Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-11 11:08:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Final touches to SSL events with record layer version.

Browse source
This commit is contained in:
Johanna Amann 2018-08-23 14:18:38 -07:00
parent aa2488fb69
commit b2a0418dc5
24 changed files with 88 additions and 65 deletions
Download patch file Download diff file Expand all files Collapse all files

4
testing/btest/scripts/base/protocols/ssl/comp_methods.test
View file

@ -3,12 +3,12 @@
# @TEST-EXEC: bro -r $TRACES/tls/tls-conn-with-extensions.trace %INPUT
# @TEST-EXEC: btest-diff .stdout
event ssl_client_hello(c: connection, version: count, possible_ts: time, client_random: string, session_id: string, ciphers: index_vec, comp_methods: index_vec)
event ssl_client_hello(c: connection, version: count, record_version: count, possible_ts: time, client_random: string, session_id: string, ciphers: index_vec, comp_methods: index_vec)
{
print comp_methods;
}
event ssl_server_hello(c: connection, version: count, possible_ts: time, server_random: string, session_id: string, cipher: count, comp_method: count)
event ssl_server_hello(c: connection, version: count, record_version: count, possible_ts: time, server_random: string, session_id: string, cipher: count, comp_method: count)
{
print comp_method;
}

2
testing/btest/scripts/base/protocols/ssl/dpd.test
View file

@ -14,7 +14,7 @@ event bro_init()
print "Start test run";
}
event ssl_client_hello(c: connection, version: count, possible_ts: time, client_random: string, session_id: string, ciphers: index_vec, comp_methods: index_vec) &priority=5
event ssl_client_hello(c: connection, version: count, record_version: count, possible_ts: time, client_random: string, session_id: string, ciphers: index_vec, comp_methods: index_vec) &priority=5
{
print "Client hello", c$id$orig_h, c$id$resp_h, version;
}

2
testing/btest/scripts/base/protocols/ssl/dtls-stun-dpd.test
View file

@ -3,7 +3,7 @@
# @TEST-EXEC: touch dpd.log
# @TEST-EXEC: btest-diff dpd.log
event ssl_client_hello(c: connection, version: count, possible_ts: time, client_random: string, session_id: string, ciphers: index_vec, comp_methods: index_vec)
event ssl_client_hello(c: connection, version: count, record_version: count, possible_ts: time, client_random: string, session_id: string, ciphers: index_vec, comp_methods: index_vec)
{
print version, client_random, session_id, ciphers;
}

4
testing/btest/scripts/base/protocols/ssl/handshake-events.test
View file

@ -22,12 +22,12 @@ event ssl_change_cipher_spec(c: connection, is_orig: bool)
print "CCS", c$id$orig_h, c$id$resp_h, is_orig;
}
event ssl_plaintext_data(c: connection, is_orig: bool, content_type: count, record_version: count, length: count)
event ssl_plaintext_data(c: connection, is_orig: bool, record_version: count, content_type: count, length: count)
{
print "Plaintext data", c$id$orig_h, c$id$resp_h, is_orig, SSL::version_strings[record_version], content_type, length;
}
event ssl_encrypted_data(c: connection, is_orig: bool, content_type: count, record_version: count, length: count)
event ssl_encrypted_data(c: connection, is_orig: bool, record_version: count, content_type: count, length: count)
{
print "Encrypted data", c$id$orig_h, c$id$resp_h, is_orig, SSL::version_strings[record_version], content_type, length;
}

4
testing/btest/scripts/base/protocols/ssl/keyexchange.test
View file

@ -62,7 +62,7 @@ event ssl_established(c: connection) &priority=5
c$ssl$server_cert_sha1 = c$ssl$cert_chain[0]$sha1;
}
event ssl_client_hello(c: connection, version: count, possible_ts: time, client_random: string, session_id: string, ciphers: index_vec) &priority=5
event ssl_client_hello(c: connection, version: count, record_version: count, possible_ts: time, client_random: string, session_id: string, ciphers: index_vec, comp_methods: index_vec) &priority=5
{
set_session(c);
c$ssl$client_random = bytestring_to_hexstr(client_random);
@ -79,7 +79,7 @@ event ssl_client_hello(c: connection, version: count, possible_ts: time, client_
c$ssl$client_cipher_suites = ciphers_str;
}
event ssl_server_hello(c: connection, version: count, possible_ts: time, server_random: string, session_id: string, cipher: count, comp_method: count) &priority=5
event ssl_server_hello(c: connection, version: count, record_version: count, possible_ts: time, server_random: string, session_id: string, cipher: count, comp_method: count) &priority=5
{
set_session(c);
c$ssl$server_random = bytestring_to_hexstr(server_random);

2
testing/btest/scripts/base/protocols/ssl/tls-1.2-ciphers.test
View file

@ -1,7 +1,7 @@
# @TEST-EXEC: bro -r $TRACES/tls/tls1.2.trace %INPUT
# @TEST-EXEC: btest-diff .stdout
event ssl_client_hello(c: connection, version: count, possible_ts: time, client_random: string, session_id: string, ciphers: index_vec, comp_methods: index_vec)
event ssl_client_hello(c: connection, version: count, record_version: count, possible_ts: time, client_random: string, session_id: string, ciphers: index_vec, comp_methods: index_vec)
{
print fmt("Got %d cipher suites", |ciphers|);
for ( i in ciphers )

4
testing/btest/scripts/base/protocols/ssl/tls-1.2-random.test
View file

@ -1,12 +1,12 @@
# @TEST-EXEC: bro -r $TRACES/tls/tls1.2.trace %INPUT
# @TEST-EXEC: btest-diff .stdout
event ssl_client_hello(c: connection, version: count, possible_ts: time, client_random: string, session_id: string, ciphers: index_vec, comp_methods: index_vec)
event ssl_client_hello(c: connection, version: count, record_version: count, possible_ts: time, client_random: string, session_id: string, ciphers: index_vec, comp_methods: index_vec)
{
print client_random;
}
event ssl_server_hello(c: connection, version: count, possible_ts: time, server_random: string, session_id: string, cipher: count, comp_method: count)
event ssl_server_hello(c: connection, version: count, record_version: count, possible_ts: time, server_random: string, session_id: string, cipher: count, comp_method: count)
{
print server_random;
}

2
testing/btest/scripts/base/protocols/ssl/tls13.test
View file

@ -25,7 +25,7 @@ event ssl_established(c: connection)
print "established", c$id;
}
event ssl_encrypted_data(c: connection, is_orig: bool, content_type: count, record_version: count, length: count)
event ssl_encrypted_data(c: connection, is_orig: bool, record_version: count, content_type: count, length: count)
{
print "encrypted", c$id, is_orig, SSL::version_strings[record_version], content_type;
}