Skip to content

Commit b47a0a6

Browse files
fooinhafooinha
authored
Merge pull request fooinha#22 from tiandrey/fix-nginx-1.14-patch
Updated patch for nginx 1.14.0
2 parents 6f0a0d1 + 4003e81 commit b47a0a6

File tree

1 file changed

+115
-43
lines changed

1 file changed

+115
-43
lines changed

‎patches/nginx.1.14.0.ssl.extensions.patch‎

Lines changed: 115 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,79 @@
1-
diff -r 2e8de3d81783 src/event/ngx_event_openssl.c
2-
--- a/src/event/ngx_event_openssl.c Tue Aug 22 17:36:12 2017 +0300
3-
+++ b/src/event/ngx_event_openssl.c Tue Aug 22 20:20:30 2017 +0000
4-
@@ -1221,6 +1221,60 @@
1+
diff -Naurp nginx-1.14.0.orig/src/event/ngx_event_openssl.c nginx-1.14.0/src/event/ngx_event_openssl.c
2+
--- nginx-1.14.0.orig/src/event/ngx_event_openssl.c 2018-04-17 18:22:36.000000000 +0300
3+
+++ nginx-1.14.0/src/event/ngx_event_openssl.c 2020-10-26 21:08:09.110961786 +0300
4+
@@ -1220,6 +1220,107 @@ ngx_ssl_set_session(ngx_connection_t *c,
5+
return NGX_OK;
56
}
67

7-
8+
+/* ----- JA3 HACK START -----------------------------------------------------*/
89
+#if OPENSSL_VERSION_NUMBER >= 0x10101000L
910
+
11+
+void
12+
+ngx_SSL_client_features(ngx_connection_t *c) {
13+
+
14+
+ unsigned short *ciphers_out = NULL;
15+
+ int *curves_out = NULL;
16+
+ int *point_formats_out = NULL;
17+
+ size_t len = 0;
18+
+ SSL *s = NULL;
19+
+
20+
+ if (c == NULL) {
21+
+ return;
22+
+ }
23+
+ s = c->ssl->connection;
24+
+
25+
+ /* Cipher suites */
26+
+ c->ssl->ciphers = NULL;
27+
+ c->ssl->ciphers_sz = SSL_get0_raw_cipherlist(s, &ciphers_out);
28+
+ c->ssl->ciphers_sz /= 2;
29+
+
30+
+ if (c->ssl->ciphers_sz && ciphers_out) {
31+
+ len = c->ssl->ciphers_sz * sizeof(unsigned short);
32+
+ c->ssl->ciphers = ngx_pnalloc(c->pool, len);
33+
+ ngx_memcpy(c->ssl->ciphers, ciphers_out, len);
34+
+ }
35+
+
36+
+ /* Elliptic curve points */
37+
+ c->ssl->curves_sz = SSL_get1_curves(s, NULL);
38+
+ if (c->ssl->curves_sz) {
39+
+ curves_out = OPENSSL_malloc(c->ssl->curves_sz * sizeof(int));
40+
+ if (curves_out != NULL) {
41+
+ SSL_get1_curves(s, curves_out);
42+
+ len = c->ssl->curves_sz * sizeof(unsigned short);
43+
+ c->ssl->curves = ngx_pnalloc(c->pool, len);
44+
+ if (c->ssl->curves != NULL) {
45+
+ for (size_t i = 0; i < c->ssl->curves_sz; i++) {
46+
+ c->ssl->curves[i] = curves_out[i];
47+
+ }
48+
+ }
49+
+ OPENSSL_free(curves_out);
50+
+ }
51+
+ }
52+
+
53+
+ /* Elliptic curve point formats */
54+
+ c->ssl->point_formats_sz = SSL_get0_ec_point_formats(s, &point_formats_out);
55+
+ if (c->ssl->point_formats_sz && point_formats_out != NULL) {
56+
+ len = c->ssl->point_formats_sz * sizeof(unsigned char);
57+
+ c->ssl->point_formats = ngx_pnalloc(c->pool, len);
58+
+ if (c->ssl->point_formats != NULL) {
59+
+ ngx_memcpy(c->ssl->point_formats, point_formats_out, len);
60+
+ }
61+
+ }
62+
+}
63+
+
64+
+/* should *ALWAYS return 1
65+
+ * # define SSL_CLIENT_HELLO_SUCCESS 1
66+
+ *
67+
+ * otherwise
68+
+ * A failure in the ClientHello callback terminates the connection.
69+
+ */
1070
+int
1171
+ngx_SSL_early_cb_fn(SSL *s, int *al, void *arg) {
1272
+
13-
+ int got_extensions;
14-
+ int *ext_out;
15-
+ size_t ext_len;
16-
+ ngx_connection_t *c;
73+
+ int got_extensions;
74+
+ int *ext_out;
75+
+ size_t ext_len;
76+
+ ngx_connection_t *c;
1777
+
1878
+ c = arg;
1979
+
@@ -25,44 +85,31 @@ diff -r 2e8de3d81783 src/event/ngx_event_openssl.c
2585
+ return 1;
2686
+ }
2787
+
28-
+ c->ssl->client_extensions_size = 0;
29-
+ c->ssl->client_extensions = NULL;
30-
+
88+
+ c->ssl->extensions_size = 0;
89+
+ c->ssl->extensions = NULL;
3190
+ got_extensions = SSL_client_hello_get1_extensions_present(s,
3291
+ &ext_out,
3392
+ &ext_len);
34-
+ if (!got_extensions) {
35-
+ return 1;
36-
+ }
37-
+
38-
+ if (!ext_out) {
39-
+ return 1;
93+
+ if (got_extensions) {
94+
+ if (ext_out && ext_len) {
95+
+ c->ssl->extensions =
96+
+ ngx_palloc(c->pool, sizeof(int) * ext_len);
97+
+ if (c->ssl->extensions != NULL) {
98+
+ c->ssl->extensions_size = ext_len;
99+
+ ngx_memcpy(c->ssl->extensions, ext_out, sizeof(int) * ext_len);
100+
+ OPENSSL_free(ext_out);
101+
+ }
102+
+ }
40103
+ }
41104
+
42-
+ if (!ext_len) {
43-
+ return 1;
44-
+ }
45-
+
46-
+ c->ssl->client_extensions = ngx_palloc(c->pool, sizeof(int) * ext_len);
47-
+ if (c->ssl->client_extensions == NULL) {
48-
+ OPENSSL_free(ext_out);
49-
+ return 1;
50-
+ }
51-
+
52-
+ c->ssl->client_extensions_size = ext_len;
53-
+ ngx_memcpy(c->ssl->client_extensions, ext_out, sizeof(int) * ext_len);
54-
+
55-
+ OPENSSL_free(ext_out);
56-
+
57105
+ return 1;
58106
+}
59107
+#endif
60-
+
61-
+
108+
+/* ----- JA3 HACK END -------------------------------------------------------*/
109+
62110
ngx_int_t
63111
ngx_ssl_handshake(ngx_connection_t *c)
64-
{
65-
@@ -1229,6 +1283,10 @@
112+
@@ -1229,6 +1330,10 @@ ngx_ssl_handshake(ngx_connection_t *c)
66113

67114
ngx_ssl_clear_error(c->log);
68115

@@ -73,18 +120,43 @@ diff -r 2e8de3d81783 src/event/ngx_event_openssl.c
73120
n = SSL_do_handshake(c->ssl->connection);
74121

75122
ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL_do_handshake: %d", n);
76-
diff -r 2e8de3d81783 src/event/ngx_event_openssl.h
77-
--- a/src/event/ngx_event_openssl.h Tue Aug 22 17:36:12 2017 +0300
78-
+++ b/src/event/ngx_event_openssl.h Tue Aug 22 20:20:30 2017 +0000
79-
@@ -85,6 +85,11 @@
123+
@@ -1292,6 +1397,12 @@ ngx_ssl_handshake(ngx_connection_t *c)
124+
125+
c->ssl->handshaked = 1;
126+
127+
+/* ----- JA3 HACK START -----------------------------------------------------*/
128+
+#if OPENSSL_VERSION_NUMBER >= 0x10101000L
129+
+ ngx_SSL_client_features(c);
130+
+#endif
131+
+/* ----- JA3 HACK END -------------------------------------------------------*/
132+
+
133+
c->recv = ngx_ssl_recv;
134+
c->send = ngx_ssl_write;
135+
c->recv_chain = ngx_ssl_recv_chain;
136+
diff -Naurp nginx-1.14.0.orig/src/event/ngx_event_openssl.h nginx-1.14.0/src/event/ngx_event_openssl.h
137+
--- nginx-1.14.0.orig/src/event/ngx_event_openssl.h 2018-04-17 18:22:36.000000000 +0300
138+
+++ nginx-1.14.0/src/event/ngx_event_openssl.h 2020-10-26 21:10:34.943067201 +0300
139+
@@ -86,6 +86,23 @@ struct ngx_ssl_connection_s {
80140
unsigned no_wait_shutdown:1;
81141
unsigned no_send_shutdown:1;
82142
unsigned handshake_buffer_set:1;
83143
+
144+
+/* ----- JA3 HACK START -----------------------------------------------------*/
84145
+#if OPENSSL_VERSION_NUMBER >= 0x10101000L
85-
+ size_t client_extensions_size;
86-
+ int *client_extensions;
146+
+
147+
+ size_t ciphers_sz;
148+
+ unsigned short *ciphers;
149+
+
150+
+ size_t extensions_size;
151+
+ int *extensions;
152+
+
153+
+ size_t curves_sz;
154+
+ unsigned short *curves;
155+
+
156+
+ size_t point_formats_sz;
157+
+ unsigned char *point_formats;
87158
+#endif
159+
+/* ----- JA3 HACK END -------------------------------------------------------*/
88160
};
89161

90162

0 commit comments

Comments
 (0)