From 2636182c83caa48c9b24838fa9fa45488bdc8c29 Mon Sep 17 00:00:00 2001 From: Timothy Noel Date: Wed, 20 Dec 2023 10:10:07 -0500 Subject: [PATCH] Fixes non-ascii ALPN values (#37) * fix for issue #21, original order * fix for issue #30 ALPN values * fix for issue #16 --- python/ja4.py | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-) diff --git a/python/ja4.py b/python/ja4.py index 08360e2..9ead8f2 100644 --- a/python/ja4.py +++ b/python/ja4.py @@ -184,13 +184,15 @@ def to_ja4s(x, debug_stream): version = TLS_MAPPER[x['version']] if x['version'] in TLS_MAPPER else '00' alpn = '00' - if 'alpn' in x: - alpn = x['alpn'] - elif 'alpn_list' in x: + if 'alpn_list' in x: if isinstance(x['alpn_list'], list): alpn = x['alpn_list'][0] else: alpn = x['alpn_list'] + if len(alpn) > 2: + alpn = f"{alpn[0]}{alpn[-1]}" + if ord(alpn[0]) > 127: + alpn = '99' x['JA4S'] = f"{ptype}{version}{ext_len}{alpn}_{x['ciphers']}_{extensions}" x['JA4S_r'] = f"{ptype}{version}{ext_len}{alpn}_{x['ciphers']}_{','.join(x['extensions'])}" @@ -232,14 +234,18 @@ def to_ja4(x, debug_stream): version = TLS_MAPPER[x['version']] if x['version'] in TLS_MAPPER else '00' alpn = '00' - if 'alpn' in x: - alpn = x['alpn'] - elif 'alpn_list' in x: + if 'alpn_list' in x: if isinstance(x['alpn_list'], list): alpn = x['alpn_list'][0] else: alpn = x['alpn_list'] + if len(alpn) > 2: + alpn = f"{alpn[0]}{alpn[-1]}" + + if ord(alpn[0]) > 127: + alpn = '99' + x['JA4'] = f"{ptype}{version}{sni}{cipher_len}{ext_len}{alpn}_{sorted_ciphers}_{sorted_extensions}" x['JA4_o'] = f"{ptype}{version}{sni}{cipher_len}{ext_len}{alpn}_{original_ciphers}_{original_extensions}" x['JA4_r'] = f"{ptype}{version}{sni}{cipher_len}{ext_len}{alpn}_{x['sorted_ciphers']}_{x['sorted_extensions']}"