bneradt opened a new pull request, #13809: URL: https://github.com/apache/trafficserver/pull/13809
On OpenSSL builds, TSClientHello::get_extension_types() only reports the extensions OpenSSL recognizes. GREASE values and unknown types such as ALPS (0x4469) or ECH on older OpenSSL never make it into OpenSSL's parsed ClientHello table, so they cannot be recovered through any OpenSSL ClientHello accessor. As a result, jax_fingerprint computes a JA4 for Chrome of t13d1515h2 instead of the t13d1516h2 that Wireshark and other JA4 implementations report for the same connection. This patch records the extension types from the raw ClientHello message on OpenSSL, using a message callback that runs before the ClientHello callback and is removed once the handshake completes. A new additive plugin API, TSClientHello::get_extension_types_raw(), exposes that list in wire order, GREASE included. BoringSSL already walks the raw extensions buffer, so its raw and existing lists are the same. The semantics of get_extension_types() are unchanged so that existing plugins, such as the jax_fingerprint JA3 method, keep producing the same fingerprints. The jax_fingerprint JA4 method now uses the raw list. A Catch2 test covers the ClientHello parser and a new autest sends a Chrome-shaped ClientHello and verifies the resulting JA4. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
