Trojan-Oxide
A Rust implementation of Trojan with QUIC tunnel, Lite-TLS and more.
Overview
- Full support for the original Trojan Protocol, including TCP and UDP traffic.
- Pure Rust implementation with no comprimise on security and speed.
- Highly efficient Tokio-based async network io.
- Minimized memory consumption.
- Predictable performance with no runtime garbage collector.
- Poll based UDP Traffic.
- QUIC tunnel. The stealth Trojan implementation is still undetectable in the HTTP/3 era.
- Lite-TLS. Avoid redundant encrpytion with TLS traffics without modifying the underlying TLS library. We do things in the Trojan way, i.e., we imitate rather than create.
- Zero-Copy (Linux Kernel >= 5.8 is required). With Lite-TLS enabled, we can achieve maximum efficiency on both the client and server sides. Up to 60% improvement is observed in a TCP echo server based on io-uring.
License
Examples
Install Rust
Please follow the instructions.
Build Trojan-Oxide From Source
git clone https://github.com/3andne/trojan-oxide.git && cd ./trojan-oxide
cargo build --release
The executable binary file is ./target/release/trojan-oxide.
Build Selected Features
You can select features according to your needs; the default configuration builds both the server and client.
Server Only
cargo build --release --features server_full
Client Only
cargo build --release --features client_full
Zero Copy Feature
This feature is disabled by default since it only works on Linux with a kernel >= 5.8. The following command will build this feature.
cargo build --release --features client_full,zio
cargo build --release --features server_full,zio
Run Server
Suppose you have a server your.website.com.
-
Your TLS certificate is in "/path/to/cert/fullchain.cert".
-
Your TLS private key is in "/path/to/key/private.key".
-
You want the server to listen on port
443, and re-direct unauthenticated traffics to80. -
You set password to
your_password. If your password contains '$', please write it as '\$'.
Then you should start the server by:
./target/release/trojan-oxide -s -w "your_password" -k "/path/to/key/private.key" -c "/path/to/cert/fullchain.cert" -u "your.website.com" -x 443 -f 80
Note that rustls (the underlying tls library) doesn't support ECC keys as of this moment. Please Follow the instructions if you have a pair of ECC keys.
Run Client
If you have a tcp-tls trojan service on your.website.com:443 with the password your_password. You can start your client by:
./target/release/trojan-oxide -w "your_password" -u you.website.com -x 443 -m t
-
the default tunnel is TCP-TLS
- use
-m qif you want to use the QUIC tunnel - use
-m lif you want to use the Lite-TLS tunnel
- use
-
you can also specify your server ip by:
./target/release/trojan-oxide -w "your_password" -u you.website.com -d 114.51.4.191 -x 443 -m t -
The default http and socks5 port is
8888and8889respectively. Please specify them by-hand-5.
Run Zero Copy Endpoints
Note that this feature only works when Linux kernel >= 5.8. Please build the client/server with zio feature first.
Then start the client in Lite-TLS mode.
./target/release/trojan-oxide -w "your_password" -u you.website.com -d 114.51.4.191 -x 443 -m l
You don't need to configure the server.
Manual
./target/release/trojan-oxide --help
USAGE:
trojan-oxide [FLAGS] [OPTIONS] --password <password> [remote-socket-addr]
FLAGS:
--help
Prints help information
-s, --server
whether to start as server
-V, --version
Prints version information
OPTIONS:
--ca <ca>
-c, --cert <cert>
TLS certificate in PEM format
-m, --connection-mode <connection-mode>
Connetion Mode:
- t (for tcp-tls)
- q (for quic)
- l (for lite-tls) [default: t]
-f, --fallback-port <fallback-port>
port to re-direct unauthenticated connections [default: 0]
-k, --key <key>
TLS private key in PEM format
-h, --http_port <local-http-addr>
client http proxy port [default: 8888]
-5, --socks5_port <local-socks5-addr>
client socks5 proxy port [default: 8889]
-l, --log-level <log-level>
Log level (from least to most verbose):
error < warn < info < debug < trace [default: info]
-w, --password <password>
the password to authenticate connections
-u, --server-hostname <server-hostname>
Server Name Indication (sni), or Hostname [default: localhost]
-d, --server-ip <server-ip>
server ip address [default: ]
-x, --server-port <server-port>
server proxy port [default: 443]
10 Nov 3, 2022
611 Dec 25, 2022
![[ZenGo X]](https://avatars.githubusercontent.com/u/40664522?v=4&s=60)
62 Dec 13, 2022
155 Nov 21, 2022
168 Oct 21, 2022
166 Dec 29, 2022
3 Sep 6, 2024
49 Dec 9, 2022
72 Sep 23, 2022
123 Dec 27, 2022
7 Dec 24, 2022
4k Jan 9, 2023
1.5k Dec 23, 2022
4k Jan 9, 2023
2 Aug 22, 2022
8 Aug 23, 2023
3 Dec 15, 2022
296 Dec 31, 2022
1.5k Jan 8, 2023