Removed X25519MLKEM768 from optional supported groups

proxy/fake_tls.py

@@ -272,6 +272,7 @@ async def probe_appdata_len(domain: str, port: int = 443,
     writer = None
     try:
         ctx = ssl.create_default_context()
+        ctx.set_ecdh_curve('X25519')
         ctx.check_hostname = False
         ctx.verify_mode = ssl.CERT_NONE
         ctx.minimum_version = ssl.TLSVersion.TLSv1_3

proxy/utils.py

@@ -149,6 +149,7 @@ def create_ssl_context(*, check_hostname: bool = True) -> ssl.SSLContext:
               if bundle_dir else certifi.where())
     context = ssl.create_default_context(cafile=cafile)
     context.load_default_certs()
+    context.set_ecdh_curve('X25519')
     context.check_hostname = check_hostname
     return context
 

tests/test_fake_tls.py

@@ -366,6 +366,9 @@ class ProbeAppdataLenTest(unittest.TestCase):
                     probe_appdata_len('localhost', timeout=0.1), timeout=2)
             self.assertIsNone(result)
             reader.read.assert_not_called()
+            hello = writer.write.call_args[0][0]
+            self.assertEqual(parse_client_hello(hello).key_shares,
+                             {GROUP_X25519: X25519_KEY_LEN})
             writer.close.assert_called_once()
 
         asyncio.run(scenario())