USENIX Security '26 - Technical Analysis of the Geedge Networks Firewall Source Code Leak
Anna Ablove, University of Michigan; Johnnie Walker, GFW Report; Ben Wolin, University of Michigan; Niklas Niere and Felix Lange, Paderborn University; Aaron Ortwein, Armin Huremagic, and Richa Priyanka, University of Michigan; Ali Zohaib and Jade Sheffey, University of Massachusetts Amherst; Nico Heitmann, Paderborn University; J. Alex Halderman, University of Michigan; Juraj Somorovsky, Paderborn University; Amir Houmansadr, University of Massachusetts Amherst; Roya Ensafi, University of Michigan; Mingshi Wu, GFW Report; Eric Wustrow, University of Colorado Boulder
In September 2025, over 100K internal documents (including code, communications, etc.) from Geedge Networks, a Chinese DPI company with ties to the Great Firewall of China, were leaked to the public. In this paper, we analyze the source code from this leak, focusing on Geedge Networks' flagship product, the Tiangou Secure Gateway (TSG) firewall. Working across multiple repositories, we successfully build and run a local copy of TSG---revealing key aspects of its architecture, including the protocols it is capable of parsing and the format of blocking rules used to censor sites, proxies, and other resources. Finally, we extract several fingerprints from TSG, including custom random number generators and parsing idiosyncrasies that allow us to identify its use and similar deployments in the Great Firewall of China.
This is the first time that the source code of a commercial DPI has been leaked, and our work is the first code analysis of a core firewall component used in national censorship infrastructure. This unprecedented investigation offers insights that can assist circumvention developers and Internet security researchers in further understanding the capabilities and limitations of modern censorship technology.
View the full USENIX Security '26 program at https://www.usenix.org/conference/usenixsecurity26/technical-sessions
Anna Ablove, University of Michigan; Johnnie Walker, GFW Report; Ben Wolin, University of Michigan; Niklas Niere and Felix Lange, Paderborn University; Aaron Ortwein, Armin Huremagic, and Richa Priyanka, University of Michigan; Ali Zohaib and Jade Sheffey, University of Massachusetts Amherst; Nico Heitmann, Paderborn University; J. Alex Halderman, University of Michigan; Juraj Somorovsky, Paderborn University; Amir Houmansadr, University of Massachusetts Amherst; Roya Ensafi, University of Michigan; Mingshi Wu, GFW Report; Eric Wustrow, University of Colorado Boulder
In September 2025, over 100K internal documents (including code, communications, etc.) from Geedge Networks, a Chinese DPI company with ties to the Great Firewall of China, were leaked to the public. In this paper, we analyze the source code from this leak, focusing on Geedge Networks' flagship product, the Tiangou Secure Gateway (TSG) firewall. Working across multiple repositories, we successfully build and run a local copy of TSG---revealing key aspects of its architecture, including the protocols it is capable of parsing and the format of blocking rules used to censor sites, proxies, and other resources. Finally, we extract several fingerprints from TSG, including custom random number generators and parsing idiosyncrasies that allow us to identify its use and similar deployments in the Great Firewall of China.
This is the first time that the source code of a commercial DPI has been leaked, and our work is the first code analysis of a core firewall component used in national censorship infrastructure. This unprecedented investigation offers insights that can assist circumvention developers and Internet security researchers in further understanding the capabilities and limitations of modern censorship technology.
View the full USENIX Security '26 program at https://www.usenix.org/conference/usenixsecurity26/technical-sessions