Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-17 05:58:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Merge remote-tracking branch 'origin/master' into topic/vladg/bit-1838

Browse source
This commit is contained in:
Vlad Grigorescu 2017-10-05 14:36:45 -05:00
commit 6cbcfbcd49
27 changed files with 170 additions and 30 deletions
Download patch file Download diff file Expand all files Collapse all files

16
testing/btest/scripts/base/protocols/ssl/tls13-experiment.test Normal file
View file

@ -0,0 +1,16 @@
# @TEST-EXEC: bro -C -r $TRACES/tls/chrome-63.0.3211.0-canary-tls_experiment.pcap %INPUT
# @TEST-EXEC: btest-diff ssl.log
# @TEST-EXEC: btest-diff .stdout
# This is a trace that uses a completely non-standard way of establishing TLS 1.3; this seems
# to be an undocumented extension where the TLS version is negotiated via the server sending back
# an supported_versions extension (which, according to the RFC is strictly prohibited).
#
# This only seems to happen with Chrome talking to google servers. We do not recognize this as
# TLS 1.3, but we do not abort when encountering traffic like this.
event ssl_extension(c: connection, is_orig: bool, code: count, val: string)
{
if ( ! is_orig && code == 43 )
print bytestring_to_hexstr(val);
}