Can you provide more APIs or options to handle SNI blocking issues?

[happytrudy]

In some areas, SNI blocking is very serious, but tokio-rustls does not provide SNI handshake hello packet fragmentation processing. It is necessary to provide an API for external program processing or directly provide parameters for control
Both wss and https protocols need to be processed

[ctz]

Here's a patch to this repo's client example that demonstrates how to fragment the clienthello:

diff --git a/examples/client.rs b/examples/client.rs
index 347a827..03664af 100644
--- a/examples/client.rs
+++ b/examples/client.rs
@@ -51,9 +51,10 @@ async fn main() -> Result<(), Box<dyn StdError + Send + Sync + 'static>> {
         root_cert_store.extend(webpki_roots::TLS_SERVER_ROOTS.iter().cloned());
     }
 
-    let config = rustls::ClientConfig::builder()
+    let mut config = rustls::ClientConfig::builder()
         .with_root_certificates(root_cert_store)
         .with_no_client_auth(); // i guess this was previously the default?
+    config.max_fragment_size = Some(100);
     let connector = TlsConnector::from(Arc::new(config));
 
     let stream = TcpStream::connect(&addr).await?;

And here you can observe in strace the outgoing messages being fragmented:

writev(9, [{iov_base="\24\3\3\0\1\1", iov_len=6}, {iov_base="\26\3\3\0_\1\0\5\210\3\3\274\21\v\335HV\226.\371md\4;\3742\34\224]\212S\242"..., iov_len=100}, {iov_base="\26\3\3\0_\5+\0\n\0\n\0\10\0\35\0\27\0\30\21\354\0-\0\2\1\1\0#\0\0\0"..., iov_len=100}, {iov_base="\26\3\3\0_\223\232\3d\336\244}\342\231\306\303\303\254\0222\243\370\223bw\204\7\2366i@+"..., iov_len=100}, {iov_base="\26\3\3\0_$\210]\203/\314\21bn\372/3C\300CC\261\305\370w.+\"PPIA"..., iov_len=100}, {iov_base="\26\3\3\0_\201\243\22\347\251\232\324Vu\361\300V\317\"\4G\3614\2053\220[Ib\35x}"..., iov_len=100}, {iov_base="\26\3\3\0_\242\276@\257\222\2257kXN\212,\4\272\320\227\204\313 \344\205\316\215\245:\366\33"..., iov_len=100}, {iov_base="\26\3\3\0_Y\26\234\262\300\331\362\223/\312djt\"4\373\310\10\351J\232B\234\300\372o\260"..., iov_len=100}, {iov_base="\26\3\3\0_\257\201=\200+`\"\263,\336Iig\250\301\17\371\206\20\313\177\206a\6\212\226\236"..., iov_len=100}, {iov_base="\26\3\3\0_\264l\323\304q!\201{\314\207\375C\232Wb\0171Y2\251V!\245\272\27T\247"..., iov_len=100}, {iov_base="\26\3\3\0_\313X\211\343\243\267\32\220\202j\\R3d[\206{\7\3lc\333[\"\251W\243"..., iov_len=100}, {iov_base="\26\3\3\0_\240\231j&\274\200F\261w\2\330\205V\214\21\323GP\270\241\214p2\23\360\212\310"..., iov_len=100}, {iov_base="\26\3\3\0_m\7W\305\225\3517\353S\245\331\273|\265\204i\243\350S\364\261\237\371<k\311\332"..., iov_len=100}, {iov_base="\26\3\3\0_G\274p\311@7g\227c\307\247\215\246\302(\7\212e\266u\332\303\0056E\3%"..., iov_len=100}, {iov_base="\26\3\3\0_\234h#\372\345cw7`\331\345\34Zh\303\307f\3\32ep\204W:\364\33o"..., iov_len=100}, {iov_base="\26\3\3\0Z\255<\222\353\23>K\236\305\1\300\204\4\22\246\263\275./\335I\314q\236\214\"\0"..., iov_len=95}], 16) = 1501

Obviously this comes at a later throughput cost, because this fragments every sent message.

[happytrudy]

Thank you very much, I will try it. As for the performance, I think the performance loss of the above processing is acceptable because SNI is blocked and cannot connect.