aboutsummaryrefslogtreecommitdiff
path: root/src
diff options
context:
space:
mode:
authorNardi Ivan <nardi.ivan@gmail.com>2020-06-06 15:54:44 +0200
committerNardi Ivan <nardi.ivan@gmail.com>2020-06-28 12:05:12 +0200
commitb68b45f3bbc0754427f04e393c66a9f3e69188ff (patch)
tree62a97566e8323185b5e0f08b220ecb51dad5b0d2 /src
parentb2e89e67361a931672281f680faede0551542eea (diff)
TLS: extract JA3 signatures in some corner cases
In some (rare) cases, Client Hello message contains lots of cipher suits.
Diffstat (limited to 'src')
1 files changed, 2 insertions, 2 deletions
diff --git a/src/lib/protocols/tls.c b/src/lib/protocols/tls.c
index c9b2d0ee2..007931e19 100644
--- a/src/lib/protocols/tls.c
+++ b/src/lib/protocols/tls.c
@@ -818,14 +818,14 @@ static void ndpi_int_tls_add_connection(struct ndpi_detection_module_struct *ndp
/* https://engineering.salesforce.com/tls-fingerprinting-with-ja3-and-ja3s-247362855967 */
#define JA3_STR_LEN 1024
-#define MAX_NUM_JA3 128
+#define MAX_NUM_JA3 512
struct ja3_info {
u_int16_t tls_handshake_version;
u_int16_t num_cipher, cipher[MAX_NUM_JA3];
u_int16_t num_tls_extension, tls_extension[MAX_NUM_JA3];
u_int16_t num_elliptic_curve, elliptic_curve[MAX_NUM_JA3];
- u_int8_t num_elliptic_curve_point_format, elliptic_curve_point_format[MAX_NUM_JA3];
+ u_int16_t num_elliptic_curve_point_format, elliptic_curve_point_format[MAX_NUM_JA3];
};
/* **************************************** */
Powered by cgit, Themed by Ted Yin.