Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-14 12:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

make tls heartbeat messages a bit better.

Browse source
This commit is contained in:
Bernhard Amann 2014-04-08 11:40:48 -07:00
parent 4d33bdbb1e
commit cb87f834f9
1 changed files with 5 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

9
scripts/policy/protocols/ssl/heartbleed.bro
View file

@ -30,12 +30,11 @@ event ssl_heartbeat(c: connection, is_orig: bool, length: count, heartbeat_type:
{ {
local checklength: count = (length<(3+16)) ? length : (length - 3 - 16); local checklength: count = (length<(3+16)) ? length : (length - 3 - 16);
if ( payload_length > checklength ) if ( payload_length > checklength )
{ {
c$ssl$heartbleed_detected = T; c$ssl$heartbleed_detected = T;
NOTICE([$note=SSL_Heartbeat_Attack, NOTICE([$note=SSL_Heartbeat_Attack,
$msg="An TLS heartbleed attack was detected!", $msg=fmt("An TLS heartbleed attack was detected! Record length %d, payload length %d", length, payload_length),
$conn=c $conn=c
]); ]);
} }
@ -60,13 +59,15 @@ event ssl_encrypted_heartbeat(c: connection, is_orig: bool, length: count)
if ( c$ssl$originator_heartbeats > c$ssl$responder_heartbeats + 3 ) if ( c$ssl$originator_heartbeats > c$ssl$responder_heartbeats + 3 )
NOTICE([$note=SSL_Heartbeat_Many_Requests, NOTICE([$note=SSL_Heartbeat_Many_Requests,
$msg="Seeing more than 3 heartbeat requests without replies from server. Possible attack?", $msg="Seeing more than 3 heartbeat requests without replies from server. Possible attack?",
$conn=c $conn=c,
$n=(c$ssl$originator_heartbeats-c$ssl$responder_heartbeats)
]); ]);
if ( is_orig && length < 19 ) if ( is_orig && length < 19 )
NOTICE([$note=SSL_Heartbeat_Odd_Length, NOTICE([$note=SSL_Heartbeat_Odd_Length,
$msg="Heartbeat message smaller than minimum length. Probable attack.", $msg="Heartbeat message smaller than minimum length. Probable attack.",
$conn=c $conn=c,
$n=length
]); ]);
if ( is_orig ) if ( is_orig )