maskit commented on PR #13809: URL: https://github.com/apache/trafficserver/pull/13809#issuecomment-6069758432
Instead of adding a second API, could we fix `get_extension_types()` itself on OpenSSL? On OpenSSL the existing list is wrong for fingerprinting in general, not just for JA4. Any fingerprint that counts or hashes extension types expects every type on the wire except GREASE. BoringSSL's `get_extension_types()` already gives that, because it walks the raw extensions buffer. The description keeps the old semantics so that JA3 output doesn't change. But on OpenSSL that output is off in the same way: it misses ALPS for Chrome, and it differs from the same plugin on BoringSSL. jax_fingerprint filters GREASE itself, so nothing depends on OpenSSL leaving GREASE out. The doc for `get_extension_types()` also already promises "a consistent interface regardless of the SSL library in use", which OpenSSL doesn't meet today. If the OpenSSL branch of `ClientHello::begin()`/`end()` returns `_raw_extension_types` when the raw message parsed, and falls back to `SSL_client_hello_get1_extensions_present` otherwise, every method picks up the fix with no plugin changes. The PR could then drop `TSRawExtensionTypeList`, `get_extension_types_raw()`, `raw_begin()`/`raw_end()`, the two `InkAPI.cc` iterators, and the change to `ja4/tls_client_hello_summary.cc`. The message callback, the parser, and both tests stay as they are. This changes behavior that shipped in 10.2.0, since the API came from PR 12914 and was backported to 10.2.x. It only affects OpenSSL builds, and it only adds entries. JA3 values on OpenSSL will change for clients that send extensions OpenSSL doesn't recognize, so it should get a release note. Separately, and not related to JA3, JA4 or jax_fingerprint: one small doc request. On OpenSSL, `TSClientHelloExtensionGet()` still only returns extensions OpenSSL recognizes, because `SSL_client_hello_get0_ext` reads the same parsed table. After this change the type list can include ALPS while `TSClientHelloExtensionGet(ch, 0x4469, ...)` returns `TS_ERROR`. jax_fingerprint isn't affected, because it never fetches the contents of those extensions. A note in `TSClientHello.en.rst` would just tell other plugin authors about the mismatch. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
