Skip to content

Commit 53a14b0

Browse files
picoHzpicoHz
committed
Initial commit
0 parents  commit 53a14b0

28 files changed

+1439
-0
lines changed

‎.gitignore

+15
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
# Generated by Cargo
2+
# will have compiled files and executables
3+
/target/
4+
5+
# Remove Cargo.lock from gitignore if creating an executable, leave it for libraries
6+
# More information here https://doc.rust-lang.org/cargo/guide/cargo-toml-vs-cargo-lock.html
7+
Cargo.lock
8+
9+
# These are backup files generated by rustfmt
10+
**/*.rs.bk
11+
12+
13+
# Added by cargo
14+
15+
/target

‎Cargo.toml

+31
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
[package]
2+
name = "pawprint"
3+
version = "0.1.0"
4+
description = "A simple web app for inspecting TLS fingerprints"
5+
edition = "2021"
6+
authors = ["picoHz <[email protected]>"]
7+
keywords = ["tls", "ja3", "fingerprint"]
8+
categories = ["network-programming", "cryptography"]
9+
repository = "https://github.com/picoHz/pawprint"
10+
homepage = "https://pawprint.dev"
11+
license = "AGPL-3.0"
12+
13+
[dependencies]
14+
anyhow = "1.0.69"
15+
clap = { version = "4.1.4", features = ["derive"] }
16+
http = "0.2.8"
17+
hyper = { version = "0.14.24", features = ["server", "http1", "http2", "tcp"] }
18+
include_dir = "0.7.3"
19+
md5 = "0.7.0"
20+
pin-project-lite = "0.2.9"
21+
rustls = "0.20.8"
22+
rustls-pemfile = "1.0.2"
23+
sailfish = "0.6.0"
24+
serde = "1.0.152"
25+
serde_derive = "1.0.152"
26+
serde_json = "1.0.93"
27+
tokio = { version = "1.25.0", features = ["macros", "rt-multi-thread", "net"] }
28+
tokio-rustls = "0.23.4"
29+
30+
[profile.release]
31+
strip = true

‎LICENSE

+661
Large diffs are not rendered by default.

‎README.md

+45
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
# Pawprint
2+
3+
🐾 A simple web app for inspecting TLS fingerprints.
4+
5+
## Demo
6+
7+
Visit https://pawprint.dev/
8+
9+
## Installation
10+
11+
```bash
12+
cargo install pawprint
13+
```
14+
15+
## Starting the server
16+
17+
```bash
18+
pawprint 0.0.0.0:443 --certs path/to/certs.pem --key path/to/key.pem
19+
```
20+
21+
## Development
22+
23+
```bash
24+
# Generate a self-signed certificate
25+
cargo install rcgen
26+
rcgen
27+
28+
cargo r -- 127.0.0.1:8443 --certs certs/cert.pem --key certs/key.pem
29+
```
30+
31+
## Credit
32+
33+
This program is inspired by the following sites / libraries.
34+
35+
- [TLS fingerprinting: How it works, where it is used and how to control your signature](https://lwthiker.com/networks/2022/06/17/tls-fingerprinting.html)
36+
37+
- [TLSFingerprint.io](https://tlsfingerprint.io/)
38+
39+
- [salesforce/ja3](https://github.com/salesforce/ja3)
40+
41+
- [ja3-rustls](https://crates.io/crates/ja3-rustls)
42+
43+
## License
44+
45+
This software is licensed under the AGPLv3.

‎certs/cert.pem

+11
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
-----BEGIN CERTIFICATE-----
2+
MIIBfTCCASOgAwIBAgIICehBgSxAhTEwCgYIKoZIzj0EAwIwMDEYMBYGA1UECgwP
3+
Q3JhYiB3aWRnaXRzIFNFMRQwEgYDVQQDDAtNYXN0ZXIgQ2VydDAgFw03NTAxMDEw
4+
MDAwMDBaGA80MDk2MDEwMTAwMDAwMFowMDEYMBYGA1UECgwPQ3JhYiB3aWRnaXRz
5+
IFNFMRQwEgYDVQQDDAtNYXN0ZXIgQ2VydDBZMBMGByqGSM49AgEGCCqGSM49AwEH
6+
A0IABPWtBaFMHK5Ofr4iEG3yyUm3q0NnwXjkunvXm1yQ47z/5pM4exKfM4xZjjVB
7+
nCE1gv7KmShUsLHa8bu1/VvgKTijJTAjMCEGA1UdEQQaMBiCC2NyYWJzLmNyYWJz
8+
gglsb2NhbGhvc3QwCgYIKoZIzj0EAwIDSAAwRQIhAOKg0EHC+oBf/E2MSJMMnDAX
9+
9HueMwSFFomD+dQqU0gUAiAE99Q/eXybUKHCOKSrY+Iwq1ePAHkH4URNpQqKGyJP
10+
HQ==
11+
-----END CERTIFICATE-----

‎certs/key.pem

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
-----BEGIN PRIVATE KEY-----
2+
MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQg+Lig6wJYoVemIErz
3+
iZw/S4SjWR0TBtCO1hqIhyx1ynuhRANCAAT1rQWhTByuTn6+IhBt8slJt6tDZ8F4
4+
5Lp715tckOO8/+aTOHsSnzOMWY41QZwhNYL+ypkoVLCx2vG7tf1b4Ck4
5+
-----END PRIVATE KEY-----

‎src/handler.rs

+67
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
use crate::report::Report;
2+
use http::{Request, Response, StatusCode};
3+
use hyper::Body;
4+
use include_dir::{include_dir, Dir};
5+
use sailfish::TemplateOnce;
6+
use std::{convert::Infallible, path::Path, sync::Arc};
7+
8+
static STATIC_DIR: Dir<'_> = include_dir!("$CARGO_MANIFEST_DIR/static");
9+
10+
#[derive(TemplateOnce)]
11+
#[template(path = "index.stpl")]
12+
struct IndexTemplate {
13+
report: Arc<Report>,
14+
}
15+
16+
pub async fn handle_request(
17+
req: Request<Body>,
18+
report: Arc<Report>,
19+
) -> Result<Response<Body>, Infallible> {
20+
let path = req.uri().path();
21+
match path {
22+
"/" => {
23+
let ctx = IndexTemplate { report };
24+
return Ok(Response::builder()
25+
.header("Content-Type", "text/html")
26+
.body(Body::from(ctx.render_once().unwrap()))
27+
.unwrap());
28+
}
29+
"/index.json" => {
30+
return Ok(Response::builder()
31+
.header("Content-Type", "application/json")
32+
.body(Body::from(
33+
serde_json::to_string_pretty(report.as_ref()).unwrap(),
34+
))
35+
.unwrap())
36+
}
37+
_ => {}
38+
}
39+
40+
if let Some(file) = STATIC_DIR.get_file(path.trim_start_matches('/')) {
41+
return Ok(Response::builder()
42+
.header("Content-Type", path_to_mime(path))
43+
.body(Body::from(file.contents()))
44+
.unwrap());
45+
}
46+
47+
Ok(Response::builder()
48+
.status(StatusCode::NOT_FOUND)
49+
.body(Body::from("404"))
50+
.unwrap())
51+
}
52+
53+
fn path_to_mime(path: &str) -> &'static str {
54+
let ext = Path::new(path)
55+
.extension()
56+
.unwrap_or_default()
57+
.to_str()
58+
.unwrap_or_default();
59+
match ext {
60+
"css" => "text/css",
61+
"png" => "image/png",
62+
"svg" => "image/svg+xml",
63+
"ico" => "image/x-icon",
64+
"xml" | "webmanifest" => "application/xml",
65+
_ => "application/octet-stream",
66+
}
67+
}

‎src/ja3.rs

+75
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
use rustls::internal::msgs::handshake::{ClientExtension, ClientHelloPayload};
2+
use serde_derive::Serialize;
3+
4+
#[derive(Serialize)]
5+
pub struct Ja3 {
6+
pub md5: String,
7+
pub str: String,
8+
}
9+
10+
impl Ja3 {
11+
pub fn new(hello: &ClientHelloPayload, sort_ext: bool) -> Self {
12+
let version = hello.client_version.get_u16();
13+
let ciphers = hello
14+
.cipher_suites
15+
.iter()
16+
.map(|cipher| cipher.get_u16())
17+
.filter(is_not_grease)
18+
.map(|n| n.to_string())
19+
.collect::<Vec<_>>();
20+
let ciphers = ciphers.join("-");
21+
22+
let mut extensions = hello
23+
.extensions
24+
.iter()
25+
.map(|ext| ext.get_type().get_u16())
26+
.filter(is_not_grease)
27+
.map(|n| n.to_string())
28+
.collect::<Vec<_>>();
29+
30+
if sort_ext {
31+
extensions.sort();
32+
}
33+
34+
let extensions = extensions.join("-");
35+
36+
let curves = hello
37+
.extensions
38+
.iter()
39+
.filter_map(|ext| match ext {
40+
ClientExtension::NamedGroups(curves) => Some(curves),
41+
_ => None,
42+
})
43+
.flatten()
44+
.map(|curve| curve.get_u16())
45+
.filter(is_not_grease)
46+
.map(|n| n.to_string())
47+
.collect::<Vec<_>>();
48+
let curves = curves.join("-");
49+
50+
let points = hello
51+
.extensions
52+
.iter()
53+
.filter_map(|ext| match ext {
54+
ClientExtension::ECPointFormats(points) => Some(points),
55+
_ => None,
56+
})
57+
.flatten()
58+
.map(|points| points.get_u8())
59+
.map(|n| n.to_string())
60+
.collect::<Vec<_>>();
61+
let points = points.join("-");
62+
63+
let ja3 = format!("{version},{ciphers},{extensions},{curves},{points}");
64+
let md5 = md5::compute(&ja3);
65+
66+
Self {
67+
md5: format!("{md5:x}"),
68+
str: ja3,
69+
}
70+
}
71+
}
72+
73+
fn is_not_grease(v: &u16) -> bool {
74+
*v & 0x0f0f != 0x0a0a
75+
}

‎src/main.rs

+112
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,112 @@
1+
use anyhow::Result;
2+
use clap::Parser;
3+
use http::Request;
4+
use hyper::{server::conn::Http, service::service_fn, Body};
5+
use std::fs::File;
6+
use std::io::{self, BufReader};
7+
use std::net::SocketAddr;
8+
use std::path::{Path, PathBuf};
9+
use std::sync::Arc;
10+
use tokio::net::TcpListener;
11+
use tokio_rustls::rustls::{self, Certificate, PrivateKey};
12+
use tokio_rustls::TlsAcceptor;
13+
14+
mod handler;
15+
mod ja3;
16+
mod report;
17+
mod tls;
18+
19+
use handler::*;
20+
use report::*;
21+
use tls::*;
22+
23+
#[derive(Parser, Debug)]
24+
#[command(author, version, about, long_about = None)]
25+
struct Args {
26+
/// Socket address
27+
addr: SocketAddr,
28+
29+
/// Certificate chain file
30+
#[arg(long)]
31+
certs: PathBuf,
32+
33+
/// Private key file
34+
#[arg(long)]
35+
key: PathBuf,
36+
}
37+
38+
#[tokio::main]
39+
async fn main() -> Result<()> {
40+
let args = Args::parse();
41+
let certs = load_certs(&args.certs)?;
42+
let key = load_key(&args.key)?;
43+
44+
let mut config = rustls::ServerConfig::builder()
45+
.with_safe_defaults()
46+
.with_no_client_auth()
47+
.with_single_cert(certs, key)?;
48+
config.alpn_protocols = vec!["h2".as_bytes().to_vec(), "http/1.1".as_bytes().to_vec()];
49+
50+
let acceptor = TlsAcceptor::from(Arc::new(config));
51+
52+
println!("🐾 Listening on {}", args.addr);
53+
let listener = TcpListener::bind(&args.addr).await?;
54+
55+
loop {
56+
let (stream, _peer_addr) = listener.accept().await?;
57+
let acceptor = acceptor.clone();
58+
59+
let stream = TlsInspctor::new(stream);
60+
61+
let fut = async move {
62+
let stream = acceptor.accept(stream).await?;
63+
let ctx = Arc::new(Report::new(stream.get_ref().0.client_hello()));
64+
65+
tokio::task::spawn(async move {
66+
if let Err(http_err) = Http::new()
67+
.serve_connection(
68+
stream,
69+
service_fn(|req: Request<Body>| {
70+
let ctx = ctx.clone();
71+
async move { handle_request(req, ctx.clone()).await }
72+
}),
73+
)
74+
.await
75+
{
76+
eprintln!("Error while serving HTTP connection: {http_err}");
77+
}
78+
});
79+
80+
Ok(()) as io::Result<()>
81+
};
82+
83+
tokio::spawn(async move {
84+
if let Err(err) = fut.await {
85+
eprintln!("Error: {err:?}");
86+
}
87+
});
88+
}
89+
}
90+
91+
fn load_certs(path: &Path) -> io::Result<Vec<Certificate>> {
92+
let mut reader = BufReader::new(File::open(path)?);
93+
let certs = rustls_pemfile::certs(&mut reader)?;
94+
Ok(certs.into_iter().map(Certificate).collect())
95+
}
96+
97+
fn load_key(path: &Path) -> Result<PrivateKey> {
98+
use rustls_pemfile::Item;
99+
let keyfile = std::fs::File::open(path)?;
100+
let mut reader = BufReader::new(keyfile);
101+
102+
while let Some(key) = rustls_pemfile::read_one(&mut reader)? {
103+
match key {
104+
Item::RSAKey(key) | Item::PKCS8Key(key) | Item::ECKey(key) => {
105+
return Ok(PrivateKey(key))
106+
}
107+
_ => {}
108+
}
109+
}
110+
111+
Err(anyhow::anyhow!("key not found"))
112+
}

‎src/report.rs

+25
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
use rustls::internal::msgs::handshake::ClientHelloPayload;
2+
use serde_derive::Serialize;
3+
4+
use crate::ja3::Ja3;
5+
6+
#[derive(Serialize)]
7+
pub struct Report {
8+
pub tls: Option<TlsReport>,
9+
}
10+
11+
#[derive(Serialize)]
12+
pub struct TlsReport {
13+
pub ja3: Ja3,
14+
pub ja3_sort_ext: Ja3,
15+
}
16+
17+
impl Report {
18+
pub fn new(hello: Option<&ClientHelloPayload>) -> Self {
19+
let tls = hello.map(|hello| TlsReport {
20+
ja3: Ja3::new(hello, false),
21+
ja3_sort_ext: Ja3::new(hello, true),
22+
});
23+
Self { tls }
24+
}
25+
}

0 commit comments

Comments
 (0)