mirror of
https://github.com/zeek/zeek.git
synced 2025-10-08 09:38:19 +00:00
More bugfixs, cleanup, and test for SSL analyzer
- SSL related files and classes renamed to remove the "binpac" term. - A small fix for DPD scripts to make the DPD log more helpful if there are multiple continued failures. Also, fixed the SSL analyzer to make it stop doing repeated violation messages for some handshake failures. - Added a $issuer_subject to the SSL log. - Created a basic test for SSL.
This commit is contained in:
parent
88807df269
commit
0a6104fe66
12 changed files with 68 additions and 96 deletions
36
src/SSL.h
Normal file
36
src/SSL.h
Normal file
|
@ -0,0 +1,36 @@
|
|||
#ifndef ssl_h
|
||||
#define ssl_h
|
||||
|
||||
#include "TCP.h"
|
||||
#include "ssl_pac.h"
|
||||
|
||||
class SSL_Analyzer : public TCP_ApplicationAnalyzer {
|
||||
public:
|
||||
SSL_Analyzer(Connection* conn);
|
||||
virtual ~SSL_Analyzer();
|
||||
|
||||
// Overriden from Analyzer.
|
||||
virtual void Done();
|
||||
virtual void DeliverStream(int len, const u_char* data, bool orig);
|
||||
virtual void Undelivered(int seq, int len, bool orig);
|
||||
|
||||
// Overriden from TCP_ApplicationAnalyzer.
|
||||
virtual void EndpointEOF(TCP_Reassembler* endp);
|
||||
|
||||
static Analyzer* InstantiateAnalyzer(Connection* conn)
|
||||
{ return new SSL_Analyzer(conn); }
|
||||
|
||||
static bool Available()
|
||||
{
|
||||
return ( ssl_client_hello || ssl_server_hello ||
|
||||
ssl_established || ssl_extension || ssl_alert ||
|
||||
x509_certificate || x509_extension || x509_error );
|
||||
}
|
||||
|
||||
protected:
|
||||
binpac::SSL::SSL_Conn* interp;
|
||||
bool had_gap;
|
||||
|
||||
};
|
||||
|
||||
#endif
|
Loading…
Add table
Add a link
Reference in a new issue