also added fix for #48

python/common.py

@@ -96,15 +96,18 @@ def sha_encode(values):
 # processes ciphers found in a packet
 # tshark keeps the ciphers either as a list or as a single value
 # based on whether it is ciphersuites or ciphersuite
-def get_hex_sorted(values, sort=True):
+def get_hex_sorted(entry, field, sort=True):
+    values = entry[field]
     if not isinstance(values, list):
         values = [ values ]
 
     # remove GREASE and calculate length
     c = [ x[2:] for x in values if x not in GREASE_TABLE ]
     actual_length = len(c)
+
     # now remove SNI and ALPN values
-    c = [ x for x in c if x not in ['0000', '0010']]
+    if field == 'extensions':
+        c = [ x for x in c if x not in ['0000', '0010']]
 
     c.sort() if sort else None
 

python/ja4.py

@@ -219,14 +219,14 @@ def to_ja4(x, debug_stream):
     cache_update(x, 'client_extensions', x['extensions'], debug_stream)
 
     # Modified to include original rendering
-    x['sorted_extensions'], _len, _ = get_hex_sorted(x['extensions'])
-    x['original_extensions'], _len, _ = get_hex_sorted(x['extensions'], sort=False)
+    x['sorted_extensions'], _len, _ = get_hex_sorted(x, 'extensions')
+    x['original_extensions'], _len, _ = get_hex_sorted(x, 'extensions', sort=False)
     x['sorted_extensions'] = x['sorted_extensions'] + '_' + ','.join(x['signature_algorithms'])
     x['original_extensions'] = x['original_extensions'] + '_' + ','.join(x['signature_algorithms'])
     sorted_extensions = sha_encode(x['sorted_extensions'])
     original_extensions = sha_encode(x['original_extensions'])
-    x['sorted_ciphers'], cipher_len, sorted_ciphers = get_hex_sorted(x['ciphers'])
-    x['original_ciphers'], cipher_len, original_ciphers = get_hex_sorted(x['ciphers'], sort=False)
+    x['sorted_ciphers'], cipher_len, sorted_ciphers = get_hex_sorted(x, 'ciphers')
+    x['original_ciphers'], cipher_len, original_ciphers = get_hex_sorted(x, 'ciphers', sort=False)
 
     sni = 'd' if 'domain' in x else 'i'
     x['version'] = x['version'][0] if isinstance(x['version'], list) else x['version']