Standard workflow (recurring across AdGuard, JumpJump, Hula, BigMama, and Ace VPN tickets) for adding a new VPN app to TSG's blocklist: capture traffic on iOS/Android/Windows in a dedicated test environment, extract SNI first, fall back to enumerating server IPs when SNI proves ineffective or the app rotates it, then re-verify weekly/periodically with automated 'dial testing' (拨测) that checks whether newly discovered IPs still connect ('未穿透' = not yet penetrated/blocked).
该VPN使用TLS1.3协议伪造sni连接节点，使用ServerIP作为特征进行阻断，提取12个ServerIP... 目前已经提取774个服务器IP，将app的json文件同步给现场
Defense implications
- This is a mature, semi-automated production pipeline (test → extract → sync to field → weekly recheck), not ad-hoc manual work. A circumvention tool should assume any sufficiently popular app-based VPN gets this treatment within days to weeks of gaining visibility, and that SNI spoofing alone only delays, not prevents, eventual IP-based blocking.
Related findings
The same T1/NTC node config (ntcconf/t1conf/main.conf, K18/Astana/Kazakhtelecom) exposes concrete DPI enforcement toggles: a SYNACK_OR_RST switch and SEND_INJECT_PKT flag governing active TCP-response/packet-injection behavior; ASN- and IP-based blocklists (ASN_MAAT, IPD_DYN_MAAT, IPD_STATIC_MAAT) refreshed from MAAT/Redis on a 1-second effect interval; a dynamic blacklist with a 180s timeout; explicit protocol-blocking switches for BitTorrent (DHT/uTP) and eMule (Kad); and TLS metadata harvesting including certificate SAN fields (NTC_SSL_COLLECT, collect_san_sw=1) streamed to a Kafka topic.
An internal measurement-study report documents researchers live-testing the public DPYProxy TLS/SNI record-fragmentation tool against the GFW from inside China, against a control run from a German VPS. On a GFW IP-blocklisted Wikipedia IP, SNI fragmentation of any tested size (1/5/10/20 bytes) still ended in a server-side RST (though 1-5 byte fragments reached ServerHello before RST vs. 10-20 byte fragments RSTing right after ClientHello); on a non-blocklisted IP for the same domain, SNI fragmentation fully bypassed SNI-based blocking and returned a normal HTTP 200 response, matching the Germany baseline. The same report notes that testing Psiphon triggered roughly 5-10 minutes of residual censorship that also blocked other, unrelated circumvention tools from the same vantage point.
An internal risk memo, "Signal审查规避模式阻断风险说明" (Signal circumvention-mode blocking risk explanation), documents that after the operator pushed a "Deny Signal APP" policy, users with Signal's censorship-circumvention (domain fronting via Google infrastructure) enabled could still send messages/files; packet capture showed the fronted traffic used Google SNIs (clients3/4.google.com, inbox.google.com, android.clients.google.com, www.google.com), and the team built a targeted FQDN+JA3+payload signature specifically to block this fronted traffic while flagging a residual risk of false-positive blocking of legitimate Google services.
A hands-on MESA lab experiment testing TLS-record/TCP fragmentation (via the DPYProxy tool, replicating the public "Circumventing the GFW with TLS Record Fragmentation" technique) against live GFW found SNI fragmentation reliably bypasses GFW's SNI-based blocking of a non-blocklisted wikipedia.org IP, but has zero effect on GFW's separate IP blocklist: for an already-blocklisted IP, every fragment size tested still failed, with GFW tearing down the connection via <RST,ACK> immediately after ClientHello for larger fragments, or after the server's Hello for very small (1-5 byte) fragments.
The tango/kni (Kernel Network Interface) repo shows TSG's SNI/TLS-ClientHello-based interception logic (kni_entry.cpp) receiving dedicated 2024 fixes for handling TLS ClientHello fragmented across multiple packets ("ssl chello frag") and a "chello first packet hit intercept policy" bug, on top of a long-standing (2020) "dynamic bypass" feature that replaced raw-ClientHello matching with JA3 TLS fingerprints, plus counters for SSL certificate-pinning detection.
A MESA-affiliated researcher's experiment log documents live testing of Psiphon and a TLS-fragmentation SNI-evasion tool (DPYProxy) against the real Great Firewall from inside mainland China. Fragmenting the TLS ClientHello/TCP stream into very small (1-5 byte) segments bypassed GFW SNI-based blocking of a non-blocklisted Wikipedia IP, while larger fragments (10-20 bytes) did not; a separately IP-blocklisted Wikipedia IP still failed regardless of fragmentation. Testing Psiphon also appeared to trigger a ~5-10 minute window in which the researcher's own unrelated circumvention tool stopped working.