- Homepage: https://github.com/kpdyer/fteproxy
- Source code: https://github.com/kpdyer/fteproxy
- Publication: https://kpdyer.com/publications/ccs2013-fte.pdf
fteproxy provides transport-layer protection to resist keyword filtering, censorship and discriminatory routing policies. Its job is to relay datastreams, such as web browsing traffic, by encoding the stream into messages that satisfy a user-specified regular expression.
fteproxy is powered by Format-Transforming Encryption [1] and was presented at CCS 2013.
[1] Protocol Misidentification Made Easy with Format-Transforming Encryption, Kevin P. Dyer, Scott E. Coull, Thomas Ristenpart and Thomas Shrimpton
- Python 3.8 or higher
pip install fteproxygit clone https://github.com/kpdyer/fteproxy.git
cd fteproxy
pip install -r requirements.txt
pip install -e .fteproxy operates as a client-server proxy:
[Application] <-> [fteproxy client] <--FTE encoded--> [fteproxy server] <-> [Destination]
On the server machine:
python3 -m fteproxy --mode server --server_ip 0.0.0.0 --server_port 8080 --proxy_ip 127.0.0.1 --proxy_port 8081This listens for FTE-encoded connections on port 8080 and forwards decoded traffic to 127.0.0.1:8081.
On the client machine:
python3 -m fteproxy --mode client --client_ip 127.0.0.1 --client_port 8079 --server_ip <server-ip> --server_port 8080This listens for plaintext connections on port 8079 and forwards FTE-encoded traffic to the server.
| Option | Description | Default |
|---|---|---|
--mode |
Relay mode: client or server | client |
--client_ip |
Client-side listening IP | 127.0.0.1 |
--client_port |
Client-side listening port | 8079 |
--server_ip |
Server-side listening IP | 127.0.0.1 |
--server_port |
Server-side listening port | 8080 |
--proxy_ip |
Forwarding-proxy listening IP | 127.0.0.1 |
--proxy_port |
Forwarding-proxy listening port | 8081 |
--key |
Cryptographic key (64 hex characters) | (default key) |
--key-file |
Path to a file containing the key (64 hex characters). Mutually exclusive with --key. |
|
--quiet |
Suppress output | false |
--version |
Show version and exit |
Passing the key with --key places it in your shell history and exposes it in
process listings (e.g. ps aux). To avoid this, write the key to a file and
point fteproxy at it with --key-file:
# Generate a random 64-hex-character (32-byte) key
python3 -c "import secrets; print(secrets.token_hex(32))" > fteproxy.key
chmod 600 fteproxy.keyThen start each side with --key-file (the client and server must use the same
key):
python3 -m fteproxy --mode server --key-file fteproxy.key --server_ip 0.0.0.0 --server_port 8080 --proxy_ip 127.0.0.1 --proxy_port 8081
python3 -m fteproxy --mode client --key-file fteproxy.key --client_ip 127.0.0.1 --client_port 8079 --server_ip <server-ip> --server_port 8080The file must contain exactly 64 hexadecimal characters (a trailing newline is
ignored). --key and --key-file cannot be used together.
python -m pytest fteproxy/tests/ -vMIT License - see LICENSE for details.
Kevin P. Dyer (kpdyer@gmail.com)
