http_quik/profile/
mod.rs

1//! Data-only definitions for Chrome transport identity profiles.
2//!
3//! This module defines the configuration schemas used by the `tls` and `http2`
4//! modules to construct browser-identical network handshakes. No protocol
5//! logic resides here; these structures serve as the single source of truth
6//! for all fingerprint-sensitive parameters.
7//!
8//! Each [`ChromeProfile`] encodes a complete, multi-layer network identity
9//! spanning TLS (Layer 4), HTTP/2 (Layer 5), and HTTP metadata (Layer 7).
10
11use boring::ssl::SslVersion;
12
13pub mod chrome_134;
14
15/// Alias for BoringSSL's internal version type.
16pub type TlsVersion = SslVersion;
17
18/// Target operating system and CPU architecture.
19///
20/// The platform determines OS-specific protocol parameters (ALPS payload
21/// length, User-Agent string, Client Hint values) and is used by
22/// [`chrome_134::profile_auto`] to align the network persona with the
23/// host kernel's TCP/IP characteristics.
24#[derive(Debug, Clone, Copy, PartialEq, Eq)]
25pub enum Platform {
26    /// macOS on Apple Silicon (M1/M2/M3/M4).
27    MacOsArm,
28    /// macOS on Intel x86-64.
29    MacOsX86,
30    /// Windows 10/11 on x86-64.
31    WindowsX64,
32    /// Linux (Ubuntu, Debian, etc.) on x86-64.
33    LinuxX64,
34}
35
36/// Configuration for the TLS 1.2/1.3 handshake layer.
37///
38/// This structure defines the Layer 4 identity of the client. Small changes
39/// here (such as the order of cipher suites) will change the JA3/JA4
40/// fingerprint and can lead to immediate detection.
41#[derive(Debug, Clone, Copy, PartialEq, Eq)]
42pub struct TlsProfile {
43    /// Minimum allowed TLS version (typically TLS 1.2).
44    pub min_version: TlsVersion,
45    /// Maximum allowed TLS version (typically TLS 1.3).
46    pub max_version: TlsVersion,
47    /// Colon-separated list of cipher suites in OpenSSL format.
48    ///
49    /// Precision in the order of this list is critical as it directly
50    /// impacts the JA3/JA4 fingerprint.
51    pub cipher_list: &'static str,
52    /// Numeric IDs for supported elliptic curve groups.
53    pub curves: &'static [u16],
54    /// Whether to enable TLS GREASE (RFC 8701) to simulate randomized extensions.
55    pub grease_enabled: bool,
56    /// Whether to permute (shuffle) TLS extensions per connection.
57    pub permute_extensions: bool,
58    /// Whether to send a dummy ECH (Encrypted Client Hello) extension for GREASE.
59    pub enable_ech_grease: bool,
60    /// Whether to enable ALPS (Application-Layer Protocol Settings).
61    pub alps_enabled: bool,
62    /// Whether to use the draft-01 or final ALPS codepoint.
63    pub alps_use_new_codepoint: bool,
64    /// Additional H2 SETTINGS IDs to append in the ALPS payload.
65    ///
66    /// Windows and Linux Chrome include an extra setting (ID 31386) in the
67    /// ALPS handshake data that macOS omits. Each tuple is `(id, value)`.
68    pub alps_extra_settings: &'static [(u16, u32)],
69    /// Whether to support RFC 8879 certificate compression (Brotli).
70    pub compress_certificate: bool,
71    /// Whether to enable stateless session tickets for fast reconnection.
72    pub session_ticket_enabled: bool,
73    /// Ordered list of ALPN protocol identifiers.
74    pub alpn_protocols: &'static [&'static [u8]],
75    /// Ordered list of signature algorithm IDs (used for JA4_r).
76    pub sigalgs: &'static [u16],
77    /// Whether to verify the server's certificate chain.
78    ///
79    /// Real browsers always verify certificates. Disable only for testing or
80    /// local proxy interception.
81    pub verify_peer: bool,
82}
83
84/// Initial HTTP/2 SETTINGS frame parameters.
85///
86/// The values and the *order* in which they are sent are used by Akamai
87/// and other WAFs to identify the client implementation.
88#[derive(Debug, Clone, Copy, PartialEq, Eq)]
89pub struct SettingsFrame {
90    /// SETTINGS_HEADER_TABLE_SIZE (ID 0x1).
91    pub header_table_size: u32,
92    /// SETTINGS_ENABLE_PUSH (ID 0x2).
93    pub enable_push: bool,
94    /// SETTINGS_INITIAL_WINDOW_SIZE (ID 0x4).
95    pub initial_window_size: u32,
96    /// SETTINGS_MAX_HEADER_LIST_SIZE (ID 0x6).
97    pub max_header_list_size: u32,
98}
99
100/// Configuration for the HTTP/2 protocol layer.
101///
102/// Defines the Layer 5 identity, focusing on behavioral markers like
103/// pseudo-header ordering and stream priority.
104#[derive(Debug, Clone, Copy, PartialEq, Eq)]
105pub struct Http2Profile {
106    /// Initial SETTINGS frame values and order.
107    pub settings: SettingsFrame,
108    /// Total connection-level window size (default + delta).
109    ///
110    /// This value determines the initial `WINDOW_UPDATE` frame increment
111    /// sent immediately after the handshake. Chrome uses a specific non-standard
112    /// increment that acts as a strong identity signal.
113    pub initial_connection_window_size: u32,
114    /// Ordering of pseudo-headers (e.g., :method, :authority, :scheme, :path).
115    pub pseudo_order: [PseudoOrder; 4],
116    /// Priority parameters for the initial HEADERS frame.
117    pub headers_priority: HeadersPriority,
118}
119
120/// Stream priority parameters embedded in the HEADERS frame.
121#[derive(Debug, Clone, Copy, PartialEq, Eq)]
122pub struct HeadersPriority {
123    /// Stream ID that this request depends on (typically 0).
124    pub dep: u32,
125    /// Priority weight (0-255).
126    pub weight: u8,
127    /// Whether this dependency is exclusive.
128    pub exclusive: bool,
129}
130
131/// Canonical HTTP/2 pseudo-header identifiers.
132#[derive(Debug, Clone, Copy, PartialEq, Eq)]
133pub enum PseudoOrder {
134    /// `:method`
135    Method,
136    /// `:authority`
137    Authority,
138    /// `:scheme`
139    Scheme,
140    /// `:path`
141    Path,
142}
143
144/// Chrome-specific HTTP header values and Client Hint metadata.
145///
146/// These values are injected into every outbound request and must match
147/// the declared platform. WAFs cross-check `sec-ch-ua-platform` against
148/// the TLS handshake and TCP stack to detect spoofed identities.
149#[derive(Debug, Clone, PartialEq, Eq)]
150pub struct HeaderProfile {
151    /// Full `User-Agent` header value.
152    pub user_agent: String,
153    /// `sec-ch-ua` Client Hint brand list.
154    pub sec_ch_ua: String,
155    /// `sec-ch-ua-platform` Client Hint (e.g., `"macOS"`, `"Windows"`, `"Linux"`).
156    pub sec_ch_ua_platform: String,
157    /// `sec-ch-ua-platform-version` Client Hint.
158    ///
159    /// Must match the host OS: Windows 11 reports `"13.0.0"`,
160    /// macOS Sequoia reports `"15.0.0"`, Linux reports `"0.0.0"`.
161    pub sec_ch_ua_platform_version: String,
162    /// Whether to include the RFC 9218 `priority` header (e.g., `u=0, i`).
163    pub include_priority_header: bool,
164    /// Whether to advertise `zstd` in the `accept-encoding` header.
165    pub zstd_encoding: bool,
166}
167
168/// A complete, multi-layer identity profile for a Chrome instance.
169///
170/// Combines TLS, HTTP/2, and HTTP metadata into a single configuration
171/// that, when applied, makes the transport layer indistinguishable from
172/// the specified Chrome version and platform.
173#[derive(Debug, Clone, PartialEq, Eq)]
174pub struct ChromeProfile {
175    /// Major Chrome version (e.g., `134`).
176    pub version: u32,
177    /// Target operating system and architecture.
178    pub platform: Platform,
179    /// TLS handshake configuration (JA3/JA4 fingerprint source).
180    pub tls: TlsProfile,
181    /// HTTP/2 handshake configuration (Akamai fingerprint source).
182    pub h2: Http2Profile,
183    /// HTTP-level metadata and Client Hints.
184    pub headers: HeaderProfile,
185}
http_quik/profile/mod.rs

http_quik/profile/
mod.rs
