Repository navigation
Advertise HTTP/1.1 ALPN to avoid Linux TLS-profile blocking - #3
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Reddit returns non-JSON 403 responses for a Linux/OpenSSL-style handshake while otherwise identical requests succeed with HTTP/1.1 ALPN. Controlled tests alternated the same anonymous token, headers, and listing/encoded-thread URLs: the native-style profile returned 403 and adding ALPN returned valid JSON with 200. Header capitalization, connection reuse, and DNS edge selection did not explain the difference.
Configure the shared HTTPS connector to advertise only
http/1.1, matching the protocol the client uses. This covers OAuth, API, and proxied HTTPS requests. Keep the platform TLS defaults, certificate verification, and existing request/route behavior. Add a direct ALPN-enabled native-tls dependency at the already locked version; no dependency versions change.A loopback regression test reads the actual production connector's TLS ClientHello and asserts its advertised ALPN protocols. Removing the ALPN setting makes this test fail. Local formatting, Clippy, and all 41 offline tests pass. Hosted Linux formatting, Clippy, complete-suite compilation, and all 41 offline tests also passed. Release https://github.com/jeffstephens/redlib/actions/runs/39677199865 published ARM64/AMD64 images from
b153b11ccb25.The actual ARM64 image was functionally checked against Reddit: listings, multiple threads, a comment permalink, additional replies, and proxied image media returned HTTP 200 with expected content. A second fresh process/session also loaded listings and threads. The previous image still received Reddit blocks during the same comparison.
Update generic fork notes; no operator-specific deployment details belong here.