流量被嗅探

[lerogo]

Describe the feature request

frp客户端的流量通过防火墙时，流量会被防火墙嗅探到，从而内网机器被封ip
希望增加伪装功能，或者加密传输

Describe alternatives you've considered

No response

Affected area

• Docs
• Installation
• Performance and Scalability
• Security
• User Experience
• Test and Release
• Developer Infrastructure
• Client Plugin
• Server Plugin
• Extensions
• Others

[Becods]

#1992 #3050

frp的特征从来都不是加密的

自行修改

frp/pkg/msg/msg.go

Lines 61 to 191 in da51adc

	// When frpc start, client send this message to login to server.
	type Login struct {
	Version string `json:"version,omitempty"`
	Hostname string `json:"hostname,omitempty"`
	Os string `json:"os,omitempty"`
	Arch string `json:"arch,omitempty"`
	User string `json:"user,omitempty"`
	PrivilegeKey string `json:"privilege_key,omitempty"`
	Timestamp int64 `json:"timestamp,omitempty"`
	RunID string `json:"run_id,omitempty"`
	Metas map[string]string `json:"metas,omitempty"`
	// Some global configures.
	PoolCount int `json:"pool_count,omitempty"`
	}
	type LoginResp struct {
	Version string `json:"version,omitempty"`
	RunID string `json:"run_id,omitempty"`
	ServerUDPPort int `json:"server_udp_port,omitempty"`
	Error string `json:"error,omitempty"`
	}
	// When frpc login success, send this message to frps for running a new proxy.
	type NewProxy struct {
	ProxyName string `json:"proxy_name,omitempty"`
	ProxyType string `json:"proxy_type,omitempty"`
	UseEncryption bool `json:"use_encryption,omitempty"`
	UseCompression bool `json:"use_compression,omitempty"`
	Group string `json:"group,omitempty"`
	GroupKey string `json:"group_key,omitempty"`
	Metas map[string]string `json:"metas,omitempty"`
	// tcp and udp only
	RemotePort int `json:"remote_port,omitempty"`
	// http and https only
	CustomDomains []string `json:"custom_domains,omitempty"`
	SubDomain string `json:"subdomain,omitempty"`
	Locations []string `json:"locations,omitempty"`
	HTTPUser string `json:"http_user,omitempty"`
	HTTPPwd string `json:"http_pwd,omitempty"`
	HostHeaderRewrite string `json:"host_header_rewrite,omitempty"`
	Headers map[string]string `json:"headers,omitempty"`
	RouteByHTTPUser string `json:"route_by_http_user,omitempty"`
	// stcp
	Sk string `json:"sk,omitempty"`
	// tcpmux
	Multiplexer string `json:"multiplexer,omitempty"`
	}
	type NewProxyResp struct {
	ProxyName string `json:"proxy_name,omitempty"`
	RemoteAddr string `json:"remote_addr,omitempty"`
	Error string `json:"error,omitempty"`
	}
	type CloseProxy struct {
	ProxyName string `json:"proxy_name,omitempty"`
	}
	type NewWorkConn struct {
	RunID string `json:"run_id,omitempty"`
	PrivilegeKey string `json:"privilege_key,omitempty"`
	Timestamp int64 `json:"timestamp,omitempty"`
	}
	type ReqWorkConn struct{}
	type StartWorkConn struct {
	ProxyName string `json:"proxy_name,omitempty"`
	SrcAddr string `json:"src_addr,omitempty"`
	DstAddr string `json:"dst_addr,omitempty"`
	SrcPort uint16 `json:"src_port,omitempty"`
	DstPort uint16 `json:"dst_port,omitempty"`
	Error string `json:"error,omitempty"`
	}
	type NewVisitorConn struct {
	ProxyName string `json:"proxy_name,omitempty"`
	SignKey string `json:"sign_key,omitempty"`
	Timestamp int64 `json:"timestamp,omitempty"`
	UseEncryption bool `json:"use_encryption,omitempty"`
	UseCompression bool `json:"use_compression,omitempty"`
	}
	type NewVisitorConnResp struct {
	ProxyName string `json:"proxy_name,omitempty"`
	Error string `json:"error,omitempty"`
	}
	type Ping struct {
	PrivilegeKey string `json:"privilege_key,omitempty"`
	Timestamp int64 `json:"timestamp,omitempty"`
	}
	type Pong struct {
	Error string `json:"error,omitempty"`
	}
	type UDPPacket struct {
	Content string `json:"c,omitempty"`
	LocalAddr *net.UDPAddr `json:"l,omitempty"`
	RemoteAddr *net.UDPAddr `json:"r,omitempty"`
	}
	type NatHoleVisitor struct {
	ProxyName string `json:"proxy_name,omitempty"`
	SignKey string `json:"sign_key,omitempty"`
	Timestamp int64 `json:"timestamp,omitempty"`
	}
	type NatHoleClient struct {
	ProxyName string `json:"proxy_name,omitempty"`
	Sid string `json:"sid,omitempty"`
	}
	type NatHoleResp struct {
	Sid string `json:"sid,omitempty"`
	VisitorAddr string `json:"visitor_addr,omitempty"`
	ClientAddr string `json:"client_addr,omitempty"`
	Error string `json:"error,omitempty"`
	}
	type NatHoleClientDetectOK struct{}
	type NatHoleSid struct {
	Sid string `json:"sid,omitempty"`
	}

此外

建议不要在公司禁止的情况下使用，安全风险和后果需要自负。

[lerogo]

#1992 #3050

frp的特征从来都不是加密的

自行修改

frp/pkg/msg/msg.go

Lines 61 to 191 in da51adc

	// When frpc start, client send this message to login to server.
	type Login struct {
	Version string `json:"version,omitempty"`
	Hostname string `json:"hostname,omitempty"`
	Os string `json:"os,omitempty"`
	Arch string `json:"arch,omitempty"`
	User string `json:"user,omitempty"`
	PrivilegeKey string `json:"privilege_key,omitempty"`
	Timestamp int64 `json:"timestamp,omitempty"`
	RunID string `json:"run_id,omitempty"`
	Metas map[string]string `json:"metas,omitempty"`
	// Some global configures.
	PoolCount int `json:"pool_count,omitempty"`
	}
	type LoginResp struct {
	Version string `json:"version,omitempty"`
	RunID string `json:"run_id,omitempty"`
	ServerUDPPort int `json:"server_udp_port,omitempty"`
	Error string `json:"error,omitempty"`
	}
	// When frpc login success, send this message to frps for running a new proxy.
	type NewProxy struct {
	ProxyName string `json:"proxy_name,omitempty"`
	ProxyType string `json:"proxy_type,omitempty"`
	UseEncryption bool `json:"use_encryption,omitempty"`
	UseCompression bool `json:"use_compression,omitempty"`
	Group string `json:"group,omitempty"`
	GroupKey string `json:"group_key,omitempty"`
	Metas map[string]string `json:"metas,omitempty"`
	// tcp and udp only
	RemotePort int `json:"remote_port,omitempty"`
	// http and https only
	CustomDomains []string `json:"custom_domains,omitempty"`
	SubDomain string `json:"subdomain,omitempty"`
	Locations []string `json:"locations,omitempty"`
	HTTPUser string `json:"http_user,omitempty"`
	HTTPPwd string `json:"http_pwd,omitempty"`
	HostHeaderRewrite string `json:"host_header_rewrite,omitempty"`
	Headers map[string]string `json:"headers,omitempty"`
	RouteByHTTPUser string `json:"route_by_http_user,omitempty"`
	// stcp
	Sk string `json:"sk,omitempty"`
	// tcpmux
	Multiplexer string `json:"multiplexer,omitempty"`
	}
	type NewProxyResp struct {
	ProxyName string `json:"proxy_name,omitempty"`
	RemoteAddr string `json:"remote_addr,omitempty"`
	Error string `json:"error,omitempty"`
	}
	type CloseProxy struct {
	ProxyName string `json:"proxy_name,omitempty"`
	}
	type NewWorkConn struct {
	RunID string `json:"run_id,omitempty"`
	PrivilegeKey string `json:"privilege_key,omitempty"`
	Timestamp int64 `json:"timestamp,omitempty"`
	}
	type ReqWorkConn struct{}
	type StartWorkConn struct {
	ProxyName string `json:"proxy_name,omitempty"`
	SrcAddr string `json:"src_addr,omitempty"`
	DstAddr string `json:"dst_addr,omitempty"`
	SrcPort uint16 `json:"src_port,omitempty"`
	DstPort uint16 `json:"dst_port,omitempty"`
	Error string `json:"error,omitempty"`
	}
	type NewVisitorConn struct {
	ProxyName string `json:"proxy_name,omitempty"`
	SignKey string `json:"sign_key,omitempty"`
	Timestamp int64 `json:"timestamp,omitempty"`
	UseEncryption bool `json:"use_encryption,omitempty"`
	UseCompression bool `json:"use_compression,omitempty"`
	}
	type NewVisitorConnResp struct {
	ProxyName string `json:"proxy_name,omitempty"`
	Error string `json:"error,omitempty"`
	}
	type Ping struct {
	PrivilegeKey string `json:"privilege_key,omitempty"`
	Timestamp int64 `json:"timestamp,omitempty"`
	}
	type Pong struct {
	Error string `json:"error,omitempty"`
	}
	type UDPPacket struct {
	Content string `json:"c,omitempty"`
	LocalAddr *net.UDPAddr `json:"l,omitempty"`
	RemoteAddr *net.UDPAddr `json:"r,omitempty"`
	}
	type NatHoleVisitor struct {
	ProxyName string `json:"proxy_name,omitempty"`
	SignKey string `json:"sign_key,omitempty"`
	Timestamp int64 `json:"timestamp,omitempty"`
	}
	type NatHoleClient struct {
	ProxyName string `json:"proxy_name,omitempty"`
	Sid string `json:"sid,omitempty"`
	}
	type NatHoleResp struct {
	Sid string `json:"sid,omitempty"`
	VisitorAddr string `json:"visitor_addr,omitempty"`
	ClientAddr string `json:"client_addr,omitempty"`
	Error string `json:"error,omitempty"`
	}
	type NatHoleClientDetectOK struct{}
	type NatHoleSid struct {
	Sid string `json:"sid,omitempty"`
	}

此外

建议不要在公司禁止的情况下使用，安全风险和后果需要自负。

好的，谢谢！就是改起来有点麻烦，呜呜🥹

[lerogo]

希望增加伪装功能，或者加密传输，就像trojan、v2ray这样的

[xqzr]

[common]
...
tls_enable = true
disable_custom_tls_first_byte = true

[ideazw]

[common]
...
tls_enable = true
disable_custom_tls_first_byte = true

加了这个就不会被嗅探到了吗？

[xqzr]

[common]
...
tls_enable = true
disable_custom_tls_first_byte = true

加了这个就不会被嗅探到了吗？

最大可能减少。

[guation]

改用kcp协议然后外面套个udp2raw 以前v2ray的mkcp被gfw检测封杀的时候就是用udp2raw来过墙的

[github-actions]

Issues go stale after 30d of inactivity. Stale issues rot after an additional 7d of inactivity and eventually close.