TLS : tls spoofing

infra/conf/transport_finalmask.go

@@ -20,6 +20,7 @@ import (
 	"github.com/xtls/xray-core/transport/internet/finalmask/mkcp/header"
 	"github.com/xtls/xray-core/transport/internet/finalmask/mkcp/original"
 	"github.com/xtls/xray-core/transport/internet/finalmask/noise"
+	"github.com/xtls/xray-core/transport/internet/finalmask/rawpacket"
 	"github.com/xtls/xray-core/transport/internet/finalmask/realm"
 	"github.com/xtls/xray-core/transport/internet/finalmask/salamander"
 	"github.com/xtls/xray-core/transport/internet/finalmask/sudoku"
@@ -70,6 +71,7 @@ var (
 	tcpmaskLoader = NewJSONConfigLoader(ConfigCreatorCache{
 		"header-custom": func() interface{} { return new(HeaderCustomTCP) },
 		"fragment":      func() interface{} { return new(FragmentMask) },
+		"rawpacket":     func() interface{} { return new(RawpacketMask) },
 		"sudoku":        func() interface{} { return new(Sudoku) },
 		"xmc":           func() interface{} { return new(XMC) },
 	}, "type", "settings")
@@ -231,6 +233,55 @@ func (c *HeaderCustomTCP) Build() (proto.Message, error) {
 	}, nil
 }
 
+type RawpacketMask struct {
+	Mode          string   `json:"mode"`
+	RemoteAddress string   `json:"remoteAddress"`
+	RemotePort    uint16   `json:"remotePort"`
+	RecvPort      uint16   `json:"recvPort"`
+	SpoofIPs      []string `json:"spoofIPs"`
+	Protocols     []string `json:"protocols"`
+	MTU           uint16   `json:"mtu"`
+	Target        string   `json:"target"`
+	TTL           uint8    `json:"ttl"`
+	SendTransport string   `json:"sendTransport"`
+	RecvTransport string   `json:"recvTransport"`
+	RelayAddress  string   `json:"relayAddress"`
+	RelayPort     uint16   `json:"relayPort"`
+	ClientIP      string   `json:"clientIP"`
+	ClientPort    uint16   `json:"clientPort"`
+	PeerSpoofIP   string   `json:"peerSpoofIP"`
+	SpoofPort     uint16   `json:"spoofPort"`
+	Auth          string   `json:"auth"`
+	SuppressRst   bool     `json:"suppressRst"`
+	Masquerade    string   `json:"masquerade"`
+}
+
+func (c *RawpacketMask) Build() (proto.Message, error) {
+	config := &rawpacket.Config{
+		Mode:          c.Mode,
+		RemoteAddress: c.RemoteAddress,
+		RemotePort:    uint32(c.RemotePort),
+		RecvPort:      uint32(c.RecvPort),
+		SpoofIps:      c.SpoofIPs,
+		Protocols:     c.Protocols,
+		Mtu:           uint32(c.MTU),
+		Target:        c.Target,
+		Ttl:           uint32(c.TTL),
+		SendTransport: c.SendTransport,
+		RecvTransport: c.RecvTransport,
+		RelayAddress:  c.RelayAddress,
+		RelayPort:     uint32(c.RelayPort),
+		ClientIp:      c.ClientIP,
+		ClientPort:    uint32(c.ClientPort),
+		PeerSpoofIp:   c.PeerSpoofIP,
+		SpoofPort:     uint32(c.SpoofPort),
+		Auth:          c.Auth,
+		SuppressRst:   c.SuppressRst,
+		Masquerade:    c.Masquerade,
+	}
+	return config, nil
+}
+
 type FragmentMask struct {
 	Packets  string       `json:"packets"`
 	Length   Int32Range   `json:"length"`

infra/conf/transport_internet.go

@@ -17,6 +17,8 @@ func (p TransportProtocol) Build() (string, error) {
 	switch strings.ToLower(string(p)) {
 	case "raw", "tcp":
 		return "tcp", nil
+	case "rawpacket":
+		return "rawpacket", nil
 	case "xhttp", "splithttp":
 		return "splithttp", nil
 	case "kcp", "mkcp":
@@ -48,6 +50,7 @@ type StreamConfig struct {
 	Network             *TransportProtocol `json:"network"`
 	Security            string             `json:"security"`
 	FinalMask           *FinalMask         `json:"finalmask"`
+	RawpacketSettings   *RawpacketMask     `json:"rawpacketSettings"`
 	TLSSettings         *TLSConfig         `json:"tlsSettings"`
 	REALITYSettings     *REALITYConfig     `json:"realitySettings"`
 	RAWSettings         *TCPConfig         `json:"rawSettings"`
@@ -182,6 +185,16 @@ func (c *StreamConfig) Build() (*internet.StreamConfig, error) {
 			Settings:     serial.ToTypedMessage(hs),
 		})
 	}
+	if c.RawpacketSettings != nil {
+		rs, err := c.RawpacketSettings.Build()
+		if err != nil {
+			return nil, errors.New("Failed to build rawpacket config.").Base(err)
+		}
+		config.TransportSettings = append(config.TransportSettings, &internet.TransportConfig{
+			ProtocolName: "rawpacket",
+			Settings:     serial.ToTypedMessage(rs),
+		})
+	}
 	if c.HysteriaSettings != nil {
 		hs, err := c.HysteriaSettings.Build()
 		if err != nil {

main/commands/all/tls/fakehello.go

@@ -0,0 +1,48 @@
+package tls
+
+import (
+	"encoding/base64"
+	"fmt"
+	"os"
+
+	"github.com/xtls/xray-core/main/commands/base"
+	"github.com/xtls/xray-core/transport/internet/finalmask/rawpacket"
+)
+
+var cmdFakeHello = &base.Command{
+	UsageLine: "{{.Exec}} tls fake-hello [-hex] <sni>",
+	Short:     "Generate a fake TLS ClientHello payload for rawpacket",
+	Long: `
+Generate a fake TLS ClientHello for use in finalmask rawpacket settings.
+
+Arguments:
+
+	-base64
+		Output base64-encoded payload (default).
+	-hex
+		Output hex-encoded payload instead of base64.
+`,
+}
+
+func init() {
+	cmdFakeHello.Run = executeFakeHello
+}
+
+var fakeHelloHex = cmdFakeHello.Flag.Bool("hex", false, "")
+
+func executeFakeHello(cmd *base.Command, args []string) {
+	if cmdFakeHello.Flag.NArg() < 1 {
+		base.Fatalf("sni not specified")
+	}
+	sni := cmdFakeHello.Flag.Arg(0)
+	payload, err := rawpacket.BuildFakeClientHello(sni)
+	if err != nil {
+		base.Fatalf("failed to build ClientHello: %s", err)
+	}
+	switch {
+	case *fakeHelloHex:
+		fmt.Fprintf(os.Stdout, "%x\n", payload)
+	default:
+		fmt.Fprintln(os.Stdout, base64.StdEncoding.EncodeToString(payload))
+	}
+}

main/commands/all/tls/tls.go

@@ -15,5 +15,6 @@ var CmdTLS = &base.Command{
 		cmdPing,
 		cmdHash,
 		cmdECH,
+		cmdFakeHello,
 	},
 }

transport/internet/finalmask/rawpacket/client_hello.go

@@ -0,0 +1,51 @@
+package rawpacket
+
+import (
+	"bytes"
+	"context"
+	"crypto/tls"
+	"errors"
+	"io"
+	"net"
+	"time"
+)
+
+// BuildFakeClientHello drives crypto/tls against a write-only in-memory conn
+// to capture a generated ClientHello. CurvePreferences pins classical groups
+// to suppress Go's default X25519MLKEM768 hybrid key share; without this the
+// post-quantum public key alone (~1184 bytes) pushes the record past one MSS,
+// and middleboxes do not reassemble fragmented ClientHellos. The handshake
+// error is discarded because the stub conn's Read returns immediately.
+func BuildFakeClientHello(sni string) ([]byte, error) {
+	if sni == "" {
+		return nil, errors.New("empty sni")
+	}
+	var buf bytes.Buffer
+	tlsConn := tls.Client(&writeOnlyConn{w: &buf}, &tls.Config{
+		ServerName: sni,
+		// Order matches what browsers advertised before post-quantum.
+		CurvePreferences:   []tls.CurveID{tls.X25519, tls.CurveP256, tls.CurveP384},
+		MinVersion:         tls.VersionTLS12,
+		MaxVersion:         tls.VersionTLS13,
+		NextProtos:         []string{"h2", "http/1.1"},
+		InsecureSkipVerify: true,
+	})
+	_ = tlsConn.HandshakeContext(context.Background())
+	if buf.Len() == 0 {
+		return nil, errors.New("tls ClientHello not produced")
+	}
+	return buf.Bytes(), nil
+}
+
+type writeOnlyConn struct {
+	w io.Writer
+}
+
+func (c *writeOnlyConn) Read([]byte) (int, error)         { return 0, io.EOF }
+func (c *writeOnlyConn) Write(p []byte) (int, error)      { return c.w.Write(p) }
+func (c *writeOnlyConn) Close() error                     { return nil }
+func (c *writeOnlyConn) LocalAddr() net.Addr              { return nil }
+func (c *writeOnlyConn) RemoteAddr() net.Addr             { return nil }
+func (c *writeOnlyConn) SetDeadline(time.Time) error      { return nil }
+func (c *writeOnlyConn) SetReadDeadline(time.Time) error  { return nil }
+func (c *writeOnlyConn) SetWriteDeadline(time.Time) error { return nil }

transport/internet/finalmask/rawpacket/config.go

@@ -0,0 +1,60 @@
+package rawpacket
+
+import (
+	"fmt"
+	"net/netip"
+	"strings"
+)
+
+const (
+	ProtocolTCP    uint8 = 6
+	ProtocolICMP   uint8 = 1
+	ProtocolICMPv6 uint8 = 58
+	ProtocolUDP    uint8 = 17
+)
+
+func ParseProtocol(s string) (uint8, error) {
+	switch strings.ToLower(s) {
+	case "tcp":
+		return ProtocolTCP, nil
+	case "icmp":
+		return ProtocolICMP, nil
+	case "icmpv6":
+		return ProtocolICMPv6, nil
+	case "udp":
+		return ProtocolUDP, nil
+	default:
+		return 0, fmt.Errorf("rawpacket: unknown protocol: %s", s)
+	}
+}
+
+func ParseIPs(ss []string) ([]netip.Addr, error) {
+	var out []netip.Addr
+	for _, s := range ss {
+		ip, err := netip.ParseAddr(s)
+		if err != nil {
+			return nil, fmt.Errorf("rawpacket: invalid spoof IP %q: %w", s, err)
+		}
+		out = append(out, ip.Unmap())
+	}
+	return out, nil
+}
+
+type RelayConfig struct {
+	ListenPort       uint16
+	ForwardAddr      string
+	ForwardTransport string // "tcp" (Xray) or "udp" (reference, default)
+	ClientIP         netip.Addr
+	ClientPort       uint16
+	SpoofIP          netip.Addr // single fallback
+	SpoofIPs         []string
+	SpoofPort        uint16
+	PeerSpoofIP      netip.Addr
+	SendTransport    string
+	RecvTransport    string
+	Mtu              uint32
+	SuppressRst      bool
+	Masquerade       string // "off" | "http" | "tls" | "dns"
+	Auth             []byte
+	icmpSuppressed   bool
+}