Address STARTTLS handshake failure for picky STARTTLS servers (WIP) #2956
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There seem to be some server who don't provide proper handshake results when we send the whole handshake data to them, including ALPN.
So, what we do is removing the ALPN extension from the stream of heax bytes when we test STARTTLS host. Plan is to do that for all in
client_simulation_sockets()also probably this won't be needed for firefox and friends.The approach is following:
We need to find the proper hexcode string in the passed data. Proper way would be going from
extension to extension with the top level length of each extension until we reach ALPN (0x10).
That seemed to difficult. We do that differently which has a threoretic catch as we might also
similar patterns -- but as we have the handshake data as hex we can make sure. What we do is
finding the leading bytes of the ALPN extension and concatenate all byte string we know of,
and match that. In addition we have the alpn+= text in the client simulation data to check against.
Scheme is alpn_ext, then come three lengths. We know each length so we can concatenate
all values and search for them, and additionally match the extensions with the text form
in TESTSSL_INSTALL_DIR/etc/client-simulation.txt.
The lengths are
This is a WIP, and at the moment only a skeleton
It would fix #2410 when finished.
What is your pull request about?
If it's a code change please check the boxes which are applicable
help()