Middlebox / TCP normalization

An internal TSG operations/troubleshooting manual lays out TSG's full traffic pipeline (NIC -> mrzcpd/marsio capture driver -> sapp DPI engine -> firewall/proxy(KNI->TFE)/active-defense/WAN-NAT policy branches) and shows engineers using maat_redis_tool to pull the live Redis-synced blocking policy tables (TSG_SECURITY_COMPILE, TSG_OBJ_IP_ADDR, TSG_OBJ_APP_ID) and filter them by numeric policy/object ID to debug why a block rule isn't firing.

A 2023 MESA Lab monthly report describes the 'TF' project's active-defense work: test cases for serial ('串联') HTTP hijack/tamper and parallel ('并联') DNS race-injection ('DNS抢答'), performance tuning that scaled active-defense capacity from 3 to 5 units, converting two existing TSG boxes to active-defense mode, and rewriting the active-defense flow-control logic to no longer depend on sapp.

An internal MESA Lab research note directly measures and compares China's ('CN') HTTP censorship middlebox against Russia, India and an unlabeled 'HZ' system, plus open-source Snort2/Snort3/Suricata: China is characterized as inspecting Host- and keyword-based triggers (example trigger given: a request containing the parameter 'q=ultrasurf') across ALL ports rather than just 80/443, responding with a triple RST or an extra RST+ACK; an 8-technique HTTP-request-mangling evasion comparison table credits China's middlebox as vulnerable only to request-line whitespace insertion and HTTP-version tampering, fewer categories than the other three systems tested.

A live tsg_master engine config file exposes a [RESET] section with concrete TCP-RST-injection parameters (NUM=1, SEED1=65535, SEED2=13, FLAGS=20, DIR=3, REMEDY=0), a [TRAFFIC_MIRROR] section confirming mirror-tap deployment (NIC_NAME="eth_vf_mirr"), a [MAAT] section wiring tsg_master directly to MAAT's subscriber-ID tables (TSG_OBJ_SUBSCRIBER_ID/TSG_DYN_SUBSCRIBER_IP), and a device tag "BeiJing-XXG" confirming this specific instance is a domestic Beijing deployment. A plaintext Kafka SASL credential (SASL_PASSWD="galaxy2019") is also exposed, and "galaxy" recurs as an internal project codename elsewhere in this batch (docker service path /home/galaxy, APP_BRIDGE_NAME).

The Xinjiang Mobile carrier traffic report (2023-05-15) states in its own QUIC-domain-ranking section that Xinjiang's intra-provincial traffic has begun carrying QUIC/HTTP3 (UDP-based) traffic that poses "a huge challenge" to the traditional parallel/out-of-band ("并联") traffic-access blocking method, and that effectively gatekeeping ("GK") UDP/QUIC traffic requires switching to an inline/in-path ("串联") blocking architecture — a direct internal admission that (as of mid-2023, in this province) the standard mirror-tap deployment could not reliably block QUIC.

sapp's own regression-test pcap corpus (public_resources/benchmark_pcap) includes an "escape_gfw" test directory explicitly named after Intang, an academic GFW-evasion tool (TTL-difference segment injection, TCP tuple4/sequence reuse tricks), plus explicit DoH and DoT protocol samples — evidence MESA Lab tests sapp's TCP reassembly/detection logic against published circumvention research to harden against it.

An IIE CAS thesis revision memo shows a student's research was retitled from "measuring evasion attacks against censorship middleboxes" to "evasion-attack traffic generation for DPI middleware" after committee feedback that "censorship middlebox" was too sensitive a term; the work builds evasion-generation tooling (citing Geneva's genetic-algorithm and SymTCP/Alembic's symbolic-execution approaches to TCP state desync) and explicitly tests it against "a specific country's DPI middleware" plus open-source DPI/NIDS, then derives defensive recommendations from the vulnerabilities it discovers.

In sapp's inline deployment mode, packet injection is handled by a driver pair (mrzcpd + mrtunnat, an mrzcpd sub-component not previously catalogued) that must reconstruct per-link tunnel state (cached in /run/mrzcpd/mrmonit.tunnat) before forging a packet in the correct direction; the internal troubleshooting guide documents that injection silently fails for GTP/MPLS/GRE-tunneled flows when the reverse-direction tunnel identifier has never been observed on that link, an explicit "asymmetric address layer" edge case.

sapp's internal architecture guide documents three deployment topologies (mirror/passive-tap, inline, dual-arm transparent) and four distinct methods for injecting blocking packets back onto the wire, including a MAC-in-MAC scheme that extracts device/link IDs from mirrored traffic's source MAC field to route an injected packet to the correct physically separate inline device over VXLAN when multiple injection points exist.

MESA Lab's internal "tcp_burst" traffic-replay tool (common_tools/tcp_burst, a fork of tcpreplay) bundles fragroute — a well-known IDS/DPI-evasion toolkit implementing TCP/IP fragmentation, segment reordering, chaffing, duplication, and delay — and integrates its replay path with the marsio packet-I/O framework also used by sapp, indicating fragroute-style evasion techniques are used internally to test TSG/sapp's DPI robustness against fragmentation- and reordering-based evasion.

Weekly Xinjiang Mobile carrier-side traffic analysis reports (2022-2023) state in plain internal language that HTTP/3 (QUIC-over-UDP) traffic 'poses a major challenge' to the traditional parallel/mirror (并联) traffic-access blocking method, and that UDP traffic requires an inline/serial (串联) blocking deployment to 'effectively' block it -- a direct admission that passive mirror-tap deployments (the apparent default) cannot reliably block QUIC-based traffic, only inline in-path deployments can.

A complete patent invention-disclosure document describes a "Multipath TCP Functionality Restriction" device deployed inline at a network egress point that identifies the MPTCP TCP option (kind=30, MP_CAPABLE subtype) in initial-handshake SYN/SYN-ACK packets and strips or NOPs it in transit, forcing the connection to fall back to ordinary single-path TCP so that conventional TCP-based inspection and attack detection can be applied to traffic that would otherwise be split across multiple paths.

An official "Geedge Networks Confidential And Proprietary" sapp/mrzcpd operations manual documents the packet-injection API (MESA_kill_tcp / MESA_inject_pkt) used for both out-of-band mirror-tap RST injection (relies on the local box's own IP routing table to send) and inline in-path injection (requires mrtunnat.conf tunnel-tracking state -- use_recent_tunnel, use_link_info_table -- keyed on outer/inner MAC and link_id/link_dir), plus the Marsio DPDK-based driver's I/O sub-modes (marsio4, marsio_vxlan, pag_marsio, agent_smith) and its role extracting VXLAN/GTP encapsulation metadata and stamping link/circuit identifiers into mirrored packets' MAC field for session-log correlation.

TSG's URL-blocking (P19 site) failed to block a second, near-simultaneous TCP session Chrome opens per HTTP request when that session's first-data-packet arrival lagged the SYN by 45+ seconds, because TSG's connection 'opening timeout' parameter defaulted to 10s and expired first, letting the session fall out of tracked state. Fixed in a later release by raising the timeout to 60s.

The lirenjie/lrj_vxlan sapp-plugin repo (2019-2020) implements a mirror/re-inject packet-processing plugin for VXLAN-encapsulated traffic that defaults to DROP for all packets and explicitly distinguishes two traffic-handling modes, "回流" (return-flow/mirror-received) and "回注" (re-inject), consistent with the mrzcpd/marsio architecture where sapp's blocking decisions on mirrored traffic are re-injected into the link.

The tango/tfe-kmod repo is a DKMS Linux kernel module that reconstructs live TCP connections from out-of-band control messages (CMSG), using the TCP_REPAIR_WINDOW socket option to set window state without a handshake and adding special-case handling for protocols such as SSH where the server sends the first packet -- kernel-level infrastructure letting a userspace process ("TFE") transparently take over or inject into an in-progress TCP flow.

The tango/tsg-service-chaining-engine (SCE) repo implements TSG's traffic-steering core: it VXLAN-encapsulates and routes both "raw" and "decrypted" copies of a session (four tracked metadata directions) through a chain of up to 32 third-party "Service Functions", with explicit per-flow actions of block, bypass, forward, and rx_drop for both mirrored and inline-steered traffic, coordinating with SAPP, mrzcpd (packet capture/re-injection), and MAAT4 (rule engine) via control-plane messages.

A user manual for a third-party ATCA traffic-splitter/bypass appliance ("VELA System" / S3300, made by Beijing Ebright Information Technology Co., Ltd., an ATCA chassis form factor matching the "TSG Ether Fabric" hardware documented elsewhere in this corpus) gives example hardware-level ACL rules that bidirectionally drop any TCP flow on port 80/8080 whose payload contains the literal HTTP header bytes "Content-Type: application/octet-stream", "content-Type: audio", or "content-Type: video" — a raw, DPI-independent, byte-pattern flow-drop capability at the switch/ACL level, distinct from TSG's own sapp/MAAT signature engine.