58 if ((*buffer)->data != NULL) {
60 (*buffer)->data = NULL;
79static int Ja3BufferResizeIfFull(
JA3Buffer *buffer, uint32_t
len)
110 if (*buffer1 == NULL || *buffer2 == NULL) {
117 if ((*buffer1)->data == NULL) {
118 (*buffer1)->data = (*buffer2)->data;
119 (*buffer1)->used = (*buffer2)->used;
120 (*buffer1)->size = (*buffer2)->size;
125 int rc = Ja3BufferResizeIfFull(*buffer1, (*buffer2)->used);
132 if ((*buffer2)->used == 0) {
133 (*buffer1)->used += snprintf((*buffer1)->data + (*buffer1)->used,
134 (*buffer1)->size - (*buffer1)->used,
",");
136 (*buffer1)->used += snprintf((*buffer1)->data + (*buffer1)->used,
137 (*buffer1)->size - (*buffer1)->used,
",%s",
154static uint32_t NumberOfDigits(uint32_t num)
160 return 1 + NumberOfDigits(num / 10);
174 if (*buffer == NULL) {
179 if ((*buffer)->data == NULL) {
181 if ((*buffer)->data == NULL) {
182 SCLogError(
"Error allocating memory for JA3 data");
189 uint32_t value_len = NumberOfDigits(value);
191 int rc = Ja3BufferResizeIfFull(*buffer, value_len);
197 if ((*buffer)->used == 0) {
198 (*buffer)->used += snprintf((*buffer)->data, (*buffer)->size,
"%u", value);
201 (*buffer)->used += snprintf(
202 (*buffer)->data + (*buffer)->used, (*buffer)->size - (*buffer)->used,
"-%u", value);
218 if (buffer == NULL) {
223 if (buffer->
data == NULL) {
228 char *ja3_hash =
SCMalloc(SC_MD5_HEX_LEN + 1);
229 if (ja3_hash == NULL) {
230 SCLogError(
"Error allocating memory for JA3 hash");
234 SCMd5HashBufferToHex((
unsigned char *)buffer->
data, buffer->
used, ja3_hash, SC_MD5_HEX_LEN + 1);
251 if (is_enabled == 0) {
252 if (strcmp(
type,
"rule") != 0) {
268 const uint8_t *b = NULL;
270 if (!SCQuicTxGetJa3(txv, STREAM_TOSERVER | STREAM_TOCLIENT, &b, &b_len))
272 if (b == NULL || b_len == 0)
275 uint8_t ja3_hash[SC_MD5_HEX_LEN + 1];
277 SCMd5HashBufferToHex(b, b_len, (
char *)ja3_hash, SC_MD5_HEX_LEN + 1);
293 const uint8_t *b = NULL;
295 if (!SCQuicTxGetJa3(txv, STREAM_TOSERVER | STREAM_TOCLIENT, &b, &b_len))
297 if (b == NULL || b_len == 0)
bool SSLJA3IsEnabled(void)
return whether ja3 is effectively enabled
void InspectionBufferCopy(InspectionBuffer *buffer, uint8_t *buf, uint32_t buf_len)
void InspectionBufferApplyTransforms(DetectEngineThreadCtx *det_ctx, InspectionBuffer *buffer, const DetectEngineTransforms *transforms)
void InspectionBufferSetupAndApplyTransforms(DetectEngineThreadCtx *det_ctx, const int list_id, InspectionBuffer *buffer, const uint8_t *data, const uint32_t data_len, const DetectEngineTransforms *transforms)
setup the buffer with our initial data
InspectionBuffer * InspectionBufferGet(DetectEngineThreadCtx *det_ctx, const int list_id)
void InspectionBufferSetup(DetectEngineThreadCtx *det_ctx, const int list_id, InspectionBuffer *buffer, const uint8_t *data, const uint32_t data_len)
setup the buffer with our initial data
#define SCLogWarning(...)
Macro used to log WARNING messages.
#define SCLogError(...)
Macro used to log ERROR messages.
JA3Buffer * Ja3BufferInit(void)
Allocate new buffer.
int Ja3BufferAddValue(JA3Buffer **buffer, uint32_t value)
int Ja3BufferAppendBuffer(JA3Buffer **buffer1, JA3Buffer **buffer2)
int Ja3IsDisabled(const char *type)
char * Ja3GenerateHash(JA3Buffer *buffer)
void Ja3BufferFree(JA3Buffer **buffer)
Free allocated buffer.
#define JA3_BUFFER_INITIAL_SIZE
#define SCRealloc(ptr, sz)
#define DEBUG_VALIDATE_BUG_ON(exp)