Kirill Minovsky 129f96db2d feat(fingerprint): give Safari the TLS 1.1/1.0 fallbacks the bundle sends ... `curl_safari155` advertises `GREASE, 0x0304, 0x0303, 0x0302, 0x0301`; ours stopped at 1.2, so Safari's hello was a shape no Safari sends, and `peetprint` — which hashes the version list and the padding that JA4 does not — separated us from the bundle even though JA3 and JA4 matched. The vendored rustls patch gains `ClientHelloProfile::legacy_versions`, written into `supported_versions` behind the configured ones, and the Safari profile lists TLS 1.1 and 1.0 there. Nothing about negotiation changes: rustls still speaks only what the config offers, so a peer that selects 1.1 ends the handshake in `PeerIncompatible::ServerDoesNotSupportTls12Or13` — which the classifier already reads as `NO TLS1.3`, not as a block. Pinned runs (test 2's two columns, test 6's TLS 1.2 axis) drop the fallbacks on the copy they build, because isolating one version is the whole point of those runs. Measured against `tls.peet.ws`: the Safari profile is now identical to `curl_safari155` on JA3, JA4 *and* peetprint (`b2bafdc6…`, was `c8705f31…`), and on the wire test 6 sends `GREASE, 0x0304, 0x0303, 0x0302, 0x0301`, 512 bytes. `PATCH.diff` is regenerated from the crates.io source (741 lines, 7 files) and validated with `patch -p1 --dry-run` against pristine 0.23.43; the copy it replaces had missed the GREASE hooks added later, so the file now matches the tree it claims to describe.		2026-09-14 12:58:36 +03:00
..
dpi-core	feat(fingerprint): give Safari the TLS 1.1/1.0 fallbacks the bundle sends	2026-09-14 12:58:36 +03:00
dpi-detector	feat(burst): finish the attempt with the request, not the handshake	2026-09-14 12:34:52 +03:00