penguinehis/DragonTCP
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

With UDP

Browse Source
This commit is contained in:
penguinehis
2026-08-16 02:33:07 -03:00
parent 14beee38b0
commit 6dac260155
33 changed files with 2065 additions and 2301 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+241 -118
View File
@@ -1,168 +1,291 @@
DragonTCP Proxy v6 - Server Debug Build
=================================
# DragonTCP Full Android VPN v1
This build adds server-side diagnostic logging for the adaptive/chunk transport.
The wire protocol and v6 client remain compatible.
This build replaces the old HTTP-proxy-only Android design with a real layer-3
VPN packet tunnel.
New server flags
----------------
It does **not** use the uploaded `jni.zip` and does not depend on HEV or any
other tun2socks binary. The Android `VpnService` TUN file descriptor is passed
directly to the DragonTCP Go core with Unix `SCM_RIGHTS`, and the Go core moves
raw IPv4/IPv6 packets through DragonTCP's adaptive, XOR-framed TCP/53
transport.
--debug
Session/connect/error logging plus periodic aggregate statistics.
## Architecture
--debug-chunks
Logs every COPEN, CPUSH, ACK, CPULL, DATA, WAIT, EOF, and CCLOSE event.
This is extremely verbose with 32-byte chunks and can reduce throughput.
Enabling --debug-chunks also enables normal debug logging.
```text
Android apps
|
| IPv4 + IPv6 default routes
v
Android VpnService TUN (MTU 1280)
|
v
DragonTCP Go VPN core
|
| adaptive small records, XOR 0xAD, TCP/53
v
DragonTCP VPN server
|
v
Linux TUN dragontcp0
|
| IP forwarding + NAT
v
Internet
```
--debug-stats-interval DURATION
Aggregate statistics frequency. Default: 5s.
Set to 0 to disable periodic statistics.
Because complete IP packets are tunneled, this carries TCP, UDP, DNS, ICMP,
IPv4 and IPv6. Applications do not need HTTP or SOCKS proxy support.
Recommended diagnostic command for fixed 32-byte chunks
--------------------------------------------------------
## Included files
sudo ./dragontcp-server-linux-amd64 --token 'YOUR_SECRET' --chunk-max 32 --chunk-buffered 2048 --chunk-poll-wait 50ms --chunk-session-timeout 5m --max-connections 20000 --tcp-buffer 0 --debug --debug-chunks --debug-stats-interval 5s
```text
bin/dragontcp-vpn-server-linux-amd64
bin/dragontcp-vpn-server-linux-arm64
android/build/DragonTCP-VPN.apk
android/lib/arm64-v8a/libdragontcp_vpn.so
core/ complete Go source
android/src/ complete Android Java source
build_core.sh
build_all.sh
android/build_apk.sh
```
Normal production command with useful low-overhead debug
---------------------------------------------------------
## Server requirements
sudo ./dragontcp-server-linux-amd64 --token 'YOUR_SECRET' --chunk-max 32 --chunk-buffered 2048 --chunk-poll-wait 50ms --chunk-session-timeout 5m --max-connections 20000 --tcp-buffer 0 --debug --debug-stats-interval 10s
The full VPN server needs root/CAP_NET_ADMIN because it creates a Linux TUN
interface and enables packet forwarding/NAT.
Disable all debug logging
-------------------------
Install the normal Linux networking tools if they are not already present:
Simply omit --debug and --debug-chunks.
```bash
sudo apt-get update
sudo apt-get install -y iproute2 iptables
```
Example debug output
--------------------
TCP port 53 must be free.
[DEBUG] SESSION OPEN id=... target=example.com:443 max_chunk=32 active_sessions=1
[CHUNK] CPUSH id=... seq=0 bytes=32 -> ACK accepted=32
[CHUNK] CPULL id=... ack=-1 want=0 offset=0 limit=32
[CHUNK] DATA id=... seq=0 offset=0 bytes=32 total=32
[CHUNK] CPULL id=... want=8 -> WAIT
[DEBUG] SESSION CLOSE id=... active_sessions=0
[DEBUG] STATS uptime=10s active_connections=8 active_sessions=2 sessions_opened=5 sessions_closed=3 bytes_up=... bytes_down=... push_records=... pull_requests=... data_records=... waits=... errors=0
Check:
Counters
--------
```bash
sudo ss -lntp | grep ':53'
```
active_connections - currently open DragonTCP TCP connections
active_sessions - currently open chunk proxy sessions
sessions_opened - total chunk sessions opened
sessions_closed - total chunk sessions closed
bytes_up - bytes accepted from client and written toward target
bytes_down - bytes read from target into chunk buffering
push_records - accepted upload CPUSH records
pull_requests - CPULL requests received
data_records - DATA responses generated
waits - WAIT responses because downstream data was not ready yet
errors - debug-counted server/protocol errors
## Start the server
Important performance note
--------------------------
```bash
sudo ./dragontcp-vpn-server-linux-amd64 \
--token 'YOUR_SECRET' \
--debug
```
At 32 bytes, --debug-chunks can generate thousands or millions of log lines for
large transfers. Use it while diagnosing a failure, then switch to --debug only
for normal use.
The defaults are:
Large-chunk update
==================
```text
listen 0.0.0.0:53/TCP
TUN dragontcp0
TUN MTU 1280
server IPv4 10.123.0.1/16
server IPv6 fd7a:4472:6167:6f6e::1/64
maximum fragment 65535 bytes
poll wait 100ms
auto NAT enabled
private targets blocked
```
This is the v6 debug/adaptive-chunk branch with FIXED poller concurrency.
It intentionally does NOT include the later adaptive-poller controller.
The server automatically enables IPv4/IPv6 forwarding and installs
MASQUERADE/forward rules with `iptables`/`ip6tables` when available.
Chunk limits
------------
If you manage routing/NAT yourself:
Previous hard limit:
```bash
sudo ./dragontcp-vpn-server-linux-amd64 \
--token 'YOUR_SECRET' \
--auto-nat=false
```
8192 bytes
To allow clients to reach private/LAN destination addresses too:
New hard limit:
```bash
--allow-private
```
1048576 bytes (1 MiB)
## Debug server
The framed protocol ceiling was increased to 2 MiB so a 1 MiB CPUSH/DATA
record plus protocol metadata fits safely.
Normal diagnostics:
New defaults:
```bash
sudo ./dragontcp-vpn-server-linux-amd64 \
--token 'YOUR_SECRET' \
--debug \
--debug-stats-interval 5s
```
client --chunk-max 65536
server --chunk-max 65536
Very verbose per-IP-packet diagnostics:
The adaptive client still begins at:
```bash
--debug-packets
```
--chunk-start 256
Do not leave `--debug-packets` enabled for high-throughput use.
and can grow toward the configured maximum after successful records.
## Android app
Use up to 1 MiB adaptive chunks
--------------------------------
Install:
Server:
```text
DragonTCP-VPN.apk
```
sudo ./dragontcp-server-linux-amd64 --token 'YOUR_SECRET' --chunk-max 1048576 --debug --debug-stats-interval 10s
The UI is intentionally small:
Android ARM64 client with fixed poller count of 8:
```text
Server
TCP Port
Token
Maximum fragment
Minimum fragment
Timeout
./dragontcp-client-android-arm64 --server-host YOUR_SERVER_IP --token 'YOUR_SECRET' --chunk-start 256 --chunk-min 32 --chunk-max 1048576 --chunk-pollers 8 --chunk-timeout 2s --chunk-adapt-log
CONNECT
STOP
The number of pollers stays exactly at the value passed with --chunk-pollers.
Only the chunk size adapts.
Live log
```
Examples of useful ceilings
---------------------------
Defaults:
--chunk-max 16384 # 16 KiB
--chunk-max 32768 # 32 KiB
--chunk-max 65536 # 64 KiB (new default maximum)
--chunk-max 131072 # 128 KiB
--chunk-max 262144 # 256 KiB
--chunk-max 524288 # 512 KiB
--chunk-max 1048576 # 1 MiB hard maximum
```text
Port 53
Max 1280
Min 32
Timeout 2s
Pollers 1 (fixed)
MTU 1280 (fixed)
```
Fixed-size mode also supports the same range:
The starting DragonTCP record size is always the configured maximum. On a
transport failure the client automatically reduces it. With Max=1280 and
Min=32 the reduction path can converge approximately as:
--chunk-size 262144
```text
1280 -> 640 -> 320 -> 160 -> 80 -> 40 -> 32
```
Memory note
-----------
After sustained successful full-size records it cautiously grows again.
Larger server chunk maxima require larger per-session target-read buffers and
can increase buffered memory substantially when many sessions are active.
For thousands of simultaneous users, do not automatically use 1 MiB unless
measurements show that it is useful. Values such as 16-64 KiB are a more
reasonable starting point, while the adaptive client can still be configured
to probe higher when your network supports it.
The app assigns itself a stable private DragonTCP VPN IPv4/IPv6 pair on first
run. The DragonTCP app UID itself is excluded from the VPN so the TCP/53
transport cannot recursively enter its own TUN interface.
Validation
----------
## Why Max defaults to 1280
The updated source and binaries were rebuilt from this v6 debug branch.
Validation included:
This version transports IP packets, not an HTTP byte stream. The Android VPN
MTU is 1280, so an individual IP packet normally cannot exceed 1280 bytes.
The UI still accepts larger DragonTCP record ceilings up to 65535, but there
is usually no throughput benefit unless the VPN MTU is raised too.
* Go builds for Linux amd64, Linux ARM64, Linux ARMv7 client, and Android ARM64.
* A protocol round-trip test with a full 1 MiB request and response frame.
* An 8 MiB HTTP download through the proxy using fixed 262144-byte (256 KiB)
chunk configuration; the downloaded SHA-256 matched the source exactly.
## Building everything from source
DragonTCP branding update
=========================
Requirements:
This package was renamed from HOX to DragonTCP.
- Go 1.22+
- JDK 17+
- Android SDK platform and build-tools
- `zip`
Binary names are now:
No Android NDK is required in this build.
dragontcp-server-linux-amd64
dragontcp-server-arm64
dragontcp-client-linux-amd64
dragontcp-client-android-arm64
dragontcp-client-arm64
dragontcp-client-armv7
Set the SDK path:
The Go module and command directories were also renamed to DragonTCP.
The existing UP/OK wire framing and chunk protocol were intentionally kept
unchanged, so this branding change does not break compatibility with the
previous protocol implementation.
```bash
export ANDROID_SDK_ROOT="$HOME/Android/Sdk"
```
Build server, Android native core, and APK:
```bash
./build_all.sh
```
Outputs:
```text
bin/dragontcp-vpn-server-linux-amd64
bin/dragontcp-vpn-server-linux-arm64
android/lib/arm64-v8a/libdragontcp_vpn.so
android/build/DragonTCP-VPN.apk
```
Build only Go/native components:
```bash
./build_core.sh
```
Build only APK after the core is present:
```bash
./android/build_apk.sh
```
## Android TUN fd handoff
The Android service creates the VPN using `VpnService.Builder.establish()`.
It then sends that TUN file descriptor to the Go child over a private Unix
socket using Android `LocalSocket.setFileDescriptorsForSend()`. The Go side
receives the descriptor with `SCM_RIGHTS` and directly reads/writes IP
packets.
This avoids JNI and avoids passing an inherited descriptor through
`ProcessBuilder`.
## Protocol packet mode
Packet mode still uses the DragonTCP request/response envelope:
```text
request : UP + request-id + length + XOR(payload)
response : OK + request-id + length + XOR(payload)
```
The VPN payload protocol is binary rather than text to reduce overhead on very
small records.
Commands include:
```text
VOPEN
VPUSH fragment
VPULL fragment
VCLOSE
```
A random 128-bit session ID is used after authenticated session creation.
Packets and fragments have sequence/offset fields so retries do not duplicate
bytes.
## Test mode
For protocol testing without root/TUN/NAT, the server has:
```bash
./dragontcp-vpn-server-linux-amd64 \
--host 127.0.0.1 \
--port 19053 \
--token test \
--mock-echo
```
This echoes complete IP packets back to the client instead of forwarding them
to the Internet.
During development the packet path was tested with IPv4 and IPv6 1280-byte
packets while the server forced a 32-byte maximum DragonTCP fragment. Both
were reassembled byte-for-byte correctly.
## Security
XOR 0xAD remains protocol obfuscation, not cryptographic encryption. HTTPS
and other TLS-based application protocols retain their own end-to-end
security, but the DragonTCP transport itself should not be considered
cryptographically confidential.