deadline handshake

.github/workflows/build-test.yml

@@ -11,7 +11,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - uses: projectdiscovery/actions/setup/go@v1
-      - uses: projectdiscovery/actions/golangci-lint@v1
+      - uses: projectdiscovery/actions/golangci-lint/v2@v1
 
   build:
     name: Test Builds

README.md

@@ -23,7 +23,15 @@ For more details and documentation refer [GoDoc](https://pkg.go.dev/github.com/p
 
 ### ZTLS Fallback
 
-fastdialer by default fallbacks to using zcrypto when there is an error in TLS handshake (insufficient security level etc ). This is done to support older TLS versions and ciphers. This can be disabled in fastdialer options or by using `DISABLE_ZTLS_FALLBACK=true` environment variable. when falling back to ztls, ChromeCiphers are used
+When the TLS handshake of `DialTLS` or `DialTLSWithConfig` fails, fastdialer retries it once with zcrypto (ztls), to reach servers that `crypto/tls` rejects, such as servers with old TLS versions or legacy ciphers. The retry uses `ztls.ChromeCiphers` and the default ztls curves instead of the cipher suites and curve preferences of the config. It retries only when:
+
+- the dial context isn't done, the handshake didn't time out, and the server's reply, if any, was TLS.
+- the TLS config allows versions older than TLS 1.3.
+- the TLS config uses nothing that zcrypto can't carry over: `InsecureSkipVerify` is `true`, and the config sets no `VerifyPeerCertificate` or `VerifyConnection` callback, no `GetClientCertificate`, and no Encrypted Client Hello settings. A `Certificates` chain is copied onto the retry. Otherwise the retry would verify the server differently, omit a certificate chosen by callback, or send the hidden server name in the clear.
+
+Plain dials, including dials through a proxy, impersonated dials and ztls dials never fall back. A dial that falls back returns a `*ztls.Conn` instead of a `*tls.Conn`, which `WithTLSData` doesn't record. If the retry fails too, the error includes both failures.
+
+To disable the fallback, set `DisableZtlsFallback` in the options or `DISABLE_ZTLS_FALLBACK=true` in the environment. Either one is enough.
 
 # Example
 

fastdialer/dial_result_test.go

@@ -0,0 +1,129 @@
+package fastdialer
+
+import (
+	"context"
+	"net"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+	"golang.org/x/net/proxy"
+)
+
+type dialResultKey struct{}
+
+type dialResult struct {
+	tag            any
+	hostname, port string
+	err            error
+}
+
+func TestOnDialResultReportsEachConnectionAttempt(t *testing.T) {
+	listener, err := net.Listen("tcp", "127.0.0.1:0")
+	require.NoError(t, err)
+	go func() {
+		for {
+			conn, err := listener.Accept()
+			if err != nil {
+				return
+			}
+			_ = conn.Close()
+		}
+	}()
+	_, port, err := net.SplitHostPort(listener.Addr().String())
+	require.NoError(t, err)
+
+	var mu sync.Mutex
+	var results []dialResult
+	options := DefaultOptions
+	options.DialerTimeout = 2 * time.Second
+	options.OnDialResult = func(ctx context.Context, hostname, port string, err error) {
+		mu.Lock()
+		defer mu.Unlock()
+		results = append(results, dialResult{tag: ctx.Value(dialResultKey{}), hostname: hostname, port: port, err: err})
+	}
+	dialer, err := NewDialer(options)
+	require.NoError(t, err)
+	defer dialer.Close()
+
+	// the caller's context reaches the callback, so it can tell its own dials apart
+	ctx := context.WithValue(context.Background(), dialResultKey{}, "scan")
+	conn, err := dialer.Dial(ctx, "tcp", listener.Addr().String())
+	require.NoError(t, err)
+	_ = conn.Close()
+
+	require.NoError(t, listener.Close())
+	_, err = dialer.Dial(ctx, "tcp", listener.Addr().String())
+	require.Error(t, err)
+
+	mu.Lock()
+	defer mu.Unlock()
+	require.Len(t, results, 2)
+	require.Equal(t, dialResult{tag: "scan", hostname: "127.0.0.1", port: port}, results[0])
+	require.Equal(t, "scan", results[1].tag)
+	require.Equal(t, "127.0.0.1", results[1].hostname)
+	require.Equal(t, port, results[1].port)
+	require.Error(t, results[1].err)
+}
+
+// A target that never got as far as a connection attempt is not reported:
+// nothing was asked of the host.
+func TestOnDialResultSkipsTargetsNeverDialed(t *testing.T) {
+	called := false
+	options := DefaultOptions
+	options.OnDialResult = func(context.Context, string, string, error) { called = true }
+	dialer, err := NewDialer(options)
+	require.NoError(t, err)
+	defer dialer.Close()
+
+	_, err = dialer.Dial(context.Background(), "tcp", "127.0.0.1")
+	require.ErrorIs(t, err, NoPortSpecifiedError)
+	require.False(t, called)
+}
+
+// nilAddrConn reports no remote address.
+type nilAddrConn struct{ net.Conn }
+
+func (nilAddrConn) RemoteAddr() net.Addr { return nil }
+
+type nilAddrProxy struct{ conn net.Conn }
+
+func (p *nilAddrProxy) Dial(network, addr string) (net.Conn, error) {
+	client, server := net.Pipe()
+	_ = server.Close()
+	p.conn = nilAddrConn{Conn: client}
+	return p.conn, nil
+}
+
+// A connection with no remote address is a failed dial, so the callback
+// reports that error rather than a success.
+func TestOnDialResultReportsMissingRemoteAddr(t *testing.T) {
+	listener, err := net.Listen("tcp", "127.0.0.1:0")
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = listener.Close() })
+
+	pdialer := &nilAddrProxy{}
+	t.Cleanup(func() {
+		if pdialer.conn != nil {
+			_ = pdialer.conn.Close()
+		}
+	})
+	var pd proxy.Dialer = pdialer
+	var got error
+	options := DefaultOptions
+	options.ProxyDialer = &pd
+	options.OnDialResult = func(_ context.Context, _, _ string, err error) { got = err }
+
+	dialer, err := NewDialer(options)
+	require.NoError(t, err)
+	defer dialer.Close()
+
+	conn, err := dialer.Dial(context.Background(), "tcp", listener.Addr().String())
+	if conn != nil {
+		_ = conn.Close()
+	}
+	require.Error(t, err)
+	require.Contains(t, err.Error(), "remote address is nil")
+	require.Equal(t, err, got)
+}

fastdialer/dialer.go

@@ -22,7 +22,6 @@ import (
 	"github.com/projectdiscovery/retryabledns"
 	cryptoutil "github.com/projectdiscovery/utils/crypto"
 	"github.com/projectdiscovery/utils/env"
-	"github.com/projectdiscovery/utils/errkit"
 	"github.com/zmap/zcrypto/encoding/asn1"
 	ztls "github.com/zmap/zcrypto/tls"
 	"golang.org/x/net/proxy"
@@ -165,7 +164,6 @@ func NewDialer(options Options) (*Dialer, error) {
 		dialer = &net.Dialer{
 			Timeout:   options.DialerTimeout,
 			KeepAlive: options.DialerKeepAlive,
-			DualStack: true,
 		}
 	}
 
@@ -296,6 +294,23 @@ func (d *Dialer) DialTLSWithConfig(ctx context.Context, network, address string,
 }
 
 // DialTLSWithConfigImpersonate dials tls with impersonation
+//
+// The config applies as in DialTLSWithConfig, except that the impersonated
+// ClientHello decides what it offers, such as cipher suites and curves. Only
+// TLS 1.3 sessions are stored in config.ClientSessionCache, and they resume
+// only when the ClientHello has a pre_shared_key extension. utls can't resume
+// a session when the server asks for another key share, so that dial fails
+// and drops the session.
+//
+// If config.NextProtos is set, it replaces the protocols in the ALPN extension
+// of the impersonated ClientHello, which can change its JA4 fingerprint but not
+// its JA3 one. A ClientHello without ALPN still sends none. If NextProtos is
+// empty, the ClientHello keeps its own protocols.
+//
+// config.MinVersion and config.MaxVersion limit the version that the server
+// may select, but the ClientHello still offers its own versions, so the dial
+// fails when the server selects one outside them. A zero MinVersion or
+// MaxVersion leaves that limit to the ClientHello.
 func (d *Dialer) DialTLSWithConfigImpersonate(ctx context.Context, network, address string, config *tls.Config, impersonate impersonate.Strategy, identity *impersonate.Identity) (conn net.Conn, err error) {
 	return d.dial(ctx, &dialOptions{
 		network:             network,
@@ -311,23 +326,6 @@ func (d *Dialer) DialTLSWithConfigImpersonate(ctx context.Context, network, addr
 
 // DialZTLSWithConfig dials ztls with config
 func (d *Dialer) DialZTLSWithConfig(ctx context.Context, network, address string, config *ztls.Config) (conn net.Conn, err error) {
-	// ztls doesn't support tls13
-	if IsTLS13(config) {
-		stdTLSConfig, err := AsTLSConfig(config)
-		if err != nil {
-			return nil, errkit.Wrap(err, "could not convert ztls config to tls config")
-		}
-		return d.dial(ctx, &dialOptions{
-			network:             network,
-			address:             address,
-			shouldUseTLS:        true,
-			shouldUseZTLS:       false,
-			tlsconfig:           stdTLSConfig,
-			ztlsconfig:          nil,
-			impersonateStrategy: impersonate.None,
-			impersonateIdentity: nil,
-		})
-	}
 	return d.dial(ctx, &dialOptions{
 		network:             network,
 		address:             address,