Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Merge remote-tracking branch 'origin/topic/johanna/reformat-spicy-ssl'

Browse source 
* origin/topic/johanna/reformat-spicy-ssl:
  Bump spicy-format to 0.16.2
  Bump spicy-format to 0.16.1
  Spicy SSL: reformat with new version of spicy format
This commit is contained in:
Johanna Amann 2024-09-12 08:51:08 +02:00
commit a0ff0fb18b
4 changed files with 11 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

2
.pre-commit-config.yaml
View file

@ -34,7 +34,7 @@ repos:
exclude: '^(.typos.toml|src/SmithWaterman.cc|testing/.*|auxil/.*|scripts/base/frameworks/files/magic/.*|CHANGES)$'
- repo: https://github.com/bbannier/spicy-format
rev: v0.15.0
rev: v0.16.2
hooks:
- id: spicy-format
# TODO: Reformat existing large analyzers just before 8.0.

6
CHANGES
View file

@ -1,3 +1,9 @@
7.1.0-dev.309 | 2024-09-12 08:51:08 +0200
* Bump spicy-format to 0.16.2 (Johanna Amann, Corelight)
* Spicy SSL: reformat with new version of spicy format (Johanna Amann, Corelight)
7.1.0-dev.305 | 2024-09-11 16:55:55 +0200
* Spicy SSL analyzer:

2
VERSION
View file

@ -1 +1 @@
7.1.0-dev.305
7.1.0-dev.309

6
src/analyzer/protocol/ssl/spicy/SSL.spicy
View file

@ -701,7 +701,7 @@ type SSL2Record = unit(lengthone: uint8, inout msg: Message, inout sh: Share) {
var length: uint16;
on lengthtwo {
self.length = (cast<uint16>(lengthone) & 0x7F)<<8 | self.lengthtwo;
self.length = (cast<uint16>(lengthone) & 0x7F) << 8 | self.lengthtwo;
}
message_type: uint8;
@ -712,7 +712,7 @@ type SSL2Record = unit(lengthone: uint8, inout msg: Message, inout sh: Share) {
SSL2ProtocolMessages::ssl_server_verify -> : skip bytes &size=self.length;
SSL2ProtocolMessages::ssl_request_certificate -> : skip bytes &size=self.length;
SSL2ProtocolMessages::ssl_client_certificate -> : skip bytes &size=self.length;
} if(get_encrypted(sh) == False) ;
} if(get_encrypted(sh) == False);
: skip bytes &size=self.length if(get_encrypted(sh) == True);
on %done {
@ -842,7 +842,7 @@ function determine_encryption_on(pr: PlaintextRecord, content_type: uint8, hands
return False;
if (content_type != 23) # application_data
return False;
return False;
## in theory, we should check for TLS13 or draft-TLS13 instead of doing the reverse.
## But - people use weird version numbers. And all of those weird version numbers are