Alexey Dolotov
80213ad35d
Add dynamic cert noise calibration for FakeTLS handshake
...
The hardcoded noise range (2500-4700 bytes) in the FakeTLS ServerHello
does not match the real certificate chain sizes of many popular fronting
domains (e.g., dl.google.com ≈ 6480 bytes, microsoft.com ≈ 13004 bytes).
This makes the proxy detectable by DPI systems that compare the
ApplicationData size with the real cert chain size for the SNI domain.
On startup, probe the fronting domain's actual TLS handshake size and
use the measured value ± jitter instead of the static range. Falls back
to the legacy 2500-4700 range if the probe fails.
Also adds optional caching of probe results between restarts
(noise-cache-path, noise-cache-ttl) and a configurable probe count
(noise-probe-count) under [defense.doppelganger].
Closes #408
2026-03-26 23:38:58 +03:00
9seconds
f0ae4ce290
Validate domain fronting availability
2026-03-23 19:22:21 +01:00
9seconds
b6b900e430
Refactoring
2026-03-23 19:12:14 +01:00
9seconds
8154f65e0e
Add validation of telegram connectivity
2026-03-23 18:34:38 +01:00
9seconds
a60523fed0
Add verification of time skewness
2026-03-23 15:28:48 +01:00
9seconds
63b147c287
Add doctor command for deprecated config values
2026-03-23 14:45:10 +01:00
Roman Shishkin
8f0bf47d56
Add Config.GetConcurrency with default fallback
2026-03-21 21:53:38 +03:00
9seconds
21d7522356
Make DRS optional
2026-03-13 11:04:01 +01:00
9seconds
8df1629882
Access command should use native dialer instead of network one
2026-03-13 08:42:15 +01:00
9seconds
a85348d6be
Use curl as user agent
2026-03-12 21:43:04 +01:00
9seconds
94e4179fb7
Add NativeDialer method to mtglib.Network
2026-03-12 19:25:53 +01:00
9seconds
75392941da
Propagate settings to Proxy
2026-03-12 19:07:11 +01:00
9seconds
700417b1d0
Integrate DNS resolver in our codebase
2026-02-27 16:23:24 +01:00
9seconds
1151291535
Use network v2 instead of network v1
2026-02-27 15:52:29 +01:00
9seconds
189dce07c6
Make auto updating optional
2026-02-26 13:35:05 +01:00
9seconds
1cb225f52c
Introduce [domain-fronting] config
2026-02-24 18:05:12 +01:00
9seconds
cde313b359
Add support for domain fronting proxy protocol
2026-02-24 16:44:35 +01:00
9seconds
5b91edf5c4
Fix tests
2026-02-24 13:58:16 +01:00
9seconds
8b34c1b104
Merge remote-tracking branch 'origin/master' into obfuscated2
2026-02-24 13:37:10 +01:00
9seconds
e4a9a96309
Remove mentioning of DC overrides
2026-02-24 13:32:06 +01:00
ivulit
bf38f9f8af
Add domain-fronting-ip option
...
Allow specifying an explicit IP address for the domain fronting host
instead of relying on DNS resolution. Useful when DNS resolution of
the fronting hostname is blocked.
The hostname from the secret is still used for SNI in TLS handshake.
2026-02-20 12:34:17 +03:00
9seconds
cf3437bb63
Add support of proxy protocol
2026-02-19 14:22:00 +01:00
9seconds
0440ccf4ff
Rewrite to WaitGroup.Go
2026-02-18 10:34:31 +01:00
9seconds
36546cec2f
Change default DOH to cloudflarte
2026-02-16 17:18:31 +01:00
9seconds
074c4017f5
Formatting by gofumpt
2026-02-16 17:10:06 +01:00
9seconds
8e87405d3e
Remove integration with gotd
2026-02-16 16:30:10 +01:00
9seconds
308e372a5d
Propagate DcUpdateEach setting
2026-02-16 15:07:56 +01:00
9seconds
836a481026
Propagate DCOverrides
2026-02-16 14:58:41 +01:00
9seconds
ecba88d2e3
Update to the latest golangci-lint
2026-02-11 10:20:04 +01:00
9seconds
7e3e4a611d
Add parameter for a simple run that sets socks5 proxies up
2022-08-09 17:02:49 +03:00
9seconds
36dad5a2f6
Update golangci-lint
2022-08-08 15:54:38 +03:00
9seconds
a27facaa16
More elegant management of ip allowlists
2022-03-21 12:04:31 +03:00
9seconds
e0850869ba
Linting
2022-03-18 14:58:08 +03:00
9seconds
30170b9413
Add iplist_size metric
2022-03-11 16:20:11 +03:00
9seconds
0ce0c668b9
Fix broken whitelists
2022-03-11 10:50:15 +03:00
Sergey Arkhipov and GitHub
3f8f96b91f
Merge pull request #230 from 9seconds/simplify-sockopts
...
Simplify sockopts
2021-12-01 16:03:52 +04:00
9seconds
ffad717829
Use CloseRead and CloseWrites
2021-12-01 10:37:31 +03:00
9seconds
0ddaabb136
Add whitelist support
2021-11-29 17:02:53 +03:00
9seconds
ca77157fd5
Deprecate and ignore simple-run setting for tcp-buffer
2021-11-28 18:15:05 +03:00
9seconds
d19cfb1df4
Deprecate bufferSize
2021-11-28 17:58:14 +03:00
boypt
31b8ab4482
fix TolerateTimeSkewness not being passed
2021-10-30 22:06:51 +08:00
Sergey Arkhipov and GitHub
ce8f1ebb6c
Merge pull request #216 from 9seconds/configure-fallback-dc
...
Add configuration option allow-fallback-on-unknown-dc
2021-10-04 15:09:47 +03:00
9seconds
cd29f3e20b
Add configuration option allow-fallback-on-unknown-dc
2021-10-04 14:42:26 +03:00
9seconds
dbaa743e03
Add new BindJSON method to a logger
2021-10-04 10:10:14 +03:00
9seconds
456ed5b051
Change algorithm of TCP relaying
2021-08-27 17:22:36 +03:00
9seconds
eaa757b6d0
Update code to the latest golangci-lint
2021-07-31 11:35:05 +03:00
9seconds
1050ca0b97
Fix lint issues
2021-07-30 16:34:00 +03:00
9seconds
c85c88efd6
Add simple-run command
2021-07-30 16:15:36 +03:00
9seconds
ed91290e47
Add test for reading config
2021-07-30 15:07:35 +03:00
9seconds
3fd5e9eb19
Rework cli
2021-07-30 15:00:48 +03:00
Alexey Dolotov
9seconds
Roman Shishkin
ivulit
Sergey ArkhipovandGitHub
boypt