Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-08 17:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Merge remote-tracking branch 'origin/topic/johanna/tls_early_alert'

Browse source 
* origin/topic/johanna/tls_early_alert:
  Extend ssl dpd signature to allow alert before server_hello.

BIT-1496 #merged
This commit is contained in:
Robin Sommer 2015-10-23 14:04:43 -07:00
commit a1c0d9d91c
3 changed files with 4 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
scripts/base/protocols/ssl/dpd.sig
View file

@ -1,7 +1,7 @@
signature dpd_ssl_server { signature dpd_ssl_server {
ip-proto == tcp ip-proto == tcp
# Server hello. # Server hello.
payload /^(\x16\x03[\x00\x01\x02\x03]..\x02...\x03[\x00\x01\x02\x03]|...?\x04..\x00\x02).*/ payload /^((\x15\x03[\x00\x01\x02\x03]....)?\x16\x03[\x00\x01\x02\x03]..\x02...\x03[\x00\x01\x02\x03]|...?\x04..\x00\x02).*/
requires-reverse-signature dpd_ssl_client requires-reverse-signature dpd_ssl_client
enable "ssl" enable "ssl"
tcp-state responder tcp-state responder

2
testing/btest/Baseline/scripts.base.protocols.ssl.dpd/.stdout
View file

@ -6,3 +6,5 @@ Client hello, 192.150.187.164, 194.127.84.106, 769
Client hello, 192.150.187.164, 194.127.84.106, 769 Client hello, 192.150.187.164, 194.127.84.106, 769
Start test run Start test run
Client hello, 10.0.0.80, 68.233.76.12, 771 Client hello, 10.0.0.80, 68.233.76.12, 771
Start test run
Client hello, 192.168.6.217, 67.207.128.99, 771

1
testing/btest/scripts/base/protocols/ssl/dpd.test
View file

@ -1,6 +1,7 @@
# @TEST-EXEC: bro -C -b -r $TRACES/tls/ssl-v2.trace %INPUT # @TEST-EXEC: bro -C -b -r $TRACES/tls/ssl-v2.trace %INPUT
# @TEST-EXEC: bro -b -r $TRACES/tls/ssl.v3.trace %INPUT # @TEST-EXEC: bro -b -r $TRACES/tls/ssl.v3.trace %INPUT
# @TEST-EXEC: bro -b -r $TRACES/tls/tls1.2.trace %INPUT # @TEST-EXEC: bro -b -r $TRACES/tls/tls1.2.trace %INPUT
# @TEST-EXEC: bro -b -r $TRACES/tls/tls-early-alert.trace %INPUT
# @TEST-EXEC: btest-diff .stdout # @TEST-EXEC: btest-diff .stdout
@load base/frameworks/dpd @load base/frameworks/dpd