Fixed ja4c

Author: kriztalz

ja4.go

@@ -82,18 +82,36 @@ func ja4b(tls TLSDetails) string {
 }
 
 func ja4c_r(tls TLSDetails) string {
+	// Get extensions and signature algorithms
 	extensions := strings.Split(strings.Split(tls.JA3, ",")[2], "-")
 	sigAlgs := strings.Split(strings.Split(tls.PeetPrint, "|")[3], "-")
 
-	// VERY dirty hack: append padding, because it gets filtered out for JA3
-	// but we want it here. _SHOULD_ be included in ever TLS clienthello, so
-	// _shouldnt_ cause any issues.
-	extensions = append(extensions, "21")
+	// Convert extensions to hex, filter GREASE and padding, and sort
+	parsedExt := []string{}
+	for _, ext := range extensions {
+		num, _ := strconv.Atoi(ext)
+		hexStr := fmt.Sprintf("%04x", num)
+		// Skip if it's a GREASE value or padding extension
+		if isGrease("0x"+strings.ToUpper(hexStr)) || hexStr == "0010" {
+			continue
+		}
+		parsedExt = append(parsedExt, hexStr)
+	}
+	sort.Strings(parsedExt)
+
+	// Convert signature algorithms to hex
+	parsedAlg := []string{}
+	for _, alg := range sigAlgs {
+		if alg == "GREASE" {
+			continue
+		}
+		num, _ := strconv.Atoi(alg)
+		hexStr := fmt.Sprintf("%04x", num)
+		parsedAlg = append(parsedAlg, hexStr)
+	}
 
-	parsedExt := toHexAll(extensions, true, true)
-	parsedAlg := toHexAll(sigAlgs, false, false)
+	// Join the results
 	parsed := strings.Join(parsedExt, ",") + "_" + strings.Join(parsedAlg, ",")
-	// fmt.Println("ja4c:", parsed)
 	return parsed
 }
 
@@ -108,4 +126,4 @@ func CalculateJa4(tls TLSDetails) string {
 
 func CalculateJa4_r(tls TLSDetails) string {
 	return ja4a(tls) + "_" + ja4b_r(tls) + "_" + ja4c_r(tls)
-}
+}