utls | Go Ecosystem Directory

Added HelloChrome_100_PSK and HelloChrome_112_PSK_Shuf, which includes PreSharedKey automatically instead of Padding as the last TLS extensions.

To use them correctly, you are required to use (*UConn).ApplyPreset():

conn := utls.UClient(plainConn, utlsConfig, utls.HelloCustom)
preset, err := utls.UTLSIdToSpec(utls.HelloChrome_112_PSK_Shuf) // correct
if err != nil {
	return nil, err
}
if pskExt, ok := preset.Extensions[len(preset.Extensions)-1].(*utls.FakePreSharedKeyExtension); ok {
	pskExt.PskIdentities = []utls.PskIdentity{ // must set identity
		{
			Label:               []byte("blahblahblah"), // change this
			ObfuscatedTicketAge: 0, // change this
		},
	}
	// each fake binder is 32 bytes of zeros
	pskExt.PskBinders = [][]byte{ // must set psk binders
		{
			0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,  // change this
		},
	} // byte slices
}
conn.ApplyPreset(&preset) // make sure to apply preset to the connection

Instead of

conn := utls.UClient(plainConn, utlsConfig, utls.HelloChrome_112_PSK_Shuf) // incorrect! PSK extension will use empty payload!

New Contributors

@fqrious made their first contribution in https://github.com/refraction-networking/utls/pull/175
@blakebyrnes made their first contribution in https://github.com/refraction-networking/utls/pull/178

Full Changelog: https://github.com/refraction-networking/utls/compare/v1.3.1...v1.3.2

utls - v1.3.1 Hotfix: InsecureServerNameToVerify for loadSession

Published by gaukas over 1 year ago

What's Changed

Add InsecureSkipTimeVerify by @molon in https://github.com/refraction-networking/utls/pull/174

New Contributors

@molon made their first contribution in https://github.com/refraction-networking/utls/pull/174

Full Changelog: https://github.com/refraction-networking/utls/compare/v1.3.0...v1.3.1

utls - v1.3.0 Update: Security, and Compatibility

Published by gaukas over 1 year ago

What's Changed

build(deps): bump golang.org/x/net from 0.5.0 to 0.7.0 by @dependabot in https://github.com/refraction-networking/utls/pull/165
crypto/tls: reject change_cipher_spec record after handshake in TLS 1.3 by @RPRX in https://github.com/refraction-networking/utls/pull/170
crypto/tls: set const maxUselessRecords to 32 (the same with OpenSSL) by @RPRX in https://github.com/refraction-networking/utls/pull/171
Sync with upstream: Go 1.19.6 (no new change in 1.19.7) by @gaukas in https://github.com/refraction-networking/utls/pull/172
feat: Convert raw bytes or tlsfingerprint record to ClientHelloSpec by @gaukas and @gfw-report in https://github.com/refraction-networking/utls/pull/168

New Contributors

@dependabot made their first contribution in https://github.com/refraction-networking/utls/pull/165

Important Notice

#170 and #171 patched vulnerabilities allowing a strong attacker to detect and break uTLS (and Go's crypto/tls) connections. Please consider updating your go.mod to use the latest version of uTLS.

Full Changelog: https://github.com/refraction-networking/utls/compare/v1.2.2...v1.3.0

utls - v1.2.2 Hotfix: Allow custom weights in generateRandomizedSpec()

Published by gaukas over 1 year ago

What's Changed

Customable weights used in generateRandomizedSpec() by @RPRX in https://github.com/refraction-networking/utls/pull/163

Full Changelog: https://github.com/refraction-networking/utls/compare/v1.2.1...v1.2.2

utls - v1.2.1 Improvements and Fix

Published by gaukas over 1 year ago

What's Changed

Fix Client Certificate Verification when Using Extended Master Secret by @DunyaKokoschka in https://github.com/refraction-networking/utls/pull/143
Bugfix: FingerprintClientHello should work when the dump contains the… by @svmk in https://github.com/refraction-networking/utls/pull/121
Misspelling ? by @githuu5y5u in https://github.com/refraction-networking/utls/pull/154
Add randomized clientHello generation in UTLSIdToSpec. by @fedosgad in https://github.com/refraction-networking/utls/pull/155
Support randomized with non-nil seed in UTLSIdToSpec by @RPRX in https://github.com/refraction-networking/utls/pull/157
add InsecureSkipServerNameVerify to tls.Config by @TNQOYxNU in https://github.com/refraction-networking/utls/pull/158
Replace InsecureSkipServerNameVerify with InsecureServerNameToVerify by @RPRX in https://github.com/refraction-networking/utls/pull/161
update go.mod by @gaukas in https://github.com/refraction-networking/utls/pull/153
Bump HelloChrome_Auto version by @gaukas in https://github.com/refraction-networking/utls/pull/162

New Contributors

@DunyaKokoschka made their first contribution in https://github.com/refraction-networking/utls/pull/143
@svmk made their first contribution in https://github.com/refraction-networking/utls/pull/121
@githuu5y5u made their first contribution in https://github.com/refraction-networking/utls/pull/154
@RPRX made their first contribution in https://github.com/refraction-networking/utls/pull/157
@TNQOYxNU made their first contribution in https://github.com/refraction-networking/utls/pull/158

Full Changelog: https://github.com/refraction-networking/utls/compare/v1.2.0...v1.2.1

We will not sync with upstream crypto/tls until the next tagged version.

utls - v1.2.0 Refactored and Made Anew

Published by gaukas almost 2 years ago

TL;DR

This update includes some major refactorizations and improvements, ALPS (ApplicationSettingsExtension) support, and included a new experimental anti-fingerprinting fingerprint from Chrome/Chromium.