Rejected announces from libtorrent clients proxying through SOCKS (opens in new tab)

(catgirl.online)

83 pointsapsec1127mo ago31 comments

31 comments

Stuff like this is why I usually go for network namespaces + (wireguard / socks / iptables) when I need to isolate traffic.

> The tracker in question that I wanted to get this working for explicitly forbids running development builds of approved BitTorrent clients.

Also didn't realize trackers were that strict about clients. I've seen some ban buggy versions / sketchy clients (usually cloud-based or for mobile), but that's usually a for-your-own-good type thing. Major names like QBT are usually fine regardless of version.

tonytamps7mo ago

The private torrent site crowd are very restrictive on which clients are allowed and even big names like qBit aren't safe enough to assume the version is allowed.

xdfgh11127mo ago

Although the identification is literally just a string you send when connecting, easy to spoof.

papyrus92447mo ago

I've never looked at the source code of a PT, but my understanding is that they also implement heuristics to detect strange behaviors, i.e. clients trying to fake their ratio.

1 more reply

dns_snek7mo ago

That part is just for your own protection - these are almost always private trackers with ratio requirements.

If you spoof the client name and your client ends up misbehaving/misreporting you'll just get banned for cheating.

kkzz997mo ago

I remember using a ratio-fake tool that would basically proxy your reporting to the tracker with the signature of the client you were actually using. It was awesome.

ardanur7mo ago

You can turn a socks5 into an interface and then move it to a different namespace: https://github.com/xjasonlyu/tun2socks

diftr7mo ago

All that and he didn't even test it with the tracker in the end? What an anticlimax.

Mathnerd3147mo ago

Sounds like a very restrictive tracker... but I guess the more restrictive, the more likely it has good stuff. Seems kind of strange though because most trackers I have seen just completely ban any sort of proxy or VPN.

seg_lol7mo ago

Is it because of some game theoretic information exposure? Or is this more about that you can't trust any of the VPN providers.

orliesaurus7mo ago

why ban VPN? what about seedboxes?

dns_snek7mo ago

They usually ban VPNs for website use but allow them for seedboxes (sometimes requiring approval). The rationale is to stop account sharing and ban evasion.

jamesnorden7mo ago

I don't know but it's pretty suspicious to ban VPNs to use something that is illegal in many countries. Hope they don't keep records that can be leaked.

charcircuit7mo ago

>why ban VPN?

It's harder to ban people if you allow using VPNs.

xdfgh11127mo ago

Private trackers have no open registration. If they ban you at the account level then it's pretty hard to get back in.

1 more reply

dahrkael7mo ago

i was expecting a more hands on explanation of what the client sends and what the tracker responds but this post is quite abstract for a technical issue. from what i read in the PR the qBT fix is to just ignore the proxy on the listening side of things but that doesnt explain the issue

neko_lover7mo ago

i thought about including packet captures and some analysis on that, but ran out of steam. you're right that it would have made a more interesting post. maybe ill amend it at some point :)

there were other peculiarities i noticed in testing, like udp trackers not working through the socks proxy even after fixing the listening port problem. id like to revisit the topic at some point to see if that can be fixed as well.

JoshGlazebrook7mo ago

Technically you could theoretically accept incoming connections if the SOCKS5 server supports the BIND command and the client knows how to use it. It's rare though.

ronsor7mo ago

I've genuinely never seen a server that supports the BIND command.

immibis7mo ago

Since you're already using a proxy, you can have the proxy change the parameters, and then you are not modifying the client.

neko_lover7mo ago

id be interested to know how i might get started with implementing something like that

immibis7mo ago

By writing your own proxy, and also making sure the URL doesn't say https (you can change it back to https in the proxy you write)

eptcyka7mo ago

The headline, whilst true to the author, makes no sense. Announces is a verb, announcements is a noun.

debugnik7mo ago

A quick search shows me that "annouce" is sometimes used as a noun in the context of bittorrent for some reason.

papyrus92447mo ago

Because it's a type of message, just like "GET" in the context of HTTP.

j / k navigate · click thread line to collapse

31 comments

Frotag7mo ago

Stuff like this is why I usually go for network namespaces + (wireguard / socks / iptables) when I need to isolate traffic.

> The tracker in question that I wanted to get this working for explicitly forbids running development builds of approved BitTorrent clients.

tonytamps7mo ago

The private torrent site crowd are very restrictive on which clients are allowed and even big names like qBit aren't safe enough to assume the version is allowed.

xdfgh11127mo ago

Although the identification is literally just a string you send when connecting, easy to spoof.

papyrus92447mo ago

I've never looked at the source code of a PT, but my understanding is that they also implement heuristics to detect strange behaviors, i.e. clients trying to fake their ratio.

1 more reply

dns_snek7mo ago

That part is just for your own protection - these are almost always private trackers with ratio requirements.

If you spoof the client name and your client ends up misbehaving/misreporting you'll just get banned for cheating.

kkzz997mo ago

I remember using a ratio-fake tool that would basically proxy your reporting to the tracker with the signature of the client you were actually using. It was awesome.

ardanur7mo ago

You can turn a socks5 into an interface and then move it to a different namespace: https://github.com/xjasonlyu/tun2socks

diftr7mo ago

All that and he didn't even test it with the tracker in the end? What an anticlimax.

Mathnerd3147mo ago

seg_lol7mo ago

Is it because of some game theoretic information exposure? Or is this more about that you can't trust any of the VPN providers.

orliesaurus7mo ago

why ban VPN? what about seedboxes?

dns_snek7mo ago

They usually ban VPNs for website use but allow them for seedboxes (sometimes requiring approval). The rationale is to stop account sharing and ban evasion.

jamesnorden7mo ago

I don't know but it's pretty suspicious to ban VPNs to use something that is illegal in many countries. Hope they don't keep records that can be leaked.

charcircuit7mo ago

>why ban VPN?

It's harder to ban people if you allow using VPNs.

xdfgh11127mo ago

Private trackers have no open registration. If they ban you at the account level then it's pretty hard to get back in.

1 more reply

dahrkael7mo ago

neko_lover7mo ago

i thought about including packet captures and some analysis on that, but ran out of steam. you're right that it would have made a more interesting post. maybe ill amend it at some point :)

JoshGlazebrook7mo ago

Technically you could theoretically accept incoming connections if the SOCKS5 server supports the BIND command and the client knows how to use it. It's rare though.

ronsor7mo ago

I've genuinely never seen a server that supports the BIND command.

immibis7mo ago

Since you're already using a proxy, you can have the proxy change the parameters, and then you are not modifying the client.

neko_lover7mo ago

id be interested to know how i might get started with implementing something like that

immibis7mo ago

By writing your own proxy, and also making sure the URL doesn't say https (you can change it back to https in the proxy you write)

eptcyka7mo ago

The headline, whilst true to the author, makes no sense. Announces is a verb, announcements is a noun.

debugnik7mo ago

A quick search shows me that "annouce" is sometimes used as a noun in the context of bittorrent for some reason.

papyrus92447mo ago

Because it's a type of message, just like "GET" in the context of HTTP.

j / k navigate · click thread line to collapse