[Question] Does browser signatures need update?

[HirbodBehnam]

Hello
Do the Chrome and Firefox signatures change over time? If so, is it possible for you to update them? Because it looks like Iran's firewall is blocking the Cloak's Chrome signature. A little more info

[cbeuw]

Yes it does need update. Thanks for the testing and heads-up.

When I first got told that Cloak stopped working in Iran by email, I was worried that it's due to more intricate flaws like packet timing etc.. At the time they were written, the browser signatures were identical to real browsers byte-to-byte (except for the variable fields), but yes they are quite old. I'll update the Chrome one since it's being blocked right now. I may update the firefox one too some time later

[notsure2]

@cbeuw How about making the changing parts of the signature possible to pass via configuration, so that in case you get busy people can update it themselves ? See how trojan-gfw project did it.

[cbeuw]

@notsure2 It's possible to specify some fields in a configuration file, like Supported Groups and Cipher Suites etc. I'm not familiar with trojan-gfw but a quick look at its documentation shows it appears to be how they are doing it. The issue is that there may be a lot of intricate or major changes in ClientHellos between browser versions. For instance, between Firefox 68 (Cloak's current firefox version) and Firefox 80, there are a few new extension types, some extensions were deleted and the order was slightly rearranged. It's certainly possible to reflect these in a configuration file without editing the source code but it would require a pretty complicated schema. utls (whose major functionality was to parrot ClientHellos of different browser versions) basically hardcode all of these: https://github.com/refraction-networking/utls/blob/master/u_parrots.go.

[notsure2]

@cbeuw Then in that case, is it possible to pull the client helo from that package by depending on it and then inserting the cloak stuff in it ? Instead of hardcoding it, that way, all we need to do is just update dependencies and rebuild to get the new signatures.

[cbeuw]

@notsure2 You mean depending on utls? If I had known about utls before I started Cloak, I would've used it for ClientHellos and I wouldn't have to deal with the handshakes my self, but now that part counts as legacy code lol. Integrating just the ClientHello formation part would require a lot of code change, I think a better approach would be to clean up the way I'm currently hard-coding it (which is a mess), to something more modular, like utls, which can be much more easily modified by others

[HirbodBehnam]

Hello @cbeuw
Thanks for the update! I downloaded and compiled the latest commit and both Chrome and Firefox signatures are working like a charm!
Thanks

[aboka2k]

Hello @cbeuw
Thanks for the update! I downloaded and compiled the latest commit and both Chrome and Firefox signatures are working like a charm!
Thanks

@HirbodBehnam will this be apply to your script in future?

[HirbodBehnam]

@aboka2k
Yes! As soon as there is a new release on this repository, my script will automatically use it to setup the server. However in this case, you should just update your client and updating server is not necessary.

I also installed Chrome 76 on a VM and checked if it can connect to my server (to a real HTTPS server) and it failed to connect to my server. So, I'm 99% percent sure that the Iran does not allow even legit Chrome 76 client hello to some servers.

Update: I ran a test with utls to see which browser signatures are affected. It looks like that only Chrome-72 signature will timeout. Here is the code and here is the result:

Normal: OK
Chrome-58: OK
Chrome-62: OK
Chrome-70: OK
Chrome-72: ERROR: uTlsConn.Handshake() error: read tcp 192.168.1.100:65409->myip:443: wsarecv: A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond.
Chrome-83: OK
iOS-111: OK
iOS-12.1: OK
Firefox-55: OK
Firefox-56: OK
Firefox-63: OK
Firefox-65: OK
Golang-0: OK

So it looks like all Chrome fingerprints from version 72 to version 81 are not working.