The same ADC/TSG-OS installation guide's built-in factory acceptance test ("tsg-diagnose-oneshot") enumerates the product's certified MITM/content-manipulation actions as standard, tested features of every deployment: SSL interception with expired/self-signed/untrusted-root cert handling, and both SSL and HTTP proxy policies supporting redirect, block, replace, hijack, and insert actions, plus DNS request handling with drop and A/AAAA redirect (including TTL-range variants). This is vendor self-documentation, not inferred behavior.
test_proxyPolicy_ssl_replace ... test_proxyPolicy_ssl_hijack ... test_proxyPolicy_ssl_insert ... test_proxyPolicy_http_replace ... test_proxyPolicy_http_hijack ... test_proxyPolicy_http_insert ... test_dnsRequest_deny_redirect_a_range_ttl ... test_dnsRequest_deny_redirect_aaaa_range_ttl
Defense implications
- Live HTTP/TLS response replace/hijack/insert is a standard, factory-certified capability on every fielded unit, not an exceptional or rare configuration — protocol designs should assume any MITM'd session can have its content actively rewritten, not merely blocked or logged.
- DNS redirect responses support explicit TTL control, so DNS-based circumvention that relies on short client-side caching windows to outrun injected records may not gain much protection here.
Related findings
TSG's own policy API documentation (tsg/tsg-doc) defines dedicated database/API objects for live content manipulation: a content-hijack policy-file table (内容劫持策略文件) with a contentName field, and an injected-script policy-file table (注入脚本) with an insertOn (injection point) field, alongside a block-page (访问阻断页面) policy-file type — confirming content injection and block-page replacement are first-class, documented TSG policy actions.
Session records log MITM-proxy decision fields per session -- proxy_action, proxy_pinning_status, proxy_intercept_status, proxy_cert_verify, proxy_intercept_error, and proxy_passthrough_reason -- alongside security_rule_list/security_action and shaping_rule_list. This confirms, at the OLAP schema level, that TLS-interception outcomes (intercepted vs. passed through, including why -- e.g. detected certificate pinning) are retained per session, corroborating the certstore product's Trusted/Untrusted/Dynamic-Bypass model. Two adjacent columns, sc_rsp_raw/sc_rsp_decrypted, sit next to these but their exact semantics were not confirmed from schema alone.
A 2023 MESA Lab monthly report describes the 'TF' project's active-defense work: test cases for serial ('串联') HTTP hijack/tamper and parallel ('并联') DNS race-injection ('DNS抢答'), performance tuning that scaled active-defense capacity from 3 to 5 units, converting two existing TSG boxes to active-defense mode, and rewriting the active-defense flow-control logic to no longer depend on sapp.
The same 224-column TSG per-session log schema carries a full TLS- interception field set — proxy_pinning_status, proxy_intercept_status, proxy_passthrough_reason, proxy_cert_verify, proxy_intercept_error, sc_rsp_raw and sc_rsp_decrypted (raw vs. decrypted server response content) — plus ssl_esni_flag and ssl_ech_flag (explicit ECH/ESNI-usage flags), ssl_ja3_hash/ssl_ja3s_hash, and ssh_hassh (SSH client fingerprinting), confirming certstore-style MITM interception, ECH/ESNI detection, and TLS/SSH fingerprinting are all first-class fields logged on every session, not experimental add-ons.
A 2023 MESA Lab monthly report (author and advisor names redacted) describes the 'TF' project's active-defense work: testing serial HTTP hijack/tamper and parallel DNS race-injection ('DNS抢答'), scaling active-defense compute boards from 3 to 5, converting two existing TSG units to active-defense mode, and rewriting active-defense flow control to no longer depend on sapp. NOTE: this content is nearly identical to the existing corpus finding 2026-084104-tf-active-defense (artifact 084104aa052e) -- likely the same underlying document ingested under two different artifact IDs; flagged for dedup review.
An internal TSG troubleshooting runbook ("HTTPS证书替换策略无效果") documents the certstore MITM-certificate service actively serving/validating forged certificates keyed by SNI, walking an operator through checking certstore logs for specific real-world domains including Google's update service (update.googleapis.com) and Nvidia's GFE service (services.gfe.nvidia.com), and cross-checking keyring config live via maat_redis_tool.