Rio riobard

调查目的：了解当前各基于TLS的协议方案中ClientHello的指纹独特性。理论背景见 https://arxiv.org/abs/1607.01639 。

指纹数据库：

naiveproxy v78.0.3904.70-4

（利益相关：我是这个的作者）

朴素VPN：一个纯内核级静态隧道

由于路由管控系统的建立，实时动态黑洞路由已成为最有效的封锁手段，TCP连接重置和DNS污染成为次要手段，利用漏洞的穿墙方法已不再具有普遍意义。对此应对方法是多样化协议的VPN来抵抗识别。这里介绍一种太简单、有时很朴素的“穷人VPN”。

朴素VPN只需要一次内核配置（Linux内核），即可永久稳定运行，不需要任何用户态守护进程。所有流量转换和加密全部由内核完成，原生性能，开销几乎没有。静态配置，避免动态握手和参数协商产生指纹特征导致被识别。并且支持NAT，移动的内网用户可以使用此方法。支持广泛，基于L2TPv3标准，Linux内核3.2+都有支持，其他操作系统原则上也能支持。但有两个局限：需要root权限；一个隧道只支持一个用户。

朴素VPN利用UDP封装的静态L2TP隧道实现VPN，内核XFRM实现静态IPsec。实际上IP-in-IP隧道即可实现VPN，但是这种协议无法穿越NAT，因此必须利用UDP封装。内核3.18将支持Foo-over-UDP，在UDP里面直接封装IP，与静态的L2TP-over-UDP很类似。

创建一个朴素VPN

CPU consumption during playback of a 720p H264 video on a 2013 Core i7 MacBook Air with Intel HD 5000 graphics card, running OS X Mavericks 10.9.2:

MPlayerX 1.0.22.1 (vda): 8% ~ 9%
VLC 2.1.4: 15% (vda)
QuickTime Player 10.3: 5% (hwaccel)
MPlayer OSX Extended rev 15 (mplayer SVN r36986): 30% (no hwaccel), 16% (-vc ffh264vda)
mpv (git-b0b0e69): 20% ~ 23% (no hwaccel), 5% ~ 7% (--hwdec=vda)
XBMC 13.0 beta 2: 14% (vda)

(All above programs are x86_64.)

	#!/bin/sh

	# multi SSID with VLAN script, for ASUS AC86U with merlin
	#
	# setup before hand:
	# set "router" to "AP Mode"
	# this will put all ports and wireless in br0
	# create 2 guest network
	# enable Administration => System => Enable JFFS custom scripts and configs
	# put this script in /jffs/scripts/, name should be "services-start"

	#!/usr/bin/env bash
	#
	# Author: Markus (MawKKe) [email protected]
	# Date: 2018-03-19
	#
	#
	# What?
	#
	# Linux dm-crypt + dm-integrity + dm-raid (RAID1)
	#

	Generating random data (100.00MB)
	Start benchmark rc4-md5
	Encrypt data in 0.224s
	Decrypt data in 0.222s

	Start benchmark aes-128-cfb
	Encrypt data in 0.599s
	Decrypt data in 0.597s

	Start benchmark aes-256-cfb

	#include <errno.h>
	#include <stdio.h>
	#include <unistd.h>
	#include <netinet/tcp.h>
	#include <netinet/in.h>
	#include <arpa/inet.h>
	#include <sys/socket.h>

	int main(int argc, char **argv) {
	int s = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);

	#!/bin/bash

	# This script will forward internet connection over redsocks proxy
	# - Install redsocks and make it listen to any IP
	# - Setup Wifi AP or ETH connection and DHCP server
	# - Connect to ssh with -D 1080 parameter or start tor on port 1080
	# - Run the script

	INTERNET_INTERFACE=wlan0
	SUBNET_INTERFACE=wlan1

	# A xterm-256color based TERMINFO that adds the escape sequences for italic.
	#
	# Install:
	#
	# tic xterm-256color-italic.terminfo
	#
	# Usage:
	#
	# export TERM=xterm-256color-italic
	#