tls_inspector: fix GREASE filtering in JA4_c signature algorithms

[dangle1]

Summary

The JA4 fingerprint's third component hashes the ClientHello's extension list joined to its signature_algorithms list. Per the JA4 spec, GREASE codepoints must be excluded everywhere they appear — including in signature_algorithms.

getJA4ExtensionHash already applies isNotGrease to extension type IDs, and getJA4CipherHash, countCiphers, and countExtensions apply it to their respective inputs. The signature_algorithms collection loop was the sole exception, pushing every 16-bit codepoint from the extension body unconditionally.

Clients that inject a GREASE value into signature_algorithms (e.g. Chrome's per-handshake random GREASE selection, drawn from the 16 reserved code points 0x0a0a, 0x1a1a, …, 0xfafa) therefore produce a different JA4_c hash per connection while all other parts of the fingerprint are identical — resulting in many-to-one hash collapse when compared against spec-compliant implementations.

Fix

Guard the sig_algs.push_back(sig_alg) call in getJA4ExtensionHash with isNotGrease(sig_alg), matching the treatment already applied everywhere else in the file.

Test plan

• Added TEST(JA4Fingerprinter, GreaseValueFilteredFromSignatureAlgorithms) in ja4_fingerprint_test.cc that constructs two `SSL_CLIENT_HELLO`s identical except for a GREASE codepoint (`0x0a0a`) in `signature_algorithms` and asserts `JA4Fingerprinter::create` produces the same fingerprint for both.
• `bazel test //test/extensions/filters/listener/tls_inspector:ja4_fingerprint_test` passes locally.

Notes

• No existing entry in the `JA4_TEST_VECTORS` table in `tls_inspector_ja4_test.cc` contains a GREASE codepoint inside its `signature_algorithms` extension body — all GREASE bytes in those captures live in extensions/versions/keyshare slots, which are already filtered correctly — so its pinned expected hashes remain valid.
• This change was drafted with AI assistance and reviewed by the author.

[repokitteh-read-only]

Hi @dangle1, welcome and thank you for your contribution.

We will try to review your Pull Request as quickly as possible.

In the meantime, please take a look at the contribution guidelines if you have not done so already.

🐱

Caused by: #46658 was opened by dangle1.

see: more, trace.