From e126032b6126675206e61e8090c336764b901162 Mon Sep 17 00:00:00 2001 From: Philipp Kunz Date: Mon, 17 Mar 2025 13:09:54 +0000 Subject: [PATCH] fix(classes.pp.connectionhandler): Replace unrecognized_name alert data with certificate_expired alert in TLS handshake handling for session resumption without SNI --- changelog.md | 7 +++++++ ts/00_commitinfo_data.ts | 2 +- ts/classes.pp.connectionhandler.ts | 12 +++++++++++- 3 files changed, 19 insertions(+), 2 deletions(-) diff --git a/changelog.md b/changelog.md index 33f42c2..3c0f0a5 100644 --- a/changelog.md +++ b/changelog.md @@ -1,5 +1,12 @@ # Changelog +## 2025-03-17 - 4.1.12 - fix(classes.pp.connectionhandler) +Replace unrecognized_name alert data with certificate_expired alert in TLS handshake handling for session resumption without SNI + +- Switched the alert payload from serverNameUnknownAlertData to a new certificateExpiredAlert buffer +- Now sends a fatal certificate_expired alert (code 47) instead of a warning unrecognized_name alert +- Improves TLS error reporting and encourages immediate disconnection when a ClientHello lacks SNI and session tickets are disallowed + ## 2025-03-17 - 4.1.11 - fix(connectionhandler) Increase delay before cleaning up connections when session resumption is blocked due to missing SNI, allowing more natural socket termination. diff --git a/ts/00_commitinfo_data.ts b/ts/00_commitinfo_data.ts index 20737d9..14581ff 100644 --- a/ts/00_commitinfo_data.ts +++ b/ts/00_commitinfo_data.ts @@ -3,6 +3,6 @@ */ export const commitinfo = { name: '@push.rocks/smartproxy', - version: '4.1.11', + version: '4.1.12', description: 'A powerful proxy package that effectively handles high traffic, with features such as SSL/TLS support, port proxying, WebSocket handling, dynamic routing with authentication options, and automatic ACME certificate management.' } diff --git a/ts/classes.pp.connectionhandler.ts b/ts/classes.pp.connectionhandler.ts index 36901db..30722ff 100644 --- a/ts/classes.pp.connectionhandler.ts +++ b/ts/classes.pp.connectionhandler.ts @@ -605,10 +605,20 @@ export class ConnectionHandler { 0x00, // close_notify alert (0) ]); + const certificateExpiredAlert = Buffer.from([ + 0x15, // Alert record type + 0x03, + 0x03, // TLS 1.2 version + 0x00, + 0x02, // Length + 0x02, // Fatal alert level (2) + 0x2F, // certificate_expired alert (47) + ]); + try { // Use cork/uncork to ensure the alert is sent as a single packet socket.cork(); - const writeSuccessful = socket.write(serverNameUnknownAlertData); + const writeSuccessful = socket.write(certificateExpiredAlert); socket.uncork(); // Function to handle the clean socket termination - but more gradually