maskit opened a new pull request, #13719: URL: https://github.com/apache/trafficserver/pull/13719
The `a` section of a JA4 fingerprint ends with two characters derived from the first ALPN value in the ClientHello. Both `ja4_fingerprint` and `jax_fingerprint` copied that value's first and last bytes verbatim. The value is an opaque length-prefixed byte string taken from the ClientHello as offered, before any negotiation or validation, so its bytes are not constrained to the registered identifiers. Because the `a` section is not hashed, arbitrary bytes, including control characters, reached the `ja4` request header sent to the origin and the plugins' log lines. This does not require a hostile client: RFC 8701 permits GREASE ALPN identifiers, which are byte pairs such as `0x0A 0x0A`. The JA4 specification covers this case: when the first or last byte of the first ALPN value is not ASCII alphanumeric, the fingerprint uses the first and last characters of that value's hex representation instead. This change implements that rule in both plugins and adds unit tests for the specification's worked examples plus the GREASE case. Fingerprints for clients whose first ALPN value has alphanumeric ends, which covers every registered ALPN identifier, are unchanged. Fingerprints for the affected clients change, and now agree with other JA4 implementations. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
