Skip to content

Conversation

@drwetter
Copy link
Collaborator

@drwetter drwetter commented Nov 24, 2025

There seem to be some server who don't provide proper handshake results when we send the whole handshake data to them, including ALPN.

So, what we do is removing the ALPN extension from the stream of heax bytes when we test STARTTLS host. Plan is to do that for all in client_simulation_sockets() also probably this won't be needed for firefox and friends.

The approach is following:

We need to find the proper hexcode string in the passed data. Proper way would be going from
extension to extension with the top level length of each extension until we reach ALPN (0x10).
That seemed to difficult. We do that differently which has a threoretic catch as we might also
similar patterns -- but as we have the handshake data as hex we can make sure. What we do is
finding the leading bytes of the ALPN extension and concatenate all byte string we know of,
and match that. In addition we have the alpn+= text in the client simulation data to check against.
Scheme is alpn_ext, then come three lengths. We know each length so we can concatenate
all values and search for them, and additionally match the extensions with the text form
in TESTSSL_INSTALL_DIR/etc/client-simulation.txt.
The lengths are

  • total length of extension
  • same as above but minus 2
  • the first extension length, i.e. 02 for h2 and 08 for http/1.1x" also: next one is always an h (0x68).

This is a WIP, and at the moment only a skeleton

It would fix #2410 when finished.

What is your pull request about?

  • Bug fix
  • Improvement
  • New feature (adds functionality)
  • Breaking change (bug fix, feature or improvement that would cause existing functionality to not work as expected)
  • Typo fix
  • Documentation update
  • Update of other files

If it's a code change please check the boxes which are applicable

  • For the main program: My edits contain no tabs, indentation is five spaces and any line endings do not contain any blank chars
  • I've read CONTRIBUTING.md and Coding_Convention.md
  • I have tested this fix or improvement against >=2 hosts and I couldn't spot a problem
  • I have tested this new feature against >=2 hosts which show this feature and >=2 host which does not (in order to avoid side effects) . I couldn't spot a problem
  • For the new feature I have made corresponding changes to the documentation and / or to help()
  • If it's a bigger change: I added myself to CREDITS.md (alphabetical order) and the change to CHANGELOG.md

There seem to be some server who don't provide proper handshake
results when we send the whole handshake data to them, including
ALPN.

So, what we do is removing the ALPN extension from the stream of
heax bytes when we test STARTTLS host. Plan is to do that for all
in `client_simulation_sockets()` also probably this won't be needed
for firefox and friends.

The approach is following:

  We need to find the proper hexcode string in the passed data. Proper way would be going from
  extension to extension with the top level length of each extension until we reach ALPN (0x10).
  That seemed to difficult. We do that differently which has a threoretic catch as we might also
  similar patterns -- but as we have the handshake data as hex we can make sure. What we do is
  finding the leading bytes of the ALPN extension and concatenate all byte string we know of,
  and match that. In addition we have the alpn+= text in the client simulation data to check against.
  Scheme is alpn_ext, then come three lengths. We know each length so we can concatenate
  all values and search for them, and additionally match the extensions with the text form
  in TESTSSL_INSTALL_DIR/etc/client-simulation.txt.
  The lengths are
  - \#1: total length of extension
  - \#2: same as above but minus 2
  - \#3: the first extension length, i.e. 02 for h2 and 08 for http/1.1x"
  also: next one is always an h (0x68).

This is a WIP.

It would fix #2410 when finished.
@drwetter drwetter marked this pull request as draft November 24, 2025 17:48
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Client simulations send inappropriate ALPN to non-http services

2 participants