Tor handles this command and then starts a child process of “obfs4proxy.exe”, which is the Obfs4 Bridge client. Bridge cert: base64 encoded nodeID, IdPublicKey of an Obfs4 relay.īridge IAT-mode: The IAT mode flag can be set to “0”, “1”, or “2”.Bridge type: obfs4, tells the bridge type.Each bridge configuration line starts with “Bridge=”. Here I only kept the first one for an example. Each bridge node must be saved in one bridge configuration line. The following data includes entire built-in Obfs4 Bridge blocks, which are called bridge configuration lines on the Tor website. “UseBridges=1” tells Tor that the Bridge feature is enabled by the user. “SETCONF” at the beginning of the command is the command name. The command format is like the one below: Tor Browser (“firefox.exe”) sends the command “SETCONF” with built-in Obfs4 Bridge information to “tor.exe” via the control TCP port 9151. The SETCONF Command and Bridge Configuration Line Next, I’ll talk about what techniques Obfs4 Bridge uses to make the traffic harder to be identified. This is a brief explanation of how the Obfs4 Bridge works. A similar thing happens on reverse direction packets.

Unsealing them, the Bridge relay gets the Tor encrypted packets and forwards them to the next Tor relay of the Tor circuit. The sealed packets are then sent to the Obfs4 Bridge relay. The Obfs4 Bridge client takes the Tor-encrypted payload and seals it up with the Obfs4 function. And as a result, the total number of relays of any given Tor circuit is always three for good performance. The Bridge relay is now the entry relay instead of the old Tor entry relay. You can clearly see that once Obfs4 Bridge is enabled, the Tor traffic goes down to the Obfs4 client (obfs4proxy.exe) to be transformed and transported to the bridge relay. Figure 2 shows a new communication path using Obfs4 Bridge.

Tor bridge sees decline server will