Posts

Technical Analysis of the Geedge Networks Firewall Source Code Leak

August 5, 2026 · The authors

Our USENIX Security '26 paper: what we found in the leaked source code of Geedge Networks' censorship firewall, and how we tested for it in the wild.

35th USENIX Security Symposium (USENIX Security '26)

Anna Ablove¹, Johnnie Walker², Ben Wolin¹, Niklas Niere³, Felix Lange³, Aaron Ortwein¹, Armin Huremagic¹, Richa Priyanka¹, Ali Zohaib⁴, Jade Sheffey⁴, Nico Heitmann³, J. Alex Halderman¹, Juraj Somorovsky³, Amir Houmansadr⁴, Roya Ensafi¹, Mingshi Wu², Eric Wustrow⁵

¹ University of Michigan  ·  ² GFW Report  ·  ³ Paderborn University  ·  ⁴ University of Massachusetts Amherst  ·  ⁵ University of Colorado Boulder

Artifact EvaluatedArtifacts Available Open Science

Read the paper (PDF) Artifact & data (Zenodo) Section walkthrough Cite

Abstract

In September 2025, over 100K internal documents (including code, communications, etc.) from Geedge Networks, a Chinese DPI company with ties to the Great Firewall of China, were leaked to the public. In this paper, we analyze the source code from this leak, focusing on Geedge Networks' flagship product, the Tiangou Secure Gateway (TSG) firewall. Working across multiple repositories, we successfully build and run a local copy of TSG—revealing key aspects of its architecture, including the protocols it is capable of parsing and the format of blocking rules used to censor sites, proxies, and other protocols. Finally, we extract several fingerprints from TSG, including custom random number generators and parsing idiosyncrasies that allow us to identify its use and similar deployments in the Great Firewall of China.

This is the first time that the source code of a commercial DPI has been leaked, and our work is the first code analysis of a core firewall component used in national censorship infrastructure. This unprecedented investigation offers insights that can assist circumvention developers and Internet security researchers in further understanding the capabilities and limitations of modern censorship technology.

What we found

• TSG code is running in China's national firewall. We derived fingerprints from the source code first, then measured deployed middleboxes. Two independent fingerprints, at different layers of the stack, each land on a different GFW component:
  • DNS. TSG injects responses with static flags 0x8180, always encodes the answer name using compression pointers, and follows at most 17 pointer jumps when parsing a query. Of the injectors we tested, only China's Injector 2 exhibits all three; Iran and CN Injectors 1 and 3 match none of them.
  • TCP. TSG generates the IPID and window of injected RSTs with a custom PRNG keyed by a configurable seed, defaulting to 13. Solving for that key from observed RSTs returns exactly 13 for both GFW II and GFW III. A stable key arising by chance is on the order of 10⁻⁴⁴—before accounting for it matching TSG's default value.
  Two more results point the same way: GFW II reassembles 102 IP fragments against TSG's 101, and its TLS length-field parsing matches an older version of TSG's SSL module. Together these indicate the leaked code, or a close derivative, is deployed as part of the Great Firewall. The match is not frozen in time: GFW II and III now fix TTL at 255 where TSG varies it, and GFW II matched TSG on that field as recently as December 2023—so the deployed code has drifted from the leaked version.
• The system is built to fingerprint circumvention tools. Signature bundles target Psiphon, Tor, ExpressVPN, NordVPN, Ultrasurf, HideMe, Lantern, LetsVPN and many more, using JA3/JA4 hashes, certificate fields, payload lengths, byte patterns, and IP ranges—most ranked at the highest risk level.
• Blocking is customer-driven and iterative. Jira and Confluence records show deployment sites in Myanmar (440 tickets), Ethiopia (53), Kazakhstan and Pakistan reporting failed blocks, setting priorities, and flagging collateral damage from over-blocking.
• Two of three detection engines are third-party code. Glimpse is built on libprotoident (Libtrace, University of Waikato) with an nDPI-derived OpenVPN detector; QDPI wraps Qosmos ixEngine. Comprehensive protocol classification is evidently expensive to build even for a well-resourced, state-linked vendor.

The paper, section by section

These pages carry the technical content of the paper for readers who want the findings without the PDF.

• §3 · Part 1 of 4

  TSG Architecture

  SAPP packet ingress, protocol plugins, Stellar sessions, the Maat rule engine, and the firewall plugin that enforces policy.

• §4 · Part 2 of 4

  Application Detection & Circumvention Tool Targeting

  The Context-Based Detector, TSG's VPN signature formats and fingerprints, the third-party engines behind Glimpse and QDPI, and the customer-driven ticket workflow.

• §5 · Part 3 of 4

  Reconstructing TSG in Practice

  Locating the build repositories and RPMs, defeating a license check, wiring up a Docker testbed, and the configuration knobs that shape TSG's behavior.

• §6 · Part 4 of 4

  Remote Fingerprints & Deployments

  Five independent fingerprints derived from the source and tested against middleboxes in China, Kazakhstan, Myanmar, Pakistan, and Iran.

What was in the leak

The company was founded in 2018 by Fang Binxing, colloquially known as the "Father of the GFW" for his foundational role in designing the Great Firewall. Geedge also maintains a close collaborative relationship with the Massive and Effective Stream Analysis (MESA) Lab at the Chinese Academy of Sciences, whose academic research on traffic analysis directly informs product development.

Category	Artifact	Size	Key contents
Source code	mirror/repo.tar	463.0 GiB	RPM bundles: Firewall, libcbd, QDPI and Glimpse detectors
Source code	mesalab_git.tar.zst	59.4 GiB	Git repos: SAPP, Protocol Plugins, Stellar-on-SAPP, Stellar, Maat, tsg-os-buildimage
Confluence	2 archives	46.4 GiB	VPN signature logs, Psiphon collateral-damage analysis
Jira	geedge_jira.tar.zst	2.5 GiB	Deployment tickets (Myanmar, Ethiopia), bug fixes
Other	14 files + filelist	10.7 MiB	—

Composition of the 572 GiB Geedge Networks data leak. Note: SAPP and the protocol plugins are additionally packaged in RPM bundles in repo.tar.

Civil society investigations have highlighted evidence of deployments of Geedge Networks' products across multiple countries, including Kazakhstan (code-named K18/K24), Ethiopia (E21), Pakistan (P19), and Myanmar (M22), and describe the company's role as extending beyond software provision to encompass system integration, operator training, and ongoing technical support. See Resources for that reporting.

Artifact and data

Our result files, anonymized PCAPs, scanning scripts, and measurement tools are archived on Zenodo. This includes the TLS length-field scanner and results, QUIC version probes, IP fragmentation reassembly PCAPs, DNS injection behavior data, and the TCP RST injection fingerprinting tool. See Resources for the full contents.

Cite this work

Please cite the USENIX Security '26 version. A copy of the camera-ready paper is available here.

@inproceedings{ablove2026geedge,
  title     = {Technical Analysis of the Geedge Networks Firewall Source Code Leak},
  author    = {Ablove, Anna and Walker, Johnnie and Wolin, Ben and Niere, Niklas and
               Lange, Felix and Ortwein, Aaron and Huremagic, Armin and Priyanka, Richa and
               Zohaib, Ali and Sheffey, Jade and Heitmann, Nico and Halderman, J. Alex and
               Somorovsky, Juraj and Houmansadr, Amir and Ensafi, Roya and Wu, Mingshi and
               Wustrow, Eric},
  booktitle = {35th USENIX Security Symposium (USENIX Security 26)},
  year      = {2026},
  publisher = {USENIX Association}
}