ja3.py
def process_extensions(client_handshake):
    """Process any extra extensions and convert to a JA3 segment.

    :param client_handshake: Handshake data from the packet
    :type client_handshake: dpkt.ssl.TLSClientHello
    :returns: list
    """
    if not hasattr(client_handshake, "extensions"):
        # Needed to preserve commas on the join
        return ["", "", ""]

    exts = list()
    elliptic_curve = ""
    elliptic_curve_point_format = ""
    for ext_val, ext_data in client_handshake.extensions:
        if not GREASE_TABLE.get(ext_val):
            exts.append(ext_val)
        if ext_val == 0x0a:
            a, b = parse_variable_array(ext_data, 2)
            # Elliptic curve points (16 bit values)
            elliptic_curve = convert_to_ja3_segment(a, 2)
        elif ext_val == 0x0b:
            a, b = parse_variable_array(ext_data, 1)
            # Elliptic curve point formats (8 bit values)
            elliptic_curve_point_format = convert_to_ja3_segment(a, 1)
        else:
            continue

    results = list()
    results.append("-".join([str(x) for x in exts]))
    results.append(elliptic_curve)
    results.append(elliptic_curve_point_format)
    return results
Process any extra extensions and convert to a JA3 segment.

    :param client_handshake: Handshake data from the packet
    :type client_handshake: dpkt.ssl.TLSClientHello
    :returns: list
    
Process any extra extensions and convert to a JA3 segment.
Process any extra extensions and convert to a JA3 segment .
def process_extensions(client_handshake):
    if not hasattr(client_handshake, "extensions"):
        return ["", "", ""]
    exts = list()
    elliptic_curve = ""
    elliptic_curve_point_format = ""
    for ext_val, ext_data in client_handshake.extensions:
        if not GREASE_TABLE.get(ext_val):
            exts.append(ext_val)
        if ext_val == 0x0a:
            a, b = parse_variable_array(ext_data, 2)
            elliptic_curve = convert_to_ja3_segment(a, 2)
        elif ext_val == 0x0b:
            a, b = parse_variable_array(ext_data, 1)
            elliptic_curve_point_format = convert_to_ja3_segment(a, 1)
        else:
            continue
    results = list()
    results.append("-".join([str(x) for x in exts]))
    results.append(elliptic_curve)
    results.append(elliptic_curve_point_format)
    return results
def process_extensions ( client_handshake ) : if not hasattr ( client_handshake , "extensions" ) : return [ "" , "" , "" ] exts = list ( ) elliptic_curve = "" elliptic_curve_point_format = "" for ext_val , ext_data in client_handshake . extensions : if not GREASE_TABLE . get ( ext_val ) : exts . append ( ext_val ) if ext_val == 0x0a : a , b = parse_variable_array ( ext_data , 2 ) elliptic_curve = convert_to_ja3_segment ( a , 2 ) elif ext_val == 0x0b : a , b = parse_variable_array ( ext_data , 1 ) elliptic_curve_point_format = convert_to_ja3_segment ( a , 1 ) else : continue results = list ( ) results . append ( "-" . join ( [ str ( x ) for x in exts ] ) ) results . append ( elliptic_curve ) results . append ( elliptic_curve_point_format ) return results
Process any extra extensions and convert to a JA3 segment.
Process any extra extensions and convert to a JA3 segment .
"""Process any extra extensions and convert to a JA3 segment.

    :param client_handshake: Handshake data from the packet
    :type client_handshake: dpkt.ssl.TLSClientHello
    :returns: list
    """ # Needed to preserve commas on the join # Elliptic curve points (16 bit values) # Elliptic curve point formats (8 bit values)
None
client_handshake
Handshake data from the packet
Handshake data from the packet