Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-09 01:58:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Spicy TLS analyzer: basic functionality working

Browse source 
It compiles, it creates some log - but it is not anywhere near on par
with the old SSL analyzer.
This commit is contained in:
Johanna Amann 2023-04-05 15:39:54 +01:00
parent 71cd4b2cf4
commit b510b0d8d1
5 changed files with 223 additions and 203 deletions
Download patch file Download diff file Expand all files Collapse all files

16
scripts/base/protocols/ssl/dpd.sig
View file

@ -3,7 +3,7 @@ signature dpd_tls_server {
# SSL3 / TLS Server hello.
payload /^(\x15\x03[\x00\x01\x02\x03]....)?\x16\x03[\x00\x01\x02\x03]..\x02...((\x03[\x00\x01\x02\x03\x04])|(\x7F[\x00-\x50])).*/
tcp-state responder
enable "ssl"
enable "tls"
}
signature dpd_tls_client {
@ -11,12 +11,12 @@ signature dpd_tls_client {
# SSL3 / TLS Client hello.
payload /^\x16\x03[\x00\x01\x02\x03]..\x01...\x03[\x00\x01\x02\x03].*/
tcp-state originator
enable "ssl"
enable "tls"
}
signature dpd_dtls_client {
ip-proto == udp
# Client hello.
payload /^\x16\xfe[\xff\xfd]\x00\x00\x00\x00\x00\x00\x00...\x01...........\xfe[\xff\xfd].*/
enable "dtls"
}
# signature dpd_dtls_client {
# ip-proto == udp
# # Client hello.
# payload /^\x16\xfe[\xff\xfd]\x00\x00\x00\x00\x00\x00\x00...\x01...........\xfe[\xff\xfd].*/
# enable "dtls"
# }