How to run a meek-server (meek bridge): - Compile the program using 'go build'. - Update your torrc file. There's a sample on /meek-server/torrc. NOTE: if you want to run your bridge on two different ports (HTTP and HTTPS), use something like this: ServerTransportPlugin meek exec /usr/local/bin/meek-server --port 7002 --disable-tls --log /var/log/tor/meek-server.log ServerTransportPlugin meek exec /usr/local/bin/meek-server --port 7443 --cert /etc/meek/cert.pem --key /etc/meek/key.pem --log /var/log/tor/meek-server-https.log - To test your bridge on the clinet side, you can add a line like this to your torrc: Bridge meek 0.0.2.0:3 url=http://my-bridge.example.com:7002/ # Important Note: If you're running more than one transport, you need a separate tor process for each, to avoid user counting confusion. For more information, see https://lists.torproject.org/pipermail/tor-dev/2014-September/007480.html and https://trac.torproject.org/projects/tor/wiki/doc/meek#Users
(meek-server is the server transport plugin for the meek pluggable transport. It acts as an HTTP server, keeps track of session ids, and forwards received data to a local OR port.
ServerTransportPlugin meek exec ./meek-server --port 8443 --cert cert.pem --key key.pem --log meek-server.log
ServerTransportPlugin meek exec ./meek-server --port 8080 --disable-tls --log meek-server.log
meek is a blocking-resistant pluggable transport for Tor. It encodes a data stream as a sequence of HTTPS requests and responses. Requests are reflected through a hard-to-block third-party web server in order to avoid talking directly to a Tor bridge. HTTPS encryption hides fingerprintable byte patterns in Tor traffic. https://trac.torproject.org/projects/tor/wiki/doc/meek The key trick that makes the system work is "domain fronting": communicating with a forbidden domain in a way that makes it look like you are communicating with an allowed domain. It works by putting the allowed domain on the "outside" of a request: in the DNS query and the SNI TLS extension; and the forbidden domain on the "inside": in the Host header of the HTTP request. The trick works with web services that ignore the SNI and handle requests based on the Host header. Google, with its App Engine infrastructure at appspot.com, is one of these services. A client wanting to communicate with a forbidden subdomain of appspot.com while appearing to communicate with www.google.com can run the client plugin program like this: meek-client --url=https://meek-reflect.appspot.com/ --front=www.google.com The meek-client program by itself has a fingerprintable TLS handshake. To disguise the TLS part of HTTPS connections, meek-client should be run with the --helper option pointing at a browser extension that has been set up separately. How it works is meek-client tells the browser what URL to request, the browser requests it and returns the payload to meek-client. The TLS implementation is that of the browser, so it better blends in with allowed traffic. Browser extensions for Chrome and Firefox are in the chrome and firefox directories. Here is a summary of the programs that appear in subdirectories. meek-client: The client transport plugin, run by a censored client. meek-server: The server transport plugin, run on a Tor relay. appengine: Reflector web app that runs on Google App Engine. The reflector simply copies requests and responses to an instance of meek-server somewhere. A public instance of the App Engine web app is at https://meek-reflect.appspot.com/. chrome, firefox: Browser extensions for TLS camouflage. meek-client-torbrowser: An auxiliary program for the Tor Browser Bundle that runs a copy of Firefox with the browser extension and then configures meek-client to use it as a helper. terminateprocess-buffer: An auxiliary program used on Windows to assist with cleanup of subprocesses. latencytest: A test program for App Engine that measures roundtrip times to different destinations. php: A php reflector similar to the appengine one above. Ideally, it can be run on any platform that supports php.from https://github.com/arlolra/meek(https://github.com/yawning/meek,内容稍多一些）相关：https://blog.torproject.org/blog/how-use-%E2%80%9Cmeek%E2%80%9D-pluggable-transporthttps://trac.torproject.org/projects/tor/wiki/doc/meek－－－－－－－－－－meek protocolThe Meek Protocol has recently been getting a lot of attention since the Tor project made a few blog posts about it. Meek is a censorship evasion protocol that users a tactic called “domain fronting” to evade DPI-based censorship tactics. The idea is that using a CDN such as Google, Akamai, or Cloudflare, you can proxy connections (using the TLS SNI extension) so that if an adversary wanted to block or drop your connection, they would need to block connections to the CDN, like Google; mutually assured destruction. The goal being, a way of connecting to the Tor Network that is unblockable even from nation state adversaries.
SNI and Domain FrontingSNI is a TLS extension that’s been around for about nine years, and has been implemented in all modern browsers at this point. This is the TLS version of virtual hosting where you send an HTTP request to a server, and inside is a request to another host. Similar to virtual hosting’s host headers, SNI provides a host inside it’s extension during the client hello request:This would be a request to https://www.google.com but the server receiving this request would look up the record to www.antitree.com to see if it was fronted, and forward the request to that host.You can try this using the actual Meek server that Tor uses:You should get a response of “I’m just a happy little web server.” which is what the meek-server default response is.In terms of Internet censorship, the idea of using SNI to proxy a request through a CDN is called Domain Fronting and AFAIK, is currently only implemented by the Meek Protocol. (That being said, the idea can apply to just about any other protocol or tool. I’ve seen other projects use Meek or something like it. ) What Meek provides is a way of using Domain Fronting to create a tunnel for any protocol that needs to be proxied.
Tor and MeekThe Meek Protocol was designed by some of the people involved with the Tor Project as one of the pluggable transports and is currently used to send the entire Tor protocol over a Meek tunnel. It does this using a little bit of infrastructure:
- meek-client: This is what a client will use to initiate a tunnel over the Meek protocol
- meek-server: corresponding server portion that will funnel requests and responses back over the Meek tunnel
- web reflector: In its current form, this takes an SNI request, sees that it is a Meek request, and redirects it to the meek-server. This also makes sure that the tunnel is still running using polling requests.
- CDN: the important cloud service that will be fronting the domain. The most common example is Google’s App-Spot.
- Meek Browser Plugin: In order to make a meek-client request look like a standard SNI request (same TLS extensions) that your browser would make, a browser plugin is used.