D4
/
sensor-d4-tls-fingerprinting
mirror of https://github.com/D4-project/sensor-d4-tls-fingerprinting
2
0
Fork 0
Code Issues Releases Wiki Activity

Merge branch 'greasebug'

master
Jean-Louis Huynen 2019-06-12 15:09:35 +02:00
parent 4f74dea4e3 01695baaee
commit df5ce5c687
1 changed files with 14 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
d4tls/fingerprinter.go
View File

@ -10,6 +10,9 @@ import (
"github.com/glaslos/tlsh" "github.com/glaslos/tlsh"
) )
// see https://tools.ietf.org/html/draft-ietf-tls-grease-02
// grease values for cipher suites, ALPN and identifiers,
// extensions, named groups, signatur algorithms, and versions.
var grease = map[uint16]bool{ var grease = map[uint16]bool{
0x0a0a: true, 0x1a1a: true, 0x2a2a: true, 0x3a3a: true, 0x0a0a: true, 0x1a1a: true, 0x2a2a: true, 0x3a3a: true,
0x4a4a: true, 0x5a5a: true, 0x6a6a: true, 0x7a7a: true, 0x4a4a: true, 0x5a5a: true, 0x6a6a: true, 0x7a7a: true,
@ -17,7 +20,7 @@ var grease = map[uint16]bool{
0xcaca: true, 0xdada: true, 0xeaea: true, 0xfafa: true, 0xcaca: true, 0xdada: true, 0xeaea: true, 0xfafa: true,
} }
// D4Fingerprinting computes fingerprints doh // D4Fingerprinting computes fingerprints
func (t *TLSSession) D4Fingerprinting(fd string) bool { func (t *TLSSession) D4Fingerprinting(fd string) bool {
switch fd { switch fd {
case "ja3": case "ja3":
@ -117,9 +120,11 @@ func (t *TLSSession) ja3() bool {
// If there are Supported Curves // If there are Supported Curves
if len(t.handShakeRecord.ETLSHandshakeClientHello.SupportedCurves) > 0 { if len(t.handShakeRecord.ETLSHandshakeClientHello.SupportedCurves) > 0 {
for i, cs := range t.handShakeRecord.ETLSHandshakeClientHello.SupportedCurves { for i, cs := range t.handShakeRecord.ETLSHandshakeClientHello.SupportedCurves {
buf = strconv.AppendInt(buf, int64(cs), 10) if grease[uint16(cs)] == false {
if (i + 1) < len(t.handShakeRecord.ETLSHandshakeClientHello.SupportedCurves) { buf = strconv.AppendInt(buf, int64(cs), 10)
buf = append(buf, byte(45)) if (i + 1) < len(t.handShakeRecord.ETLSHandshakeClientHello.SupportedCurves) {
buf = append(buf, byte(45))
}
} }
} }
} }
@ -128,9 +133,11 @@ func (t *TLSSession) ja3() bool {
// If there are Supported Points // If there are Supported Points
if len(t.handShakeRecord.ETLSHandshakeClientHello.SupportedPoints) > 0 { if len(t.handShakeRecord.ETLSHandshakeClientHello.SupportedPoints) > 0 {
for i, cs := range t.handShakeRecord.ETLSHandshakeClientHello.SupportedPoints { for i, cs := range t.handShakeRecord.ETLSHandshakeClientHello.SupportedPoints {
buf = strconv.AppendInt(buf, int64(cs), 10) if grease[uint16(cs)] == false {
if (i + 1) < len(t.handShakeRecord.ETLSHandshakeClientHello.SupportedPoints) { buf = strconv.AppendInt(buf, int64(cs), 10)
buf = append(buf, byte(45)) if (i + 1) < len(t.handShakeRecord.ETLSHandshakeClientHello.SupportedPoints) {
buf = append(buf, byte(45))
}
} }
} }
} }