View Issue Details
| ID | Project | Category | View Status | Date Submitted | Last Update |
|---|---|---|---|---|---|
| 0011650 | GNUnet | documentation | public | 2026-07-20 11:59 | 2026-07-20 12:13 |
| Reporter | Jllx | Assigned To | |||
| Priority | normal | Severity | minor | Reproducibility | have not tried |
| Status | new | Resolution | open | ||
| Product Version | 0.27.0 | ||||
| Summary | 0011650: information about gnunet obsufcation techniques / current filtering status | ||||
| Description | Hi, since more and more countries are restricting VPN, I searched the web how gnunet is resilient to DPI. current "state" of DPI in some countries : - full cyphered QUIC connections are dropped by default (so setting Encrypted Client Hello [ECH] is meaninglessness) - the first client hello [CH] of QUIC have to be readable by DPI to access the SNI - the SNI of CH is then matched to the IP address, if the IP is a known matching IP to that service, the connection is allowed - certificate matching : if the certificate is auto-signed, or not matching the SNI, the connection is degraded/intercepted - some countries seems also to try detect if the service is what it is supposed to, establishing a connection, and see if the service is a website or if it's a gnunet... - other techniques seems to be "trafic shape analysis" : a service like meet.google.com is analyzed producing a "shape fingerprint" (used to be sure that underlying is webRTC on DTLS) according to some sources, gnunet use QUIC as underlying (is there other low layer connections?) so I wonder how to obfuscate the gnunet traffic... I saw some tools like "cloak" that act as a "http rooter / port sharing" eg redirect traffic to the right service, encapsulating the payload into a https connection, it should works with gnunet.... and maybe there can be some way to do "port knocking" like (http knocking....) to allow connections but won't it break the gnunet connection model? seems that QUIC is actively targeted, even if still allowed could be nice to have some docs on how gnunet connect, if it's possible to change the protocol, how to integrate in third parties tools like cloak (if necessary) and a "current state of filtering" and filtering techniques that are known to be used in some countries, how to bypass them... how to manage users allowed to access the system (for example if some country use a technique like "connect to see if it's gnunet" isn't it a way like cloak to allow creating a "trusted hosts" list, so that identified user can connect to the gnunet entry point, and having the gnunet entry point whitelisted into some(s) outside relay(s)...) and what about traffic shaping... is there a way to mimic? | ||||
| Tags | No tags attached. | ||||
| related to | 0011526 | new | PQ-secure TCP/UDP encryption |
