chrome-fp 0.2.0__py3-none-any.whl

chrome_fp/__init__.py

@@ -0,0 +1,26 @@
+"""chrome_fp —— 与真 Chrome 逐字节同指纹的纯 Python HTTP 请求库
+
+用法:
+    from chrome_fp import Session
+    s = Session()
+    r = s.get("https://tls.peet.ws/api/all")
+    print(r.json()["tls"]["ja4"])
+"""
+
+from .session import Session
+from .hello import ClientHello, build_client_hello
+from .fingerprint import ja3_from_hello, ja4_from_hello, parse_client_hello
+from .spec import CHROME_MAJOR, CHROME_VERSION
+
+__all__ = [
+    "Session",
+    "ClientHello",
+    "build_client_hello",
+    "ja3_from_hello",
+    "ja4_from_hello",
+    "parse_client_hello",
+    "CHROME_MAJOR",
+    "CHROME_VERSION",
+]
+
+__version__ = "0.2.0"

chrome_fp/client.py

@@ -0,0 +1,113 @@
+"""连接分派: 发同一个 Chrome ClientHello, 读第一条 ServerHello, 自动走 TLS 1.3 或回落到 TLS 1.2。
+
+真 Chrome 遇到只支持 1.2 的服务器也是用同一个 ClientHello 回落的(我们发的 ClientHello 里
+supported_versions 已含 0x0303、密码套件里也有 TLS1.2 套件), 所以**指纹完全不变**。
+"""
+
+from __future__ import annotations
+
+import socket
+import struct
+import sys
+
+from . import tls12, tls13
+from .hello import ClientHello
+
+
+def parse_server_hello_exts(msg: bytes) -> tuple[dict[int, bytes], int]:
+    """返回 (扩展字典, 套件号)"""
+    body = msg[4:]
+    p = 2 + 32
+    sid_len = body[p]
+    p += 1 + sid_len
+    suite = struct.unpack(">H", body[p:p + 2])[0]
+    p += 2
+    comp_len = body[p]
+    p += 1 + comp_len
+    exts: dict[int, bytes] = {}
+    if p + 2 <= len(body):
+        ext_total = struct.unpack(">H", body[p:p + 2])[0]
+        p += 2
+        end = min(p + ext_total, len(body))
+        while p + 4 <= end:
+            et, el = struct.unpack(">HH", body[p:p + 4])
+            exts[et] = body[p + 4:p + 4 + el]
+            p += 4 + el
+    return exts, suite
+
+
+def is_tls13(msg: bytes) -> bool:
+    exts, _ = parse_server_hello_exts(msg)
+    return exts.get(0x002B, b"")[:2] == b"\x03\x04"
+
+
+def open_connection(
+    sock: socket.socket,
+    client_hello: ClientHello,
+    *,
+    verify_certs: bool = True,
+    ca_file: str | None = None,
+    timeout: float | None = 30.0,
+    allow_tls12: bool = True,
+    debug: bool = False,
+):
+    """发 ClientHello 并完成握手; 返回 TLS13Connection 或 TLS12Connection(接口一致)"""
+    if timeout is not None:
+        sock.settimeout(timeout)
+    sock.sendall(client_hello.record)
+    # 注: RFC 8446 D.4 的"CH 后立刻发 dummy CCS"实测会把只支持 TLS 1.2 的服务器搞坏
+    # (它们会把这个 CCS 当成密钥切换), 所以只在确认是 TLS 1.3 之后才发 —— 见 tls13.py
+    # 里发送 client Finished 之前那一条。
+
+    # ---- 预读第一条握手消息(用于判断版本) ----
+    raw = b""
+    hs_buf = b""
+    first: bytes | None = None
+    while first is None:
+        while len(raw) < 5:
+            chunk = sock.recv(65536)
+            if not chunk:
+                raise tls13.TLSException("连接被对端关闭")
+            raw += chunk
+        ctype = raw[0]
+        length = struct.unpack(">H", raw[3:5])[0]
+        while len(raw) < 5 + length:
+            chunk = sock.recv(65536)
+            if not chunk:
+                raise tls13.TLSException("连接被对端关闭")
+            raw += chunk
+        payload = raw[5:5 + length]
+        raw = raw[5 + length:]
+        if ctype == tls13.CT_CHANGE_CIPHER_SPEC:
+            continue
+        if ctype == tls13.CT_ALERT:
+            raise tls13.TLSException(f"收到 alert: {payload.hex()}")
+        hs_buf += payload
+        if len(hs_buf) >= 4:
+            msglen = int.from_bytes(hs_buf[1:4], "big")
+            if len(hs_buf) >= 4 + msglen:
+                first = hs_buf[:4 + msglen]
+                hs_buf = hs_buf[4 + msglen:]
+
+    if first[0] != tls13.HS_SERVER_HELLO:
+        raise tls13.TLSException(f"期待 ServerHello, 收到消息类型 {first[0]}")
+
+    tls13_ok = is_tls13(first)
+    if debug:
+        print(f"[client] ServerHello -> {'TLS1.3' if tls13_ok else 'TLS1.2'}", file=sys.stderr)
+
+    if tls13_ok:
+        conn = tls13.TLS13Connection(
+            sock, client_hello, verify_certs=verify_certs, ca_file=ca_file, timeout=timeout,
+            ch_sent=True, server_hello_msg=first, hs_buf=hs_buf, preload_buf=raw,
+        )
+    else:
+        if not allow_tls12:
+            raise tls13.TLSException("服务器只支持 TLS 1.2, 而 allow_tls12=False")
+        conn = tls12.TLS12Connection(
+            sock, client_hello, server_hello_msg=first, hs_buf=hs_buf, preload_buf=raw,
+            verify_certs=verify_certs, ca_file=ca_file, timeout=timeout,
+        )
+    alpn = conn.do_handshake()
+    conn.tls_version = "1.3" if tls13_ok else "1.2"
+    return conn

chrome_fp/fingerprint.py

@@ -0,0 +1,199 @@
+"""ClientHello 解析 + JA3 / JA4 计算 (用于自检: 生成的握手是否与真 Chrome 一致)"""
+
+from __future__ import annotations
+
+import struct
+from hashlib import md5, sha256
+
+GREASE = {0x0A0A + 0x1010 * i for i in range(16)}
+
+EXT_NAME = {
+    0x0000: "server_name", 0x0005: "status_request", 0x000A: "supported_groups",
+    0x000B: "ec_point_formats", 0x000D: "signature_algorithms", 0x0010: "alpn",
+    0x0012: "signed_certificate_timestamp", 0x0015: "padding", 0x0017: "extended_master_secret",
+    0x001B: "compress_certificate", 0x001C: "record_size_limit", 0x0023: "session_ticket",
+    0x002B: "supported_versions", 0x002D: "psk_key_exchange_modes", 0x0033: "key_share",
+    0x44CD: "application_settings(ALPS)", 0x4469: "application_settings(old)",
+    0xCA34: "trust_anchors", 0xFE0D: "encrypted_client_hello(GREASE)", 0xFF01: "renegotiation_info",
+}
+
+GROUP_NAME = {
+    0x001D: "x25519", 0x0017: "secp256r1", 0x0018: "secp384r1", 0x0019: "secp521r1",
+    0x001E: "x448", 0x11EC: "X25519MLKEM768", 0x6399: "X25519Kyber768Draft00",
+    0x0100: "ffdhe2048", 0x0101: "ffdhe3072", 0x0102: "ffdhe4096",
+}
+
+
+def _u16(b: bytes, p: int) -> int:
+    return struct.unpack(">H", b[p:p + 2])[0]
+
+
+def parse_client_hello(record: bytes) -> dict:
+    """解析 record 层字节, 返回结构化信息"""
+    body = record[5:]
+    p = 4
+    out: dict = {
+        "record_len": len(record),
+        "legacy_version": body[p:p + 2].hex(),
+    }
+    p += 2
+    out["random"] = body[p:p + 32].hex()
+    p += 32
+    sid_len = body[p]
+    out["session_id"] = body[p + 1:p + 1 + sid_len].hex()
+    p += 1 + sid_len
+    cs_len = _u16(body, p)
+    p += 2
+    ciphers = [body[p + i:p + i + 2].hex() for i in range(0, cs_len, 2)]
+    out["ciphers"] = ciphers
+    p += cs_len
+    comp_len = body[p]
+    out["compressions"] = body[p + 1:p + 1 + comp_len].hex()
+    p += 1 + comp_len
+    ext_total = _u16(body, p)
+    p += 2
+    end = p + ext_total
+    exts: list[tuple[int, bytes]] = []
+    while p + 4 <= end:
+        et = _u16(body, p)
+        el = _u16(body, p + 2)
+        exts.append((et, body[p + 4:p + 4 + el]))
+        p += 4 + el
+    out["extensions"] = exts
+    out["ext_types"] = [et for et, _ in exts]
+    out["ext_names"] = [
+        f"0x{et:04x}" + ("(GREASE)" if et in GREASE else f"({EXT_NAME.get(et, '?')})")
+        for et, _ in exts
+    ]
+    out["handshake_len"] = int.from_bytes(body[1:4], "big")
+
+    d = dict(exts)
+    if 0x000A in d:
+        n = _u16(d[0x000A], 0)
+        out["supported_groups"] = [
+            GROUP_NAME.get(_u16(d[0x000A], 2 + i), f"0x{_u16(d[0x000A], 2 + i):04x}")
+            for i in range(0, n, 2)
+        ]
+    if 0x000D in d:
+        n = _u16(d[0x000D], 0)
+        out["signature_algorithms"] = [f"0x{_u16(d[0x000D], 2 + i):04x}" for i in range(0, n, 2)]
+    if 0x002B in d:
+        n = d[0x002B][0]
+        out["supported_versions"] = [f"0x{_u16(d[0x002B], 1 + i):04x}" for i in range(0, n, 2)]
+    if 0x0033 in d:
+        b = d[0x0033]
+        total = _u16(b, 0)
+        ks, q = [], 2
+        while q < 2 + total:
+            g = _u16(b, q)
+            kl = _u16(b, q + 2)
+            ks.append({"group": GROUP_NAME.get(g, f"0x{g:04x}"), "len": kl})
+            q += 4 + kl
+        out["key_shares"] = ks
+    if 0x0000 in d:
+        b = d[0x0000]
+        name_len = _u16(b, 3)          # [0:2]=list len, [2]=type, [3:5]=name len, [5:]=name
+        out["sni"] = b[5:5 + name_len].decode("ascii", "replace")
+    if 0x0010 in d:
+        b = d[0x0010]
+        n = _u16(b, 0)
+        protos, i = [], 2
+        while i < 2 + n:
+            ln = b[i]
+            protos.append(b[i + 1:i + 1 + ln].decode())
+            i += 1 + ln
+        out["alpn"] = protos
+    if 0xFE0D in d:
+        out["ech_len"] = len(d[0xFE0D])
+        out["ech_config_id"] = d[0xFE0D][5]
+    if 0xCA34 in d:
+        b = d[0xCA34]
+        inner = b[2:]
+        ids, i = [], 0
+        while i < len(inner):
+            ln = inner[i]
+            ids.append(inner[i + 1:i + 1 + ln].hex())
+            i += 1 + ln
+        out["trust_anchor_count"] = len(ids)
+        out["trust_anchor_set"] = sorted(ids)
+    if 0x001B in d:
+        out["compress_certificate"] = d[0x001B].hex()
+    if 0x44CD in d:
+        out["alps"] = d[0x44CD].hex()
+    if 0x0005 in d:
+        out["status_request"] = d[0x0005].hex()
+    return out
+
+
+def ja3_from_hello(record: bytes) -> tuple[str, str]:
+    info = parse_client_hello(record)
+    ciphers_d = parse_client_hello(record)["ciphers"]
+    ciphers = ",".join(c for c in ciphers_d if int(c, 16) not in GREASE)
+    exts = ",".join(str(e) for e in info["ext_types"] if e not in GREASE)
+    d = dict(info["extensions"])
+    curves = ""
+    if 0x000A in d:
+        n = _u16(d[0x000A], 0)
+        curves = ",".join(
+            str(_u16(d[0x000A], 2 + i)) for i in range(0, n, 2)
+            if _u16(d[0x000A], 2 + i) not in GREASE
+        )
+    fmt = ""
+    if 0x000B in d:
+        b = d[0x000B]
+        fmt = ",".join(str(x) for x in b[1:1 + b[0]])
+    s = f"{ciphers},{exts},{curves},{fmt}"
+    return s, md5(s.encode()).hexdigest()
+
+
+def ja4_from_hello(record: bytes) -> str:
+    """JA4 — 按 FoxIO 官方实现 (python/ja4.py to_ja4):
+    扩展列表带 0x 前缀、升序; 签名算法按出现顺序、不带前缀; 二者用 "_" 连接; GREASE 全部剔除。
+    """
+    info = parse_client_hello(record)
+    d = dict(info["extensions"])
+    ciphers = sorted(c for c in info["ciphers"] if int(c, 16) not in GREASE)
+    exts = sorted(f"0x{e:04x}" for e in info["ext_types"] if e not in GREASE)
+    sigalgs: list[str] = []
+    if 0x000D in d:
+        n = _u16(d[0x000D], 0)
+        sigalgs = [
+            f"{_u16(d[0x000D], 2 + i):04x}"
+            for i in range(0, n, 2)
+            if _u16(d[0x000D], 2 + i) not in GREASE
+        ]
+    alpn = ""
+    if 0x0010 in d:
+        b = d[0x0010]
+        n = _u16(b, 0)
+        if n >= 2:
+            ln = b[2]
+            alpn = b[3:3 + ln].decode("ascii", "replace")
+
+    def h12(s: str) -> str:
+        return sha256(s.encode()).hexdigest()[:12]
+
+    a = "t" + "13" + ("d" if 0x0000 in d else "i") + f"{len(ciphers):02d}" + f"{len(exts):02d}" + (alpn or "00")
+    b = h12(",".join(ciphers))
+    ext_str = ",".join(exts)
+    if sigalgs:
+        ext_str += "_" + ",".join(sigalgs)
+    c = h12(ext_str)
+    return f"{a}_{b}_{c}"
+
+
+def describe(record: bytes) -> str:
+    info = parse_client_hello(record)
+    _, j3 = ja3_from_hello(record)
+    lines = [
+        f"record_len={info['record_len']} handshake_len={info['handshake_len']}",
+        f"ciphers({len(info['ciphers'])}): {info['ciphers']}",
+        f"extensions({len(info['ext_types'])}): {info['ext_names']}",
+        f"groups: {info.get('supported_groups')}",
+        f"versions: {info.get('supported_versions')}",
+        f"key_shares: {info.get('key_shares')}",
+        f"sni: {info.get('sni')} alpn: {info.get('alpn')}",
+        f"ja3={j3}",
+        f"ja4={ja4_from_hello(record)}",
+    ]
+    return "\n".join(lines)

chrome_fp/hello.py

@@ -0,0 +1,251 @@
+"""按 Chrome/BoringSSL 源码规则逐字节构造 ClientHello。
+
+结构完全照 ssl_add_clienthello_tlsext (extensions.cc:4462+) 实现:
+  1. 先写一个空的 GREASE 扩展 (ssl_grease_extension1)
+  2. 按 kExtensions[] 表顺序(或 Fisher-Yates 随机置换后的顺序)逐个尝试添加扩展
+  3. 最后写一个 1 字节的 GREASE 扩展 (ssl_grease_extension2)
+  4. 长度落在 (0xff, 0x200) 时补 padding 扩展 (本库通常用不到, 保留规则)
+"""
+
+from __future__ import annotations
+
+import os
+import struct
+from dataclasses import dataclass, field
+
+from cryptography.hazmat.primitives.asymmetric import x25519
+
+from . import mlkem, spec
+
+HANDSHAKE_CLIENT_HELLO = 1
+SSL3_HM_HEADER_LENGTH = 4
+
+
+def _u8(x: int) -> bytes:
+    return struct.pack(">B", x)
+
+
+def _u16(x: int) -> bytes:
+    return struct.pack(">H", x)
+
+
+def _u16len(b: bytes) -> bytes:
+    return _u16(len(b)) + b
+
+
+def _u8len(b: bytes) -> bytes:
+    return _u8(len(b)) + b
+
+
+def _grease() -> int:
+    return spec.GREASE_VALUES[os.urandom(1)[0] % len(spec.GREASE_VALUES)]
+
+
+@dataclass
+class ClientHello:
+    """构造结果 + 完成握手所需的密钥材料"""
+
+    record: bytes
+    handshake: bytes
+    host: str
+    random: bytes
+    session_id: bytes
+    key_share_private_x25519: x25519.X25519PrivateKey
+    x25519_public: bytes
+    mlkem_ek: bytes
+    mlkem_dk: bytes
+    grease: dict = field(default_factory=dict)
+
+    @property
+    def ja3(self) -> tuple[str, str]:
+        from .fingerprint import ja3_from_hello
+
+        return ja3_from_hello(self.record)
+
+    def explain(self) -> str:
+        from .fingerprint import describe
+
+        return describe(self.record)
+
+
+GREASE_PARTS = ("cipher", "ext", "group", "version", "sigalg", "keyshare")
+
+
+def _extension_bodies(host: str, grease: dict, greases: dict, include_mlkem: bool = True,
+                      grease_parts: tuple[str, ...] = GREASE_PARTS) -> dict[int, bytes]:
+    """返回 {扩展类型: 内容}, 内容与真 Chrome 完全一致"""
+    ek, dk = mlkem.keygen()
+    greases["mlkem_ek"] = ek
+    greases["mlkem_dk"] = dk
+
+    priv = x25519.X25519PrivateKey.generate()
+    pub = priv.public_key().public_bytes_raw()
+    greases["x25519_priv"] = priv
+    greases["x25519_pub"] = pub
+
+    bodies: dict[int, bytes] = {}
+
+    # server_name
+    host_b = host.encode("idna") if any(ord(c) > 127 for c in host) else host.encode()
+    bodies[0x0000] = _u16len(_u8(0x00) + _u16len(host_b))
+
+    # encrypted_client_hello (ECH GREASE): encrypted_client_hello.cc:732-784
+    config_id = os.urandom(1)
+    payload_len = 32 * (4 + os.urandom(1)[0] % 4) + 16   # {144,176,208,240}
+    ech = (
+        _u8(0x00)                      # type = outer
+        + _u16(0x0001)                 # kdf_id = HKDF-SHA256
+        + _u16(0x0001)                 # aead_id = AES-128-GCM
+        + config_id                    # config_id (random)
+        + _u16len(os.urandom(32))      # enc (x25519 public, 随机)
+        + _u16len(os.urandom(payload_len))  # payload (随机)
+    )
+    bodies[0xFE0D] = ech
+
+    bodies[0x0017] = b""               # extended_master_secret
+    bodies[0xFF01] = b"\x00"           # renegotiation_info
+    groups = spec.SUPPORTED_GROUPS if include_mlkem else [g for g in spec.SUPPORTED_GROUPS if g != 0x11EC]
+    if "group" in grease_parts:
+        groups = [grease["group"], *groups]
+    bodies[0x000A] = _u16len(b"".join(_u16(g) for g in groups))   # supported_groups
+    bodies[0x000B] = b"\x01\x00"       # ec_point_formats: uncompressed
+    bodies[0x0023] = b""               # session_ticket (empty)
+    bodies[0x0010] = _u16len(b"".join(_u8len(p) for p in spec.ALPN_PROTOCOLS))
+    bodies[0x0005] = b"\x01\x00\x00\x00\x00"   # status_request (OCSP)
+    sigalgs = spec.SIGNATURE_ALGORITHMS if "sigalg" not in grease_parts else [grease["sigalg"], *spec.SIGNATURE_ALGORITHMS]
+    bodies[0x000D] = _u16len(b"".join(_u16(s) for s in sigalgs))   # signature_algorithms
+    bodies[0x0012] = b""               # signed_certificate_timestamp (empty)
+    ks = b""
+    if "keyshare" in grease_parts:
+        # GREASE 组值必须与 supported_groups 里的 GREASE 相同
+        # (OpenSSL extensions_srvr.c:703 会因 key_share 的组不在 supported_groups 里而报 illegal_parameter;
+        #  真 Chrome 两处本来就是同一个值, 见 8 份抓包样本)
+        ks += _u16(grease["group"]) + _u16len(b"\x00")            # GREASE key share
+    if include_mlkem:
+        ks += _u16(0x11EC) + _u16len(ek + pub)                # X25519MLKEM768
+    ks += _u16(0x001D) + _u16len(pub)                         # x25519
+    bodies[0x0033] = _u16len(ks)     # key_share
+    bodies[0x002D] = b"\x01\x01"       # psk_key_exchange_modes: psk_dhe_ke
+    versions = spec.SUPPORTED_VERSIONS if "version" not in grease_parts else [grease["version"], *spec.SUPPORTED_VERSIONS]
+    bodies[0x002B] = _u8len(b"".join(_u16(v) for v in versions))   # supported_versions
+    bodies[0x001B] = b"\x02\x00\x02"   # compress_certificate: brotli
+    bodies[0x44CD] = _u16len(_u8len(b"h2"))     # ALPS
+
+    # trust_anchors: 32 个 ID 随机排序
+    ids = [bytes.fromhex(x) for x in spec.TRUST_ANCHOR_IDS]
+    ids = _shuffle(ids)
+    blob = b"".join(_u8len(i) for i in ids)
+    bodies[0xCA34] = _u16len(blob)
+
+    return bodies
+
+
+def _shuffle(items: list) -> list:
+    out = list(items)
+    for i in range(len(out) - 1, 0, -1):
+        j = os.urandom(4)[0] % (i + 1) if False else int.from_bytes(os.urandom(4), "big") % (i + 1)
+        out[i], out[j] = out[j], out[i]
+    return out
+
+
+def _permutation(n: int) -> list[int]:
+    """BoringSSL ssl_setup_extension_permutation (extensions.cc:4306-4328) 的 Fisher-Yates"""
+    perm = list(range(n))
+    seeds = [int.from_bytes(os.urandom(4), "big") for _ in range(n - 1)]
+    for i in range(n - 1, 0, -1):
+        j = seeds[i - 1] % (i + 1)
+        perm[i], perm[j] = perm[j], perm[i]
+    return perm
+
+
+def build_client_hello(
+    host: str,
+    *,
+    permute_extensions: bool = True,
+    include_grease: bool = True,
+    include_mlkem: bool = True,
+    grease_parts: tuple[str, ...] | None = None,
+) -> ClientHello:
+    """生成 record 层字节 + 握手密钥材料"""
+    grease = {
+        "cipher": _grease(),
+        "ext1": _grease(),
+        "ext2": _grease(),
+        "group": _grease(),
+        "version": _grease(),
+        "sigalg": _grease(),
+    }
+    materials: dict = {}
+    grease["keyshare_group"] = grease["group"]   # key_share 与 supported_groups 共用同一个 GREASE 组值
+    if grease_parts is None:
+        grease_parts = GREASE_PARTS if include_grease else ()
+    if not include_grease:
+        grease_parts = ()
+    # GREASE 的 key_share 与 supported_groups 必须成对出现(否则服务器报 illegal_parameter)
+    if "keyshare" in grease_parts and "group" not in grease_parts:
+        grease_parts = (*grease_parts, "group")
+    bodies = _extension_bodies(host, grease, materials, include_mlkem=include_mlkem,
+                               grease_parts=grease_parts)
+
+    client_random = os.urandom(32)
+    session_id = os.urandom(32)
+
+    hello = bytearray()
+    hello += b"\x03\x03"                          # legacy_version = TLS1.2
+    hello += client_random
+    hello += _u8len(session_id)                   # 32 字节随机 session id
+    ciphers = ([grease["cipher"]] if "cipher" in grease_parts else []) + spec.CIPHER_SUITES
+    hello += _u16len(b"".join(_u16(c) for c in ciphers))
+    hello += _u8len(b"\x00")                      # compression: null
+
+    # ---- 扩展 ----
+    exts = bytearray()
+    if include_grease:
+        exts += _u16(grease["ext1"]) + _u16(0)    # 空 GREASE 扩展, 永远第一个
+
+    order = _permutation(spec.NUM_EXT_SLOTS) if permute_extensions else list(range(spec.NUM_EXT_SLOTS))
+    last_was_empty = False
+    for idx in order:
+        ext_type = spec.EXT_TABLE[idx]
+        body = bodies.get(ext_type)
+        if body is None:
+            continue
+        exts += _u16(ext_type) + _u16len(body)
+        last_was_empty = len(body) == 0
+
+    if include_grease:
+        exts += _u16(grease["ext2"]) + _u16len(b"\x00")   # 1 字节 GREASE 扩展, 永远最后
+        last_was_empty = False
+
+    # ---- padding 规则 (extensions.cc:4527-4560) ----
+    msg_len = SSL3_HM_HEADER_LENGTH + len(hello) + 2 + len(exts)
+    padding_len = 0
+    if last_was_empty:
+        padding_len = 1
+        msg_len += 4 + padding_len
+    if 0xFF < msg_len < 0x200:
+        if padding_len:
+            msg_len -= 4 + padding_len
+        padding_len = 0x200 - msg_len
+        if padding_len == 0:
+            padding_len = 1
+    if padding_len:
+        exts += _u16(0x0015) + _u16len(b"\x00" * padding_len)
+
+    hello += _u16len(bytes(exts))
+
+    handshake = _u8(HANDSHAKE_CLIENT_HELLO) + len(hello).to_bytes(3, "big") + bytes(hello)
+    record = b"\x16\x03\x01" + _u16(len(handshake)) + handshake
+
+    return ClientHello(
+        record=record,
+        handshake=handshake,
+        host=host,
+        random=client_random,
+        session_id=session_id,
+        key_share_private_x25519=materials["x25519_priv"],
+        x25519_public=materials["x25519_pub"],
+        mlkem_ek=materials["mlkem_ek"],
+        mlkem_dk=materials["mlkem_dk"],
+        grease=grease,
+    )