From b68b45f3bbc0754427f04e393c66a9f3e69188ff Mon Sep 17 00:00:00 2001 From: Nardi Ivan Date: Sat, 6 Jun 2020 15:54:44 +0200 Subject: TLS: extract JA3 signatures in some corner cases In some (rare) cases, Client Hello message contains lots of cipher suits. --- src/lib/protocols/tls.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'src/lib/protocols/tls.c') diff --git a/src/lib/protocols/tls.c b/src/lib/protocols/tls.c index c9b2d0ee2..007931e19 100644 --- a/src/lib/protocols/tls.c +++ b/src/lib/protocols/tls.c @@ -818,14 +818,14 @@ static void ndpi_int_tls_add_connection(struct ndpi_detection_module_struct *ndp /* https://engineering.salesforce.com/tls-fingerprinting-with-ja3-and-ja3s-247362855967 */ #define JA3_STR_LEN 1024 -#define MAX_NUM_JA3 128 +#define MAX_NUM_JA3 512 struct ja3_info { u_int16_t tls_handshake_version; u_int16_t num_cipher, cipher[MAX_NUM_JA3]; u_int16_t num_tls_extension, tls_extension[MAX_NUM_JA3]; u_int16_t num_elliptic_curve, elliptic_curve[MAX_NUM_JA3]; - u_int8_t num_elliptic_curve_point_format, elliptic_curve_point_format[MAX_NUM_JA3]; + u_int16_t num_elliptic_curve_point_format, elliptic_curve_point_format[MAX_NUM_JA3]; }; /* **************************************** */ -- cgit v1.2.3