feat(tls): reassemble hello messages split across TLS records

A handshake message may span any number of records, and splitting the
ClientHello into tiny records hides the SNI from analyzers that expect it
in the first one. The tls analyzer read the first record header and then
cut the handshake body straight out of the stream, so fragmented hellos
either stalled until Limit() or failed to parse, and every SNI rule was
bypassed.

The record layer is now peeled off and the hello rebuilt from the record
bodies before parsing, for both ClientHello and ServerHello. The number of
records a hello spanned is exposed as tls.req_records / tls.resp_records,
kept outside req/resp so a non-nil req still means a fully parsed hello.
Fragmentation is published as soon as a second record shows up, since
1-byte records can stretch a hello past Limit() and it never completes.

docs: add TLS record fragmentation doc, correct the claim in the TCP
window evasion doc that tls is unaffected by splitting.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

This commit is contained in:

Mxmilu666

2026-09-24 17:31:57 +08:00

co-authored by

Claude Opus 5.5

parent 8f8cc1d4d9

commit ae7135ab64

5 changed files with 391 additions and 200 deletions

									
										README.zh.md
									
		+1
		
												View File
												
				@@ -39,6 +39,7 @@ Telegram 群组： https://t.me/OpGFW

				- [Minecraft 分析器](docs/minecraft.zh.md)

				- [EasyTier 分析器](docs/easytier.zh.md)

				- [TCP 窗口操纵规避与检测](docs/tcp-window-evasion.zh.md)

				- [TLS record 分片规避与检测](docs/tls-record-fragmentation.zh.md)

				## 使用场景