@prosopo/provider 4.15.13 → 4.15.15

package/dist/api/ja4.js

@@ -1,203 +1,164 @@
 import { createHash } from "node:crypto";
-const RECORD_HEADER_LENGTH = 5;
-const HANDSHAKE_HEADER_LENGTH = 4;
-const HANDSHAKE_RECORD_TYPE = 22;
-const HANDSHAKE_MESSAGE_TYPE = 1;
-const EXT_SERVER_NAME = 0;
-const EXT_SIGNATURE_ALGORITHMS = 13;
-const EXT_ALPN = 16;
-const EXT_SUPPORTED_VERSIONS = 43;
+//#region src/api/ja4.ts
+var RECORD_HEADER_LENGTH = 5;
+var HANDSHAKE_HEADER_LENGTH = 4;
+var HANDSHAKE_RECORD_TYPE = 22;
+var HANDSHAKE_MESSAGE_TYPE = 1;
+var EXT_SERVER_NAME = 0;
+var EXT_SIGNATURE_ALGORITHMS = 13;
+var EXT_ALPN = 16;
+var EXT_SUPPORTED_VERSIONS = 43;
 function isGrease(id) {
-  return (id & 3855) === 2570 && id >> 8 === (id & 255);
+	return (id & 3855) === 2570 && id >> 8 === (id & 255);
 }
 function hash12(input) {
-  return createHash("sha256").update(input).digest("hex").slice(0, 12);
+	return createHash("sha256").update(input).digest("hex").slice(0, 12);
 }
 function formatIdList(ids) {
-  return ids.map((id) => id.toString(16).padStart(4, "0")).join(",");
+	return ids.map((id) => id.toString(16).padStart(4, "0")).join(",");
 }
 function alpnChar(b) {
-  if (b >= 48 && b <= 57 || // 0-9
-  b >= 65 && b <= 90 || // A-Z
-  b >= 97 && b <= 122) {
-    return String.fromCharCode(b);
-  }
-  return b.toString(16).padStart(2, "0");
+	if (b >= 48 && b <= 57 || b >= 65 && b <= 90 || b >= 97 && b <= 122) return String.fromCharCode(b);
+	return b.toString(16).padStart(2, "0");
 }
 function alpnFirstLast(protocol) {
-  const first = protocol.length > 0 ? alpnChar(protocol.readUInt8(0)) : "0";
-  const last = protocol.length > 1 ? alpnChar(protocol.readUInt8(protocol.length - 1)) : "0";
-  return [first, last];
+	return [protocol.length > 0 ? alpnChar(protocol.readUInt8(0)) : "0", protocol.length > 1 ? alpnChar(protocol.readUInt8(protocol.length - 1)) : "0"];
 }
 function tlsVersionStr(version) {
-  switch (version) {
-    case 769:
-      return "10";
-    case 770:
-      return "11";
-    case 771:
-      return "12";
-    case 772:
-      return "13";
-    default:
-      return "00";
-  }
-}
-class Ja4ParseError extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "Ja4ParseError";
-  }
+	switch (version) {
+		case 769: return "10";
+		case 770: return "11";
+		case 771: return "12";
+		case 772: return "13";
+		default: return "00";
+	}
 }
+var Ja4ParseError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "Ja4ParseError";
+	}
+};
+/**
+* Compute a JA4 TLS fingerprint from raw ClientHello bytes.
+*
+* Expects the full TLS record:
+*   5-byte record header  (content_type + version + record_len)
+*   4-byte handshake header (msg_type + msg_len)
+*   ClientHello body
+*
+* Throws Ja4ParseError for structural failures in the TLS record or handshake
+* header (wrong record type, wrong message type, declared lengths exceeding the
+* buffer, odd cipher-suite length).
+*
+* Extension-level malformation (truncated extension body, malformed ALPN
+* entries) is handled defensively: parsing stops at the first bad entry and
+* a fingerprint is produced from whatever was successfully parsed. This matches
+* the Rust reference implementation and avoids turning extension parse errors
+* into connection-fingerprinting failures.
+*/
 function calculateJa4(data) {
-  let offset = 0;
-  if (data.length < RECORD_HEADER_LENGTH + HANDSHAKE_HEADER_LENGTH) {
-    throw new Ja4ParseError("ClientHello too short");
-  }
-  const recordType = data.readUInt8(offset);
-  offset += 1;
-  if (recordType !== HANDSHAKE_RECORD_TYPE) {
-    throw new Ja4ParseError(
-      `Invalid record type: 0x${recordType.toString(16)}`
-    );
-  }
-  offset += 2;
-  const recordLen = data.readUInt16BE(offset);
-  offset += 2;
-  if (data.length < RECORD_HEADER_LENGTH + recordLen) {
-    throw new Ja4ParseError("Record length exceeds buffer");
-  }
-  data = data.subarray(0, RECORD_HEADER_LENGTH + recordLen);
-  if (data.length < RECORD_HEADER_LENGTH + HANDSHAKE_HEADER_LENGTH) {
-    throw new Ja4ParseError("Record too short for handshake header");
-  }
-  const msgType = data.readUInt8(offset);
-  offset += 1;
-  if (msgType !== HANDSHAKE_MESSAGE_TYPE) {
-    throw new Ja4ParseError(
-      `Not a ClientHello: handshake type 0x${msgType.toString(16)}`
-    );
-  }
-  const msgLen = data.readUIntBE(offset, 3);
-  offset += 3;
-  if (data.length - offset < msgLen) {
-    throw new Ja4ParseError("Handshake message length exceeds record");
-  }
-  data = data.subarray(0, offset + msgLen);
-  if (data.length - offset < 35) {
-    throw new Ja4ParseError("ClientHello body too short");
-  }
-  let clientVersion = data.readUInt16BE(offset);
-  offset += 2;
-  offset += 32;
-  const sessionIdLen = data.readUInt8(offset);
-  offset += 1;
-  if (data.length - offset < sessionIdLen) {
-    throw new Ja4ParseError("Truncated at session ID");
-  }
-  offset += sessionIdLen;
-  if (data.length - offset < 2) {
-    throw new Ja4ParseError("Truncated at cipher suites length");
-  }
-  const cipherSuitesLen = data.readUInt16BE(offset);
-  offset += 2;
-  if (data.length - offset < cipherSuitesLen) {
-    throw new Ja4ParseError("Truncated at cipher suites");
-  }
-  if (cipherSuitesLen % 2 !== 0) {
-    throw new Ja4ParseError("Cipher suites length is not a multiple of 2");
-  }
-  const cipherSuites = [];
-  for (let i = 0; i < cipherSuitesLen; i += 2) {
-    cipherSuites.push(data.readUInt16BE(offset + i));
-  }
-  offset += cipherSuitesLen;
-  if (data.length - offset < 1) {
-    throw new Ja4ParseError("Truncated at compression methods");
-  }
-  const compressionLen = data.readUInt8(offset);
-  offset += 1;
-  if (data.length - offset < compressionLen) {
-    throw new Ja4ParseError("Truncated at compression methods data");
-  }
-  offset += compressionLen;
-  if (data.length - offset < 2) {
-    throw new Ja4ParseError("Truncated at extensions length");
-  }
-  const extensionsLen = data.readUInt16BE(offset);
-  offset += 2;
-  if (data.length - offset < extensionsLen) {
-    throw new Ja4ParseError("Truncated at extensions");
-  }
-  const extIds = [];
-  const sigAlgorithms = [];
-  const alpnProtocols = [];
-  let extOffset = offset;
-  const extEnd = offset + extensionsLen;
-  while (extOffset + 4 <= extEnd) {
-    const extId = data.readUInt16BE(extOffset);
-    extOffset += 2;
-    const extLen = data.readUInt16BE(extOffset);
-    extOffset += 2;
-    if (extOffset + extLen > extEnd) break;
-    const extData = data.subarray(extOffset, extOffset + extLen);
-    extOffset += extLen;
-    extIds.push(extId);
-    if (extId === EXT_SUPPORTED_VERSIONS) {
-      if (extData.length >= 1) {
-        const listLen = extData.readUInt8(0);
-        let best = 0;
-        for (let i = 1; i + 1 < extData.length && i + 1 <= listLen; i += 2) {
-          const v = extData.readUInt16BE(i);
-          if (!isGrease(v) && v > best) best = v;
-        }
-        if (best > 0) clientVersion = best;
-      }
-    } else if (extId === EXT_SIGNATURE_ALGORITHMS) {
-      if (extData.length >= 2) {
-        const algLen = extData.readUInt16BE(0);
-        for (let i = 2; i + 1 < extData.length && i + 1 < algLen + 2; i += 2) {
-          const alg = extData.readUInt16BE(i);
-          if (!isGrease(alg)) sigAlgorithms.push(alg);
-        }
-      }
-    } else if (extId === EXT_ALPN) {
-      if (extData.length >= 2) {
-        const listLen = extData.readUInt16BE(0);
-        const listEnd = Math.min(extData.length, 2 + listLen);
-        let alpnOff = 2;
-        while (alpnOff < listEnd) {
-          const protoLen = extData.readUInt8(alpnOff);
-          alpnOff += 1;
-          if (alpnOff + protoLen > listEnd) break;
-          alpnProtocols.push(extData.subarray(alpnOff, alpnOff + protoLen));
-          alpnOff += protoLen;
-        }
-      }
-    }
-  }
-  const versionStr = tlsVersionStr(clientVersion);
-  const sni = extIds.includes(EXT_SERVER_NAME) ? "d" : "i";
-  const firstAlpn = alpnProtocols[0];
-  const [alpnFirst, alpnLast] = firstAlpn ? alpnFirstLast(firstAlpn) : ["0", "0"];
-  const nonGreaseCiphers = cipherSuites.filter((c) => !isGrease(c));
-  const nonGreaseExts = extIds.filter((e) => !isGrease(e));
-  const cipherCount = Math.min(99, nonGreaseCiphers.length).toString().padStart(2, "0");
-  const extCount = Math.min(99, nonGreaseExts.length).toString().padStart(2, "0");
-  const firstChunk = `t${versionStr}${sni}${cipherCount}${extCount}${alpnFirst}${alpnLast}`;
-  const sortedCiphers = [...nonGreaseCiphers].sort((a, b) => a - b);
-  const cipherHash = hash12(formatIdList(sortedCiphers));
-  const filteredExts = nonGreaseExts.filter(
-    (e) => e !== EXT_SERVER_NAME && e !== EXT_ALPN
-  );
-  const sortedExts = [...filteredExts].sort((a, b) => a - b);
-  const extStr = formatIdList(sortedExts);
-  const sigAlgStr = formatIdList(sigAlgorithms);
-  const extHashInput = sigAlgStr.length > 0 ? `${extStr}_${sigAlgStr}` : extStr;
-  const extHash = hash12(extHashInput);
-  return `${firstChunk}_${cipherHash}_${extHash}`;
+	let offset = 0;
+	if (data.length < RECORD_HEADER_LENGTH + HANDSHAKE_HEADER_LENGTH) throw new Ja4ParseError("ClientHello too short");
+	const recordType = data.readUInt8(offset);
+	offset += 1;
+	if (recordType !== HANDSHAKE_RECORD_TYPE) throw new Ja4ParseError(`Invalid record type: 0x${recordType.toString(16)}`);
+	offset += 2;
+	const recordLen = data.readUInt16BE(offset);
+	offset += 2;
+	if (data.length < RECORD_HEADER_LENGTH + recordLen) throw new Ja4ParseError("Record length exceeds buffer");
+	data = data.subarray(0, RECORD_HEADER_LENGTH + recordLen);
+	if (data.length < RECORD_HEADER_LENGTH + HANDSHAKE_HEADER_LENGTH) throw new Ja4ParseError("Record too short for handshake header");
+	const msgType = data.readUInt8(offset);
+	offset += 1;
+	if (msgType !== HANDSHAKE_MESSAGE_TYPE) throw new Ja4ParseError(`Not a ClientHello: handshake type 0x${msgType.toString(16)}`);
+	const msgLen = data.readUIntBE(offset, 3);
+	offset += 3;
+	if (data.length - offset < msgLen) throw new Ja4ParseError("Handshake message length exceeds record");
+	data = data.subarray(0, offset + msgLen);
+	if (data.length - offset < 35) throw new Ja4ParseError("ClientHello body too short");
+	let clientVersion = data.readUInt16BE(offset);
+	offset += 2;
+	offset += 32;
+	const sessionIdLen = data.readUInt8(offset);
+	offset += 1;
+	if (data.length - offset < sessionIdLen) throw new Ja4ParseError("Truncated at session ID");
+	offset += sessionIdLen;
+	if (data.length - offset < 2) throw new Ja4ParseError("Truncated at cipher suites length");
+	const cipherSuitesLen = data.readUInt16BE(offset);
+	offset += 2;
+	if (data.length - offset < cipherSuitesLen) throw new Ja4ParseError("Truncated at cipher suites");
+	if (cipherSuitesLen % 2 !== 0) throw new Ja4ParseError("Cipher suites length is not a multiple of 2");
+	const cipherSuites = [];
+	for (let i = 0; i < cipherSuitesLen; i += 2) cipherSuites.push(data.readUInt16BE(offset + i));
+	offset += cipherSuitesLen;
+	if (data.length - offset < 1) throw new Ja4ParseError("Truncated at compression methods");
+	const compressionLen = data.readUInt8(offset);
+	offset += 1;
+	if (data.length - offset < compressionLen) throw new Ja4ParseError("Truncated at compression methods data");
+	offset += compressionLen;
+	if (data.length - offset < 2) throw new Ja4ParseError("Truncated at extensions length");
+	const extensionsLen = data.readUInt16BE(offset);
+	offset += 2;
+	if (data.length - offset < extensionsLen) throw new Ja4ParseError("Truncated at extensions");
+	const extIds = [];
+	const sigAlgorithms = [];
+	const alpnProtocols = [];
+	let extOffset = offset;
+	const extEnd = offset + extensionsLen;
+	while (extOffset + 4 <= extEnd) {
+		const extId = data.readUInt16BE(extOffset);
+		extOffset += 2;
+		const extLen = data.readUInt16BE(extOffset);
+		extOffset += 2;
+		if (extOffset + extLen > extEnd) break;
+		const extData = data.subarray(extOffset, extOffset + extLen);
+		extOffset += extLen;
+		extIds.push(extId);
+		if (extId === EXT_SUPPORTED_VERSIONS) {
+			if (extData.length >= 1) {
+				const listLen = extData.readUInt8(0);
+				let best = 0;
+				for (let i = 1; i + 1 < extData.length && i + 1 <= listLen; i += 2) {
+					const v = extData.readUInt16BE(i);
+					if (!isGrease(v) && v > best) best = v;
+				}
+				if (best > 0) clientVersion = best;
+			}
+		} else if (extId === EXT_SIGNATURE_ALGORITHMS) {
+			if (extData.length >= 2) {
+				const algLen = extData.readUInt16BE(0);
+				for (let i = 2; i + 1 < extData.length && i + 1 < algLen + 2; i += 2) {
+					const alg = extData.readUInt16BE(i);
+					if (!isGrease(alg)) sigAlgorithms.push(alg);
+				}
+			}
+		} else if (extId === EXT_ALPN) {
+			if (extData.length >= 2) {
+				const listLen = extData.readUInt16BE(0);
+				const listEnd = Math.min(extData.length, 2 + listLen);
+				let alpnOff = 2;
+				while (alpnOff < listEnd) {
+					const protoLen = extData.readUInt8(alpnOff);
+					alpnOff += 1;
+					if (alpnOff + protoLen > listEnd) break;
+					alpnProtocols.push(extData.subarray(alpnOff, alpnOff + protoLen));
+					alpnOff += protoLen;
+				}
+			}
+		}
+	}
+	const versionStr = tlsVersionStr(clientVersion);
+	const sni = extIds.includes(EXT_SERVER_NAME) ? "d" : "i";
+	const firstAlpn = alpnProtocols[0];
+	const [alpnFirst, alpnLast] = firstAlpn ? alpnFirstLast(firstAlpn) : ["0", "0"];
+	const nonGreaseCiphers = cipherSuites.filter((c) => !isGrease(c));
+	const nonGreaseExts = extIds.filter((e) => !isGrease(e));
+	const firstChunk = `t${versionStr}${sni}${Math.min(99, nonGreaseCiphers.length).toString().padStart(2, "0")}${Math.min(99, nonGreaseExts.length).toString().padStart(2, "0")}${alpnFirst}${alpnLast}`;
+	const cipherHash = hash12(formatIdList([...nonGreaseCiphers].sort((a, b) => a - b)));
+	const extStr = formatIdList([...nonGreaseExts.filter((e) => e !== EXT_SERVER_NAME && e !== EXT_ALPN)].sort((a, b) => a - b));
+	const sigAlgStr = formatIdList(sigAlgorithms);
+	return `${firstChunk}_${cipherHash}_${hash12(sigAlgStr.length > 0 ? `${extStr}_${sigAlgStr}` : extStr)}`;
 }
-export {
-  Ja4ParseError,
-  calculateJa4
-};
+//#endregion
+export { Ja4ParseError, calculateJa4 };

package/dist/api/ja4Middleware.js

@@ -1,58 +1,43 @@
-import { handleErrors } from "@prosopo/api-express-router";
+import { calculateJa4 } from "./ja4.js";
 import { getLogger } from "@prosopo/logger";
 import { randomAsHex } from "@prosopo/util-crypto";
-import { calculateJa4 } from "./ja4.js";
-const DEFAULT_JA4 = "ja4";
-const getJA4 = async (headers, logger) => {
-  logger = logger || getLogger("info", "provider:ja4");
-  if (process.env.NODE_ENV === "development") {
-    return {
-      ja4PlusFingerprint: `${DEFAULT_JA4}${randomAsHex().slice(28, 32)}`
-    };
-  }
-  try {
-    const xTlsClientHello = (headers["x-tls-clienthello"] || "").toString();
-    const clientHelloBuffer = Buffer.from(xTlsClientHello, "base64");
-    logger.debug(() => ({
-      msg: "ClientHello First Bytes:",
-      data: { hex: clientHelloBuffer.subarray(0, 5).toString("hex") }
-    }));
-    if (clientHelloBuffer[5] !== 1) {
-      logger.debug(() => ({
-        msg: "Invalid ClientHello message: First byte is not 0x01"
-      }));
-      return { ja4PlusFingerprint: DEFAULT_JA4 };
-    }
-    const ja4PlusFingerprint = calculateJa4(clientHelloBuffer);
-    return { ja4PlusFingerprint };
-  } catch (e) {
-    logger.error(() => ({
-      msg: "Error generating JA4+ fingerprint:",
-      err: e instanceof Error ? e : new Error(String(e))
-    }));
-    return { ja4PlusFingerprint: DEFAULT_JA4 };
-  }
-};
-const ja4Middleware = (env) => {
-  return async (req, res, next) => {
-    try {
-      req.logger.debug(() => ({ data: { url: req.url } }));
-      const ja4 = await getJA4(req.headers, req.logger);
-      req.ja4 = ja4.ja4PlusFingerprint || "";
-      req.logger = req.logger.with(
-        {
-          ja4: req.ja4
-        },
-        "ja4"
-      );
-      next();
-    } catch (err) {
-      return handleErrors(err, req, res, next);
-    }
-  };
+import { handleErrors } from "@prosopo/api-express-router";
+//#region src/api/ja4Middleware.ts
+var DEFAULT_JA4 = "ja4";
+var getJA4 = async (headers, logger) => {
+	logger = logger || getLogger("info", "provider:ja4");
+	if (process.env.NODE_ENV === "development") return { ja4PlusFingerprint: `ja4${randomAsHex().slice(28, 32)}` };
+	try {
+		const xTlsClientHello = (headers["x-tls-clienthello"] || "").toString();
+		const clientHelloBuffer = Buffer.from(xTlsClientHello, "base64");
+		logger.debug(() => ({
+			msg: "ClientHello First Bytes:",
+			data: { hex: clientHelloBuffer.subarray(0, 5).toString("hex") }
+		}));
+		if (clientHelloBuffer[5] !== 1) {
+			logger.debug(() => ({ msg: "Invalid ClientHello message: First byte is not 0x01" }));
+			return { ja4PlusFingerprint: "ja4" };
+		}
+		return { ja4PlusFingerprint: calculateJa4(clientHelloBuffer) };
+	} catch (e) {
+		logger.error(() => ({
+			msg: "Error generating JA4+ fingerprint:",
+			err: e instanceof Error ? e : new Error(String(e))
+		}));
+		return { ja4PlusFingerprint: "ja4" };
+	}
 };
-export {
-  DEFAULT_JA4,
-  getJA4,
-  ja4Middleware
+var ja4Middleware = (env) => {
+	return async (req, res, next) => {
+		try {
+			req.logger.debug(() => ({ data: { url: req.url } }));
+			req.ja4 = (await getJA4(req.headers, req.logger)).ja4PlusFingerprint || "";
+			req.logger = req.logger.with({ ja4: req.ja4 }, "ja4");
+			next();
+		} catch (err) {
+			return handleErrors(err, req, res, next);
+		}
+	};
 };
+//#endregion
+export { DEFAULT_JA4, getJA4, ja4Middleware };