Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-08 09:38:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

SSL: Fix logging of Hello Retry Requests

Browse source 
It turns out that we never logged hello retry requests correctly in the
ssl_history field.

Hello retry requests are (in their final version) signaled by a specific
random value in the server random.

This commit fixes this oversight, and hello retry requests are now
correctly logged as such.
This commit is contained in:
Johanna Amann 2023-05-03 13:34:48 +01:00
parent cc25129b2f
commit e7c9fa1f6e
2 changed files with 16 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

2
testing/btest/Baseline/scripts.base.protocols.ssl.tls13/ssl-out.log
View file

@ -61,5 +61,5 @@ XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 192.168.178.80 54220 174.138.9.219 443 TLSv1
#open XXXX-XX-XX-XX-XX-XX
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p version cipher curve server_name resumed last_alert next_protocol established ssl_history cert_chain_fps client_cert_chain_fps sni_matches_cert
#types time string addr port addr port string string string string bool string string bool string vector[string] vector[string] bool
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 10.192.48.168 63564 64.233.185.139 443 TLSv13 TLS_AES_256_GCM_SHA384 secp256r1 - F - - T CsiICs - - -
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 10.192.48.168 63564 64.233.185.139 443 TLSv13 TLS_AES_256_GCM_SHA384 secp256r1 - F - - T CjiICs - - -
#close XXXX-XX-XX-XX-XX-XX