Kirill Minovsky c12dd28d0d fix(tls): a version-pinned hello drops the other version's shape ... A column that pins TLS 1.3 rewrote `supported_versions` and nothing else, so the hello advertised one version while still carrying the other's extensions and cipher suites: Chrome 107 and Safari 15.5 kept `extended_master_secret`, `renegotiation_info`, `ec_point_formats` and `session_ticket` plus the whole TLS 1.2 cipher list, and a 1.2 hello kept `supported_versions`, ALPS and the padding a hello that short has no use for. That shape exists nowhere. Read off the `curl-impersonate v2.2.2` bundles pinned the same way (`--tlsv1.3 --tls-max 1.3`, `--tls-max 1.2`) through a local ClientHello sniffer, the bundles drop exactly those, and our pinned 1.3 hellos are now byte-identical to theirs — same cipher list, same extension list in the same order, same 512-byte size. `standby-rezka.tv` answers the hybrid with `alert_illegal_parameter`; it answers the bundle's 200. `fingerprint::pinned_drop` holds the per-profile table (Firefox keeps `extended_master_secret` and `renegotiation_info` at 1.3, so it is not one rule for all three), and `apply_profile` applies it through `suppress_extensions` — an extension merely missing from `extension_order` is still emitted, only later, and one the profile supplies verbatim would come from `raw_extensions` — plus a cipher-suite filter. The 1.2 builder loses the padding extension too, matching the bundles' 198/210-byte 1.2 hellos against our 185/199. Two gaps stay documented: `compress_certificate` cannot be offered in a 1.2 hello (rustls offers it only when 1.3 is offered as well), so those constants stop one extension short of the bundles, and Firefox's 1.3 hello still omits ECH. JA4's version field now falls back to the ClientHello's legacy version when a hello carries no `supported_versions`: a 1.2-only browser hello is not a TLS 1.0 client, which is what the field said before. The harness gains `dump13`/`dump12` so the pinned shapes can be dumped without a network.		2026-09-14 17:45:25 +03:00
..
dpi-core	fix(tls): a version-pinned hello drops the other version's shape	2026-09-14 17:45:25 +03:00
dpi-detector	feat(classify,cli): name TLS-stack failures, fix the site-family redirect rule, trace test 6	2026-09-14 16:22:40 +03:00