Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-04 07:38:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Spicy TLS: fix parsing of no-extension hellos, port registration

Browse source 
Parsing of client/server hellos that do not contain extensions should
now work correctly.

The port registration is now done Zeek-side, wich fixes some test
failures.
This commit is contained in:
Johanna Amann 2023-11-08 08:00:49 +00:00
parent 32d27b1b3f
commit dda1bbb7fc
4 changed files with 20 additions and 19 deletions
Download patch file Download diff file Expand all files Collapse all files

12
scripts/base/protocols/ssl/files.zeek
View file

@ -96,13 +96,13 @@ function describe_file(f: fa_file): string
event zeek_init() &priority=5
{
# Files::register_protocol(Analyzer::ANALYZER_SSL,
# [$get_file_handle = SSL::get_file_handle,
# $describe = SSL::describe_file]);
Files::register_protocol(Analyzer::ANALYZER_SSL,
[$get_file_handle = SSL::get_file_handle,
$describe = SSL::describe_file]);
# Files::register_protocol(Analyzer::ANALYZER_DTLS,
# [$get_file_handle = SSL::get_file_handle,
# $describe = SSL::describe_file]);
Files::register_protocol(Analyzer::ANALYZER_DTLS,
[$get_file_handle = SSL::get_file_handle,
$describe = SSL::describe_file]);
local ssl_filter = Log::get_filter(SSL::LOG, "default");

4
scripts/base/protocols/ssl/main.zeek
View file

@ -197,8 +197,8 @@ redef likely_server_ports += { ssl_ports, dtls_ports };
event zeek_init() &priority=6
{
Log::create_stream(SSL::LOG, [$columns=Info, $ev=log_ssl, $path="ssl", $policy=log_policy]);
#Analyzer::register_for_ports(Analyzer::ANALYZER_SSL, ssl_ports);
#Analyzer::register_for_ports(Analyzer::ANALYZER_DTLS, dtls_ports);
Analyzer::register_for_ports(Analyzer::ANALYZER_SSL, ssl_ports);
Analyzer::register_for_ports(Analyzer::ANALYZER_DTLS, dtls_ports);
}
function set_session(c: connection)