security

package
v0.6.122 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Mar 29, 2026 License: AGPL-3.0, AGPL-3.0-or-later Imports: 40 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	BrowserChrome  = "chrome"
	BrowserFirefox = "firefox"
	BrowserSafari  = "safari"
	BrowserEdge    = "edge"
	BrowserIOS     = "ios"
	BrowserAndroid = "android"
)

Well-known browser fingerprint identifiers for WithBrowserFingerprint.

Variables

View Source 
var (
	ErrNoSampleFiles          = errors.New("challenge: no usable files or subdirectories")
	ErrEmptySampleLine        = errors.New("empty sample line found")
	ErrNoNonEmptySampleLines  = errors.New("no non-empty lines found")
	ErrSampleIndexOutOfBounds = errors.New("sample index out of bounds")
	ErrInvalidSubstringBounds = errors.New("invalid substring bounds")
)
View Source 
var (
	ErrPSKNetwrokRequired = errors.New("psk: network required")
	ErrPSKVersionRequired = errors.New("psk: version required")
)
View Source 
var ErrEmptySeed = errors.New("empty seed")
View Source 
var ErrInvalidStackSize = errors.New("challenge: invalid file stack size - expected 4 elements")

Functions

func ConvertToSHA256 

func ConvertToSHA256(input []byte) []byte

func EncryptAES 

func EncryptAES(plainData, password []byte) ([]byte, error)

func GenerateKeyFromSeed 

func GenerateKeyFromSeed(seed []byte) (ed25519.PrivateKey, error)

func GetCodebaseHashHex added in v0.3.9 

func GetCodebaseHashHex(codebase FileSystem) (string, error)

func ResolveChallenge added in v0.2.476 

func ResolveChallenge(codebase FileSystem, location SampleLocation, nonce int64) ([]byte, error)

func Sign added in v0.4.17 

func Sign(privKey, body []byte) string

func VerifySignature added in v0.4.18 

func VerifySignature(pubKey, body []byte, signatureStr string) error

Types

type CamouflageConfig added in v0.6.84 

type CamouflageConfig struct {
	// contains filtered or unexported fields
}

CamouflageConfig holds the TLS camouflage settings shared by all connections created by a single SpoofTransport instance.

func BuildCamouflageConfig added in v0.6.84 

func BuildCamouflageConfig(
	sni, browserFingerprint string,
	handshakeTimeout time.Duration,
) (*CamouflageConfig, error)

BuildCamouflageConfig constructs the CamouflageConfig from transport settings. Called once during construction.

type CamouflageConn added in v0.6.84 

type CamouflageConn struct {
	// contains filtered or unexported fields
}

CamouflageConn wraps a TCP connection with a real TLS tunnel. The client side uses uTLS to present a genuine browser TLS fingerprint (Chrome, Firefox, etc.), while the server side uses standard crypto/tls with a plausible certificate chain. All traffic inside the tunnel is indistinguishable from normal HTTPS browsing to DPI middleboxes.

func NewCamouflageConn added in v0.6.84 

func NewCamouflageConn(conn manet.Conn, isClient bool, cfg *CamouflageConfig) (*CamouflageConn, error)

NewCamouflageConn wraps conn with a real TLS tunnel and performs the TLS handshake. isClient determines whether this side initiates the handshake (uTLS with browser fingerprint) or accepts (crypto/tls server).

func (*CamouflageConn) Close added in v0.6.84 

func (cc *CamouflageConn) Close() error

func (*CamouflageConn) CloseRead added in v0.6.84 

func (cc *CamouflageConn) CloseRead() error

CloseRead forwards to the underlying connection if supported.

func (*CamouflageConn) CloseWrite added in v0.6.84 

func (cc *CamouflageConn) CloseWrite() error

CloseWrite sends a TLS close_notify alert if the underlying TLS connection supports half-close.

func (*CamouflageConn) LocalAddr added in v0.6.84 

func (cc *CamouflageConn) LocalAddr() net.Addr

func (*CamouflageConn) LocalMultiaddr added in v0.6.84 

func (cc *CamouflageConn) LocalMultiaddr() ma.Multiaddr

func (*CamouflageConn) Read added in v0.6.84 

func (cc *CamouflageConn) Read(b []byte) (int, error)

func (*CamouflageConn) RemoteAddr added in v0.6.84 

func (cc *CamouflageConn) RemoteAddr() net.Addr

func (*CamouflageConn) RemoteMultiaddr added in v0.6.84 

func (cc *CamouflageConn) RemoteMultiaddr() ma.Multiaddr

func (*CamouflageConn) SetDeadline added in v0.6.84 

func (cc *CamouflageConn) SetDeadline(t time.Time) error

func (*CamouflageConn) SetReadDeadline added in v0.6.84 

func (cc *CamouflageConn) SetReadDeadline(t time.Time) error

func (*CamouflageConn) SetWriteDeadline added in v0.6.84 

func (cc *CamouflageConn) SetWriteDeadline(t time.Time) error

func (*CamouflageConn) Write added in v0.6.84 

func (cc *CamouflageConn) Write(b []byte) (int, error)

type FileSystem 

type FileSystem interface {
	ReadDir(name string) ([]fs.DirEntry, error)
	ReadFile(name string) ([]byte, error)
	Open(name string) (fs.File, error)
}

type PSK 

type PSK []byte

func GeneratePSK 

func GeneratePSK(network string, v *semver.Version) (PSK, error)

GeneratePSK TODO rotate PSK?

func (PSK) String 

func (s PSK) String() string

type PrivateKey 

type PrivateKey crypto.PrivKey

type SampleLocation added in v0.2.476 

type SampleLocation struct {
	DirStack  []int // every index is level and value is dir num
	FileStack []int // file index, line index, left line border, right line border
}

func GenerateChallenge added in v0.2.476 

func GenerateChallenge(codebase FileSystem, nonce int64) ([]byte, SampleLocation, error)

type SpoofConn added in v0.6.84 

type SpoofConn struct {
	manet.Conn
	// contains filtered or unexported fields
}

SpoofConn wraps a manet.Conn and transparently splits Write calls into small TCP segments while the connection is in the handshake phase (the first handshakeLen bytes). After the handshake, writes pass through without modification.

func NewSpoofConn added in v0.6.84 

func NewSpoofConn(conn manet.Conn, fragmentSize, handshakeLen int, maxDelay time.Duration) *SpoofConn

func (*SpoofConn) CloseRead added in v0.6.84 

func (c *SpoofConn) CloseRead() error

CloseRead forwards to the underlying connection if supported.

func (*SpoofConn) CloseWrite added in v0.6.84 

func (c *SpoofConn) CloseWrite() error

CloseWrite forwards to the underlying connection if supported.

func (*SpoofConn) Write added in v0.6.84 

func (c *SpoofConn) Write(b []byte) (int, error)

Write fragments b into small segments if the handshake phase is still active; otherwise it delegates directly to the underlying connection.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.