fragment params should not be limited

[GFW-knocker]

Attention | توجه

• I searched and no similar issues were found | جستجو کردم و هیچ گزارش مشابهی پیدا نشد
• I read FAQ and no relevant issues were found | سوالات متداول را خواندم و هیچ مورد مربوطی پیدا نشد

What Happened? | چه اتفاقی افتاده؟

regarding the previous issue that closed:
#1129

some users need fragment with length below 10
even sometimes with need length 1 ( yes1 byte )
iran firewall act different across regions

recent firewall update seems block tlshello mode
and some users need packet fragmented more than 100 pieces to pass firewall.
so for a packet of 500 byte , he need length below 5

so its not reasonable to limit number in UI, when xray-core support this.

Minimal Reproducible Example | چه فرایندی برای مشاهده این مشکل طی کرده‌اید؟

No response

Relevant log output | لاگ برنامه یا پنل

no log

Panel version | نسخه‌ پنل

latest

Client | برنامه فیلترشکن

No response

Client version | نسخه برنامه فیلترشکن

No response

[GFW-knocker]

of course , fragment is client-side
but think of a provider that want to set params remotely for his subscriber.

[GFW-knocker]

thanks again for your great work that help tens of millions.

[bia-pain-bache]

First of all, I'm glad to have you here Knocker.
I believe if GFW is not bypassed with 10 bytes fragmentation, it would not be bypassed even with 1 byte. Also I believe fine tuning interval and maxSplit makes enough confusion to firewall to avoid 1 byte fragment which heavily degrade proxy performance.
Do you believe IR GFW investigates 30-40 segments (for 10-20 length) in each handshake for each user with random values? Really I don't think they have such infrastructures, however I'm sure you have access to ISPs situation via Mahsa Server and you're claiming based on a fact.
I appreciate if you can guide me which ISPs have such a situation right now? MCI, Shatel and TCI work perfectly with 10-20 or even up to 100-200 (with 1-1 packet) regarding my tests these days.
Fixing UI is not such a big deal, I'm just curious about the ISP we are talking about.

[bia-pain-bache]

of course , fragment is client-side but think of a provider that want to set params remotely for his subscriber.

I removed url configs from panel, they cannot be donated anymore (CF banned limitless traffic even with custom domains), so the worker can handle 2-3 persons top, besides 1101 errors occur frequently when heavy traffics are made via donations. Right now panel only provides custom configs.
So setting optimal fragment settings from MahsaNG is not a concern anymore.

[GFW-knocker]

Do you believe IR GFW investigates 30-40 segments ?

we have to fragment mode:
tlshello : worked with a few chunk (length 100-200) but tlshello blocked 3 days ago.
generic 1-1 : chunk first packet to arbitrary size , it still work if enough chunk happen

generic mode can be applied to tls or non-tls config.
specially for non-tls , you can test ws:80 with filtered domain and chunk more than 100 pieces to pass handshake.
below 100 chunk, it detected by firewall

yes. i 100% sure MCI can assemble packets up to ~120 pieces, above that they give up.
assembling power differs across cities.

[bia-pain-bache]

I fixed this, however I wonder if they can assemble up to 120 pcs, why generic fragment with large pieces are still bypassing GFW or on the other hand, why 1 byte length tlshello fragment cannot bypass...

[GFW-knocker]

special thanks for fixing this.

[GFW-knocker]

why generic fragment with large pieces are still bypassing GFW

in my isp, generic mode cant pass with less than 100 chunks

why 1 byte length tlshello fragment cannot bypass...

tlshello mode , chunk then group every 3 to 4 them again in packet , so packets look like "multiple handshake msg in one clienthello"

i think last firewall update block "multiple handshake in one packet"

BTW i test this setting and can successfully bypass firewall
packet=tlshello
length=3-5
interval=4-7

in case of length=1 byte, you should reduce interval (delay) to make ping reasonable (below 3000)

[bia-pain-bache]

Apparently it's a messy situation and it differs based on ISP and distinct.
I sincerely appreciate your efforts and services to the community.