TLS : tls spoofing

infra/conf/transport_internet.go

@@ -23,6 +23,7 @@ import (
 	"github.com/xtls/xray-core/transport/internet"
 	"github.com/xtls/xray-core/transport/internet/finalmask/fragment"
 	"github.com/xtls/xray-core/transport/internet/finalmask/header/custom"
+	"github.com/xtls/xray-core/transport/internet/finalmask/rawpacket"
 	"github.com/xtls/xray-core/transport/internet/finalmask/header/dns"
 	"github.com/xtls/xray-core/transport/internet/finalmask/header/dtls"
 	"github.com/xtls/xray-core/transport/internet/finalmask/header/srtp"
@@ -1237,6 +1238,7 @@ var (
 	tcpmaskLoader = NewJSONConfigLoader(ConfigCreatorCache{
 		"header-custom": func() interface{} { return new(HeaderCustomTCP) },
 		"fragment":      func() interface{} { return new(FragmentMask) },
+		"rawpacket":     func() interface{} { return new(RawpacketMask) },
 		"sudoku":        func() interface{} { return new(Sudoku) },
 	}, "type", "settings")
 
@@ -1447,6 +1449,23 @@ func (c *FragmentMask) Build() (proto.Message, error) {
 	return config, nil
 }
 
+type RawpacketMask struct {
+	Payload string `json:"payload"`
+	Method  string `json:"method"`
+	TTL     int32  `json:"ttl"`
+	Count   int32  `json:"count"`
+}
+
+func (c *RawpacketMask) Build() (proto.Message, error) {
+	config := &rawpacket.Config{
+		Payload: c.Payload,
+		Method:  c.Method,
+		Ttl:     uint32(c.TTL),
+		Count:   c.Count,
+	}
+	return config, nil
+}
+
 type NoiseItem struct {
 	Rand      Int32Range      `json:"rand"`
 	RandRange *Int32Range     `json:"randRange"`

transport/internet/finalmask/rawpacket/config.go

@@ -0,0 +1,14 @@
+package rawpacket
+
+import "net"
+
+func (c *Config) TCP() {}
+
+func (c *Config) WrapConnClient(raw net.Conn) (net.Conn, error) {
+	return NewConnClient(c, raw)
+}
+
+func (c *Config) WrapConnServer(raw net.Conn) (net.Conn, error) {
+	// Raw packet injection is client-side only.
+	return raw, nil
+}

transport/internet/finalmask/rawpacket/config.proto

@@ -0,0 +1,23 @@
+syntax = "proto3";
+
+package xray.transport.internet.finalmask.rawpacket;
+option csharp_namespace = "Xray.Transport.Internet.Finalmask.Rawpacket";
+option go_package = "github.com/xtls/xray-core/transport/internet/finalmask/rawpacket";
+option java_package = "com.xray.transport.internet.finalmask.rawpacket";
+option java_multiple_files = true;
+
+message Config {
+  // Base64-encoded fake payload bytes to inject before the real traffic.
+  string payload = 1;
+
+  // Corruption method to make the fake packet dropped by the server.
+  // Available: wrong-sequence, wrong-checksum, wrong-ack, wrong-md5, wrong-timestamp.
+  string method = 2;
+
+  // TTL of the fake packet. A low value (e.g. 3-5) ensures the packet
+  // is seen by middleboxes but does not reach the destination server.
+  uint32 ttl = 3;
+
+  // How many Write() calls trigger injection. 0 or 1 = single-shot (default).
+  int32 count = 4;
+}