Post B5574w1ItxHHyk9AjQ by benjojo@benjojo.co.uk
 (DIR) More posts by benjojo@benjojo.co.uk
 (DIR) Post #B5574vXsfLk4VUNfs0 by benjojo@benjojo.co.uk
       0 likes, 1 repeats
       
       How many TCP segments is a reasonable number for a TLS Client Hello?Depending on your network set up, for connecting to bgp.tools until maybe a couple of hours ago the (non reasonable, but real) answer may have been up to 22!It turns out on IPv4 bgp.tools has been advertising the wrong TCP window scale for quite some time and it's a true testament to TCP's flexibility that any of this was working in the first place.Regardless, connection setups on bgp.tools should now work a little better on IPv4 now that your machine wont have to send 21 extra packets
       
 (DIR) Post #B5574w1ItxHHyk9AjQ by benjojo@benjojo.co.uk
       0 likes, 0 repeats
       
       It was only figured out because of a Fortinet/FortiGate firewall user who wrote a email to me about having weird problems with accessing bgp.tools, and them being patient for debugging on both sides over email.Remember, if you see weird stuff, email it in! It's entirely possible your setup is unearthing some deeply cursed behaviour that the operator would really like to know aboutApparently FortiGate's do not like it when you send your TLS Client Hello spread over 10+ packets, I don't really blame them since that does look quite insane over the wire
       
 (DIR) Post #B5574wXYy159anEw0u by FritzAdalis@infosec.exchange
       0 likes, 0 repeats
       
       @benjojo Knowing Fortinet it's probably a vuln.
       
 (DIR) Post #B5574xJQ65MZzDd9bk by bortzmeyer@mastodon.gougere.fr
       0 likes, 0 repeats
       
       @benjojo It will be even funnier with the large keys of PQC, no?
       
 (DIR) Post #B557520Se0AWXrnaFc by hailey@hails.org
       0 likes, 0 repeats
       
       @benjojo a true testament to the fact that being good at computers only means your computers are broken in more novel and exciting ways
       
 (DIR) Post #B55752rdSIhfCmg38K by LapTop006@aus.social
       0 likes, 0 repeats
       
       @benjojo OpenVPN for a long time used an initial window of 64 byte for TLS setup, I fixed our corp version to at least do 576, it was long enough ago that I couldn't defend 1280, although they did fix upstream a few months later