A DPI session-plugin ("stellar" framework) SSL/TLS decoder fully parses live ClientHello/ServerHello handshakes, computing JA3/JA3S fingerprints (MD5 over version+cipher-suites+extensions with GREASE values stripped per the standard JA3 spec), extracting plaintext SNI, explicitly flagging whether a ClientHello carries ESNI (extension type 0xFFCE) or ECH (extension type 0xFE0D), and decoding full X.509 certificate chains (issuer/subject RDN sequences, SAN, validity window, serial, pubkey, signature algorithm) in real time. It also recognizes TLCP 1.0 (China's national "国密"/GmSSL TLS variant) as a distinct protocol version alongside SSLv2 through TLS1.3.
#define ENCRPTED_SERVER_NAME_EXT_TYPE 0xFFCE // ESNI extension type ID, explicitly detected via ssl_message_esni_is_true(); #define ENCRPTED_CLIENT_HELLO_EXT_TYPE 0xFE0D // ECH extension type ID, detected via ssl_message_ech_is_true()
Defense implications
- JA3/JA3S is computed on every live handshake — a Lantern-adjacent client TLS stack should avoid a distinctive/rare cipher-suite-and-extension ordering that yields a fingerprintable JA3 hash; mimic a common browser's exact ordering rather than a library default.
- ESNI/ECH presence itself is explicitly flagged as a boolean signal (esni_is_true/ech_is_true), independent of whether the payload can be decrypted — treat 'ECH extension present' as something this class of DPI can act on (e.g. block-on-ECH-presence), so ECH rollout for circumvention should not assume the extension's mere presence is unobservable.
- TLCP 1.0 is recognized as a first-class protocol version, indicating this DPI runs in a Chinese-network context aware of national-crypto TLS; a mimicry design targeting this censor should verify it doesn't rely on any TLCP-specific quirk to blend in, since the decoder treats TLCP as a known/expected version rather than an anomaly.
Cited artifacts
mesalab_git—stellar/ssl_decoder.bundle:src/ssl_decoder.cpp(source-code)mesalab_git—stellar/ssl_decoder.bundle:src/ssl_export.cpp(source-code)mesalab_git—stellar/ssl_decoder.bundle:src/ssl_internal.h(source-code)
Provenance pointers only — no leak content is rehosted. Raw material: Enlace Hacktivista.
Related findings
chongming/traffic_replay is a Flask/tcpreplay-based QA harness that replays curated pcaps against a TSG instance to exercise its decoders, including SSL fixtures specifically named ssl_ech_false.pcap, ssl_no_sni.pcap and ssl_tls13.pcap alongside esni.pcap, openvpn.pcap, and major-platform captures (facebook/google/twitter/ youtube). A companion update_tsg_ca.py/tsg_ca.txt installs a TSG-issued CA cert on the test client, confirming the QA environment exercises TLS interception as part of routine detection testing.
MESA_Platform's "quic" module (built and packaged as stellar-on-sapp/sapp RPMs) implements SNI/User-Agent extraction from both cleartext GQUIC (versions 23-59) and encrypted IETF QUIC RFC9000 ClientHello payloads, and supports a QUIC SNI whitelist -- i.e. the DPI pipeline decrypts/parses encrypted QUIC handshakes to recover the destination domain rather than being blocked by QUIC's encryption.
A debugging ticket for sites "Old Airport-PE" and "Bole-IGW" (naming consistent with Addis Ababa, Ethiopia) confirms the customer verified Psiphon3, YouTube, Facebook, and Telegram blocking as working well during independent testing, and reveals the operational session-correlation method used when packet captures and system logs must be cross-referenced across NAT: JA3_HASH + server IP + client public IP + SSL SNI.
Internal spec for "spacemap-service", a passive-DPI-fed reconnaissance database and web UI that catalogs every observed website's IP/domain, geolocation, ASN, DNS server, CDN vendor, TLS certificate fields (issuer/CN/SNI), OS and web-framework fingerprint (via Wappalyzer), and WHOIS/ICP registration data, exposing reverse-lookup search by any single attribute (e.g. all sites behind a given cert issuer, ASN, or CDN vendor).
Two independently-leaked TSG session-log CSV exports share an identical 224-field schema whose proxy_* columns (proxy_action, proxy_pinning_status, proxy_intercept_status, proxy_cert_verify, proxy_intercept_error) log the outcome of TLS interception per session, alongside ssl_ja3_hash/ssl_ja3s_hash, ssl_esni_flag, ssl_ech_flag, and quic_sni fields — confirming MITM/cert-pinning-bypass instrumentation and TLS/QUIC fingerprinting are built into TSG's standard traffic-logging pipeline, not a bolt-on feature.
A confidentiality-marked ("内部资料 注意保密", 架构组/Architecture Group) MESA Lab research report systematically profiles 11 video-conferencing/collaboration platforms (DingTalk, Zoom, Feishu/Lark, WeCom, Tencent Meeting, WebEx, Huawei WeLink, Slack, Teambition, 科技云会, 小鱼易连) with SNI lists, TLS certificate fingerprints, DNS/whois infrastructure, and an explicit "passive traffic analysis feasibility" (被动流量分析可行性) verdict per app — direct precursor engineering work for per-app DPI detection signatures.