mirror of
https://github.com/refraction-networking/utls.git
synced 2025-04-03 03:57:36 +03:00
Update fingerprints + add default spec version (#25)
Update fingerprints + add default spec version
* Adds fingerprints for Chrome 75, iOS 12.1, and Firefox 65(=Firefox 63)
* If min/max tls versions are not explicitly specified in the ClientHelloSpec,
uTLS will try to parse versions from SupportedVersions extension,
and fallback to [TLS 1.0, TLS 1.2] if SupportedVersions is absent.
* Adds mimicked FakeRecordSizeLimitExtension and FakeCertCompressionAlgsExtension
to be used instead of GenericExtension{} for clarity and extensibility
(we are ready to use those with Firefox and Chrome fps with correct values
whenever actual functionality is implemented)
* SetTLSVers: parse the right extensions + cosmetics
This commit is contained in:
sergeyfrolov
GitHub
parent
05163f8a36
commit
b7c656eec2
5 changed files with 310 additions and 46 deletions
149
u_parrots.go
149
u_parrots.go
|
|
@ -133,7 +133,81 @@ func utlsIdToSpec(id ClientHelloID) (ClientHelloSpec, error) {
|
|||
CurveP256,
|
||||
CurveP384,
|
||||
}},
|
||||
&GenericExtension{id: fakeCertCompressionAlgs, data: []byte{02, 00, 02}},
|
||||
&FakeCertCompressionAlgsExtension{[]CertCompressionAlgo{CertCompressionBrotli}},
|
||||
&UtlsGREASEExtension{},
|
||||
&UtlsPaddingExtension{GetPaddingLen: BoringPaddingStyle},
|
||||
},
|
||||
}, nil
|
||||
case HelloChrome_72:
|
||||
return ClientHelloSpec{
|
||||
CipherSuites: []uint16{
|
||||
GREASE_PLACEHOLDER,
|
||||
TLS_AES_128_GCM_SHA256,
|
||||
TLS_AES_256_GCM_SHA384,
|
||||
TLS_CHACHA20_POLY1305_SHA256,
|
||||
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
|
||||
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
|
||||
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
|
||||
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
|
||||
TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,
|
||||
TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,
|
||||
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
|
||||
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
|
||||
TLS_RSA_WITH_AES_128_GCM_SHA256,
|
||||
TLS_RSA_WITH_AES_256_GCM_SHA384,
|
||||
TLS_RSA_WITH_AES_128_CBC_SHA,
|
||||
TLS_RSA_WITH_AES_256_CBC_SHA,
|
||||
TLS_RSA_WITH_3DES_EDE_CBC_SHA,
|
||||
},
|
||||
CompressionMethods: []byte{
|
||||
0x00, // compressionNone
|
||||
},
|
||||
Extensions: []TLSExtension{
|
||||
&UtlsGREASEExtension{},
|
||||
&SNIExtension{},
|
||||
&UtlsExtendedMasterSecretExtension{},
|
||||
&RenegotiationInfoExtension{renegotiation: RenegotiateOnceAsClient},
|
||||
&SupportedCurvesExtension{[]CurveID{
|
||||
CurveID(GREASE_PLACEHOLDER),
|
||||
X25519,
|
||||
CurveP256,
|
||||
CurveP384,
|
||||
}},
|
||||
&SupportedPointsExtension{SupportedPoints: []byte{
|
||||
0x00, // pointFormatUncompressed
|
||||
}},
|
||||
&SessionTicketExtension{},
|
||||
&ALPNExtension{AlpnProtocols: []string{"h2", "http/1.1"}},
|
||||
&StatusRequestExtension{},
|
||||
&SignatureAlgorithmsExtension{SupportedSignatureAlgorithms: []SignatureScheme{
|
||||
ECDSAWithP256AndSHA256,
|
||||
PSSWithSHA256,
|
||||
PKCS1WithSHA256,
|
||||
ECDSAWithP384AndSHA384,
|
||||
PSSWithSHA384,
|
||||
PKCS1WithSHA384,
|
||||
PSSWithSHA512,
|
||||
PKCS1WithSHA512,
|
||||
PKCS1WithSHA1,
|
||||
}},
|
||||
&SCTExtension{},
|
||||
&KeyShareExtension{[]KeyShare{
|
||||
{Group: CurveID(GREASE_PLACEHOLDER), Data: []byte{0}},
|
||||
{Group: X25519},
|
||||
}},
|
||||
&PSKKeyExchangeModesExtension{[]uint8{
|
||||
PskModeDHE,
|
||||
}},
|
||||
&SupportedVersionsExtension{[]uint16{
|
||||
GREASE_PLACEHOLDER,
|
||||
VersionTLS13,
|
||||
VersionTLS12,
|
||||
VersionTLS11,
|
||||
VersionTLS10,
|
||||
}},
|
||||
&FakeCertCompressionAlgsExtension{[]CertCompressionAlgo{
|
||||
CertCompressionBrotli,
|
||||
}},
|
||||
&UtlsGREASEExtension{},
|
||||
&UtlsPaddingExtension{GetPaddingLen: BoringPaddingStyle},
|
||||
},
|
||||
|
|
@ -186,7 +260,7 @@ func utlsIdToSpec(id ClientHelloID) (ClientHelloSpec, error) {
|
|||
},
|
||||
GetSessionID: nil,
|
||||
}, nil
|
||||
case HelloFirefox_63:
|
||||
case HelloFirefox_63, HelloFirefox_65:
|
||||
return ClientHelloSpec{
|
||||
TLSVersMin: VersionTLS10,
|
||||
TLSVersMax: VersionTLS13,
|
||||
|
|
@ -254,7 +328,7 @@ func utlsIdToSpec(id ClientHelloID) (ClientHelloSpec, error) {
|
|||
PKCS1WithSHA1,
|
||||
}},
|
||||
&PSKKeyExchangeModesExtension{[]uint8{pskModeDHE}},
|
||||
&GenericExtension{id: fakeRecordSizeLimit, data: []byte{0x40, 0x01}},
|
||||
&FakeRecordSizeLimitExtension{0x4001},
|
||||
&UtlsPaddingExtension{GetPaddingLen: BoringPaddingStyle},
|
||||
}}, nil
|
||||
case HelloIOS_11_1:
|
||||
|
|
@ -316,6 +390,68 @@ func utlsIdToSpec(id ClientHelloID) (ClientHelloSpec, error) {
|
|||
}},
|
||||
},
|
||||
}, nil
|
||||
case HelloIOS_12_1:
|
||||
return ClientHelloSpec{
|
||||
CipherSuites: []uint16{
|
||||
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
|
||||
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
|
||||
DISABLED_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,
|
||||
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,
|
||||
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
|
||||
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
|
||||
TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,
|
||||
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
|
||||
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
|
||||
DISABLED_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,
|
||||
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,
|
||||
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
|
||||
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
|
||||
TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,
|
||||
TLS_RSA_WITH_AES_256_GCM_SHA384,
|
||||
TLS_RSA_WITH_AES_128_GCM_SHA256,
|
||||
DISABLED_TLS_RSA_WITH_AES_256_CBC_SHA256,
|
||||
TLS_RSA_WITH_AES_128_CBC_SHA256,
|
||||
TLS_RSA_WITH_AES_256_CBC_SHA,
|
||||
TLS_RSA_WITH_AES_128_CBC_SHA,
|
||||
0xc008,
|
||||
TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,
|
||||
TLS_RSA_WITH_3DES_EDE_CBC_SHA,
|
||||
},
|
||||
CompressionMethods: []byte{
|
||||
compressionNone,
|
||||
},
|
||||
Extensions: []TLSExtension{
|
||||
&RenegotiationInfoExtension{renegotiation: RenegotiateOnceAsClient},
|
||||
&SNIExtension{},
|
||||
&UtlsExtendedMasterSecretExtension{},
|
||||
&SignatureAlgorithmsExtension{SupportedSignatureAlgorithms: []SignatureScheme{
|
||||
ECDSAWithP256AndSHA256,
|
||||
PSSWithSHA256,
|
||||
PKCS1WithSHA256,
|
||||
ECDSAWithP384AndSHA384,
|
||||
ECDSAWithSHA1,
|
||||
PSSWithSHA384,
|
||||
PSSWithSHA384,
|
||||
PKCS1WithSHA384,
|
||||
PSSWithSHA512,
|
||||
PKCS1WithSHA512,
|
||||
PKCS1WithSHA1,
|
||||
}},
|
||||
&StatusRequestExtension{},
|
||||
&NPNExtension{},
|
||||
&SCTExtension{},
|
||||
&ALPNExtension{AlpnProtocols: []string{"h2", "h2-16", "h2-15", "h2-14", "spdy/3.1", "spdy/3", "http/1.1"}},
|
||||
&SupportedPointsExtension{SupportedPoints: []byte{
|
||||
pointFormatUncompressed,
|
||||
}},
|
||||
&SupportedCurvesExtension{[]CurveID{
|
||||
X25519,
|
||||
CurveP256,
|
||||
CurveP384,
|
||||
CurveP521,
|
||||
}},
|
||||
},
|
||||
}, nil
|
||||
default:
|
||||
return ClientHelloSpec{}, errors.New("ClientHello ID " + id.Str() + " is unknown")
|
||||
}
|
||||
|
|
@ -349,7 +485,8 @@ func (uconn *UConn) applyPresetByID(id ClientHelloID) (err error) {
|
|||
// same ClientHelloSpec. It is advised to use different specs and avoid any shared state.
|
||||
func (uconn *UConn) ApplyPreset(p *ClientHelloSpec) error {
|
||||
var err error
|
||||
err = uconn.SetTLSVers(p.TLSVersMin, p.TLSVersMax)
|
||||
|
||||
err = uconn.SetTLSVers(p.TLSVersMin, p.TLSVersMax, p.Extensions)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
|
@ -640,10 +777,6 @@ func (uconn *UConn) generateRandomizedSpec() (ClientHelloSpec, error) {
|
|||
r.rand.Shuffle(len(p.Extensions), func(i, j int) {
|
||||
p.Extensions[i], p.Extensions[j] = p.Extensions[j], p.Extensions[i]
|
||||
})
|
||||
err = uconn.SetTLSVers(p.TLSVersMin, p.TLSVersMax)
|
||||
if err != nil {
|
||||
return p, err
|
||||
}
|
||||
|
||||
return p, nil
|
||||
}
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue