ALPS new codepoint (17613) is dropped from $http_ssl_ja3 / $http_ssl_ja4 — current Chrome conflated with no-ALPS clients

[hsw]

Summary

The OpenSSL patches declare an ext_defs[] slot only for the legacy ALPS codepoint 17513. BoringSSL has rotated the experimental ALPS deployment to 17613 and made it the default; current Chrome stable ships the new codepoint. Without a slot for 17613, it lands in the unknown bucket and disappears from $http_ssl_ja3 and $http_ssl_ja4. Modern Chrome ends up indistinguishable from a no-ALPS client.

Reproduction

JA3 extensions list, current Chrome ClientHello with default ALPS:

wire:           0-5-10-11-13-16-18-23-27-35-43-45-51-17613-65037-65281
$http_ssl_ja3:  0-5-10-11-13-16-18-23-27-35-43-45-51-65037-65281

17613 is silently dropped. Older Chrome (or --disable-features=UseNewAlpsCodepointHttp2) emits 17513, which IS captured.

Where the rotation happened

• 2025-02-10 Chromium 90243a74 — Enable Alps new codepoint as default. Flips kUseNewAlpsCodepointHttp2 to FEATURE_ENABLED_BY_DEFAULT. Commit body cites 1% / 10% Stable Finch metrics review.
• 2025-03-31 BoringSSL c86127e6 — Change to use ALPS new codepoint as default. Flips SSL_CONFIG::alps_use_new_codepoint library default to true.
• 2025-06-13 Chromium 220d5910 — same flip for QUIC; the HTTP/2 flag had been default-on "about four milestones" by then.

Current state

BoringSSL include/openssl/tls1.h:

// ExtensionType value from draft-vvv-tls-alps. This is not an IANA defined
// extension number.
#define TLSEXT_TYPE_application_settings_old 17513
#define TLSEXT_TYPE_application_settings 17613

Chromium net/base/features.cc:350-352:

BASE_FEATURE(kUseNewAlpsCodepointHttp2, base::FEATURE_ENABLED_BY_DEFAULT);
BASE_FEATURE(kUseNewAlpsCodepointQUIC,  base::FEATURE_ENABLED_BY_DEFAULT);

Chrome stable from M135 onwards ships 17613; M133 and earlier emit 17513; M134 was the Finch transition window.

Fix

PR follows the BoringSSL naming: rename existing TLSEXT_TYPE_application_settings (= 17513) → _old, and let TLSEXT_TYPE_application_settings become the canonical 17613. SSL_client_hello_get_ja_data() is unchanged — it walks pre_proc_exts[] by received_order and picks up either codepoint in its wire-order position.

Both openssl-3.5.6.patch and openssl-3.6.2.patch get the same hunk.