2

I'm recently running openvpn in openwrt-x86-generic, and I want to use obfsproxy to obfuscate the traffic.

The problem is that the package of obfsproxy in openwrt(which I use as a openvpn server) has been abandoned for quite a long time, so the latest version I can get through opkg is 0.1.4. However, in a PC running windows xp(which is a client), the oldest version of obfsproxy I can get through pip install is 0.2.1. When I try to connect the server, it always cast an error saying corrupted magic number, which is likely to be the version problem.

I've tried from 0.2.1 to 0.2.13 in client, none of which worked. There seems to be no specific document on this problem, and it seems complicated now since the package in openwrt in nolonger maintained.

Could anyone give me some advice on how to solve it, or offer some reference about obfsproxy?

BTW, I'm using obfs2 method, but I don't think that is the key problem.

Thanks. Tgn

1

obfs2 should be considered dead and buried. A passive observer can remove the obfuscation (and an active attacker can remove obfs3).

The "Corrupted magic value" is actually part of the protocol, it's not related to the "version number", it expects that a "magic" value (obfs2.py, obfs2.h) is part of the decrypted message.

You can read more about obfs2 here, it includes example code that should allow you to reconstruct and review the key exchange from a packet capture.

They should be interoperable, using 0.2.13 obfs2.py as the client and 0.1.4 obfsproxy as the server:

setup the server:

$ ./obfsproxy obfs2 --dest=127.0.0.1:31337 server 127.0.0.1:31338
2016-xx-xx xx:xx:xx [notice] Starting (obfsproxy version: 0.1.4 (git-94ebc4c3edf1e3e5)).

setup the client:

$ ./bin/obfsproxy obfs2 --dest 127.0.0.1:31338 client 127.0.0.1:31339
2016-xx-xx xx:xx:xx,xxx [WARNING] Obfsproxy (version: obfsproxy-0.2.13-1-g2bf9d09) starting up.
2016-xx-xx xx:xx:xx,xxx [WARNING] Pyptlib version: 0.0.6

connect into the client and send some data:

$ ncat 127.0.0.1 31339 -c 'echo "Hello, this is dog."'

and the receiving end-point receives it over obfs2:

$ ncat -l 127.0.0.1 31337
Hello, this is dog.

So "Hello, this is dog." was sent into the waiting 0.2.13 obfs2.py client listener, across to the 0.1.4 obfsproxy server listener and out to the destination.

You should, however, stop using obfs2 and upgrade to obfs4. For how to cross-compile it, try this answer and incorporate setting environment variables in the launch script, in line with pt-spec.txt.

  • Thanks a lot! I find the cause of corrupted magic number is the --shared-secret option, if I don't specify this option, it works well, and openvpn along with obfsproxy is working now. However, I find that the traffic is not routed through obfsproxy(for example, ping www.github.com would still use ICMP package without obfuscation) even if I specify redirect-gateway def1 local in server config. If I use merely openvpn without obfsproxy, the whole traffic is indeed redirected through openvpn, so I doubt it might be the configuration of obfsproxy, but I couldn't figure out the reason. – Tgn Yang Aug 6 '16 at 11:09
  • Since your answer has solved my original problem, I'll take it as the right answer. – Tgn Yang Aug 6 '16 at 11:15
  • I'll have a look at --shared-secret option, but I've no idea about openvpn. – cacahuatl Aug 6 '16 at 17:24
  • Yeah, I can reproduce the issue by using --shared-secret (which looks to be used as some kind of MAC), at a glance of both code bases I think one of them is hashing it differently from the other. I'll update with more info and a possible fix if I can, once I've given it a proper read. – cacahuatl Aug 6 '16 at 23:39
  • Thanks for your help. I'm wondering where I can get the code bases of same programming language. The latest obfsproxy seems to use python while the old one in obfsproxy-legacy is using C, would that be a possible reason for the incongruous implemention of hasing method? And is there a C version of the latest obfsproxy? – Tgn Yang Aug 8 '16 at 3:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.