D4
/
sensor-d4-tls-fingerprinting
mirror of https://github.com/D4-project/sensor-d4-tls-fingerprinting
2
0
Fork 0
Code Issues Releases Wiki Activity

Merge branch 'greasebug'

master
Jean-Louis Huynen 2019-06-12 15:09:35 +02:00
parent 4f74dea4e3 01695baaee
commit df5ce5c687
1 changed files with 14 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
d4tls/fingerprinter.go
View File

@ -10,6 +10,9 @@ import (
"github.com/glaslos/tlsh"
)
// see https://tools.ietf.org/html/draft-ietf-tls-grease-02
// grease values for cipher suites, ALPN and identifiers,
// extensions, named groups, signatur algorithms, and versions.
var grease = map[uint16]bool{
0x0a0a: true, 0x1a1a: true, 0x2a2a: true, 0x3a3a: true,
0x4a4a: true, 0x5a5a: true, 0x6a6a: true, 0x7a7a: true,
@ -17,7 +20,7 @@ var grease = map[uint16]bool{
0xcaca: true, 0xdada: true, 0xeaea: true, 0xfafa: true,
}
// D4Fingerprinting computes fingerprints doh
// D4Fingerprinting computes fingerprints
func (t *TLSSession) D4Fingerprinting(fd string) bool {
switch fd {
case "ja3":
@ -117,23 +120,27 @@ func (t *TLSSession) ja3() bool {
// If there are Supported Curves
if len(t.handShakeRecord.ETLSHandshakeClientHello.SupportedCurves) > 0 {
for i, cs := range t.handShakeRecord.ETLSHandshakeClientHello.SupportedCurves {
if grease[uint16(cs)] == false {
buf = strconv.AppendInt(buf, int64(cs), 10)
if (i + 1) < len(t.handShakeRecord.ETLSHandshakeClientHello.SupportedCurves) {
buf = append(buf, byte(45))
}
}
}
}
buf = append(buf, byte(44))
// If there are Supported Points
if len(t.handShakeRecord.ETLSHandshakeClientHello.SupportedPoints) > 0 {
for i, cs := range t.handShakeRecord.ETLSHandshakeClientHello.SupportedPoints {
if grease[uint16(cs)] == false {
buf = strconv.AppendInt(buf, int64(cs), 10)
if (i + 1) < len(t.handShakeRecord.ETLSHandshakeClientHello.SupportedPoints) {
buf = append(buf, byte(45))
}
}
}
}
t.Record.JA3 = string(buf)
tmp := md5.Sum(buf)
t.Record.JA3Digest = hex.EncodeToString(tmp[:])