mirror of
https://github.com/zeek/zeek.git
synced 2025-10-08 09:38:19 +00:00
Updates and fixes for the SSL analyzer.
- Fixed a pretty major eternal looping bug in the SSL analyzer and a few other parsing problems. - New core scripts and log for SSL connection analysis. - New known-certs script for logging certificate assets.
This commit is contained in:
Seth Hall
parent
dddfc1009a
commit
24d570a94c
17 changed files with 1019 additions and 1017 deletions
|
|
@ -8,7 +8,7 @@
|
|||
@load mime
|
||||
@load smtp
|
||||
@load ssh
|
||||
#@load ssl
|
||||
@load ssl
|
||||
@load syslog
|
||||
|
||||
#@load communication
|
||||
|
|
|
|||
|
|
@ -1,2 +1,4 @@
|
|||
#@load ssl/base
|
||||
#@load ssl/validate
|
||||
@load ssl/consts
|
||||
@load ssl/base
|
||||
@load ssl/mozilla-ca-list
|
||||
@load ssl/known-certs
|
||||
|
|
@ -1,45 +1,47 @@
|
|||
|
||||
@load notice
|
||||
|
||||
module SSL;
|
||||
|
||||
export {
|
||||
redef enum Log::ID += { SSL };
|
||||
|
||||
## This is the root CA bundle. By default it is Mozilla's full trusted
|
||||
redef enum Notice::Type += {
|
||||
Invalid_Server_Cert,
|
||||
Self_Signed_Cert
|
||||
};
|
||||
|
||||
type Info: record {
|
||||
ts: time &log;
|
||||
uid: string &log;
|
||||
id: conn_id &log;
|
||||
version: string &log &optional;
|
||||
cipher: string &log &optional;
|
||||
validation_status:string &log &optional;
|
||||
server_name: string &log &optional;
|
||||
server_subject: string &log &optional;
|
||||
not_valid_before: time &log &optional;
|
||||
not_valid_after: time &log &optional;
|
||||
|
||||
cert: string &optional;
|
||||
cert_chain: vector of string &optional;
|
||||
};
|
||||
|
||||
## This is where the default root CA bundle is defined. By loading the
|
||||
## protocols/ssl/mozilla-ca-list.bro script it will be set to Mozilla's
|
||||
## root CA list.
|
||||
# TODO: move the mozilla_root_certs setting into the mozilla file.
|
||||
#print mozilla_root_certs;
|
||||
const root_certs: table[string] of string = {} &redef;
|
||||
#const root_certs: table[string] of string = {} &redef;
|
||||
|
||||
|
||||
## This is where you can define root certificates that you want to validate
|
||||
## against servers. For example, you may have a policy that states that
|
||||
## all local certificates must be signed by a specific signing authority.
|
||||
## If you specify your local networks with only the specific authority
|
||||
## or authorities your policy stipulates here, certificates signed by any
|
||||
## other key will not validate. By default, all servers are validated
|
||||
## against the full ``root_certs`` bundle.
|
||||
#const server_validation: table[subnet] of table[string] of string =
|
||||
# { [0.0.0.0/0] = root_certs } &redef;
|
||||
|
||||
## This is where you can define root certificates that you want to validate
|
||||
## against clients. This is still doing validation against the server
|
||||
## certificate chain, but this allows you to define a restricted
|
||||
## list of signing certificate that clients should be seen connecting to.
|
||||
## For example, you may have a tightly controlled network
|
||||
## that you **never** want to establish SSL sessions using anything other
|
||||
## than certificates signed by a very select list of certificate
|
||||
## authorities. You can define the networks in this variable along with
|
||||
## key signing certificates with which they should be allowed to establish
|
||||
## SSL connections. By default, all client connections are validated
|
||||
## against the full ``root_certs`` bundle.
|
||||
#const client_validation: table[subnet] of table[string] of string =
|
||||
# { [0.0.0.0/0] = root_certs } &redef;
|
||||
global log_ssl: event(rec: Info);
|
||||
}
|
||||
|
||||
# TODO: add the script for this and generate on one to ship.
|
||||
#@load mozilla-root-certs
|
||||
redef record connection += {
|
||||
ssl: Info &optional;
|
||||
};
|
||||
|
||||
event bro_init()
|
||||
{
|
||||
Log::create_stream(SSL, [$columns=Info, $ev=log_ssl]);
|
||||
}
|
||||
|
||||
redef capture_filters += {
|
||||
["ssl"] = "tcp port 443",
|
||||
|
|
@ -57,18 +59,93 @@ redef capture_filters += {
|
|||
|
||||
global ssl_ports = {
|
||||
443/tcp, 563/tcp, 585/tcp, 614/tcp, 636/tcp,
|
||||
989/tcp, 990/tcp, 992/tcp, 993/tcp, 995/tcp,
|
||||
989/tcp, 990/tcp, 992/tcp, 993/tcp, 995/tcp, 5223/tcp
|
||||
} &redef;
|
||||
|
||||
redef dpd_config += {
|
||||
[[ANALYZER_SSL]] = [$ports = ssl_ports]
|
||||
};
|
||||
|
||||
function set_session(c: connection)
|
||||
{
|
||||
if ( ! c?$ssl )
|
||||
c$ssl = [$ts=network_time(), $uid=c$uid, $id=c$id, $cert_chain=vector()];
|
||||
}
|
||||
|
||||
event ssl_client_hello(c: connection, version: count, possible_ts: time, session_id: string, ciphers: count_set) &priority=5
|
||||
{
|
||||
set_session(c);
|
||||
}
|
||||
|
||||
event ssl_server_hello(c: connection, version: count, possible_ts: time, session_id: string, cipher: count, comp_method: count) &priority=5
|
||||
{
|
||||
set_session(c);
|
||||
|
||||
c$ssl$version = version_strings[version];
|
||||
c$ssl$cipher = cipher_desc[cipher];
|
||||
}
|
||||
|
||||
event x509_certificate(c: connection, cert: X509, is_server: bool, chain_idx: count, chain_len: count, der_cert: string) &priority=5
|
||||
{
|
||||
set_session(c);
|
||||
|
||||
if ( chain_idx == 0 )
|
||||
{
|
||||
# Save the primary cert.
|
||||
c$ssl$cert = der_cert;
|
||||
|
||||
# Also save other certificate information about the primary cert.
|
||||
c$ssl$server_subject = cert$subject;
|
||||
c$ssl$not_valid_before = cert$not_valid_before;
|
||||
c$ssl$not_valid_after = cert$not_valid_after;
|
||||
}
|
||||
else
|
||||
{
|
||||
# Otherwise, add it to the cert validation chain.
|
||||
c$ssl$cert_chain[|c$ssl$cert_chain|] = der_cert;
|
||||
}
|
||||
}
|
||||
|
||||
event ssl_extension(c: connection, code: count, val: string)
|
||||
{
|
||||
set_session(c);
|
||||
|
||||
if ( extensions[code] == "server_name" )
|
||||
c$ssl$server_name = sub_bytes(val, 6, |val|);
|
||||
}
|
||||
|
||||
event ssl_alert(c: connection, level: count, desc: count)
|
||||
{
|
||||
#print level;
|
||||
#print desc;
|
||||
}
|
||||
|
||||
event x509_error(c: connection, err: count)
|
||||
{
|
||||
print err;
|
||||
}
|
||||
|
||||
|
||||
event x509_certificate(c: connection, cert: X509, is_server: bool, chain_idx: count, chain_len: count, der_cert: string) &priority=-5
|
||||
{
|
||||
if ( chain_idx == chain_len-1 || chain_len == 1 )
|
||||
{
|
||||
local result = x509_verify(c$ssl$cert, c$ssl$cert_chain, root_certs);
|
||||
#print fmt("verifying cert... %s", x509_err2str(result));
|
||||
|
||||
c$ssl$validation_status = x509_err2str(result);
|
||||
if ( result != 0 )
|
||||
{
|
||||
#print c$ssl;
|
||||
NOTICE([$note=Invalid_Server_Cert, $msg="validation failed", $conn=c]);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
event ssl_established(c: connection) &priority=-5
|
||||
{
|
||||
set_session(c);
|
||||
|
||||
Log::write(SSL, c$ssl);
|
||||
}
|
||||
|
||||
#redef SSL::client_validation += table(
|
||||
# [128.146.0.0/16] = table(
|
||||
# ["LOCAL_DER_CERT"] = "ADFADFWEAFASDFASDFA",
|
||||
# ["LOCAL_DER_CERT2"] = "ADFADFWEAFASDFASDFA" )
|
||||
# #["DER_CERT_1"] = SSL::root_certs["DER_CERT_1"],
|
||||
# #["LOCAL_DER_CERT"] = "ADFADFWEAFASDFASDFA"},
|
||||
#);
|
||||
|
|
|
|||
532
policy/protocols/ssl/consts.bro
Normal file
532
policy/protocols/ssl/consts.bro
Normal file
|
|
@ -0,0 +1,532 @@
|
|||
module SSL;
|
||||
|
||||
export {
|
||||
|
||||
const SSLv2 = 0x0002;
|
||||
const SSLv3 = 0x0300;
|
||||
const TLSv10 = 0x0301;
|
||||
const TLSv11 = 0x0302;
|
||||
const version_strings: table[count] of string = {
|
||||
[SSLv2] = "SSLv2",
|
||||
[SSLv3] = "SSLv3",
|
||||
[TLSv10] = "TLSv10",
|
||||
[TLSv11] = "TLSv11",
|
||||
} &default="UNKNOWN";
|
||||
|
||||
# http://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xml
|
||||
const extensions: table[count] of string = {
|
||||
[0] = "server_name",
|
||||
[1] = "max_fragment_length",
|
||||
[2] = "client_certificate_url",
|
||||
[3] = "trusted_ca_keys",
|
||||
[4] = "truncated_hmac",
|
||||
[5] = "status_request",
|
||||
[6] = "user_mapping",
|
||||
[7] = "client_authz",
|
||||
[8] = "server_authz",
|
||||
[9] = "cert_type",
|
||||
[10] = "elliptic_curves",
|
||||
[11] = "ec_point_formats",
|
||||
[12] = "srp",
|
||||
[13] = "signature_algorithms",
|
||||
[14] = "use_srtp",
|
||||
[35] = "SessionTicket TLS",
|
||||
[65281] = "renegotiation_info"
|
||||
} &default=function(i: count):string { return fmt("unknown-%d", i); };
|
||||
|
||||
## SSLv2
|
||||
const SSLv20_CK_RC4_128_WITH_MD5 = 0x010080;
|
||||
const SSLv20_CK_RC4_128_EXPORT40_WITH_MD5 = 0x020080;
|
||||
const SSLv20_CK_RC2_128_CBC_WITH_MD5 = 0x030080;
|
||||
const SSLv20_CK_RC2_128_CBC_EXPORT40_WITH_MD5 = 0x040080;
|
||||
const SSLv20_CK_IDEA_128_CBC_WITH_MD5 = 0x050080;
|
||||
const SSLv20_CK_DES_64_CBC_WITH_MD5 = 0x060040;
|
||||
const SSLv20_CK_DES_192_EDE3_CBC_WITH_MD5 = 0x0700C0;
|
||||
|
||||
## TLS
|
||||
const TLS_NULL_WITH_NULL_NULL = 0x0000;
|
||||
const TLS_RSA_WITH_NULL_MD5 = 0x0001;
|
||||
const TLS_RSA_WITH_NULL_SHA = 0x0002;
|
||||
const TLS_RSA_EXPORT_WITH_RC4_40_MD5 = 0x0003;
|
||||
const TLS_RSA_WITH_RC4_128_MD5 = 0x0004;
|
||||
const TLS_RSA_WITH_RC4_128_SHA = 0x0005;
|
||||
const TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5 = 0x0006;
|
||||
const TLS_RSA_WITH_IDEA_CBC_SHA = 0x0007;
|
||||
const TLS_RSA_EXPORT_WITH_DES40_CBC_SHA = 0x0008;
|
||||
const TLS_RSA_WITH_DES_CBC_SHA = 0x0009;
|
||||
const TLS_RSA_WITH_3DES_EDE_CBC_SHA = 0x000A;
|
||||
const TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA = 0x000B;
|
||||
const TLS_DH_DSS_WITH_DES_CBC_SHA = 0x000C;
|
||||
const TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA = 0x000D;
|
||||
const TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA = 0x000E;
|
||||
const TLS_DH_RSA_WITH_DES_CBC_SHA = 0x000F;
|
||||
const TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA = 0x0010;
|
||||
const TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA = 0x0011;
|
||||
const TLS_DHE_DSS_WITH_DES_CBC_SHA = 0x0012;
|
||||
const TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA = 0x0013;
|
||||
const TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA = 0x0014;
|
||||
const TLS_DHE_RSA_WITH_DES_CBC_SHA = 0x0015;
|
||||
const TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA = 0x0016;
|
||||
const TLS_DH_ANON_EXPORT_WITH_RC4_40_MD5 = 0x0017;
|
||||
const TLS_DH_ANON_WITH_RC4_128_MD5 = 0x0018;
|
||||
const TLS_DH_ANON_EXPORT_WITH_DES40_CBC_SHA = 0x0019;
|
||||
const TLS_DH_ANON_WITH_DES_CBC_SHA = 0x001A;
|
||||
const TLS_DH_ANON_WITH_3DES_EDE_CBC_SHA = 0x001B;
|
||||
const SSL_FORTEZZA_KEA_WITH_NULL_SHA = 0x001C;
|
||||
const SSL_FORTEZZA_KEA_WITH_FORTEZZA_CBC_SHA = 0x001D;
|
||||
const TLS_KRB5_WITH_DES_CBC_SHA = 0x001E;
|
||||
const TLS_KRB5_WITH_3DES_EDE_CBC_SHA = 0x001F;
|
||||
const TLS_KRB5_WITH_RC4_128_SHA = 0x0020;
|
||||
const TLS_KRB5_WITH_IDEA_CBC_SHA = 0x0021;
|
||||
const TLS_KRB5_WITH_DES_CBC_MD5 = 0x0022;
|
||||
const TLS_KRB5_WITH_3DES_EDE_CBC_MD5 = 0x0023;
|
||||
const TLS_KRB5_WITH_RC4_128_MD5 = 0x0024;
|
||||
const TLS_KRB5_WITH_IDEA_CBC_MD5 = 0x0025;
|
||||
const TLS_KRB5_EXPORT_WITH_DES_CBC_40_SHA = 0x0026;
|
||||
const TLS_KRB5_EXPORT_WITH_RC2_CBC_40_SHA = 0x0027;
|
||||
const TLS_KRB5_EXPORT_WITH_RC4_40_SHA = 0x0028;
|
||||
const TLS_KRB5_EXPORT_WITH_DES_CBC_40_MD5 = 0x0029;
|
||||
const TLS_KRB5_EXPORT_WITH_RC2_CBC_40_MD5 = 0x002A;
|
||||
const TLS_KRB5_EXPORT_WITH_RC4_40_MD5 = 0x002B;
|
||||
const TLS_RSA_WITH_AES_128_CBC_SHA = 0x002F;
|
||||
const TLS_DH_DSS_WITH_AES_128_CBC_SHA = 0x0030;
|
||||
const TLS_DH_RSA_WITH_AES_128_CBC_SHA = 0x0031;
|
||||
const TLS_DHE_DSS_WITH_AES_128_CBC_SHA = 0x0032;
|
||||
const TLS_DHE_RSA_WITH_AES_128_CBC_SHA = 0x0033;
|
||||
const TLS_DH_ANON_WITH_AES_128_CBC_SHA = 0x0034;
|
||||
const TLS_RSA_WITH_AES_256_CBC_SHA = 0x0035;
|
||||
const TLS_DH_DSS_WITH_AES_256_CBC_SHA = 0x0036;
|
||||
const TLS_DH_RSA_WITH_AES_256_CBC_SHA = 0x0037;
|
||||
const TLS_DHE_DSS_WITH_AES_256_CBC_SHA = 0x0038;
|
||||
const TLS_DHE_RSA_WITH_AES_256_CBC_SHA = 0x0039;
|
||||
const TLS_DH_ANON_WITH_AES_256_CBC_SHA = 0x003A;
|
||||
const TLS_RSA_WITH_NULL_SHA256 = 0x003B;
|
||||
const TLS_RSA_WITH_AES_128_CBC_SHA256 = 0x003C;
|
||||
const TLS_RSA_WITH_AES_256_CBC_SHA256 = 0x003D;
|
||||
const TLS_DH_DSS_WITH_AES_128_CBC_SHA256 = 0x003E;
|
||||
const TLS_DH_RSA_WITH_AES_128_CBC_SHA256 = 0x003F;
|
||||
const TLS_DHE_DSS_WITH_AES_128_CBC_SHA256 = 0x0040;
|
||||
const TLS_RSA_WITH_CAMELLIA_128_CBC_SHA = 0x0041;
|
||||
const TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA = 0x0042;
|
||||
const TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA = 0x0043;
|
||||
const TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA = 0x0044;
|
||||
const TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA = 0x0045;
|
||||
const TLS_DH_ANON_WITH_CAMELLIA_128_CBC_SHA = 0x0046;
|
||||
const TLS_RSA_EXPORT1024_WITH_RC4_56_MD5 = 0x0060;
|
||||
const TLS_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5 = 0x0061;
|
||||
const TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA = 0x0062;
|
||||
const TLS_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA = 0x0063;
|
||||
const TLS_RSA_EXPORT1024_WITH_RC4_56_SHA = 0x0064;
|
||||
const TLS_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA = 0x0065;
|
||||
const TLS_DHE_DSS_WITH_RC4_128_SHA = 0x0066;
|
||||
const TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 = 0x0067;
|
||||
const TLS_DH_DSS_WITH_AES_256_CBC_SHA256 = 0x0068;
|
||||
const TLS_DH_RSA_WITH_AES_256_CBC_SHA256 = 0x0069;
|
||||
const TLS_DHE_DSS_WITH_AES_256_CBC_SHA256 = 0x006A;
|
||||
const TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 = 0x006B;
|
||||
const TLS_DH_ANON_WITH_AES_128_CBC_SHA256 = 0x006C;
|
||||
const TLS_DH_ANON_WITH_AES_256_CBC_SHA256 = 0x006D;
|
||||
const TLS_RSA_WITH_CAMELLIA_256_CBC_SHA = 0x0084;
|
||||
const TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA = 0x0085;
|
||||
const TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA = 0x0086;
|
||||
const TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA = 0x0087;
|
||||
const TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA = 0x0088;
|
||||
const TLS_DH_ANON_WITH_CAMELLIA_256_CBC_SHA = 0x0089;
|
||||
const TLS_PSK_WITH_RC4_128_SHA = 0x008A;
|
||||
const TLS_PSK_WITH_3DES_EDE_CBC_SHA = 0x008B;
|
||||
const TLS_PSK_WITH_AES_128_CBC_SHA = 0x008C;
|
||||
const TLS_PSK_WITH_AES_256_CBC_SHA = 0x008D;
|
||||
const TLS_DHE_PSK_WITH_RC4_128_SHA = 0x008E;
|
||||
const TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA = 0x008F;
|
||||
const TLS_DHE_PSK_WITH_AES_128_CBC_SHA = 0x0090;
|
||||
const TLS_DHE_PSK_WITH_AES_256_CBC_SHA = 0x0091;
|
||||
const TLS_RSA_PSK_WITH_RC4_128_SHA = 0x0092;
|
||||
const TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA = 0x0093;
|
||||
const TLS_RSA_PSK_WITH_AES_128_CBC_SHA = 0x0094;
|
||||
const TLS_RSA_PSK_WITH_AES_256_CBC_SHA = 0x0095;
|
||||
const TLS_RSA_WITH_SEED_CBC_SHA = 0x0096;
|
||||
const TLS_DH_DSS_WITH_SEED_CBC_SHA = 0x0097;
|
||||
const TLS_DH_RSA_WITH_SEED_CBC_SHA = 0x0098;
|
||||
const TLS_DHE_DSS_WITH_SEED_CBC_SHA = 0x0099;
|
||||
const TLS_DHE_RSA_WITH_SEED_CBC_SHA = 0x009A;
|
||||
const TLS_DH_ANON_WITH_SEED_CBC_SHA = 0x009B;
|
||||
const TLS_RSA_WITH_AES_128_GCM_SHA256 = 0x009C;
|
||||
const TLS_RSA_WITH_AES_256_GCM_SHA384 = 0x009D;
|
||||
const TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 = 0x009E;
|
||||
const TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 = 0x009F;
|
||||
const TLS_DH_RSA_WITH_AES_128_GCM_SHA256 = 0x00A0;
|
||||
const TLS_DH_RSA_WITH_AES_256_GCM_SHA384 = 0x00A1;
|
||||
const TLS_DHE_DSS_WITH_AES_128_GCM_SHA256 = 0x00A2;
|
||||
const TLS_DHE_DSS_WITH_AES_256_GCM_SHA384 = 0x00A3;
|
||||
const TLS_DH_DSS_WITH_AES_128_GCM_SHA256 = 0x00A4;
|
||||
const TLS_DH_DSS_WITH_AES_256_GCM_SHA384 = 0x00A5;
|
||||
const TLS_DH_ANON_WITH_AES_128_GCM_SHA256 = 0x00A6;
|
||||
const TLS_DH_ANON_WITH_AES_256_GCM_SHA384 = 0x00A7;
|
||||
const TLS_PSK_WITH_AES_128_GCM_SHA256 = 0x00A8;
|
||||
const TLS_PSK_WITH_AES_256_GCM_SHA384 = 0x00A9;
|
||||
const TLS_DHE_PSK_WITH_AES_128_GCM_SHA256 = 0x00AA;
|
||||
const TLS_DHE_PSK_WITH_AES_256_GCM_SHA384 = 0x00AB;
|
||||
const TLS_RSA_PSK_WITH_AES_128_GCM_SHA256 = 0x00AC;
|
||||
const TLS_RSA_PSK_WITH_AES_256_GCM_SHA384 = 0x00AD;
|
||||
const TLS_PSK_WITH_AES_128_CBC_SHA256 = 0x00AE;
|
||||
const TLS_PSK_WITH_AES_256_CBC_SHA384 = 0x00AF;
|
||||
const TLS_PSK_WITH_NULL_SHA256 = 0x00B0;
|
||||
const TLS_PSK_WITH_NULL_SHA384 = 0x00B1;
|
||||
const TLS_DHE_PSK_WITH_AES_128_CBC_SHA256 = 0x00B2;
|
||||
const TLS_DHE_PSK_WITH_AES_256_CBC_SHA384 = 0x00B3;
|
||||
const TLS_DHE_PSK_WITH_NULL_SHA256 = 0x00B4;
|
||||
const TLS_DHE_PSK_WITH_NULL_SHA384 = 0x00B5;
|
||||
const TLS_RSA_PSK_WITH_AES_128_CBC_SHA256 = 0x00B6;
|
||||
const TLS_RSA_PSK_WITH_AES_256_CBC_SHA384 = 0x00B7;
|
||||
const TLS_RSA_PSK_WITH_NULL_SHA256 = 0x00B8;
|
||||
const TLS_RSA_PSK_WITH_NULL_SHA384 = 0x00B9;
|
||||
const TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256 = 0x00BA;
|
||||
const TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA256 = 0x00BB;
|
||||
const TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA256 = 0x00BC;
|
||||
const TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA256 = 0x00BD;
|
||||
const TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 = 0x00BE;
|
||||
const TLS_DH_ANON_WITH_CAMELLIA_128_CBC_SHA256 = 0x00BF;
|
||||
const TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256 = 0x00C0;
|
||||
const TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA256 = 0x00C1;
|
||||
const TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA256 = 0x00C2;
|
||||
const TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA256 = 0x00C3;
|
||||
const TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256 = 0x00C4;
|
||||
const TLS_DH_ANON_WITH_CAMELLIA_256_CBC_SHA256 = 0x00C5;
|
||||
const TLS_ECDH_ECDSA_WITH_NULL_SHA = 0xC001;
|
||||
const TLS_ECDH_ECDSA_WITH_RC4_128_SHA = 0xC002;
|
||||
const TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA = 0xC003;
|
||||
const TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA = 0xC004;
|
||||
const TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA = 0xC005;
|
||||
const TLS_ECDHE_ECDSA_WITH_NULL_SHA = 0xC006;
|
||||
const TLS_ECDHE_ECDSA_WITH_RC4_128_SHA = 0xC007;
|
||||
const TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA = 0xC008;
|
||||
const TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA = 0xC009;
|
||||
const TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA = 0xC00A;
|
||||
const TLS_ECDH_RSA_WITH_NULL_SHA = 0xC00B;
|
||||
const TLS_ECDH_RSA_WITH_RC4_128_SHA = 0xC00C;
|
||||
const TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA = 0xC00D;
|
||||
const TLS_ECDH_RSA_WITH_AES_128_CBC_SHA = 0xC00E;
|
||||
const TLS_ECDH_RSA_WITH_AES_256_CBC_SHA = 0xC00F;
|
||||
const TLS_ECDHE_RSA_WITH_NULL_SHA = 0xC010;
|
||||
const TLS_ECDHE_RSA_WITH_RC4_128_SHA = 0xC011;
|
||||
const TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA = 0xC012;
|
||||
const TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA = 0xC013;
|
||||
const TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA = 0xC014;
|
||||
const TLS_ECDH_ANON_WITH_NULL_SHA = 0xC015;
|
||||
const TLS_ECDH_ANON_WITH_RC4_128_SHA = 0xC016;
|
||||
const TLS_ECDH_ANON_WITH_3DES_EDE_CBC_SHA = 0xC017;
|
||||
const TLS_ECDH_ANON_WITH_AES_128_CBC_SHA = 0xC018;
|
||||
const TLS_ECDH_ANON_WITH_AES_256_CBC_SHA = 0xC019;
|
||||
const TLS_SRP_SHA_WITH_3DES_EDE_CBC_SHA = 0xC01A;
|
||||
const TLS_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA = 0xC01B;
|
||||
const TLS_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA = 0xC01C;
|
||||
const TLS_SRP_SHA_WITH_AES_128_CBC_SHA = 0xC01D;
|
||||
const TLS_SRP_SHA_RSA_WITH_AES_128_CBC_SHA = 0xC01E;
|
||||
const TLS_SRP_SHA_DSS_WITH_AES_128_CBC_SHA = 0xC01F;
|
||||
const TLS_SRP_SHA_WITH_AES_256_CBC_SHA = 0xC020;
|
||||
const TLS_SRP_SHA_RSA_WITH_AES_256_CBC_SHA = 0xC021;
|
||||
const TLS_SRP_SHA_DSS_WITH_AES_256_CBC_SHA = 0xC022;
|
||||
const TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 = 0xC023;
|
||||
const TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 = 0xC024;
|
||||
const TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256 = 0xC025;
|
||||
const TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384 = 0xC026;
|
||||
const TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 = 0xC027;
|
||||
const TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 = 0xC028;
|
||||
const TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256 = 0xC029;
|
||||
const TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384 = 0xC02A;
|
||||
const TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 = 0xC02B;
|
||||
const TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 = 0xC02C;
|
||||
const TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256 = 0xC02D;
|
||||
const TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384 = 0xC02E;
|
||||
const TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 = 0xC02F;
|
||||
const TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 = 0xC030;
|
||||
const TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256 = 0xC031;
|
||||
const TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384 = 0xC032;
|
||||
const TLS_ECDHE_PSK_WITH_RC4_128_SHA = 0xC033;
|
||||
const TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA = 0xC034;
|
||||
const TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA = 0xC035;
|
||||
const TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA = 0xC036;
|
||||
const TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256 = 0xC037;
|
||||
const TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384 = 0xC038;
|
||||
const TLS_ECDHE_PSK_WITH_NULL_SHA = 0xC039;
|
||||
const TLS_ECDHE_PSK_WITH_NULL_SHA256 = 0xC03A;
|
||||
const TLS_ECDHE_PSK_WITH_NULL_SHA384 = 0xC03B;
|
||||
const SSL_RSA_FIPS_WITH_DES_CBC_SHA = 0xFEFE;
|
||||
const SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA = 0xFEFF;
|
||||
const SSL_RSA_FIPS_WITH_DES_CBC_SHA_2 = 0xFFE1;
|
||||
const SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA_2 = 0xFFE0;
|
||||
const SSL_RSA_WITH_RC2_CBC_MD5 = 0xFF80;
|
||||
const SSL_RSA_WITH_IDEA_CBC_MD5 = 0xFF81;
|
||||
const SSL_RSA_WITH_DES_CBC_MD5 = 0xFF82;
|
||||
const SSL_RSA_WITH_3DES_EDE_CBC_MD5 = 0xFF83;
|
||||
const TLS_EMPTY_RENEGOTIATION_INFO_SCSV = 0x00FF;
|
||||
|
||||
# --- This is a table of all known cipher specs.
|
||||
# --- It can be used for detecting unknown ciphers and for
|
||||
# --- converting the cipher spec constants into a human readable format.
|
||||
|
||||
const cipher_desc: table[count] of string = {
|
||||
# --- sslv20 ---
|
||||
[SSLv20_CK_RC4_128_EXPORT40_WITH_MD5] =
|
||||
"SSLv20_CK_RC4_128_EXPORT40_WITH_MD5",
|
||||
[SSLv20_CK_RC4_128_WITH_MD5] = "SSLv20_CK_RC4_128_WITH_MD5",
|
||||
[SSLv20_CK_RC2_128_CBC_WITH_MD5] = "SSLv20_CK_RC2_128_CBC_WITH_MD5",
|
||||
[SSLv20_CK_RC2_128_CBC_EXPORT40_WITH_MD5] =
|
||||
"SSLv20_CK_RC2_128_CBC_EXPORT40_WITH_MD5",
|
||||
[SSLv20_CK_IDEA_128_CBC_WITH_MD5] = "SSLv20_CK_IDEA_128_CBC_WITH_MD5",
|
||||
[SSLv20_CK_DES_192_EDE3_CBC_WITH_MD5] =
|
||||
"SSLv20_CK_DES_192_EDE3_CBC_WITH_MD5",
|
||||
[SSLv20_CK_DES_64_CBC_WITH_MD5] = "SSLv20_CK_DES_64_CBC_WITH_MD5",
|
||||
|
||||
# --- TLS ---
|
||||
[TLS_NULL_WITH_NULL_NULL] = "TLS_NULL_WITH_NULL_NULL",
|
||||
[TLS_RSA_WITH_NULL_MD5] = "TLS_RSA_WITH_NULL_MD5",
|
||||
[TLS_RSA_WITH_NULL_SHA] = "TLS_RSA_WITH_NULL_SHA",
|
||||
[TLS_RSA_EXPORT_WITH_RC4_40_MD5] = "TLS_RSA_EXPORT_WITH_RC4_40_MD5",
|
||||
[TLS_RSA_WITH_RC4_128_MD5] = "TLS_RSA_WITH_RC4_128_MD5",
|
||||
[TLS_RSA_WITH_RC4_128_SHA] = "TLS_RSA_WITH_RC4_128_SHA",
|
||||
[TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5] = "TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5",
|
||||
[TLS_RSA_WITH_IDEA_CBC_SHA] = "TLS_RSA_WITH_IDEA_CBC_SHA",
|
||||
[TLS_RSA_EXPORT_WITH_DES40_CBC_SHA] = "TLS_RSA_EXPORT_WITH_DES40_CBC_SHA",
|
||||
[TLS_RSA_WITH_DES_CBC_SHA] = "TLS_RSA_WITH_DES_CBC_SHA",
|
||||
[TLS_RSA_WITH_3DES_EDE_CBC_SHA] = "TLS_RSA_WITH_3DES_EDE_CBC_SHA",
|
||||
[TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA] = "TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA",
|
||||
[TLS_DH_DSS_WITH_DES_CBC_SHA] = "TLS_DH_DSS_WITH_DES_CBC_SHA",
|
||||
[TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA] = "TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA",
|
||||
[TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA] = "TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA",
|
||||
[TLS_DH_RSA_WITH_DES_CBC_SHA] = "TLS_DH_RSA_WITH_DES_CBC_SHA",
|
||||
[TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA] = "TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA",
|
||||
[TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA] = "TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA",
|
||||
[TLS_DHE_DSS_WITH_DES_CBC_SHA] = "TLS_DHE_DSS_WITH_DES_CBC_SHA",
|
||||
[TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA] = "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA",
|
||||
[TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA] = "TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA",
|
||||
[TLS_DHE_RSA_WITH_DES_CBC_SHA] = "TLS_DHE_RSA_WITH_DES_CBC_SHA",
|
||||
[TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA] = "TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA",
|
||||
[TLS_DH_ANON_EXPORT_WITH_RC4_40_MD5] = "TLS_DH_ANON_EXPORT_WITH_RC4_40_MD5",
|
||||
[TLS_DH_ANON_WITH_RC4_128_MD5] = "TLS_DH_ANON_WITH_RC4_128_MD5",
|
||||
[TLS_DH_ANON_EXPORT_WITH_DES40_CBC_SHA] = "TLS_DH_ANON_EXPORT_WITH_DES40_CBC_SHA",
|
||||
[TLS_DH_ANON_WITH_DES_CBC_SHA] = "TLS_DH_ANON_WITH_DES_CBC_SHA",
|
||||
[TLS_DH_ANON_WITH_3DES_EDE_CBC_SHA] = "TLS_DH_ANON_WITH_3DES_EDE_CBC_SHA",
|
||||
[SSL_FORTEZZA_KEA_WITH_NULL_SHA] = "SSL_FORTEZZA_KEA_WITH_NULL_SHA",
|
||||
[SSL_FORTEZZA_KEA_WITH_FORTEZZA_CBC_SHA] = "SSL_FORTEZZA_KEA_WITH_FORTEZZA_CBC_SHA",
|
||||
[TLS_KRB5_WITH_DES_CBC_SHA] = "TLS_KRB5_WITH_DES_CBC_SHA",
|
||||
[TLS_KRB5_WITH_3DES_EDE_CBC_SHA] = "TLS_KRB5_WITH_3DES_EDE_CBC_SHA",
|
||||
[TLS_KRB5_WITH_RC4_128_SHA] = "TLS_KRB5_WITH_RC4_128_SHA",
|
||||
[TLS_KRB5_WITH_IDEA_CBC_SHA] = "TLS_KRB5_WITH_IDEA_CBC_SHA",
|
||||
[TLS_KRB5_WITH_DES_CBC_MD5] = "TLS_KRB5_WITH_DES_CBC_MD5",
|
||||
[TLS_KRB5_WITH_3DES_EDE_CBC_MD5] = "TLS_KRB5_WITH_3DES_EDE_CBC_MD5",
|
||||
[TLS_KRB5_WITH_RC4_128_MD5] = "TLS_KRB5_WITH_RC4_128_MD5",
|
||||
[TLS_KRB5_WITH_IDEA_CBC_MD5] = "TLS_KRB5_WITH_IDEA_CBC_MD5",
|
||||
[TLS_KRB5_EXPORT_WITH_DES_CBC_40_SHA] = "TLS_KRB5_EXPORT_WITH_DES_CBC_40_SHA",
|
||||
[TLS_KRB5_EXPORT_WITH_RC2_CBC_40_SHA] = "TLS_KRB5_EXPORT_WITH_RC2_CBC_40_SHA",
|
||||
[TLS_KRB5_EXPORT_WITH_RC4_40_SHA] = "TLS_KRB5_EXPORT_WITH_RC4_40_SHA",
|
||||
[TLS_KRB5_EXPORT_WITH_DES_CBC_40_MD5] = "TLS_KRB5_EXPORT_WITH_DES_CBC_40_MD5",
|
||||
[TLS_KRB5_EXPORT_WITH_RC2_CBC_40_MD5] = "TLS_KRB5_EXPORT_WITH_RC2_CBC_40_MD5",
|
||||
[TLS_KRB5_EXPORT_WITH_RC4_40_MD5] = "TLS_KRB5_EXPORT_WITH_RC4_40_MD5",
|
||||
[TLS_RSA_WITH_AES_128_CBC_SHA] = "TLS_RSA_WITH_AES_128_CBC_SHA",
|
||||
[TLS_DH_DSS_WITH_AES_128_CBC_SHA] = "TLS_DH_DSS_WITH_AES_128_CBC_SHA",
|
||||
[TLS_DH_RSA_WITH_AES_128_CBC_SHA] = "TLS_DH_RSA_WITH_AES_128_CBC_SHA",
|
||||
[TLS_DHE_DSS_WITH_AES_128_CBC_SHA] = "TLS_DHE_DSS_WITH_AES_128_CBC_SHA",
|
||||
[TLS_DHE_RSA_WITH_AES_128_CBC_SHA] = "TLS_DHE_RSA_WITH_AES_128_CBC_SHA",
|
||||
[TLS_DH_ANON_WITH_AES_128_CBC_SHA] = "TLS_DH_ANON_WITH_AES_128_CBC_SHA",
|
||||
[TLS_RSA_WITH_AES_256_CBC_SHA] = "TLS_RSA_WITH_AES_256_CBC_SHA",
|
||||
[TLS_DH_DSS_WITH_AES_256_CBC_SHA] = "TLS_DH_DSS_WITH_AES_256_CBC_SHA",
|
||||
[TLS_DH_RSA_WITH_AES_256_CBC_SHA] = "TLS_DH_RSA_WITH_AES_256_CBC_SHA",
|
||||
[TLS_DHE_DSS_WITH_AES_256_CBC_SHA] = "TLS_DHE_DSS_WITH_AES_256_CBC_SHA",
|
||||
[TLS_DHE_RSA_WITH_AES_256_CBC_SHA] = "TLS_DHE_RSA_WITH_AES_256_CBC_SHA",
|
||||
[TLS_DH_ANON_WITH_AES_256_CBC_SHA] = "TLS_DH_ANON_WITH_AES_256_CBC_SHA",
|
||||
[TLS_RSA_WITH_NULL_SHA256] = "TLS_RSA_WITH_NULL_SHA256",
|
||||
[TLS_RSA_WITH_AES_128_CBC_SHA256] = "TLS_RSA_WITH_AES_128_CBC_SHA256",
|
||||
[TLS_RSA_WITH_AES_256_CBC_SHA256] = "TLS_RSA_WITH_AES_256_CBC_SHA256",
|
||||
[TLS_DH_DSS_WITH_AES_128_CBC_SHA256] = "TLS_DH_DSS_WITH_AES_128_CBC_SHA256",
|
||||
[TLS_DH_RSA_WITH_AES_128_CBC_SHA256] = "TLS_DH_RSA_WITH_AES_128_CBC_SHA256",
|
||||
[TLS_DHE_DSS_WITH_AES_128_CBC_SHA256] = "TLS_DHE_DSS_WITH_AES_128_CBC_SHA256",
|
||||
[TLS_RSA_WITH_CAMELLIA_128_CBC_SHA] = "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA",
|
||||
[TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA] = "TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA",
|
||||
[TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA] = "TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA",
|
||||
[TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA] = "TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA",
|
||||
[TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA] = "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA",
|
||||
[TLS_DH_ANON_WITH_CAMELLIA_128_CBC_SHA] = "TLS_DH_ANON_WITH_CAMELLIA_128_CBC_SHA",
|
||||
[TLS_RSA_EXPORT1024_WITH_RC4_56_MD5] = "TLS_RSA_EXPORT1024_WITH_RC4_56_MD5",
|
||||
[TLS_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5] = "TLS_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5",
|
||||
[TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA] = "TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA",
|
||||
[TLS_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA] = "TLS_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA",
|
||||
[TLS_RSA_EXPORT1024_WITH_RC4_56_SHA] = "TLS_RSA_EXPORT1024_WITH_RC4_56_SHA",
|
||||
[TLS_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA] = "TLS_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA",
|
||||
[TLS_DHE_DSS_WITH_RC4_128_SHA] = "TLS_DHE_DSS_WITH_RC4_128_SHA",
|
||||
[TLS_DHE_RSA_WITH_AES_128_CBC_SHA256] = "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256",
|
||||
[TLS_DH_DSS_WITH_AES_256_CBC_SHA256] = "TLS_DH_DSS_WITH_AES_256_CBC_SHA256",
|
||||
[TLS_DH_RSA_WITH_AES_256_CBC_SHA256] = "TLS_DH_RSA_WITH_AES_256_CBC_SHA256",
|
||||
[TLS_DHE_DSS_WITH_AES_256_CBC_SHA256] = "TLS_DHE_DSS_WITH_AES_256_CBC_SHA256",
|
||||
[TLS_DHE_RSA_WITH_AES_256_CBC_SHA256] = "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256",
|
||||
[TLS_DH_ANON_WITH_AES_128_CBC_SHA256] = "TLS_DH_ANON_WITH_AES_128_CBC_SHA256",
|
||||
[TLS_DH_ANON_WITH_AES_256_CBC_SHA256] = "TLS_DH_ANON_WITH_AES_256_CBC_SHA256",
|
||||
[TLS_RSA_WITH_CAMELLIA_256_CBC_SHA] = "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA",
|
||||
[TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA] = "TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA",
|
||||
[TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA] = "TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA",
|
||||
[TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA] = "TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA",
|
||||
[TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA] = "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA",
|
||||
[TLS_DH_ANON_WITH_CAMELLIA_256_CBC_SHA] = "TLS_DH_ANON_WITH_CAMELLIA_256_CBC_SHA",
|
||||
[TLS_PSK_WITH_RC4_128_SHA] = "TLS_PSK_WITH_RC4_128_SHA",
|
||||
[TLS_PSK_WITH_3DES_EDE_CBC_SHA] = "TLS_PSK_WITH_3DES_EDE_CBC_SHA",
|
||||
[TLS_PSK_WITH_AES_128_CBC_SHA] = "TLS_PSK_WITH_AES_128_CBC_SHA",
|
||||
[TLS_PSK_WITH_AES_256_CBC_SHA] = "TLS_PSK_WITH_AES_256_CBC_SHA",
|
||||
[TLS_DHE_PSK_WITH_RC4_128_SHA] = "TLS_DHE_PSK_WITH_RC4_128_SHA",
|
||||
[TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA] = "TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA",
|
||||
[TLS_DHE_PSK_WITH_AES_128_CBC_SHA] = "TLS_DHE_PSK_WITH_AES_128_CBC_SHA",
|
||||
[TLS_DHE_PSK_WITH_AES_256_CBC_SHA] = "TLS_DHE_PSK_WITH_AES_256_CBC_SHA",
|
||||
[TLS_RSA_PSK_WITH_RC4_128_SHA] = "TLS_RSA_PSK_WITH_RC4_128_SHA",
|
||||
[TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA] = "TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA",
|
||||
[TLS_RSA_PSK_WITH_AES_128_CBC_SHA] = "TLS_RSA_PSK_WITH_AES_128_CBC_SHA",
|
||||
[TLS_RSA_PSK_WITH_AES_256_CBC_SHA] = "TLS_RSA_PSK_WITH_AES_256_CBC_SHA",
|
||||
[TLS_RSA_WITH_SEED_CBC_SHA] = "TLS_RSA_WITH_SEED_CBC_SHA",
|
||||
[TLS_DH_DSS_WITH_SEED_CBC_SHA] = "TLS_DH_DSS_WITH_SEED_CBC_SHA",
|
||||
[TLS_DH_RSA_WITH_SEED_CBC_SHA] = "TLS_DH_RSA_WITH_SEED_CBC_SHA",
|
||||
[TLS_DHE_DSS_WITH_SEED_CBC_SHA] = "TLS_DHE_DSS_WITH_SEED_CBC_SHA",
|
||||
[TLS_DHE_RSA_WITH_SEED_CBC_SHA] = "TLS_DHE_RSA_WITH_SEED_CBC_SHA",
|
||||
[TLS_DH_ANON_WITH_SEED_CBC_SHA] = "TLS_DH_ANON_WITH_SEED_CBC_SHA",
|
||||
[TLS_RSA_WITH_AES_128_GCM_SHA256] = "TLS_RSA_WITH_AES_128_GCM_SHA256",
|
||||
[TLS_RSA_WITH_AES_256_GCM_SHA384] = "TLS_RSA_WITH_AES_256_GCM_SHA384",
|
||||
[TLS_DHE_RSA_WITH_AES_128_GCM_SHA256] = "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256",
|
||||
[TLS_DHE_RSA_WITH_AES_256_GCM_SHA384] = "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384",
|
||||
[TLS_DH_RSA_WITH_AES_128_GCM_SHA256] = "TLS_DH_RSA_WITH_AES_128_GCM_SHA256",
|
||||
[TLS_DH_RSA_WITH_AES_256_GCM_SHA384] = "TLS_DH_RSA_WITH_AES_256_GCM_SHA384",
|
||||
[TLS_DHE_DSS_WITH_AES_128_GCM_SHA256] = "TLS_DHE_DSS_WITH_AES_128_GCM_SHA256",
|
||||
[TLS_DHE_DSS_WITH_AES_256_GCM_SHA384] = "TLS_DHE_DSS_WITH_AES_256_GCM_SHA384",
|
||||
[TLS_DH_DSS_WITH_AES_128_GCM_SHA256] = "TLS_DH_DSS_WITH_AES_128_GCM_SHA256",
|
||||
[TLS_DH_DSS_WITH_AES_256_GCM_SHA384] = "TLS_DH_DSS_WITH_AES_256_GCM_SHA384",
|
||||
[TLS_DH_ANON_WITH_AES_128_GCM_SHA256] = "TLS_DH_ANON_WITH_AES_128_GCM_SHA256",
|
||||
[TLS_DH_ANON_WITH_AES_256_GCM_SHA384] = "TLS_DH_ANON_WITH_AES_256_GCM_SHA384",
|
||||
[TLS_PSK_WITH_AES_128_GCM_SHA256] = "TLS_PSK_WITH_AES_128_GCM_SHA256",
|
||||
[TLS_PSK_WITH_AES_256_GCM_SHA384] = "TLS_PSK_WITH_AES_256_GCM_SHA384",
|
||||
[TLS_DHE_PSK_WITH_AES_128_GCM_SHA256] = "TLS_DHE_PSK_WITH_AES_128_GCM_SHA256",
|
||||
[TLS_DHE_PSK_WITH_AES_256_GCM_SHA384] = "TLS_DHE_PSK_WITH_AES_256_GCM_SHA384",
|
||||
[TLS_RSA_PSK_WITH_AES_128_GCM_SHA256] = "TLS_RSA_PSK_WITH_AES_128_GCM_SHA256",
|
||||
[TLS_RSA_PSK_WITH_AES_256_GCM_SHA384] = "TLS_RSA_PSK_WITH_AES_256_GCM_SHA384",
|
||||
[TLS_PSK_WITH_AES_128_CBC_SHA256] = "TLS_PSK_WITH_AES_128_CBC_SHA256",
|
||||
[TLS_PSK_WITH_AES_256_CBC_SHA384] = "TLS_PSK_WITH_AES_256_CBC_SHA384",
|
||||
[TLS_PSK_WITH_NULL_SHA256] = "TLS_PSK_WITH_NULL_SHA256",
|
||||
[TLS_PSK_WITH_NULL_SHA384] = "TLS_PSK_WITH_NULL_SHA384",
|
||||
[TLS_DHE_PSK_WITH_AES_128_CBC_SHA256] = "TLS_DHE_PSK_WITH_AES_128_CBC_SHA256",
|
||||
[TLS_DHE_PSK_WITH_AES_256_CBC_SHA384] = "TLS_DHE_PSK_WITH_AES_256_CBC_SHA384",
|
||||
[TLS_DHE_PSK_WITH_NULL_SHA256] = "TLS_DHE_PSK_WITH_NULL_SHA256",
|
||||
[TLS_DHE_PSK_WITH_NULL_SHA384] = "TLS_DHE_PSK_WITH_NULL_SHA384",
|
||||
[TLS_RSA_PSK_WITH_AES_128_CBC_SHA256] = "TLS_RSA_PSK_WITH_AES_128_CBC_SHA256",
|
||||
[TLS_RSA_PSK_WITH_AES_256_CBC_SHA384] = "TLS_RSA_PSK_WITH_AES_256_CBC_SHA384",
|
||||
[TLS_RSA_PSK_WITH_NULL_SHA256] = "TLS_RSA_PSK_WITH_NULL_SHA256",
|
||||
[TLS_RSA_PSK_WITH_NULL_SHA384] = "TLS_RSA_PSK_WITH_NULL_SHA384",
|
||||
[TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256] = "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256",
|
||||
[TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA256] = "TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA256",
|
||||
[TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA256] = "TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA256",
|
||||
[TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA256] = "TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA256",
|
||||
[TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256] = "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256",
|
||||
[TLS_DH_ANON_WITH_CAMELLIA_128_CBC_SHA256] = "TLS_DH_ANON_WITH_CAMELLIA_128_CBC_SHA256",
|
||||
[TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256] = "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256",
|
||||
[TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA256] = "TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA256",
|
||||
[TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA256] = "TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA256",
|
||||
[TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA256] = "TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA256",
|
||||
[TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256] = "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256",
|
||||
[TLS_DH_ANON_WITH_CAMELLIA_256_CBC_SHA256] = "TLS_DH_ANON_WITH_CAMELLIA_256_CBC_SHA256",
|
||||
[TLS_ECDH_ECDSA_WITH_NULL_SHA] = "TLS_ECDH_ECDSA_WITH_NULL_SHA",
|
||||
[TLS_ECDH_ECDSA_WITH_RC4_128_SHA] = "TLS_ECDH_ECDSA_WITH_RC4_128_SHA",
|
||||
[TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA] = "TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA",
|
||||
[TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA] = "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA",
|
||||
[TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA] = "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA",
|
||||
[TLS_ECDHE_ECDSA_WITH_NULL_SHA] = "TLS_ECDHE_ECDSA_WITH_NULL_SHA",
|
||||
[TLS_ECDHE_ECDSA_WITH_RC4_128_SHA] = "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA",
|
||||
[TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA] = "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA",
|
||||
[TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA] = "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA",
|
||||
[TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA] = "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA",
|
||||
[TLS_ECDH_RSA_WITH_NULL_SHA] = "TLS_ECDH_RSA_WITH_NULL_SHA",
|
||||
[TLS_ECDH_RSA_WITH_RC4_128_SHA] = "TLS_ECDH_RSA_WITH_RC4_128_SHA",
|
||||
[TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA] = "TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA",
|
||||
[TLS_ECDH_RSA_WITH_AES_128_CBC_SHA] = "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA",
|
||||
[TLS_ECDH_RSA_WITH_AES_256_CBC_SHA] = "TLS_ECDH_RSA_WITH_AES_256_CBC_SHA",
|
||||
[TLS_ECDHE_RSA_WITH_NULL_SHA] = "TLS_ECDHE_RSA_WITH_NULL_SHA",
|
||||
[TLS_ECDHE_RSA_WITH_RC4_128_SHA] = "TLS_ECDHE_RSA_WITH_RC4_128_SHA",
|
||||
[TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA] = "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA",
|
||||
[TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA] = "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA",
|
||||
[TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA] = "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA",
|
||||
[TLS_ECDH_ANON_WITH_NULL_SHA] = "TLS_ECDH_ANON_WITH_NULL_SHA",
|
||||
[TLS_ECDH_ANON_WITH_RC4_128_SHA] = "TLS_ECDH_ANON_WITH_RC4_128_SHA",
|
||||
[TLS_ECDH_ANON_WITH_3DES_EDE_CBC_SHA] = "TLS_ECDH_ANON_WITH_3DES_EDE_CBC_SHA",
|
||||
[TLS_ECDH_ANON_WITH_AES_128_CBC_SHA] = "TLS_ECDH_ANON_WITH_AES_128_CBC_SHA",
|
||||
[TLS_ECDH_ANON_WITH_AES_256_CBC_SHA] = "TLS_ECDH_ANON_WITH_AES_256_CBC_SHA",
|
||||
[TLS_SRP_SHA_WITH_3DES_EDE_CBC_SHA] = "TLS_SRP_SHA_WITH_3DES_EDE_CBC_SHA",
|
||||
[TLS_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA] = "TLS_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA",
|
||||
[TLS_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA] = "TLS_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA",
|
||||
[TLS_SRP_SHA_WITH_AES_128_CBC_SHA] = "TLS_SRP_SHA_WITH_AES_128_CBC_SHA",
|
||||
[TLS_SRP_SHA_RSA_WITH_AES_128_CBC_SHA] = "TLS_SRP_SHA_RSA_WITH_AES_128_CBC_SHA",
|
||||
[TLS_SRP_SHA_DSS_WITH_AES_128_CBC_SHA] = "TLS_SRP_SHA_DSS_WITH_AES_128_CBC_SHA",
|
||||
[TLS_SRP_SHA_WITH_AES_256_CBC_SHA] = "TLS_SRP_SHA_WITH_AES_256_CBC_SHA",
|
||||
[TLS_SRP_SHA_RSA_WITH_AES_256_CBC_SHA] = "TLS_SRP_SHA_RSA_WITH_AES_256_CBC_SHA",
|
||||
[TLS_SRP_SHA_DSS_WITH_AES_256_CBC_SHA] = "TLS_SRP_SHA_DSS_WITH_AES_256_CBC_SHA",
|
||||
[TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256] = "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256",
|
||||
[TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384] = "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384",
|
||||
[TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256] = "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256",
|
||||
[TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384] = "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384",
|
||||
[TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256] = "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256",
|
||||
[TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384] = "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384",
|
||||
[TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256] = "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256",
|
||||
[TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384] = "TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384",
|
||||
[TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256] = "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
|
||||
[TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384] = "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
|
||||
[TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256] = "TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256",
|
||||
[TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384] = "TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384",
|
||||
[TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256] = "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
|
||||
[TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384] = "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
|
||||
[TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256] = "TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256",
|
||||
[TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384] = "TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384",
|
||||
[TLS_ECDHE_PSK_WITH_RC4_128_SHA] = "TLS_ECDHE_PSK_WITH_RC4_128_SHA",
|
||||
[TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA] = "TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA",
|
||||
[TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA] = "TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA",
|
||||
[TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA] = "TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA",
|
||||
[TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256] = "TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256",
|
||||
[TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384] = "TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384",
|
||||
[TLS_ECDHE_PSK_WITH_NULL_SHA] = "TLS_ECDHE_PSK_WITH_NULL_SHA",
|
||||
[TLS_ECDHE_PSK_WITH_NULL_SHA256] = "TLS_ECDHE_PSK_WITH_NULL_SHA256",
|
||||
[TLS_ECDHE_PSK_WITH_NULL_SHA384] = "TLS_ECDHE_PSK_WITH_NULL_SHA384",
|
||||
[SSL_RSA_FIPS_WITH_DES_CBC_SHA] = "SSL_RSA_FIPS_WITH_DES_CBC_SHA",
|
||||
[SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA] = "SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA",
|
||||
[SSL_RSA_FIPS_WITH_DES_CBC_SHA_2] = "SSL_RSA_FIPS_WITH_DES_CBC_SHA_2",
|
||||
[SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA_2] = "SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA_2",
|
||||
} &default="UNKNOWN";
|
||||
|
||||
const x509_errors: table[count] of string = {
|
||||
[0] = "X509_V_OK",
|
||||
[1] = "X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT",
|
||||
[2] = "X509_V_ERR_UNABLE_TO_GET_CRL",
|
||||
[3] = "X509_V_ERR_UNABLE_TO_DECRYPT_CERT_SIGNATURE",
|
||||
[4] = "X509_V_ERR_UNABLE_TO_DECRYPT_CRL_SIGNATURE",
|
||||
[5] = "X509_V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY",
|
||||
[6] = "X509_V_ERR_CERT_SIGNATURE_FAILURE",
|
||||
[7] = "X509_V_ERR_CRL_SIGNATURE_FAILURE",
|
||||
[8] = "X509_V_ERR_CERT_NOT_YET_VALID",
|
||||
[9] = "X509_V_ERR_CERT_HAS_EXPIRED",
|
||||
[10] = "X509_V_ERR_CRL_NOT_YET_VALID",
|
||||
[11] = "X509_V_ERR_CRL_HAS_EXPIRED",
|
||||
[12] = "X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD",
|
||||
[13] = "X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD",
|
||||
[14] = "X509_V_ERR_ERROR_IN_CRL_LAST_UPDATE_FIELD",
|
||||
[15] = "X509_V_ERR_ERROR_IN_CRL_NEXT_UPDATE_FIELD",
|
||||
[16] = "X509_V_ERR_OUT_OF_MEM",
|
||||
[17] = "X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT",
|
||||
[18] = "X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN",
|
||||
[19] = "X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY",
|
||||
[20] = "X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE",
|
||||
[21] = "X509_V_ERR_CERT_CHAIN_TOO_LONG",
|
||||
[22] = "X509_V_ERR_CERT_REVOKED",
|
||||
[23] = "X509_V_ERR_INVALID_CA",
|
||||
[24] = "X509_V_ERR_PATH_LENGTH_EXCEEDED",
|
||||
[25] = "X509_V_ERR_INVALID_PURPOSE",
|
||||
[26] = "X509_V_ERR_CERT_UNTRUSTED",
|
||||
[27] = "X509_V_ERR_CERT_REJECTED",
|
||||
[28] = "X509_V_ERR_SUBJECT_ISSUER_MISMATCH",
|
||||
[29] = "X509_V_ERR_AKID_SKID_MISMATCH",
|
||||
[30] = "X509_V_ERR_AKID_ISSUER_SERIAL_MISMATCH",
|
||||
[31] = "X509_V_ERR_KEYUSAGE_NO_CERTSIGN",
|
||||
[32] = "X509_V_ERR_UNABLE_TO_GET_CRL_ISSUER",
|
||||
[33] = "X509_V_ERR_UNHANDLED_CRITICAL_EXTENSION"
|
||||
};
|
||||
|
||||
}
|
||||
60
policy/protocols/ssl/known-certs.bro
Normal file
60
policy/protocols/ssl/known-certs.bro
Normal file
|
|
@ -0,0 +1,60 @@
|
|||
|
||||
@load protocols/ssl
|
||||
@load utils/directions-and-hosts
|
||||
|
||||
module KnownCerts;
|
||||
|
||||
export {
|
||||
redef enum Log::ID += { KNOWN_CERTS };
|
||||
|
||||
type Info: record {
|
||||
## The timestamp when the certificate was detected.
|
||||
ts: time &log;
|
||||
## The address that offered the certificate.
|
||||
host: addr &log;
|
||||
## If the certificate was handed out by a server, this is the
|
||||
## port that the server was listening on.
|
||||
port_num: port &log &optional;
|
||||
## Certificate subject.
|
||||
subject: string &log &optional;
|
||||
## Certificate issuer subject.
|
||||
issuer_subject: string &log &optional;
|
||||
## Serial number for the certificate.
|
||||
serial: string &log &optional;
|
||||
};
|
||||
|
||||
## The certificates whose existence should be logged and tracked.
|
||||
## Choices are: LOCAL_HOSTS, REMOTE_HOSTS, ALL_HOSTS, NO_HOSTS
|
||||
const asset_tracking = LOCAL_HOSTS &redef;
|
||||
|
||||
## The set of all known certificates to store for preventing duplicate
|
||||
## logging. It can also be used from other scripts to
|
||||
## inspect if a certificate has been seen in use. The string value
|
||||
## in the set is for storing the certificate's serial number.
|
||||
global known_certs: set[addr, string] &create_expire=1day &synchronized &redef;
|
||||
|
||||
global log_known_certs: event(rec: Info);
|
||||
}
|
||||
|
||||
event bro_init()
|
||||
{
|
||||
Log::create_stream(KNOWN_CERTS, [$columns=Info, $ev=log_known_certs]);
|
||||
}
|
||||
|
||||
event x509_certificate(c: connection, cert: X509, is_server: bool, chain_idx: count, chain_len: count, der_cert: string)
|
||||
{
|
||||
# We aren't tracking client certificates yet.
|
||||
if ( ! is_server ) return;
|
||||
# We are also only tracking the primary cert.
|
||||
if ( chain_idx != 0 ) return;
|
||||
|
||||
local host = c$id$resp_h;
|
||||
if ( [host, cert$serial] !in known_certs && addr_matches_host(host, asset_tracking) )
|
||||
{
|
||||
add known_certs[host, cert$serial];
|
||||
Log::write(KNOWN_CERTS, [$ts=network_time(), $host=host,
|
||||
$port_num=c$id$resp_p, $subject=cert$subject,
|
||||
$issuer_subject=cert$issuer,
|
||||
$serial=cert$serial]);
|
||||
}
|
||||
}
|
||||
140
policy/protocols/ssl/mozilla-ca-list.bro
Normal file
140
policy/protocols/ssl/mozilla-ca-list.bro
Normal file
File diff suppressed because one or more lines are too long
|
|
@ -1,691 +0,0 @@
|
|||
module SSL;
|
||||
|
||||
## SSLv2
|
||||
const SSLv20_CK_RC4_128_WITH_MD5 = 0x010080;
|
||||
const SSLv20_CK_RC4_128_EXPORT40_WITH_MD5 = 0x020080;
|
||||
const SSLv20_CK_RC2_128_CBC_WITH_MD5 = 0x030080;
|
||||
const SSLv20_CK_RC2_128_CBC_EXPORT40_WITH_MD5 = 0x040080;
|
||||
const SSLv20_CK_IDEA_128_CBC_WITH_MD5 = 0x050080;
|
||||
const SSLv20_CK_DES_64_CBC_WITH_MD5 = 0x060040;
|
||||
const SSLv20_CK_DES_192_EDE3_CBC_WITH_MD5 = 0x0700C0;
|
||||
|
||||
## TLS
|
||||
const TLS_NULL_WITH_NULL_NULL = 0x0000;
|
||||
const TLS_RSA_WITH_NULL_MD5 = 0x0001;
|
||||
const TLS_RSA_WITH_NULL_SHA = 0x0002;
|
||||
const TLS_RSA_EXPORT_WITH_RC4_40_MD5 = 0x0003;
|
||||
const TLS_RSA_WITH_RC4_128_MD5 = 0x0004;
|
||||
const TLS_RSA_WITH_RC4_128_SHA = 0x0005;
|
||||
const TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5 = 0x0006;
|
||||
const TLS_RSA_WITH_IDEA_CBC_SHA = 0x0007;
|
||||
const TLS_RSA_EXPORT_WITH_DES40_CBC_SHA = 0x0008;
|
||||
const TLS_RSA_WITH_DES_CBC_SHA = 0x0009;
|
||||
const TLS_RSA_WITH_3DES_EDE_CBC_SHA = 0x000A;
|
||||
const TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA = 0x000B;
|
||||
const TLS_DH_DSS_WITH_DES_CBC_SHA = 0x000C;
|
||||
const TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA = 0x000D;
|
||||
const TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA = 0x000E;
|
||||
const TLS_DH_RSA_WITH_DES_CBC_SHA = 0x000F;
|
||||
const TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA = 0x0010;
|
||||
const TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA = 0x0011;
|
||||
const TLS_DHE_DSS_WITH_DES_CBC_SHA = 0x0012;
|
||||
const TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA = 0x0013;
|
||||
const TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA = 0x0014;
|
||||
const TLS_DHE_RSA_WITH_DES_CBC_SHA = 0x0015;
|
||||
const TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA = 0x0016;
|
||||
const TLS_DH_ANON_EXPORT_WITH_RC4_40_MD5 = 0x0017;
|
||||
const TLS_DH_ANON_WITH_RC4_128_MD5 = 0x0018;
|
||||
const TLS_DH_ANON_EXPORT_WITH_DES40_CBC_SHA = 0x0019;
|
||||
const TLS_DH_ANON_WITH_DES_CBC_SHA = 0x001A;
|
||||
const TLS_DH_ANON_WITH_3DES_EDE_CBC_SHA = 0x001B;
|
||||
const SSL_FORTEZZA_KEA_WITH_NULL_SHA = 0x001C;
|
||||
const SSL_FORTEZZA_KEA_WITH_FORTEZZA_CBC_SHA = 0x001D;
|
||||
const TLS_KRB5_WITH_DES_CBC_SHA = 0x001E;
|
||||
const TLS_KRB5_WITH_3DES_EDE_CBC_SHA = 0x001F;
|
||||
const TLS_KRB5_WITH_RC4_128_SHA = 0x0020;
|
||||
const TLS_KRB5_WITH_IDEA_CBC_SHA = 0x0021;
|
||||
const TLS_KRB5_WITH_DES_CBC_MD5 = 0x0022;
|
||||
const TLS_KRB5_WITH_3DES_EDE_CBC_MD5 = 0x0023;
|
||||
const TLS_KRB5_WITH_RC4_128_MD5 = 0x0024;
|
||||
const TLS_KRB5_WITH_IDEA_CBC_MD5 = 0x0025;
|
||||
const TLS_KRB5_EXPORT_WITH_DES_CBC_40_SHA = 0x0026;
|
||||
const TLS_KRB5_EXPORT_WITH_RC2_CBC_40_SHA = 0x0027;
|
||||
const TLS_KRB5_EXPORT_WITH_RC4_40_SHA = 0x0028;
|
||||
const TLS_KRB5_EXPORT_WITH_DES_CBC_40_MD5 = 0x0029;
|
||||
const TLS_KRB5_EXPORT_WITH_RC2_CBC_40_MD5 = 0x002A;
|
||||
const TLS_KRB5_EXPORT_WITH_RC4_40_MD5 = 0x002B;
|
||||
const TLS_RSA_WITH_AES_128_CBC_SHA = 0x002F;
|
||||
const TLS_DH_DSS_WITH_AES_128_CBC_SHA = 0x0030;
|
||||
const TLS_DH_RSA_WITH_AES_128_CBC_SHA = 0x0031;
|
||||
const TLS_DHE_DSS_WITH_AES_128_CBC_SHA = 0x0032;
|
||||
const TLS_DHE_RSA_WITH_AES_128_CBC_SHA = 0x0033;
|
||||
const TLS_DH_ANON_WITH_AES_128_CBC_SHA = 0x0034;
|
||||
const TLS_RSA_WITH_AES_256_CBC_SHA = 0x0035;
|
||||
const TLS_DH_DSS_WITH_AES_256_CBC_SHA = 0x0036;
|
||||
const TLS_DH_RSA_WITH_AES_256_CBC_SHA = 0x0037;
|
||||
const TLS_DHE_DSS_WITH_AES_256_CBC_SHA = 0x0038;
|
||||
const TLS_DHE_RSA_WITH_AES_256_CBC_SHA = 0x0039;
|
||||
const TLS_DH_ANON_WITH_AES_256_CBC_SHA = 0x003A;
|
||||
const TLS_RSA_WITH_NULL_SHA256 = 0x003B;
|
||||
const TLS_RSA_WITH_AES_128_CBC_SHA256 = 0x003C;
|
||||
const TLS_RSA_WITH_AES_256_CBC_SHA256 = 0x003D;
|
||||
const TLS_DH_DSS_WITH_AES_128_CBC_SHA256 = 0x003E;
|
||||
const TLS_DH_RSA_WITH_AES_128_CBC_SHA256 = 0x003F;
|
||||
const TLS_DHE_DSS_WITH_AES_128_CBC_SHA256 = 0x0040;
|
||||
const TLS_RSA_WITH_CAMELLIA_128_CBC_SHA = 0x0041;
|
||||
const TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA = 0x0042;
|
||||
const TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA = 0x0043;
|
||||
const TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA = 0x0044;
|
||||
const TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA = 0x0045;
|
||||
const TLS_DH_ANON_WITH_CAMELLIA_128_CBC_SHA = 0x0046;
|
||||
const TLS_RSA_EXPORT1024_WITH_RC4_56_MD5 = 0x0060;
|
||||
const TLS_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5 = 0x0061;
|
||||
const TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA = 0x0062;
|
||||
const TLS_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA = 0x0063;
|
||||
const TLS_RSA_EXPORT1024_WITH_RC4_56_SHA = 0x0064;
|
||||
const TLS_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA = 0x0065;
|
||||
const TLS_DHE_DSS_WITH_RC4_128_SHA = 0x0066;
|
||||
const TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 = 0x0067;
|
||||
const TLS_DH_DSS_WITH_AES_256_CBC_SHA256 = 0x0068;
|
||||
const TLS_DH_RSA_WITH_AES_256_CBC_SHA256 = 0x0069;
|
||||
const TLS_DHE_DSS_WITH_AES_256_CBC_SHA256 = 0x006A;
|
||||
const TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 = 0x006B;
|
||||
const TLS_DH_ANON_WITH_AES_128_CBC_SHA256 = 0x006C;
|
||||
const TLS_DH_ANON_WITH_AES_256_CBC_SHA256 = 0x006D;
|
||||
const TLS_RSA_WITH_CAMELLIA_256_CBC_SHA = 0x0084;
|
||||
const TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA = 0x0085;
|
||||
const TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA = 0x0086;
|
||||
const TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA = 0x0087;
|
||||
const TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA = 0x0088;
|
||||
const TLS_DH_ANON_WITH_CAMELLIA_256_CBC_SHA = 0x0089;
|
||||
const TLS_PSK_WITH_RC4_128_SHA = 0x008A;
|
||||
const TLS_PSK_WITH_3DES_EDE_CBC_SHA = 0x008B;
|
||||
const TLS_PSK_WITH_AES_128_CBC_SHA = 0x008C;
|
||||
const TLS_PSK_WITH_AES_256_CBC_SHA = 0x008D;
|
||||
const TLS_DHE_PSK_WITH_RC4_128_SHA = 0x008E;
|
||||
const TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA = 0x008F;
|
||||
const TLS_DHE_PSK_WITH_AES_128_CBC_SHA = 0x0090;
|
||||
const TLS_DHE_PSK_WITH_AES_256_CBC_SHA = 0x0091;
|
||||
const TLS_RSA_PSK_WITH_RC4_128_SHA = 0x0092;
|
||||
const TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA = 0x0093;
|
||||
const TLS_RSA_PSK_WITH_AES_128_CBC_SHA = 0x0094;
|
||||
const TLS_RSA_PSK_WITH_AES_256_CBC_SHA = 0x0095;
|
||||
const TLS_RSA_WITH_SEED_CBC_SHA = 0x0096;
|
||||
const TLS_DH_DSS_WITH_SEED_CBC_SHA = 0x0097;
|
||||
const TLS_DH_RSA_WITH_SEED_CBC_SHA = 0x0098;
|
||||
const TLS_DHE_DSS_WITH_SEED_CBC_SHA = 0x0099;
|
||||
const TLS_DHE_RSA_WITH_SEED_CBC_SHA = 0x009A;
|
||||
const TLS_DH_ANON_WITH_SEED_CBC_SHA = 0x009B;
|
||||
const TLS_RSA_WITH_AES_128_GCM_SHA256 = 0x009C;
|
||||
const TLS_RSA_WITH_AES_256_GCM_SHA384 = 0x009D;
|
||||
const TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 = 0x009E;
|
||||
const TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 = 0x009F;
|
||||
const TLS_DH_RSA_WITH_AES_128_GCM_SHA256 = 0x00A0;
|
||||
const TLS_DH_RSA_WITH_AES_256_GCM_SHA384 = 0x00A1;
|
||||
const TLS_DHE_DSS_WITH_AES_128_GCM_SHA256 = 0x00A2;
|
||||
const TLS_DHE_DSS_WITH_AES_256_GCM_SHA384 = 0x00A3;
|
||||
const TLS_DH_DSS_WITH_AES_128_GCM_SHA256 = 0x00A4;
|
||||
const TLS_DH_DSS_WITH_AES_256_GCM_SHA384 = 0x00A5;
|
||||
const TLS_DH_ANON_WITH_AES_128_GCM_SHA256 = 0x00A6;
|
||||
const TLS_DH_ANON_WITH_AES_256_GCM_SHA384 = 0x00A7;
|
||||
const TLS_PSK_WITH_AES_128_GCM_SHA256 = 0x00A8;
|
||||
const TLS_PSK_WITH_AES_256_GCM_SHA384 = 0x00A9;
|
||||
const TLS_DHE_PSK_WITH_AES_128_GCM_SHA256 = 0x00AA;
|
||||
const TLS_DHE_PSK_WITH_AES_256_GCM_SHA384 = 0x00AB;
|
||||
const TLS_RSA_PSK_WITH_AES_128_GCM_SHA256 = 0x00AC;
|
||||
const TLS_RSA_PSK_WITH_AES_256_GCM_SHA384 = 0x00AD;
|
||||
const TLS_PSK_WITH_AES_128_CBC_SHA256 = 0x00AE;
|
||||
const TLS_PSK_WITH_AES_256_CBC_SHA384 = 0x00AF;
|
||||
const TLS_PSK_WITH_NULL_SHA256 = 0x00B0;
|
||||
const TLS_PSK_WITH_NULL_SHA384 = 0x00B1;
|
||||
const TLS_DHE_PSK_WITH_AES_128_CBC_SHA256 = 0x00B2;
|
||||
const TLS_DHE_PSK_WITH_AES_256_CBC_SHA384 = 0x00B3;
|
||||
const TLS_DHE_PSK_WITH_NULL_SHA256 = 0x00B4;
|
||||
const TLS_DHE_PSK_WITH_NULL_SHA384 = 0x00B5;
|
||||
const TLS_RSA_PSK_WITH_AES_128_CBC_SHA256 = 0x00B6;
|
||||
const TLS_RSA_PSK_WITH_AES_256_CBC_SHA384 = 0x00B7;
|
||||
const TLS_RSA_PSK_WITH_NULL_SHA256 = 0x00B8;
|
||||
const TLS_RSA_PSK_WITH_NULL_SHA384 = 0x00B9;
|
||||
const TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256 = 0x00BA;
|
||||
const TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA256 = 0x00BB;
|
||||
const TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA256 = 0x00BC;
|
||||
const TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA256 = 0x00BD;
|
||||
const TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 = 0x00BE;
|
||||
const TLS_DH_ANON_WITH_CAMELLIA_128_CBC_SHA256 = 0x00BF;
|
||||
const TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256 = 0x00C0;
|
||||
const TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA256 = 0x00C1;
|
||||
const TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA256 = 0x00C2;
|
||||
const TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA256 = 0x00C3;
|
||||
const TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256 = 0x00C4;
|
||||
const TLS_DH_ANON_WITH_CAMELLIA_256_CBC_SHA256 = 0x00C5;
|
||||
const TLS_ECDH_ECDSA_WITH_NULL_SHA = 0xC001;
|
||||
const TLS_ECDH_ECDSA_WITH_RC4_128_SHA = 0xC002;
|
||||
const TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA = 0xC003;
|
||||
const TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA = 0xC004;
|
||||
const TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA = 0xC005;
|
||||
const TLS_ECDHE_ECDSA_WITH_NULL_SHA = 0xC006;
|
||||
const TLS_ECDHE_ECDSA_WITH_RC4_128_SHA = 0xC007;
|
||||
const TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA = 0xC008;
|
||||
const TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA = 0xC009;
|
||||
const TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA = 0xC00A;
|
||||
const TLS_ECDH_RSA_WITH_NULL_SHA = 0xC00B;
|
||||
const TLS_ECDH_RSA_WITH_RC4_128_SHA = 0xC00C;
|
||||
const TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA = 0xC00D;
|
||||
const TLS_ECDH_RSA_WITH_AES_128_CBC_SHA = 0xC00E;
|
||||
const TLS_ECDH_RSA_WITH_AES_256_CBC_SHA = 0xC00F;
|
||||
const TLS_ECDHE_RSA_WITH_NULL_SHA = 0xC010;
|
||||
const TLS_ECDHE_RSA_WITH_RC4_128_SHA = 0xC011;
|
||||
const TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA = 0xC012;
|
||||
const TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA = 0xC013;
|
||||
const TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA = 0xC014;
|
||||
const TLS_ECDH_ANON_WITH_NULL_SHA = 0xC015;
|
||||
const TLS_ECDH_ANON_WITH_RC4_128_SHA = 0xC016;
|
||||
const TLS_ECDH_ANON_WITH_3DES_EDE_CBC_SHA = 0xC017;
|
||||
const TLS_ECDH_ANON_WITH_AES_128_CBC_SHA = 0xC018;
|
||||
const TLS_ECDH_ANON_WITH_AES_256_CBC_SHA = 0xC019;
|
||||
const TLS_SRP_SHA_WITH_3DES_EDE_CBC_SHA = 0xC01A;
|
||||
const TLS_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA = 0xC01B;
|
||||
const TLS_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA = 0xC01C;
|
||||
const TLS_SRP_SHA_WITH_AES_128_CBC_SHA = 0xC01D;
|
||||
const TLS_SRP_SHA_RSA_WITH_AES_128_CBC_SHA = 0xC01E;
|
||||
const TLS_SRP_SHA_DSS_WITH_AES_128_CBC_SHA = 0xC01F;
|
||||
const TLS_SRP_SHA_WITH_AES_256_CBC_SHA = 0xC020;
|
||||
const TLS_SRP_SHA_RSA_WITH_AES_256_CBC_SHA = 0xC021;
|
||||
const TLS_SRP_SHA_DSS_WITH_AES_256_CBC_SHA = 0xC022;
|
||||
const TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 = 0xC023;
|
||||
const TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 = 0xC024;
|
||||
const TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256 = 0xC025;
|
||||
const TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384 = 0xC026;
|
||||
const TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 = 0xC027;
|
||||
const TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 = 0xC028;
|
||||
const TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256 = 0xC029;
|
||||
const TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384 = 0xC02A;
|
||||
const TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 = 0xC02B;
|
||||
const TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 = 0xC02C;
|
||||
const TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256 = 0xC02D;
|
||||
const TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384 = 0xC02E;
|
||||
const TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 = 0xC02F;
|
||||
const TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 = 0xC030;
|
||||
const TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256 = 0xC031;
|
||||
const TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384 = 0xC032;
|
||||
const TLS_ECDHE_PSK_WITH_RC4_128_SHA = 0xC033;
|
||||
const TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA = 0xC034;
|
||||
const TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA = 0xC035;
|
||||
const TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA = 0xC036;
|
||||
const TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256 = 0xC037;
|
||||
const TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384 = 0xC038;
|
||||
const TLS_ECDHE_PSK_WITH_NULL_SHA = 0xC039;
|
||||
const TLS_ECDHE_PSK_WITH_NULL_SHA256 = 0xC03A;
|
||||
const TLS_ECDHE_PSK_WITH_NULL_SHA384 = 0xC03B;
|
||||
const SSL_RSA_FIPS_WITH_DES_CBC_SHA = 0xFEFE;
|
||||
const SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA = 0xFEFF;
|
||||
const SSL_RSA_FIPS_WITH_DES_CBC_SHA_2 = 0xFFE1;
|
||||
const SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA_2 = 0xFFE0;
|
||||
const SSL_RSA_WITH_RC2_CBC_MD5 = 0xFF80;
|
||||
const SSL_RSA_WITH_IDEA_CBC_MD5 = 0xFF81;
|
||||
const SSL_RSA_WITH_DES_CBC_MD5 = 0xFF82;
|
||||
const SSL_RSA_WITH_3DES_EDE_CBC_MD5 = 0xFF83;
|
||||
const TLS_EMPTY_RENEGOTIATION_INFO_SCSV = 0x00FF;
|
||||
|
||||
|
||||
# Cipher specifications native to TLS can be included in Version 2.0 client
|
||||
# hello messages using the syntax below. Any V2CipherSpec element with its
|
||||
# first byte equal to zero will be ignored by Version 2.0 servers. Clients
|
||||
# sending any of the above V2CipherSpecs should also include the TLS equivalent
|
||||
# (see Appendix A.5):
|
||||
# V2CipherSpec (see TLS name) = { 0x00, CipherSuite };
|
||||
|
||||
|
||||
# --- This is a table of all known cipher specs.
|
||||
# --- It can be used for detecting unknown ciphers and for
|
||||
# --- converting the cipher spec constants into a human readable format.
|
||||
|
||||
const ssl_cipher_desc: table[count] of string = {
|
||||
# --- sslv20 ---
|
||||
[SSLv20_CK_RC4_128_EXPORT40_WITH_MD5] =
|
||||
"SSLv20_CK_RC4_128_EXPORT40_WITH_MD5",
|
||||
[SSLv20_CK_RC4_128_WITH_MD5] = "SSLv20_CK_RC4_128_WITH_MD5",
|
||||
[SSLv20_CK_RC2_128_CBC_WITH_MD5] = "SSLv20_CK_RC2_128_CBC_WITH_MD5",
|
||||
[SSLv20_CK_RC2_128_CBC_EXPORT40_WITH_MD5] =
|
||||
"SSLv20_CK_RC2_128_CBC_EXPORT40_WITH_MD5",
|
||||
[SSLv20_CK_IDEA_128_CBC_WITH_MD5] = "SSLv20_CK_IDEA_128_CBC_WITH_MD5",
|
||||
[SSLv20_CK_DES_192_EDE3_CBC_WITH_MD5] =
|
||||
"SSLv20_CK_DES_192_EDE3_CBC_WITH_MD5",
|
||||
[SSLv20_CK_DES_64_CBC_WITH_MD5] = "SSLv20_CK_DES_64_CBC_WITH_MD5",
|
||||
|
||||
# --- TLS ---
|
||||
[TLS_NULL_WITH_NULL_NULL] = "TLS_NULL_WITH_NULL_NULL",
|
||||
[TLS_RSA_WITH_NULL_MD5] = "TLS_RSA_WITH_NULL_MD5",
|
||||
[TLS_RSA_WITH_NULL_SHA] = "TLS_RSA_WITH_NULL_SHA",
|
||||
[TLS_RSA_EXPORT_WITH_RC4_40_MD5] = "TLS_RSA_EXPORT_WITH_RC4_40_MD5",
|
||||
[TLS_RSA_WITH_RC4_128_MD5] = "TLS_RSA_WITH_RC4_128_MD5",
|
||||
[TLS_RSA_WITH_RC4_128_SHA] = "TLS_RSA_WITH_RC4_128_SHA",
|
||||
[TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5] = "TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5",
|
||||
[TLS_RSA_WITH_IDEA_CBC_SHA] = "TLS_RSA_WITH_IDEA_CBC_SHA",
|
||||
[TLS_RSA_EXPORT_WITH_DES40_CBC_SHA] = "TLS_RSA_EXPORT_WITH_DES40_CBC_SHA",
|
||||
[TLS_RSA_WITH_DES_CBC_SHA] = "TLS_RSA_WITH_DES_CBC_SHA",
|
||||
[TLS_RSA_WITH_3DES_EDE_CBC_SHA] = "TLS_RSA_WITH_3DES_EDE_CBC_SHA",
|
||||
[TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA] = "TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA",
|
||||
[TLS_DH_DSS_WITH_DES_CBC_SHA] = "TLS_DH_DSS_WITH_DES_CBC_SHA",
|
||||
[TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA] = "TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA",
|
||||
[TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA] = "TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA",
|
||||
[TLS_DH_RSA_WITH_DES_CBC_SHA] = "TLS_DH_RSA_WITH_DES_CBC_SHA",
|
||||
[TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA] = "TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA",
|
||||
[TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA] = "TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA",
|
||||
[TLS_DHE_DSS_WITH_DES_CBC_SHA] = "TLS_DHE_DSS_WITH_DES_CBC_SHA",
|
||||
[TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA] = "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA",
|
||||
[TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA] = "TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA",
|
||||
[TLS_DHE_RSA_WITH_DES_CBC_SHA] = "TLS_DHE_RSA_WITH_DES_CBC_SHA",
|
||||
[TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA] = "TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA",
|
||||
[TLS_DH_ANON_EXPORT_WITH_RC4_40_MD5] = "TLS_DH_ANON_EXPORT_WITH_RC4_40_MD5",
|
||||
[TLS_DH_ANON_WITH_RC4_128_MD5] = "TLS_DH_ANON_WITH_RC4_128_MD5",
|
||||
[TLS_DH_ANON_EXPORT_WITH_DES40_CBC_SHA] = "TLS_DH_ANON_EXPORT_WITH_DES40_CBC_SHA",
|
||||
[TLS_DH_ANON_WITH_DES_CBC_SHA] = "TLS_DH_ANON_WITH_DES_CBC_SHA",
|
||||
[TLS_DH_ANON_WITH_3DES_EDE_CBC_SHA] = "TLS_DH_ANON_WITH_3DES_EDE_CBC_SHA",
|
||||
[SSL_FORTEZZA_KEA_WITH_NULL_SHA] = "SSL_FORTEZZA_KEA_WITH_NULL_SHA",
|
||||
[SSL_FORTEZZA_KEA_WITH_FORTEZZA_CBC_SHA] = "SSL_FORTEZZA_KEA_WITH_FORTEZZA_CBC_SHA",
|
||||
[TLS_KRB5_WITH_DES_CBC_SHA] = "TLS_KRB5_WITH_DES_CBC_SHA",
|
||||
[TLS_KRB5_WITH_3DES_EDE_CBC_SHA] = "TLS_KRB5_WITH_3DES_EDE_CBC_SHA",
|
||||
[TLS_KRB5_WITH_RC4_128_SHA] = "TLS_KRB5_WITH_RC4_128_SHA",
|
||||
[TLS_KRB5_WITH_IDEA_CBC_SHA] = "TLS_KRB5_WITH_IDEA_CBC_SHA",
|
||||
[TLS_KRB5_WITH_DES_CBC_MD5] = "TLS_KRB5_WITH_DES_CBC_MD5",
|
||||
[TLS_KRB5_WITH_3DES_EDE_CBC_MD5] = "TLS_KRB5_WITH_3DES_EDE_CBC_MD5",
|
||||
[TLS_KRB5_WITH_RC4_128_MD5] = "TLS_KRB5_WITH_RC4_128_MD5",
|
||||
[TLS_KRB5_WITH_IDEA_CBC_MD5] = "TLS_KRB5_WITH_IDEA_CBC_MD5",
|
||||
[TLS_KRB5_EXPORT_WITH_DES_CBC_40_SHA] = "TLS_KRB5_EXPORT_WITH_DES_CBC_40_SHA",
|
||||
[TLS_KRB5_EXPORT_WITH_RC2_CBC_40_SHA] = "TLS_KRB5_EXPORT_WITH_RC2_CBC_40_SHA",
|
||||
[TLS_KRB5_EXPORT_WITH_RC4_40_SHA] = "TLS_KRB5_EXPORT_WITH_RC4_40_SHA",
|
||||
[TLS_KRB5_EXPORT_WITH_DES_CBC_40_MD5] = "TLS_KRB5_EXPORT_WITH_DES_CBC_40_MD5",
|
||||
[TLS_KRB5_EXPORT_WITH_RC2_CBC_40_MD5] = "TLS_KRB5_EXPORT_WITH_RC2_CBC_40_MD5",
|
||||
[TLS_KRB5_EXPORT_WITH_RC4_40_MD5] = "TLS_KRB5_EXPORT_WITH_RC4_40_MD5",
|
||||
[TLS_RSA_WITH_AES_128_CBC_SHA] = "TLS_RSA_WITH_AES_128_CBC_SHA",
|
||||
[TLS_DH_DSS_WITH_AES_128_CBC_SHA] = "TLS_DH_DSS_WITH_AES_128_CBC_SHA",
|
||||
[TLS_DH_RSA_WITH_AES_128_CBC_SHA] = "TLS_DH_RSA_WITH_AES_128_CBC_SHA",
|
||||
[TLS_DHE_DSS_WITH_AES_128_CBC_SHA] = "TLS_DHE_DSS_WITH_AES_128_CBC_SHA",
|
||||
[TLS_DHE_RSA_WITH_AES_128_CBC_SHA] = "TLS_DHE_RSA_WITH_AES_128_CBC_SHA",
|
||||
[TLS_DH_ANON_WITH_AES_128_CBC_SHA] = "TLS_DH_ANON_WITH_AES_128_CBC_SHA",
|
||||
[TLS_RSA_WITH_AES_256_CBC_SHA] = "TLS_RSA_WITH_AES_256_CBC_SHA",
|
||||
[TLS_DH_DSS_WITH_AES_256_CBC_SHA] = "TLS_DH_DSS_WITH_AES_256_CBC_SHA",
|
||||
[TLS_DH_RSA_WITH_AES_256_CBC_SHA] = "TLS_DH_RSA_WITH_AES_256_CBC_SHA",
|
||||
[TLS_DHE_DSS_WITH_AES_256_CBC_SHA] = "TLS_DHE_DSS_WITH_AES_256_CBC_SHA",
|
||||
[TLS_DHE_RSA_WITH_AES_256_CBC_SHA] = "TLS_DHE_RSA_WITH_AES_256_CBC_SHA",
|
||||
[TLS_DH_ANON_WITH_AES_256_CBC_SHA] = "TLS_DH_ANON_WITH_AES_256_CBC_SHA",
|
||||
[TLS_RSA_WITH_NULL_SHA256] = "TLS_RSA_WITH_NULL_SHA256",
|
||||
[TLS_RSA_WITH_AES_128_CBC_SHA256] = "TLS_RSA_WITH_AES_128_CBC_SHA256",
|
||||
[TLS_RSA_WITH_AES_256_CBC_SHA256] = "TLS_RSA_WITH_AES_256_CBC_SHA256",
|
||||
[TLS_DH_DSS_WITH_AES_128_CBC_SHA256] = "TLS_DH_DSS_WITH_AES_128_CBC_SHA256",
|
||||
[TLS_DH_RSA_WITH_AES_128_CBC_SHA256] = "TLS_DH_RSA_WITH_AES_128_CBC_SHA256",
|
||||
[TLS_DHE_DSS_WITH_AES_128_CBC_SHA256] = "TLS_DHE_DSS_WITH_AES_128_CBC_SHA256",
|
||||
[TLS_RSA_WITH_CAMELLIA_128_CBC_SHA] = "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA",
|
||||
[TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA] = "TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA",
|
||||
[TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA] = "TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA",
|
||||
[TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA] = "TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA",
|
||||
[TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA] = "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA",
|
||||
[TLS_DH_ANON_WITH_CAMELLIA_128_CBC_SHA] = "TLS_DH_ANON_WITH_CAMELLIA_128_CBC_SHA",
|
||||
[TLS_RSA_EXPORT1024_WITH_RC4_56_MD5] = "TLS_RSA_EXPORT1024_WITH_RC4_56_MD5",
|
||||
[TLS_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5] = "TLS_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5",
|
||||
[TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA] = "TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA",
|
||||
[TLS_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA] = "TLS_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA",
|
||||
[TLS_RSA_EXPORT1024_WITH_RC4_56_SHA] = "TLS_RSA_EXPORT1024_WITH_RC4_56_SHA",
|
||||
[TLS_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA] = "TLS_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA",
|
||||
[TLS_DHE_DSS_WITH_RC4_128_SHA] = "TLS_DHE_DSS_WITH_RC4_128_SHA",
|
||||
[TLS_DHE_RSA_WITH_AES_128_CBC_SHA256] = "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256",
|
||||
[TLS_DH_DSS_WITH_AES_256_CBC_SHA256] = "TLS_DH_DSS_WITH_AES_256_CBC_SHA256",
|
||||
[TLS_DH_RSA_WITH_AES_256_CBC_SHA256] = "TLS_DH_RSA_WITH_AES_256_CBC_SHA256",
|
||||
[TLS_DHE_DSS_WITH_AES_256_CBC_SHA256] = "TLS_DHE_DSS_WITH_AES_256_CBC_SHA256",
|
||||
[TLS_DHE_RSA_WITH_AES_256_CBC_SHA256] = "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256",
|
||||
[TLS_DH_ANON_WITH_AES_128_CBC_SHA256] = "TLS_DH_ANON_WITH_AES_128_CBC_SHA256",
|
||||
[TLS_DH_ANON_WITH_AES_256_CBC_SHA256] = "TLS_DH_ANON_WITH_AES_256_CBC_SHA256",
|
||||
[TLS_RSA_WITH_CAMELLIA_256_CBC_SHA] = "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA",
|
||||
[TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA] = "TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA",
|
||||
[TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA] = "TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA",
|
||||
[TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA] = "TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA",
|
||||
[TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA] = "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA",
|
||||
[TLS_DH_ANON_WITH_CAMELLIA_256_CBC_SHA] = "TLS_DH_ANON_WITH_CAMELLIA_256_CBC_SHA",
|
||||
[TLS_PSK_WITH_RC4_128_SHA] = "TLS_PSK_WITH_RC4_128_SHA",
|
||||
[TLS_PSK_WITH_3DES_EDE_CBC_SHA] = "TLS_PSK_WITH_3DES_EDE_CBC_SHA",
|
||||
[TLS_PSK_WITH_AES_128_CBC_SHA] = "TLS_PSK_WITH_AES_128_CBC_SHA",
|
||||
[TLS_PSK_WITH_AES_256_CBC_SHA] = "TLS_PSK_WITH_AES_256_CBC_SHA",
|
||||
[TLS_DHE_PSK_WITH_RC4_128_SHA] = "TLS_DHE_PSK_WITH_RC4_128_SHA",
|
||||
[TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA] = "TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA",
|
||||
[TLS_DHE_PSK_WITH_AES_128_CBC_SHA] = "TLS_DHE_PSK_WITH_AES_128_CBC_SHA",
|
||||
[TLS_DHE_PSK_WITH_AES_256_CBC_SHA] = "TLS_DHE_PSK_WITH_AES_256_CBC_SHA",
|
||||
[TLS_RSA_PSK_WITH_RC4_128_SHA] = "TLS_RSA_PSK_WITH_RC4_128_SHA",
|
||||
[TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA] = "TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA",
|
||||
[TLS_RSA_PSK_WITH_AES_128_CBC_SHA] = "TLS_RSA_PSK_WITH_AES_128_CBC_SHA",
|
||||
[TLS_RSA_PSK_WITH_AES_256_CBC_SHA] = "TLS_RSA_PSK_WITH_AES_256_CBC_SHA",
|
||||
[TLS_RSA_WITH_SEED_CBC_SHA] = "TLS_RSA_WITH_SEED_CBC_SHA",
|
||||
[TLS_DH_DSS_WITH_SEED_CBC_SHA] = "TLS_DH_DSS_WITH_SEED_CBC_SHA",
|
||||
[TLS_DH_RSA_WITH_SEED_CBC_SHA] = "TLS_DH_RSA_WITH_SEED_CBC_SHA",
|
||||
[TLS_DHE_DSS_WITH_SEED_CBC_SHA] = "TLS_DHE_DSS_WITH_SEED_CBC_SHA",
|
||||
[TLS_DHE_RSA_WITH_SEED_CBC_SHA] = "TLS_DHE_RSA_WITH_SEED_CBC_SHA",
|
||||
[TLS_DH_ANON_WITH_SEED_CBC_SHA] = "TLS_DH_ANON_WITH_SEED_CBC_SHA",
|
||||
[TLS_RSA_WITH_AES_128_GCM_SHA256] = "TLS_RSA_WITH_AES_128_GCM_SHA256",
|
||||
[TLS_RSA_WITH_AES_256_GCM_SHA384] = "TLS_RSA_WITH_AES_256_GCM_SHA384",
|
||||
[TLS_DHE_RSA_WITH_AES_128_GCM_SHA256] = "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256",
|
||||
[TLS_DHE_RSA_WITH_AES_256_GCM_SHA384] = "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384",
|
||||
[TLS_DH_RSA_WITH_AES_128_GCM_SHA256] = "TLS_DH_RSA_WITH_AES_128_GCM_SHA256",
|
||||
[TLS_DH_RSA_WITH_AES_256_GCM_SHA384] = "TLS_DH_RSA_WITH_AES_256_GCM_SHA384",
|
||||
[TLS_DHE_DSS_WITH_AES_128_GCM_SHA256] = "TLS_DHE_DSS_WITH_AES_128_GCM_SHA256",
|
||||
[TLS_DHE_DSS_WITH_AES_256_GCM_SHA384] = "TLS_DHE_DSS_WITH_AES_256_GCM_SHA384",
|
||||
[TLS_DH_DSS_WITH_AES_128_GCM_SHA256] = "TLS_DH_DSS_WITH_AES_128_GCM_SHA256",
|
||||
[TLS_DH_DSS_WITH_AES_256_GCM_SHA384] = "TLS_DH_DSS_WITH_AES_256_GCM_SHA384",
|
||||
[TLS_DH_ANON_WITH_AES_128_GCM_SHA256] = "TLS_DH_ANON_WITH_AES_128_GCM_SHA256",
|
||||
[TLS_DH_ANON_WITH_AES_256_GCM_SHA384] = "TLS_DH_ANON_WITH_AES_256_GCM_SHA384",
|
||||
[TLS_PSK_WITH_AES_128_GCM_SHA256] = "TLS_PSK_WITH_AES_128_GCM_SHA256",
|
||||
[TLS_PSK_WITH_AES_256_GCM_SHA384] = "TLS_PSK_WITH_AES_256_GCM_SHA384",
|
||||
[TLS_DHE_PSK_WITH_AES_128_GCM_SHA256] = "TLS_DHE_PSK_WITH_AES_128_GCM_SHA256",
|
||||
[TLS_DHE_PSK_WITH_AES_256_GCM_SHA384] = "TLS_DHE_PSK_WITH_AES_256_GCM_SHA384",
|
||||
[TLS_RSA_PSK_WITH_AES_128_GCM_SHA256] = "TLS_RSA_PSK_WITH_AES_128_GCM_SHA256",
|
||||
[TLS_RSA_PSK_WITH_AES_256_GCM_SHA384] = "TLS_RSA_PSK_WITH_AES_256_GCM_SHA384",
|
||||
[TLS_PSK_WITH_AES_128_CBC_SHA256] = "TLS_PSK_WITH_AES_128_CBC_SHA256",
|
||||
[TLS_PSK_WITH_AES_256_CBC_SHA384] = "TLS_PSK_WITH_AES_256_CBC_SHA384",
|
||||
[TLS_PSK_WITH_NULL_SHA256] = "TLS_PSK_WITH_NULL_SHA256",
|
||||
[TLS_PSK_WITH_NULL_SHA384] = "TLS_PSK_WITH_NULL_SHA384",
|
||||
[TLS_DHE_PSK_WITH_AES_128_CBC_SHA256] = "TLS_DHE_PSK_WITH_AES_128_CBC_SHA256",
|
||||
[TLS_DHE_PSK_WITH_AES_256_CBC_SHA384] = "TLS_DHE_PSK_WITH_AES_256_CBC_SHA384",
|
||||
[TLS_DHE_PSK_WITH_NULL_SHA256] = "TLS_DHE_PSK_WITH_NULL_SHA256",
|
||||
[TLS_DHE_PSK_WITH_NULL_SHA384] = "TLS_DHE_PSK_WITH_NULL_SHA384",
|
||||
[TLS_RSA_PSK_WITH_AES_128_CBC_SHA256] = "TLS_RSA_PSK_WITH_AES_128_CBC_SHA256",
|
||||
[TLS_RSA_PSK_WITH_AES_256_CBC_SHA384] = "TLS_RSA_PSK_WITH_AES_256_CBC_SHA384",
|
||||
[TLS_RSA_PSK_WITH_NULL_SHA256] = "TLS_RSA_PSK_WITH_NULL_SHA256",
|
||||
[TLS_RSA_PSK_WITH_NULL_SHA384] = "TLS_RSA_PSK_WITH_NULL_SHA384",
|
||||
[TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256] = "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256",
|
||||
[TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA256] = "TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA256",
|
||||
[TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA256] = "TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA256",
|
||||
[TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA256] = "TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA256",
|
||||
[TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256] = "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256",
|
||||
[TLS_DH_ANON_WITH_CAMELLIA_128_CBC_SHA256] = "TLS_DH_ANON_WITH_CAMELLIA_128_CBC_SHA256",
|
||||
[TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256] = "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256",
|
||||
[TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA256] = "TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA256",
|
||||
[TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA256] = "TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA256",
|
||||
[TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA256] = "TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA256",
|
||||
[TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256] = "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256",
|
||||
[TLS_DH_ANON_WITH_CAMELLIA_256_CBC_SHA256] = "TLS_DH_ANON_WITH_CAMELLIA_256_CBC_SHA256",
|
||||
[TLS_ECDH_ECDSA_WITH_NULL_SHA] = "TLS_ECDH_ECDSA_WITH_NULL_SHA",
|
||||
[TLS_ECDH_ECDSA_WITH_RC4_128_SHA] = "TLS_ECDH_ECDSA_WITH_RC4_128_SHA",
|
||||
[TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA] = "TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA",
|
||||
[TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA] = "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA",
|
||||
[TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA] = "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA",
|
||||
[TLS_ECDHE_ECDSA_WITH_NULL_SHA] = "TLS_ECDHE_ECDSA_WITH_NULL_SHA",
|
||||
[TLS_ECDHE_ECDSA_WITH_RC4_128_SHA] = "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA",
|
||||
[TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA] = "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA",
|
||||
[TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA] = "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA",
|
||||
[TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA] = "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA",
|
||||
[TLS_ECDH_RSA_WITH_NULL_SHA] = "TLS_ECDH_RSA_WITH_NULL_SHA",
|
||||
[TLS_ECDH_RSA_WITH_RC4_128_SHA] = "TLS_ECDH_RSA_WITH_RC4_128_SHA",
|
||||
[TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA] = "TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA",
|
||||
[TLS_ECDH_RSA_WITH_AES_128_CBC_SHA] = "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA",
|
||||
[TLS_ECDH_RSA_WITH_AES_256_CBC_SHA] = "TLS_ECDH_RSA_WITH_AES_256_CBC_SHA",
|
||||
[TLS_ECDHE_RSA_WITH_NULL_SHA] = "TLS_ECDHE_RSA_WITH_NULL_SHA",
|
||||
[TLS_ECDHE_RSA_WITH_RC4_128_SHA] = "TLS_ECDHE_RSA_WITH_RC4_128_SHA",
|
||||
[TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA] = "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA",
|
||||
[TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA] = "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA",
|
||||
[TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA] = "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA",
|
||||
[TLS_ECDH_ANON_WITH_NULL_SHA] = "TLS_ECDH_ANON_WITH_NULL_SHA",
|
||||
[TLS_ECDH_ANON_WITH_RC4_128_SHA] = "TLS_ECDH_ANON_WITH_RC4_128_SHA",
|
||||
[TLS_ECDH_ANON_WITH_3DES_EDE_CBC_SHA] = "TLS_ECDH_ANON_WITH_3DES_EDE_CBC_SHA",
|
||||
[TLS_ECDH_ANON_WITH_AES_128_CBC_SHA] = "TLS_ECDH_ANON_WITH_AES_128_CBC_SHA",
|
||||
[TLS_ECDH_ANON_WITH_AES_256_CBC_SHA] = "TLS_ECDH_ANON_WITH_AES_256_CBC_SHA",
|
||||
[TLS_SRP_SHA_WITH_3DES_EDE_CBC_SHA] = "TLS_SRP_SHA_WITH_3DES_EDE_CBC_SHA",
|
||||
[TLS_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA] = "TLS_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA",
|
||||
[TLS_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA] = "TLS_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA",
|
||||
[TLS_SRP_SHA_WITH_AES_128_CBC_SHA] = "TLS_SRP_SHA_WITH_AES_128_CBC_SHA",
|
||||
[TLS_SRP_SHA_RSA_WITH_AES_128_CBC_SHA] = "TLS_SRP_SHA_RSA_WITH_AES_128_CBC_SHA",
|
||||
[TLS_SRP_SHA_DSS_WITH_AES_128_CBC_SHA] = "TLS_SRP_SHA_DSS_WITH_AES_128_CBC_SHA",
|
||||
[TLS_SRP_SHA_WITH_AES_256_CBC_SHA] = "TLS_SRP_SHA_WITH_AES_256_CBC_SHA",
|
||||
[TLS_SRP_SHA_RSA_WITH_AES_256_CBC_SHA] = "TLS_SRP_SHA_RSA_WITH_AES_256_CBC_SHA",
|
||||
[TLS_SRP_SHA_DSS_WITH_AES_256_CBC_SHA] = "TLS_SRP_SHA_DSS_WITH_AES_256_CBC_SHA",
|
||||
[TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256] = "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256",
|
||||
[TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384] = "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384",
|
||||
[TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256] = "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256",
|
||||
[TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384] = "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384",
|
||||
[TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256] = "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256",
|
||||
[TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384] = "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384",
|
||||
[TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256] = "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256",
|
||||
[TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384] = "TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384",
|
||||
[TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256] = "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
|
||||
[TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384] = "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
|
||||
[TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256] = "TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256",
|
||||
[TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384] = "TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384",
|
||||
[TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256] = "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
|
||||
[TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384] = "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
|
||||
[TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256] = "TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256",
|
||||
[TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384] = "TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384",
|
||||
[TLS_ECDHE_PSK_WITH_RC4_128_SHA] = "TLS_ECDHE_PSK_WITH_RC4_128_SHA",
|
||||
[TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA] = "TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA",
|
||||
[TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA] = "TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA",
|
||||
[TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA] = "TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA",
|
||||
[TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256] = "TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256",
|
||||
[TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384] = "TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384",
|
||||
[TLS_ECDHE_PSK_WITH_NULL_SHA] = "TLS_ECDHE_PSK_WITH_NULL_SHA",
|
||||
[TLS_ECDHE_PSK_WITH_NULL_SHA256] = "TLS_ECDHE_PSK_WITH_NULL_SHA256",
|
||||
[TLS_ECDHE_PSK_WITH_NULL_SHA384] = "TLS_ECDHE_PSK_WITH_NULL_SHA384",
|
||||
[SSL_RSA_FIPS_WITH_DES_CBC_SHA] = "SSL_RSA_FIPS_WITH_DES_CBC_SHA",
|
||||
[SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA] = "SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA",
|
||||
[SSL_RSA_FIPS_WITH_DES_CBC_SHA_2] = "SSL_RSA_FIPS_WITH_DES_CBC_SHA_2",
|
||||
[SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA_2] = "SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA_2",
|
||||
} &default="UNKNOWN";
|
||||
|
||||
|
||||
# --- the following sets are provided for convenience
|
||||
|
||||
# --- this set holds all EXPORT ciphers
|
||||
const ssl_cipherset_EXPORT: set[count] = {
|
||||
SSLv20_CK_RC4_128_EXPORT40_WITH_MD5,
|
||||
SSLv20_CK_RC2_128_CBC_EXPORT40_WITH_MD5,
|
||||
TLS_RSA_EXPORT_WITH_RC4_40_MD5,
|
||||
TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5,
|
||||
TLS_RSA_EXPORT_WITH_DES40_CBC_SHA,
|
||||
TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA,
|
||||
TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA,
|
||||
TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA,
|
||||
TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA,
|
||||
TLS_DH_ANON_EXPORT_WITH_RC4_40_MD5,
|
||||
TLS_DH_ANON_EXPORT_WITH_DES40_CBC_SHA,
|
||||
TLS_KRB5_EXPORT_WITH_DES_CBC_40_SHA,
|
||||
TLS_KRB5_EXPORT_WITH_RC2_CBC_40_SHA,
|
||||
TLS_KRB5_EXPORT_WITH_RC4_40_SHA,
|
||||
TLS_KRB5_EXPORT_WITH_DES_CBC_40_MD5,
|
||||
TLS_KRB5_EXPORT_WITH_RC2_CBC_40_MD5,
|
||||
TLS_KRB5_EXPORT_WITH_RC4_40_MD5,
|
||||
TLS_RSA_EXPORT1024_WITH_RC4_56_MD5,
|
||||
TLS_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5,
|
||||
TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA,
|
||||
TLS_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA,
|
||||
TLS_RSA_EXPORT1024_WITH_RC4_56_SHA,
|
||||
TLS_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA,
|
||||
};
|
||||
|
||||
# --- this set holds all DES ciphers
|
||||
const ssl_cipherset_DES: set[count] = {
|
||||
SSLv20_CK_DES_64_CBC_WITH_MD5,
|
||||
TLS_RSA_EXPORT_WITH_DES40_CBC_SHA,
|
||||
TLS_RSA_WITH_DES_CBC_SHA,
|
||||
TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA,
|
||||
TLS_DH_DSS_WITH_DES_CBC_SHA,
|
||||
TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA,
|
||||
TLS_DH_RSA_WITH_DES_CBC_SHA,
|
||||
TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA,
|
||||
TLS_DHE_DSS_WITH_DES_CBC_SHA,
|
||||
TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA,
|
||||
TLS_DHE_RSA_WITH_DES_CBC_SHA,
|
||||
TLS_DH_ANON_EXPORT_WITH_DES40_CBC_SHA,
|
||||
TLS_DH_ANON_WITH_DES_CBC_SHA,
|
||||
TLS_KRB5_WITH_DES_CBC_SHA,
|
||||
TLS_KRB5_WITH_DES_CBC_MD5,
|
||||
TLS_KRB5_EXPORT_WITH_DES_CBC_40_SHA,
|
||||
TLS_KRB5_EXPORT_WITH_DES_CBC_40_MD5,
|
||||
TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA,
|
||||
TLS_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA,
|
||||
SSL_RSA_FIPS_WITH_DES_CBC_SHA,
|
||||
SSL_RSA_FIPS_WITH_DES_CBC_SHA_2,
|
||||
};
|
||||
|
||||
|
||||
# --- this set holds all 3DES ciphers
|
||||
const ssl_cipherset_3DES: set[count] = {
|
||||
SSLv20_CK_DES_192_EDE3_CBC_WITH_MD5,
|
||||
TLS_RSA_WITH_3DES_EDE_CBC_SHA,
|
||||
TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA,
|
||||
TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA,
|
||||
TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA,
|
||||
TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA,
|
||||
TLS_DH_ANON_WITH_3DES_EDE_CBC_SHA,
|
||||
TLS_KRB5_WITH_3DES_EDE_CBC_SHA,
|
||||
TLS_KRB5_WITH_3DES_EDE_CBC_MD5,
|
||||
TLS_PSK_WITH_3DES_EDE_CBC_SHA,
|
||||
TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA,
|
||||
TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA,
|
||||
TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA,
|
||||
TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA,
|
||||
TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA,
|
||||
TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,
|
||||
TLS_ECDH_ANON_WITH_3DES_EDE_CBC_SHA,
|
||||
TLS_SRP_SHA_WITH_3DES_EDE_CBC_SHA,
|
||||
TLS_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA,
|
||||
TLS_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA,
|
||||
TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA,
|
||||
SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA,
|
||||
SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA_2,
|
||||
};
|
||||
|
||||
# --- this set holds all RC2 ciphers
|
||||
const ssl_cipherset_RC2: set[count] = {
|
||||
SSLv20_CK_RC2_128_CBC_WITH_MD5,
|
||||
SSLv20_CK_RC2_128_CBC_EXPORT40_WITH_MD5,
|
||||
TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5,
|
||||
TLS_KRB5_EXPORT_WITH_RC2_CBC_40_SHA,
|
||||
TLS_KRB5_EXPORT_WITH_RC2_CBC_40_MD5,
|
||||
TLS_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5,
|
||||
};
|
||||
|
||||
# --- this set holds all RC4 ciphers
|
||||
const ssl_cipherset_RC4: set[count] = {
|
||||
SSLv20_CK_RC4_128_WITH_MD5,
|
||||
SSLv20_CK_RC4_128_EXPORT40_WITH_MD5,
|
||||
TLS_RSA_EXPORT_WITH_RC4_40_MD5,
|
||||
TLS_RSA_WITH_RC4_128_MD5,
|
||||
TLS_RSA_WITH_RC4_128_SHA,
|
||||
TLS_DH_ANON_EXPORT_WITH_RC4_40_MD5,
|
||||
TLS_DH_ANON_WITH_RC4_128_MD5,
|
||||
TLS_KRB5_WITH_RC4_128_SHA,
|
||||
TLS_KRB5_WITH_RC4_128_MD5,
|
||||
TLS_KRB5_EXPORT_WITH_RC4_40_SHA,
|
||||
TLS_KRB5_EXPORT_WITH_RC4_40_MD5,
|
||||
TLS_RSA_EXPORT1024_WITH_RC4_56_MD5,
|
||||
TLS_RSA_EXPORT1024_WITH_RC4_56_SHA,
|
||||
TLS_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA,
|
||||
TLS_DHE_DSS_WITH_RC4_128_SHA,
|
||||
TLS_PSK_WITH_RC4_128_SHA,
|
||||
TLS_DHE_PSK_WITH_RC4_128_SHA,
|
||||
TLS_RSA_PSK_WITH_RC4_128_SHA,
|
||||
TLS_ECDH_ECDSA_WITH_RC4_128_SHA,
|
||||
TLS_ECDHE_ECDSA_WITH_RC4_128_SHA,
|
||||
TLS_ECDH_RSA_WITH_RC4_128_SHA,
|
||||
TLS_ECDHE_RSA_WITH_RC4_128_SHA,
|
||||
TLS_ECDH_ANON_WITH_RC4_128_SHA,
|
||||
TLS_ECDHE_PSK_WITH_RC4_128_SHA,
|
||||
};
|
||||
|
||||
# --- this set holds all IDEA ciphers
|
||||
const ssl_cipherset_IDEA: set[count] = {
|
||||
SSLv20_CK_IDEA_128_CBC_WITH_MD5,
|
||||
TLS_RSA_WITH_IDEA_CBC_SHA,
|
||||
TLS_KRB5_WITH_IDEA_CBC_SHA,
|
||||
TLS_KRB5_WITH_IDEA_CBC_MD5
|
||||
};
|
||||
|
||||
# --- this set holds all AES ciphers
|
||||
const ssl_cipherset_AES: set[count] = {
|
||||
TLS_RSA_WITH_AES_128_CBC_SHA,
|
||||
TLS_DH_DSS_WITH_AES_128_CBC_SHA,
|
||||
TLS_DH_RSA_WITH_AES_128_CBC_SHA,
|
||||
TLS_DHE_DSS_WITH_AES_128_CBC_SHA,
|
||||
TLS_DHE_RSA_WITH_AES_128_CBC_SHA,
|
||||
TLS_DH_ANON_WITH_AES_128_CBC_SHA,
|
||||
TLS_RSA_WITH_AES_256_CBC_SHA,
|
||||
TLS_DH_DSS_WITH_AES_256_CBC_SHA,
|
||||
TLS_DH_RSA_WITH_AES_256_CBC_SHA,
|
||||
TLS_DHE_DSS_WITH_AES_256_CBC_SHA,
|
||||
TLS_DHE_RSA_WITH_AES_256_CBC_SHA,
|
||||
TLS_DH_ANON_WITH_AES_256_CBC_SHA,
|
||||
TLS_RSA_WITH_AES_128_CBC_SHA256,
|
||||
TLS_RSA_WITH_AES_256_CBC_SHA256,
|
||||
TLS_DH_DSS_WITH_AES_128_CBC_SHA256,
|
||||
TLS_DH_RSA_WITH_AES_128_CBC_SHA256,
|
||||
TLS_DHE_DSS_WITH_AES_128_CBC_SHA256,
|
||||
TLS_DHE_RSA_WITH_AES_128_CBC_SHA256,
|
||||
TLS_DH_DSS_WITH_AES_256_CBC_SHA256,
|
||||
TLS_DH_RSA_WITH_AES_256_CBC_SHA256,
|
||||
TLS_DHE_DSS_WITH_AES_256_CBC_SHA256,
|
||||
TLS_DHE_RSA_WITH_AES_256_CBC_SHA256,
|
||||
TLS_DH_ANON_WITH_AES_128_CBC_SHA256,
|
||||
TLS_DH_ANON_WITH_AES_256_CBC_SHA256,
|
||||
TLS_PSK_WITH_AES_128_CBC_SHA,
|
||||
TLS_PSK_WITH_AES_256_CBC_SHA,
|
||||
TLS_DHE_PSK_WITH_AES_128_CBC_SHA,
|
||||
TLS_DHE_PSK_WITH_AES_256_CBC_SHA,
|
||||
TLS_RSA_PSK_WITH_AES_128_CBC_SHA,
|
||||
TLS_RSA_PSK_WITH_AES_256_CBC_SHA,
|
||||
TLS_RSA_WITH_AES_128_GCM_SHA256,
|
||||
TLS_RSA_WITH_AES_256_GCM_SHA384,
|
||||
TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,
|
||||
TLS_DHE_RSA_WITH_AES_256_GCM_SHA384,
|
||||
TLS_DH_RSA_WITH_AES_128_GCM_SHA256,
|
||||
TLS_DH_RSA_WITH_AES_256_GCM_SHA384,
|
||||
TLS_DHE_DSS_WITH_AES_128_GCM_SHA256,
|
||||
TLS_DHE_DSS_WITH_AES_256_GCM_SHA384,
|
||||
TLS_DH_DSS_WITH_AES_128_GCM_SHA256,
|
||||
TLS_DH_DSS_WITH_AES_256_GCM_SHA384,
|
||||
TLS_DH_ANON_WITH_AES_128_GCM_SHA256,
|
||||
TLS_DH_ANON_WITH_AES_256_GCM_SHA384,
|
||||
TLS_PSK_WITH_AES_128_GCM_SHA256,
|
||||
TLS_PSK_WITH_AES_256_GCM_SHA384,
|
||||
TLS_DHE_PSK_WITH_AES_128_GCM_SHA256,
|
||||
TLS_DHE_PSK_WITH_AES_256_GCM_SHA384,
|
||||
TLS_RSA_PSK_WITH_AES_128_GCM_SHA256,
|
||||
TLS_RSA_PSK_WITH_AES_256_GCM_SHA384,
|
||||
TLS_PSK_WITH_AES_128_CBC_SHA256,
|
||||
TLS_PSK_WITH_AES_256_CBC_SHA384,
|
||||
TLS_DHE_PSK_WITH_AES_128_CBC_SHA256,
|
||||
TLS_DHE_PSK_WITH_AES_256_CBC_SHA384,
|
||||
TLS_RSA_PSK_WITH_AES_128_CBC_SHA256,
|
||||
TLS_RSA_PSK_WITH_AES_256_CBC_SHA384,
|
||||
TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA,
|
||||
TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA,
|
||||
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
|
||||
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
|
||||
TLS_ECDH_RSA_WITH_AES_128_CBC_SHA,
|
||||
TLS_ECDH_RSA_WITH_AES_256_CBC_SHA,
|
||||
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
|
||||
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
|
||||
TLS_ECDH_ANON_WITH_AES_128_CBC_SHA,
|
||||
TLS_ECDH_ANON_WITH_AES_256_CBC_SHA,
|
||||
TLS_SRP_SHA_WITH_AES_128_CBC_SHA,
|
||||
TLS_SRP_SHA_RSA_WITH_AES_128_CBC_SHA,
|
||||
TLS_SRP_SHA_DSS_WITH_AES_128_CBC_SHA,
|
||||
TLS_SRP_SHA_WITH_AES_256_CBC_SHA,
|
||||
TLS_SRP_SHA_RSA_WITH_AES_256_CBC_SHA,
|
||||
TLS_SRP_SHA_DSS_WITH_AES_256_CBC_SHA,
|
||||
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,
|
||||
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,
|
||||
TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256,
|
||||
TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384,
|
||||
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,
|
||||
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,
|
||||
TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256,
|
||||
TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384,
|
||||
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
|
||||
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
|
||||
TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256,
|
||||
TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384,
|
||||
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
|
||||
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
|
||||
TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256,
|
||||
TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384,
|
||||
TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA,
|
||||
TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA,
|
||||
TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256,
|
||||
TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384,
|
||||
};
|
||||
|
|
@ -1,74 +0,0 @@
|
|||
# $Id: ssl-errors.bro 6 2004-04-30 00:31:26Z jason $
|
||||
|
||||
# --- const defns of error messages
|
||||
const X509_V_OK = +0;
|
||||
const X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT = +1;
|
||||
const X509_V_ERR_UNABLE_TO_GET_CRL = +2;
|
||||
const X509_V_ERR_UNABLE_TO_DECRYPT_CERT_SIGNATURE = +3;
|
||||
const X509_V_ERR_UNABLE_TO_DECRYPT_CRL_SIGNATURE = +4;
|
||||
const X509_V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY = +5;
|
||||
const X509_V_ERR_CERT_SIGNATURE_FAILURE = +6;
|
||||
const X509_V_ERR_CRL_SIGNATURE_FAILURE = +7;
|
||||
const X509_V_ERR_CERT_NOT_YET_VALID = +8;
|
||||
const X509_V_ERR_CERT_HAS_EXPIRED = +9;
|
||||
const X509_V_ERR_CRL_NOT_YET_VALID = +10;
|
||||
const X509_V_ERR_CRL_HAS_EXPIRED = +11;
|
||||
const X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD = +12;
|
||||
const X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD = +13;
|
||||
const X509_V_ERR_ERROR_IN_CRL_LAST_UPDATE_FIELD = +14;
|
||||
const X509_V_ERR_ERROR_IN_CRL_NEXT_UPDATE_FIELD = +15;
|
||||
const X509_V_ERR_OUT_OF_MEM = +16;
|
||||
const X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT = +17;
|
||||
const X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN = +18;
|
||||
const X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY = +19;
|
||||
const X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE = +20;
|
||||
const X509_V_ERR_CERT_CHAIN_TOO_LONG = +21;
|
||||
const X509_V_ERR_CERT_REVOKED = +22;
|
||||
const X509_V_ERR_INVALID_CA = +23;
|
||||
const X509_V_ERR_PATH_LENGTH_EXCEEDED = +24;
|
||||
const X509_V_ERR_INVALID_PURPOSE = +25;
|
||||
const X509_V_ERR_CERT_UNTRUSTED = +26;
|
||||
const X509_V_ERR_CERT_REJECTED = +27;
|
||||
const X509_V_ERR_SUBJECT_ISSUER_MISMATCH = +28;
|
||||
const X509_V_ERR_AKID_SKID_MISMATCH = +29;
|
||||
const X509_V_ERR_AKID_ISSUER_SERIAL_MISMATCH = +30;
|
||||
const X509_V_ERR_KEYUSAGE_NO_CERTSIGN = +31;
|
||||
const X509_V_ERR_UNABLE_TO_GET_CRL_ISSUER = +32;
|
||||
const X509_V_ERR_UNHANDLED_CRITICAL_EXTENSION = +33;
|
||||
|
||||
const x509_errors: table[int] of string = {
|
||||
[+0] = "X509_V_OK",
|
||||
[+1] = "X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT",
|
||||
[+2] = "X509_V_ERR_UNABLE_TO_GET_CRL",
|
||||
[+3] = "X509_V_ERR_UNABLE_TO_DECRYPT_CERT_SIGNATURE",
|
||||
[+4] = "X509_V_ERR_UNABLE_TO_DECRYPT_CRL_SIGNATURE",
|
||||
[+5] = "X509_V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY",
|
||||
[+6] = "X509_V_ERR_CERT_SIGNATURE_FAILURE",
|
||||
[+7] = "X509_V_ERR_CRL_SIGNATURE_FAILURE",
|
||||
[+8] = "X509_V_ERR_CERT_NOT_YET_VALID",
|
||||
[+9] = "X509_V_ERR_CERT_HAS_EXPIRED",
|
||||
[+10] = "X509_V_ERR_CRL_NOT_YET_VALID",
|
||||
[+11] = "X509_V_ERR_CRL_HAS_EXPIRED",
|
||||
[+12] = "X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD",
|
||||
[+13] = "X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD",
|
||||
[+14] = "X509_V_ERR_ERROR_IN_CRL_LAST_UPDATE_FIELD",
|
||||
[+15] = "X509_V_ERR_ERROR_IN_CRL_NEXT_UPDATE_FIELD",
|
||||
[+16] = "X509_V_ERR_OUT_OF_MEM",
|
||||
[+17] = "X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT",
|
||||
[+18] = "X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN",
|
||||
[+19] = "X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY",
|
||||
[+20] = "X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE",
|
||||
[+21] = "X509_V_ERR_CERT_CHAIN_TOO_LONG",
|
||||
[+22] = "X509_V_ERR_CERT_REVOKED",
|
||||
[+23] = "X509_V_ERR_INVALID_CA",
|
||||
[+24] = "X509_V_ERR_PATH_LENGTH_EXCEEDED",
|
||||
[+25] = "X509_V_ERR_INVALID_PURPOSE",
|
||||
[+26] = "X509_V_ERR_CERT_UNTRUSTED",
|
||||
[+27] = "X509_V_ERR_CERT_REJECTED",
|
||||
[+28] = "X509_V_ERR_SUBJECT_ISSUER_MISMATCH",
|
||||
[+29] = "X509_V_ERR_AKID_SKID_MISMATCH",
|
||||
[+30] = "X509_V_ERR_AKID_ISSUER_SERIAL_MISMATCH",
|
||||
[+31] = "X509_V_ERR_KEYUSAGE_NO_CERTSIGN",
|
||||
[+32] = "X509_V_ERR_UNABLE_TO_GET_CRL_ISSUER",
|
||||
[+33] = "X509_V_ERR_UNHANDLED_CRITICAL_EXTENSION"
|
||||
};
|
||||
|
|
@ -50,9 +50,9 @@ export {
|
|||
handshake_cipher: string &default=""; # agreed-upon cipher for session/conn.
|
||||
};
|
||||
|
||||
# Certificates presented by which hosts to record.
|
||||
# Choices are: LocalHosts, RemoteHosts, Enabled, Disabled
|
||||
const logging = LocalHosts &redef;
|
||||
## Certificates presented by which hosts to record.
|
||||
## Choices are: LOCAL_HOSTS, REMOTE_HOSTS, ALL_HOSTS, NO_HOSTS
|
||||
const asset_tracking = default_asset_tracking &redef;
|
||||
|
||||
# If set to T, this will split local and remote certs
|
||||
# into separate files. F merges everything into a single file.
|
||||
File diff suppressed because one or more lines are too long
|
|
@ -11,5 +11,7 @@
|
|||
redef Notice::ignored_types += {
|
||||
Weird::ContentGap,
|
||||
Weird::AckAboveHole,
|
||||
DPD::ProtocolViolation
|
||||
Weird::RetransmissionInconsistency,
|
||||
Weird::WeirdActivity, # Only allow these to go in the weird log.
|
||||
DPD::ProtocolViolation,
|
||||
};
|
||||
|
|
@ -2,7 +2,9 @@
|
|||
@load software
|
||||
@load conn/known-hosts
|
||||
@load conn/known-services
|
||||
@load ssl/known-certs
|
||||
|
||||
redef Software::asset_tracking = ALL_HOSTS;
|
||||
redef KnownHosts::asset_tracking = ALL_HOSTS;
|
||||
redef KnownServices::asset_tracking = ALL_HOSTS;
|
||||
redef KnownCerts::asset_tracking = ALL_HOSTS;
|
||||
|
|
|
|||
|
|
@ -2,17 +2,10 @@
|
|||
#include "TCP_Reassembler.h"
|
||||
#include "util.h"
|
||||
|
||||
|
||||
bool SSL_Analyzer_binpac::warnings_generated = false;
|
||||
|
||||
SSL_Analyzer_binpac::SSL_Analyzer_binpac(Connection* c)
|
||||
: TCP_ApplicationAnalyzer(AnalyzerTag::SSL, c)
|
||||
{
|
||||
interp = new binpac::SSL::SSLAnalyzer;
|
||||
interp->set_bro_analyzer(this);
|
||||
|
||||
if ( ! warnings_generated )
|
||||
generate_warnings();
|
||||
interp = new binpac::SSL::SSL_Conn(this);
|
||||
}
|
||||
|
||||
SSL_Analyzer_binpac::~SSL_Analyzer_binpac()
|
||||
|
|
@ -51,18 +44,3 @@ void SSL_Analyzer_binpac::Undelivered(int seq, int len, bool orig)
|
|||
TCP_ApplicationAnalyzer::Undelivered(seq, len, orig);
|
||||
interp->NewGap(orig, len);
|
||||
}
|
||||
|
||||
void SSL_Analyzer_binpac::warn_(const char* msg)
|
||||
{
|
||||
warn("SSL_Analyzer_binpac: ", msg);
|
||||
}
|
||||
|
||||
void SSL_Analyzer_binpac::generate_warnings()
|
||||
{
|
||||
if ( ssl_store_certificates )
|
||||
warn_("storage of certificates (ssl_store_certificates) not supported");
|
||||
if ( ssl_store_key_material )
|
||||
warn_("storage of key material (ssl_store_key_material) not supported");
|
||||
|
||||
warnings_generated = true;
|
||||
}
|
||||
|
|
|
|||
|
|
@ -10,9 +10,12 @@ public:
|
|||
SSL_Analyzer_binpac(Connection* conn);
|
||||
virtual ~SSL_Analyzer_binpac();
|
||||
|
||||
// Overriden from Analyzer.
|
||||
virtual void Done();
|
||||
virtual void DeliverStream(int len, const u_char* data, bool orig);
|
||||
virtual void Undelivered(int seq, int len, bool orig);
|
||||
|
||||
// Overriden from TCP_ApplicationAnalyzer
|
||||
virtual void EndpointEOF(TCP_Reassembler* endp);
|
||||
|
||||
static Analyzer* InstantiateAnalyzer(Connection* conn)
|
||||
|
|
@ -25,12 +28,9 @@ public:
|
|||
x509_certificate || x509_extension || x509_error );
|
||||
}
|
||||
|
||||
static bool warnings_generated;
|
||||
static void warn_(const char* msg);
|
||||
static void generate_warnings();
|
||||
|
||||
protected:
|
||||
binpac::SSL::SSLAnalyzer* interp;
|
||||
binpac::SSL::SSL_Conn* interp;
|
||||
|
||||
};
|
||||
|
||||
#endif
|
||||
|
|
|
|||
|
|
@ -45,7 +45,8 @@
|
|||
|
||||
function to_string_val(data : uint8[]) : StringVal
|
||||
%{
|
||||
assert(data->size() <= 32);
|
||||
if ( data->size() > 32 )
|
||||
return new StringVal("");
|
||||
|
||||
char tmp[32];
|
||||
memset(tmp, 0, sizeof(tmp));
|
||||
|
|
@ -93,18 +94,19 @@ function convert_ciphers_uint16(ciph : uint16[]) : int[]
|
|||
return newciph;
|
||||
%}
|
||||
|
||||
refine analyzer SSLAnalyzer += {
|
||||
|
||||
refine connection SSL_Conn += {
|
||||
|
||||
%member{
|
||||
Analyzer* bro_analyzer_;
|
||||
%}
|
||||
|
||||
%init{
|
||||
bro_analyzer_ = 0;
|
||||
%}
|
||||
|
||||
%eof{
|
||||
if ( state_ != STATE_CONN_ESTABLISHED &&
|
||||
state_ != STATE_TRACK_LOST && state_ != STATE_INITIAL )
|
||||
state_ != STATE_TRACK_LOST &&
|
||||
state_ != STATE_INITIAL )
|
||||
bro_analyzer()->ProtocolViolation(fmt("unexpected end of connection in state %s",
|
||||
state_label(state_).c_str()));
|
||||
%}
|
||||
|
|
@ -112,16 +114,6 @@ refine analyzer SSLAnalyzer += {
|
|||
%cleanup{
|
||||
%}
|
||||
|
||||
function bro_analyzer() : Analyzer
|
||||
%{
|
||||
return bro_analyzer_;
|
||||
%}
|
||||
|
||||
function set_bro_analyzer(a : Analyzer) : void
|
||||
%{
|
||||
bro_analyzer_ = a;
|
||||
%}
|
||||
|
||||
function proc_change_cipher_spec(rec: SSLRecord) : bool
|
||||
%{
|
||||
if ( state_ == STATE_TRACK_LOST )
|
||||
|
|
@ -133,7 +125,8 @@ refine analyzer SSLAnalyzer += {
|
|||
|
||||
function proc_application_data(rec: SSLRecord) : bool
|
||||
%{
|
||||
if ( state_ != STATE_CONN_ESTABLISHED )
|
||||
if ( state_ != STATE_CONN_ESTABLISHED &&
|
||||
(state_ != STATE_CLIENT_FINISHED && ! ${rec.is_orig}) )
|
||||
bro_analyzer()->ProtocolViolation(fmt("unexpected ApplicationData from %s at state %s",
|
||||
orig_label(${rec.is_orig}).c_str(),
|
||||
state_label(old_state_).c_str()));
|
||||
|
|
@ -142,7 +135,7 @@ refine analyzer SSLAnalyzer += {
|
|||
|
||||
function proc_alert(rec: SSLRecord, level : int, desc : int) : bool
|
||||
%{
|
||||
BifEvent::generate_ssl_alert(bro_analyzer_, bro_analyzer_->Conn(),
|
||||
BifEvent::generate_ssl_alert(bro_analyzer(), bro_analyzer()->Conn(),
|
||||
level, desc);
|
||||
return true;
|
||||
%}
|
||||
|
|
@ -174,7 +167,7 @@ refine analyzer SSLAnalyzer += {
|
|||
Unref(ciph);
|
||||
}
|
||||
|
||||
BifEvent::generate_ssl_client_hello(bro_analyzer_, bro_analyzer_->Conn(),
|
||||
BifEvent::generate_ssl_client_hello(bro_analyzer(), bro_analyzer()->Conn(),
|
||||
version, ts,
|
||||
to_string_val(session_id),
|
||||
cipher_set);
|
||||
|
|
@ -199,8 +192,8 @@ refine analyzer SSLAnalyzer += {
|
|||
|
||||
if ( ssl_server_hello )
|
||||
{
|
||||
BifEvent::generate_ssl_server_hello(bro_analyzer_,
|
||||
bro_analyzer_->Conn(),
|
||||
BifEvent::generate_ssl_server_hello(bro_analyzer(),
|
||||
bro_analyzer()->Conn(),
|
||||
version, ts,
|
||||
to_string_val(session_id),
|
||||
cipher_suite, comp_method);
|
||||
|
|
@ -213,8 +206,8 @@ refine analyzer SSLAnalyzer += {
|
|||
function proc_ssl_extension(type: int, data: bytestring) : bool
|
||||
%{
|
||||
if ( ssl_extension )
|
||||
BifEvent::generate_ssl_extension(bro_analyzer_,
|
||||
bro_analyzer_->Conn(), type,
|
||||
BifEvent::generate_ssl_extension(bro_analyzer(),
|
||||
bro_analyzer()->Conn(), type,
|
||||
new StringVal(data.length(), (const char*) data.data()));
|
||||
return true;
|
||||
%}
|
||||
|
|
@ -241,7 +234,7 @@ refine analyzer SSLAnalyzer += {
|
|||
X509* pTemp = d2i_X509_binpac(NULL, &data, cert.length());
|
||||
if ( ! pTemp )
|
||||
{
|
||||
BifEvent::generate_x509_error(bro_analyzer_, bro_analyzer_->Conn(),
|
||||
BifEvent::generate_x509_error(bro_analyzer(), bro_analyzer()->Conn(),
|
||||
ERR_get_error());
|
||||
return false;
|
||||
}
|
||||
|
|
@ -267,7 +260,7 @@ refine analyzer SSLAnalyzer += {
|
|||
pX509Cert->Assign(5, new Val(get_time_from_asn1(X509_get_notAfter(pTemp)), TYPE_TIME));
|
||||
StringVal* der_cert = new StringVal(cert.length(), (const char*) cert.data());
|
||||
|
||||
BifEvent::generate_x509_certificate(bro_analyzer_, bro_analyzer_->Conn(),
|
||||
BifEvent::generate_x509_certificate(bro_analyzer(), bro_analyzer()->Conn(),
|
||||
pX509Cert,
|
||||
! ${rec.is_orig},
|
||||
i, certificates->size(),
|
||||
|
|
@ -299,8 +292,8 @@ refine analyzer SSLAnalyzer += {
|
|||
continue;
|
||||
|
||||
StringVal* value = new StringVal(length, pBuffer);
|
||||
BifEvent::generate_x509_extension(bro_analyzer_,
|
||||
bro_analyzer_->Conn(), value);
|
||||
BifEvent::generate_x509_extension(bro_analyzer(),
|
||||
bro_analyzer()->Conn(), value);
|
||||
OPENSSL_free(pBuffer);
|
||||
}
|
||||
}
|
||||
|
|
@ -339,8 +332,8 @@ refine analyzer SSLAnalyzer += {
|
|||
orig_label(${rec.is_orig}).c_str(),
|
||||
state_label(old_state_).c_str()));
|
||||
|
||||
BifEvent::generate_ssl_established(bro_analyzer_,
|
||||
bro_analyzer_->Conn());
|
||||
BifEvent::generate_ssl_established(bro_analyzer(),
|
||||
bro_analyzer()->Conn());
|
||||
|
||||
return true;
|
||||
%}
|
||||
|
|
@ -379,89 +372,85 @@ refine analyzer SSLAnalyzer += {
|
|||
|
||||
else if ( state_ == STATE_CONN_ESTABLISHED &&
|
||||
old_state_ == STATE_COMM_ENCRYPTED )
|
||||
BifEvent::generate_ssl_established(bro_analyzer_,
|
||||
bro_analyzer_->Conn());
|
||||
BifEvent::generate_ssl_established(bro_analyzer(),
|
||||
bro_analyzer()->Conn());
|
||||
|
||||
return true;
|
||||
%}
|
||||
|
||||
};
|
||||
|
||||
refine typeattr ChangeCipherSpec += &let {
|
||||
proc : bool = $context.analyzer.proc_change_cipher_spec(rec)
|
||||
proc : bool = $context.connection.proc_change_cipher_spec(rec)
|
||||
&requires(state_changed);
|
||||
};
|
||||
|
||||
refine typeattr Alert += &let {
|
||||
proc : bool = $context.analyzer.proc_alert(rec, level, description);
|
||||
proc : bool = $context.connection.proc_alert(rec, level, description);
|
||||
};
|
||||
|
||||
refine typeattr V2Error += &let {
|
||||
proc : bool = $context.analyzer.proc_alert(rec, -1, error_code);
|
||||
proc : bool = $context.connection.proc_alert(rec, -1, error_code);
|
||||
};
|
||||
|
||||
refine typeattr ApplicationData += &let {
|
||||
proc : bool = $context.analyzer.proc_application_data(rec);
|
||||
proc : bool = $context.connection.proc_application_data(rec);
|
||||
};
|
||||
|
||||
refine typeattr ClientHello += &let {
|
||||
proc : bool = $context.analyzer.proc_client_hello(rec, client_version,
|
||||
proc : bool = $context.connection.proc_client_hello(rec, client_version,
|
||||
gmt_unix_time,
|
||||
session_id, convert_ciphers_uint16(csuits))
|
||||
&requires(state_changed);
|
||||
};
|
||||
|
||||
refine typeattr V2ClientHello += &let {
|
||||
proc : bool = $context.analyzer.proc_client_hello(rec, client_version, 0,
|
||||
proc : bool = $context.connection.proc_client_hello(rec, client_version, 0,
|
||||
session_id, convert_ciphers_uint24(ciphers))
|
||||
&requires(state_changed);
|
||||
};
|
||||
|
||||
refine typeattr ServerHello += &let {
|
||||
proc : bool = $context.analyzer.proc_server_hello(rec, server_version,
|
||||
proc : bool = $context.connection.proc_server_hello(rec, server_version,
|
||||
gmt_unix_time, session_id, cipher_suite,
|
||||
compression_method)
|
||||
&requires(state_changed);
|
||||
};
|
||||
|
||||
refine typeattr V2ServerHello += &let {
|
||||
proc : bool = $context.analyzer.proc_server_hello(rec, server_version, 0, 0,
|
||||
proc : bool = $context.connection.proc_server_hello(rec, server_version, 0, 0,
|
||||
convert_ciphers_uint24(ciphers)[0], 0)
|
||||
&requires(state_changed);
|
||||
|
||||
cert : bool = $context.analyzer.proc_v2_certificate(rec, cert_data)
|
||||
cert : bool = $context.connection.proc_v2_certificate(rec, cert_data)
|
||||
&requires(proc);
|
||||
};
|
||||
|
||||
refine typeattr Certificate += &let {
|
||||
proc : bool = $context.analyzer.proc_v3_certificate(rec, certificates)
|
||||
proc : bool = $context.connection.proc_v3_certificate(rec, certificates)
|
||||
&requires(state_changed);
|
||||
};
|
||||
|
||||
refine typeattr V2ClientMasterKey += &let {
|
||||
proc : bool = $context.analyzer.proc_v2_client_master_key(rec, to_int()(cipher_kind))
|
||||
proc : bool = $context.connection.proc_v2_client_master_key(rec, cipher_kind)
|
||||
&requires(state_changed);
|
||||
};
|
||||
|
||||
refine typeattr UnknownHandshake += &let {
|
||||
proc : bool = $context.analyzer.proc_unknown_handshake(hs, is_orig);
|
||||
proc : bool = $context.connection.proc_unknown_handshake(hs, is_orig);
|
||||
};
|
||||
|
||||
refine typeattr Handshake += &let {
|
||||
proc : bool = $context.analyzer.proc_handshake(this, rec.is_orig);
|
||||
proc : bool = $context.connection.proc_handshake(this, rec.is_orig);
|
||||
};
|
||||
|
||||
refine typeattr UnknownRecord += &let {
|
||||
proc : bool = $context.analyzer.proc_unknown_record(rec);
|
||||
proc : bool = $context.connection.proc_unknown_record(rec);
|
||||
};
|
||||
|
||||
refine typeattr CiphertextRecord += &let {
|
||||
proc : bool = $context.analyzer.proc_ciphertext_record(rec);
|
||||
proc : bool = $context.connection.proc_ciphertext_record(rec);
|
||||
}
|
||||
|
||||
refine typeattr SSLExtension += &let {
|
||||
proc : bool = $context.analyzer.proc_ssl_extension(type, data);
|
||||
proc : bool = $context.connection.proc_ssl_extension(type, data);
|
||||
};
|
||||
|
||||
|
||||
|
||||
|
|
|
|||
|
|
@ -20,6 +20,11 @@ type uint24 = record {
|
|||
return (num->byte1() << 16) | (num->byte2() << 8) | num->byte3();
|
||||
}
|
||||
};
|
||||
|
||||
string state_label(int state_nr);
|
||||
string orig_label(bool is_orig);
|
||||
double get_time_from_asn1(const ASN1_TIME * atime);
|
||||
string handshake_type_label(int type);
|
||||
%}
|
||||
|
||||
extern type to_int;
|
||||
|
|
@ -30,11 +35,11 @@ type SSLRecord(is_orig: bool) = record {
|
|||
head2 : uint8;
|
||||
head3 : uint8;
|
||||
head4 : uint8;
|
||||
rec : RecordText(this, is_orig) &requires(content_type), &restofdata;
|
||||
rec : RecordText(this, is_orig)[] &length=length, &requires(content_type);
|
||||
} &length = length+5, &byteorder=bigendian,
|
||||
&let {
|
||||
version : int =
|
||||
$context.analyzer.determine_ssl_version(head0, head1, head2);
|
||||
$context.connection.determine_ssl_version(head0, head1, head2);
|
||||
|
||||
content_type : int = case version of {
|
||||
UNKNOWN_VERSION -> 0;
|
||||
|
|
@ -49,7 +54,7 @@ type SSLRecord(is_orig: bool) = record {
|
|||
};
|
||||
};
|
||||
|
||||
type RecordText(rec: SSLRecord, is_orig: bool) = case $context.analyzer.state() of {
|
||||
type RecordText(rec: SSLRecord, is_orig: bool) = case $context.connection.state() of {
|
||||
STATE_ABBREV_SERVER_ENCRYPTED, STATE_CLIENT_ENCRYPTED,
|
||||
STATE_COMM_ENCRYPTED, STATE_CONN_ESTABLISHED
|
||||
-> ciphertext : CiphertextRecord(rec, is_orig);
|
||||
|
|
@ -57,10 +62,17 @@ type RecordText(rec: SSLRecord, is_orig: bool) = case $context.analyzer.state()
|
|||
-> plaintext : PlaintextRecord(rec, is_orig);
|
||||
};
|
||||
|
||||
type PossibleEncryptedHandshake(rec: SSLRecord, is_orig: bool) = case $context.connection.state() of {
|
||||
# Deal with encrypted handshakes before the server cipher spec change.
|
||||
STATE_CLIENT_FINISHED, STATE_CLIENT_ENCRYPTED
|
||||
-> ct : CiphertextRecord(rec, is_orig);
|
||||
default -> hs : Handshake(rec);
|
||||
};
|
||||
|
||||
type PlaintextRecord(rec: SSLRecord, is_orig: bool) = case rec.content_type of {
|
||||
CHANGE_CIPHER_SPEC -> ch_cipher : ChangeCipherSpec(rec);
|
||||
ALERT -> alert : Alert(rec);
|
||||
HANDSHAKE -> handshake : Handshake(rec)[];
|
||||
HANDSHAKE -> handshake : PossibleEncryptedHandshake(rec, is_orig);
|
||||
APPLICATION_DATA -> app_data : ApplicationData(rec);
|
||||
V2_ERROR -> v2_error : V2Error(rec);
|
||||
V2_CLIENT_HELLO -> v2_client_hello : V2ClientHello(rec);
|
||||
|
|
@ -297,21 +309,21 @@ type ChangeCipherSpec(rec: SSLRecord) = record {
|
|||
type : uint8;
|
||||
} &length = 1, &let {
|
||||
state_changed : bool =
|
||||
$context.analyzer.transition(STATE_CLIENT_FINISHED,
|
||||
$context.connection.transition(STATE_CLIENT_FINISHED,
|
||||
STATE_COMM_ENCRYPTED, rec.is_orig, false) ||
|
||||
$context.analyzer.transition(STATE_IN_SERVER_HELLO,
|
||||
$context.connection.transition(STATE_IN_SERVER_HELLO,
|
||||
STATE_ABBREV_SERVER_ENCRYPTED, rec.is_orig, false) ||
|
||||
$context.analyzer.transition(STATE_CLIENT_KEY_NO_CERT,
|
||||
$context.connection.transition(STATE_CLIENT_KEY_NO_CERT,
|
||||
STATE_CLIENT_ENCRYPTED, rec.is_orig, true) ||
|
||||
$context.analyzer.transition(STATE_CLIENT_CERT_VERIFIED,
|
||||
$context.connection.transition(STATE_CLIENT_CERT_VERIFIED,
|
||||
STATE_CLIENT_ENCRYPTED, rec.is_orig, true) ||
|
||||
#$context.analyzer.transition(STATE_CLIENT_CERT,
|
||||
# STATE_CLIENT_ENCRYPTED, rec.is_orig, true) ||
|
||||
$context.analyzer.transition(STATE_CLIENT_KEY_WITH_CERT,
|
||||
$context.connection.transition(STATE_CLIENT_CERT,
|
||||
STATE_CLIENT_ENCRYPTED, rec.is_orig, true) ||
|
||||
$context.analyzer.transition(STATE_ABBREV_SERVER_FINISHED,
|
||||
$context.connection.transition(STATE_CLIENT_KEY_WITH_CERT,
|
||||
STATE_CLIENT_ENCRYPTED, rec.is_orig, true) ||
|
||||
$context.connection.transition(STATE_ABBREV_SERVER_FINISHED,
|
||||
STATE_COMM_ENCRYPTED, rec.is_orig, true) ||
|
||||
$context.analyzer.lost_track();
|
||||
$context.connection.lost_track();
|
||||
};
|
||||
|
||||
|
||||
|
|
@ -329,8 +341,8 @@ type Alert(rec: SSLRecord) = record {
|
|||
# V2 Error Records (SSLv2 2.7.)
|
||||
######################################################################
|
||||
|
||||
type V2Error(rec: SSLRecord) = record {
|
||||
error_code : uint16;
|
||||
type V2Error(rec: SSLRecord) = empty &let {
|
||||
error_code : uint16 = ((rec.head3 << 8) | rec.head4);
|
||||
};
|
||||
|
||||
|
||||
|
|
@ -352,7 +364,7 @@ type ApplicationData(rec: SSLRecord) = empty;
|
|||
|
||||
# Hello Request is empty
|
||||
type HelloRequest(rec: SSLRecord) = empty &let {
|
||||
hr: bool = $context.analyzer.set_hello_requested(true);
|
||||
hr: bool = $context.connection.set_hello_requested(true);
|
||||
};
|
||||
|
||||
|
||||
|
|
@ -376,11 +388,11 @@ type ClientHello(rec: SSLRecord) = record {
|
|||
extensions : SSLExtension[] &until($input.length() == 0);
|
||||
} &let {
|
||||
state_changed : bool =
|
||||
$context.analyzer.transition(STATE_INITIAL,
|
||||
$context.connection.transition(STATE_INITIAL,
|
||||
STATE_CLIENT_HELLO_RCVD, rec.is_orig, true) ||
|
||||
($context.analyzer.hello_requested() &&
|
||||
$context.analyzer.transition(STATE_ANY, STATE_CLIENT_HELLO_RCVD, rec.is_orig, true)) ||
|
||||
$context.analyzer.lost_track();
|
||||
($context.connection.hello_requested() &&
|
||||
$context.connection.transition(STATE_ANY, STATE_CLIENT_HELLO_RCVD, rec.is_orig, true)) ||
|
||||
$context.connection.lost_track();
|
||||
};
|
||||
|
||||
|
||||
|
|
@ -389,20 +401,21 @@ type ClientHello(rec: SSLRecord) = record {
|
|||
######################################################################
|
||||
|
||||
type V2ClientHello(rec: SSLRecord) = record {
|
||||
client_version : uint16;
|
||||
csuit_len : uint16;
|
||||
session_len : uint16;
|
||||
chal_len : uint16;
|
||||
ciphers : uint24[csuit_len/3];
|
||||
session_id : uint8[session_len];
|
||||
challenge : bytestring &length = chal_len;
|
||||
} &length = 8 + csuit_len + session_len + chal_len, &let {
|
||||
} &length = 6 + csuit_len + session_len + chal_len, &let {
|
||||
state_changed : bool =
|
||||
$context.analyzer.transition(STATE_INITIAL,
|
||||
$context.connection.transition(STATE_INITIAL,
|
||||
STATE_CLIENT_HELLO_RCVD, rec.is_orig, true) ||
|
||||
($context.analyzer.hello_requested() &&
|
||||
$context.analyzer.transition(STATE_ANY, STATE_CLIENT_HELLO_RCVD, rec.is_orig, true)) ||
|
||||
$context.analyzer.lost_track();
|
||||
($context.connection.hello_requested() &&
|
||||
$context.connection.transition(STATE_ANY, STATE_CLIENT_HELLO_RCVD, rec.is_orig, true)) ||
|
||||
$context.connection.lost_track();
|
||||
|
||||
client_version : int = rec.version;
|
||||
};
|
||||
|
||||
|
||||
|
|
@ -420,9 +433,9 @@ type ServerHello(rec: SSLRecord) = record {
|
|||
compression_method : uint8;
|
||||
} &let {
|
||||
state_changed : bool =
|
||||
$context.analyzer.transition(STATE_CLIENT_HELLO_RCVD,
|
||||
$context.connection.transition(STATE_CLIENT_HELLO_RCVD,
|
||||
STATE_IN_SERVER_HELLO, rec.is_orig, false) ||
|
||||
$context.analyzer.lost_track();
|
||||
$context.connection.lost_track();
|
||||
};
|
||||
|
||||
|
||||
|
|
@ -431,8 +444,8 @@ type ServerHello(rec: SSLRecord) = record {
|
|||
######################################################################
|
||||
|
||||
type V2ServerHello(rec: SSLRecord) = record {
|
||||
session_id_hit : uint8;
|
||||
cert_type : uint8;
|
||||
#session_id_hit : uint8;
|
||||
#cert_type : uint8;
|
||||
server_version : uint16;
|
||||
cert_len : uint16;
|
||||
ciph_len : uint16;
|
||||
|
|
@ -440,14 +453,18 @@ type V2ServerHello(rec: SSLRecord) = record {
|
|||
cert_data : bytestring &length = cert_len;
|
||||
ciphers : uint24[ciph_len/3];
|
||||
conn_id_data : bytestring &length = conn_id_len;
|
||||
} &length = 10 + cert_len + ciph_len + conn_id_len, &let {
|
||||
} #&length = 8 + cert_len + ciph_len + conn_id_len,
|
||||
&let {
|
||||
state_changed : bool =
|
||||
(session_id_hit > 0 ?
|
||||
$context.analyzer.transition(STATE_CLIENT_HELLO_RCVD,
|
||||
$context.connection.transition(STATE_CLIENT_HELLO_RCVD,
|
||||
STATE_CONN_ESTABLISHED, rec.is_orig, false) :
|
||||
$context.analyzer.transition(STATE_CLIENT_HELLO_RCVD,
|
||||
$context.connection.transition(STATE_CLIENT_HELLO_RCVD,
|
||||
STATE_V2_CL_MASTER_KEY_EXPECTED, rec.is_orig, false)) ||
|
||||
$context.analyzer.lost_track();
|
||||
$context.connection.lost_track();
|
||||
|
||||
session_id_hit : uint8 = rec.head3;
|
||||
cert_type : uint8 = rec.head4;
|
||||
};
|
||||
|
||||
|
||||
|
|
@ -467,11 +484,11 @@ type Certificate(rec: SSLRecord) = record {
|
|||
certificates : CertificateList &length = to_int()(length);
|
||||
} &let {
|
||||
state_changed : bool =
|
||||
$context.analyzer.transition(STATE_IN_SERVER_HELLO,
|
||||
$context.connection.transition(STATE_IN_SERVER_HELLO,
|
||||
STATE_IN_SERVER_HELLO, rec.is_orig, false) ||
|
||||
$context.analyzer.transition(STATE_SERVER_HELLO_DONE,
|
||||
$context.connection.transition(STATE_SERVER_HELLO_DONE,
|
||||
STATE_CLIENT_CERT, rec.is_orig, true) ||
|
||||
$context.analyzer.lost_track();
|
||||
$context.connection.lost_track();
|
||||
};
|
||||
|
||||
|
||||
|
|
@ -481,12 +498,12 @@ type Certificate(rec: SSLRecord) = record {
|
|||
|
||||
# For now ignore details; just eat up complete message
|
||||
type ServerKeyExchange(rec: SSLRecord) = record {
|
||||
key : bytestring &restofdata;
|
||||
key : bytestring &restofdata &transient;
|
||||
} &let {
|
||||
state_changed : bool =
|
||||
$context.analyzer.transition(STATE_IN_SERVER_HELLO,
|
||||
$context.connection.transition(STATE_IN_SERVER_HELLO,
|
||||
STATE_IN_SERVER_HELLO, rec.is_orig, false) ||
|
||||
$context.analyzer.lost_track();
|
||||
$context.connection.lost_track();
|
||||
};
|
||||
|
||||
|
||||
|
|
@ -499,9 +516,9 @@ type CertificateRequest(rec: SSLRecord) = record {
|
|||
cont : bytestring &restofdata &transient;
|
||||
} &let {
|
||||
state_changed : bool =
|
||||
$context.analyzer.transition(STATE_IN_SERVER_HELLO,
|
||||
$context.connection.transition(STATE_IN_SERVER_HELLO,
|
||||
STATE_IN_SERVER_HELLO, rec.is_orig, false) ||
|
||||
$context.analyzer.lost_track();
|
||||
$context.connection.lost_track();
|
||||
};
|
||||
|
||||
|
||||
|
|
@ -512,9 +529,9 @@ type CertificateRequest(rec: SSLRecord) = record {
|
|||
# Server Hello Done is empty
|
||||
type ServerHelloDone(rec: SSLRecord) = empty &let {
|
||||
state_changed : bool =
|
||||
$context.analyzer.transition(STATE_IN_SERVER_HELLO,
|
||||
$context.connection.transition(STATE_IN_SERVER_HELLO,
|
||||
STATE_SERVER_HELLO_DONE, rec.is_orig, false) ||
|
||||
$context.analyzer.lost_track();
|
||||
$context.connection.lost_track();
|
||||
};
|
||||
|
||||
|
||||
|
|
@ -533,16 +550,16 @@ type ServerHelloDone(rec: SSLRecord) = empty &let {
|
|||
# For now ignore details of ClientKeyExchange (most of it is
|
||||
# encrypted anyway); just eat up message.
|
||||
type ClientKeyExchange(rec: SSLRecord) = record {
|
||||
cont : bytestring &restofdata &transient;
|
||||
key : bytestring &restofdata;
|
||||
} &let {
|
||||
state_changed : bool =
|
||||
$context.analyzer.transition(STATE_SERVER_HELLO_DONE,
|
||||
$context.connection.transition(STATE_SERVER_HELLO_DONE,
|
||||
STATE_CLIENT_KEY_NO_CERT, rec.is_orig, true) ||
|
||||
$context.analyzer.transition(STATE_CLIENT_CERT,
|
||||
$context.connection.transition(STATE_CLIENT_CERT,
|
||||
STATE_CLIENT_KEY_WITH_CERT, rec.is_orig, true) ||
|
||||
$context.analyzer.transition(STATE_CLIENT_CERT,
|
||||
$context.connection.transition(STATE_CLIENT_CERT,
|
||||
STATE_CLIENT_KEY_WITH_CERT, rec.is_orig, true) ||
|
||||
$context.analyzer.lost_track();
|
||||
$context.connection.lost_track();
|
||||
};
|
||||
|
||||
######################################################################
|
||||
|
|
@ -550,18 +567,20 @@ type ClientKeyExchange(rec: SSLRecord) = record {
|
|||
######################################################################
|
||||
|
||||
type V2ClientMasterKey(rec: SSLRecord) = record {
|
||||
cipher_kind : uint24;
|
||||
cipher_kind_8 : uint8;
|
||||
cl_key_len : uint16;
|
||||
en_key_len : uint16;
|
||||
key_arg_len : uint16;
|
||||
cl_key_data : bytestring &length = cl_key_len &transient;
|
||||
en_key_data : bytestring &length = en_key_len &transient;
|
||||
key_arg_data : bytestring &length = key_arg_len &transient;
|
||||
} &length = 9 + cl_key_len + en_key_len + key_arg_len, &let {
|
||||
} &length = 7 + cl_key_len + en_key_len + key_arg_len, &let {
|
||||
state_changed : bool =
|
||||
$context.analyzer.transition(STATE_V2_CL_MASTER_KEY_EXPECTED,
|
||||
$context.connection.transition(STATE_V2_CL_MASTER_KEY_EXPECTED,
|
||||
STATE_CONN_ESTABLISHED, rec.is_orig, true) ||
|
||||
$context.analyzer.lost_track();
|
||||
$context.connection.lost_track();
|
||||
|
||||
cipher_kind : int = (((rec.head3 << 16) | (rec.head4 << 8)) | cipher_kind_8);
|
||||
};
|
||||
|
||||
|
||||
|
|
@ -574,9 +593,9 @@ type CertificateVerify(rec: SSLRecord) = record {
|
|||
cont : bytestring &restofdata &transient;
|
||||
} &let {
|
||||
state_changed : bool =
|
||||
$context.analyzer.transition(STATE_CLIENT_KEY_WITH_CERT,
|
||||
$context.connection.transition(STATE_CLIENT_KEY_WITH_CERT,
|
||||
STATE_CLIENT_CERT_VERIFIED, rec.is_orig, true) ||
|
||||
$context.analyzer.lost_track();
|
||||
$context.connection.lost_track();
|
||||
};
|
||||
|
||||
|
||||
|
|
@ -595,14 +614,9 @@ type CertificateVerify(rec: SSLRecord) = record {
|
|||
type UnknownHandshake(hs: Handshake, is_orig: bool) = record {
|
||||
cont : bytestring &restofdata &transient;
|
||||
} &let {
|
||||
# TODO: an unknown handshake could just be an encrypted handshake
|
||||
# before a server sends the change cipher spec message.
|
||||
# I have no clue why this happens, but it does seem to happen.
|
||||
# This should be solved in a different way eventually.
|
||||
#state_changed : bool = $context.analyzer.lost_track();
|
||||
state_changed : bool = $context.connection.lost_track();
|
||||
};
|
||||
|
||||
|
||||
type Handshake(rec: SSLRecord) = record {
|
||||
msg_type : uint8;
|
||||
length : uint24;
|
||||
|
|
@ -618,8 +632,8 @@ type Handshake(rec: SSLRecord) = record {
|
|||
CERTIFICATE_VERIFY -> certificate_verify : CertificateVerify(rec);
|
||||
CLIENT_KEY_EXCHANGE -> client_key_exchange : ClientKeyExchange(rec);
|
||||
default -> unknown_handshake : UnknownHandshake(this, rec.is_orig);
|
||||
} &length = to_int()(length);
|
||||
};
|
||||
} &length = 4 + to_int()(length);
|
||||
|
||||
|
||||
######################################################################
|
||||
|
|
@ -629,24 +643,30 @@ type Handshake(rec: SSLRecord) = record {
|
|||
type UnknownRecord(rec: SSLRecord) = record {
|
||||
cont : bytestring &restofdata &transient;
|
||||
} &let {
|
||||
state_changed : bool = $context.analyzer.lost_track();
|
||||
state_changed : bool = $context.connection.lost_track();
|
||||
};
|
||||
|
||||
type CiphertextRecord(rec: SSLRecord, is_orig: bool) = empty &let {
|
||||
type CiphertextRecord(rec: SSLRecord, is_orig: bool) = record {
|
||||
cont : bytestring &restofdata &transient;
|
||||
} &let {
|
||||
state_changed : bool =
|
||||
$context.analyzer.transition(STATE_ABBREV_SERVER_ENCRYPTED,
|
||||
STATE_ABBREV_SERVER_FINISHED, rec.is_orig, false) ||
|
||||
$context.analyzer.transition(STATE_CLIENT_ENCRYPTED,
|
||||
$context.connection.transition(STATE_CLIENT_FINISHED,
|
||||
STATE_CLIENT_FINISHED, rec.is_orig, false) ||
|
||||
$context.connection.transition(STATE_CLIENT_FINISHED,
|
||||
STATE_CLIENT_FINISHED, rec.is_orig, true) ||
|
||||
$context.analyzer.transition(STATE_COMM_ENCRYPTED,
|
||||
$context.connection.transition(STATE_ABBREV_SERVER_ENCRYPTED,
|
||||
STATE_ABBREV_SERVER_FINISHED, rec.is_orig, false) ||
|
||||
$context.connection.transition(STATE_CLIENT_ENCRYPTED,
|
||||
STATE_CLIENT_FINISHED, rec.is_orig, true) ||
|
||||
$context.connection.transition(STATE_COMM_ENCRYPTED,
|
||||
STATE_CONN_ESTABLISHED, rec.is_orig, false) ||
|
||||
$context.analyzer.transition(STATE_COMM_ENCRYPTED,
|
||||
$context.connection.transition(STATE_COMM_ENCRYPTED,
|
||||
STATE_CONN_ESTABLISHED, rec.is_orig, true) ||
|
||||
$context.analyzer.transition(STATE_CONN_ESTABLISHED,
|
||||
$context.connection.transition(STATE_CONN_ESTABLISHED,
|
||||
STATE_CONN_ESTABLISHED, rec.is_orig, false) ||
|
||||
$context.analyzer.transition(STATE_CONN_ESTABLISHED,
|
||||
$context.connection.transition(STATE_CONN_ESTABLISHED,
|
||||
STATE_CONN_ESTABLISHED, rec.is_orig, true) ||
|
||||
$context.analyzer.lost_track();
|
||||
$context.connection.lost_track();
|
||||
};
|
||||
|
||||
|
||||
|
|
@ -663,9 +683,7 @@ type SSLPDU(is_orig: bool) = record {
|
|||
# binpac analyzer for SSL including
|
||||
######################################################################
|
||||
|
||||
analyzer SSLAnalyzer {
|
||||
upflow = SSLFlow(true);
|
||||
downflow = SSLFlow(false);
|
||||
refine connection SSL_Conn += {
|
||||
|
||||
%member{
|
||||
int state_;
|
||||
|
|
@ -715,6 +733,7 @@ analyzer SSLAnalyzer {
|
|||
|
||||
function lost_track() : bool
|
||||
%{
|
||||
printf("just lost track!\n");
|
||||
state_ = STATE_TRACK_LOST;
|
||||
return false;
|
||||
%}
|
||||
|
|
|
|||
18
src/ssl.pac
18
src/ssl.pac
|
|
@ -11,14 +11,20 @@
|
|||
%include bro.pac
|
||||
|
||||
analyzer SSL withcontext {
|
||||
analyzer : SSLAnalyzer;
|
||||
flow : SSLFlow;
|
||||
connection: SSL_Conn;
|
||||
flow: SSL_Flow;
|
||||
};
|
||||
|
||||
connection SSL_Conn(bro_analyzer: BroAnalyzer) {
|
||||
upflow = SSL_Flow(true);
|
||||
downflow = SSL_Flow(false);
|
||||
};
|
||||
|
||||
%include ssl-protocol.pac
|
||||
|
||||
flow SSL_Flow(is_orig: bool) {
|
||||
flowunit = SSLPDU(is_orig) withcontext(connection, this);
|
||||
}
|
||||
|
||||
%include ssl-analyzer.pac
|
||||
%include ssl-defs.pac
|
||||
|
||||
flow SSLFlow(is_orig : bool) {
|
||||
flowunit = SSLPDU(is_orig) withcontext(connection, this);
|
||||
};
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue