Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

socks/dpd: Fix socks5_server side signature

Browse source 
The server replies with \x05 and identifier for the chosen method.
Not quite sure what the previous signature meant capture.

See also: https://datatracker.ietf.org/doc/html/rfc1928#section-3

Closes #3099.
This commit is contained in:
Arne Welzel 2023-06-05 13:34:42 +02:00
parent a18d6c9400
commit d6ca1ec4f6
5 changed files with 19 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

4
scripts/base/protocols/socks/dpd.sig
View file

@ -40,9 +40,7 @@ signature dpd_socks5_server {
requires-reverse-signature dpd_socks5_client
# Watch for a single authentication method to be chosen by the server or
# the server to indicate the no authentication is required.
payload /^\x05(\x00|\x01[\x00\x01\x02])/
payload /^\x05[\x00\x01\x02\xff]/
tcp-state responder
enable "socks"
}