From a70fc8c5c1437a89a45ca74a3a62e5185e8e91a8 Mon Sep 17 00:00:00 2001
From: Flowseal <sellyalegium@gmail.com>
Date: Fri, 30 Oct 2026 18:44:15 +0300
Subject: [PATCH] Removed X25519MLKEM768 from optional supported groups

---
 proxy/fake_tls.py      | 1 +
 proxy/utils.py         | 1 +
 tests/test_fake_tls.py | 3 +++
 3 files changed, 5 insertions(+)

diff --git a/proxy/fake_tls.py b/proxy/fake_tls.py
index 153783c..389bb59 100644
--- a/proxy/fake_tls.py
+++ b/proxy/fake_tls.py
@@ -272,6 +272,7 @@ async def probe_appdata_len(domain: str, port: int = 443,
     writer = None
     try:
         ctx = ssl.create_default_context()
+        ctx.set_ecdh_curve('X25519')
         ctx.check_hostname = False
         ctx.verify_mode = ssl.CERT_NONE
         ctx.minimum_version = ssl.TLSVersion.TLSv1_3
diff --git a/proxy/utils.py b/proxy/utils.py
index 930965e..4e6369d 100644
--- a/proxy/utils.py
+++ b/proxy/utils.py
@@ -149,6 +149,7 @@ def create_ssl_context(*, check_hostname: bool = True) -> ssl.SSLContext:
               if bundle_dir else certifi.where())
     context = ssl.create_default_context(cafile=cafile)
     context.load_default_certs()
+    context.set_ecdh_curve('X25519')
     context.check_hostname = check_hostname
     return context
 
diff --git a/tests/test_fake_tls.py b/tests/test_fake_tls.py
index e26b21d..f2b0b91 100644
--- a/tests/test_fake_tls.py
+++ b/tests/test_fake_tls.py
@@ -366,6 +366,9 @@ class ProbeAppdataLenTest(unittest.TestCase):
                     probe_appdata_len('localhost', timeout=0.1), timeout=2)
             self.assertIsNone(result)
             reader.read.assert_not_called()
+            hello = writer.write.call_args[0][0]
+            self.assertEqual(parse_client_hello(hello).key_shares,
+                             {GROUP_X25519: X25519_KEY_LEN})
             writer.close.assert_called_once()
 
         asyncio.run(scenario())