Merge pull request #6 from LeeBrotherston/use-cryptobyte-package

Use cryptobyte package

.github/workflows/codeql-analysis.yml

@@ -2,7 +2,6 @@ name: "CodeQL"
 
 on:
   push:
-    branches: [main]
   pull_request:
     # The branches below must be a subset of the branches above
     branches: [main]

.github/workflows/golangci-lint.yml

@@ -1,11 +1,6 @@
 name: golangci-lint
 on:
   push:
-    tags:
-      - v*
-    branches:
-      - master
-      - main
   pull_request:
 permissions:
   contents: read
@@ -18,7 +13,7 @@ jobs:
     steps:
       - uses: actions/setup-go@v3
         with:
-          go-version: '1.17'
+          go-version: '1.20'
       - uses: actions/checkout@v3
       - name: golangci-lint
         uses: golangci/golangci-lint-action@v3

LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2021 Lee Brotherston
+Copyright (c) 2023 Lee Brotherston
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

README.md

@@ -1,4 +1,5 @@
-# dactyloscopy
+# dactyloscopy 
+[![CodeQL](https://github.com/LeeBrotherston/dactyloscopy/actions/workflows/codeql-analysis.yml/badge.svg)](https://github.com/LeeBrotherston/dactyloscopy/actions/workflows/codeql-analysis.yml)[![golangci-lint](https://github.com/LeeBrotherston/dactyloscopy/actions/workflows/golangci-lint.yml/badge.svg)](https://github.com/LeeBrotherston/dactyloscopy/actions/workflows/golangci-lint.yml)[![DependencyReview](https://github.com/LeeBrotherston/dactyloscopy/actions/workflows/dependency-review.yml/badge.svg)](https://github.com/LeeBrotherston/dactyloscopy/actions/workflows/dependency-review.yml)
 
 GO package for performing TLS fingerprinting.
 

example/example.go

@@ -0,0 +1,71 @@
+/*
+
+Exciting Licence Info.....
+
+This file is part of fpReaper.
+
+# Lee's Shitheads Prohibited Licence (loosely based on the BSD simplified licence)
+Copyright 2021 Lee Brotherston
+Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+3. You are not a member of law enforcement, and you do not work for any government or private organization that conducts or aids surveillance (e.g., signals intelligence, Palantir).
+4. You are not associated with any groups which are aligned with Racist, Homophobic, Transphobic, TERF, Mysogynistic, "Pro Life" (anti-womens-choice), or other shithead values.
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+
+*/
+
+package main
+
+import (
+	"encoding/json"
+	"flag"
+	"fmt"
+
+	"github.com/LeeBrotherston/dactyloscopy"
+	"github.com/google/gopacket"
+	"github.com/google/gopacket/pcap"
+)
+
+func doSniff(device string) error {
+	// Open device
+	// the 0 and true refer to snaplen and promisc mode.  For now we always want these.
+	handle, err := pcap.OpenLive(device, 0, true, pcap.BlockForever)
+	if err != nil {
+		return err
+	}
+	// Yes yes, I know... But offsetting this to the kernel *drastically* reduces processing time
+	err = handle.SetBPFFilter("(tcp[tcp[12]/16*4]=22 and (tcp[tcp[12]/16*4+5]=1) and (tcp[tcp[12]/16*4+9]=3) and (tcp[tcp[12]/16*4+1]=3)) or (ip6[(ip6[52]/16*4)+40]=22 and (ip6[(ip6[52]/16*4+5)+40]=1) and (ip6[(ip6[52]/16*4+9)+40]=3) and (ip6[(ip6[52]/16*4+1)+40]=3)) or ((udp[14] = 6 and udp[16] = 32 and udp[17] = 1) and ((udp[(udp[60]/16*4)+48]=22) and (udp[(udp[60]/16*4)+53]=1) and (udp[(udp[60]/16*4)+57]=3) and (udp[(udp[60]/16*4)+49]=3))) or (proto 41 and ip[26] = 6 and ip[(ip[72]/16*4)+60]=22 and (ip[(ip[72]/16*4+5)+60]=1) and (ip[(ip[72]/16*4+9)+60]=3) and (ip[(ip[72]/16*4+1)+60]=3))")
+	if err != nil {
+		return err
+	}
+	defer handle.Close()
+
+	// Use the handle as a packet source to process all packets
+	packetSource := gopacket.NewPacketSource(handle, handle.LinkType())
+	for packet := range packetSource.Packets() {
+
+		var clientHello dactyloscopy.Fingerprint
+		payload := packet.ApplicationLayer()
+
+		err = clientHello.ProcessClientHello(payload.Payload())
+		if err != nil {
+			fmt.Printf("Error: %v\n", err)
+		}
+
+		output, err := json.Marshal(clientHello)
+		if err != nil {
+			return err
+		}
+		fmt.Printf("%s\n", output)
+	}
+	return nil
+}
+
+func main() {
+	intStr := flag.String("i", "en0", "interface to sniff")
+	flag.Parse()
+
+	doSniff(*intStr)
+}

example/go.mod

@@ -0,0 +1,15 @@
+module example
+
+go 1.18
+
+replace github.com/LeeBrotherston/dactyloscopy => ./../
+
+require (
+	github.com/LeeBrotherston/dactyloscopy v0.0.0-20211004030734-27f81f4ef3d5
+	github.com/google/gopacket v1.1.19
+)
+
+require (
+	golang.org/x/crypto v0.6.0 // indirect
+	golang.org/x/sys v0.6.0 // indirect
+)

example/go.sum

@@ -0,0 +1,21 @@
+github.com/google/gopacket v1.1.19 h1:ves8RnFZPGiFnTS0uPQStjwru6uO6h+nlr9j6fL7kF8=
+github.com/google/gopacket v1.1.19/go.mod h1:iJ8V8n6KS+z2U1A8pUwu8bW5SyEMkXJB8Yo/Vo+TKTo=
+golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
+golang.org/x/crypto v0.6.0 h1:qfktjS5LUO+fFKeJXZ+ikTRijMmljikvG68fpMMruSc=
+golang.org/x/crypto v0.6.0/go.mod h1:OFC/31mSvZgRz0V1QTNCzfAI1aIRzbiufJtkMIlEp58=
+golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
+golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
+golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.6.0 h1:L4ZwwTvKW9gr0ZMS1yrHD9GZhIuVjOBBnaKH+SPQK0Q=
+golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.5.0 h1:MUK/U/4lj1t1oPg0HfuXDN/Z1wv31ZJ/YcPiGccS4DU=
+golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.6.0 h1:MVltZSvRTcU2ljQOhs94SXPftV6DCNnZViHeQps87pQ=
+golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/tools v0.0.0-20200130002326-2f3ba24bd6e7/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
+golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=

go.mod

@@ -1,5 +1,5 @@
 module github.com/LeeBrotherston/dactyloscopy
 
-go 1.16
+go 1.18
 
-require github.com/spaolacci/murmur3 v1.1.0
+require golang.org/x/crypto v0.6.0

go.sum

@@ -1,2 +1,2 @@
-github.com/spaolacci/murmur3 v1.1.0 h1:7c1g84S4BPRrfL5Xrdp6fOJ206sU9y293DDHaoy0bLI=
-github.com/spaolacci/murmur3 v1.1.0/go.mod h1:JwIasOWyU6f++ZhiEuf87xNszmSA2myDM2Kzu9HwQUA=
+golang.org/x/crypto v0.6.0 h1:qfktjS5LUO+fFKeJXZ+ikTRijMmljikvG68fpMMruSc=
+golang.org/x/crypto v0.6.0/go.mod h1:OFC/31mSvZgRz0V1QTNCzfAI1aIRzbiufJtkMIlEp58=