maskit commented on PR #13725: URL: https://github.com/apache/trafficserver/pull/13725#issuecomment-5824723899
@bneradt Thanks for the review. I added a live ClientHello regression test in 4197793 (`tests/gold_tests/pluginTest/jax_fingerprint/jax_fingerprint_sigalgs.test.py`). - It opens three `openssl s_client` connections that differ only in `-sigalgs`: two algorithms, the same two in reverse order, and then one more. It checks that `a` and `b` are identical across them and that each `c` differs from the others. - It uses `s_client` instead of `ATSReplayTest` because I couldn't find a way to set the client's signature algorithms in Proxy Verifier. - It doesn't hard-code fingerprint values, since the client's extension list depends on its OpenSSL version. - I confirmed it fails when the extension lookup is broken: with `get_extension_hash()` asking for a nonexistent extension, all three connections got the same `c`. - Separately, I checked the logged values by hand against JA4 computed from the same ClientHellos (`s_client -trace`). `a`, `b`, and `c` all matched. The test only covers jax_fingerprint. ja4_fingerprint has other mismatches that aren't part of this change (#13727), and the recommendation there is to switch to jax_fingerprint. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
