From d7cae0be18a88677692149e5625306ca0fb80f45 Mon Sep 17 00:00:00 2001 From: wangyu- Date: Fri, 11 Aug 2017 01:32:55 -0700 Subject: [PATCH 01/20] Update README.md --- README.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/README.md b/README.md index 9a95485..120d570 100755 --- a/README.md +++ b/README.md @@ -127,6 +127,9 @@ kcptun is a tcp connection speed-up program,it speeds-up tcp connection by using ### speed-up tcp connection via raw traffic by using udp2raw+finalspeed finalspeed is a tcp connection speed-up program similiar to kcptun,it speeds-up tcp connection by using kcp protocol on-top of udp or tcp.but its tcp mode doesnt support openvz,you can bypass this problem if you use udp2raw+finalspeed together,and icmp mode also becomes avaliable. +# how to build +read [build_guide](/doc/build_guide.md) + # Related work ### kcptun-raw this project was inspired by kcptun-raw,which modified kcptun to support tcp mode. From e732ce2a8ab2ef191dfd3012cd58a50023b3ac28 Mon Sep 17 00:00:00 2001 From: wangyu- Date: Fri, 11 Aug 2017 01:33:20 -0700 Subject: [PATCH 02/20] Update README.md --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 120d570..c89f935 100755 --- a/README.md +++ b/README.md @@ -127,7 +127,7 @@ kcptun is a tcp connection speed-up program,it speeds-up tcp connection by using ### speed-up tcp connection via raw traffic by using udp2raw+finalspeed finalspeed is a tcp connection speed-up program similiar to kcptun,it speeds-up tcp connection by using kcp protocol on-top of udp or tcp.but its tcp mode doesnt support openvz,you can bypass this problem if you use udp2raw+finalspeed together,and icmp mode also becomes avaliable. -# how to build +# How to build read [build_guide](/doc/build_guide.md) # Related work From 165dc193f018b47597a684ab7118b02c859bb722 Mon Sep 17 00:00:00 2001 From: wangyu- Date: Fri, 11 Aug 2017 01:45:53 -0700 Subject: [PATCH 03/20] Update README.md --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index c89f935..74574bd 100755 --- a/README.md +++ b/README.md @@ -11,7 +11,7 @@ encrypt your traffic with aes128cbc,protects data integrity by md5 or crc32,prot ### Simulated TCP Handshake simulated 3-way handshake,simluated seq ack_seq. Simluated tcp options:MSS,sackOk,TS,TS_ack,wscale. Provides real-time delivery ,no tcp over tcp problem when using openvpn. ### Connnection Failure Dectection & Recover -Conection failure detection by hearbeat. After hearbeat timeouts,client will auto change port and re-connect.if re-connection is successful,the previous connection will be recovered,and all existed udp conversations will stay vaild. +Conection failure detection by hearbeat. After hearbeat timeouts,client will auto change port and re-connect.if re-connection is successful,the previous connection will be recovered,and all existed udp conversations will stay vaild. (for example,if you use udp2raw+openvpn.the openvpn wont lose connection after reconnect,**Even if you re-insert your net cable,or connect to a new wifi,existing openvpn connection will stay vaild**) ### Other Features Multiplexing ,one client supports multi udp connections,all of those traffic will share one raw connection From 9f25a61dadfe963d0927b3955eca3670c8668455 Mon Sep 17 00:00:00 2001 From: wangyu- Date: Fri, 11 Aug 2017 01:47:20 -0700 Subject: [PATCH 04/20] Update README.md --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 74574bd..40fc418 100755 --- a/README.md +++ b/README.md @@ -10,7 +10,7 @@ Which can help you bypass udp blocking or udp QOS or just poorly supported udp N encrypt your traffic with aes128cbc,protects data integrity by md5 or crc32,protect replay attack with an anti-replay window smiliar to ipsec/openvpn.Client and server use pre shared secret to verify each other,man-in-the-middle is impossible. ### Simulated TCP Handshake simulated 3-way handshake,simluated seq ack_seq. Simluated tcp options:MSS,sackOk,TS,TS_ack,wscale. Provides real-time delivery ,no tcp over tcp problem when using openvpn. -### Connnection Failure Dectection & Recover +### Connection Failure Dectection & Connection Stablize(connection recover) Conection failure detection by hearbeat. After hearbeat timeouts,client will auto change port and re-connect.if re-connection is successful,the previous connection will be recovered,and all existed udp conversations will stay vaild. (for example,if you use udp2raw+openvpn.the openvpn wont lose connection after reconnect,**Even if you re-insert your net cable,or connect to a new wifi,existing openvpn connection will stay vaild**) ### Other Features Multiplexing ,one client supports multi udp connections,all of those traffic will share one raw connection From fadf5a25c202885fdefdff7d9a8b74fc9ea59164 Mon Sep 17 00:00:00 2001 From: wangyu- Date: Fri, 11 Aug 2017 01:49:56 -0700 Subject: [PATCH 05/20] Update README.zh-cn.md --- doc/README.zh-cn.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/doc/README.zh-cn.md b/doc/README.zh-cn.md index 8df5c68..e30d31d 100644 --- a/doc/README.zh-cn.md +++ b/doc/README.zh-cn.md @@ -1,6 +1,6 @@ Udp2raw-tunnel ![image2](/images/image2.PNG) -加密、防重放攻击的、信道复用的udp tunnel，利用raw socket中转udp流量 +加密、防重放攻击的、信道复用的udp tunnel，利用raw socket中转udp流量.同时有心跳保活，在断线重连后保持上层连接不掉线的功能。 [English](/README.md) From 81e599e84c86647061debef63dee18a5fb133370 Mon Sep 17 00:00:00 2001 From: wangyu- Date: Fri, 11 Aug 2017 01:50:25 -0700 Subject: [PATCH 06/20] Update README.zh-cn.md --- doc/README.zh-cn.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/doc/README.zh-cn.md b/doc/README.zh-cn.md index e30d31d..6989c8e 100644 --- a/doc/README.zh-cn.md +++ b/doc/README.zh-cn.md @@ -1,6 +1,6 @@ Udp2raw-tunnel ![image2](/images/image2.PNG) -加密、防重放攻击的、信道复用的udp tunnel，利用raw socket中转udp流量.同时有心跳保活，在断线重连后保持上层连接不掉线的功能。 +加密、防重放攻击的、信道复用的udp tunnel，利用raw socket中转udp流量.同时有心跳保活，且在断线重连后保持上层连接不掉线的功能。 [English](/README.md) From d1934dda4c326b7483201ddb75ce5e26b867a4b9 Mon Sep 17 00:00:00 2001 From: wangyu- Date: Fri, 11 Aug 2017 01:52:29 -0700 Subject: [PATCH 07/20] Update README.md --- README.md | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index 40fc418..d96f8bf 100755 --- a/README.md +++ b/README.md @@ -7,11 +7,13 @@ An Encrpyted,Anti-Replay,Multiplexed Udp Tunnel,tunnels udp traffic through fake ### Send/Recv Udp Packet as Raw Packet with TCP header,ICMP header Which can help you bypass udp blocking or udp QOS or just poorly supported udp NAT behavior by some ISP. Raw packet with UDP header is also supported,in this way you can just make use of the encrpyting and anti-replay feature. ### Encrpytion,Anti-Replay,Anti-MITM -encrypt your traffic with aes128cbc,protects data integrity by md5 or crc32,protect replay attack with an anti-replay window smiliar to ipsec/openvpn.Client and server use pre shared secret to verify each other,man-in-the-middle is impossible. +Encrypt your traffic with aes128cbc,protects data integrity by md5 or crc32,protect replay attack with an anti-replay window smiliar to ipsec/openvpn.Client and server use pre shared secret to verify each other,man-in-the-middle is impossible. ### Simulated TCP Handshake -simulated 3-way handshake,simluated seq ack_seq. Simluated tcp options:MSS,sackOk,TS,TS_ack,wscale. Provides real-time delivery ,no tcp over tcp problem when using openvpn. +Simulated 3-way handshake,simluated seq ack_seq. Simluated tcp options:MSS,sackOk,TS,TS_ack,wscale. Provides real-time delivery ,no tcp over tcp problem when using openvpn. ### Connection Failure Dectection & Connection Stablize(connection recover) -Conection failure detection by hearbeat. After hearbeat timeouts,client will auto change port and re-connect.if re-connection is successful,the previous connection will be recovered,and all existed udp conversations will stay vaild. (for example,if you use udp2raw+openvpn.the openvpn wont lose connection after reconnect,**Even if you re-insert your net cable,or connect to a new wifi,existing openvpn connection will stay vaild**) +Conection failure detection by hearbeat. After hearbeat timeouts,client will auto change port and re-connect.if re-connection is successful,the previous connection will be recovered,and all existed udp conversations will stay vaild. + +For example,if you use udp2raw+openvpn.the openvpn wont lose connection after reconnect,**Even if you re-insert your net cable,or connect to a new wifi,existing openvpn connection will stay vaild** ### Other Features Multiplexing ,one client supports multi udp connections,all of those traffic will share one raw connection From 46b0a00b3e5a78c367db02c7e8818c1fb4b87305 Mon Sep 17 00:00:00 2001 From: wangyu- Date: Fri, 11 Aug 2017 01:53:03 -0700 Subject: [PATCH 08/20] Update README.md --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index d96f8bf..8185ad8 100755 --- a/README.md +++ b/README.md @@ -1,7 +1,7 @@ # Udp2raw-tunnel ![image0](images/image0.PNG) -An Encrpyted,Anti-Replay,Multiplexed Udp Tunnel,tunnels udp traffic through fake-tcp or icmp by using raw socket +An Encrpyted,Anti-Replay,Multiplexed Udp Tunnel,tunnels udp traffic through fake-tcp or icmp by using raw socket.Its also a Connection Stablizer. [简体中文](/doc/README.zh-cn.md) ### Send/Recv Udp Packet as Raw Packet with TCP header,ICMP header From ebdb08873ad6e8c2b6ef8ea702c7b3fbaddd0cfa Mon Sep 17 00:00:00 2001 From: wangyu- Date: Fri, 11 Aug 2017 01:54:39 -0700 Subject: [PATCH 09/20] Update README.md --- README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 8185ad8..7757350 100755 --- a/README.md +++ b/README.md @@ -10,10 +10,10 @@ Which can help you bypass udp blocking or udp QOS or just poorly supported udp N Encrypt your traffic with aes128cbc,protects data integrity by md5 or crc32,protect replay attack with an anti-replay window smiliar to ipsec/openvpn.Client and server use pre shared secret to verify each other,man-in-the-middle is impossible. ### Simulated TCP Handshake Simulated 3-way handshake,simluated seq ack_seq. Simluated tcp options:MSS,sackOk,TS,TS_ack,wscale. Provides real-time delivery ,no tcp over tcp problem when using openvpn. -### Connection Failure Dectection & Connection Stablize(connection recover) +### Connection Failure Dectection & Connection Stablize(Connection Recover) Conection failure detection by hearbeat. After hearbeat timeouts,client will auto change port and re-connect.if re-connection is successful,the previous connection will be recovered,and all existed udp conversations will stay vaild. -For example,if you use udp2raw+openvpn.the openvpn wont lose connection after reconnect,**Even if you re-insert your net cable,or connect to a new wifi,existing openvpn connection will stay vaild** +For example,if you use udp2raw+openvpn.Openvpn wont lose connection after reconnect,**Even if you re-insert your net cable,or connect to a new wifi,existing openvpn connection will stay vaild**. ### Other Features Multiplexing ,one client supports multi udp connections,all of those traffic will share one raw connection From c08bd12ea08af7be2b5b5b10a3fb3a6f046c7a4f Mon Sep 17 00:00:00 2001 From: wangyu- Date: Fri, 11 Aug 2017 01:55:26 -0700 Subject: [PATCH 10/20] Update README.md --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 7757350..2fc24ff 100755 --- a/README.md +++ b/README.md @@ -10,7 +10,7 @@ Which can help you bypass udp blocking or udp QOS or just poorly supported udp N Encrypt your traffic with aes128cbc,protects data integrity by md5 or crc32,protect replay attack with an anti-replay window smiliar to ipsec/openvpn.Client and server use pre shared secret to verify each other,man-in-the-middle is impossible. ### Simulated TCP Handshake Simulated 3-way handshake,simluated seq ack_seq. Simluated tcp options:MSS,sackOk,TS,TS_ack,wscale. Provides real-time delivery ,no tcp over tcp problem when using openvpn. -### Connection Failure Dectection & Connection Stablize(Connection Recover) +### Connection Failure Dectect & Connection Stablize(Connection Recover) Conection failure detection by hearbeat. After hearbeat timeouts,client will auto change port and re-connect.if re-connection is successful,the previous connection will be recovered,and all existed udp conversations will stay vaild. For example,if you use udp2raw+openvpn.Openvpn wont lose connection after reconnect,**Even if you re-insert your net cable,or connect to a new wifi,existing openvpn connection will stay vaild**. From 5e6d9772475a8906f32fbdcc62421f8535145220 Mon Sep 17 00:00:00 2001 From: wangyu- Date: Fri, 11 Aug 2017 02:25:14 -0700 Subject: [PATCH 11/20] Update README.md --- README.md | 1 + 1 file changed, 1 insertion(+) diff --git a/README.md b/README.md index 2fc24ff..52fa2ce 100755 --- a/README.md +++ b/README.md @@ -4,6 +4,7 @@ An Encrpyted,Anti-Replay,Multiplexed Udp Tunnel,tunnels udp traffic through fake-tcp or icmp by using raw socket.Its also a Connection Stablizer. [简体中文](/doc/README.zh-cn.md) +# Features ### Send/Recv Udp Packet as Raw Packet with TCP header,ICMP header Which can help you bypass udp blocking or udp QOS or just poorly supported udp NAT behavior by some ISP. Raw packet with UDP header is also supported,in this way you can just make use of the encrpyting and anti-replay feature. ### Encrpytion,Anti-Replay,Anti-MITM From e01d7059addec412401bbff3e0cbc02013e1669c Mon Sep 17 00:00:00 2001 From: wangyu- Date: Fri, 11 Aug 2017 02:26:25 -0700 Subject: [PATCH 12/20] Update README.zh-cn.md --- doc/README.zh-cn.md | 1 + 1 file changed, 1 insertion(+) diff --git a/doc/README.zh-cn.md b/doc/README.zh-cn.md index 6989c8e..d546ff5 100644 --- a/doc/README.zh-cn.md +++ b/doc/README.zh-cn.md @@ -11,6 +11,7 @@ Udp2raw-tunnel 如果你需要加速跨国网游、网页浏览，解决方案在另一个repo： https://github.com/wangyu-/UDPspeeder +# 功能特性 ### 把udp流量伪装成tcp /icmp 用raw socket给udp包加上tcp/icmp包头，可以突破udp流量限制或Udp QOS。或者在udp nat有问题的环境下，提升稳定性。  另外也支持用raw 发udp包，这样流量不会被伪装，只会被加密。 From 3a0c512e43c1bd7f3270a9a1d0fbcc4a63aa6c7f Mon Sep 17 00:00:00 2001 From: wangyu- Date: Fri, 11 Aug 2017 02:39:46 -0700 Subject: [PATCH 13/20] Update README.md --- README.md | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 52fa2ce..6171423 100755 --- a/README.md +++ b/README.md @@ -7,10 +7,12 @@ An Encrpyted,Anti-Replay,Multiplexed Udp Tunnel,tunnels udp traffic through fake # Features ### Send/Recv Udp Packet as Raw Packet with TCP header,ICMP header Which can help you bypass udp blocking or udp QOS or just poorly supported udp NAT behavior by some ISP. Raw packet with UDP header is also supported,in this way you can just make use of the encrpyting and anti-replay feature. -### Encrpytion,Anti-Replay,Anti-MITM -Encrypt your traffic with aes128cbc,protects data integrity by md5 or crc32,protect replay attack with an anti-replay window smiliar to ipsec/openvpn.Client and server use pre shared secret to verify each other,man-in-the-middle is impossible. ### Simulated TCP Handshake Simulated 3-way handshake,simluated seq ack_seq. Simluated tcp options:MSS,sackOk,TS,TS_ack,wscale. Provides real-time delivery ,no tcp over tcp problem when using openvpn. + +### Encrpytion,Anti-Replay,Anti-MITM +Encrypt your traffic with aes128cbc,protects data integrity by md5 or crc32,protect replay attack with an anti-replay window smiliar to ipsec/openvpn.Client and server use pre shared secret to verify each other,man-in-the-middle is impossible. + ### Connection Failure Dectect & Connection Stablize(Connection Recover) Conection failure detection by hearbeat. After hearbeat timeouts,client will auto change port and re-connect.if re-connection is successful,the previous connection will be recovered,and all existed udp conversations will stay vaild. From 6296322e22736d97eb9cbb66d378615d7d58bfbe Mon Sep 17 00:00:00 2001 From: wangyu- Date: Fri, 11 Aug 2017 02:41:07 -0700 Subject: [PATCH 14/20] Update README.zh-cn.md --- doc/README.zh-cn.md | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-) diff --git a/doc/README.zh-cn.md b/doc/README.zh-cn.md index d546ff5..9c93c64 100644 --- a/doc/README.zh-cn.md +++ b/doc/README.zh-cn.md @@ -15,13 +15,6 @@ https://github.com/wangyu-/UDPspeeder ### 把udp流量伪装成tcp /icmp 用raw socket给udp包加上tcp/icmp包头，可以突破udp流量限制或Udp QOS。或者在udp nat有问题的环境下，提升稳定性。  另外也支持用raw 发udp包，这样流量不会被伪装，只会被加密。 -### 加密 防重放攻击 防中间人攻击 -用aes128cbc加密，md5/crc32做数据完整校验。用类似ipsec/openvpn的 replay windows机制来防止重放攻击。 - -设计目标是，即使攻击者可以监听到tunnel的所有包，可以选择性丢弃tunnel的任意包，可以重放任意包；攻击者也没办法获得tunnel承载的任何数据，也没办法向tunnel的数据流中通过包构造/包重放插入任何数据。udp2raw client和server用预分配密钥（pre-shared secret）互相认证，无法被中间人攻击。 - - - ### 模拟TCP3次握手 模拟TCP3次握手，模拟seq ack过程。另外还模拟了一些tcp option：MSS,sackOk,TS,TS_ack,wscale，用来使流量看起来更像是由普通的linux tcp协议栈发送的。 @@ -32,6 +25,11 @@ Client能用单倍的超时时间检测到单向链路的失效，不管是上 对于有大量client的情况，对于不同client,server发送的心跳是错开时间发送的，不会因为短时间发送大量的心跳而造成拥塞和延迟抖动。 +### 加密 防重放攻击 防中间人攻击 +用aes128cbc加密，md5/crc32做数据完整校验。用类似ipsec/openvpn的 replay windows机制来防止重放攻击。 + +设计目标是，即使攻击者可以监听到tunnel的所有包，可以选择性丢弃tunnel的任意包，可以重放任意包；攻击者也没办法获得tunnel承载的任何数据，也没办法向tunnel的数据流中通过包构造/包重放插入任何数据。udp2raw client和server用预分配密钥（pre-shared secret）互相认证，无法被中间人攻击。 + ### 其他特性 信道复用，client的udp端支持多个连接。 From 4eb72f6139d64e75133003148cb0cd4c1bf0577d Mon Sep 17 00:00:00 2001 From: wangyu- Date: Fri, 11 Aug 2017 02:45:29 -0700 Subject: [PATCH 15/20] Update README.md --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 6171423..da25e13 100755 --- a/README.md +++ b/README.md @@ -11,7 +11,7 @@ Which can help you bypass udp blocking or udp QOS or just poorly supported udp N Simulated 3-way handshake,simluated seq ack_seq. Simluated tcp options:MSS,sackOk,TS,TS_ack,wscale. Provides real-time delivery ,no tcp over tcp problem when using openvpn. ### Encrpytion,Anti-Replay,Anti-MITM -Encrypt your traffic with aes128cbc,protects data integrity by md5 or crc32,protect replay attack with an anti-replay window smiliar to ipsec/openvpn.Client and server use pre shared secret to verify each other,man-in-the-middle is impossible. +Encrypt your traffic with aes128cbc,protects data integrity by md5 or crc32,protect replay attack with an anti-replay window smiliar to ipsec/openvpn.Client/Server verifys each other,man-in-the-middle is impossible. ### Connection Failure Dectect & Connection Stablize(Connection Recover) Conection failure detection by hearbeat. After hearbeat timeouts,client will auto change port and re-connect.if re-connection is successful,the previous connection will be recovered,and all existed udp conversations will stay vaild. From ccab523ddf05d47ce6facaf6b567724e413f650c Mon Sep 17 00:00:00 2001 From: wangyu- Date: Fri, 11 Aug 2017 02:46:33 -0700 Subject: [PATCH 16/20] Update README.zh-cn.md --- doc/README.zh-cn.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/doc/README.zh-cn.md b/doc/README.zh-cn.md index 9c93c64..b688390 100644 --- a/doc/README.zh-cn.md +++ b/doc/README.zh-cn.md @@ -28,7 +28,7 @@ Client能用单倍的超时时间检测到单向链路的失效，不管是上 ### 加密 防重放攻击 防中间人攻击 用aes128cbc加密，md5/crc32做数据完整校验。用类似ipsec/openvpn的 replay windows机制来防止重放攻击。 -设计目标是，即使攻击者可以监听到tunnel的所有包，可以选择性丢弃tunnel的任意包，可以重放任意包；攻击者也没办法获得tunnel承载的任何数据，也没办法向tunnel的数据流中通过包构造/包重放插入任何数据。udp2raw client和server用预分配密钥（pre-shared secret）互相认证，无法被中间人攻击。 +设计目标是，即使攻击者可以监听到tunnel的所有包，可以选择性丢弃tunnel的任意包，可以重放任意包；攻击者也没办法获得tunnel承载的任何数据，也没办法向tunnel的数据流中通过包构造/包重放插入任何数据。client和server互相认证对方，无法被中间人攻击。 ### 其他特性 信道复用，client的udp端支持多个连接。 From fc4d1786576f7d5a2e26b921e7bbb99266b4dc45 Mon Sep 17 00:00:00 2001 From: Tian Yunhao Date: Fri, 11 Aug 2017 20:36:37 +0800 Subject: [PATCH 17/20] Update README.md --- README.md | 100 +++++++++++++++++++++++++++++++++--------------------- 1 file changed, 62 insertions(+), 38 deletions(-) diff --git a/README.md b/README.md index da25e13..4023a56 100755 --- a/README.md +++ b/README.md @@ -1,50 +1,70 @@ # Udp2raw-tunnel ![image0](images/image0.PNG) -An Encrpyted,Anti-Replay,Multiplexed Udp Tunnel,tunnels udp traffic through fake-tcp or icmp by using raw socket.Its also a Connection Stablizer. +An encrpyted, anti-replay, multiplexing UDP tunnel which tunnels UDP traffic with fake TCP or ICMP header using raw socket. Also acts as a connection stablizer. [简体中文](/doc/README.zh-cn.md) # Features -### Send/Recv Udp Packet as Raw Packet with TCP header,ICMP header -Which can help you bypass udp blocking or udp QOS or just poorly supported udp NAT behavior by some ISP. Raw packet with UDP header is also supported,in this way you can just make use of the encrpyting and anti-replay feature. -### Simulated TCP Handshake -Simulated 3-way handshake,simluated seq ack_seq. Simluated tcp options:MSS,sackOk,TS,TS_ack,wscale. Provides real-time delivery ,no tcp over tcp problem when using openvpn. +### Send / Receive UDP Packet with fake headers +Fake headers help you bypass UDP blocking, UDP QOS or improper UDP NAT behavior on some ISPs. Raw packets with UDP headers are also supported, where you can just use the encrpyting and anti-replay feature. -### Encrpytion,Anti-Replay,Anti-MITM -Encrypt your traffic with aes128cbc,protects data integrity by md5 or crc32,protect replay attack with an anti-replay window smiliar to ipsec/openvpn.Client/Server verifys each other,man-in-the-middle is impossible. +### Simulate TCP Handshake +Simulates the 3-way handshake, along with seq and ack_seq. TCP options MSS, sackOk, TS, TS_ack, wscale are also simulated. Real-time delivery guaranteed, no TCP over TCP problem when using OpenVPN. -### Connection Failure Dectect & Connection Stablize(Connection Recover) -Conection failure detection by hearbeat. After hearbeat timeouts,client will auto change port and re-connect.if re-connection is successful,the previous connection will be recovered,and all existed udp conversations will stay vaild. +### Encrpytion, Anti-Replay, Anti-MITM +* Encrypt your traffic with AES-128-CBC. +* Protect data integrity by MD5 or CRC32. +* Defense replay attack with an anti-replay window, smiliar to IPSec and OpenVPN. +* Authenticate mutually, no more MITM attacks. + +### Failure Dectection & Stablization (Connection Recovery) +Conection failures are detected by heartbeats. If timed-out, the client will automatically change the port number and reconnect. If reconnection is successful, the previous connection will be recovered, and all existing UDP conversations will stay vaild. + +For example, if you use UDP2RAW + OpenVPN, OpenVPN won't lose connection after any reconnect, **even if the network cable is re-plugged or the WiFi access point is changed**. -For example,if you use udp2raw+openvpn.Openvpn wont lose connection after reconnect,**Even if you re-insert your net cable,or connect to a new wifi,existing openvpn connection will stay vaild**. ### Other Features -Multiplexing ,one client supports multi udp connections,all of those traffic will share one raw connection +* **Multiplexing** One client can handle multiple UDP connections, all of which share the same raw connection. -Multiple Clients Support,one server supports multiple clients. +* **Multiple Clients** One server can have multiple clients. -NAT Supported,all 3 modes work in NAT environment +* **NAT Support** All of the 3 modes work in NAT-ed environments. -OpenVZ Supported,tested on bandwagonhost +* **OpenVZ Support** Tested on BandwagonHost. + +* **OpenWRT Support** No dependencies, easy to build. Binary for ar71xx are included in release. + +### Keywords +* UDP QoS Bypass +* UDP Blocking Bypass +* OpenVPN TCP over TCP problem +* OpenVPN over ICMP +* UDP to ICMP tunnel +* UDP to TCP tunnel +* UDP over ICMP +* UDP over TCP -Openwrt Supported,no dependence package,easy to compile,ar71xx binary included in release. -### Key Words -bypass udp qos,bypass udp blocking,openvpn tcp over tcp problem,openvpn over icmp,udp to icmp tunnel,udp to tcp tunnel,udp via icmp,udp via tcp # Getting Started ### Prerequisites -linux host(include desktop linux,openwrt router,raspberry pi),root access. if you want to use it on window,you can use VMware(both bridged mode and nat mode are supported). +A Linux host (including desktop Linux, OpenWRT router, or Raspberry PI) with root access. + +If you want to use it on MICRO$OFT Windows, you can use VMware or Hyper-V (both bridged mode and NAT mode are supported). + ### Installing -download binary release from https://github.com/wangyu-/udp2raw-tunnel/releases +Download binary release from https://github.com/wangyu-/udp2raw-tunnel/releases + ### Running -assume your udp is blocked or being QOS-ed or just poorly supported.assume your server ip is 44.55.66.77, you have a service listening on udp port 7777. -``` -run at client side: +Assume your UDP is blocked or being QOS-ed or just poorly supported. Assume your server ip is 44.55.66.77, you have a service listening on udp port 7777. + +```bash +# Run at client side ./udp2raw_amd64 -c -l0.0.0.0:3333 -r44.55.66.77:4096 -a -k "passwd" --raw-mode faketcp -run at server side: +# Run at server side: ./udp2raw_amd64 -s -l0.0.0.0:4096 -r 127.0.0.1:7777 -a -k "passwd" --raw-mode faketcp - ``` -Now,your client and server established a tunnel thorough tcp port 4096. Connecting to udp port 3333 at client side is equivalent with connecting to port 7777 at server side. No udp traffic will be exposed to outside. + +Now, the client and the server have established a tunnel through TCP port 4096. Connecting to UDP port 3333 at the client side is equivalent to connecting to port 7777 at the server side. No UDP traffic will be exposed. + # Advanced Topic ### Usage ``` @@ -82,25 +102,30 @@ other options: 2:increase randomly, about every 3 packets (default) -h,--help print this help message ``` -### iptables rule -this programs sends packet via raw socket.In faketcp mode,Linux Kernel TCP packet processing has to be blocked by a iptables rule on both sides,otherwise Kernel will automatically send RST for unrecongized TCP packet and you will sustain from stability/peformance problem.You can use -a option to let the program automatically add/del iptables rule on start/exit.You can also use the -g option to generate iptables rule and add it manually. -### cipher-mode and auth-mode -Its suggested to use aes128cbc + md5 to obtain maxmized security.If you want to run the program on a router,you can try xor+simple,it can fool Packet Inspection by firewalls most time, but it cant protect you from serious attackers. Mode none is only for debug,its not suggest to set cipher-mode or auth-mode to none. + +### IPTABLES rule +This program sends packets via raw socket. In FakeTCP mode, Linux kernel TCP packet processing has to be blocked by a iptables rule on both sides, otherwise the kernel will automatically send RST for an unrecongized TCP packet and you will sustain from stability / peformance problems. You can use `-a` option to let the program automatically add / delete iptables rule on start / exit. You can also use the -g option to generate iptables rule and add it manually. + +### `cipher-mode` and `auth-mode` +It is suggested to use AES-128-CBC + MD5 to obtain maximum security. If you want to run the program on a router, you can try XOR + simple, which can fool packet inspection by firewalls the most of time, but it cannot protect you from serious attacks. Mode none is only for debugging purpose. It is not recommended to set the cipher-mode or auth-mode to none. + ### seq-mode -the faketcp mode doest not behave 100% like a real tcp connection.ISP may be able to distinguish the simulated tcp traffic from real tcp traffic(though its costly). seq-mode can help you changed the seq increase behavior a bit. If you experienced problems,try to change the value. +The FakeTCP mode does not behave 100% like a real tcp connection. ISPs may be able to distinguish the simulated tcp traffic from the real TCP traffic (though it's costly). seq-mode can help you change the seq increase behavior slightly. If you experience any problems, try to change the value. + # Peformance Test -#### test method: -iperf3 tcp via openvpn + udp2raw -(iperf3 udp mode is not used bc of bug mentioned in this issue: https://github.com/esnet/iperf/issues/296 ,instead,we turn iperf3 's tcp traffic into udp by using openvpn,to test udp2raw 's peformance. Read [Application](https://github.com/wangyu-/udp2raw-tunnel#application) for detail ) +#### Test method: +iperf3 TCP via OpenVPN + udp2raw +(iperf3 UDP mode is not used because of a bug mentioned in this issue: https://github.com/esnet/iperf/issues/296 . Instead, we package the TCP traffic into UDP by OpenVPN to test the performance. Read [Application](https://github.com/wangyu-/udp2raw-tunnel#application) for details. + #### iperf3 command: ``` iperf3 -c 10.222.2.1 -P40 iperf3 -c 10.222.2.1 -P40 -R ``` -#### client host -vultr $2.5/monthly plan(single core 2.4ghz cpu,512m ram,location:Tokyo,Japan), -#### server host -bandwagonhost $3.99/annually(single core 2.0ghz cpu,128m ram,location:Los Angeles,USA) +#### Environments +* **Client** Vultr $2.5/monthly plan (single core 2.4GHz cpu, 512MB RAM, Tokyo, Japan) +* **Server** BandwagonHost $3.99/annually plan (single core 2.0GHz cpu, 128MB RAM, Los Angeles, USA) + ### Test1 raw_mode: faketcp cipher_mode: xor  auth_mode: simple @@ -152,4 +177,3 @@ https://github.com/linhua55/some_kcptun_tools/tree/master/relayRawSocket Transparently tunnel your IP traffic through ICMP echo and reply packets. https://github.com/DhavalKapil/icmptunnel - From 746aefa70ad2d119103f45e24445b72e69789a36 Mon Sep 17 00:00:00 2001 From: wangyu- Date: Fri, 11 Aug 2017 06:54:39 -0700 Subject: [PATCH 18/20] Update README.md --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 4023a56..b6dfa63 100755 --- a/README.md +++ b/README.md @@ -63,7 +63,7 @@ Assume your UDP is blocked or being QOS-ed or just poorly supported. Assume your ./udp2raw_amd64 -s -l0.0.0.0:4096 -r 127.0.0.1:7777 -a -k "passwd" --raw-mode faketcp ``` -Now, the client and the server have established a tunnel through TCP port 4096. Connecting to UDP port 3333 at the client side is equivalent to connecting to port 7777 at the server side. No UDP traffic will be exposed. +Now,an encrypted raw tunnel has been established between client and server through TCP port 4096. Connecting to UDP port 3333 at the client side is equivalent to connecting to port 7777 at the server side. No UDP traffic will be exposed. # Advanced Topic ### Usage From 36ed28064a78c0d0dde26d8768e915788cd22d1d Mon Sep 17 00:00:00 2001 From: wangyu- Date: Fri, 11 Aug 2017 08:39:43 -0700 Subject: [PATCH 19/20] Create 111 --- images/speedtest/111 | 1 + 1 file changed, 1 insertion(+) create mode 100644 images/speedtest/111 diff --git a/images/speedtest/111 b/images/speedtest/111 new file mode 100644 index 0000000..8b13789 --- /dev/null +++ b/images/speedtest/111 @@ -0,0 +1 @@ + From 83b00e79adac9465999dcba06b5dc53524ddc31c Mon Sep 17 00:00:00 2001 From: wangyu- Date: Fri, 11 Aug 2017 08:40:23 -0700 Subject: [PATCH 20/20] Add files via upload --- images/speedtest/Capture.PNG | Bin 0 -> 9201 bytes images/speedtest/Capture2.PNG | Bin 0 -> 8336 bytes 2 files changed, 0 insertions(+), 0 deletions(-) create mode 100644 images/speedtest/Capture.PNG create mode 100644 images/speedtest/Capture2.PNG diff --git a/images/speedtest/Capture.PNG b/images/speedtest/Capture.PNG new file mode 100644 index 0000000000000000000000000000000000000000..fb12c54a9ee810ec48f811d1b75cbc53bd6d7d74 GIT binary patch literal 9201 zcmb7~2RK|^*Y}AKq7x;A$>^emOo%chdM`;3Jvs>?As9xD=)HH*5{cfsiQe0YAj(9P ziRh!7!F#yx`+1)Cz25KozVEs)&YXSDoW1s1Yp>sbO{lh}68Uwe>v(v03u|=_hZnzze?1VpJ4;rngi<%)HK4y2eAv6$ws>jo30&0y*6sH zTMkSQ&qbP!w`5MIRc*`H6ZMDAajE^+YIS+*FW3M zK2M>x>~^cCj~zots#PDzyCOp>j6}&{f$O2`-ajAN>|dfmJh_;xzf7V zf7A?oyT}i*zVPko~#6&*u6{U)HLt4RLVC_#%G~i+iWZ zVp02QF3qkREGm2S`b`FxmH>=vY@PTp>u6r-plULsE279|!<>QI0?vH{9kv!fN2gMx zWqTZ@{KJcf^tfb%kU_I@!8Y=i^#B*uTxk5K>QkWrGl%)+=|3c`Q9@wMsv7vf=lJ1+3L+JJg@zrYZ_XATb$S#NiWNvC$%Rg4g+F)i+!^WpM zRqNf>GOx3wl#{JkYQ>*i@tsOsBck;=O<+#hO>bkP*gTbq2MSYBUawQbF7b z9}SsUD`y`ptU#ygn|cY1{fK9F$AVAvO}#Z};)V}45NSoFnU1F^YY8q5H}*51Wv@pC zmYVVWk+fh}lc>UcMyPwPLI;8x5<13UUF|vLf zLw4y{GeSmtRqEAf-wLJIhU51Vv+Tei`-4g?9j46UHys6EZ0~iK=HJ(ljbL?eja+nM z61Mj%-ko?ykyux%sZPzrTN0MbW3b)+0qkG7UXsWcudT2;zl|R>5(V{z)8z7m<$fbA zY32>fb;aK^9ZW}jO|sl$d>s2ELGfWwe(UaLlS&9M=&_K)vWCtLh0j8-*uP~oZEDKW zDFBB$$g%$PTpm@1hXs)^yeC50=G-29z~_bKF6AVOU5)?-B@jL2bGm#NIKe~ir#BD0 z`PUBdd$HNcXk>HgNcI}gLV8+2bRTA zFx6+8RgKVgdV6u{XmA0|0WNV~U%O6|MUTpS?($qTzy`!ET4_^-F?!WBhdaP-g(`|$ ztn0-R!SU1I1!tIxnOVto;1g(7rjt1x;dbSVGHr&g6|k2H_|8Qz-ur%Q6sz4NE;A4+ z{DI$s)@FDFD*fW?jvIl4D7RpE z!aaq49&vi}_|10|TbAS1>l1q#jh0k1L!GwFqA8MFtvwl1OM8QB@%0ce;$=?AdH3zr zu$@ei8>fx}XrBHr?(;S1+gqMjtoy4NW%zQLvC?`8Hu@{fgIyB^qU?voU-4Q?3oCU@W`C2KQ**cWa3Ja?BE`3T~1Mj^=3zPMhL+tl0NDZP3@sJlBA= zVnV$hmhjda4AobRmXsNb_*4iyG9r2>^UmiU@$L*?e`xSIg`FOUmK@EU5er=Lz5Z{b z*k?Lv)H}ynvN`=TytZUDI~_`qqM#C!mtK5^K4;U-N63Md3`B%VwP9c7GBAe{c_7Di z2ML%~cCum{rC~cJW7viwNP~ngqZ~ zg(tV9oP4KVI=SFf-fa-=LH$!O{M{oKu9ovXVaVd2Ysy+V+RKrfp1;ISk1T28G?N5m zG^3pAkLg_&x}G>pb@n}3uP9rKXFyFjL-V)h=Lnky<__m=JA@jSkQ^LQj7_=);K-yT z`j_t6rq?*Z(0d@{Gt9b+&9|vt^(}U6>O}_kE{&4jyn4@jg>EJDa9*w2a6w^6TSR(q zH1Ahm`Ept7nZ%f#EqXX}rS%$Xwa{x!)`BFkS3!gXjFRl0l6D03Dh+GBFCa7X-Hohy zRCaZem2`4&>r~_q7UWaDfY!=L2<&Wgie4a_}V0qU2LN!Aze9mXq(ED6VuT z(O2r#Kd8O+Wdrx%uRnKz@+*I0A&{5T$%=(i;X75s+kF>)_97Is3%He!WHlx(#Mo$vE5Y_$WUc=K?U(v9^=232KM z3uL^s^w6_Fa!JSEo%cOi;}|920|7id~`(f8rG}-vgGEHFSYb- z++k_iyFlXAW43RX$!K#S=aH#URyK_)Z!*$MY0sgxecu5e$f4;2r-s^IgE#L;liNQ=^e< zqa8zL=WfB`<%i}6Qs)i)iTBJ4GfKNtHgbNcHhJ%?g%(PwUJ7fgc5mv^l(&&JZ2=2u z-yy$P0XZ@eq2P&jE{%rHS_@%trXCD|AJ|T0g7~EE8T*X)3DsOrwsA(_H&7pHz{b@6 zys&uuMUS2%gJ>KA zH?m(^P29h>f*60ONO=FLj@?S7kh~#`e$mz%j+`WIiKZ*y*M;`{Dmx1sBy;4*2qJrQ z$G+I$C*}`k+0iX91ww4GSn9RH1)fW8PZaYnRpuJP@4kTG+Jb_vQoAmizTc?(hw~h@uXl5*40acS zn@AA{@2?wQRFbt1sc}R!X1`OZt>~U@KGFvts|h7%LY#~iTPtZdNIvD>3ec1E%pYBN z7s&8PK-+IzRmt=BgvC5Dq1b_arVs%_;dWUBCi-)6$@zL!ZIZNMn~C)KFH*0${A5!O zdYOk?*+Q);cI%E~b}}=hw7FrlU}USXlSCcDF<2JrqF#@s>6dWQyLI7HNZFs0C%hpfLXsnQx?iP2 zs5aGfe#a@I_Jb9Ng75si`O`8BMh4#=?O-E}kR0SL8+{bGxsBfe7eW5?ofV$-b1v<% z9sj7|*2=I`JtgGbkVZ&kmx#Vq-Ja-=VguvqAtspj&W8RsJI5!G# zxBG`et?%L5OmcUvh@kM`=oLerMTA0cBR#N1j^A;TLfaqJB6)Hd)+ix)vwz^twphP6b2*%1yyIB)?+L|6p`u9IT~_5f{99c1>qh8`IcPcpN6)+(9vstP>9(ze!H>G0io~-58Pfv zx*pd9ek%a-oL+KQo}co(shOzP7QT}Skp=QN2M80>FDR$=lJmQ7c-&h7pNw1MUhD1K zx7(wkueE6^xm!yh0KP@?`^Mz7ZvIZsg~&}`QyBPq*D$uC$w}SMTZBQN*SB1$78O^iPA%N^3D7740${rl=F48&VpHn zGAM<$L!TF2nWhY(ZNF(a*NxEqV2XQk0(VIcqlz4SS#%s&O0vouu+EeU$5q$&@6C`@nGlQhBn>%M zuooNrX^D@oM(*_NF_ql!+0y!5g`*GLCSWMF{}qU%xN$z~UC~UH!JOTDrL!e5fv)hJ zx6?|$DxDqc9}nbvS5UV{$1g%&Cri04%+qSEweWw5C*rd@cB2MjN%nPV{*d_}2SA)L%whWl5!I2x>eyLK()zmEi zvH-jDtTe&1U=qA2iUP`5|bsU0pq9 zILJ8Zu3x5E{bPFj7+t#@-g2XGb|=}g-K26jJ^AAWy^vbXdJL2}mc&OuZDrV!_%-r+ z-*!z2#0N=z_rX;-I_8iv`+iuia5~4g`4N#CWNqo4b{}MMAxhNlXOzN&nzyffhvmo|+G36{8RUS3#a;@MkMR11zb!ortc)g?p8f{mW8t?7I7`$= z3n>j2UJLU3)pHb+F;Gyr)p=s2+j~Dhl+s7@f!8t}cqmFu=R6X;)(nKRi|=&PE0pQA z8OU~&K%+_>--R604YH%Md_+c1+q-t^uu?fPvOzIV0kry-vHUFurcd|$Sm`ESgBlk=aLuPxqgYf%31lG_boPi`ozUisaU zBIfHa(8JjGP(f3N3I8UtXVx8{@q*T=3z83eY&NS{DDFO&8F=TC*z@x)I6gtpPnFrl z_1QsI7sFrRjv2iieu3;fsstbY&#+(8+(3(t-Bf2U(7j-OOyRQk$1Pa}9ZxoB!#bZa z40{x>H53>wSj+sXN*uLt8YP;nj&O)B2&i%Zvoq`Za!?tK&>@eYE)aL-nFe za_Nz_P5CrGv%QN@6q9rFTw$6<;LDurO>fBmC$s+$C1vPzySFnPM7}cIv?a_Mx!V>UZz=tz*5SA-=(O27 z9C~nBq7cBVRU}M4zqK5{m><|mD=>N`Ik_dyt`>PQE82b|>g2k4Q+sA#Sr#vrQH>h60)m`&2oq9b(>|2fywL(6>yf*NB64A1Wbx(#FUn~YkGdW5dHhn+PtH$A~U^@lLL*l+SoZK z#6*xAHCu)L{j^M&puI5(+({Un=tvTxqJ7=n*@?LoP*-V(9$XfphP|MS!}4R-If@0jd|%O> zG=AB7x+&S@NZ>2Zg&S=>r5Sp#WY~YCN%z#7BCAejy{1n5EWgc-!1E#`n1FqgQBfB6 z5#*~bi@ek-cF4t07J|(lVdUu#U}67EyEJ%j&g+~&MVZeX<&{m2_#LMfA9Fe5Ac&!% zVey=|Crd)$-XL7rvaf0+RmXCq3KZ@;Yb%2_X7QdSu{jy!8(KeO1h_ESv^MezVvw=P%w*HLmx zG(Ilo!I#Q`|B2#JB>xu_Cw`pTKJuB-oqmbZtwBo=fy0E8bGMSc5fEOB7-KUIB-V*tE|pE~ ziK?5H`p7@3A&W$r4vRP)yj!%I?D1;qOkbhydRe*(zz*@Af2aEP`QG>n2SojnC~tBj z&cVSySZ|$)sE_|elfS*$ysPP(;Fwhj=K1qLe--6R9q8Rit>erf_T~2!Qo#(X4b4`o z7c}El7;yNSQ{!|NpW4;y(CZB`6fT;+N9Ip*?Hz>L4A_+j-^O}^(af%Ys3cvJ0v!HW zC(rc9hd-^npmC0Ty3ba^S|wz<)5~?ru_FC49|J0OW}JqKrzfYKgAz!>S$*4sGDTgV z(IER_i`-MrhlID?s^mj=TZ{Nu0mnA_fxZtLYef77}1Or>i5%yp1l#M~F;?dKhI(jxzz&(HS7 zP*djK)q8h4w_+8-2V-({pR-R44?=8tBt~5{%C3Ui>?5uIO_FcD_Y|pnu5dpsuBV*U4;ritQ8B1bmQwP@ zQrbz%vEub`voVRcdwS^5J+%*JCGjW!#p7E}0w=%>-=5vj;fp6~k1dueiu)fV z?k73R0f<{peCv4WGv?k$nr6s%LH z3j?pe;{+;F75}P-dx6J{5=w_zr)Lo#vVwRBmcK^U&Hm66zp;=4j!7G;J7u>FVT>_Cu_w+9=w-P)bXur~0s$~k-Upzb@ z&YWB1xUu@0rV{zEUdUh@<7jVRu^3_5Aw0=dF&!>rYYeVBEWGK z;or&NX>-+pFv)9l?n7H}^)ab*b0fTA<9Mlc6x(UcbzQ^N{xhE%o!ha%6&N5@s#`mr z+Gf|(%#ZPHV2&Bgrc|%3TKmw+X^vsh;X+(YUca(CxVzmg;FYGm$8xP}xw`1=m# z;noa7;0&Tvk=c_v$sg;L#Mj*#oE(%MJ}?SP0C@I7(tx>(n8k@RUeIapINus2zv#Q+ zzu}zrqR+;$bgY_=BK*r<^4#PfK~y7>S7gU&KBzNs2m*HEXvD0vZ`1iGacVwqB{la6 zXX*)T63Qvwwdr~Un23G%>S>x3h$S#N)0WP%PMwMPuz&}tv2h}ow<1TkO}4Gmo53RO z@!LFBwu41AMnC4ZtoxatdCFCLOP=Sf)uTCTq|a<07n%Icqy_uK-hx;4wmCIDiErwm z4@VpFGvz{dfaQ7@hlO_@ClUvJq0(#|_kA7!G2kour3*3LWZ(*&yQz6P8z&@a&kthah zXrL1@oF>^tJ2?FK_GPWM-8NH`f zFa%S!IAA0>oSK`-Sk#Mtb{%Olfq?`bM+xrMs2}Yv(4GIC%J&ZP;KWUCtB&zVfCeBd zOV4PNDP-WbrPi$kpy_*|_MueR2S8SZWs)Z!c>qM@Rb_8;3AECgs4^IkEK+W?2Ge}> z*hzl>6yBeo)7wy#4@mv5^GNBXU+AMPt=l$cd~4#r+|2FVn&lMh(Q51s8iT56U2}PU zRA~FZq4-ecgRFP>YTSl9?&MgCktTZMRpV41@;7Gt63U z5-bd!?&Ji(o}u!7_+Ssd=&Gov%zK|0wgj`D1@E)}qh%daUCCyPYQZke{h~;}dzpy!`_qilJCaU96*MS;d3!s))zPD?unpz-Y#|cjt>60npzs@1sl>4T*TFG z<}=@~Wp*h!wwV)LE9QAVWV3E2J7`dhm9cbsTIG|~}A z59p7SEhu!9lbu%vNN8Bu{&KIN(B2FZvu8(~=q><=_>flLQF6>{{72=ME)jNNF)`&dY?ia zzO8q(aAy&kTIpm$p6&P7g%b<6(uTQkI#N8brIo1Ty8`RTWdOPa9QnF%1#WWDRWx+v z2W?v^idpZ*Uo0QWYeeWUpMlWzyF^8x;lD*m=FgFl__S(!;|SS%5nu!gS*e$krV4ZK z3Jzl=SMLOnI(rK8(9oj=(Crs3;VZ>OjswDSzk2Zu!*3RyZT^`E)sw6?eB5N?d(|`y zx18dfT)ewdz$?@$`Sr@pVhgU4_(7O?nUp~-L_T&ctip(k999hUr)FOC8w=z7&6W6z zhQ0*wpRbP>A5(P%gGy>j(AAiG&Ee6qhV8unbmu82fbM*COG>e)QW}=UE5jr;Mwi9J z4s4;!BQQH>_fpM&qi@oZx?(&PSjXE6assGT&S4By<)WPF-8+H0U5s3P zX7IGiQvSM&YQ@QD`O*CvH?iM(IB4PSMi#8Tt!3wQ=$=+c|GOI*p z!OM)zSz=EkOHcm)(Q3DGe3=7)^3!*ho$p3GPob3|v*!cCo&ukHfs}E(Lq8Q;3Jmzh zV01z0I)B1vi0`9In}A;Z1v4kOR%1T$gdqvF?JZgHyqbmEj4s>foRpW1`wIjQ%Z1=w z68_~01$(^9D=z6g42frV*}K0yRe=Bh2JUmLmS>`BqlcBGvfsj-a4Xj2RS}^|Z;5EsZUNO{PbumYHi5Evaf0g^jSIR;>7-a9$*Vj$iMA+=6!gIK?+9V zPOBOJ+r0!3nP*7ToaFpFI>Wsz54Q!-IR6l%sjQbwuaLhNpC231GY^#gjS0GBKt9AB zjm(>1o^3RwRMz|Rc&NgVcD?)h(r$+p{eKQnDwm`i#b^dt6BNi8==wdwou2&YpEO&BVqqF5;(x!^luvOKQ%c)^5gJpr#g~Q6hU}FB@ReON7&# z3+tVzk$fp7)dvBPiTw4MQNAQDRk)~YY@Lb21Ufg_El2(Ng+J;?m0d&(TvVB45F##F zJbV|=>mla^cfa!9a~(QPE3%=}X$qZ4{`Qv+wVQ(tFU$K#=VFv#ayxB5{FxT2lKf(u z55?ItKVPNPP4?H>CwZ>))jl>8r(Awea}ks6_0412un|#gR&xah~3%clw<^ zAQw8|!QU@xLUfDuA)?9&&D~tTv{Q!&{uQswsx83#f zW>Y(bNiwL4Y*|WKKgRm6wqK5((JjNKGHg@dQaK`__El)FW8opmT=dE)a=o_NJ}M7* z`xmC0Y@$*6xU-F`^|C{Llp8&nkzK!%l16?8I@s!UU(2!Vi=!56~Oq|M4d-!jc2*N38HE!w{y zRIs7NoM9@lbWWRl9u)K^l7Ni^)J(sbMMXQ&@NpoCj+m^Xq&^R;EM4&Gr}sjAM3=ir z=Fx`5KzkKtm|T_Vu{fvPwjljmk8^pIvx>&wnW!j%cHpq!G2DlAS2H_^b@H!#K=T=O z?~0W2(*waqyC8|xN>p@Bfa+CBSu^B#oHx*89<`;xMT0e%3fXN@l}`CY3}VXdTMdH) zBwG&8GD8d26-(ad_Hd4KsV!cdAG>P_f$MQ`yy$mai~5|9uQgxCu98t%icU;1cM@mb zJN{~2vyx6O%}J#S1I$B2An=Xw&W+C?8v{(R-m{;(X}SBgYyk#l=yJryCy zX%0OUp;)Xr_H);YS^!oN>}HYXl-+CFC);rvn?D}$nXAvhmR2w_Aw%?%LC~lW?9lht zfP99Y1)HMRY1?x!6uR8hx|~{Rk(yan=DG93UA&F2?t%1~g`4{zgAXVlYG~()FnJvD zvIlyVhbtSMV#Lp@QAoKvFb9$FBBmyH?lh*P!Y# zrx-2m55*&EHN#VItikXm9Wn%0GCoQ-Zhmi-`t7zgi~5BQV`yeqiHk7EL`xR9BSAiJ z>%xd9p%M2Jb;Cu5=jvVJL^Q{9`P-axpVO33>5mo+sO5iz6rI@MC$@X^0mQU^x}e1t zl_*@B7ZAd>PhT7y2y<Hiu7mF;!zXCr6dmB0gn^rG=@BcKvFr%-n)|%#g=;bO% zg?UuoZ0J{DMMRL@uBUr+UagF>%s%J~ezc}Bn0 zgefK(&01{KO9@rKh&gVGk4vF+g4An%7OAI;@G(kekuIEeyc-o{l!E^gtJ8)dXXktU z0$dRJcFjCOfsLTtDGrR925cd3kHxZ!n#o4=OZ^^UQQbgGE)zTu9{Iv8|C%KeoTfo*+v;RtDRv@xqCACWM;I|I*CJK zSd!!}!j7D^jbb_J8{5{I?<@8Et~Z`+pA6eCTe(*{EUaNjVn z5~^Ol~hPw?EW4#Ip7xVGBu zvFsOv6Kddc;0*CH>m*8) zxWQCWp=sn_o}kU}QLV#|=1@cczvM-HcKB6glH{548kkNP~oS_Qbj94&v(-HY2bQ zp*vN#jct=dKtIH^?!GMORxyVb+#HAC7ncW;!_`BuIxtz#_I|C|*hAvUdu1)Z_wE^e2P`+J0@f4NW{--jF6MAnP@;g^Q&L$XTl5 z_r7BhwUd_Sjn!jmbmw^t8CZ6GsNkG1h(X%!Mxd*9iW&%RPW8R7162 zVRNnb_HIRiynK~4l6c(H-~W?m^hLCB9HQhffN?gnjyb5My~AbZYgcN`Fvj}6;Fqlq z_fRHBd2jbMrdpaI>Eec73Mc;Rcuz;oYMh6pf^Z&UC=zV4TIspnniHKn>wK|HXz-y+ zj&5t~wK;SCG3L2>ga~nuOqk}MbSc8C*igvWux`P&}iVMzmCx-VLJbbYdJ`wj*ZQkoA(!EBY#^vXHC4lmi|ri;ii zYTWwJY{ei}&c~1ji$Vx571fS##b{27??^R&nJ&=;-z;yob2vRp>%t!)i8JJN*EoJr$7o%0ryOEL@kT597_nR0KXQRVC5wI%l#JFpBXJT`hSK{Wm;Dn3mIu zCgL*F6pSHfpp7KD1(zR#iqu+J#s>p6WOLHvPF=SnKpB(vy5-XZ0!e`_%rY zB}=~!}YSp@!9+3;uUpJ zG!xonmpzSikzlvik#&ldpa}EBbTuVISSTwl@@BrIY_+ojQ?qdae7MPeS_wRBR6R zxayq0_0gnZ@)_mfKz=yZZMhd+WGDLI&xow&J_%}h_R z-dU`2shZ*)U1G72l_7hpAO$9LDaafMdig#i65D<;rxLh8LE49GnYSA>6bX(zcQ zPR|w0xnb1p_gQB;*a^JLJ-66!?E-epS=~f&Y7!gk5)~uBs6JP#?lo5FGBaibmv3qW zlh-%&(tHuvJoH-n)ws;w?*jqXH(qpji7n3%NDxiM@*bKWo!~BgI_Q&%`uw!5vNzI2 zH{`Xgah7SMKC$d&H77 zpyCQqj%^b06>;BmF~dRl1gT2UHQo!_1&@pvCi_1rGO9ifzJl{7r9FkXcYV;NPW6Vc zT~E~?Ha`p(<)>2CbHtC)n1t<~P>XW^q4bjHwbv5B6};nwfavS9{(yaQ$9+EJ0R~~Ifm?C^hvnfUdD$a}$qomN3?#FW(t}}e zt{+jqE$ETSEStaXljkIV&t9@dLJra~)4T55|C!(w_TQSxiqGNbeT{wR-|SwyB%4-` z^>sR#8-4RdaR3i}&C%oc`WKQYkB+~*1AR|0{Op6%c&o$bGGbnH;*orR>bOTPA*`Hf=7p2NsmXv+nJ3XP8LUD3y~mcE_j!3N@yul>6%KD8?!j;_tA|!nKHEa> za$ED@&g*_8;EhJ%>UgS#oHXN=IDy@a7;y^-oMFHz4=Sz18iZ|5yvuv270(ubHBL&a z=THlr^6-Nr;}X&NLRju)X+q^Ey~&dkFXcUd}7+2(f%?G z2YwU{z8m@!-q%z_G!=Fx7`%5BNwt>A7i6#Owd&5OeO4{@JzAs-zsl5*iPp*&vfYB( zKSU40SgN62VGgV5RXwk8Qb42#!>J^I&y6wR(GG>3Y_62oblqrJ3_Ne~Xpuyvix-Td zv3)*N`oDR6Ai^G4rax~Dyk*vZ%Jlx#w$`AQVu!9c~7GSQ8|7rnYaEURfqlfen zVz)fArLXv-V$im-2OadxL5@!RDT01w$gHG4R@kIY!Ao0c_EBZ705O097u>9U5GX-+ z4Np)waJv!x%Cihe21w=!36w1J`(E!7P)3)bml`F&fcmEVcj$vpQ+|O16At%h1;xHo z1~#~umgy~*eP5?EROc*0(vw+_qBn$^>f*y=hcI&j zu{`cSMY^RljuY<9n0f0PlwAToHzdf_d2T0 z2gHa7*Bz$%KpxaFoFU;h##78R(KL>-&B>dP+8cP}>!DX_k53lqFRHj1tUHW6pcB^4 z1To*eM*%BlU$d`?Jh%2wY1NmnZ8vdf__UO2@K0 zmR?%OA+F6|pKS`K=tV!X2DP8m7XwqwU-ejnMN|5P4+=>^A zH|WOL_tx6&5#+4&Q@f~v=LXN|a=$=6H#J}6?}JwH$>==exIxj+(dMJ2x`hY*e5QHw zil2mbS6s7bo$908gt}>@D1)1iHzQK~`?{R+0s#Plt$VkQle6{4j2&-8p9%l1$SG4oq3g_rlM7j8jrppFbjLvM z=a24ea}MjJ83fc;tEZ#Y{h1ItFw96oKbK#!wse;lge+&WV|Xc#EL`);N1K*pG{vw^LoiDAd~;d6NYw20mfQYv z?wDGaL+`!-Z4isAHBuK=XR_UmBU`~B7pvAu2G^f+&*}ipFK<_0i58u%=@+W56@#mD zn8zChUpCLFJUhWoO5OjGEYN3thc%=Cyds_E^(T0t_*O-gYgu-D-nnLr?otZV8|l81 zUP*3Oo=clzo(_6TEKNV+jm#VQ6P(hjU!%kAy9MzKu2Op{)Qf{)MqurVjeo3LKt@AK zZqKgbh*)h_#7QNXA?;Qd(m7FH88$4rBc*ab{iuC49MrQCJ< z>Ki@N&J_Sq6xB2i{&VhwMBIOvdSggt0x*J7Wm3Ca8_@S5;s9=TD*?T4M@KZi!Kuf z-&H_0F{FuV$*=eTh3-y%AzeRGBj@@KRWJH)mMSxN9iZ?LOP=GCWdU1|_G9^;;*kKx zua}!ZzXsgOzWK1cjIcnV2S0_<@yIZtESQ*V*7I%@`0;8?Nwz`*lYP2)LtdX3`Le{Z zG^K6YBAe`dEeB{%spZ@Zf3rh-HXYsrZ`Xo*sfxQK#!{s3kYeVX*TdSiVeKviIZ8I@~|NG!37w&WUhzA9G~d(MKs$x3>|b}&#{ znOC2ioyh36r8RJtJ7l3+7H6>RmBB7!jmc@B7Ay;n)5U!TM~=2QLCroATa93FJWiyx z3D@`TuP*TlAG;ErSP8&pvs54KT8LR6>nkuh7~;ze%Pdm9*>hwMk2e^V?PbHW1;Hh-2)!crO!cZSIlRd7afV#+-B_!tf=L*m+< zfvbtQG0cNzIs!*CAy>aIo!o=lnVWxowjVaH*|-7E+mQ;;T)f6+TBuzCtWFRpi5m&f zQw+!E{aZEQzB^s}u8(Bu?S|=|OLsw>mVMT9*g}in*I=HosBFKLZaDLZP&9c7T6tS6Mq}9(?*CkU^c_x`d9+Ay zh_`){$X_LThEFs?h5wYYkZegpVGQtV=C3NWzE0c1f?02zX0|j;rceaeHK-pGlm|Y< z+%h0C?phn?%s$KvMx3f$%S~NC7UP~lZ1XZTa{!Fp zRG|+dXvVGiiOcXT+|(x~lz@UeBipA)+T$I{#l9SI>NJTk;Tu6~V(u)4|0o=^=tRun zWEoyvmCRq;Gac47-^_{(h&&W?{^hyh7r)c^zKb zoova05W|c(Wbu|!zlt1cQHUpi(9mAowDmM8sH0Q6oWE=;vM=NA*KdsI}t#D}l~m=|`iMi?{^`*kmiG$^+#mS}!D zz7N#DJ@yq>uzpHzuJey~fYPdjdd7NkIR1 z(