Technical Analysis of the Geedge Networks Firewall Source Code Leak

TSG's Context-Based Detector (CBD) evaluates circumvention tool signatures across JA3/JA4 TLS fingerprints, SSL certificate issuer fields, UDP payload length, first-packet byte patterns, server IP ranges, and FQDN matches, often combining multiple conditions with logical AND. Of 29 VPN and circumvention tool signatures logged in the VPN Signature File Update Log (March–November 2024), 21 carry risk level 5 (the maximum), indicating aggressive prioritization of blocking major tools including ExpressVPN, NordVPN, Tor Browser, and Psiphon.

§4.1, §4.1.2, Table 3, Table 4 detection dpitls-fingerprinttraffic-shapeip-blockingsni-blocking cnmmetkzpk

Measurements of TCP RST injectors confirm that GFW II and GFW III consistently yield a seed key k=13, matching TSG's default seed_key parameter in trick_algo_getrandval_with_seed. The probability of sharing TSG's default value of 13 by chance is approximately 10⁻⁴⁴, strongly indicating these GFW components run Geedge Networks TSG code or a close derivative.

§6.3, Table 7 deployment rst-injectiondpi cn

Internal Jira tickets reveal that Psiphon lacked obvious protocol signatures, forcing censors to fall back to IP-based blocking of Psiphon3 client IPs combined with a 'whitelist protection mechanism' that allows traffic when the destination SNI matches a popular domain—an explicit collateral-damage tradeoff documented in the Confluence file 'GTN498 The collateral damage analysis of Psiphon3 Blocking.' A ticket from the Ethiopia (E21) deployment shows customers complaining that the VPN deny policy inadvertently blocked non-VPN applications.

§4.1.2, Figure 2, Figure 3 detection ip-blockingsni-blocking cnmmet

TLS ClientHello length-field permutation tests show that GFW II's parsing behavior matches an older tagged version of TSG's SSL module, while Kazakhstan and Pakistan (DROP mode) exhibit parsing behaviors consistent with TSG QUIC plugin deployments. QUIC version fingerprinting further confirms Kazakhstan runs an older version of TSG's QUIC parsing code, and Myanmar's supported QUIC versions exactly match TSG's, spanning at least five countries confirmed or plausibly running TSG components.

§6.4, §6.5, Table 8, Table 9 deployment dpitls-fingerprinthttp3-quic-blocksni-blocking cnkzpkmm

TSG's DNS parser enforces a hard limit of exactly 17 compression-pointer jumps per query; a query with 18 jumps causes domain name extraction to fail and suppresses the injection response. Only China's GFW Injector 2 shares the full combination of DNS flags 0x8180, compression-pointer encoding in injected answers, and the 17-pointer capability boundary, confirming it runs TSG's DNS injection code.

§6.1, Table 5 deployment dns-poisoningdpi cn