maskit opened a new pull request, #13725: URL: https://github.com/apache/trafficserver/pull/13725
The ja4_fingerprint and jax_fingerprint plugins compute the last section of a JA4 fingerprint (`c`) from the sorted extension list only. The [JA4 spec](https://github.com/FoxIO-LLC/ja4/blob/main/technical_details/JA4.md) defines it as the sorted extensions followed by `_` and the signature algorithms in the order the client sent them. Since virtually every TLS 1.2/1.3 client sends signature_algorithms, the `c` section from either plugin never matched other JA4 implementations or published fingerprints. The spec's own worked example shows it: the plugins produced `t13d1516h2_8daaf6152771_6d807ffa2a79` where the spec says `t13d1516h2_8daaf6152771_e5627efa2ab1`. The existing unit tests didn't catch this because they compared the code's output against a hash of the same string the code builds. ## Changes - Both plugins read the signature_algorithms extension and append its values to the `c` input, in wire order, with GREASE values dropped. When there are none, the string ends without `_`, as the spec says. This matches FoxIO's Rust and Python reference implementations. - ja4_fingerprint's raw `c` string gets the same fix. - jax_fingerprint's `c` hash now lives in one helper, used by both the plugin and the unit-test mock, so the tests exercise the production hashing code. - Unit tests in both plugins run the spec's worked example and check the published values (`e5627efa2ab1`, and `6d807ffa2a79` without signature algorithms), plus GREASE handling and malformed list lengths. ## Operator impact This changes the `c` section of nearly every JA4 fingerprint these plugins produce. Stored fingerprints, and abuse_shield rules or other lists built from ATS-generated JA4 values, need to be regenerated. Values taken from other JA4 tools should now match. ## Testing - `test_ja4` and `test_jax` pass on BoringSSL, OpenSSL 3.1, and Homebrew OpenSSL 3.x. - Disabling the signature algorithm handling, the GREASE filter, or the length bound each makes the new tests fail. - The existing AuTests only check that the headers are present, so they're unaffected. - No test covers reading the extension from a live ClientHello. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
