Fix SNI extraction for fragmented TLS ClientHello messages

[Copilot]

This PR fixes the SNI (Server Name Indication) extraction issue when TLS ClientHello messages are fragmented across multiple TCP segments or TLS records, which commonly occurs with Xray proxy using Chrome fingerprints.

Problem

The original implementation in utils/tls/sni/sni.go only performed a single conn.Read() call to capture the ClientHello message. When Xray uses Chrome fingerprint, the TLS handshake data can be split across multiple reads, causing the SNI extraction to fail with empty hostnames.

Solution

Enhanced the Sniff() function to handle fragmented reads by:

1. Replacing single read with buffered reading: Added readTLSRecords() function that continues reading until complete TLS records are available
2. TLS record parsing: Parses the 5-byte TLS record header to determine the expected record length
3. Robust fragmentation handling: Continues reading data until the complete TLS record is received
4. Data preservation: Ensures all read data is properly buffered and available for connection replay

Key Changes

• Sniff() function: Now uses readTLSRecords() instead of single conn.Read()
• New readTLSRecords() function: Implements intelligent buffering that:
  • Reads TLS record headers to determine expected lengths
  • Handles partial reads gracefully
  • Includes bounds checking for malformed data
  • Preserves backward compatibility

Testing

Added comprehensive tests demonstrating:

• Fragmented reads (1 byte at a time) are handled correctly with multiple Read() calls
• Normal reads remain efficient with single Read() calls
• Data integrity is preserved for connection replay
• All existing functionality continues to work

The fix maintains full backward compatibility while resolving the fragmentation issue reported with Xray Chrome fingerprints.

Fixes #342.

Warning

Firewall rules blocked me from connecting to one or more addresses

I tried to connect to the following addresses, but was blocked by firewall rules:

• example.com
  • Triggering command: /tmp/go-build852115530/b001/exe/test_real_tls (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

---

💬 Share your feedback on Copilot coding agent for the chance to win a $200 gift card! Click here to start the survey.

[Copilot]

@yyyar 👋 This repository doesn't have Copilot instructions. With Copilot instructions, I can understand the repository better, work faster and produce higher quality PRs.

I can generate a .github/copilot-instructions.md file for you automatically. Click here to open a pre-filled issue and assign it to me. I'll write the instructions, and then tag you for review.