D4
/
sensor-d4-tls-fingerprinting
mirror of https://github.com/D4-project/sensor-d4-tls-fingerprinting
2
0
Fork 0
Code Issues Releases Wiki Activity

some changes after checking GREASE

DecodingLayerParser
Jean-Louis Huynen 2019-02-06 10:06:05 +01:00
parent b1d2b9bbe4
commit 32a75bfa95
1 changed files with 10 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
d4tls/d4tls.go
View File

@ -145,14 +145,15 @@ func (t *TLSSession) ja3s() bool {
// byte (44) is "," // byte (44) is ","
buf = append(buf, byte(44)) buf = append(buf, byte(44))
// If there are Cipher Suites // If the Server Cipher is not in GREASE
if grease[uint16(t.handShakeRecord.ETLSHandshakeServerHello.CipherSuite)] == false {
buf = strconv.AppendInt(buf, int64(t.handShakeRecord.ETLSHandshakeServerHello.CipherSuite), 10) buf = strconv.AppendInt(buf, int64(t.handShakeRecord.ETLSHandshakeServerHello.CipherSuite), 10)
}
buf = append(buf, byte(44)) buf = append(buf, byte(44))
// If there are extensions // If there are extensions
if len(t.handShakeRecord.ETLSHandshakeServerHello.AllExtensions) > 0 { if len(t.handShakeRecord.ETLSHandshakeServerHello.AllExtensions) > 0 {
for i, e := range t.handShakeRecord.ETLSHandshakeServerHello.AllExtensions { for i, e := range t.handShakeRecord.ETLSHandshakeServerHello.AllExtensions {
// TODO check this grease thingy
if grease[uint16(e)] == false { if grease[uint16(e)] == false {
buf = strconv.AppendInt(buf, int64(e), 10) buf = strconv.AppendInt(buf, int64(e), 10)
if (i + 1) < len(t.handShakeRecord.ETLSHandshakeServerHello.AllExtensions) { if (i + 1) < len(t.handShakeRecord.ETLSHandshakeServerHello.AllExtensions) {
@ -179,6 +180,7 @@ func (t *TLSSession) ja3() bool {
// If there are Cipher Suites // If there are Cipher Suites
if len(t.handShakeRecord.ETLSHandshakeClientHello.CipherSuites) > 0 { if len(t.handShakeRecord.ETLSHandshakeClientHello.CipherSuites) > 0 {
for i, cs := range t.handShakeRecord.ETLSHandshakeClientHello.CipherSuites { for i, cs := range t.handShakeRecord.ETLSHandshakeClientHello.CipherSuites {
if grease[uint16(cs)] == false {
buf = strconv.AppendInt(buf, int64(cs), 10) buf = strconv.AppendInt(buf, int64(cs), 10)
// byte(45) is "-" // byte(45) is "-"
if (i + 1) < len(t.handShakeRecord.ETLSHandshakeClientHello.CipherSuites) { if (i + 1) < len(t.handShakeRecord.ETLSHandshakeClientHello.CipherSuites) {
@ -186,12 +188,12 @@ func (t *TLSSession) ja3() bool {
} }
} }
} }
}
buf = append(buf, byte(44)) buf = append(buf, byte(44))
// If there are extensions // If there are extensions
if len(t.handShakeRecord.ETLSHandshakeClientHello.AllExtensions) > 0 { if len(t.handShakeRecord.ETLSHandshakeClientHello.AllExtensions) > 0 {
for i, e := range t.handShakeRecord.ETLSHandshakeClientHello.AllExtensions { for i, e := range t.handShakeRecord.ETLSHandshakeClientHello.AllExtensions {
// TODO check this grease thingy
if grease[uint16(e)] == false { if grease[uint16(e)] == false {
buf = strconv.AppendInt(buf, int64(e), 10) buf = strconv.AppendInt(buf, int64(e), 10)
if (i + 1) < len(t.handShakeRecord.ETLSHandshakeClientHello.AllExtensions) { if (i + 1) < len(t.handShakeRecord.ETLSHandshakeClientHello.AllExtensions) {