diff --git a/scripts/base/protocols/ssl/main.bro b/scripts/base/protocols/ssl/main.bro index 9eab0ca970..3958a90fa2 100644 --- a/scripts/base/protocols/ssl/main.bro +++ b/scripts/base/protocols/ssl/main.bro @@ -153,7 +153,7 @@ function finish(c: connection) disable_analyzer(c$id, c$ssl$analyzer_id); } -event ssl_client_hello(c: connection, version: count, possible_ts: time, client_random: string, session_id: string, ciphers: count_set) &priority=5 +event ssl_client_hello(c: connection, version: count, possible_ts: time, client_random: string, session_id: string, ciphers: index_vec) &priority=5 { set_session(c); diff --git a/src/analyzer/protocol/ssl/events.bif b/src/analyzer/protocol/ssl/events.bif index b673954e53..01abb87745 100644 --- a/src/analyzer/protocol/ssl/events.bif +++ b/src/analyzer/protocol/ssl/events.bif @@ -26,7 +26,7 @@ ## ## .. bro:see:: ssl_alert ssl_established ssl_extension ssl_server_hello ## ssl_session_ticket_handshake x509_certificate x509_error x509_extension -event ssl_client_hello%(c: connection, version: count, possible_ts: time, client_random: string, session_id: string, ciphers: count_set%); +event ssl_client_hello%(c: connection, version: count, possible_ts: time, client_random: string, session_id: string, ciphers: index_vec%); ## Generated for an SSL/TLS server's initial *hello* message. SSL/TLS sessions ## start with an unencrypted handshake, and Bro extracts as much information out diff --git a/src/analyzer/protocol/ssl/ssl-analyzer.pac b/src/analyzer/protocol/ssl/ssl-analyzer.pac index 4043d1ac89..18d3812742 100644 --- a/src/analyzer/protocol/ssl/ssl-analyzer.pac +++ b/src/analyzer/protocol/ssl/ssl-analyzer.pac @@ -168,19 +168,18 @@ refine connection SSL_Conn += { else std::transform(cipher_suites24->begin(), cipher_suites24->end(), std::back_inserter(*cipher_suites), to_int()); - TableVal* cipher_set = new TableVal(internal_type("count_set")->AsTableType()); + VectorVal* cipher_vec = new VectorVal(internal_type("index_vec")->AsVectorType()); for ( unsigned int i = 0; i < cipher_suites->size(); ++i ) { Val* ciph = new Val((*cipher_suites)[i], TYPE_COUNT); - cipher_set->Assign(ciph, 0); - Unref(ciph); + cipher_vec->Assign(i, ciph); } BifEvent::generate_ssl_client_hello(bro_analyzer(), bro_analyzer()->Conn(), version, ts, new StringVal(client_random.length(), (const char*) client_random.data()), to_string_val(session_id), - cipher_set); + cipher_vec); delete cipher_suites; } diff --git a/testing/btest/Baseline/scripts.base.protocols.ssl.tls-1.2-ciphers/.stdout b/testing/btest/Baseline/scripts.base.protocols.ssl.tls-1.2-ciphers/.stdout new file mode 100644 index 0000000000..2f2781f430 --- /dev/null +++ b/testing/btest/Baseline/scripts.base.protocols.ssl.tls-1.2-ciphers/.stdout @@ -0,0 +1,81 @@ +Got 80 cipher suites +TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 +TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 +TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 +TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 +TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA +TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA +TLS_SRP_SHA_DSS_WITH_AES_256_CBC_SHA +TLS_SRP_SHA_RSA_WITH_AES_256_CBC_SHA +TLS_DHE_DSS_WITH_AES_256_GCM_SHA384 +TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 +TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 +TLS_DHE_DSS_WITH_AES_256_CBC_SHA256 +TLS_DHE_RSA_WITH_AES_256_CBC_SHA +TLS_DHE_DSS_WITH_AES_256_CBC_SHA +TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA +TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA +TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384 +TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384 +TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384 +TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384 +TLS_ECDH_RSA_WITH_AES_256_CBC_SHA +TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA +TLS_RSA_WITH_AES_256_GCM_SHA384 +TLS_RSA_WITH_AES_256_CBC_SHA256 +TLS_RSA_WITH_AES_256_CBC_SHA +TLS_RSA_WITH_CAMELLIA_256_CBC_SHA +TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA +TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA +TLS_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA +TLS_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA +TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA +TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA +TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA +TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA +TLS_RSA_WITH_3DES_EDE_CBC_SHA +TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 +TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 +TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 +TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 +TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA +TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA +TLS_SRP_SHA_DSS_WITH_AES_128_CBC_SHA +TLS_SRP_SHA_RSA_WITH_AES_128_CBC_SHA +TLS_DHE_DSS_WITH_AES_128_GCM_SHA256 +TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 +TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 +TLS_DHE_DSS_WITH_AES_128_CBC_SHA256 +TLS_DHE_RSA_WITH_AES_128_CBC_SHA +TLS_DHE_DSS_WITH_AES_128_CBC_SHA +TLS_DHE_RSA_WITH_SEED_CBC_SHA +TLS_DHE_DSS_WITH_SEED_CBC_SHA +TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA +TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA +TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256 +TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256 +TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256 +TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256 +TLS_ECDH_RSA_WITH_AES_128_CBC_SHA +TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA +TLS_RSA_WITH_AES_128_GCM_SHA256 +TLS_RSA_WITH_AES_128_CBC_SHA256 +TLS_RSA_WITH_AES_128_CBC_SHA +TLS_RSA_WITH_SEED_CBC_SHA +TLS_RSA_WITH_CAMELLIA_128_CBC_SHA +TLS_RSA_WITH_IDEA_CBC_SHA +TLS_ECDHE_RSA_WITH_RC4_128_SHA +TLS_ECDHE_ECDSA_WITH_RC4_128_SHA +TLS_ECDH_RSA_WITH_RC4_128_SHA +TLS_ECDH_ECDSA_WITH_RC4_128_SHA +TLS_RSA_WITH_RC4_128_SHA +TLS_RSA_WITH_RC4_128_MD5 +TLS_DHE_RSA_WITH_DES_CBC_SHA +TLS_DHE_DSS_WITH_DES_CBC_SHA +TLS_RSA_WITH_DES_CBC_SHA +TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA +TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA +TLS_RSA_EXPORT_WITH_DES40_CBC_SHA +TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5 +TLS_RSA_EXPORT_WITH_RC4_40_MD5 +TLS_EMPTY_RENEGOTIATION_INFO_SCSV diff --git a/testing/btest/scripts/base/protocols/ssl/tls-1.2-ciphers.test b/testing/btest/scripts/base/protocols/ssl/tls-1.2-ciphers.test new file mode 100644 index 0000000000..be1a2c2c2d --- /dev/null +++ b/testing/btest/scripts/base/protocols/ssl/tls-1.2-ciphers.test @@ -0,0 +1,9 @@ +# @TEST-EXEC: bro -r $TRACES/tls1.2.trace %INPUT +# @TEST-EXEC: btest-diff .stdout + +event ssl_client_hello(c: connection, version: count, possible_ts: time, client_random: string, session_id: string, ciphers: index_vec) + { + print fmt("Got %d cipher suites", |ciphers|); + for ( i in ciphers ) + print SSL::cipher_desc[ciphers[i]]; + } diff --git a/testing/btest/scripts/base/protocols/ssl/tls-1.2-random.test b/testing/btest/scripts/base/protocols/ssl/tls-1.2-random.test index acea4fa131..d2f82c4bc0 100644 --- a/testing/btest/scripts/base/protocols/ssl/tls-1.2-random.test +++ b/testing/btest/scripts/base/protocols/ssl/tls-1.2-random.test @@ -1,7 +1,7 @@ # @TEST-EXEC: bro -r $TRACES/tls1.2.trace %INPUT # @TEST-EXEC: btest-diff .stdout -event ssl_client_hello(c: connection, version: count, possible_ts: time, client_random: string, session_id: string, ciphers: count_set) +event ssl_client_hello(c: connection, version: count, possible_ts: time, client_random: string, session_id: string, ciphers: index_vec) { print client_random; }