gfw_resist_tls_proxy

internet for everyone or no one

سلام گرم به همه دوستانی که برای حق اولیه و ابتدایی شهروندی ، برای دسترسی به اینترنت ، تلاش میکنند
سلام به هیدیفای،باشسیز،سگارو،آی آر سی اف ، پروژه امید، یوتیوبرها و همه عزیزان دوست داشتنی
روش این پیج یک زخم عمیق بر پیکر GFW می گذارد که تا سالها سوزش آن در ماتحت فیلترچیان دنیا باقی خواهد ماند

main Idea:

in TLS protocol (even latest v1.3) SNI transfered in plain-text
GFW find it and when SNI is not in whitelist reply with TCP-RST
so it filter cloudflare ip based on SNI such that some popular sites
like plos.org be open and all others closed through that ip
so we need to hide SNI from GFW
we fragment TLS client Hello packet into chunks in a simple manner
we show that it pass the firewall
more importantly we show that GFW cant fix it because its nearly impossible
to cache TBs of data in high speed router so they MUST give up or break the whole network

about SNI , ESNI & ECH (skip if you want)

leaking domain name (SNI) is the old famous bug of tls protocol which is not fixed yet as of 2023
some attempt started few years ago is try to encrypt sni called ESNI which is deprecated today
cloudflare stop supporting esni in summer 2022
another way is Encrypted Client Hello (ECH) which is in draft version and well-documented
i make much effort to use ECH but its too complex and still is in development
also its based on DNS-over-HTTPS which is already filtered by GFW

about GFW SNI filtering on cloudflare IPs (skip if you want)

cloudflare IPs are high traffic and 30% of web is behind them
so GFW cant simply block them by traffic volume
and all traffic is encrypted except client hello which leak server name (SNI)


so GFW extract sni from client hello and when SNI is in white list it pass



otherwise it send TCP-RST to terminate tcp socket

about packet fragment (skip if you want)

we hide sni by fragmenting client hello packet into several chunk.
but GFW already know this and try to assemble those chunk to find SNI! LOL but we add time delay between fragment. LOL since cloudflare IPs have too much traffic , GFW cant wait too long. LOL GFW high-speed cache is limited so it cant cache TBs of data looking for a tiny tcp fragment. LOL so it forget those fragments after a second. LOL its impossible to looking in huge traffic for a packet didnt know when or where it arrive. LOL so it Give up.

required for test

python 3
wireshark or microsoft network monitor