Skip to content
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 9 additions & 19 deletions ja4.lua
Original file line number Diff line number Diff line change
Expand Up @@ -162,22 +162,19 @@ local function _ja4(txn)
-- Parse ciphers
------------------
local ciphers = {}
local ciphers_orig
if RAW_OUTPUTS then
ciphers_orig = {}
end
local cipher_list_orig = ""
local cipher_bin = txn.f:ssl_fc_cipherlist_bin(1)
if cipher_bin and #cipher_bin >= 2 then
local count = 0
for i = 1, #cipher_bin - 1, 2 do
count = count + 1
local value = string.unpack(">I2", cipher_bin, i)
local hex = HEX_LOOKUP[value] or string.format("%04x", value)
if RAW_OUTPUTS then
ciphers_orig[count] = hex
end
ciphers[count] = hex
end
if RAW_OUTPUTS then
cipher_list_orig = table.concat(ciphers, ",")
end
table.sort(ciphers)
end

Expand Down Expand Up @@ -225,9 +222,8 @@ local function _ja4(txn)
local cipher_list = table.concat(ciphers, ",")
local extension_list = table.concat(extensions, ",")
local signature_algorithm_list = table.concat(signature_algorithms, ",")
local cipher_list_orig, extension_list_orig
local extension_list_orig
if RAW_OUTPUTS then
cipher_list_orig = table.concat(ciphers_orig, ",")
extension_list_orig = table.concat(extensions_orig, ",")
end

Expand Down Expand Up @@ -280,10 +276,12 @@ local function _ja4(txn)

if extension_list_orig == "" then
ja4_c_o = "000000000000"
ja4_c_ro = ""
elseif signature_algorithm_list ~= "" then
local hash_input = extension_list_orig .. "_" .. signature_algorithm_list
ja4_c_o = sha256_truncated(txn.c, hash_input)
ja4_c_ro = extension_list_orig .. "_" .. signature_algorithm_list
ja4_c_o = sha256_truncated(txn.c, ja4_c_ro)
else
ja4_c_ro = extension_list_orig
ja4_c_o = sha256_truncated(txn.c, extension_list_orig)
end

Expand All @@ -294,14 +292,6 @@ local function _ja4(txn)
else
ja4_c_r = extension_list
end

if extension_list_orig == "" then
ja4_c_ro = ""
elseif signature_algorithm_list ~= "" then
ja4_c_ro = extension_list_orig .. "_" .. signature_algorithm_list
else
ja4_c_ro = extension_list_orig
end
end

-------------------------------------
Expand Down