Proceedings on Privacy Enhancing Technologies 2015; 2015 (1):61–76 Roya Ensafi*, Philipp Winter, Abdullah Mueen, and Jedidiah R. Crandall Analyzing the Great Firewall of China Over Space and Time Abstract: A nation-scale firewall, colloquially referred ●● ● ●● ●● ●●● ● ● ●● ● ● to as the “Great Firewall of China,” implements many ● ● ●●●●●● ● ● ●●● ● ●● ●●●●● ●● ●● ● ● ● ● ●● ● ● ●●●● ● ●●● ● ●●● ● ●●●●●● ●●● ● ● ● ●●● ● ● ●●● ● ● ● ● ● ● ●●● ● ● ● ●●●● different types of censorship and content filtering to con- ●● ● ● ● ● ● ● ● ● ● ●● ● ● ● ● ● ● ● ●● ●● ● ●● ● ●● ● ● ● ●●●● ● ●● ● ● ● ● trol China’s Internet traffic. Past work has shown that ● ● ● ● ● ● ● ● ● ● ● ● ● ● ●●● ● ● the firewall occasionally fails. In other words, sometimes ●●●●● ● ● ●● ● ● ● ● clients in China are able to reach blacklisted servers ● ●● ● ● ● ● 500 1500 2500 outside of China. This phenomenon has not yet been Number of users in China characterized because it is infeasible to find a large and Jan Mar May Jul geographically diverse set of clients in China from which Date in 2014 to test connectivity. In this paper, we overcome this challenge by using a hy- Fig. 1. The approximate amount of directly connecting Tor users brid idle scan technique that is able to measure connec- (as opposed to connecting over bridges) for the first months of tivity between a remote client and an arbitrary server, 2014 [40]. While the number of users varies, it rarely exceeds neither of which are under the control of the researcher 3,000; only a fraction of the 30,000 users the network once counted. performing measurements. In addition to hybrid idle scans, we present and employ a novel side channel in the Linux kernel’s SYN backlog. We show that both tech- 1 Introduction niques are practical by measuring the reachability of the Tor network which is known to be blocked in China. Our More than 600 million Internet users are located behind measurements reveal that failures in the firewall occur the world’s most sophisticated and pervasive censorship throughout the entire country without any conspicuous system: the Great Firewall of China (GFW). Brought to geographical patterns. We give some evidence that rout- life in 2003, the GFW has a tight grip on several layers ing plays a role, but other factors (such as how the GFW of the TCP/IP model and is known to block or filter IP maintains its list of IP/port pairs to block) may also be addresses, TCP ports, DNS requests, HTTP requests, important. circumvention tools, and even social networking sites. Keywords: Tor, GFW, censorship analysis, network This pervasive censorship gives rise to numerous cir- measurement, idle scan cumvention tools seeking to evade the GFW by exploit- ing a number of opportunities. Of particular interest is DOI 10.1515/popets-2015-0005 the Tor anonymity network [15] whose arms race with Received 11/22/2014; revised 2/12/2015; accepted 2/12/2015. the operators of the GFW now counts several iterations. Once having had 30,000 users solely from China, the Tor network now is largely inaccessible from within China’s borders as illustrated in Figure 1. The amount of users trying to connect to the Tor network indicates that there is a strong need for prac- tical and scalable circumvention tools. Censorship cir- cumvention, however, builds on censorship analysis.A *Corresponding Author: Roya Ensafi: University of New solid understanding of censorship systems is necessary Mexico, E-mail: [email protected] in order to design sound and sustainable circumvention Philipp Winter: Karlstad University, E-mail: systems. However, it is difficult to analyze Internet cen- [email protected] Abdullah Mueen: University of New Mexico, E-mail: sorship without controlling either the censored source [email protected] machine or its—typically uncensored—communication Jedidiah R. Crandall: University of New Mexico, E-mail: destination. This problem is usually tackled by obtain- [email protected] ing access to censored source machines, finding open Analyzing the Great Firewall of China Over Space and Time 62 proxies, renting virtual systems, or by cooperating with – Ensafi et al. assumed that SYN packets are treated volunteers inside the censoring country. In the absence the same as RST packets by the GFW, but had no of these possibilities, censorship analysis has to resort to way to verify this. Winter and Lindskog observed observing traffic on the server’s side and inferring what that, from their VPS in Beijing, for Tor relays only the client is seeing, which is not always feasible either. the SYN/ACK from the server is blocked, not the Our work fills this gap by presenting and evaluating SYN from the client to the server. One of our key network measurement techniques which can be used to results in this paper is that this observation also expose censorship while controlling neither the source applies to China in general for a lot of different ge- nor the destination machine. This puts our study in ographic locations. In this paper we present a novel stark contrast to previous work which had to rely on SYN backlog side channel for this purpose. proxies or volunteers, both of which provide limited cov- – Ensafi et al.’s method for choosing clients in China erage of the censor’s networks. was uniform throughout the IP address space of the Our techniques are currently limited to testing basic country, not stratified geographically, so that any IP connectivity. Thus, we can only detect censorship on geographic patterns in their results could have been lower layers of the network stack, i.e., before a TCP biased. We instead use stratified sampling based on connection is even established. This kind of low-level longitude and latitude. censorship is very important to the censors, however. – Ensafi et al.’s data was not culled to ensure that For example, while social media controls on domestic Tor relays which appeared in the consensus but were sites in China, such as Weibo, can be very sophisticated, actually not accessible did not appear in the mea- users would simply use alternatives such as Facebook if surements. We more thoroughly culled our data to the low-level IP address blocking were not in place to remove these kinds of distortions. prevent this. Also, deep packet inspection (DPI) does – Ensafi et al.’s measurements between clients and not scale as well in terms of raw traffic as does lower- servers did not form a full bipartite graph, meaning level filtering. Nevertheless, we acknowledge that our that not every client was tested with every server techniques are not applicable if censors only make use and vice versa. Our experiments were designed to of DPI to block Tor as it was or is done by Ethiopia, form a full bipartite graph to ensure completeness Kazakhstan, and Syria [1]. and avoid distortions in the results. So, to return to our key open questions: 1.1 Limitations of Previous Work – Are there geographic patterns in the cases where the GFW lets through packets that it would oth- Previous related work on China’s filtering of packets erwise block? No. Our results indicate that failures based on IP addresses and TCP ports left open two occur throughout the country and that there are no key questions: are there geographic patterns in the cases conspicuous geographic patterns. where the GFW lets through packets that it would oth- – Are the GFW’s failures on a given route persistent erwise block?; and, are the GFW’s failures on a given or intermittent? Both. Some routes see persistent route persistent or intermittent? failures throughout that day, and some routes see Winter and Lindskog [46] used a virtual private only intermittent failures. server (VPS) in Beijing as a vantage point to reach the set of all Tor relays. For experiments where seeing pack- In summary, this paper makes the following contri- ets on both the client and server side was necessary they butions: performed the experiments between the VPS in Beijing – We answer the two aforementioned key questions, and a Tor relay in Sweden, that was under their control. and confirm other key observations (such as that They observed that, for some Tor relays, their VPS in the GFW blocks SYN/ACKs entering the country China was able to connect to those relays. mostly, and not SYNs leaving the country) that can Ensafi et al. [17, 18] also observed inconsistencies provide important clues about how the GFW oper- with respect to clients in China being able to commu- ates. nicate over IP with Tor servers. However, their experi- – We describe the first real-world application of the ments were not designed to locate geographic patterns hybrid idle scan [17, 18] to a large-scale Internet or answer other key questions about the GFW’s filtering measurement problem, in which we measure the of Tor in the routing layer. Specifically: Analyzing the Great Firewall of China Over Space and Time 63 connectivity between the Tor anonymity network reduce the number of SYN/ACK retransmissions for all and clients in China over a period of four weeks. pending connections [2]. As a result, half-open connec- – We present and evaluate a novel side channel based tions will time out earlier which should bring the SYN on the Linux kernel’s SYN backlog which enables backlog back into uncritical state. We show that the indirect detection of packet loss. Linux kernel’s pruning mechanism—by design a shared resource—constitutes a side channel which can be used Our results call into question some basic assump- to measure intentional packet drops targeting a server. tions about the GFW, such as the assumption that This is possible without controlling said server. China uses the consensus file (a list of all available Our key insight is that we can remotely measure the relays) as their list for blocking Tor or the assump- approximate size of a server’s SYN backlog by sending tion that the blocking occurs at the border.