Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Merge remote-tracking branch 'origin/topic/johanna/gh-4547'

Browse source 
* origin/topic/johanna/gh-4547:
  Spicy SSL analyzer: make record layer version parsing more strict
This commit is contained in:
Johanna Amann 2025-06-26 20:21:31 +01:00
commit dbeadc65ba
4 changed files with 13 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

11
CHANGES
View file

@ -1,3 +1,14 @@
8.0.0-dev.551 | 2025-06-26 20:21:31 +0100
* Spicy SSL analyzer: make record layer version parsing more strict (Johanna Amann, Corelight)
The Spicy based SSL analyzer was, so far, more permissive with the
record layer versions that it would accept.
This change brings the parsing of record layer versions in line with the
binpac based analyzer. This behavioral difference was discovered due to
a test that changed with the recent dpd log changes.
8.0.0-dev.548 | 2025-06-26 18:49:31 +0200 8.0.0-dev.548 | 2025-06-26 18:49:31 +0200
* extend script coverage profiling to track whether conditionals evaluate to true/false (Vern Paxson, Corelight) * extend script coverage profiling to track whether conditionals evaluate to true/false (Vern Paxson, Corelight)

2
VERSION
View file

@ -1 +1 @@
8.0.0-dev.548 8.0.0-dev.551

2
src/analyzer/protocol/ssl/spicy/SSL.spicy
View file

@ -740,7 +740,7 @@ type SSL2ClientMasterKey = unit(length: uint16, inout sh: Share) {
# For TLS-y protocols - determine how to continue # For TLS-y protocols - determine how to continue
type TLSRecordFragmentChoice = unit(content_type: uint8, handshakesink: sink&, alertsink: sink&, inout msg: Message, inout sh: Share) { type TLSRecordFragmentChoice = unit(content_type: uint8, handshakesink: sink&, alertsink: sink&, inout msg: Message, inout sh: Share) {
# content_type: uint8; # &convert=ContentType($$); # content_type: uint8; # &convert=ContentType($$);
version: uint16; version: uint16 &requires=($$ == SSLv3 || $$ == TLSv10 || $$ == TLSv11 || $$ == TLSv12 : "Invalid version in record layer. Version: %s" % $$);
switch (is_dtls_version(self.version)) { switch (is_dtls_version(self.version)) {
True -> dtlsfragment: DTLSRecordFragment(content_type, handshakesink, alertsink, msg, sh); True -> dtlsfragment: DTLSRecordFragment(content_type, handshakesink, alertsink, msg, sh);

3
testing/btest/core/pppoe-over-qinq.zeek
View file

@ -1,5 +1,2 @@
# Disable test temporarily - see GH-4547
# @TEST-REQUIRES: ! have-spicy-ssl
# @TEST-EXEC: zeek -r $TRACES/pppoe-over-qinq.pcap # @TEST-EXEC: zeek -r $TRACES/pppoe-over-qinq.pcap
# @TEST-EXEC: btest-diff conn.log # @TEST-EXEC: btest-diff conn.log