https_server.py
def tls_handshake(sock, message_queues, fd_to_socket, sock_to_ja3, poller):
    """Takes a given connection and completes the TLS handshake to obtain the
    JA3 fingerprint.

    Arguments:
        sock (:obj: `socket`) current TCP connection with a client to complete
            the TLS handshake with.
        message_queues (:obj: `queue.queue`) standard queue for message IO for
            the given socket
        fd_to_socket (:obj: `dict`) Dictionary mapping file descriptor integers
            to socket objects
        sock_to_ja3 (:obj: `dict`) Dictionary mapping socket objects to ja3
            fingerprints
        poller (:obj: `select.poll`) poller object for concurrent IO on the socket
    """

    try:
        # peek and get the client HELLO for the TLS handshake
        # we have an ssl socket, then we've already completed the TLS handshake
        if isinstance(sock, ssl.SSLSocket):
            _LOGGER.info("returning the ssl socket for false")
            return False

        # otherwise, we peek at the TLS handshake
        _LOGGER.info("receiving client hello")
        client_hello = sock.recv(2048, socket.MSG_PEEK)

        addr = sock.getpeername()

        # we got data from it and it didn't hangup
        if client_hello:
            ja3_record = ja3.process_ssl(client_hello)
            # handles if the client_hello is not TLS handshake or just plain HTTP
            if ja3_record is not None:
                ja3_digest = ja3_record.get("ja3_digest", None)

                # gets rid of the non-ssl socket
                del fd_to_socket[sock.fileno()]
                poller.unregister(sock)

                # need to set to blocking for a hot sec so it can complete the TLS handshake
                sock.setblocking(1)

                # complete the TLS handshake by wrapping the
                # socket in the ssl module
                _LOGGER.debug("Attempting to wrap the socket with SSL")

                ssock = ssl.wrap_socket(sock, certfile=CERTFILE, \
                        keyfile=KEYFILE, server_side=True, \
                        ssl_version=ssl.PROTOCOL_TLSv1_2)


                _LOGGER.debug("got peername")
                # set the ssl socket to be nonblocking
                ssock.setblocking(0)
                _LOGGER.debug("created TLS connection, adding SSL socket to poller")

                # add the ssl socket for later use
                fd_to_socket[ssock.fileno()] = ssock
                # add the ja3 digest to the socket
                sock_to_ja3[ssock] = ja3_digest

                # it's a new ssl socket client, so register the poller to
                # look out for it
                poller.register(ssock, READ_ONLY)
                message_queues[ssock] = queue.Queue()

                _LOGGER.info("New TLS Connection Established: %s", addr)
                _LOGGER.info("JA3: (%s,%s) :: %s", addr[0], addr[1], ja3_digest)

                # successful TLS handshake
                return True

            # equivalent of an else block
            _LOGGER.debug("Did not receive TLS handshake from %s", addr)

            # no message queue yet or ja3 digest
            return False

        # equivalent of an else block
        _LOGGER.info("Client %s Hung Up before initiating TLS Handshake", addr)
        _LOGGER.debug(sock)
        cleanup_connection(sock, poller)
        return None

    except BlockingIOError as err:
        _LOGGER.warning("Blocking IO Err: %s", err)
        return False

    except ssl.SSLError as err:
        # error typically associated with browsers complaining about a
        # self-signed cert
        _LOGGER.warning("SSL Err: %s", err)
        # cleanup_connection(sock, poller)
        return None

    except OSError as err:
        _LOGGER.warning(err)
        cleanup_connection(sock, poller)
        return None
Takes a given connection and completes the TLS handshake to obtain the
    JA3 fingerprint.

    Arguments:
        sock (:obj: `socket`) current TCP connection with a client to complete
            the TLS handshake with.
        message_queues (:obj: `queue.queue`) standard queue for message IO for
            the given socket
        fd_to_socket (:obj: `dict`) Dictionary mapping file descriptor integers
            to socket objects
        sock_to_ja3 (:obj: `dict`) Dictionary mapping socket objects to ja3
            fingerprints
        poller (:obj: `select.poll`) poller object for concurrent IO on the socket
    
Takes a given connection and completes the TLS handshake to obtain the
JA3 fingerprint.
Takes a given connection and completes the TLS handshake to obtain the JA3 fingerprint .
def tls_handshake(sock, message_queues, fd_to_socket, sock_to_ja3, poller):
    try:
        if isinstance(sock, ssl.SSLSocket):
            _LOGGER.info("returning the ssl socket for false")
            return False
        _LOGGER.info("receiving client hello")
        client_hello = sock.recv(2048, socket.MSG_PEEK)
        addr = sock.getpeername()
        if client_hello:
            ja3_record = ja3.process_ssl(client_hello)
            if ja3_record is not None:
                ja3_digest = ja3_record.get("ja3_digest", None)
                del fd_to_socket[sock.fileno()]
                poller.unregister(sock)
                sock.setblocking(1)
                _LOGGER.debug("Attempting to wrap the socket with SSL")
                ssock = ssl.wrap_socket(sock, certfile=CERTFILE, \
                        keyfile=KEYFILE, server_side=True, \
                        ssl_version=ssl.PROTOCOL_TLSv1_2)
                _LOGGER.debug("got peername")
                ssock.setblocking(0)
                _LOGGER.debug("created TLS connection, adding SSL socket to poller")
                fd_to_socket[ssock.fileno()] = ssock
                sock_to_ja3[ssock] = ja3_digest
                poller.register(ssock, READ_ONLY)
                message_queues[ssock] = queue.Queue()
                _LOGGER.info("New TLS Connection Established: %s", addr)
                _LOGGER.info("JA3: (%s,%s) :: %s", addr[0], addr[1], ja3_digest)
                return True
            _LOGGER.debug("Did not receive TLS handshake from %s", addr)
            return False
        _LOGGER.info("Client %s Hung Up before initiating TLS Handshake", addr)
        _LOGGER.debug(sock)
        cleanup_connection(sock, poller)
        return None
    except BlockingIOError as err:
        _LOGGER.warning("Blocking IO Err: %s", err)
        return False
    except ssl.SSLError as err:
        _LOGGER.warning("SSL Err: %s", err)
        return None
    except OSError as err:
        _LOGGER.warning(err)
        cleanup_connection(sock, poller)
        return None
def tls_handshake ( sock , message_queues , fd_to_socket , sock_to_ja3 , poller ) : try : if isinstance ( sock , ssl . SSLSocket ) : _LOGGER . info ( "returning the ssl socket for false" ) return False _LOGGER . info ( "receiving client hello" ) client_hello = sock . recv ( 2048 , socket . MSG_PEEK ) addr = sock . getpeername ( ) if client_hello : ja3_record = ja3 . process_ssl ( client_hello ) if ja3_record is not None : ja3_digest = ja3_record . get ( "ja3_digest" , None ) del fd_to_socket [ sock . fileno ( ) ] poller . unregister ( sock ) sock . setblocking ( 1 ) _LOGGER . debug ( "Attempting to wrap the socket with SSL" ) ssock = ssl . wrap_socket ( sock , certfile = CERTFILE , keyfile = KEYFILE , server_side = True , ssl_version = ssl . PROTOCOL_TLSv1_2 ) _LOGGER . debug ( "got peername" ) ssock . setblocking ( 0 ) _LOGGER . debug ( "created TLS connection, adding SSL socket to poller" ) fd_to_socket [ ssock . fileno ( ) ] = ssock sock_to_ja3 [ ssock ] = ja3_digest poller . register ( ssock , READ_ONLY ) message_queues [ ssock ] = queue . Queue ( ) _LOGGER . info ( "New TLS Connection Established: %s" , addr ) _LOGGER . info ( "JA3: (%s,%s) :: %s" , addr [ 0 ] , addr [ 1 ] , ja3_digest ) return True _LOGGER . debug ( "Did not receive TLS handshake from %s" , addr ) return False _LOGGER . info ( "Client %s Hung Up before initiating TLS Handshake" , addr ) _LOGGER . debug ( sock ) cleanup_connection ( sock , poller ) return None except BlockingIOError as err : _LOGGER . warning ( "Blocking IO Err: %s" , err ) return False except ssl . SSLError as err : _LOGGER . warning ( "SSL Err: %s" , err ) return None except OSError as err : _LOGGER . warning ( err ) cleanup_connection ( sock , poller ) return None
Takes a given connection and completes the TLS handshake to obtain the
JA3 fingerprint.
Takes a given connection and completes the TLS handshake to obtain the JA3 fingerprint .
"""Takes a given connection and completes the TLS handshake to obtain the
    JA3 fingerprint.

    Arguments:
        sock (:obj: `socket`) current TCP connection with a client to complete
            the TLS handshake with.
        message_queues (:obj: `queue.queue`) standard queue for message IO for
            the given socket
        fd_to_socket (:obj: `dict`) Dictionary mapping file descriptor integers
            to socket objects
        sock_to_ja3 (:obj: `dict`) Dictionary mapping socket objects to ja3
            fingerprints
        poller (:obj: `select.poll`) poller object for concurrent IO on the socket
    """ # peek and get the client HELLO for the TLS handshake # we have an ssl socket, then we've already completed the TLS handshake # otherwise, we peek at the TLS handshake # we got data from it and it didn't hangup # handles if the client_hello is not TLS handshake or just plain HTTP # gets rid of the non-ssl socket # need to set to blocking for a hot sec so it can complete the TLS handshake # complete the TLS handshake by wrapping the # socket in the ssl module # set the ssl socket to be nonblocking # add the ssl socket for later use # add the ja3 digest to the socket # it's a new ssl socket client, so register the poller to # look out for it # successful TLS handshake # equivalent of an else block # no message queue yet or ja3 digest # equivalent of an else block # error typically associated with browsers complaining about a # self-signed cert # cleanup_connection(sock, poller)
sock
message_queues
fd_to_socket
sock_to_ja3
poller
sock (
`socket`) current TCP connection with a client to complete
the TLS handshake with.
` socket ` ) current TCP connection with a client to complete the TLS handshake with .
message_queues (
`queue.queue`) standard queue for message IO for
the given socket
` queue . queue ` ) standard queue for message IO for the given socket
fd_to_socket (
`dict`) Dictionary mapping file descriptor integers
to socket objects
` dict ` ) Dictionary mapping file descriptor integers to socket objects
sock_to_ja3 (
`dict`) Dictionary mapping socket objects to ja3
fingerprints
` dict ` ) Dictionary mapping socket objects to ja3 fingerprints
poller (
`select.poll`) poller object for concurrent IO on the socket
` select . poll ` ) poller object for concurrent IO on the socket