Ja4 for QUIC protocol

[liboabo]

Main changes

1. Removed openssl.patch, as SSL_client_hello_get1_extensions_present works correctly. Tested on all modern OpenSSL versions (3.0, 3.1, 3.2, 3.3, 3.4, 3.5, 3.6, master).
2. The function ngx_SSL_client_features has been removed from nginx.patch. All calculations for cipher suites and signature algorithms have now been moved to the file src/ngx_http_ssl_ja4_module.c.
3. Documentation still needs to be updated and docker directories need to be fixed.
4. Perhaps the version of the ja4-nginx-module module should be changed.
5. The integration-test.yaml file and tests need to be updated.

How to build and test

Building curl with quic protocol support

git clone https://github.com/openssl/openssl.git
cd openssl
git checkout -b 3.5 origin/openssl-3.5
./Configure no-shared --prefix=$HOME/.local --debug
make
make install_sw

cd ..
sudo apt install pkg-config libpsl-dev libnghttp2-dev libnghttp3-dev

git clone https://github.com/curl/curl.git
cd curl
git checkout -b v8.11-dev f2adb3b6d7
CPPFLAGS="-I$HOME/.local/include" LDFLAGS="-L$HOME/.local/lib64" \
    ./configure --prefix=$HOME/.local --disable-shared --with-nghttp2 --with-nghttp3 --with-openssl-quic --with-openssl
make 
make install

export PATH=${HOME}/.local/bin:${PATH} 
which curl
/home/user/.local/bin/curl
curl --version
curl 8.11.2-DEV (x86_64-pc-linux-gnu) libcurl/8.11.2-DEV OpenSSL/3.5.5 zlib/1.3 libidn2/2.3.7 libpsl/0.21.2 nghttp2/1.59.0 nghttp3/0.8.0

Build angie with ja4-nginx-module

git clone https://github.com/webserver-llc/angie.git
git clone https://github.com/FoxIO-LLC/ja4-nginx-module.git

cd angie
git checkout -b v1.10.2  origin/v1.10.2

./configure \
--with-debug \
--with-cc-opt='-O0 -g' \
--with-http_ssl_module \
--with-http_v2_module \
--with-http_v3_module \
--with-cc-opt=-I$HOME/.local/include \
--with-ld-opt=-L$HOME/.local/lib64 \
--prefix=$(pwd) \
--add-module=../ja4-nginx-module/src

make -j

mkdir logs
cd ..

Create config file for test and run angie

cat <<E > nginx.conf
> daemon off;

events {}

http {
    
    error_log logs/error-server.log debug;

    server {
        listen 8443 ssl;
        listen 8443 quic;
        http2 on;
        http3 on;
        server_name localhost;
        ssl_certificate server.crt;
        ssl_certificate_key server.key;
        location / {
            add_header Content-Type text/plain;
            return 200 "JA4: $http_ssl_ja4";
        }
    }
}
E

./angie/objs/angie -c `pwd`/nginx.conf ; echo

Create self-signed certificates

openssl req -x509 -subj "/C=RU/ST=Moscow/L=Moscow/O=WB/CN=localhost" -nodes -days 730 -newkey rsa:2048 -keyout server.key -out server.crt

Run tests

for i in "--http2" "--http3"; do curl --interface 127.0.4.7 --cacert `pwd`/server.crt $i https://localhost:8443/ ; echo ; done

JA4: t13d3012h2_1d37bd780c83_882d495ac381
JA4: q13d0311h3_55b375c5d22e_8ca2970c38c4

Build docker image

cd ja4-nginx-module
docker build --tag ja4-nginx:quic

Good luck!

[vlvkobal]

Hi @liboabo , could you please enable “Allow edits by maintainers” on this PR? I’d like to fix the build issues.

[liboabo]

Hi @liboabo , could you please enable “Allow edits by maintainers” on this PR? I’d like to fix the build issues.

Hey @vlvkobal, I tried, but it was no use. It might have something to do with my organization's policies. I'll check soon.