mirror of
https://github.com/zeek/zeek.git
synced 2025-10-07 09:08:20 +00:00
Merge remote-tracking branch 'origin/master' into topic/johanna/websockets
This commit is contained in:
Johanna Amann
commit
cd345caadb
229 changed files with 6335 additions and 1407 deletions
6
testing/btest/scripts/base/protocols/irc/longline.test
Normal file
6
testing/btest/scripts/base/protocols/irc/longline.test
Normal file
|
|
@ -0,0 +1,6 @@
|
|||
# This tests that an excessively long line is truncated by the contentline
|
||||
# analyzer
|
||||
|
||||
# @TEST-EXEC: bro -C -r $TRACES/contentline-irc-5k-line.pcap %INPUT
|
||||
# @TEST-EXEC: btest-diff weird.log
|
||||
|
||||
|
|
@ -3,3 +3,9 @@
|
|||
# @TEST-EXEC: btest-diff tunnel.log
|
||||
|
||||
@load base/protocols/socks
|
||||
|
||||
redef SOCKS::default_capture_password = T;
|
||||
|
||||
@TEST-START-NEXT
|
||||
|
||||
@load base/protocols/socks
|
||||
|
|
|
|||
|
|
@ -0,0 +1,6 @@
|
|||
# This tests a successful login with pubkey using curve25519 as the KEX algorithm
|
||||
|
||||
# @TEST-EXEC: bro -b -r $TRACES/ssh/ssh_kex_curve25519.pcap %INPUT
|
||||
# @TEST-EXEC: btest-diff ssh.log
|
||||
|
||||
@load base/protocols/ssh
|
||||
116
testing/btest/scripts/base/protocols/ssl/keyexchange.test
Normal file
116
testing/btest/scripts/base/protocols/ssl/keyexchange.test
Normal file
|
|
@ -0,0 +1,116 @@
|
|||
# @TEST-EXEC: bro -r $TRACES/tls/dhe.pcap %INPUT
|
||||
# @TEST-EXEC: cat ssl.log > ssl-all.log
|
||||
# @TEST-EXEC: bro -r $TRACES/tls/ecdhe.pcap %INPUT
|
||||
# @TEST-EXEC: cat ssl.log >> ssl-all.log
|
||||
# @TEST-EXEC: bro -r $TRACES/tls/ssl.v3.trace %INPUT
|
||||
# @TEST-EXEC: cat ssl.log >> ssl-all.log
|
||||
# @TEST-EXEC: btest-diff ssl-all.log
|
||||
|
||||
# Test the new client and server key exchange events.
|
||||
|
||||
@load base/protocols/ssl
|
||||
@load base/files/x509
|
||||
@load protocols/ssl/extract-certs-pem.bro
|
||||
|
||||
module SSL;
|
||||
|
||||
export {
|
||||
redef record Info += {
|
||||
# ClientHello
|
||||
client_random: string &log &optional;
|
||||
client_cipher_suites: string &log &optional;
|
||||
|
||||
# ServerHello
|
||||
server_random: string &log &optional;
|
||||
|
||||
# ServerKeyExchange
|
||||
server_dh_p: string &log &optional;
|
||||
server_dh_q: string &log &optional;
|
||||
server_dh_Ys: string &log &optional;
|
||||
server_ecdh_point: string &log &optional;
|
||||
server_signature: string &log &optional;
|
||||
|
||||
# ServerCertificate
|
||||
server_cert_sha1: string &log &optional;
|
||||
|
||||
# ClientKeyExchange
|
||||
client_rsa_pms: string &log &optional;
|
||||
client_dh_Yc: string &log &optional;
|
||||
client_ecdh_point: string &log &optional;
|
||||
};
|
||||
|
||||
## Control if host certificates offered by the defined hosts
|
||||
## will be written to the PEM certificates file.
|
||||
## Choices are: LOCAL_HOSTS, REMOTE_HOSTS, ALL_HOSTS, NO_HOSTS.
|
||||
redef extract_certs_pem = ALL_HOSTS;
|
||||
}
|
||||
|
||||
event ssl_established(c: connection) &priority=5
|
||||
{
|
||||
if ( ! c$ssl?$cert_chain || |c$ssl$cert_chain| == 0 ||
|
||||
! c$ssl$cert_chain[0]?$x509 )
|
||||
return;
|
||||
|
||||
c$ssl$server_cert_sha1 = c$ssl$cert_chain[0]$sha1;
|
||||
}
|
||||
|
||||
event ssl_client_hello(c: connection, version: count, possible_ts: time, client_random: string, session_id: string, ciphers: index_vec) &priority=5
|
||||
{
|
||||
set_session(c);
|
||||
c$ssl$client_random = bytestring_to_hexstr(client_random);
|
||||
|
||||
local ciphers_str = "";
|
||||
for (i in ciphers)
|
||||
{
|
||||
ciphers_str += cipher_desc[ciphers[i]];
|
||||
if ( i != |ciphers|-1)
|
||||
{
|
||||
ciphers_str += ",";
|
||||
}
|
||||
}
|
||||
c$ssl$client_cipher_suites = ciphers_str;
|
||||
}
|
||||
|
||||
event ssl_server_hello(c: connection, version: count, possible_ts: time, server_random: string, session_id: string, cipher: count, comp_method: count) &priority=5
|
||||
{
|
||||
set_session(c);
|
||||
c$ssl$server_random = bytestring_to_hexstr(server_random);
|
||||
}
|
||||
|
||||
event ssl_dh_server_params(c: connection, p: string, q: string, Ys: string) &priority=5
|
||||
{
|
||||
set_session(c);
|
||||
c$ssl$server_dh_p = bytestring_to_hexstr(p);
|
||||
c$ssl$server_dh_q = bytestring_to_hexstr(q);
|
||||
c$ssl$server_dh_Ys = bytestring_to_hexstr(Ys);
|
||||
}
|
||||
|
||||
event ssl_ecdh_server_params(c: connection, curve: count, point: string) &priority=5
|
||||
{
|
||||
set_session(c);
|
||||
c$ssl$server_ecdh_point = bytestring_to_hexstr(point);
|
||||
}
|
||||
|
||||
event ssl_server_signature(c: connection, signed_params: string) &priority=5
|
||||
{
|
||||
set_session(c);
|
||||
c$ssl$server_signature = bytestring_to_hexstr(signed_params);
|
||||
}
|
||||
|
||||
event ssl_rsa_client_pms(c: connection, pms: string) &priority=5
|
||||
{
|
||||
set_session(c);
|
||||
c$ssl$client_rsa_pms = bytestring_to_hexstr(pms);
|
||||
}
|
||||
|
||||
event ssl_dh_client_params(c: connection, Yc: string) &priority=5
|
||||
{
|
||||
set_session(c);
|
||||
c$ssl$client_dh_Yc = bytestring_to_hexstr(Yc);
|
||||
}
|
||||
|
||||
event ssl_ecdh_client_params(c: connection, point: string) &priority=5
|
||||
{
|
||||
set_session(c);
|
||||
c$ssl$client_ecdh_point = bytestring_to_hexstr(point);
|
||||
}
|
||||
43
testing/btest/scripts/base/protocols/ssl/ocsp-http-get.test
Normal file
43
testing/btest/scripts/base/protocols/ssl/ocsp-http-get.test
Normal file
|
|
@ -0,0 +1,43 @@
|
|||
# This tests a normal OCSP request sent through HTTP GET
|
||||
|
||||
# @TEST-EXEC: bro -C -r $TRACES/tls/ocsp-http-get.pcap %INPUT
|
||||
# @TEST-EXEC: btest-diff ocsp.log
|
||||
# @TEST-EXEC: btest-diff .stdout
|
||||
|
||||
@load files/x509/log-ocsp
|
||||
|
||||
event bro_init()
|
||||
{
|
||||
Files::register_for_mime_type(Files::ANALYZER_OCSP_REQUEST, "application/ocsp-request");
|
||||
Files::register_for_mime_type(Files::ANALYZER_OCSP_REPLY, "application/ocsp-response");
|
||||
}
|
||||
|
||||
event ocsp_extension(f: fa_file, ext: X509::Extension, global_resp: bool)
|
||||
{
|
||||
print "extension: ", ext, global_resp;
|
||||
}
|
||||
|
||||
event ocsp_request(f: fa_file, version: count, requestorName: string)
|
||||
{
|
||||
print "request", version, requestorName;
|
||||
}
|
||||
|
||||
event ocsp_request_certificate(f: fa_file, hashAlgorithm: string, issuerNameHash: string, issuerKeyHash: string, serialNumber: string)
|
||||
{
|
||||
print "request cert", hashAlgorithm, issuerNameHash, issuerKeyHash, serialNumber;
|
||||
}
|
||||
|
||||
event ocsp_response_status(f: fa_file, status: string)
|
||||
{
|
||||
print "ocsp_response_status", status;
|
||||
}
|
||||
|
||||
event ocsp_response_bytes(f: fa_file, resp_ref: opaque of ocsp_resp, status: string, version: count, responderId: string, producedAt: time, signatureAlgorithm: string, certs: x509_opaque_vector)
|
||||
{
|
||||
print "ocsp_response_bytes", status, version, responderId, producedAt, signatureAlgorithm;
|
||||
}
|
||||
|
||||
event ocsp_response_certificate(f: fa_file, hashAlgorithm: string, issuerNameHash: string, issuerKeyHash: string, serialNumber: string, certStatus: string, revoketime: time, revokereason: string, thisUpdate: time, nextUpdate: time)
|
||||
{
|
||||
print "ocsp_response_certificate", hashAlgorithm, issuerNameHash, issuerKeyHash, serialNumber, certStatus, revoketime, revokereason, thisUpdate, nextUpdate;
|
||||
}
|
||||
|
|
@ -0,0 +1,42 @@
|
|||
# This tests a OCSP request missing response
|
||||
|
||||
# @TEST-EXEC: bro -C -r $TRACES/tls/ocsp-request-only.pcap %INPUT
|
||||
# @TEST-EXEC: btest-diff .stdout
|
||||
|
||||
@load files/x509/log-ocsp
|
||||
|
||||
event bro_init()
|
||||
{
|
||||
Files::register_for_mime_type(Files::ANALYZER_OCSP_REQUEST, "application/ocsp-request");
|
||||
Files::register_for_mime_type(Files::ANALYZER_OCSP_REPLY, "application/ocsp-response");
|
||||
}
|
||||
|
||||
event ocsp_extension(f: fa_file, ext: X509::Extension, global_resp: bool)
|
||||
{
|
||||
print "extension: ", ext, global_resp;
|
||||
}
|
||||
|
||||
event ocsp_request(f: fa_file, version: count, requestorName: string)
|
||||
{
|
||||
print "request", version, requestorName;
|
||||
}
|
||||
|
||||
event ocsp_request_certificate(f: fa_file, hashAlgorithm: string, issuerNameHash: string, issuerKeyHash: string, serialNumber: string)
|
||||
{
|
||||
print "request cert", hashAlgorithm, issuerNameHash, issuerKeyHash, serialNumber;
|
||||
}
|
||||
|
||||
event ocsp_response_status(f: fa_file, status: string)
|
||||
{
|
||||
print "ocsp_response_status", status;
|
||||
}
|
||||
|
||||
event ocsp_response_bytes(f: fa_file, resp_ref: opaque of ocsp_resp, status: string, version: count, responderId: string, producedAt: time, signatureAlgorithm: string, certs: x509_opaque_vector)
|
||||
{
|
||||
print "ocsp_response_bytes", status, version, responderId, producedAt, signatureAlgorithm;
|
||||
}
|
||||
|
||||
event ocsp_response_certificate(f: fa_file, hashAlgorithm: string, issuerNameHash: string, issuerKeyHash: string, serialNumber: string, certStatus: string, revoketime: time, revokereason: string, thisUpdate: time, nextUpdate: time)
|
||||
{
|
||||
print "ocsp_response_certificate", hashAlgorithm, issuerNameHash, issuerKeyHash, serialNumber, certStatus, revoketime, revokereason, thisUpdate, nextUpdate;
|
||||
}
|
||||
|
|
@ -0,0 +1,43 @@
|
|||
# This tests a pair of normal OCSP request and response
|
||||
|
||||
# @TEST-EXEC: bro -C -r $TRACES/tls/ocsp-request-response.pcap %INPUT
|
||||
# @TEST-EXEC: btest-diff ocsp.log
|
||||
# @TEST-EXEC: btest-diff .stdout
|
||||
|
||||
@load files/x509/log-ocsp
|
||||
|
||||
event bro_init()
|
||||
{
|
||||
Files::register_for_mime_type(Files::ANALYZER_OCSP_REQUEST, "application/ocsp-request");
|
||||
Files::register_for_mime_type(Files::ANALYZER_OCSP_REPLY, "application/ocsp-response");
|
||||
}
|
||||
|
||||
event ocsp_extension(f: fa_file, ext: X509::Extension, global_resp: bool)
|
||||
{
|
||||
print "extension: ", ext, global_resp;
|
||||
}
|
||||
|
||||
event ocsp_request(f: fa_file, version: count, requestorName: string)
|
||||
{
|
||||
print "request", version, requestorName;
|
||||
}
|
||||
|
||||
event ocsp_request_certificate(f: fa_file, hashAlgorithm: string, issuerNameHash: string, issuerKeyHash: string, serialNumber: string)
|
||||
{
|
||||
print "request cert", hashAlgorithm, issuerNameHash, issuerKeyHash, serialNumber;
|
||||
}
|
||||
|
||||
event ocsp_response_status(f: fa_file, status: string)
|
||||
{
|
||||
print "ocsp_response_status", status;
|
||||
}
|
||||
|
||||
event ocsp_response_bytes(f: fa_file, resp_ref: opaque of ocsp_resp, status: string, version: count, responderId: string, producedAt: time, signatureAlgorithm: string, certs: x509_opaque_vector)
|
||||
{
|
||||
print "ocsp_response_bytes", status, version, responderId, producedAt, signatureAlgorithm;
|
||||
}
|
||||
|
||||
event ocsp_response_certificate(f: fa_file, hashAlgorithm: string, issuerNameHash: string, issuerKeyHash: string, serialNumber: string, certStatus: string, revoketime: time, revokereason: string, thisUpdate: time, nextUpdate: time)
|
||||
{
|
||||
print "ocsp_response_certificate", hashAlgorithm, issuerNameHash, issuerKeyHash, serialNumber, certStatus, revoketime, revokereason, thisUpdate, nextUpdate;
|
||||
}
|
||||
|
|
@ -0,0 +1,43 @@
|
|||
# This tests a normal OCSP response missing request
|
||||
|
||||
# @TEST-EXEC: bro -C -r $TRACES/tls/ocsp-response-only.pcap %INPUT
|
||||
# @TEST-EXEC: btest-diff ocsp.log
|
||||
# @TEST-EXEC: btest-diff .stdout
|
||||
|
||||
@load files/x509/log-ocsp
|
||||
|
||||
event bro_init()
|
||||
{
|
||||
Files::register_for_mime_type(Files::ANALYZER_OCSP_REQUEST, "application/ocsp-request");
|
||||
Files::register_for_mime_type(Files::ANALYZER_OCSP_REPLY, "application/ocsp-response");
|
||||
}
|
||||
|
||||
event ocsp_extension(f: fa_file, ext: X509::Extension, global_resp: bool)
|
||||
{
|
||||
print "extension: ", ext, global_resp;
|
||||
}
|
||||
|
||||
event ocsp_request(f: fa_file, version: count, requestorName: string)
|
||||
{
|
||||
print "request", version, requestorName;
|
||||
}
|
||||
|
||||
event ocsp_request_certificate(f: fa_file, hashAlgorithm: string, issuerNameHash: string, issuerKeyHash: string, serialNumber: string)
|
||||
{
|
||||
print "request cert", hashAlgorithm, issuerNameHash, issuerKeyHash, serialNumber;
|
||||
}
|
||||
|
||||
event ocsp_response_status(f: fa_file, status: string)
|
||||
{
|
||||
print "ocsp_response_status", status;
|
||||
}
|
||||
|
||||
event ocsp_response_bytes(f: fa_file, resp_ref: opaque of ocsp_resp, status: string, version: count, responderId: string, producedAt: time, signatureAlgorithm: string, certs: x509_opaque_vector)
|
||||
{
|
||||
print "ocsp_response_bytes", status, version, responderId, producedAt, signatureAlgorithm;
|
||||
}
|
||||
|
||||
event ocsp_response_certificate(f: fa_file, hashAlgorithm: string, issuerNameHash: string, issuerKeyHash: string, serialNumber: string, certStatus: string, revoketime: time, revokereason: string, thisUpdate: time, nextUpdate: time)
|
||||
{
|
||||
print "ocsp_response_certificate", hashAlgorithm, issuerNameHash, issuerKeyHash, serialNumber, certStatus, revoketime, revokereason, thisUpdate, nextUpdate;
|
||||
}
|
||||
43
testing/btest/scripts/base/protocols/ssl/ocsp-revoked.test
Normal file
43
testing/btest/scripts/base/protocols/ssl/ocsp-revoked.test
Normal file
|
|
@ -0,0 +1,43 @@
|
|||
# This tests OCSP response with revocation
|
||||
|
||||
# @TEST-EXEC: bro -C -r $TRACES/tls/ocsp-revoked.pcap %INPUT
|
||||
# @TEST-EXEC: btest-diff ocsp.log
|
||||
# @TEST-EXEC: btest-diff .stdout
|
||||
|
||||
@load files/x509/log-ocsp
|
||||
|
||||
event bro_init()
|
||||
{
|
||||
Files::register_for_mime_type(Files::ANALYZER_OCSP_REQUEST, "application/ocsp-request");
|
||||
Files::register_for_mime_type(Files::ANALYZER_OCSP_REPLY, "application/ocsp-response");
|
||||
}
|
||||
|
||||
event ocsp_extension(f: fa_file, ext: X509::Extension, global_resp: bool)
|
||||
{
|
||||
print "extension: ", ext, global_resp;
|
||||
}
|
||||
|
||||
event ocsp_request(f: fa_file, version: count, requestorName: string)
|
||||
{
|
||||
print "request", version, requestorName;
|
||||
}
|
||||
|
||||
event ocsp_request_certificate(f: fa_file, hashAlgorithm: string, issuerNameHash: string, issuerKeyHash: string, serialNumber: string)
|
||||
{
|
||||
print "request cert", hashAlgorithm, issuerNameHash, issuerKeyHash, serialNumber;
|
||||
}
|
||||
|
||||
event ocsp_response_status(f: fa_file, status: string)
|
||||
{
|
||||
print "ocsp_response_status", status;
|
||||
}
|
||||
|
||||
event ocsp_response_bytes(f: fa_file, resp_ref: opaque of ocsp_resp, status: string, version: count, responderId: string, producedAt: time, signatureAlgorithm: string, certs: x509_opaque_vector)
|
||||
{
|
||||
print "ocsp_response_bytes", status, version, responderId, producedAt, signatureAlgorithm;
|
||||
}
|
||||
|
||||
event ocsp_response_certificate(f: fa_file, hashAlgorithm: string, issuerNameHash: string, issuerKeyHash: string, serialNumber: string, certStatus: string, revoketime: time, revokereason: string, thisUpdate: time, nextUpdate: time)
|
||||
{
|
||||
print "ocsp_response_certificate", hashAlgorithm, issuerNameHash, issuerKeyHash, serialNumber, certStatus, revoketime, revokereason, thisUpdate, nextUpdate;
|
||||
}
|
||||
|
|
@ -0,0 +1,39 @@
|
|||
# @TEST-EXEC: bro -r $TRACES/tls/signed_certificate_timestamp.pcap %INPUT
|
||||
# @TEST-EXEC: btest-diff .stdout
|
||||
|
||||
export {
|
||||
type LogInfo: record {
|
||||
version: count;
|
||||
logid: string;
|
||||
timestamp: count;
|
||||
sig_alg: count;
|
||||
hash_alg: count;
|
||||
signature: string;
|
||||
};
|
||||
}
|
||||
|
||||
redef record SSL::Info += {
|
||||
ct_proofs: vector of LogInfo &default=vector();
|
||||
};
|
||||
|
||||
event ssl_extension_signed_certificate_timestamp(c: connection, is_orig: bool, version: count, logid: string, timestamp: count, signature_and_hashalgorithm: SSL::SignatureAndHashAlgorithm, signature: string)
|
||||
{
|
||||
print version, SSL::ct_logs[logid]$description, double_to_time(timestamp/1000.0), signature_and_hashalgorithm;
|
||||
c$ssl$ct_proofs[|c$ssl$ct_proofs|] = LogInfo($version=version, $logid=logid, $timestamp=timestamp, $sig_alg=signature_and_hashalgorithm$SignatureAlgorithm, $hash_alg=signature_and_hashalgorithm$HashAlgorithm, $signature=signature);
|
||||
}
|
||||
|
||||
event ssl_established(c: connection)
|
||||
{
|
||||
if ( ! c$ssl?$cert_chain || |c$ssl$cert_chain| == 0 || ! c$ssl$cert_chain[0]?$x509 )
|
||||
return;
|
||||
|
||||
local cert = c$ssl$cert_chain[0]$x509$handle;
|
||||
|
||||
for ( i in c$ssl$ct_proofs )
|
||||
{
|
||||
local log = c$ssl$ct_proofs[i];
|
||||
|
||||
print "Verify of", SSL::ct_logs[log$logid]$description, sct_verify(cert, log$logid, SSL::ct_logs[log$logid]$key, log$signature, log$timestamp, log$hash_alg);
|
||||
print "Bad verify of", SSL::ct_logs[log$logid]$description, sct_verify(cert, log$logid, SSL::ct_logs[log$logid]$key, log$signature, log$timestamp+1, log$hash_alg);
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,16 @@
|
|||
# @TEST-EXEC: bro -C -r $TRACES/tls/chrome-63.0.3211.0-canary-tls_experiment.pcap %INPUT
|
||||
# @TEST-EXEC: btest-diff ssl.log
|
||||
# @TEST-EXEC: btest-diff .stdout
|
||||
|
||||
# This is a trace that uses a completely non-standard way of establishing TLS 1.3; this seems
|
||||
# to be an undocumented extension where the TLS version is negotiated via the server sending back
|
||||
# an supported_versions extension (which, according to the RFC is strictly prohibited).
|
||||
#
|
||||
# This only seems to happen with Chrome talking to google servers. We do not recognize this as
|
||||
# TLS 1.3, but we do not abort when encountering traffic like this.
|
||||
|
||||
event ssl_extension(c: connection, is_orig: bool, code: count, val: string)
|
||||
{
|
||||
if ( ! is_orig && code == 43 )
|
||||
print bytestring_to_hexstr(val);
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue