fix: domain-specific TLS fingerprinting check at handshake level

Fixed issue where users were banned for 'Malicious TLS fingerprint' even when
'Analyze TLS fingerprints' was disabled in UI for their domain.

Root cause: IsTLSFingerprintEnabled() returned true if ANY domain had the
feature enabled, and this boolean was captured at server startup. The TLS
handshake callback would then check fingerprints for ALL domains.

Changes:
- Modified GetConfigForClientWrapper to accept a domain lookup function
  instead of a global boolean
- Added IsTLSFingerprintEnabledForDomain() method to ConfigManager for
  per-domain configuration checks
- Updated proxy/https.go to pass domain-specific lookup function
- Fixed DNS test mock to include missing GetAgents() method

Now TLS fingerprint checking only occurs for domains that explicitly have
the feature enabled in their L7 protection settings.

Author: Rxflex

config/manager.go

@@ -472,6 +472,32 @@ func (cm *ConfigManager) IsTLSFingerprintEnabled() bool {
 	return false
 }
 
+// IsTLSFingerprintEnabledForDomain checks if TLS fingerprinting is enabled for a specific domain
+// This allows per-domain TLS fingerprinting configuration at the TLS handshake level
+func (cm *ConfigManager) IsTLSFingerprintEnabledForDomain(domain string) bool {
+	cm.mu.RLock()
+	defer cm.mu.RUnlock()
+
+	if domain == "" {
+		return false
+	}
+
+	// Normalize domain to lowercase for comparison
+	domainLower := strings.ToLower(domain)
+
+	for _, d := range cm.config.Domains {
+		// Check exact match or subdomain match
+		domainConfigLower := strings.ToLower(d.Domain)
+		if domainConfigLower == domainLower || strings.HasSuffix(domainLower, "."+domainConfigLower) {
+			if d.HTTPProxy.AntiDDoS != nil && d.HTTPProxy.AntiDDoS.L7Protection != nil {
+				return d.HTTPProxy.AntiDDoS.L7Protection.TLSFingerprintEnabled
+			}
+			return false
+		}
+	}
+	return false
+}
+
 func (cm *ConfigManager) GetAgentID() string {
 	cm.mu.RLock()
 	defer cm.mu.RUnlock()

dns/server_test.go

@@ -33,6 +33,10 @@ func (m *MockConfigManager) GetAgentIP() string {
 	return m.agentIP
 }
 
+func (m *MockConfigManager) GetAgents() []config.FallbackAgentInfo {
+	return []config.FallbackAgentInfo{}
+}
+
 func TestCNAMEFlattening(t *testing.T) {
 	tests := []struct {
 		name           string

firewall/tls_handshake.go

@@ -259,7 +259,7 @@ func GetConfigForClientWrapper(
 	baseConfig *tls.Config,
 	configuredDomains []string,
 	getCertificateFunc func(*tls.ClientHelloInfo) (*tls.Certificate, error),
-	tlsFingerprintEnabled bool,
+	isTLSEnabledForDomainFunc func(domain string) bool,
 ) func(*tls.ClientHelloInfo) (*tls.Config, error) {
 
 	handshakeLimiter := GetHandshakeRateLimiter()
@@ -269,7 +269,7 @@ func GetConfigForClientWrapper(
 		ip := ExtractIPFromAddr(hello.Conn.RemoteAddr())
 
 		// === FORTRESS LAYER 1: SNI Validation (Cheap Check) ===
-		// Отсекаем сканеры и боты без валидного SNI
+		// Отсекаем сканеры и ботов без валидного SNI
 		if err := ValidateSNI(hello.ServerName, configuredDomains); err != nil {
 			// Логируем с указанием настроенных доменов для отладки
 			log.Printf("[TLS-Fortress] Blocked handshake from %s: %v (SNI: %s, configured domains: %d)",
@@ -308,7 +308,13 @@ func GetConfigForClientWrapper(
 		}
 
 		// === FORTRESS LAYER 3: TLS Fingerprinting (JA3/JA4) ===
-		// Анализ TLS fingerprint для обнаружения ботов (только если включено в настройках)
+		// Анализ TLS fingerprint для обнаружения ботов (только если включено для конкретного домена)
+		// Проверяем динамически для каждого домена, а не глобально
+		tlsFingerprintEnabled := false
+		if isTLSEnabledForDomainFunc != nil && hello.ServerName != "" {
+			tlsFingerprintEnabled = isTLSEnabledForDomainFunc(hello.ServerName)
+		}
+
 		if tlsFingerprintEnabled {
 			tlsFingerprint := ExtractTLSFingerprint(hello)
 			if tlsFingerprint != "" {

proxy/https.go

@@ -77,12 +77,14 @@ func StartHTTPSProxy(configMgr *config.ConfigManager) {
 		// === FORTRESS EDITION: GetConfigForClient - главная точка защиты ===
 		// Layer 1: SNI Validation (отсекает сканеры)
 		// Layer 2: Handshake Rate Limiting (защита от velocity attacks)
-		// Layer 3: TLS Fingerprinting (обнаружение ботнетов)
+		// Layer 3: TLS Fingerprinting (обнаружение ботнетов) - домен-специфичная проверка
 		GetConfigForClient: firewall.GetConfigForClientWrapper(
 			nil, // baseConfig (nil = use default)
 			configuredDomains,
 			server.getCertificate,
-			server.configMgr.IsTLSFingerprintEnabled(),
+			func(domain string) bool {
+				return server.configMgr.IsTLSFingerprintEnabledForDomain(domain)
+			},
 		),
 	}