Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Merge remote-tracking branch 'origin/topic/johanna/ssl-history-also-for-sslv2-not-only-for-things-that-use-the-more-modern-handshake'

Browse source 
* origin/topic/johanna/ssl-history-also-for-sslv2-not-only-for-things-that-use-the-more-modern-handshake:
  Make ssl_history work for SSLv2 handshakes/connections
This commit is contained in:
Johanna Amann 2024-08-20 11:38:48 +01:00
commit 2f07ca9e7f
7 changed files with 27 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

10
scripts/base/protocols/ssl/main.zeek
View file

@ -282,6 +282,11 @@ event ssl_client_hello(c: connection, version: count, record_version: count, pos
c$ssl$session_id = bytestring_to_hexstr(session_id);
c$ssl$client_ticket_empty_session_seen = F;
}
# add manually for SSLv2, since the handshake_message event is not raised, as there is no handshake protocol.
# We don't really have a direction in that case
if ( version == 2 )
add_to_history(c, T, "c");
}
event ssl_server_hello(c: connection, version: count, record_version: count, possible_ts: time, server_random: string, session_id: string, cipher: count, comp_method: count) &priority=5
@ -302,6 +307,11 @@ event ssl_server_hello(c: connection, version: count, record_version: count, pos
if ( c$ssl?$session_id && c$ssl$session_id == bytestring_to_hexstr(session_id) && c$ssl$version_num/0xFF != 0x7F && c$ssl$version_num != TLSv13 )
c$ssl$resumed = T;
# add manually for SSLv2, since the handshake_message event is not raised, as there is no handshake protocol.
# We don't really have a direction in that case
if ( version == 2 )
add_to_history(c, F, "s");
}
event ssl_extension_supported_versions(c: connection, is_client: bool, versions: index_vec)