Drafting Fake-TLS V2

src/config/defaults.rs

@@ -23,6 +23,10 @@ pub(crate) fn default_fake_cert_len() -> usize {
     2048
 }
 
+pub(crate) fn default_tls_front_dir() -> String {
+    "tlsfront".to_string()
+}
+
 pub(crate) fn default_replay_check_len() -> usize {
     65_536
 }

src/config/load.rs

@@ -163,6 +163,21 @@ impl ProxyConfig {
             config.censorship.mask_host = Some(config.censorship.tls_domain.clone());
         }
 
+        // Merge primary + extra TLS domains, deduplicate (primary always first).
+        if !config.censorship.tls_domains.is_empty() {
+            let mut all = Vec::with_capacity(1 + config.censorship.tls_domains.len());
+            all.push(config.censorship.tls_domain.clone());
+            for d in std::mem::take(&mut config.censorship.tls_domains) {
+                if !d.is_empty() && !all.contains(&d) {
+                    all.push(d);
+                }
+            }
+            // keep primary as tls_domain; store remaining back to tls_domains
+            if all.len() > 1 {
+                config.censorship.tls_domains = all[1..].to_vec();
+            }
+        }
+
         // Migration: prefer_ipv6 -> network.prefer.
         if config.general.prefer_ipv6 {
             if config.network.prefer == 4 {
@@ -180,7 +195,7 @@ impl ProxyConfig {
         validate_network_cfg(&mut config.network)?;
 
         // Random fake_cert_len only when default is in use.
-        if config.censorship.fake_cert_len == default_fake_cert_len() {
+        if !config.censorship.tls_emulation && config.censorship.fake_cert_len == default_fake_cert_len() {
             config.censorship.fake_cert_len = rand::rng().gen_range(1024..4096);
         }
 
@@ -235,7 +250,7 @@ impl ProxyConfig {
         // Migration: Populate upstreams if empty (Default Direct).
         if config.upstreams.is_empty() {
             config.upstreams.push(UpstreamConfig {
-                upstream_type: UpstreamType::Direct { interface: None },
+                upstream_type: UpstreamType::Direct { interface: None, bind_addresses: None },
                 weight: 1,
                 enabled: true,
                 scopes: String::new(),

src/config/types.rs

@@ -295,6 +295,11 @@ pub struct ServerConfig {
     #[serde(default)]
     pub listen_tcp: Option<bool>,
 
+    /// Accept HAProxy PROXY protocol headers on incoming connections.
+    /// When enabled, real client IPs are extracted from PROXY v1/v2 headers.
+    #[serde(default)]
+    pub proxy_protocol: bool,
+
     #[serde(default)]
     pub metrics_port: Option<u16>,
 
@@ -314,6 +319,7 @@ impl Default for ServerConfig {
             listen_unix_sock: None,
             listen_unix_sock_perm: None,
             listen_tcp: None,
+            proxy_protocol: false,
             metrics_port: None,
             metrics_whitelist: default_metrics_whitelist(),
             listeners: Vec::new(),
@@ -362,6 +368,10 @@ pub struct AntiCensorshipConfig {
     #[serde(default = "default_tls_domain")]
     pub tls_domain: String,
 
+    /// Additional TLS domains for generating multiple proxy links.
+    #[serde(default)]
+    pub tls_domains: Vec<String>,
+
     #[serde(default = "default_true")]
     pub mask: bool,
 
@@ -376,17 +386,28 @@ pub struct AntiCensorshipConfig {
 
     #[serde(default = "default_fake_cert_len")]
     pub fake_cert_len: usize,
+
+    /// Enable TLS certificate emulation using cached real certificates.
+    #[serde(default)]
+    pub tls_emulation: bool,
+
+    /// Directory to store TLS front cache (on disk).
+    #[serde(default = "default_tls_front_dir")]
+    pub tls_front_dir: String,
 }
 
 impl Default for AntiCensorshipConfig {
     fn default() -> Self {
         Self {
             tls_domain: default_tls_domain(),
+            tls_domains: Vec::new(),
             mask: true,
             mask_host: None,
             mask_port: default_mask_port(),
             mask_unix_sock: None,
             fake_cert_len: default_fake_cert_len(),
+            tls_emulation: false,
+            tls_front_dir: default_tls_front_dir(),
         }
     }
 }
@@ -446,6 +467,8 @@ pub enum UpstreamType {
     Direct {
         #[serde(default)]
         interface: Option<String>,
+        #[serde(default)]
+        bind_addresses: Option<Vec<String>>,
     },
     Socks4 {
         address: String,