$ show xvzc/spoofdpi
spoofdpi is a cross-platform proxy tool that bypasses Deep Packet Inspection (DPI) by fragmenting and desynchronizing TLS handshakes. It operates in three modes: HTTP proxy, SOCKS5 proxy, or TUN interface (transparent proxy). In production, it intercepts outgoing connections, reads the TLS ClientHello, splits it into segments using configurable strategies (SNI-split, random, chunk, first-byte, or custom plans), optionally sends fake packets before the real data, and may disorder segments by manipulating the TTL field so that DPI middleboxes misparse the connection while the destination server reassembles it correctly. It also includes a built-in DNS resolver with UDP, HTTPS (DoH), and system backends, and a rule system for per-domain/per-IP configuration. The architecture is a single Go binary with modular internal packages: config (TOML+CLI loading), desync (TLS/UDP desynchronization), dns (multi-backend resolver), netutil (connection management, dialing, TTL setting), packet (raw packet capture/injection via pcap or Linux raw sockets), proto (HTTP, SOCKS5, TLS parsing), rule (domain and CIDR matching), server (HTTP, SOCKS5, TUN server implementations), session (context-based tracing), trie (generic trie structures), cache (sharded LRU and TTL caches), and logging (zerolog-based structured logging). The TUI mode uses bubbletea for a terminal interface showing real-time speed and logs. Key entry points are cmd/spoofdpi/main.go (main function) which parses CLI flags, loads configuration, and starts the selected server. External dependencies include gopacket for packet manipulation, wireguard-tun for TUN device support, gvisor for TCP/IP stack in TUN mode, and various Go packages for CLI, TOML, DNS, and logging. The code is well-structured with extensive use of interfaces, generics, and concurrency primitives (context, channels, goroutines).
The LLM identified 6 files worth highlighting for reuse:
Generic domain trie supporting exact, single-wildcard (*), and globstar (**) patterns. Reversed segment insertion enables efficient longest-prefix matching. Can be extracted for any domain-based routing or filtering system.
CIDR trie using patricia tree for IPv4 and IPv6 longest-prefix matching. Supports add and search operations. Reusable for IP-based routing or access control.
Sharded LRU cache with generic key-value interface, configurable capacity, and invalidation callback. Uses FNV-1a hashing for shard selection. Thread-safe via per-shard mutex. Can be extracted as a standalone caching library.
Sharded TTL cache with background janitor for expired entry cleanup. Supports per-entry TTL, skip-existing, and update-only modes. Thread-safe with read-write locks. Reusable for any time-based caching need.
IdleTimeoutConn wraps a net.Conn with automatic deadline extension on read/write activity, preventing premature timeout on idle connections. Includes ConnRegistry for managing a pool of such connections with LRU eviction and periodic cleanup. Reusable for any server that needs to manage persistent connections with idle timeouts.
Core TLS desynchronization engine implementing multiple fragmentation strategies (SNI-split, random, chunk, first-byte, custom segment plans) and optional packet disordering via TTL manipulation. Includes fake packet injection. The split and send logic is well-abstracted and could be reused in other DPI circumvention tools.