Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-06 00:28:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Merge remote-tracking branch 'origin/topic/johanna/tls-more-data'

Browse source 
* origin/topic/johanna/tls-more-data:
  Update NEWS for ssl changes.
  SSL: test updates for record_layer version
  Final touches to SSL events with record layer version.
  Introduce ssl_plaintext_data event.
  Add record layer version to event ssl_encrypted_data.
  Add compression methods to ssl_client_hello event.
This commit is contained in:
Jon Siwek 2018-08-30 09:28:41 -05:00
commit 7e6fc58ab4
36 changed files with 333 additions and 132 deletions
Download patch file Download diff file Expand all files Collapse all files

8
scripts/base/protocols/ssl/main.bro
View file

@ -200,7 +200,7 @@ function finish(c: connection, remove_analyzer: bool)
}
}
event ssl_client_hello(c: connection, version: count, possible_ts: time, client_random: string, session_id: string, ciphers: index_vec) &priority=5
event ssl_client_hello(c: connection, version: count, record_version: count, possible_ts: time, client_random: string, session_id: string, ciphers: index_vec, comp_methods: index_vec) &priority=5
{
set_session(c);
@ -212,7 +212,7 @@ event ssl_client_hello(c: connection, version: count, possible_ts: time, client_
}
}
event ssl_server_hello(c: connection, version: count, possible_ts: time, server_random: string, session_id: string, cipher: count, comp_method: count) &priority=5
event ssl_server_hello(c: connection, version: count, record_version: count, possible_ts: time, server_random: string, session_id: string, cipher: count, comp_method: count) &priority=5
{
set_session(c);
@ -351,11 +351,11 @@ event protocol_confirmation(c: connection, atype: Analyzer::Tag, aid: count) &pr
}
}
event ssl_application_data(c: connection, is_orig: bool, length: count)
event ssl_plaintext_data(c: connection, is_orig: bool, record_version: count, content_type: count, length: count) &priority=5
{
set_session(c);
if ( ! c$ssl?$version || c$ssl$established )
if ( ! c$ssl?$version || c$ssl$established || content_type != APPLICATION_DATA )
return;
if ( c$ssl$version_num/0xFF != 0x7F && c$ssl$version_num != TLSv13 )