Documentation
¶
Overview ¶
Package reflex implements the Reflex protocol, where TLS roles are reversed relative to TCP roles. The TCP client acts as the TLS server, and the TCP server (proxy) acts as the TLS client. This defeats SNI-based censorship and JA3/JA4 fingerprinting because no ClientHello appears in the client→server direction.
Authentication is embedded in the TLS handshake itself: the client presents a TLS certificate whose SHA-256 fingerprint the server validates against a pre-shared expected value. No pre-handshake bytes are exchanged.
Index ¶
- func DERFingerprint(der []byte) string
- func NewInbound(ctx context.Context, router adapter.Router, lg log.ContextLogger, tag string, ...) (adapter.Inbound, error)
- func NewOutbound(ctx context.Context, router adapter.Router, lg log.ContextLogger, tag string, ...) (adapter.Outbound, error)
- func RegisterInbound(registry *inbound.Registry)
- func RegisterOutbound(registry *outbound.Registry)
- type Inbound
- type Outbound
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func DERFingerprint ¶
DERFingerprint returns the hex-encoded SHA-256 of DER-encoded certificate bytes.
func NewInbound ¶
func NewOutbound ¶
func RegisterInbound ¶
func RegisterOutbound ¶
Types ¶
type Inbound ¶
Inbound implements the server side of Reflex. It accepts TCP connections, immediately sends a TLS ClientHello (reversed role), then validates the peer's certificate fingerprint as authentication.
func (*Inbound) NewConnectionEx ¶
func (i *Inbound) NewConnectionEx(ctx context.Context, conn net.Conn, metadata adapter.InboundContext, onClose N.CloseHandlerFunc)
NewConnectionEx handles a new TCP connection with the reversed TLS handshake.
type Outbound ¶
Outbound implements the client side of Reflex. It dials a TCP connection, then acts as a TLS server (waits for ClientHello from the proxy). The server validates the client's TLS certificate fingerprint as authentication.
Source Files