Alexey Dolotov 80213ad35d Add dynamic cert noise calibration for FakeTLS handshake ...

The hardcoded noise range (2500-4700 bytes) in the FakeTLS ServerHello
does not match the real certificate chain sizes of many popular fronting
domains (e.g., dl.google.com ≈ 6480 bytes, microsoft.com ≈ 13004 bytes).
This makes the proxy detectable by DPI systems that compare the
ApplicationData size with the real cert chain size for the SNI domain.

On startup, probe the fronting domain's actual TLS handshake size and
use the measured value ± jitter instead of the static range. Falls back
to the legacy 2500-4700 range if the probe fails.

Also adds optional caching of probe results between restarts
(noise-cache-path, noise-cache-ttl) and a configurable probe count
(noise-probe-count) under [defense.doppelganger].

Closes #408

2026-03-26 23:38:58 +03:00

..

access.go

Refactoring

2026-03-23 19:12:14 +01:00

cli.go

Add doctor command for deprecated config values

2026-03-23 14:45:10 +01:00

doctor.go

Validate domain fronting availability

2026-03-23 19:22:21 +01:00

generate_secret.go

Update golangci-lint

2022-08-08 15:54:38 +03:00

run_proxy.go

Add dynamic cert noise calibration for FakeTLS handshake

2026-03-26 23:38:58 +03:00

run.go

Update golangci-lint

2022-08-08 15:54:38 +03:00

simple_run.go

Fix tests

2026-02-24 13:58:16 +01:00

utils.go

Refactoring

2026-03-23 19:12:14 +01:00