deps: bump domainfront (SNI: default strategy without country code + baked-in SNI)#41
Merged
Merged
Conversation
Picks up getlantern/domainfront#11: ExpandedProvider applies the default frontingsnis strategy even with no country code (so akamai sends its arbitrary SNIs globally instead of the conspicuous no-SNI), preserves a baked-in per-masquerade SNI (for aliyun's www.mobgslb.tbcache.com), and verifies the SNI-path edge cert against the front Domain instead of chain-only. No kindling code changes; build + tests pass. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (1)
📝 WalkthroughWalkthroughThe pull request updates the ChangesDependency version update
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Contributor
There was a problem hiding this comment.
Pull request overview
This PR updates the github.com/getlantern/domainfront dependency to pick up upstream changes (domainfront#11) related to SNI strategy behavior and certificate verification, without modifying Kindling’s application code.
Changes:
- Bump
github.com/getlantern/domainfronttov0.0.0-20260625001429-518c0256669b. - Update
go.sumchecksums to match the newdomainfrontpseudo-version.
Reviewed changes
Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| go.mod | Updates the required github.com/getlantern/domainfront version. |
| go.sum | Updates module and go.mod hashes for the bumped domainfront version. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
myleshorton
added a commit
to getlantern/radiance
that referenced
this pull request
Jun 25, 2026
…I) (#539) domainfront v0.0.0-...-93591749d736 -> 518c0256669b (getlantern/domainfront#11) kindling v0.0.0-...-737fcffe2860 -> 7cdf7184420c (getlantern/kindling#41) Activates legit SNI for fronting: ExpandedProvider applies the default frontingsnis strategy with no country code (akamai sends arbitrary SNIs globally), preserves a baked-in per-masquerade SNI (aliyun mobgslb), and verifies the SNI-path edge cert against the front Domain (not chain-only). The kindling/fronted packages (which consume domainfront) build and test green. The pre-existing cmd/lantern build break (ipc.NewClient signature) is unrelated to this bump and reproduces on main with these changes stashed. Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
myleshorton
added a commit
to getlantern/lantern
that referenced
this pull request
Jun 25, 2026
) radiance -> v0.0.0-20260625003855-687d6be3d5f0 (getlantern/radiance#539) domainfront -> v0.0.0-20260625001429-518c0256669b (getlantern/domainfront#11) kindling -> v0.0.0-20260625002640-7cdf7184420c (getlantern/kindling#41) Final link in the chain that lets fronting send a legit SNI instead of the conspicuous no-SNI clients use today: ExpandedProvider applies the default frontingsnis strategy with no country code (akamai sends its arbitrary SNIs globally), preserves a baked-in per-masquerade SNI (aliyun www.mobgslb.tbcache.com), and verifies the SNI-path edge cert against the front Domain rather than chain-only. go build/vet clean; only go.mod and go.sum change. Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Bump
getlantern/domainfronttov0.0.0-20260625001429-518c0256669b, picking up domainfront#11.What #11 changes
ExpandedProvidernow resolves each masquerade's SNI so providers can send a legit SNI instead of the conspicuous no-SNI every client uses today (the production client passes no country code, which previously left every provider's arbitrary-SNI strategy inert):defaultfrontingsnis strategy applies even with no country code → akamai sends its arbitrary SNIs (real akamai-customer domains) globally. Validated: 20/20 sampled edges front identically to no-SNI, no regression.www.mobgslb.tbcache.com(the service domain its edges actually accept).No kindling code changes —
build+go test ./...pass.go mod tidyrun;go.mod+go.sumcommitted together.Rollout
Next link in the chain: radiance bumps kindling → lantern bumps radiance. The companion lantern-cloud#2897 sets aliyun's front SNI; both are backward-safe (pre-bump clients omit SNI exactly as today).
🤖 Generated with Claude Code
Summary by CodeRabbit