tunnelfetch 1.1.2 → 1.3.0

package/src/profiles.js

@@ -0,0 +1,150 @@
+// Fingerprint profiles: one coherent network identity, instead of a dozen knobs that can disagree.
+//
+// Every field a fingerprinter reads is individually configurable — cipher list, groups, signature
+// algorithms, ALPN, TLS versions, ClientHello extension order, GREASE, request header order,
+// HTTP/2 SETTINGS, pseudo-header order, HPACK indexing, Accept-Encoding. That is necessary and it
+// is also a trap: nothing stopped a caller assembling a Chrome User-Agent on top of curl's TLS and
+// curl's HTTP/2, which is a combination no real client produces and a detector reads instantly.
+//
+// A profile is the whole identity or none of it. It supplies defaults for every layer at once, and
+// it declares what it REQUIRES — because a profile that quietly drops the half of itself this
+// runtime cannot perform would recreate exactly the incoherence it exists to prevent.
+//
+// The values are captured, not recalled. curl 8.21.0 / OpenSSL 3.6.3 and Chromium, both read off
+// the wire on 2026-08-01. See test/tls/fingerprint.test.js and test/tls/grease.test.js.
+
+import { ConfigError, codes } from './errors.js';
+import { CURL_EXTENSION_ORDER, SHUFFLE_EXTENSIONS } from './tls/handshake-messages.js';
+import { CURL_HEADER_ORDER } from './client/header-order.js';
+
+/**
+ * @typedef {object} FingerprintProfile
+ * @property {string} name
+ * @property {object} [tls] merged into `tls`
+ * @property {readonly string[]} [headerOrder]
+ * @property {Array<[number, number]>} [http2Settings]
+ * @property {string[]} [http2PseudoHeaderOrder]
+ * @property {Record<string, string>} [http2HpackIndexing]
+ * @property {Array<[string, string]>} [headers] default request headers, in order
+ * @property {string[]} [requires] capabilities the caller must inject for this identity to be
+ *   honest: `'cipher:chacha20'`, `'group:x25519mlkem768'`, `'decoder:br'`, `'decoder:zstd'`
+ */
+
+/**
+ * curl 8.21.0 / OpenSSL 3.6.3. Complete: every layer was captured, and everything it offers is
+ * something this package can actually perform. This is the default identity.
+ */
+export const curl = Object.freeze({
+  name: 'curl/8.21.0',
+  tls: Object.freeze({
+    alpn: ['h2', 'http/1.1'],
+    extensionOrder: CURL_EXTENSION_ORDER,
+    grease: false, // curl does not GREASE
+  }),
+  headerOrder: CURL_HEADER_ORDER,
+  headers: Object.freeze([['User-Agent', 'curl/8.21.0']]),
+  // Captured: MAX_CONCURRENT_STREAMS, INITIAL_WINDOW_SIZE, ENABLE_PUSH, in that order.
+  http2Settings: Object.freeze([[3, 100], [4, 10485760], [2, 0]]),
+  http2PseudoHeaderOrder: Object.freeze([':method', ':scheme', ':authority', ':path']),
+  http2HpackIndexing: Object.freeze({ ':path': 'without' }),
+  requires: Object.freeze([]),
+});
+
+/**
+ * Chromium, TLS layer captured off the wire.
+ *
+ * INCOMPLETE ON PURPOSE, and it refuses to be used as though it were not. Two things are missing
+ * and neither can be papered over:
+ *
+ *   * Chromium offers TLS_CHACHA20_POLY1305_SHA256 and the X25519MLKEM768 group, and this package
+ *     implements neither. A ClientHello is an OFFER: a server may take either, and a client that
+ *     then cannot complete the handshake has traded a fingerprint mismatch for a dead connection.
+ *     Both are reachable by injection, which is why they are listed in `requires` rather than
+ *     silently dropped.
+ *   * Chromium's HTTP/2 preface was not captured — capturing it needs a TLS server the browser
+ *     will trust, which is a different exercise. So this profile carries no h2 layer, and using it
+ *     with HTTP/2 enabled would produce a Chromium ClientHello above a curl h2 preface: precisely
+ *     the split identity a profile exists to prevent.
+ *
+ * `applyProfile` refuses both cases with a message naming what is missing.
+ */
+export const chrome = Object.freeze({
+  name: 'chromium (TLS layer only)',
+  tls: Object.freeze({
+    // 16 suites, GREASE excluded — it is added by the grease option, not carried in the list.
+    ciphers: Object.freeze([
+      0x1301, 0x1302, 0x1303, 0xc02b, 0xc02f, 0xc02c, 0xc030, 0xcca9,
+      0xcca8, 0xc013, 0xc014, 0x009c, 0x009d, 0x002f, 0x0035,
+    ]),
+    groups: Object.freeze([0x11ec, 0x001d, 0x0017, 0x0018]),
+    sigSchemes: Object.freeze([0x0403, 0x0804, 0x0401, 0x0503, 0x0805, 0x0501, 0x0806, 0x0601]),
+    alpn: ['h2', 'http/1.1'],
+    // Measured: two hellos, identical extension set, entirely different orders. Chromium shuffles.
+    extensionOrder: SHUFFLE_EXTENSIONS,
+    grease: true,
+  }),
+  headers: Object.freeze([['Accept-Encoding', 'gzip, deflate, br, zstd']]),
+  http2Settings: null, // not captured — see above
+  requires: Object.freeze([
+    'cipher:chacha20',
+    'group:x25519mlkem768',
+    'decoder:br',
+    'decoder:zstd',
+    'http2:captured',
+  ]),
+});
+
+/** @type {Record<string, FingerprintProfile>} */
+export const profiles = Object.freeze({ curl, chrome });
+
+/**
+ * Fold a profile into a Client's options, and refuse an identity that cannot be honoured.
+ *
+ * Explicit options WIN over the profile: a caller who names a field meant to name it, and silently
+ * overriding them would make the profile impossible to adjust. The profile fills what was not said.
+ *
+ * @param {object} options as given to the Client
+ * @returns {object} options with the profile folded in
+ */
+export function applyProfile(options) {
+  const p = options.profile;
+  if (!p) return options;
+  if (typeof p !== 'object' || !p.name) {
+    throw new ConfigError(
+      codes.CONFIG_INVALID,
+      'profile must be a fingerprint profile object; see `profiles` for the built-in ones',
+    );
+  }
+
+  const missing = [];
+  for (const need of p.requires ?? []) {
+    const [kind, what] = need.split(':');
+    if (kind === 'decoder' && !options.decoders?.[what]) missing.push(need);
+    if (kind === 'cipher' && !options.ciphers?.[what]) missing.push(need);
+    if (kind === 'group' && !options.groups?.[what]) missing.push(need);
+    // A profile with no captured h2 layer must not be run over HTTP/2, or it presents this
+    // identity's ClientHello above a different client's preface.
+    if (kind === 'http2' && options.http2 !== false) missing.push(need);
+  }
+  if (missing.length) {
+    throw new ConfigError(
+      codes.CONFIG_INVALID,
+      `the "${p.name}" profile cannot be presented honestly: ${missing.join(', ')} ` +
+        `${missing.length === 1 ? 'is' : 'are'} missing. A fingerprint field this package cannot ` +
+        'perform is an offer a server may take and then find unhonoured, which fails the ' +
+        'connection rather than merely looking wrong. Supply the missing pieces (see `decoders`, ' +
+        '`ciphers`, `groups`) or set `http2: false`, or use a profile that is complete.',
+      { profile: p.name, missing },
+    );
+  }
+
+  const out = { ...options };
+  if (p.tls) out.tls = { ...p.tls, ...(options.tls ?? {}) };
+  for (const key of ['headerOrder', 'http2Settings', 'http2PseudoHeaderOrder', 'http2HpackIndexing']) {
+    if (options[key] === undefined && p[key] != null) out[key] = p[key];
+  }
+  // Profile headers are DEFAULTS: a request that sets its own User-Agent keeps it. They are folded
+  // in per request rather than here, so this only records them.
+  if (p.headers) out.profileHeaders = p.headers;
+  return out;
+}

package/src/tls/connect.js

@@ -135,6 +135,17 @@ function expectServerHello(msg, offers12) {
  * @property {number[]} [offerGroups] groups to send an actual key_share for. Default the first
  *   supported group; a HelloRetryRequest recovers any other choice at the cost of a round trip.
  * @property {number[]} [ciphers] cipher suites to offer, in preference order.
+ * @property {number[]} [sigSchemes] signature_algorithms to offer, in preference order.
+ * @property {boolean | number} [grease] send GREASE (RFC 8701) reserved values in the cipher list,
+ *   the extension list (one at each end), supported_groups, supported_versions and key_share.
+ *   Default false, because curl does not GREASE — Chromium does. A number is a seed, which makes
+ *   the hello reproducible; `true` draws one from `deps.randomBytes`. A server that negotiates a
+ *   GREASE value is refused with a typed error naming it.
+ * @property {number[] | 'shuffle'} [extensionOrder] ClientHello extension types, in the order to emit them.
+ *   JA3 and JA4 hash the extension list in WIRE ORDER, so this is most of what a fingerprinter
+ *   reads. Defaults to curl's order (`CURL_EXTENSION_ORDER`). Extensions not named keep their
+ *   natural position at the end; `pre_shared_key` is always last whatever is asked, because RFC
+ *   8446 s4.2.11 defines the binder transcript as the hello truncated just before the binders.
  * @property {Uint8Array} [clientRandom] fixed ClientHello.random, for reproducible handshakes.
  * @property {Uint8Array} [legacySessionId] fixed legacy_session_id, likewise.
  * @property {boolean} [compatibilityCcs] send the middlebox-compatibility ChangeCipherSpec.
@@ -326,6 +337,9 @@ async function drive({ record, hostname, verifyPeer, options, deps, versions })
     alpn,
     ciphers,
     versions,
+    extensionOrder: options.extensionOrder,
+    sigSchemes: options.sigSchemes,
+    grease: options.grease ?? false,
     random: options.clientRandom,
     legacySessionId: options.legacySessionId,
     psk: pskOffer && {

package/src/tls/extensions.js

@@ -26,6 +26,16 @@ function ext(type, body) {
   return new Builder().u16(type).vector(2, body).build();
 }
 
+/**
+ * An extension of an arbitrary type with an arbitrary body. Exists for GREASE (RFC 8701), whose
+ * whole point is to carry a reserved type this package assigns no meaning to.
+ * @param {number} type
+ * @param {Uint8Array} body
+ */
+export function encodeRawExtension(type, body) {
+  return ext(type, body);
+}
+
 // ------------------------------------------------------------------ encoders (ClientHello)
 
 /**

package/src/tls/grease.js

@@ -0,0 +1,109 @@
+// GREASE (RFC 8701) — reserved values a client sprinkles through its ClientHello so that servers
+// and middleboxes stay tolerant of values they do not recognise. A peer MUST ignore them; one that
+// negotiates a GREASE value is broken, and this file makes that refusal explicit rather than
+// leaving it to a downstream "no parameters for this suite" check whose message would blame the
+// offer list.
+//
+// curl does not GREASE. Chromium does, and its placement was captured off the wire from this
+// machine's Chromium rather than recalled — two ClientHellos, compared:
+//
+//   ciphers            one GREASE value, FIRST
+//   extensions         one GREASE extension FIRST (empty) and one LAST (a single zero byte)
+//   supported_groups   one GREASE value, FIRST
+//   supported_versions one GREASE value, FIRST
+//   key_share          one GREASE entry FIRST, carrying a one-byte key
+//   ALPN               none
+//   signature_algorithms none
+//
+// The same capture settled something that would otherwise have been guessed wrong: Chromium
+// SHUFFLES its extension order on every connection. The two hellos shared an identical non-GREASE
+// extension set and had entirely different orders, with GREASE first and last both times and a
+// different GREASE value each time. So "match Chrome's extension order" is not a fixed list — it
+// is a shuffle. See `shuffleExtensions`.
+
+/** The sixteen reserved values (RFC 8701 s2): 0x0A0A, 0x1A1A, ... 0xFAFA. */
+export const GREASE_VALUES = Object.freeze(
+  Array.from({ length: 16 }, (_, i) => (i << 12) | 0x0a00 | (i << 4) | 0x0a),
+);
+
+/** @param {number} v @returns {boolean} */
+export function isGrease(v) {
+  return (v & 0x0f0f) === 0x0a0a && v >>> 8 === (v & 0xff);
+}
+
+/**
+ * A deterministic-from-seed source of GREASE values and shuffles.
+ *
+ * Seeded rather than ad-hoc `Math.random` for two reasons: this package forbids ambient randomness
+ * in `src/` (repo-hygiene enforces it, so that every byte on the wire is reproducible in a test),
+ * and a fingerprint that cannot be reproduced cannot be asserted byte-for-byte.
+ *
+ * @param {number} seed
+ */
+export function greaseSource(seed) {
+  let s = seed >>> 0 || 0x9e3779b9;
+  const next = () => {
+    s ^= s << 13;
+    s >>>= 0;
+    s ^= s >> 17;
+    s ^= s << 5;
+    s >>>= 0;
+    return s;
+  };
+  const used = new Set();
+  return {
+    /** A GREASE value not yet handed out in this hello, since Chromium never repeats one. */
+    take() {
+      for (let i = 0; i < 64; i++) {
+        const v = GREASE_VALUES[next() % GREASE_VALUES.length];
+        if (!used.has(v)) {
+          used.add(v);
+          return v;
+        }
+      }
+      /* c8 ignore next */
+      return GREASE_VALUES[used.size % GREASE_VALUES.length];
+    },
+    next,
+  };
+}
+
+/**
+ * Fisher-Yates over the middle of the extension list, leaving the ends alone.
+ *
+ * The first and last positions are not free: Chromium pins a GREASE extension to each, and
+ * `pre_shared_key` MUST be last of all (RFC 8446 s4.2.11 — the binder transcript is the hello
+ * truncated just before the binders, a range that only exists if nothing follows them). So the
+ * shuffle covers everything between the fixed ends and nothing else.
+ *
+ * @param {Array<Uint8Array>} parts encoded extensions, already ordered
+ * @param {{next: () => number}} rng
+ * @param {(e: Uint8Array) => number} typeOf
+ * @param {number} pskType
+ * @returns {Array<Uint8Array>}
+ */
+export function shuffleExtensions(parts, rng, typeOf, pskType) {
+  const out = [...parts];
+  // Anything pinned at either end stays put: leading GREASE, and trailing GREASE or pre_shared_key.
+  let lo = 0;
+  while (lo < out.length && isGrease(typeOf(out[lo]))) lo++;
+  let hi = out.length - 1;
+  while (hi > lo && (isGrease(typeOf(out[hi])) || typeOf(out[hi]) === pskType)) hi--;
+
+  for (let i = hi; i > lo; i--) {
+    const j = lo + (rng.next() % (i - lo + 1));
+    [out[i], out[j]] = [out[j], out[i]];
+  }
+  return out;
+}
+
+/**
+ * A GREASE key_share entry: a reserved group with a single-byte key, which is what Chromium sends.
+ * The byte is fixed rather than random — it is never used for anything, and a value that varies
+ * would only make the hello harder to assert on.
+ *
+ * @param {number} group
+ */
+export function greaseKeyShare(group) {
+  return { group, keyExchange: Uint8Array.of(0x00) };
+}

package/src/tls/handshake-messages.js

@@ -11,6 +11,7 @@
 import { TlsError, TlsUnsupportedError, CertificateError, codes, hex16 } from '../errors.js';
 import { concat, equal, timingSafeEqual, utf8 } from '../util/bytes.js';
 import { Builder, Cursor, vector, handshakeMessage } from './wire.js';
+import { greaseSource, greaseKeyShare, shuffleExtensions, isGrease } from './grease.js';
 // der.js is a strict ASN.1 reader with no trust policy in it; the signature-format conversion
 // lives there so the certificate path builder and this file cannot drift apart.
 import { ecdsaDerToRaw } from '../trust/der.js';
@@ -49,6 +50,7 @@ import {
   encodePreSharedKey,
   encodePskKeyExchangeModes,
   encodeRenegotiationInfo,
+  encodeRawExtension,
   encodeServerName,
   encodeSignatureAlgorithms,
   encodeStatusRequest,
@@ -210,6 +212,68 @@ export async function deriveSharedSecret(group, privateKey, peerKey) {
  * @param {ClientHelloOptions} opts
  * @returns {ClientHello}
  */
+/**
+ * Extension emission order, by type. This is not cosmetic: JA3 and JA4 hash the extension list in
+ * WIRE ORDER, so the order alone is a large part of what a fingerprinter reads.
+ *
+ * Captured from curl 8.21.0 / OpenSSL 3.6.3, which sends:
+ *   renegotiation_info, server_name, ec_point_formats, supported_groups, ALPN, encrypt_then_mac,
+ *   extended_master_secret, post_handshake_auth, signature_algorithms, supported_versions,
+ *   psk_key_exchange_modes, key_share
+ *
+ * Two of those this package does not send, and the reason is the same in both cases — an extension
+ * is a claim about what we can do. encrypt_then_mac only applies to CBC suites, which are not
+ * offered; post_handshake_auth invites a CertificateRequest after the handshake, which is not
+ * implemented. status_request goes the other way: curl does not send it, this package does,
+ * because a stapled OCSP response is its only revocation signal. It is placed where OpenSSL puts
+ * it when it does send one, right after server_name.
+ *
+ * Anything not named here keeps its natural position at the end, and pre_shared_key is forced last
+ * whatever the caller asks for, because RFC 8446 s4.2.11 defines the binder transcript as the hello
+ * truncated just before the binders — a range that only exists if nothing follows them.
+ */
+/** `extensionOrder: SHUFFLE_EXTENSIONS` reproduces what Chromium does — see grease.js. */
+export const SHUFFLE_EXTENSIONS = 'shuffle';
+
+export const CURL_EXTENSION_ORDER = Object.freeze([
+  EXTENSION.renegotiation_info,
+  EXTENSION.server_name,
+  EXTENSION.status_request,
+  EXTENSION.ec_point_formats,
+  EXTENSION.supported_groups,
+  EXTENSION.alpn,
+  EXTENSION.extended_master_secret,
+  EXTENSION.signature_algorithms,
+  EXTENSION.supported_versions,
+  EXTENSION.psk_key_exchange_modes,
+  EXTENSION.key_share,
+]);
+
+/**
+ * Put the encoded extensions into the requested order.
+ *
+ * @param {Array<Uint8Array|null>} parts encoded extensions, nulls for the ones not offered
+ * @param {number[]} order extension types, most significant first
+ * @returns {Array<Uint8Array>}
+ */
+function orderExtensions(parts, order) {
+  const present = parts.filter(Boolean);
+  const typeOf = (e) => (e[0] << 8) | e[1];
+  // pre_shared_key is not the caller's to place.
+  const psk = present.filter((e) => typeOf(e) === EXTENSION.pre_shared_key);
+  const rest = present.filter((e) => typeOf(e) !== EXTENSION.pre_shared_key);
+  const rank = new Map(order.map((t, i) => [t, i]));
+  // A stable sort on rank, with unranked extensions after every ranked one in the order they were
+  // built. Array.prototype.sort is required to be stable, so equal ranks keep their relative order.
+  return [
+    ...rest
+      .map((e, i) => ({ e, i, r: rank.get(typeOf(e)) ?? Number.MAX_SAFE_INTEGER }))
+      .sort((x, y) => x.r - y.r || x.i - y.i)
+      .map((x) => x.e),
+    ...psk,
+  ];
+}
+
 export function buildClientHello({
   hostname,
   keyShares,
@@ -220,10 +284,19 @@ export function buildClientHello({
   sigSchemes = SUPPORTED_SIG_SCHEMES,
   alpn = [ALPN_HTTP11],
   versions = [TLS13, TLS12],
+  extensionOrder = CURL_EXTENSION_ORDER,
   extraExtensions = [],
   psk = null,
+  grease = false,
   randomBytes = defaultRandom,
 }) {
+  // A seed rather than ambient randomness: repo-hygiene forbids Math.random in src/ so that every
+  // byte this package puts on the wire is reproducible in a test, and a fingerprint that cannot be
+  // reproduced cannot be asserted byte-for-byte.
+  const g = grease === false || grease == null
+    ? null
+    : greaseSource(typeof grease === 'number' ? grease : ((randomBytes(4)[0] << 24) |
+        (randomBytes(4)[1] << 16) | (randomBytes(4)[2] << 8) | randomBytes(4)[3]) >>> 0);
   const clientRandom = random ?? randomBytes(32);
   if (clientRandom.byteLength !== 32) {
     throw new TlsError(codes.CONFIG_INVALID, `ClientHello.random must be 32 bytes, got ${clientRandom.byteLength}`);
@@ -242,7 +315,9 @@ export function buildClientHello({
     throw new TlsError(codes.CONFIG_INVALID, 'ClientHello would offer no cipher suites');
   }
 
+  // GREASE goes FIRST in each list, which is where Chromium puts it — captured, not recalled.
   const suiteBytes = new Builder();
+  if (g) suiteBytes.u16(g.take());
   for (const s of suites) suiteBytes.u16(s);
 
   if (psk && !offersTls13) {
@@ -258,11 +333,16 @@ export function buildClientHello({
     // Always offered, for either version: without it a server may not staple (RFC 6066 s8), and
     // a stapled OCSP response is the only revocation signal this package can consume.
     encodeStatusRequest(),
-    encodeSupportedGroups(groups),
+    encodeSupportedGroups(g ? [g.take(), ...groups] : groups),
     encodeSignatureAlgorithms(sigSchemes),
     alpn.length ? encodeAlpn(alpn) : null,
-    offersTls13 ? encodeSupportedVersions(versions) : null,
-    offersTls13 ? encodeKeyShare(keyShares.map(({ group, keyExchange }) => ({ group, keyExchange }))) : null,
+    offersTls13 ? encodeSupportedVersions(g ? [g.take(), ...versions] : versions) : null,
+    offersTls13
+      ? encodeKeyShare([
+          ...(g ? [greaseKeyShare(g.take())] : []),
+          ...keyShares.map(({ group, keyExchange }) => ({ group, keyExchange })),
+        ])
+      : null,
     offersTls13 ? encodePskKeyExchangeModes() : null,
     offersTls12 ? encodeExtendedMasterSecret() : null,
     offersTls12 ? encodeEcPointFormats() : null,
@@ -279,13 +359,36 @@ export function buildClientHello({
     if (part) offered.add((part[0] << 8) | part[1]);
   }
 
+  const typeOf = (e) => (e[0] << 8) | e[1];
+  // Order (or shuffle) the real extensions FIRST, then bracket them with GREASE. Doing it the
+  // other way round put both GREASE extensions at the end under a fixed order, because neither
+  // reserved type appears in any order list — and it put the trailing one after pre_shared_key,
+  // which RFC 8446 s4.2.11 forbids.
+  const laidReal =
+    extensionOrder === SHUFFLE_EXTENSIONS
+      ? shuffleExtensions(extensionParts.filter(Boolean), g ?? greaseSource(1), typeOf,
+          EXTENSION.pre_shared_key)
+      : orderExtensions(extensionParts, extensionOrder);
+
+  let laid = laidReal;
+  if (g) {
+    // Leading GREASE is empty, trailing carries a single zero byte — as captured from Chromium.
+    // The trailing one goes BEFORE any pre_shared_key, which must stay last of all.
+    const head = encodeRawExtension(g.take(), new Uint8Array(0));
+    const tail = encodeRawExtension(g.take(), Uint8Array.of(0));
+    const pskAt = laidReal.findIndex((e) => typeOf(e) === EXTENSION.pre_shared_key);
+    laid = pskAt === -1
+      ? [head, ...laidReal, tail]
+      : [head, ...laidReal.slice(0, pskAt), tail, ...laidReal.slice(pskAt)];
+  }
+
   const body = new Builder()
     .u16(LEGACY_VERSION)
     .push(clientRandom)
     .vector(1, sessionId)
     .vector(2, suiteBytes.build())
     .vector(1, Uint8Array.from([0])) // legacy_compression_methods: null only
-    .push(encodeExtensionBlock(extensionParts))
+    .push(encodeExtensionBlock(laid))
     .build();
 
   const message = handshakeMessage(HANDSHAKE_TYPE.client_hello, body);
@@ -446,6 +549,19 @@ export function negotiateVersion(serverHello, { offeredVersions }) {
  */
 export function negotiateCipher(serverHello, { offeredCiphers, version }) {
   const suite = serverHello.cipherSuite;
+  // A GREASE value is reserved and MUST be ignored by a server (RFC 8701 s3). One that negotiates
+  // it is broken, and because we offered it the "was it offered" test below would let it through —
+  // so it is refused here, naming GREASE, rather than falling to the missing-parameters check
+  // whose message would blame this package's own offer list.
+  if (isGrease(suite)) {
+    throw new TlsUnsupportedError(
+      codes.TLS_CIPHER_UNSUPPORTED,
+      `server selected the GREASE cipher suite ${hex16(suite)}, which RFC 8701 reserves and ` +
+        'requires a server to ignore. It exists in the offer precisely to detect peers that do ' +
+        'not.',
+      { cipherSuite: suite },
+    );
+  }
   if (!offeredCiphers.includes(suite)) {
     throw new TlsUnsupportedError(
       codes.TLS_CIPHER_UNSUPPORTED,

package/src/tls/handshake.js

@@ -239,6 +239,11 @@ export async function continueTls13(ctx) {
       alpn,
       ciphers,
       versions,
+      // The retry must reproduce the first hello's extension set AND order: s4.1.2 does not list
+      // either among the modifications a second ClientHello may make, and a strict server checks.
+      extensionOrder: options.extensionOrder,
+      sigSchemes: options.sigSchemes,
+      grease: options.grease ?? false,
       random: hello.clientRandom,
       legacySessionId: hello.legacySessionId,
       extraExtensions: cookie ? [cookieExtension(cookie)] : [],

package/src/warmup-fixture.js

@@ -18,61 +18,61 @@ export const WARMUP_HOSTNAME = "warmup.invalid";
 export const WARMUP_NOW = 1893456000000; // fixed epoch ms inside the chain's validity window
 
 const CLIENT_PRIV =
-  "MC4CAQAwBQYDK2VuBCIEIPjlXa5xRQTO0OmW85dWmeM6C0AjCqfOKH5MJlnIpT9b";
+  "MC4CAQAwBQYDK2VuBCIEINivgNQO5n8jwnzWfEWjdR14q7Km+UhPnqyL3RtkDbF7";
 const CLIENT_PUB =
-  "vbmT3r0piIyf5GavMXh1RqIsCml4dFibAAgovDW+Vww=";
+  "o5wNrq9yxfTLf8U3jLhUsXB52Kmf2q3zodyy/4jELSM=";
 const CLIENT_RANDOM =
   "AwoRGB8mLTQ7QklQV15lbHN6gYiPlp2kq7K5wMfO1dw=";
 const SESSION_ID =
   "BRAbJjE8R1JdaHN+iZSfqrXAy9bh7PcCDRgjLjlET1o=";
 const CLIENT_HELLO =
   "AQAA9AMDAwoRGB8mLTQ7QklQV15lbHN6gYiPlp2kq7K5wMfO1dwgBRAbJjE8R1JdaHN+iZSfqrXAy9bh7PcCDRgjLjlET1oADBMB" +
-  "EwLAK8AvwCzAMAEAAJ8AAAATABEAAA53YXJtdXAuaW52YWxpZAAFAAUBAAAAAAAKAAoACAAdABcAGAAZAA0AFgAUBAMFAwYDCAQI" +
-  "BQgGCAcEAQUBBgEAEAALAAkIaHR0cC8xLjEAKwAFBAMEAwMAMwAmACQAHQAgvbmT3r0piIyf5GavMXh1RqIsCml4dFibAAgovDW+" +
-  "VwwALQACAQEAFwAAAAsAAgEA/wEAAQA=";
+  "EwLAK8AvwCzAMAEAAJ//AQABAAAAABMAEQAADndhcm11cC5pbnZhbGlkAAUABQEAAAAAAAsAAgEAAAoACgAIAB0AFwAYABkAEAAL" +
+  "AAkIaHR0cC8xLjEAFwAAAA0AFgAUBAMFAwYDCAQIBQgGCAcEAQUBBgEAKwAFBAMEAwMALQACAQEAMwAmACQAHQAgo5wNrq9yxfTL" +
+  "f8U3jLhUsXB52Kmf2q3zodyy/4jELSM=";
 const SERVER_BYTES =
-  "FgMBAHoCAAB2AwPR9xYqSLPpiCwNco2cXVmtsxGRHpcVn9pgzYTTNfuygSAFEBsmMTxHUl1oc36JlJ+qtcDL1uHs9wINGCMuOURP" +
-  "WhMBAAAuACsAAgMEADMAJAAdACB+60XRWGB4e1t9Dy9U4hH3KMr8mYswz6ypnzfDjwHbdRcDAwdYnGQEkD2xWtrlMBiqAi7aAE5y" +
-  "OFQ7yBVgD+JYtaKoaQ5E6XGWU8HFO8TwqJAN1k1PERiecKl0Pdj1ne7lLDUxJ8w4rJMjXxuc8vSyfN1KjTxoBXvZ4hKuJeolN4Sp" +
-  "nVeUNtFXfNnLNuk1UDJZ/UWsZKATQM2PQEAgSXJA5bogqMD3w81B9FHF/6TxFiWu1uhB9AavIgwiRrO1XJPt/toozSJl/CMfvJNp" +
-  "+ukMVYeKACc8Vu9tYYi1gZRbVh9jDpWfW4x5Qsvwb+GgWdvDeDe4+P5nff2cmq2KrlUyGXaezYZiusNpYsRtGDLz+mcH1Gj99m4v" +
-  "fa4bGGz4lZiZG03M3CYJ6xbTfXn9JnRvhMjNxU4PxN1ntYYjuAPF+1GgKcjpTDWWY2sWNycZXY9nIk7AwG2+bl062gwmTHcSYXut" +
-  "1G7+WSzncPbzsdN00JJFjJDYMuH+mvtCqRaaOLu3A1Doqmdf79yfBUZN9pNA+DsFTYYaUGD4yaOzp+KguRAuVxd3yA0fsPRmz276" +
-  "oDmTCkNqgH8AZ3LPBHuW2b/DKG8Md4i6/p1pjHWa3Odjh8AIv6fc59deRwt9w6++FHODQC+NLa+2YFkuPWjxcWvYNBNulTQddz2y" +
-  "hPIBu8T7cL4lFgK0sgif13Q3ZSRMNbqdmS5T2weodLVnmODNs3o3pA42Q6yt1yPnoKtdk+yQuN2xvOBZb3h3ZMhIMcFHHeGlHoiU" +
-  "uogypE89jOsorucWK6yroBvewBOA4bx8TtUC46LkGSe5VTqatsixkODqd2RUMISXj+jE/g+niaOUWSQ4ONVucJBd6SgWwCT+EkJb" +
-  "oxH2ZyfInSNqRUAu5bUsb6P9kodpAtp2FKbLmCALoKL6K7RcHLfPtDh6Ejv8zHay7UGSINZtoKFhkVO5cpoNFoBgxAQud01RVh09" +
-  "BCz0IhBw8ZIsK+4GLd43ffHjO4Oqx5JQUIXpRO4i5/wqRxFac8SfmqUqkDJ4EqZlbZ0VO151hkslyHUjwb540kFtsO4+6pFw4dZt" +
-  "Hu9h4qW6wspnm2GWJb1KZtHeQfOD3bNvNCsLPxCSgTkGyXZAzhW1uMzXXElONkw+vaE5y/9W2vadqLR1TMzwYsW3K2qc/zIq7/wx" +
-  "q0nFJubW9Gty2D2gF3Zikfhid6YDoUYVg5Wy5uXayXR/4Mss7b4VF0ikUCsVn9JVwSony5o4TlHa4Zh9nzmJFXoVKQwmOeQ0/T6g" +
-  "ap86oZRdXSpMZDg0LarqVOOsU4zyuK0a9Ts8TTmoDxz5wpVRKI87mDb1kN/T8YfDM+Kaf181nhQM+jfXUtj3g2SjrbfmOgDUWcy2" +
-  "6solXDjF0XWEe42tcQm44k0518zHUL9ItudBsKkLZpFcfmTDHON7SOUjydsLEB5vMd9m/rfDl6c9nGZyUic+LLjpocc41zvyN/cx" +
-  "qZl/dwFxrHooPEYhaiqOxSbn75doMygIhjwLQHMPrG72d6Ym1UrMcUwhi/4oad6xE7tlIGLbJqv1RCgg6dij5tGpPOvXoBcvQVEs" +
-  "AWpq8pTXEpru5yydwrX9akoC1J6pKuhwYudrzfA3jvPTcCnHWAKS3PG+hQ59JLuxVUrw6f9A3/jXUUuYk3XkGuKLw924STdQS+9d" +
-  "i34c7DB6TcDaoq9XMMTs4DsU/aaILIUztt1rgjEyRxx16Kjm8qot5g2ldz/suM7iHSe2Dd+MOvdGmA2cnF6EW2VFMDbbRUe1BL6m" +
-  "a8Sa62xZPgF+hZrK+cQNs1MYIVjrzdbDxwePWSl+R87dgNBtplZKh/fp4as9tM/SD7kLh/TxeTEBIuuf5VKPGQcHLt4ifYh+4eIj" +
-  "h9IKJchum7/53DW+13efK2qVXtjAz8izCDmL8My5QrfeWwKhppGzSILDPtEce/MUYu5bUNo4n8AHomWf2fpaeUn104bDHMH+0ook" +
-  "cpAJki15og5ZrxzkUG6oNtCGgZqfogV3FDRw4olaEkUQY7cHTi7CZkR3oRNiOMJu/fsi6XbksXxNDW9y+ugUwciW9UjqxkfLh7I4" +
-  "/eETaNRbuVYjcVSypTEuC1dqjXnxFucHN0NyANn1PrIm7qBOoPnrLhq5wYpuLZ9qlfiXWun3oBlO4MyRh0YepClhx/qT74KZryFB" +
-  "0AyYzMolgyvR6OiZ3ajxEqo2pUgfKtDlo1AqGmydH16HScaaIgG8R2nj30FUE4BOJUr8XWm4Nk9yVuI0LPrVSaIb7RlpfskAVAGu" +
-  "/wF/YR9Itk9GhGiQ4pw50hgi/MnzQYixea9bUV+1Lfe4aA+/WRoQYsAu2jO+4VsuhwSCv5zTQPllr+rkNmvwjEnX7IAl138dk+/Y" +
-  "gA16PAWCQUkrk6Z1vZFjl3qfYelCwuIWT7HnfW8ZTYjvDZ5OgnLtm55MKjdrwX6xhxXocZ8+SiurIx9FVQdvFJg3vvAPCYnislUf" +
-  "wbIQQlCI0JWcyL0iI/JmIE2YWsegK1pvD/3PmB1fUiePd0wDado3LpdO39yUYA6rE4ynHUpwrmnCPlqEOh0XAwMBGacbGrwvRADw" +
-  "I/oOygBJY1Cl6puADo3n6DTofw4wr1ihuyxX6c2Br8Fj9R57WG8ALIp0CQNNy7mJ8YynOlKP1AeQspIelnQPzVo8l4n7ThvlMayx" +
-  "xDMnJHdIBCSKg8rUQdxi/zM/z1lnORCzQMJXi2A786I+FTa/2f+y9ln2uDRD6LEKlrz71onlf8o2h2x+cqwYUBdQPeZqa6gkFhWJ" +
-  "5QXq0jK/iViKEIyduX7wZL9Pf26PKvsuiFUTNwBMvEJdAkSkmhxbR4SeWdMuvxQ/cvIn42Id6HaOqdsEueNrv/dnskCqqAHDGFLe" +
-  "h+IQgpHZdFNYrFPlhhDLqIHLk6MZZLfS3QLmFhVTSMn4xpQ809ZMvGT3NXWTOB7GFwMDABM00dpa951QoPFgnJv9SpPMaxoa";
+  "FgMBAHoCAAB2AwMC2KMpeoduVRsS/IdMsSXpe01e8s3wE/rytik1l91rgiAFEBsmMTxHUl1oc36JlJ+qtcDL1uHs9wINGCMuOURP" +
+  "WhMBAAAuACsAAgMEADMAJAAdACAr+v3w+m4O5oxHFSy624+fpkWPq277w7+v3Ke3hrKpOxcDAwdY/NxJTmM9YwAtwCbLgQJoioff" +
+  "HlNuzTL1ruUzSLqTb4yMSTiKyiOITsAVKStDY8NsguJ1/CKx/s93Oy4wgtcmJudrxMQK5tRTYfwCrZDgR5yfSVD25wIX5VjuTuJ4" +
+  "OsQFJ0qX5cqXv4042XcyR06iRqN7iOKY8h2aH5opqQylx5+51GyKjFWB+qIwTceJ8+r/sl/wkxh4hwq7AfmZuRE8suxcZlojgrH6" +
+  "ka1eJ81f/HbalU90Xjs3L9A4UnxB/e3CtoA12a8TkvD6bQCb3sCZUwgt0GSKajpw8/n11XWEyW5AAojiopI+pxwur5wMEkdNrABX" +
+  "FpDt+pBW2hfWgUgeHO0JLn2XkXQVnipgdd6e6mtePKtIFqT4tW7dW5Rzp1X8QwqSA+oGpwUTleL4qROziaY9cdALrVHFQ3P5L4IA" +
+  "fWPF7FmGj+PBOqo1V4Xlw9suTnGJmiIve9XOY+J0GndLb3b/DULmo0wNG4VdvyO0keFqg2Ov3cKAFHfrbPCRSJwdQfpaA2abuC9H" +
+  "MkKgK5JAtvWbAopxu281UMA3tJpWSxiI8LjpbLnNqhUFseBukdRFVVPwE4ckqwqk5NcTb66Eqyyw0fd+TioDTqyTyyGJJwvBHm3l" +
+  "KXkU4x4crwFsyDWDZpH8KbYbImVlpCtK+uSPEouREgTeimbeR3elxccpfGkm47yYnERBAfCcM18OcZkMb3AqFsgnaN+Cy345lBJs" +
+  "uJfRkRfAmdhlCz5KWmqSNY+3fT6iWyJ9dPBvmcsCnxn6FUZfNxAoYSi7wNzsSv7CRMDWPhdEIWMoDVjf8ZKubz0R/OddtVr1Il20" +
+  "xiIcevpEJ9pRntZjCkWtykA+z48Vw3Ia8HoMsKDMQagJ472FhNggwMipgA1uM6+nEe+/scUC3HDck6YGwgpb9k1LWVxYsCIdoz0t" +
+  "pbVoCV+QCvqyJGNWpIwRQLYjxHV84WzH/tWbGyyFXkFrA/7XgjE4bydjs88lcC7rAHKXLRrpF1CMwQg5XOkI8ftYRbYIKK9OYx/7" +
+  "uUPGBPdPvYkrOwe2q1VgHQd+vK87hlN+aNDOlbxSdcy9U84OSUPwDQs7TYqu7R9Hxsc8BTnRo1Gn6XeVrIdVZmrhQQWdCX9MFSww" +
+  "GCs8IxY5CM/2/thifsZN85K0AxgBz45XphZS9YNAjCIex8L4ky5mruYESLcHErLPkMZCDUuvgapmtD8SKsxTz/sLhZuotN6Xmbmb" +
+  "5WjTm3Rw7W95mI41mHRCLBEHK2KhqSLdpH2vO43D/g4LKAh21M3wxKJAmElkRyUa8zb+E6GcqtTnL6Zldlm+cRp8KopVLBAJFpFw" +
+  "T3riPPiJ6QxWcZjM9aXCHPE+TL1W+KzyTwLChHzPjBopJ+PMjXos7T7DTgQLmO9jsdILAl6xNQgPPukoOAy9Wn3yCWcsETEelZbV" +
+  "rgZ4aEwXkurJ5RrsOjGEN+uODmJ2lbW2//B+lKlDGILtisLEg8CzzrSN6BZ420Z50PkGZoP6ML7+JC0rtC75gyNrWXYIBzxwr2/S" +
+  "2F30780r8cqU5yvq7VI+nDbUzNoauhWgdVBrCQ/4blaupU+yxHbBvYjRBMBuKwcHTJO2R/s+xTqK5j41Sukm3x99+vEqwrTmN1dm" +
+  "aWYk70oKuW1Ewx9V7/ExKwGbsDBxYMjKS8h/aAc0CZz7Fxk30V05LA5rUPsG7zeUyKsvBnnivtCcY7GN1b6mEsLhkkHg6hxaDjBf" +
+  "GfjodpXTHsbiZExkL+CYQnE6LQGtOhHrt+ojtQb7iSCvdjIZ/i1Mw2N3UFjkW6qM1ISASQBCSrG8WZqvjZQ+wsngaeo1iL5Zg5qv" +
+  "Rc+KoaEackS0NVraKSFrc+xHfyofDskV/FsS9ovfYnouP3pV5SdIcBWMOvIUovGLB2m1nW1k1mySRfm4VHqeag/cSmXSNQX6aVSh" +
+  "AsrHAyPrwtBBF5Ox892Ok5p91yDahZhDWfTBTTkY76Ru12FaVafiPyG6lFxbx88tIpiVqfnhqvlj2qvLJFe24MmvjWiXdO00axAy" +
+  "M9JTe0IvA5hvyVaTn0w1MzzaNBkDDPpgLlt0yEVoblcrqaQjP0H9J+SjxAUgT52sDDCLjFxFY/zh5guI9RhDYZ2Pyg+vdudJKfja" +
+  "dr4L4CpUTKFO+DEJf/Efc7nOlTJWD4Dh3SavGfu7gplzh3FMBFegkUkCQJC2hzatNNSpkE8REhC73Rm9me2iysJMv/4Sy5a6Er5Y" +
+  "ffE0aAsJ/gXCvE7fQbeZhogp3iBQm911LBwtUn5Wwh8ALGELJxSsQloxFJwPYSzhUGJ01XKNYo6GIWjrpWtcKIKAe1tlB4Ni/Ag7" +
+  "bQV7J67dyHvMti/Jgq7VODUJIb8E+u6H7FVQ/8jzE1mm4Dmmtfd9LqB7pal3YbzzxwfN6Qw84jN7lgcksByuZ7eTV2Q4T0IK/toG" +
+  "oroTtRRz7vMwg6xLnNIhtdeQaQMVnveuVkWZ29pzwNTxaKVITIIfsJjxTmHqph7wED0rBpR7vSs9WOsMSeoXAwMBGfgD+3KLo6SI" +
+  "9AOwKrhRqXO7Xgn2i58peIpNbvy4DVJ3AOjAect4osO+zRcr5gBp/2JFJgL5l5hgdUpApp9U50/SOOPwCvAZIpfPDlWlixJjUF/K" +
+  "8NxWHgx62Wuq6mX7CW7BEqwNzb1yYNSzfZYR0qhmiJ04vj4nnxXcmKum9fj5eO4ptiyLUAqrDpYwUAKCAqlLVZCJbS1dVdwEWSQs" +
+  "X/lq6RoYYBaRde8fJT2EXzQnfkn5eV4dzI1gseEMQUJ85kshKa847TwI/4rNRhdhXtDCHi8lMfoRgcobGwYmSImTtt6pxJPj07Og" +
+  "tyDBW2lyhFOLT2hMSJSdK/tQ/PezQDviGzEaV/5oKHDReaTKWOsjbDkftJiufdJ+FwMDABOfvj5nYBpetvkAsU02oXftLJYe";
 const ROOT_DER =
   "MIIC2jCCAcKgAwIBAgIBATANBgkqhkiG9w0BAQsFADAeMRwwGgYDVQQDDBNXYXJtdXAgRml4dHVyZSBSb290MB4XDTI1MDEwMTAw" +
   "MDAwMFoXDTM1MDEwMTAwMDAwMFowHjEcMBoGA1UEAwwTV2FybXVwIEZpeHR1cmUgUm9vdDCCASIwDQYJKoZIhvcNAQEBBQADggEP" +
-  "ADCCAQoCggEBAMlyqJWB5tdme7o+TptR4T2er2MD5gsVcRmg1XWAIHnjY5Wy+cQ9dn670JtY5My0WBX+RSDPFsRzPnimzyLm2Jzs" +
-  "J8xpOMDtfE3/NUjxLSHrhdxJ+gFqoB0j7faIzLar1EXMdlhGCmFtXXoMQyuKhlMRzqP3VpH0N91OkGueQFlJAsuazEf9zm0v6PnV" +
-  "1QuH4X4+/wRYeAjrLmksLkLhI2h/QZ/EwiVwcLQUvPb4kSHeemZKRRXByLAqOBj6g/MqFRkhqiYQmDB4upjBcYHC8Ae9b02hP8vQ" +
-  "q9Dv5pRGloGk7olcviiSTj3YTIFd5Cd7xQZXyE42dJa6C9bZHkgZHPMCAwEAAaMjMCEwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8B" +
-  "Af8EBAMCAgQwDQYJKoZIhvcNAQELBQADggEBAB62L1/vofc1iZN1EoyIdHfgQZS7EtrjO4kkpHJPb2e1AmgvSCGSBC1OBaqlgpcT" +
-  "gSfmwSY7g059w18gaEkBhjm5czUmt+IM1DWir6hLPI//6QizsQo0AatePnMvJYuny9VMG2HWbpY17IKxT3/sG4zID7XtDjycuBkf" +
-  "uy6DN6Qrp0+aqYMfXs28HWwDgf3b7ZjEAwquSQ+dG8Ml36fd8hjydf2VjOl0h5C3xfc88sEEv0BAks11cYjHDT6jHNYYbXfWcesk" +
-  "nflRe2my0pLsKJFzVhQvpWl6Tud5+Im99hi0GMI1L17hMv9YlCGR+vIQsP78y/WTIEHMiFTpCWd1NTY=";
+  "ADCCAQoCggEBAMEAjrxVUntvHweCVz7mjYZTWZiTOW3mabXocCrFXKs8CcJVYNGQkpvhC/1VIr4t7hdrSPG31j6PvR4x0OAZTJZR" +
+  "k++Zo1jPUWIG3YomFJWhVjoJqoZTcO8uMDydvO75OTxto6Mc5gpfzHgfc52aAqemSqnfzryjupS6o1KOwbE1byLjM/Mmpp4CrRXx" +
+  "Fy/Jd8g2w1dSTTZo7QDIYBuZcNW4UYna9Mpac7otnv8JdlRSKonbbxXbx1E2GUm0tVM+4B5ARtBOFggnZYNW+KvQwcl4NRLTrFZS" +
+  "KNaRAW78DxclmSBsMm0lV+lsnV9miyuR2vfsj1FwSHKe1gzf12yRMpECAwEAAaMjMCEwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8B" +
+  "Af8EBAMCAgQwDQYJKoZIhvcNAQELBQADggEBAGmB1ws+kKHGtO5D8UnCCyXI/q5LtHsMDO+lDwp/6HAKJ6xVnJCNVP4d1/nTwMVm" +
+  "KeJTfEseakqaVSiUcowlPEgSM1OVIRU6aRqBog4cjyBt9F74cmdy+VOewkd4jwHUDnkuj8sNx6BdU8FN83w2nIlQ35g/exzQDP8q" +
+  "mB/GtQlnGbmi6mRMKzFn5stSwQS5tcTwz8h5dkDG2FtsBG4f8YDs8r2G0ur7FQD9aIhlttcUUdSE1mZHm4itgqgyE+hreL0x0wqz" +
+  "7V7NQK7fMH8OLTr5JrjVMyrpX8EQqyntEkAS8IaaQ42h3GNo1+HRVeJ9M53noaveacxhtTZDnI5u8wA=";
 
 export const WARMUP_FIXTURE = {
   clientPrivPkcs8: () => B(CLIENT_PRIV),