net4people
[China] education net seems to block tls record layer fragment (with tcp segment)
As provided. I don't count how many reset packets I get.
This techinique is widely used in using proxies build with worker with regionaly blocked domain wokers.dev/pages.dev.
Have you tried decreasing the length of the first TLS record ( e.g. length = 1 )? Did CERNET route some traffic through China Telecom's autonomous systems?
Have you tried decreasing the length of the first TLS record ( e.g. length = 1 )? Did CERNET route some traffic through China Telecom's autonomous systems?
useless as it used to be when only tcp frag last year. any bigger interval or more fragments is useless. must be something stateful.
As I know, the China Mobie apply the chage too.
you could try to use both TCP segmentation and TLS fragmentation at the same time. Could work... especially when the fragments dont align
you could try to use both TCP segmentation and TLS fragmentation at the same time. Could work... especially when the fragments dont align
No, never work on education net.
you could try to use both TCP segmentation and TLS fragmentation at the same time. Could work... especially when the fragments dont align
I guess it is something with full TCP TLS stack. I don't know whether it will deploy to the whole net.
That's worrisome. I hope to monitor it somewhat for the rest of the GFW.
Today I split the first TLS record into 400 TLS records, still got reset. ( in AS56040 )
Just verified that the three TLS injectors (TCP RST) of the GFW and the one in Henan still cannot reassemble TLS records. I'll keep checking, but as for now, that new behavior seems limited to the education net
Two PCAP files for collecting the fingerprints of the middleboxes: brookings.edu-1.pcap.zip signal.org-IPv6.pcap.zip
Today I split the first TLS record into 400 TLS records, still got reset. ( in AS56040 )
看一下matrix.。我有事找你
Take a look at matrix. I have something to search for you.
Strangely, gfw cannot deal with fragments with oob data. I've reported it to gfw.report.
Just verified that the three TLS injectors (TCP RST) of the GFW and the one in Henan still cannot reassemble TLS records. I'll keep checking, but as for now, that new behavior seems limited to the education net
As reported by my users or collabrators, the change has been adopted and has influenced the whole country. I guess it is at the gateway. but I don't measure.