Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Address PR feedback

Browse source 
This addresses feedback to GH-1814. The most significant change is the
fact that the ChipertextRecord now can remain &transient - which might
lead to improved speed.
This commit is contained in:
Johanna Amann 2022-02-23 11:31:21 +00:00
parent b78f30339f
commit 1c9ea09d9f
5 changed files with 24 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

16
scripts/policy/protocols/ssl/decryption.zeek
View file

@ -1,9 +1,9 @@
##! This script allows for the decryption of certain TLS 1.2 connection, if the user is in possession ##! This script allows for the decryption of certain TLS 1.2 connections, if the user is in possession
##! of the private key material for the session. Key material can either be provided via a file (useful ##! of the private key material for the session. Key material can either be provided via a file (useful
##! for processing trace files) or via sending events via broker (for live decoding). ##! for processing trace files) or via sending events via Broker (for live decoding).
##! ##!
##! Please note that this feature is experimental and can change without guarantees to our typical ##! Please note that this feature is experimental and can change without guarantees to our typical
##! deprecation tieline. Please also note that currently only TLS 1.2 connections that use the ##! deprecation timeline. Please also note that currently only TLS 1.2 connections that use the
##! TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 cipher suite are supported. ##! TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 cipher suite are supported.
@load base/frameworks/input @load base/frameworks/input
@ -26,19 +26,19 @@ export {
## Secrets expire after this time of not being used. ## Secrets expire after this time of not being used.
const secret_expiration = 5 mins &redef; const secret_expiration = 5 mins &redef;
## This event can be triggered, e.g., via broker to add known keys to the TLS key database. ## This event can be triggered, e.g., via Broker to add known keys to the TLS key database.
## ##
## client_random: client random for which the key is set ## client_random: client random for which the key is set
## ##
## keys: key material ## keys: key material
global add_keys: event(client_random: string, keys: string); global add_keys: event(client_random: string, keys: string);
## This event can be triggered, e.g., via broker to add known secrets to the TLS secret datbase. ## This event can be triggered, e.g., via Broker to add known secrets to the TLS secret datbase.
## ##
## client_random: client random for which the secret is set ## client_random: client random for which the secret is set
## ##
## secrets: derived TLS secrets material ## secrets: derived TLS secrets material
global add_secret: event(client_random: string, secret: string); global add_secret: event(client_random: string, secrets: string);
} }
@if ( keylog_file == "" ) @if ( keylog_file == "" )
@ -47,8 +47,8 @@ export {
global secrets: table[string] of string = {} &redef; global secrets: table[string] of string = {} &redef;
global keys: table[string] of string = {} &redef; global keys: table[string] of string = {} &redef;
@else @else
#global secrets: table[string] of string = {} &read_expire=secret_expiration &redef; global secrets: table[string] of string = {} &read_expire=secret_expiration &redef;
#global keys: table[string] of string = {} &read_expire=secret_expiration &redef; global keys: table[string] of string = {} &read_expire=secret_expiration &redef;
@endif @endif

15
src/analyzer/protocol/ssl/SSL.cc
View file

@ -23,8 +23,15 @@
namespace zeek::analyzer::ssl namespace zeek::analyzer::ssl
{ {
#define MSB(a) ((a >> 8) & 0xff) template <typename T> static inline T MSB(const T a)
#define LSB(a) (a & 0xff) {
return ((a >> 8) & 0xff);
}
template <typename T> static inline T LSB(const T a)
{
return (a & 0xff);
}
static std::basic_string<unsigned char> fmt_seq(uint32_t num) static std::basic_string<unsigned char> fmt_seq(uint32_t num)
{ {
@ -147,7 +154,7 @@ void SSL_Analyzer::SetKeys(const zeek::StringVal& nkeys)
void SSL_Analyzer::SetKeys(const std::vector<u_char> newkeys) void SSL_Analyzer::SetKeys(const std::vector<u_char> newkeys)
{ {
keys = newkeys; keys = std::move(newkeys);
} }
std::optional<std::vector<u_char>> std::optional<std::vector<u_char>>
@ -396,7 +403,7 @@ void SSL_Analyzer::ForwardDecryptedData(const std::vector<u_char>& data, bool is
pia->FirstPacket(false, nullptr); pia->FirstPacket(false, nullptr);
} }
else else
reporter->FatalError("Could not initialize PIA"); reporter->Error("Could not initialize PIA");
} }
ForwardStream(data.size(), data.data(), is_orig); ForwardStream(data.size(), data.data(), is_orig);

4
src/analyzer/protocol/ssl/SSL.h
View file

@ -25,7 +25,7 @@ namespace zeek::analyzer::ssl
class SSL_Analyzer final : public analyzer::tcp::TCP_ApplicationAnalyzer class SSL_Analyzer final : public analyzer::tcp::TCP_ApplicationAnalyzer
{ {
// let binpac forward encryppted TLS application data to us. // let binpac forward encrypted TLS application data to us.
friend class binpac::SSL::SSL_Conn; friend class binpac::SSL::SSL_Conn;
public: public:
@ -54,7 +54,7 @@ public:
* connection. (For TLS 1.2 this is the pre-master secret) * connection. (For TLS 1.2 this is the pre-master secret)
* *
* Please note that these functions currently are hardcoded to only work with a single TLS 1.2 * Please note that these functions currently are hardcoded to only work with a single TLS 1.2
* cuphersuite (TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384). * ciphersuite (TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384).
* *
* @param secret The secret to set * @param secret The secret to set
*/ */

4
src/analyzer/protocol/ssl/ssl-dtls-analyzer.pac
View file

@ -45,7 +45,7 @@ refine connection SSL_Conn += {
return true; return true;
%} %}
function proc_ciphertext_record(rec : SSLRecord, cont: bytestring) : bool function proc_ciphertext_record(rec : SSLRecord, cont: const_bytestring) : bool
%{ %{
if ( established_ == false && determine_tls13() == 1 ) if ( established_ == false && determine_tls13() == 1 )
{ {
@ -72,7 +72,7 @@ refine connection SSL_Conn += {
if ( rec->content_type() == APPLICATION_DATA && decryption_failed_ == false ) if ( rec->content_type() == APPLICATION_DATA && decryption_failed_ == false )
{ {
// If decryption of one packet fails, do not try to decrypt future packets. // If decryption of one packet fails, do not try to decrypt future packets.
if ( ! zeek_analyzer()->TryDecryptApplicationData(cont.length(), cont.data(), rec->is_orig(), rec->content_type(), rec->raw_tls_version()) ) if ( ! zeek_analyzer()->TryDecryptApplicationData(cont.length(), cont.begin(), rec->is_orig(), rec->content_type(), rec->raw_tls_version()) )
decryption_failed_ = true; decryption_failed_ = true;
} }

2
src/analyzer/protocol/ssl/ssl-dtls-protocol.pac
View file

@ -96,7 +96,7 @@ type UnknownRecord(rec: SSLRecord) = record {
}; };
type CiphertextRecord(rec: SSLRecord) = record { type CiphertextRecord(rec: SSLRecord) = record {
cont : bytestring &restofdata; cont : bytestring &restofdata &transient;
}; };
###################################################################### ######################################################################