-
Notifications
You must be signed in to change notification settings - Fork 1
/
splittls.go
128 lines (102 loc) · 2.85 KB
/
splittls.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
// Package splittls implements the --tls-split-hello logic and allows splitting
// TLS ClientHello.
package splittls
import (
"net"
"time"
"github.com/ameshkov/gocurl/internal/client/dialer"
"github.com/ameshkov/gocurl/internal/output"
)
// CreateDialFunc creates a dialFunc that splits the TLS ClientHello in two
// parts.
func CreateDialFunc(
firstChunkSize int,
delay int,
baseDial dialer.DialFunc,
out *output.Output,
) (f dialer.DialFunc) {
out.Debug(
"Splitting TLS ClientHello is enabled. First chunk size is %d, delay is %d",
firstChunkSize,
delay,
)
return func(network, addr string) (conn net.Conn, err error) {
conn, err = baseDial(network, addr)
if err != nil {
return nil, err
}
return &splitTLSConn{
Conn: conn,
baseConn: conn,
firstChunkSize: firstChunkSize,
delay: delay,
out: out,
}, nil
}
}
// splitTLSConn is the implementation of net.Conn which only purpose is wait for
// the ClientHello packet and split it in two parts when it is written.
type splitTLSConn struct {
net.Conn
// baseConn is the underlying TCP connection.
baseConn net.Conn
// firstChunkSize is the size of the first chunk of ClientHello.
firstChunkSize int
// delay is time to wait in milliseconds before sending the second part.
delay int
// out is required for debug-level logging.
out *output.Output
// writeCnt is the number of Write calls.
writeCnt int
// splitDone is set to true when we encounter the first TLS packet and
// split it OR if there were more than 5 packets send through the
// connection. Why 2? We assume that the first packet can be proxy
// authorization and the second must be ClientHello in this case.
splitDone bool
}
// type check
var _ net.Conn = (*splitTLSConn)(nil)
// isClientHello checks if the packet is ClientHello.
func (c *splitTLSConn) isClientHello(b []byte) (ok bool) {
if c.writeCnt > 5 || c.splitDone || len(b) < 6 {
return false
}
// Check if the record type is handshake (0x16)
if b[0] != 0x16 {
return false
}
// Check for TLS version
if b[1] != 0x03 {
return false
}
// Check if the message type is ClientHello (0x01)
if b[5] != 0x01 {
return false
}
return true
}
// Write implements net.Conn for *splitTLSConn. Its purpose is to wait until
// the first TLS packet (ClientHello) and then apply the split logic.
func (c *splitTLSConn) Write(b []byte) (n int, err error) {
c.writeCnt++
if c.isClientHello(b) {
c.out.Debug("Found ClientHello, splitting it into parts")
chunks := [][]byte{
b[:c.firstChunkSize],
b[c.firstChunkSize:],
}
for i, chunk := range chunks {
var l int
l, err = c.baseConn.Write(chunk)
if err != nil {
return n, err
}
n = n + l
if c.delay > 0 && i < len(chunks)-1 {
time.Sleep(time.Duration(c.delay) * time.Millisecond)
}
}
return n, err
}
return c.baseConn.Write(b)
}