<html><body><div dir="ltr"><div>
</div><div><div>
<div>Hello,</div><div dir="ltr"><br></div><div dir="ltr">Can you confirm, you say the alert is coming from a non-java server, or are you saying your modified handshake is rejected by a Java server? (Or do you think the alert is not received?)<span style="font-size: inherit;">.</span></div><div dir="ltr"><br></div><div dir="ltr">I would turn on ssl debug logging and upload the traces to a gist sharing side so we can review the actual content. You can also check the servers logs why it rejects it.</div><div dir="ltr"><br></div><div dir="ltr">(It’s strange that you set two ALPN strings but only one is in your excerpt?)</div><div dir="ltr"><br></div><div dir="ltr">Gruss</div><div dir="ltr">Bernd</div><div id="ms-outlook-mobile-signature"><div style="direction:ltr">-- </div><div style="direction:ltr">http://bernd.eckenfels.net</div></div>
</div>
<div> </div><hr style="display:inline-block;width:98%" tabindex="-1"><div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif"><b>Von:</b> security-dev <security-dev-retn@openjdk.org> im Auftrag von Filip Petr. <filipakanation@gmail.com><br><b>Gesendet:</b> Donnerstag, August 31, 2023 4:02 PM<br><b>An:</b> security-dev@openjdk.org <security-dev@openjdk.org><br><b>Betreff:</b> Modification of Client hello TLS packet<div> </div></font></div><div dir="ltr">My goal is for a community of automation experts to have a perfectly matched Client hello (JA3 hash) fingerprint as modern commercial browsers so they can do their job more successfully. For this to happen one must add 8 additional extensions to the Client hello request. Those changes were done under /sun/security/ssl. Mostly modifying SSLExtension.java file by adding additional extensions. My goal is to have perfectly working adjusted extensions and to use TLS1.3 on top of that. The extensions that my Java client using standard Java net library had prior me adding new ones were:<br>1.key_share<div>2. signature_algorithms_cert</div><div>3. psk_key_exchange_modes</div><div>4. supported_versions </div><div>5. signature_algorithms</div><div>6. application_layer_protocol_negotiation</div><div>7. supported_group</div><div>8. status_request</div><div>9. server_name</div><div><br></div><div>After the change to match Chrome's extensions it became:<br>1. TLS_GREASE (0x5a5a)</div><div>2. status_request</div><div>3. ec_point_formats</div><div>4. supported_groups</div><div>5. signed_certificate_timestamp</div><div>6. application_settings</div><div>7. server_name</div><div>8. application_layer_protocol_negotiation</div><div>9. key_share</div><div>10. extended_master_secret</div><div>11. extensionRenegotiationInfo</div><div>12. session_ticket</div><div>13. supported_versions</div><div>14. signature_algorithms</div><div>15. psk_key_exchange_modes</div><div>16. TLS_GREASE (0x3a3a)</div><div>17. padding</div><div><br></div><div>The reason for me making this post is because when I add application_settings extension, the module doesn't work for certain websites such as for google domains and for some it works perfectly fine. I analysed in Wireshark the requests they were all properly done but for some weird reason, Java gives back following exceptions once I encounter some sites it crashes on</div><div><br></div><div>1. Received fatal alert: decode_error<br>2. Unknown handshake type size, Handshake.msg_type = 25<br>3. Received fatal alert: unexpected_message<br></div><div><br></div><div><br></div><div>Unfortunately I don't know how to track fatal alerts and their cores so I'm not sure how I can handle this. Why does Java crash on this simple extension such as application_settings? It holds nothing but following</div><div><pre style="color: rgb(0, 0, 0);"> {
"name": "application_settings (17513)",
"protocols": [
"h2"
]
}</pre><pre style=""><font style="color: rgb(0, 0, 0);">
</font><font face="Arial, Helvetica, sans-serif"><span style="">That's pretty much it. Once I remove this extension, the module works just fine with the rest added ones. I should add on top that i do these 2 following lines as my ssl configuration prior creating java client</span></font></pre><pre style="">sslParams.setApplicationProtocols(new String[] {"h2", "http/11"});<br>sslParams.setProtocols(new String[]{"TLSv1.3"});<font face="Arial, Helvetica, sans-serif"><span style=""><br></span></font></pre><pre style="">Any help would be welcome! Thanks in advance!</pre></div></div>
</div></div></body></html>