From 7b86605ff13ab898e87d74ba17dab47f08a8045d Mon Sep 17 00:00:00 2001 From: lambwheit <38606611+lambwheit@users.noreply.github.com> Date: Thu, 13 Nov 2025 19:21:20 +1100 Subject: [PATCH] Fixed incorrect removal of padding extension https://github.com/FoxIO-LLC/ja4/blob/main/technical_details/JA4.md according to this only grease should be ignore and u can see in the extension hash example, they also include 0015 https://github.com/FoxIO-LLC/ja4/blob/main/technical_details/JA4.md#extension-hash --- pkg/tls/ja4.go | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkg/tls/ja4.go b/pkg/tls/ja4.go index 921495a..4092917 100644 --- a/pkg/tls/ja4.go +++ b/pkg/tls/ja4.go @@ -54,13 +54,13 @@ func ja4c_r(tls *types.TLSDetails) string { extensions := strings.Split(strings.Split(tls.JA3, ",")[2], "-") sigAlgs := strings.Split(strings.Split(tls.PeetPrint, "|")[3], "-") - // Convert extensions to hex, filter GREASE and padding, and sort + // Convert extensions to hex, filter GREASE, and sort parsedExt := []string{} for _, ext := range extensions { num, _ := strconv.Atoi(ext) hexStr := fmt.Sprintf("%04x", num) - // Skip if it's a GREASE value or padding extension - if types.IsGrease("0x"+strings.ToUpper(hexStr)) || hexStr == "0010" || hexStr == "0000" || hexStr == "0015" { + // Skip if it's a GREASE value + if types.IsGrease("0x"+strings.ToUpper(hexStr)) || hexStr == "0010" || hexStr == "0000" { continue } parsedExt = append(parsedExt, hexStr)