|
| 1 | +diff -r 2e63d59c342d src/event/ngx_event_openssl.c |
| 2 | +--- a/src/event/ngx_event_openssl.c Tue Sep 10 16:48:11 2024 +0400 |
| 3 | ++++ b/src/event/ngx_event_openssl.c Sat Sep 14 18:00:11 2024 +0000 |
| 4 | +@@ -1742,6 +1742,7 @@ |
| 5 | + #ifdef SSL_OP_NO_RENEGOTIATION |
| 6 | + SSL_set_options(sc->connection, SSL_OP_NO_RENEGOTIATION); |
| 7 | + #endif |
| 8 | ++ SSL_set_options(sc->connection, SSL_OP_NO_TICKET); |
| 9 | + } |
| 10 | + |
| 11 | + if (SSL_set_ex_data(sc->connection, ngx_ssl_connection_index, c) == 0) { |
| 12 | +@@ -1793,6 +1794,116 @@ |
| 13 | + return NGX_OK; |
| 14 | + } |
| 15 | + |
| 16 | ++/* ----- JA3 HACK START -----------------------------------------------------*/ |
| 17 | ++ |
| 18 | ++void |
| 19 | ++ngx_SSL_client_features(ngx_connection_t *c) { |
| 20 | ++ |
| 21 | ++ unsigned short *ciphers_out = NULL; |
| 22 | ++ int *curves_out = NULL; |
| 23 | ++ int *point_formats_out = NULL; |
| 24 | ++ size_t i = 0; |
| 25 | ++ size_t len = 0; |
| 26 | ++ SSL *s = NULL; |
| 27 | ++ |
| 28 | ++ if (c == NULL) { |
| 29 | ++ return; |
| 30 | ++ } |
| 31 | ++ s = c->ssl->connection; |
| 32 | ++ |
| 33 | ++ /* Cipher suites */ |
| 34 | ++ c->ssl->ciphers = NULL; |
| 35 | ++ c->ssl->ciphers_sz = SSL_get0_raw_cipherlist(s, &ciphers_out); |
| 36 | ++ c->ssl->ciphers_sz /= 2; |
| 37 | ++ |
| 38 | ++ if (c->ssl->ciphers_sz && ciphers_out) { |
| 39 | ++ len = c->ssl->ciphers_sz * sizeof(unsigned short); |
| 40 | ++ c->ssl->ciphers = ngx_pnalloc(c->pool, len); |
| 41 | ++ ngx_memcpy(c->ssl->ciphers, ciphers_out, len); |
| 42 | ++ } |
| 43 | ++ |
| 44 | ++ /* Elliptic curve points */ |
| 45 | ++ |
| 46 | ++ c->ssl->curves_sz = SSL_get1_curves(s, NULL); |
| 47 | ++ if (c->ssl->curves_sz) { |
| 48 | ++ len = c->ssl->curves_sz * sizeof(int); |
| 49 | ++ curves_out = OPENSSL_malloc(len); |
| 50 | ++ if (curves_out != NULL) { |
| 51 | ++ memset(curves_out, 0, len); |
| 52 | ++ SSL_get1_curves(s, curves_out); |
| 53 | ++ len = c->ssl->curves_sz * sizeof(unsigned short); |
| 54 | ++ c->ssl->curves = ngx_pnalloc(c->pool, len); |
| 55 | ++ if (c->ssl->curves != NULL) { |
| 56 | ++ for (i = 0; i < c->ssl->curves_sz; i++) { |
| 57 | ++ c->ssl->curves[i] = (unsigned short) curves_out[i]; |
| 58 | ++ } |
| 59 | ++ } |
| 60 | ++ OPENSSL_free(curves_out); |
| 61 | ++ } |
| 62 | ++ } |
| 63 | ++ |
| 64 | ++ /* Elliptic curve point formats */ |
| 65 | ++ c->ssl->point_formats_sz = SSL_get0_ec_point_formats(s, &point_formats_out); |
| 66 | ++ if (c->ssl->point_formats_sz && point_formats_out != NULL) { |
| 67 | ++ len = c->ssl->point_formats_sz * sizeof(unsigned char); |
| 68 | ++ c->ssl->point_formats = ngx_pnalloc(c->pool, len); |
| 69 | ++ if (c->ssl->point_formats != NULL) { |
| 70 | ++ ngx_memcpy(c->ssl->point_formats, point_formats_out, len); |
| 71 | ++ } |
| 72 | ++ } |
| 73 | ++} |
| 74 | ++ |
| 75 | ++/* should *ALWAYS return 1 |
| 76 | ++ * # define SSL_CLIENT_HELLO_SUCCESS 1 |
| 77 | ++ * |
| 78 | ++ * otherwise |
| 79 | ++ * A failure in the ClientHello callback terminates the connection. |
| 80 | ++ */ |
| 81 | ++int |
| 82 | ++ngx_SSL_early_cb_fn(SSL *s, int *al, void *arg) { |
| 83 | ++ |
| 84 | ++ int got_extensions; |
| 85 | ++ int *ext_out; |
| 86 | ++ size_t ext_len; |
| 87 | ++ ngx_connection_t *c; |
| 88 | ++ |
| 89 | ++ c = arg; |
| 90 | ++ |
| 91 | ++ if (c == NULL) { |
| 92 | ++ return 1; |
| 93 | ++ } |
| 94 | ++ |
| 95 | ++ if (c->ssl == NULL) { |
| 96 | ++ return 1; |
| 97 | ++ } |
| 98 | ++ |
| 99 | ++ c->ssl->extensions_size = 0; |
| 100 | ++ c->ssl->extensions = NULL; |
| 101 | ++ got_extensions = SSL_client_hello_get1_extensions_present( |
| 102 | ++ s, |
| 103 | ++ &ext_out, |
| 104 | ++ &ext_len); |
| 105 | ++ if (!got_extensions) { |
| 106 | ++ return 1; |
| 107 | ++ } |
| 108 | ++ if (!ext_out) { |
| 109 | ++ return 1; |
| 110 | ++ } |
| 111 | ++ if (!ext_len) { |
| 112 | ++ return 1; |
| 113 | ++ } |
| 114 | ++ |
| 115 | ++ c->ssl->extensions = ngx_palloc(c->pool, sizeof(int) * ext_len); |
| 116 | ++ if (c->ssl->extensions != NULL) { |
| 117 | ++ c->ssl->extensions_size = ext_len; |
| 118 | ++ ngx_memcpy(c->ssl->extensions, ext_out, sizeof(int) * ext_len); |
| 119 | ++ } |
| 120 | ++ |
| 121 | ++ OPENSSL_free(ext_out); |
| 122 | ++ |
| 123 | ++ return 1; |
| 124 | ++} |
| 125 | ++/* ----- JA3 HACK END -------------------------------------------------------*/ |
| 126 | + |
| 127 | + ngx_int_t |
| 128 | + ngx_ssl_handshake(ngx_connection_t *c) |
| 129 | +@@ -1813,6 +1924,10 @@ |
| 130 | + |
| 131 | + ngx_ssl_clear_error(c->log); |
| 132 | + |
| 133 | ++/* ----- JA3 HACK START -----------------------------------------------------*/ |
| 134 | ++ SSL_CTX_set_client_hello_cb(c->ssl->session_ctx, ngx_SSL_early_cb_fn, c); |
| 135 | ++/* ----- JA3 HACK END -------------------------------------------------------*/ |
| 136 | ++ |
| 137 | + n = SSL_do_handshake(c->ssl->connection); |
| 138 | + |
| 139 | + ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL_do_handshake: %d", n); |
| 140 | +@@ -1831,6 +1946,10 @@ |
| 141 | + ngx_ssl_handshake_log(c); |
| 142 | + #endif |
| 143 | + |
| 144 | ++/* ----- JA3 HACK START -----------------------------------------------------*/ |
| 145 | ++ ngx_SSL_client_features(c); |
| 146 | ++/* ----- JA3 HACK END -------------------------------------------------------*/ |
| 147 | ++ |
| 148 | + c->recv = ngx_ssl_recv; |
| 149 | + c->send = ngx_ssl_write; |
| 150 | + c->recv_chain = ngx_ssl_recv_chain; |
| 151 | +diff -r 2e63d59c342d src/event/ngx_event_openssl.h |
| 152 | +--- a/src/event/ngx_event_openssl.h Tue Sep 10 16:48:11 2024 +0400 |
| 153 | ++++ b/src/event/ngx_event_openssl.h Sat Sep 14 18:00:11 2024 +0000 |
| 154 | +@@ -128,6 +128,20 @@ |
| 155 | + unsigned in_ocsp:1; |
| 156 | + unsigned early_preread:1; |
| 157 | + unsigned write_blocked:1; |
| 158 | ++ |
| 159 | ++/* ----- JA3 HACK START -----------------------------------------------------*/ |
| 160 | ++ size_t ciphers_sz; |
| 161 | ++ unsigned short *ciphers; |
| 162 | ++ |
| 163 | ++ size_t extensions_size; |
| 164 | ++ int *extensions; |
| 165 | ++ |
| 166 | ++ size_t curves_sz; |
| 167 | ++ unsigned short *curves; |
| 168 | ++ |
| 169 | ++ size_t point_formats_sz; |
| 170 | ++ unsigned char *point_formats; |
| 171 | ++/* ----- JA3 HACK END -------------------------------------------------------*/ |
| 172 | + }; |
| 173 | + |
| 174 | + |
0 commit comments