Connection Reliability and Anti-Censorship

Relevant source files

• intra/core/sigcond.go
• intra/dialers/cdial.go
• intra/dialers/direct_split.go
• intra/dialers/example/main.go
• intra/dialers/pdial.go
• intra/dialers/rdial.go
• intra/dialers/retrier.go
• intra/dialers/split_and_desync.go
• intra/dialers/tlsdial.go
• intra/dialers/types.go
• intra/rwconn.go

This page provides a high-level overview of the connection management infrastructure within the intra/dialers and intra/protect packages. These systems are responsible for establishing reliable outbound TCP/UDP connections, selecting appropriate dialing strategies, and circumventing network censorship via packet-splitting and TCB (Transmission Control Block) desynchronization.

The reliability system operates beneath the proxy layer, providing a robust net.Conn implementation to TCP and DNS transport handlers. It ensures that connections remain stable even in hostile network environments where Deep Packet Inspection (DPI) or packet loss might otherwise cause connection resets.

---

System Overview

The connection management system serves three primary functions:

1. Protected Dialing: Sockets are created through the RDialer/RDial abstraction, ensuring they are bound to the correct network interface via platform-specific controllers intra/dialers/rdial.go20-66
2. Transparent Retries: The retrier struct wraps provisional sockets and can replay the initial data write on a new connection if no reply is received within a calculated RTT-based timeout intra/dialers/retrier.go73-117
3. Censorship Bypassing: During a retry (or proactively), the system can fragment the initial TCP segment or inject decoy payloads to confuse stateful DPI middleboxes intra/dialers/direct_split.go37-45

Component Relationship Diagram

The following diagram maps the relationship between the high-level reliability logic and the underlying code entities.

Title: Connection Reliability Architecture

Sources: intra/dialers/retrier.go73-117 intra/dialers/direct_split.go37-45 intra/dialers/split_and_desync.go45-57 intra/dialers/rdial.go20-66

---

Connection Retry and Strategy Selection

The retrier implementation provides a DuplexConn that transparently handles failures during the initial handshake and data exchange. It maintains a tee buffer of the first write to allow for "replay" if a connection is reset or times out intra/dialers/retrier.go106-108

Strategy Selection

The system uses a strategy-based approach to choose between different levels of aggressiveness:

• RetryNever: No retries are attempted intra/dialers/retrier.go127-129
• RetryWithSplit: If the first attempt fails, retry using a splitting strategy intra/dialers/retrier.go173
• DialAny: Attempts to connect using multiple dialers, utilizing ippPins (a Sieve cache) to pin successful ip:port pairs to specific dialer IDs intra/dialers/retrier.go65-69 intra/dialers/retrier.go198-212

The retry timeout is dynamically calculated based on the RTT of the initial SYN/SYN-ACK exchange via calcTimeout intra/dialers/retrier.go134-142

For detailed implementation of the retrier and strategy selection, see Connection Retry and Strategy Selection.

Sources: intra/dialers/retrier.go65-175 intra/dialers/retrier.go198-212

---

Splitting and Desync Attacks

To bypass censorship, Firestack employs two primary methods of TCP stream manipulation. Both methods utilize a SigCond synchronization primitive to ensure that splitting logic only applies to the very first segment of a connection intra/dialers/direct_split.go41-56 intra/core/sigcond.go29-32

TCP/TLS Splitting

The splitter implementation fragments the first outbound segment. Supported strategies include SplitTCP (sending the first byte separately) and SplitTCPOrTLS, which identifies TLS record boundaries to evade SNI-based filtering intra/dialers/direct_split.go61-73

TCB Desynchronization Attack

The overwriteSplitter implements a TCB Desynchronization attack. It works by:

1. TTL Estimation: Using a UDP traceroute via tracert() to find the hop distance to the destination intra/dialers/split_and_desync.go109-176
2. TTL Caching: Storing estimated TTLs in a ttlcache (a Sieve cache) for 30 seconds to optimize subsequent connections intra/dialers/split_and_desync.go41
3. Decoy Injection: Sending a fake segment (e.g., a decoy HTTP request like desync_http1_1str) with a TTL low enough to reach the censor's DPI middlebox but not the actual server intra/dialers/split_and_desync.go29
4. Payload Overwriting: Confusing stateful DPI by overwriting the decoy with real data intended for the server intra/dialers/split_and_desync.go45-56

For a deep dive into the desync workflow and TTL caching, see Splitting and Desync Attacks.

Anti-Censorship Sequence Diagram

Title: TCB Desynchronization Workflow

Sources: intra/dialers/split_and_desync.go41-56 intra/dialers/split_and_desync.go109-176 intra/dialers/split_and_desync.go29

---

IP Selection and Reliability

Reliability is further enhanced by commondial2, which manages the selection of IP addresses from an IPSet. It prioritizes "confirmed" IPs (those that have worked recently) and handles reordering based on network preferences (IPv4 vs IPv6) intra/dialers/cdial.go62-179

• IP Confirmation: When a connection succeeds, the IP is marked as confirmed via ips.Confirm(ip) intra/dialers/cdial.go185-189
• ECH Retry: The dialtls function automatically detects Encrypted Client Hello (ECH) rejection (ECHRejectionError) and retries with updated ECH configurations fetched via ECH(cfg.ServerName) intra/dialers/rdial.go182-202
• Deadline Extension: The rwext wrapper extends read/write deadlines on every I/O operation via extendr() and extendw() to prevent premature connection termination intra/rwconn.go21-60 It implements RetrierConn to support efficient data streaming via core.Stream intra/rwconn.go62-90

Sources: intra/dialers/cdial.go62-189 intra/dialers/rdial.go173-208 intra/rwconn.go21-90