Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

SSL: do not try to disable failed analyzer

Browse source 
Currently, if a TLS/DTLS analyzer fails with a protocol violation, we
will still try to remove the analyzer later, which results in the
following error message:

error: connection does not have analyzer specified to disable

Now, instead we don't try removing the analyzer anymore, after a
violation occurred.
This commit is contained in:
Johanna Amann 2023-05-03 11:16:14 +01:00
parent cc25129b2f
commit 21888a145a
4 changed files with 15 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

9
scripts/base/protocols/ssl/main.zeek
View file

@ -499,6 +499,15 @@ event analyzer_confirmation_info(atype: AllAnalyzers::Tag, info: AnalyzerConfirm
}
}
event analyzer_violation_info(atype: AllAnalyzers::Tag, info: AnalyzerViolationInfo) &priority=5
{
if ( atype == Analyzer::ANALYZER_SSL || atype == Analyzer::ANALYZER_DTLS )
{
# analyzer errored out; prevent us from trying to remove it later
delete info$c$ssl$analyzer_id;
}
}
event ssl_plaintext_data(c: connection, is_client: bool, record_version: count, content_type: count, length: count) &priority=5
{
set_session(c);