Skip to content

Commit 7e56555

Browse files
fooinhafooinha
authored
Merge pull request fooinha#35 from fooinha/fix/19-ticket
[UA] - fix application_settings (17513) extension
2 parents b3135f4 + 108fc48 commit 7e56555

File tree

2 files changed

+172
-1
lines changed

2 files changed

+172
-1
lines changed

‎patches/nginx.1.23.0.ssl.extensions.patch‎

Lines changed: 171 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,171 @@
1+
--- nginx/src/event/ngx_event_openssl.c 2022-05-30 22:55:09.181782322 +0000
2+
+++ /build/nginx/src/event/ngx_event_openssl.c 2022-05-30 23:04:51.900925951 +0000
3+
@@ -1659,6 +1659,7 @@
4+
#ifdef SSL_OP_NO_RENEGOTIATION
5+
SSL_set_options(sc->connection, SSL_OP_NO_RENEGOTIATION);
6+
#endif
7+
+ SSL_set_options(sc->connection, SSL_OP_NO_TICKET);
8+
}
9+
10+
if (SSL_set_ex_data(sc->connection, ngx_ssl_connection_index, c) == 0) {
11+
@@ -1710,6 +1711,111 @@
12+
return NGX_OK;
13+
}
14+
15+
+/* ----- JA3 HACK START -----------------------------------------------------*/
16+
+#if OPENSSL_VERSION_NUMBER >= 0x10101000L
17+
+
18+
+void
19+
+ngx_SSL_client_features(ngx_connection_t *c) {
20+
+
21+
+ unsigned short *ciphers_out = NULL;
22+
+ int *curves_out = NULL;
23+
+ int *point_formats_out = NULL;
24+
+ size_t i = 0;
25+
+ size_t len = 0;
26+
+ SSL *s = NULL;
27+
+
28+
+ if (c == NULL) {
29+
+ return;
30+
+ }
31+
+ s = c->ssl->connection;
32+
+
33+
+ /* Cipher suites */
34+
+ c->ssl->ciphers = NULL;
35+
+ c->ssl->ciphers_sz = SSL_get0_raw_cipherlist(s, &ciphers_out);
36+
+ c->ssl->ciphers_sz /= 2;
37+
+
38+
+ if (c->ssl->ciphers_sz && ciphers_out) {
39+
+ len = c->ssl->ciphers_sz * sizeof(unsigned short);
40+
+ c->ssl->ciphers = ngx_pnalloc(c->pool, len);
41+
+ ngx_memcpy(c->ssl->ciphers, ciphers_out, len);
42+
+ }
43+
+
44+
+ /* Elliptic curve points */
45+
+
46+
+ c->ssl->curves_sz = SSL_get1_curves(s, NULL);
47+
+ if (c->ssl->curves_sz) {
48+
+ len = c->ssl->curves_sz * sizeof(int);
49+
+ curves_out = OPENSSL_malloc(len);
50+
+ if (curves_out != NULL) {
51+
+ memset(curves_out, 0, len);
52+
+ SSL_get1_curves(s, curves_out);
53+
+ len = c->ssl->curves_sz * sizeof(unsigned short);
54+
+ c->ssl->curves = ngx_pnalloc(c->pool, len);
55+
+ if (c->ssl->curves != NULL) {
56+
+ for (i = 0; i < c->ssl->curves_sz; i++) {
57+
+ c->ssl->curves[i] = (unsigned short) curves_out[i];
58+
+ }
59+
+ }
60+
+ OPENSSL_free(curves_out);
61+
+ }
62+
+ }
63+
+
64+
+ /* Elliptic curve point formats */
65+
+ c->ssl->point_formats_sz = SSL_get0_ec_point_formats(s, &point_formats_out);
66+
+ if (c->ssl->point_formats_sz && point_formats_out != NULL) {
67+
+ len = c->ssl->point_formats_sz * sizeof(unsigned char);
68+
+ c->ssl->point_formats = ngx_pnalloc(c->pool, len);
69+
+ if (c->ssl->point_formats != NULL) {
70+
+ ngx_memcpy(c->ssl->point_formats, point_formats_out, len);
71+
+ }
72+
+ }
73+
+}
74+
+
75+
+/* should *ALWAYS return 1
76+
+ * # define SSL_CLIENT_HELLO_SUCCESS 1
77+
+ *
78+
+ * otherwise
79+
+ * A failure in the ClientHello callback terminates the connection.
80+
+ */
81+
+int
82+
+ngx_SSL_early_cb_fn(SSL *s, int *al, void *arg) {
83+
+
84+
+ int got_extensions;
85+
+ int *ext_out;
86+
+ size_t ext_len;
87+
+ ngx_connection_t *c;
88+
+
89+
+ c = arg;
90+
+
91+
+ if (c == NULL) {
92+
+ return 1;
93+
+ }
94+
+
95+
+ if (c->ssl == NULL) {
96+
+ return 1;
97+
+ }
98+
+
99+
+ c->ssl->extensions_size = 0;
100+
+ c->ssl->extensions = NULL;
101+
+ got_extensions = SSL_client_hello_get1_extensions_present(s,
102+
+ &ext_out,
103+
+ &ext_len);
104+
+ if (got_extensions) {
105+
+ if (ext_out && ext_len) {
106+
+ c->ssl->extensions =
107+
+ ngx_palloc(c->pool, sizeof(int) * ext_len);
108+
+ if (c->ssl->extensions != NULL) {
109+
+ c->ssl->extensions_size = ext_len;
110+
+ ngx_memcpy(c->ssl->extensions, ext_out, sizeof(int) * ext_len);
111+
+ OPENSSL_free(ext_out);
112+
+ }
113+
+ }
114+
+ }
115+
+
116+
+ return 1;
117+
+}
118+
+#endif
119+
+/* ----- JA3 HACK END -------------------------------------------------------*/
120+
121+
ngx_int_t
122+
ngx_ssl_handshake(ngx_connection_t *c)
123+
@@ -1730,6 +1836,10 @@
124+
125+
ngx_ssl_clear_error(c->log);
126+
127+
+#if OPENSSL_VERSION_NUMBER >= 0x10101000L
128+
+ SSL_CTX_set_client_hello_cb(c->ssl->session_ctx, ngx_SSL_early_cb_fn, c);
129+
+#endif
130+
+
131+
n = SSL_do_handshake(c->ssl->connection);
132+
133+
ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL_do_handshake: %d", n);
134+
@@ -1748,6 +1858,12 @@
135+
ngx_ssl_handshake_log(c);
136+
#endif
137+
138+
+/* ----- JA3 HACK START -----------------------------------------------------*/
139+
+#if OPENSSL_VERSION_NUMBER >= 0x10101000L
140+
+ ngx_SSL_client_features(c);
141+
+#endif
142+
+/* ----- JA3 HACK END -------------------------------------------------------*/
143+
+
144+
c->recv = ngx_ssl_recv;
145+
c->send = ngx_ssl_write;
146+
c->recv_chain = ngx_ssl_recv_chain;
147+
diff -r d964b0aee8e7 src/event/ngx_event_openssl.h
148+
--- a/src/event/ngx_event_openssl.h Thu May 23 16:49:22 2019 +0300
149+
+++ b/src/event/ngx_event_openssl.h Sat Jun 01 14:53:52 2019 +0000
150+
@@ -99,6 +99,23 @@
151+
unsigned in_early:1;
152+
unsigned early_preread:1;
153+
unsigned write_blocked:1;
154+
+
155+
+/* ----- JA3 HACK START -----------------------------------------------------*/
156+
+#if OPENSSL_VERSION_NUMBER >= 0x10101000L
157+
+
158+
+ size_t ciphers_sz;
159+
+ unsigned short *ciphers;
160+
+
161+
+ size_t extensions_size;
162+
+ int *extensions;
163+
+
164+
+ size_t curves_sz;
165+
+ unsigned short *curves;
166+
+
167+
+ size_t point_formats_sz;
168+
+ unsigned char *point_formats;
169+
+#endif
170+
+/* ----- JA3 HACK END -------------------------------------------------------*/
171+
};

‎patches/nginx.latest.patch‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
nginx.1.17.1.ssl.extensions.patch
1+
nginx.1.23.0.ssl.extensions.patch

0 commit comments

Comments
 (0)