From d96f4ca736151632282572003ccf916b88134c71 Mon Sep 17 00:00:00 2001
From: Luca Deri <deri@ntop.org>
Date: Fri, 19 Mar 2021 22:33:04 +0100
Subject: Added ALPN and elliptic curve in JA3S+

---
 src/lib/protocols/tls.c | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

(limited to 'src/lib/protocols')

diff --git a/src/lib/protocols/tls.c b/src/lib/protocols/tls.c
index c2856cc89..09c6f6939 100644
--- a/src/lib/protocols/tls.c
+++ b/src/lib/protocols/tls.c
@@ -1253,17 +1253,22 @@ int processClientServerHello(struct ndpi_detection_module_struct *ndpi_struct,
       }
 
       if(ndpi_struct->enable_ja3_plus) {
-	for(i=0; i<ja3.client.num_tls_extension; i++) {
+	for(i=0; i<ja3.server.num_tls_extension; i++) {
 	  rc = snprintf(&ja3_str[ja3_str_len], sizeof(ja3_str)-ja3_str_len, "%s%u",
-			(i > 0) ? "-" : "", ja3.client.tls_extension[i]);
+			(i > 0) ? "-" : "", ja3.server.tls_extension[i]);
 	  if((rc > 0) && (ja3_str_len + rc < JA3_STR_LEN)) ja3_str_len += rc; else break;
 	}
 
-	for(i=0; i<ja3.client.num_elliptic_curve; i++) {
+	for(i=0; i<ja3.server.num_elliptic_curve_point_format; i++) {
 	  rc = snprintf(&ja3_str[ja3_str_len], sizeof(ja3_str)-ja3_str_len, "%s%u",
-			(i > 0) ? "-" : "", ja3.client.elliptic_curve[i]);
+			(i > 0) ? "-" : "", ja3.server.elliptic_curve_point_format[i]);
 	  if((rc > 0) && (ja3_str_len + rc < JA3_STR_LEN)) ja3_str_len += rc; else break;
 	}
+
+	if(ja3.server.alpn[0] != '\0') {
+	  rc = snprintf(&ja3_str[ja3_str_len], sizeof(ja3_str)-ja3_str_len, ",%s", ja3.server.alpn);
+	  if((rc > 0) && (ja3_str_len + rc < JA3_STR_LEN)) ja3_str_len += rc;
+	}
 	
 #ifdef DEBUG_TLS
 	printf("[JA3+] Server: %s \n", ja3_str);
-- 
cgit v1.2.3