From 76a7326cd55099ac9491cf25c4c87e01464a1838 Mon Sep 17 00:00:00 2001 From: ajin Date: Thu, 23 Nov 2023 01:57:03 +0800 Subject: [PATCH] patch lower tshark version oid (#28) * Fix object-id error * fix low tshark version use oid tshark 3.2.3 use x509if_x509if_id --- python/ja4.py | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/python/ja4.py b/python/ja4.py index 2a0fd5e..68a96ae 100644 --- a/python/ja4.py +++ b/python/ja4.py @@ -373,7 +373,10 @@ def layer_update(x, pkt, layer): if layer == 'x509af' and l: [ x.update({key: l[f'tls_tls_{item}']}) for key, item in keymap['tls'].items() if f'tls_tls_{item}' in l ] x.update({'issuer_sequence': l['x509if_x509if_rdnSequence']}) if 'x509if_x509if_rdnSequence' in l else None - x.update({'rdn_oids': l['x509if_x509if_oid']}) if 'x509if_x509if_oid' in l else None + if 'x509if_x509if_id' in l: + x.update({'rdn_oids':l['x509if_x509if_id']}) + if 'x509if_x509if_oid' in l: + x.update({'rdn_oids':l['x509if_x509if_oid']}) x.update({'printable_certs': l['x509sat_x509sat_printableString']}) if 'x509sat_x509sat_printableString' in l else None # Some extension types are a list bug #29