Skip to content

Commit 076e877

Browse files
fooinhafooinha
authored
Merge pull request #12 from fooinha/fix/11
saves ec values to nginx connection
2 parents 6a4ab26 + cfa9f53 commit 076e877

File tree

7 files changed

+384
-98
lines changed

7 files changed

+384
-98
lines changed

‎COPYRIGHT

Lines changed: 0 additions & 30 deletions
This file was deleted.

‎COPYRIGHT.md

Lines changed: 169 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,169 @@
1+
# Copyright
2+
3+
[TOC]
4+
5+
NGINX
6+
------
7+
8+
```
9+
-----------------------------------------------------------------------------
10+
NGINX License
11+
12+
/*
13+
* Copyright (C) 2002-2016 Igor Sysoev
14+
* Copyright (C) 2011-2016 Nginx, Inc.
15+
* All rights reserved.
16+
*
17+
* Redistribution and use in source and binary forms, with or without
18+
* modification, are permitted provided that the following conditions
19+
* are met:
20+
* 1. Redistributions of source code must retain the above copyright
21+
* notice, this list of conditions and the following disclaimer.
22+
* 2. Redistributions in binary form must reproduce the above copyright
23+
* notice, this list of conditions and the following disclaimer in the
24+
* documentation and/or other materials provided with the distribution.
25+
*
26+
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
27+
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
28+
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
29+
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
30+
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
31+
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
32+
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
33+
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
34+
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
35+
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
36+
* SUCH DAMAGE.
37+
*/
38+
-----------------------------------------------------------------------------
39+
```
40+
41+
OpenSSL
42+
-------
43+
44+
```
45+
LICENSE ISSUES
46+
==============
47+
48+
The OpenSSL toolkit stays under a double license, i.e. both the conditions of
49+
the OpenSSL License and the original SSLeay license apply to the toolkit.
50+
See below for the actual license texts.
51+
52+
OpenSSL License
53+
---------------
54+
55+
/* ====================================================================
56+
* Copyright (c) 1998-2018 The OpenSSL Project. All rights reserved.
57+
*
58+
* Redistribution and use in source and binary forms, with or without
59+
* modification, are permitted provided that the following conditions
60+
* are met:
61+
*
62+
* 1. Redistributions of source code must retain the above copyright
63+
* notice, this list of conditions and the following disclaimer.
64+
*
65+
* 2. Redistributions in binary form must reproduce the above copyright
66+
* notice, this list of conditions and the following disclaimer in
67+
* the documentation and/or other materials provided with the
68+
* distribution.
69+
*
70+
* 3. All advertising materials mentioning features or use of this
71+
* software must display the following acknowledgment:
72+
* "This product includes software developed by the OpenSSL Project
73+
* for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
74+
*
75+
* 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
76+
* endorse or promote products derived from this software without
77+
* prior written permission. For written permission, please contact
78+
* [email protected].
79+
*
80+
* 5. Products derived from this software may not be called "OpenSSL"
81+
* nor may "OpenSSL" appear in their names without prior written
82+
* permission of the OpenSSL Project.
83+
*
84+
* 6. Redistributions of any form whatsoever must retain the following
85+
* acknowledgment:
86+
* "This product includes software developed by the OpenSSL Project
87+
* for use in the OpenSSL Toolkit (http://www.openssl.org/)"
88+
*
89+
* THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
90+
* EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
91+
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
92+
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
93+
* ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
94+
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
95+
* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
96+
* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
97+
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
98+
* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
99+
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
100+
* OF THE POSSIBILITY OF SUCH DAMAGE.
101+
* ====================================================================
102+
*
103+
* This product includes cryptographic software written by Eric Young
104+
* ([email protected]). This product includes software written by Tim
105+
* Hudson ([email protected]).
106+
*
107+
*/
108+
109+
Original SSLeay License
110+
-----------------------
111+
112+
/* Copyright (C) 1995-1998 Eric Young ([email protected])
113+
* All rights reserved.
114+
*
115+
* This package is an SSL implementation written
116+
* by Eric Young ([email protected]).
117+
* The implementation was written so as to conform with Netscapes SSL.
118+
*
119+
* This library is free for commercial and non-commercial use as long as
120+
* the following conditions are aheared to. The following conditions
121+
* apply to all code found in this distribution, be it the RC4, RSA,
122+
* lhash, DES, etc., code; not just the SSL code. The SSL documentation
123+
* included with this distribution is covered by the same copyright terms
124+
* except that the holder is Tim Hudson ([email protected]).
125+
*
126+
* Copyright remains Eric Young's, and as such any Copyright notices in
127+
* the code are not to be removed.
128+
* If this package is used in a product, Eric Young should be given attribution
129+
* as the author of the parts of the library used.
130+
* This can be in the form of a textual message at program startup or
131+
* in documentation (online or textual) provided with the package.
132+
*
133+
* Redistribution and use in source and binary forms, with or without
134+
* modification, are permitted provided that the following conditions
135+
* are met:
136+
* 1. Redistributions of source code must retain the copyright
137+
* notice, this list of conditions and the following disclaimer.
138+
* 2. Redistributions in binary form must reproduce the above copyright
139+
* notice, this list of conditions and the following disclaimer in the
140+
* documentation and/or other materials provided with the distribution.
141+
* 3. All advertising materials mentioning features or use of this software
142+
* must display the following acknowledgement:
143+
* "This product includes cryptographic software written by
144+
* Eric Young ([email protected])"
145+
* The word 'cryptographic' can be left out if the rouines from the library
146+
* being used are not cryptographic related :-).
147+
* 4. If you include any Windows specific code (or a derivative thereof) from
148+
* the apps directory (application code) you must include an acknowledgement:
149+
* "This product includes software written by Tim Hudson ([email protected])"
150+
*
151+
* THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
152+
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
153+
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
154+
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
155+
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
156+
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
157+
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
158+
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
159+
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
160+
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
161+
* SUCH DAMAGE.
162+
*
163+
* The licence and distribution terms for any publically available version or
164+
* derivative of this code cannot be changed. i.e. this code cannot simply be
165+
* copied and put under another distribution licence
166+
* [including the GNU Public Licence.]
167+
*/
168+
169+
```

‎README.md

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -142,6 +142,16 @@ Creating nginx-ssl-ja3
142142
143143
```
144144

145+
146+
147+
## Contributors
148+
149+
@**fooinha** - author
150+
151+
@**Sessa93**
152+
153+
@**bartebor**
154+
145155
## Fair Warning
146156

147157
**THIS IS NOT PRODUCTION** ready.

‎patches/nginx.1.17.1.ssl.extensions.patch

Lines changed: 162 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,162 @@
1+
diff -r d964b0aee8e7 src/event/ngx_event_openssl.c
2+
--- a/src/event/ngx_event_openssl.c Thu May 23 16:49:22 2019 +0300
3+
+++ b/src/event/ngx_event_openssl.c Sat Jun 01 14:53:52 2019 +0000
4+
@@ -1588,6 +1588,107 @@
5+
return NGX_OK;
6+
}
7+
8+
+/* ----- JA3 HACK START -----------------------------------------------------*/
9+
+#if OPENSSL_VERSION_NUMBER >= 0x10101000L
10+
+
11+
+void
12+
+ngx_SSL_client_features(ngx_connection_t *c) {
13+
+
14+
+ unsigned short *ciphers_out = NULL;
15+
+ int *curves_out = NULL;
16+
+ int *point_formats_out = NULL;
17+
+ size_t len = 0;
18+
+ SSL *s = NULL;
19+
+
20+
+ if (c == NULL) {
21+
+ return;
22+
+ }
23+
+ s = c->ssl->connection;
24+
+
25+
+ /* Cipher suites */
26+
+ c->ssl->ciphers = NULL;
27+
+ c->ssl->ciphers_sz = SSL_get0_raw_cipherlist(s, &ciphers_out);
28+
+ c->ssl->ciphers_sz /= 2;
29+
+
30+
+ if (c->ssl->ciphers_sz && ciphers_out) {
31+
+ len = c->ssl->ciphers_sz * sizeof(unsigned short);
32+
+ c->ssl->ciphers = ngx_pnalloc(c->pool, len);
33+
+ ngx_memcpy(c->ssl->ciphers, ciphers_out, len);
34+
+ }
35+
+
36+
+ /* Elliptic curve points */
37+
+ c->ssl->curves_sz = SSL_get1_curves(s, NULL);
38+
+ if (c->ssl->curves_sz) {
39+
+ curves_out = OPENSSL_malloc(c->ssl->curves_sz * sizeof(int));
40+
+ if (curves_out != NULL) {
41+
+ SSL_get1_curves(s, curves_out);
42+
+ len = c->ssl->curves_sz * sizeof(unsigned short);
43+
+ c->ssl->curves = ngx_pnalloc(c->pool, len);
44+
+ if (c->ssl->curves != NULL) {
45+
+ for (size_t i = 0; i < c->ssl->curves_sz; i++) {
46+
+ c->ssl->curves[i] = curves_out[i];
47+
+ }
48+
+ }
49+
+ OPENSSL_free(curves_out);
50+
+ }
51+
+ }
52+
+
53+
+ /* Elliptic curve point formats */
54+
+ c->ssl->point_formats_sz = SSL_get0_ec_point_formats(s, &point_formats_out);
55+
+ if (c->ssl->point_formats_sz && point_formats_out != NULL) {
56+
+ len = c->ssl->point_formats_sz * sizeof(unsigned char);
57+
+ c->ssl->point_formats = ngx_pnalloc(c->pool, len);
58+
+ if (c->ssl->point_formats != NULL) {
59+
+ ngx_memcpy(c->ssl->point_formats, point_formats_out, len);
60+
+ }
61+
+ }
62+
+}
63+
+
64+
+/* should *ALWAYS return 1
65+
+ * # define SSL_CLIENT_HELLO_SUCCESS 1
66+
+ *
67+
+ * otherwise
68+
+ * A failure in the ClientHello callback terminates the connection.
69+
+ */
70+
+int
71+
+ngx_SSL_early_cb_fn(SSL *s, int *al, void *arg) {
72+
+
73+
+ int got_extensions;
74+
+ int *ext_out;
75+
+ size_t ext_len;
76+
+ ngx_connection_t *c;
77+
+
78+
+ c = arg;
79+
+
80+
+ if (c == NULL) {
81+
+ return 1;
82+
+ }
83+
+
84+
+ if (c->ssl == NULL) {
85+
+ return 1;
86+
+ }
87+
+
88+
+ c->ssl->extensions_size = 0;
89+
+ c->ssl->extensions = NULL;
90+
+ got_extensions = SSL_client_hello_get1_extensions_present(s,
91+
+ &ext_out,
92+
+ &ext_len);
93+
+ if (got_extensions) {
94+
+ if (ext_out && ext_len) {
95+
+ c->ssl->extensions =
96+
+ ngx_palloc(c->pool, sizeof(int) * ext_len);
97+
+ if (c->ssl->extensions != NULL) {
98+
+ c->ssl->extensions_size = ext_len;
99+
+ ngx_memcpy(c->ssl->extensions, ext_out, sizeof(int) * ext_len);
100+
+ OPENSSL_free(ext_out);
101+
+ }
102+
+ }
103+
+ }
104+
+
105+
+ return 1;
106+
+}
107+
+#endif
108+
+/* ----- JA3 HACK END -------------------------------------------------------*/
109+
110+
ngx_int_t
111+
ngx_ssl_handshake(ngx_connection_t *c)
112+
@@ -1603,6 +1704,10 @@
113+
114+
ngx_ssl_clear_error(c->log);
115+
116+
+#if OPENSSL_VERSION_NUMBER >= 0x10101000L
117+
+ SSL_CTX_set_client_hello_cb(c->ssl->session_ctx, ngx_SSL_early_cb_fn, c);
118+
+#endif
119+
+
120+
n = SSL_do_handshake(c->ssl->connection);
121+
122+
ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL_do_handshake: %d", n);
123+
@@ -1623,6 +1728,12 @@
124+
125+
c->ssl->handshaked = 1;
126+
127+
+/* ----- JA3 HACK START -----------------------------------------------------*/
128+
+#if OPENSSL_VERSION_NUMBER >= 0x10101000L
129+
+ ngx_SSL_client_features(c);
130+
+#endif
131+
+/* ----- JA3 HACK END -------------------------------------------------------*/
132+
+
133+
c->recv = ngx_ssl_recv;
134+
c->send = ngx_ssl_write;
135+
c->recv_chain = ngx_ssl_recv_chain;
136+
diff -r d964b0aee8e7 src/event/ngx_event_openssl.h
137+
--- a/src/event/ngx_event_openssl.h Thu May 23 16:49:22 2019 +0300
138+
+++ b/src/event/ngx_event_openssl.h Sat Jun 01 14:53:52 2019 +0000
139+
@@ -99,6 +99,23 @@
140+
unsigned in_early:1;
141+
unsigned early_preread:1;
142+
unsigned write_blocked:1;
143+
+
144+
+/* ----- JA3 HACK START -----------------------------------------------------*/
145+
+#if OPENSSL_VERSION_NUMBER >= 0x10101000L
146+
+
147+
+ size_t ciphers_sz;
148+
+ unsigned short *ciphers;
149+
+
150+
+ size_t extensions_size;
151+
+ unsigned short *extensions;
152+
+
153+
+ size_t curves_sz;
154+
+ unsigned short *curves;
155+
+
156+
+ size_t point_formats_sz;
157+
+ unsigned char *point_formats;
158+
+#endif
159+
+/* ----- JA3 HACK END -------------------------------------------------------*/
160+
};
161+
162+

‎patches/nginx.latest.patch

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
nginx.1.15.9.ssl.extensions.patch
1+
nginx.1.17.1.ssl.extensions.patch

0 commit comments

Comments
 (0)