go-gost / gost

GO Simple Tunnel - a simple tunnel written in golang
https://gost.run
MIT License
4.39k stars 528 forks source link

[Feature Request] sni 处理器支持域前置 #361

Closed A2uria closed 2 months ago

A2uria commented 12 months ago

目前 sni 处理器仅支持根据 sni 转发到对应服务器,添加类似 noservername 的参数使 gost 支持移除 tls client hello 中 sni 拓展。

例如:

$ openssl s_client -state -brief <domain name>:443 < /dev/null
SSL_connect:before SSL initialization
SSL_connect:SSLv3/TLS write client hello
SSL_connect:error in SSLv3/TLS write client hello
write:errno=10054

直接访问 <domain name> 会导致连接被重置,移除 tls client hello 中的 sni 拓展后就可正常连接。

$ openssl s_client -brief -noservername <domain name>:443 < /dev/null
CONNECTION ESTABLISHED
Protocol version: TLSv1.3
Ciphersuite: TLS_AES_256_GCM_SHA384
Peer certificate: ...
Hash used: SHA256
Signature type: RSA-PSS
Verification: OK
Server Temp Key: ECDH, prime256v1, 256 bits
DONE

Expected:

$ curl https://<domain name>
curl: (35) Recv failure: Connection was reset
$ gost -L sni://:443?noservername=true &
$ curl --resolve <domain name>:443:127.0.0.1 https://<domain name>
ok
Scribing commented 7 months ago

有用但不多,主要是cloudflare不支持,只有零星几个站能用上

ginuerzh commented 2 months ago

对于TLS1.3,SNI扩展是强制使用的。