Added TLS fragmentation to fronted HTTP client

psiphon/net.go

@@ -474,6 +474,14 @@ func makeFrontedHTTPClient(
 		networkLatencyMultiplierMax,
 		p.Float(parameters.NetworkLatencyMultiplierLambda))
 
+	tlsFragmentClientHello := false
+	tlsFragmentorLimitProtocols := p.TunnelProtocols(parameters.TLSFragmentClientHelloLimitProtocols)
+	if len(tlsFragmentorLimitProtocols) == 0 || common.Contains(tlsFragmentorLimitProtocols, effectiveTunnelProtocol) {
+		if net.ParseIP(meekSNIServerName) == nil {
+			tlsFragmentClientHello = p.WeightedCoinFlip(parameters.TLSFragmentClientHelloProbability)
+		}
+	}
+
 	meekConfig := &MeekConfig{
 		DiagnosticID:             frontingProviderID,
 		Parameters:               config.GetParameters(),
@@ -481,6 +489,7 @@ func makeFrontedHTTPClient(
 		DialAddress:              meekDialAddress,
 		UseHTTPS:                 true,
 		TLSProfile:               tlsProfile,
+		TLSFragmentClientHello:   tlsFragmentClientHello,
 		NoDefaultTLSSessionID:    noDefaultTLSSessionID,
 		RandomizedTLSProfileSeed: randomizedTLSProfileSeed,
 		SNIServerName:            meekSNIServerName,
@@ -603,6 +612,10 @@ func makeFrontedHTTPClient(
 			params["tls_version"] = getTLSVersionForMetrics(tlsVersion, meekConfig.NoDefaultTLSSessionID)
 		}
 
+		if meekConfig.TLSFragmentClientHello {
+			params["tls_fragmented"] = "1"
+		}
+
 		return params
 	}
 

psiphon/server/api.go

@@ -541,7 +541,9 @@ var remoteServerListStatParams = append(
 		{"meek_transformed_host_name", isBooleanFlag, requestParamOptional | requestParamLogFlagAsBool},
 		{"user_agent", isAnyString, requestParamOptional},
 		{"tls_profile", isAnyString, requestParamOptional},
-		{"tls_version", isAnyString, requestParamOptional}},
+		{"tls_version", isAnyString, requestParamOptional},
+		{"tls_fragmented", isBooleanFlag, requestParamOptional | requestParamLogFlagAsBool},
+	},
 
 	baseSessionParams...)