code_public/ja4-platform
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(ja4ebpf): correct HPACK static table per RFC 7541 and decode indexed representations

Browse Source 
The HPACK static table was completely wrong from index 15 onwards — entries
were shifted and missing, causing all header name lookups to return wrong
names (e.g. index 19 returned "cookie" instead of "accept"). Rewrite the
entire table as hpackStaticEntry{Name,Value} structs matching RFC 7541 Appendix
A (indices 1-61) plus browser extensions (62-100). Fix DecodeH2HeadersBlock to
properly decode fully-indexed representations (6.1) which were silently dropped
before — now both name and value are extracted from the static table entry.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
Jacquin Antoine
2026-04-15 15:24:04 +02:00
parent 0975d40609
commit fd84aebc44
2 changed files with 116 additions and 109 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
services/ja4ebpf/internal/parser/http2_test.go
View File

@ -157,12 +157,11 @@ func buildH2Frame(frameType, flags uint8, streamID uint32, payload []byte) []byt
}
func TestDecodeH2HeadersBlockLiteralWithIndexedName(t *testing.T) {
// Literal with incremental indexing, indexed name (user-agent = index 95)
// Prefix byte: 0x40 | 95 = 0x5F... wait, 95 > 63 so we need multi-byte
// For index 95: first byte = 0x40 | 0x3F = 0x7F, second byte = 95 - 63 = 32 = 0x20
// Literal with incremental indexing, indexed name (user-agent = index 61 in RFC 7541)
// Prefix byte: 0x40 | 61 = 0x7D
// Then value: 7-bit length "Mozilla/5.0" = 11 bytes, no Huffman
h2block := []byte{
0x7F, 0x20, // indexed name = 95 (user-agent), with incremental indexing
0x7D, // indexed name = 61 (user-agent), with incremental indexing
0x0B, 'M', 'o', 'z', 'i', 'l', 'l', 'a', '/', '5', '.', '0', // value length 11 + value
}
kv, order := parser.DecodeH2HeadersBlock(h2block)