c6350e271afix(ConnectionHandler): Use the correct TLS alert data and increase the delay before socket termination when session resumption without SNI is detected.Philipp Kunz2025-03-17 13:19:18 +00:00
35f6739b3cfix(tls-handshake): Set certificate_expired TLS alert level to warning instead of fatal to allow graceful termination.Philipp Kunz2025-03-17 13:15:12 +00:00
e126032b61fix(classes.pp.connectionhandler): Replace unrecognized_name alert data with certificate_expired alert in TLS handshake handling for session resumption without SNIPhilipp Kunz2025-03-17 13:09:54 +00:00
e8639e1b01fix(connectionhandler): Increase delay before cleaning up connections when session resumption is blocked due to missing SNI, allowing more natural socket termination.Philipp Kunz2025-03-17 13:00:02 +00:00
f72db86e37fix(ConnectionHandler): Replace closeNotify alert with handshake failure alert in TLS ClientHello handling to properly signal missing SNI and enforce session ticket restrictions.Philipp Kunz2025-03-16 14:13:35 +00:00
1c34578c36fix(ConnectionHandler/tls): Change the TLS alert sent when a ClientHello lacks SNI: use the close_notify alert instead of handshake_failure to prompt immediate retry with SNI.Philipp Kunz2025-03-16 14:02:18 +00:00
67ddf97547fix(classes.pp.connectionhandler): Improve TLS alert handling in ClientHello when SNI is missing and session tickets are disallowedPhilipp Kunz2025-03-16 13:47:34 +00:00
2b6464acd5fix(tls): Refine TLS ClientHello handling when allowSessionTicket is false by replacing extensive alert timeout logic with a concise warning alert and short delay, encouraging immediate client retry with proper SNIPhilipp Kunz2025-03-16 13:28:48 +00:00
9dd402054dfix(TLS/ConnectionHandler): Improve handling of TLS session resumption without SNI by sending an unrecognized_name alert instead of immediately terminating the connection. This change adds a grace period for the client to retry the handshake with proper SNI and cleans up the connection if no valid response is received.Philipp Kunz2025-03-16 13:19:37 +00:00
cad0e6a2b2fix(ConnectionHandler): Refactor ConnectionHandler code formatting for improved readability and consistency in log messages and whitespace handlingPhilipp Kunz2025-03-15 19:10:54 +00:00
ee79f9ab7cfix(connectionhandler): Improve handling of TLS ClientHello messages when allowSessionTicket is disabled and no SNI is provided by sending a warning alert (unrecognized_name, code 0x70) with a proper callback and delay to ensure the alert is transmitted before closing the connection.Philipp Kunz2025-03-15 18:51:50 +00:00
97982976c8fix(connectionhandler): Send proper TLS alert before terminating connections when SNI is missing and session tickets are disallowed.Philipp Kunz2025-03-15 17:16:18 +00:00
9aa747b5d4feat(SniHandler): Enhance SNI extraction to support session caching and tab reactivation by adding session cache initialization, cleanup and helper methods. Update processTlsPacket to use cached SNI for session resumption and connection racing scenarios.Philipp Kunz2025-03-14 11:34:52 +00:00
baaee0ad4dfix(portproxy): Enforce TLS handshake and SNI validation on port 443 by blocking non-TLS connections and terminating session resumption attempts without SNI when allowSessionTicket is disabled.Philipp Kunz2025-03-12 10:27:25 +00:00
ab1ec84832fix(tls/sni): Improve logging for TLS session resumption by extracting and logging SNI values from ClientHello messages.Philipp Kunz2025-03-12 10:01:54 +00:00
1a90566622fix(TLS/SNI): Improve TLS session resumption handling and logging. Now, session resumption attempts are always logged with details, and connections without a proper SNI are rejected when allowSessionTicket is disabled. In addition, empty SNI extensions are explicitly treated as missing, ensuring stricter and more consistent TLS handshake validation.Philipp Kunz2025-03-12 09:56:21 +00:00
62a3e1f4b7fix(SniHandler): Improve TLS SNI session resumption handling: connections containing a session ticket are now only rejected when no SNI is present and allowSessionTicket is disabled. Updated return values and logging for clearer resumption detection.Philipp Kunz2025-03-11 19:38:41 +00:00
29d28fba93feat(SniHandler): Add session cache support and tab reactivation detection to improve SNI extraction in TLS handshakesPhilipp Kunz2025-03-11 18:05:20 +00:00
415b82a84afix(PortProxy): Improve SNI extraction handling in PortProxy by passing explicit connection info to extractSNIWithResumptionSupport for better TLS renegotiation and debug logging.Philipp Kunz2025-03-11 17:37:43 +00:00
0e12706176feat(SniHandler): Enhance SNI extraction to support fragmented ClientHello messages, TLS 1.3 early data, and improved PSK parsingPhilipp Kunz2025-03-11 17:33:31 +00:00
36e4341315fix(snihandler): Enhance SNI extraction to support TLS 1.3 PSK-based session resumption by adding a dedicated extractSNIFromPSKExtension method and improved logging for session resumption indicators.Philipp Kunz2025-03-11 17:23:57 +00:00
43378becd2fix(PortProxy): Improve buffering and data handling during connection setup in PortProxy to prevent data lossPhilipp Kunz2025-03-11 17:05:15 +00:00
e31c84493ffeat(core): Improve wildcard domain matching and enhance NetworkProxy integration in PortProxy. Added support for TLD wildcards and complex wildcard patterns in the router, and refactored TLS renegotiation handling for stricter SNI enforcement.Philipp Kunz2025-03-11 11:34:29 +00:00
85cc57ae10fix(PortProxy): Simplify TLS handshake SNI extraction and update timeout settings in PortProxy for improved maintainability and reliability.Philipp Kunz2025-03-11 09:12:40 +00:00
ccccc5b8c8feat(PortProxy): Enhance TLS session cache, SNI extraction, and chained proxy support in PortProxy. Improve handling of multiple and fragmented TLS records, and add new configuration options (isChainedProxy, chainPosition, aggressiveTlsRefresh, tlsSessionCache) for robust TLS certificate refresh.Philipp Kunz2025-03-11 04:24:29 +00:00
788b444fccfix(PortProxy): Improve TLS renegotiation SNI handling by first checking if the new SNI is allowed under the existing domain config. If not, attempt to find an alternative domain config and update the locked domain accordingly; otherwise, terminate the connection on SNI mismatch.Philipp Kunz2025-03-11 02:25:58 +00:00
74fdb58f84fix(PortProxy): Improve TLS renegotiation handling in PortProxy by validating the new SNI against allowed domain configurations. If the new SNI is permitted based on existing IP rules, update the locked domain to allow connection reuse; otherwise, terminate the connection to prevent misrouting.Philipp Kunz2025-03-11 02:18:56 +00:00
Philipp Kunz