Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

DTLS 1.3: finish implementation, add connection_id extension

Browse source 
This commit adds support for the connection_id extension, adds a trace
that uses DTLS 1.3 connection IDs, and adds parsing for the DTLS 1.3
unified header, in case connection IDs are not used.

In case connection IDs are used, parsing of the DTLS 1.3 unified header
is skipped. This is due to the fact, that the header then contains a
variable length element, with the length of the element not given in the
header. Instead, the length is given in the client/server hello message
of the opposite side of the connection (which we might have missed).

Furthermore, parsing is not of a high importance, since we are not
passing the connection ID, or any of the other parsed values of the
unified header into scriptland.
This commit is contained in:
Johanna Amann 2023-05-10 11:08:26 +01:00
parent d6c4c510ea
commit a8e84c6192
12 changed files with 188 additions and 19 deletions
Download patch file Download diff file Expand all files Collapse all files

26
testing/btest/scripts/base/protocols/ssl/dtls-13.test
View file

@ -1,6 +1,30 @@
# This tests a normal SSL connection and the log it outputs.
# @TEST-EXEC: zeek -C -r $TRACES/tls/dtls13-wolfssl.pcap %INPUT
# @TEST-EXEC: btest-diff ssl.log
# @TEST-EXEC: cp ssl.log ssl-all.log
# @TEST-EXEC: echo "start CID test"
# @TEST-EXEC: zeek -C -r $TRACES/tls/dtls13-cid.pcap %INPUT
# @TEST-EXEC: cat ssl.log >> ssl-all.log
# @TEST-EXEC: btest-diff ssl-all.log
# @TEST-EXEC: btest-diff .stdout
# @TEST-EXEC: test ! -f dpd.log
event ssl_client_hello(c: connection, version: count, record_version: count, possible_ts: time, client_random: string, session_id: string, ciphers: index_vec, comp_methods: index_vec)
{
print "CH", c$id, version, record_version;
}
event ssl_server_hello(c: connection, version: count, record_version: count, possible_ts: time, server_random: string, session_id: string, cipher: count, comp_method: count)
{
print "SH", c$id, version, record_version;
}
event ssl_extension_connection_id(c: connection, is_client: bool, cid: string)
{
print "CID", c$id, is_client, cid;
}
event ssl_encrypted_data(c: connection, is_client: bool, record_version: count, content_type: count, length: count)
{
print "Encrypted", c$id, is_client, record_version, content_type, length;
}