TLS fingerprint for routing #6054

In Russia, the Internet regulator sent out a manual to owners of popular Russian applications (also government applications) on ways to detect the use of VPN and check access to prohibited resources.
One of the detection methods is the ability to access prohibited resources taking into account the user’s geolocation аnd identifying user IPs that do not belong to the Internet provider
Namely, if the user is located on the territory of Russia and has access to a prohibited resource, then this moment is recorded in the protocol.
The protocol is subsequently sent to the supervisory authority.

For now this is only a recommendation. But taking into account the carblanche of the supervisory authority, this may become a mandatory requirement.

Perhaps in the future, in order to enforce rules locally, DPI will intercept specific packet of a given protocol.
Android allows you to control routing for applications. This is its advantage when trying to analyze request traffic from other applications.
iOS does not allow this functionality.

In order for the VPN client to be able to build routes for other applications, it is worth trying to implement routing according to the following principle:

• TLS fingerprint. Any application on the device has its own handshake formats and thanks to this you can determine which application is trying to access the Internet.

To know the TLS fingerprint, you also need to build in a functionality that will scan the fingerprint and link it to the SNI domain((The native application requests data through the native server and this will be visible by the number of requests and certificate)). Thus, the user can know which fingerprint to apply the VPN access rule to (perhaps this is the responsibility of the VPN application). Or hopes to form a single database of TLS fingerprints .