Technical Analysis of the Geedge Networks Firewall Source Code Leak
· The authors
Our USENIX Security '26 paper: what we found in the leaked source code of Geedge Networks' censorship firewall, and how we tested for it in the wild.
35th USENIX Security Symposium (USENIX Security '26)
1 University of Michigan · 2 GFW Report · 3 Paderborn University · 4 University of Massachusetts Amherst · 5 University of Colorado Boulder
Abstract
In September 2025, over 100K internal documents (including code, communications, etc.) from Geedge Networks, a Chinese DPI company with ties to the Great Firewall of China, were leaked to the public. In this paper, we analyze the source code from this leak, focusing on Geedge Networks' flagship product, the Tiangou Secure Gateway (TSG) firewall. Working across multiple repositories, we successfully build and run a local copy of TSG—revealing key aspects of its architecture, including the protocols it is capable of parsing and the format of blocking rules used to censor sites, proxies, and other protocols. Finally, we extract several fingerprints from TSG, including custom random number generators and parsing idiosyncrasies that allow us to identify its use and similar deployments in the Great Firewall of China.
This is the first time that the source code of a commercial DPI has been leaked, and our work is the first code-level analysis of a core firewall component used in national censorship infrastructure. This unprecedented investigation offers insights that can assist circumvention developers and Internet security researchers in further understanding the capabilities and limitations of modern censorship technology.
What we found
TSG code is running in China's national firewall.
We derived fingerprints from the source code first, then measured deployed middleboxes. Two independent fingerprints, at different layers of the stack, each land on a different GFW component:
-
DNS. TSG injects responses with static flags
0x8180, always encodes the answer name using compression pointers, and follows at most 17 pointer jumps when parsing a query. Of the injectors we tested, only China's Injector 2 exhibits all three; Iran and CN Injectors 1 and 3 match none of them. -
TCP. TSG generates the IPID and window of injected RSTs with a custom
PRNG keyed by a configurable seed, defaulting to
13. Solving for that key from observed RSTs returns exactly 13 for both GFW II and GFW III. A stable key arising by chance is on the order of 10−44—before accounting for it matching TSG's default value.
Two more results point the same way: GFW II reassembles 102 IP fragments against TSG's 101, and its TLS length-field parsing matches an older version of TSG's SSL module. Together these indicate the leaked code, or a close derivative, is deployed as part of the Great Firewall. The match is not frozen in time: GFW II and III now fix TTL at 255 where TSG varies it, and GFW II matched TSG on that field as recently as December 2023—so the deployed code has drifted from the leaked version.
What was in the leak
The company was founded in 2018 and maintains a close collaborative relationship with the Massive and Effective Stream Analysis (MESA) Lab at the Chinese Academy of Sciences, whose academic research on traffic analysis directly informs product development.
| Category | Artifact | Size | Key contents |
|---|---|---|---|
| Source code | mirror/repo.tar | 463.0 GiB | RPM bundles: Firewall, libcbd, QDPI and Glimpse detectors |
| Source code | mesalab_git.tar.zst | 59.4 GiB | Git repos: SAPP, Protocol Plugins, Stellar-on-SAPP, Stellar, Maat, tsg-os-buildimage |
| Confluence | 2 archives | 46.4 GiB | VPN signature logs, Psiphon collateral-damage analysis |
| Jira | geedge_jira.tar.zst | 2.5 GiB | Deployment tickets (Myanmar, Ethiopia), bug fixes |
| Other | 14 files + filelist | 10.7 MiB | — |
Composition of the 572 GiB Geedge Networks data leak. Note: SAPP and the protocol plugins are additionally packaged in RPM bundles in repo.tar.
Artifact and data
Our result files, anonymized PCAPs, scanning scripts, and measurement tools are archived on Zenodo. This includes the TLS length-field scanner and results, QUIC version probes, IP fragmentation reassembly PCAPs, DNS injection behavior data, and the TCP RST injection fingerprinting tool. See Resources for the full contents.
Cite this work
Please cite the USENIX Security '26 version. A copy of the camera-ready paper is available here.
@inproceedings{ablove2026geedge,
title = {Technical Analysis of the Geedge Networks Firewall Source Code Leak},
author = {Ablove, Anna and Walker, Johnnie and Wolin, Ben and Niere, Niklas and
Lange, Felix and Ortwein, Aaron and Huremagic, Armin and Priyanka, Richa and
Zohaib, Ali and Sheffey, Jade and Heitmann, Nico and Halderman, J. Alex and
Somorovsky, Juraj and Houmansadr, Amir and Ensafi, Roya and Wu, Mingshi and
Wustrow, Eric},
booktitle = {35th USENIX Security Symposium (USENIX Security 26)},
year = {2026},
publisher = {USENIX Association}
}