meta property="og:title" content="Websocket" />
|
||
<meta property="og:description" content="由于使用CDN中转时，HTTPS对CDN透明，CDN可以审查Websocket传输内容，而Trojan协议明文的头部特征过于明显，而TLS握" />
|
||
<meta property="og:type" content="article" />
|
||
<meta property="og:url" content="https://p4gefau1t.github.io/trojan-go/developer/websocket/" />
|
||
<meta property="og:image" content="https://p4gefau1t.github.io/trojan-go/images/og-image.png"/>
|
||
<meta property="og:site_name" content="Trojan-Go Docs" />
|
||
<meta name="twitter:card" content="summary_large_image"/>
|
||
<meta name="twitter:image" content="https://p4gefau1t.github.io/trojan-go/images/og-image.png"/>
|
||
|
||
<meta name="twitter:title" content="Websocket"/>
|
||
<meta name="twitter:description" content="由于使用CDN中转时，HTTPS对CDN透明，CDN可以审查Websocket传输内容，而Trojan协议明文的头部特征过于明显，而TLS握"/>
|
||
<meta itemprop="name" content="Websocket">
|
||
<meta itemprop="description" content="由于使用CDN中转时，HTTPS对CDN透明，CDN可以审查Websocket传输内容，而Trojan协议明文的头部特征过于明显，而TLS握">
|
||
|
||
<meta itemprop="wordCount" content="1093">
|
||
<meta itemprop="image" content="https://p4gefau1t.github.io/trojan-go/images/og-image.png"/>
|
||
|
||
|
||
|
||
<meta itemprop="keywords" content="" /></head>
|
||
<body><div class="container"><header>
|
||
<h1>Trojan-Go Docs</h1>
|
||
|
||
<span class="version">Version 0.4.8</span>
|
||
<a href="https://github.com/p4gefau1t/trojan-go" class="github"><i class="fab fa-github"></i></a>
|
||
<p class="description">An unidentifiable mechanism that helps you bypass GFW. </p>
|
||
|
||
</header>
|
||
<div class="global-menu">
|
||
<nav>
|
||
<ul>
|
||
<li><a href="/trojan-go/">Home</a></li>
|
||
<li><a href="https://github.com/p4gefau1t">GitHub</a></li></ul>
|
||
</nav>
|
||
</div>
|
||
<div class="content-container">
|
||
<main><h1>Websocket</h1>
|
||
<p>由于使用CDN中转时，HTTPS对CDN透明，CDN可以审查Websocket传输内容，而Trojan协议明文的头部特征过于明显，而TLS握手特征也很明显。为了保证Websocket传输的隐蔽和安全，默认情况下还会进行一次AES加密(混淆层)和TLS连接(双重TLS)。其中TLS用于保证传输的安全性，AES加密仅仅只是用于混淆流量。</p>
|
||
<p><strong>如果你使用的是国内的CDN，务必保证两者均开启。最坏情况下也应当保持混淆和双重TLS之一是打开的。</strong></p>
|
||
<p>开启Websocket模块的客户端可以使用<code>obfuscation</code>字段开启混淆，以及使用<code>double_tls</code>启用双重TLS以确保连接安全性和隐蔽性。</p>
|
||
<p>混淆层使用AES-CTR-128密码系统。加密主密钥派生自<code>obfuscation_password</code>，使用16字节的盐和sha1散列算法，使用pbkdf2对<code>obfuscation_password</code>密码进行32次迭代，派生得到16字节的主密钥。盐为硬编码的随机字节，定义为</p>
|
||
<div class="highlight"><pre style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-go" data-lang="go"><span style="color:#a6e22e">salt</span> <span style="color:#f92672">:=</span> []<span style="color:#66d9ef">byte</span>{<span style="color:#ae81ff">48</span>, <span style="color:#ae81ff">149</span>, <span style="color:#ae81ff">6</span>, <span style="color:#ae81ff">18</span>, <span style="color:#ae81ff">13</span>, <span style="color:#ae81ff">193</span>, <span style="color:#ae81ff">247</span>, <span style="color:#ae81ff">116</span>, <span style="color:#ae81ff">197</span>, <span style="color:#ae81ff">135</span>, <span style="color:#ae81ff">236</span>, <span style="color:#ae81ff">175</span>, <span style="color:#ae81ff">190</span>, <span style="color:#ae81ff">209</span>, <span style="color:#ae81ff">146</span>, <span style="color:#ae81ff">48</span>}
|
||
</code></pre></div><p>在每次连接开始时，生成16字节的随机IV。根据主密钥和IV，使用AES-CTR-128密码系统对后续流量进行加密。Websocket承载的客户端到服务端的头部结构如下（IV随着Payload一起发送，避免了长度特征）：</p>
|
||
<div class="highlight"><pre style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-text" data-lang="text">+----+-------------------+
|
||
| IV | Encrypted Payload |
|
||
+----+-------------------+
|
||
| 16 | Variable |
|
||
+----+-------------------+
|
||
</code></pre></div><p>服务端用同样的方法得到主密钥，接收IV后进行解密和后续的双向通讯。服务端到客户端的流量无头部，均为密文。</p>
|
||
<div class="highlight"><pre style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-text" data-lang="text">+------------------------+
|
||
| Encrypted Payload |
|
||
+------------------------+
|
||
| Variable |
|
||
+------------------------+
|
||
</code></pre></div><p>注意，这层加密作用仅仅是增加数据流的熵，混淆流量特征，而不是保护数据安全。CTR加密模式不保证数据完整性和身份认证，因此可能遭受CDN或者中间人的重放攻击。如果CDN不可信，或者遭受了基于HTTPS劫持的中间人攻击，应启用双重TLS保证数据传输安全。</p>
|
||
<p>如果使用了双重TLS，握手造成的延迟可能略有增加，但是只要开启<code>session_reuse</code>，<code>session_ticket</code>复用TLS连接，以及开启<code>mux</code>启用TLS多路复用，只会在开启Trojan-Go时的最初几秒察觉明显的延迟。</p>
|
||
<p>当Websocket握手成功，但认证失败（混淆密码错误，用户密码sha224错误，TLS设置不一致），服务端将尝试与remote_addr:remote_port的服务器进行相同的Websocket握手过程，并将此websocket连接代理给它。如果它的Websocket握手失败，服务端将关闭该Websocket连接。</p>
|
||
<p>开启Websocket支持后，协议栈如下：</p>
|
||
<table>
|
||
<thead>
|
||
<tr>
|
||
<th>协议</th>
|
||
<th>备注</th>
|
||
</tr>
|
||
</thead>
|
||
<tbody>
|
||
<tr>
|
||
<td>真实流量</td>
|
||
<td></td>
|
||
</tr>
|
||
<tr>
|
||
<td>SimpleSocks</td>
|
||
<td>如果开启多路复用</td>
|
||
</tr>
|
||
<tr>
|
||
<td>smux</td>
|
||
<td>如果开启多路复用</td>
|
||
</tr>
|
||
<tr>
|
||
<td>Trojan</td>
|
||
<td></td>
|
||
</tr>
|
||
<tr>
|
||
<td>TLS</td>
|
||
<td>如果开启双重TLS</td>
|
||
</tr>
|
||
<tr>
|
||
<td>混淆层</td>
|
||
<td>如果开启混淆</td>
|
||
</tr>
|
||
<tr>
|
||
<td>Websocket</td>
|
||
<td></td>
|
||
</tr>
|
||
<tr>
|
||
<td>TLS</td>
|
||
<td></td>
|
||
</tr>
|
||
<tr>
|
||
<td>TCP</td>
|
||
<td></td>
|
||
</tr>
|
||
</tbody>
|
||
</table>
|
||
<div class="edit-meta">
|
||
|
||
<br><a href="https://github.com/p4gefau1t/trojan-go/docs/edit/master/content/developer/websocket.md" class="edit-page"><i class="fas fa-pen-square"></i> Edit on GitHub</a></div><nav class="pagination"><a class="nav nav-prev" href="https://p4gefau1t.github.io/trojan-go/developer/mux/" title="多路复用"><i class="fas fa-arrow-left" aria-hidden="true"></i> Prev - 多路复用</a>
|
||
<a class="nav nav-next" href="https://p4gefau1t.github.io/trojan-go/developer/simplesocks/" title="SimpleSocks协议">Next - SimpleSocks协议 <i class="fas fa-arrow-right" aria-hidden="true"></i></a>
|
||
</nav><footer><p class="powered">Powered by <a href="https://gohugo.io">Hugo</a>. Theme by <a href="https://themes.gohugo.io/hugo-theme-techdoc/">TechDoc</a>. Designed by <a href="https://github.com/thingsym/hugo-theme-techdoc">Thingsym</a>.</p>
|
||
</footer>
|
||
</main><div class="sidebar">
|
||
|
||
<nav class="open-menu">
|
||
<ul>
|
||
<li class=""><a href="https://p4gefau1t.github.io/trojan-go">Home</a></li>
|
||
|
||
<li class=""><a href="https://p4gefau1t.github.io/trojan-go/basic/">基本配置</a>
|
||
|
||
<ul class="sub-menu">
|
||
<li class=""><a href="https://p4gefau1t.github.io/trojan-go/basic/trojan/">Trojan基本原理</a></li>
|
||
<li class=""><a href="https://p4gefau1t.github.io/trojan-go/basic/config/">正确配置Trojan-Go</a></li>
|
||
<li class=""><a href="https://p4gefau1t.github.io/trojan-go/basic/fullconfig/">完整的配置文件</a></li>
|
||
</ul>
|
||
|
||
</li>
|
||
|
||
<li class=""><a href="https://p4gefau1t.github.io/trojan-go/advance/">高级配置</a>
|
||
|
||
<ul class="sub-menu">
|
||
<li class=""><a href="https://p4gefau1t.github.io/trojan-go/advance/mux/">启用多路复用提升并发性能</a></li>
|
||
<li class=""><a href="https://p4gefau1t.github.io/trojan-go/advance/websocket/">使用Websocket进行CDN转发和抵抗中间人攻击</a></li>
|
||
<li class=""><a href="https://p4gefau1t.github.io/trojan-go/advance/router/">国内直连和广告屏蔽</a></li>
|
||
<li class=""><a href="https://p4gefau1t.github.io/trojan-go/advance/relay/">流量中继</a></li>
|
||
<li class=""><a href="https://p4gefau1t.github.io/trojan-go/advance/forward/">隧道和反向代理</a></li>
|
||
<li class=""><a href="https://p4gefau1t.github.io/trojan-go/advance/nginx-relay/">一种基于SNI代理的多路径分流中继方案</a></li>
|
||
</ul>
|
||
|
||
</li>
|
||
|
||
<li class="parent"><a href="https://p4gefau1t.github.io/trojan-go/developer/">实现细节和开发指南</a>
|
||
|
||
<ul class="sub-menu">
|
||
<li class=""><a href="https://p4gefau1t.github.io/trojan-go/developer/overview/">基本介绍</a></li>
|
||
<li class=""><a href="https://p4gefau1t.github.io/trojan-go/developer/build/">编译和自定义Trojan-Go</a></li>
|
||
<li class=""><a href="https://p4gefau1t.github.io/trojan-go/developer/trojan/">Trojan协议</a></li>
|
||
<li class=""><a href="https://p4gefau1t.github.io/trojan-go/developer/mux/">多路复用</a></li>
|
||
<li class="active"><a href="https://p4gefau1t.github.io/trojan-go/developer/websocket/">Websocket</a></li>
|
||
<li class=""><a href="https://p4gefau1t.github.io/trojan-go/developer/simplesocks/">SimpleSocks协议</a></li>
|
||
<li class=""><a href="https://p4gefau1t.github.io/trojan-go/developer/api/">API</a></li>
|
||
</ul>
|
||
|
||
</li>
|
||
</ul>
|
||
</nav>
|
||
|
||
|
||
|
||
<div class="sidebar-footer"></div>
|
||
</div>
|
||
</div><a href="#" id="backtothetop-fixed" class="backtothetop"
|
||
data-backtothetop-duration="600"
|
||
data-backtothetop-easing="easeOutQuart"
|
||
data-backtothetop-fixed-fadeIn="1000"
|
||
data-backtothetop-fixed-fadeOut="1000"
|
||
data-backtothetop-fixed-bottom="10"
|
||
data-backtothetop-fixed-right="20">
|
||
<span class="fa-layers fa-fw">
|
||
<i class="fas fa-circle"></i>
|
||
<i class="fas fa-arrow-circle-up"></i>
|
||
</span></a>
|
||
</div>
|
||
</body>
|
||
</html>
|