Censors Ignore Unencrypted HTTP/2 Traffic (2024)

The obvious follow-up is to then put a (possibly obfuscated) TLS connection in the request and response bodies, creating another tunneling method.

This is already being done, but the GFW can detect even some pretty clever obfuscation attempts, they even look at TCP timings and all kinds of things you might not think about. Even if the inner traffic is completely encrypted, there are other ways to tell with a degree of probability that the connection is likely a tunnel, and they'll block it.