Documentation
¶
Overview ¶
Package injector constructs fake TLS ClientHello packets for SNI-spoofing DPI bypass. This is a Go port of the upstream Python ClientHelloMaker (patterniha/SNI-Spoofing), producing byte-identical output so golden tests can verify parity.
Index ¶
Constants ¶
const ( // RandLen is the size of the TLS client_random field. RandLen = 32 // SessionIDLen is the fixed session_id length the template uses. SessionIDLen = 32 KeyShareLen = 32 // OutputLen is the total fake ClientHello size. Constant across all SNIs // because the padding extension absorbs the difference. OutputLen = 517 )
Variables ¶
var ErrInvalidInput = errors.New("snix/injector: invalid input size")
ErrInvalidInput is returned when random/session/key_share sizes are wrong, or SNI exceeds the padding budget.
Functions ¶
func BuildClientHello ¶
BuildClientHello constructs a 517-byte fake TLS 1.3 ClientHello with the given SNI and randomized handshake fields. Output is byte-identical to the upstream Python implementation for equal inputs.
rnd, sessID, keyShare MUST each be 32 bytes; sni MUST be <= 219 bytes. The result is newly allocated and safe to modify.
func BuildClientHelloPadded ¶
BuildClientHelloPadded returns a ClientHello whose total size is OutputLen + extraPad bytes, where extraPad ∈ [0, 65000]. The extension is byte-identical to BuildClientHello when extraPad == 0.
Extra bytes are appended to the padding extension. The record and handshake length fields are recomputed so the resulting packet remains a valid TLS record; any TLS parser (including the DPI) will see a well- formed ClientHello carrying the same SNI, key_share, and cipher suites as the fixed-size variant.
Breaking the fixed-517-byte signature is a key anti-fingerprinting win: a DPI that looked for "exact length 517 during handshake-ACK window" cannot match a variable-length stream.
Types ¶
This section is empty.
Source Files