Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Only pass session ticket data in ssl_session_ticket_handshake event

Browse source 
This commit fixes the parsing of the data field in the SSL analyzer. So
far, this field contained two extra bytes at the beginning, which
contain the length of the following data.

Now, the data passed to the event only contains the actual value of the
session ticket.

The Spicy analyzer already contains the correct handling of this field,
and does not need to be updated. A test that uses the event and
exhibited the bug was added.
This commit is contained in:
Johanna Amann 2025-06-24 15:08:30 +01:00
parent cab4ebf513
commit 9d06a13828
4 changed files with 25 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

13
testing/btest/scripts/base/protocols/ssl/session-ticket.test Normal file
View file

@ -0,0 +1,13 @@
# @TEST-DOC: Tests the ssl_session_ticket_handshake event
# @TEST-EXEC: echo "CVE-2015-3194.pcap"
# @TEST-EXEC: zeek -b -C -r $TRACES/tls/CVE-2015-3194.pcap %INPUT
# @TEST-EXEC: echo "client-certificate.pcap"
# @TEST-EXEC: zeek -b -C -r $TRACES/tls/client-certificate.pcap %INPUT
# @TEST-EXEC: btest-diff .stdout
@load base/protocols/ssl
event ssl_session_ticket_handshake(c: connection, ticket_lifetime_hint: count, ticket: string)
{
print ticket_lifetime_hint, ticket;
}