An internal MESA Lab research note directly measures and compares China's ('CN') HTTP censorship middlebox against Russia, India and an unlabeled 'HZ' system, plus open-source Snort2/Snort3/Suricata: China is characterized as inspecting Host- and keyword-based triggers (example trigger given: a request containing the parameter 'q=ultrasurf') across ALL ports rather than just 80/443, responding with a triple RST or an extra RST+ACK; an 8-technique HTTP-request-mangling evasion comparison table credits China's middlebox as vulnerable only to request-line whitespace insertion and HTTP-version tampering, fewer categories than the other three systems tested.
CN：存在基于Host的审查以及基于Keyword的审查机制，对所有端口都进行监控，而不只是HTTP默认端口（80，443）。针对审查内容返回3*RST数据包进行阻塞，或者额外返回<RST,ACK>数据包...使用包含参数为“q=ultrasurf”请求触发。
Defense implications
- Per this document's own comparison table, China's GFW HTTP middlebox (as tested by MESA's own researchers) was NOT credited as vulnerable to Host-header duplication, multi-byte-character insertion, method tampering, long-request fragmentation, or case-randomization — evasions that did work against Russia/India/the unlabeled 'HZ' system and some open-source IDS. Treat those specific tricks as likely already hardened against in China even where useful elsewhere.
- The two evasions credited against China here (request-line whitespace insertion, HTTP-version tampering) are low-level HTTP-parser mismatches worth independently re-validating, since this is one internal team's dated point-in-time measurement, not a standing guarantee.
Related findings
An internal TSG operations/troubleshooting manual lays out TSG's full traffic pipeline (NIC -> mrzcpd/marsio capture driver -> sapp DPI engine -> firewall/proxy(KNI->TFE)/active-defense/WAN-NAT policy branches) and shows engineers using maat_redis_tool to pull the live Redis-synced blocking policy tables (TSG_SECURITY_COMPILE, TSG_OBJ_IP_ADDR, TSG_OBJ_APP_ID) and filter them by numeric policy/object ID to debug why a block rule isn't firing.
A live tsg_master engine config file exposes a [RESET] section with concrete TCP-RST-injection parameters (NUM=1, SEED1=65535, SEED2=13, FLAGS=20, DIR=3, REMEDY=0), a [TRAFFIC_MIRROR] section confirming mirror-tap deployment (NIC_NAME="eth_vf_mirr"), a [MAAT] section wiring tsg_master directly to MAAT's subscriber-ID tables (TSG_OBJ_SUBSCRIBER_ID/TSG_DYN_SUBSCRIBER_IP), and a device tag "BeiJing-XXG" confirming this specific instance is a domestic Beijing deployment. A plaintext Kafka SASL credential (SASL_PASSWD="galaxy2019") is also exposed, and "galaxy" recurs as an internal project codename elsewhere in this batch (docker service path /home/galaxy, APP_BRIDGE_NAME).
The AppSketch/MAAT signature system contains a systematically dated, patch-versioned catalog of FQDN-based detection signatures for dozens of individually named commercial VPN apps (e.g. V2VPN, V2Netvpn, Turbo VPN, LetsVPN, AdGuard VPN, Avira Phantom VPN, TouchVPN, FinchVPN, Opera VPN, Ultrasurf VPN, GoFly VPN), each modeled as an 'app' object in category 'networking' / subcategory 'tunnels' whose default deny_action drops the flow while sending both an ICMP-unreachable and a TCP RST to the client. At least 35 such distinct VPN-app signature objects appear in this batch alone, dated July-November 2024, with repeated 'Patch0N' revisions to the same app as its domains rotate.
An IIE/CAS graduate mid-term thesis builds a simulated-annealing-enhanced genetic-algorithm tool that auto-generates Geneva-style TCP/IP and HTTP-field evasion strategies and measures them against live censorship middleware in Russia and China: raw TCP/IP-layer evasion succeeds only 0.14% of the time end-to-end (most real web servers reject the malformed packets), HTTP-field mutation (Host/Version/Path) succeeds 5.2% of the time, China implements both Host- and stricter Keyword-based middleware blocking versus Russia's Host-only blocking, and Russia's middleware proved roughly 6x more vulnerable to the generated evasion set than China's; the next thesis phase builds an ML classifier trained on HTTP Host/Version/ Method/Path fields specifically to detect this evasion traffic class.
A MESA lab measurement of national censorship middleware (China, Russia, an unnamed "HZ" censor, and India) finds China's GFW performs both Host-header-based and keyword-based filtering across ALL ports, not just HTTP/HTTPS 80/443, and blocks matching connections with 3x injected RST packets or an additional RST,ACK -- a broader and more aggressive posture than the other three censors measured, none of which monitor all ports.
MESA Lab's own incident analysis of a TCP reflection-amplification abuse wave against the GFW shows the underlying keyword-filtering and RST-injection trigger mechanism from a live production log: a spoofed SYN followed by a PSH+ACK packet whose HTTP GET Host header contains one of three forbidden domains (youporn.com, bittorrent.com, freedomhouse.org) causes the GFW to send three RST,ACK packets each to the spoofed source and real destination IPs. A companion internal reading-group presentation (advisor name redacted) separately reviews the USENIX 2021 "Weaponizing Middleboxes for TCP Reflected Amplification" paper, which documents this exact class of attack abusing censorship middleboxes as DDoS reflectors.