Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-11 19:18:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

At the moment, SSL connections where the ssl_established event does not fire are not logged.

Browse source 
That means that, for example, connections that are terminated with an alert during the
handshake never appear in the ssl.log.

This patch changes this behavior - now all ssl connections that fire any event are logged.

The protocol confirmation of the ssl analyzer is moved to the client_hello instead to
the server hello. Furthermore, an additional field is added to ssl.log, which indicates
if a connection has been established or not (which probably indicates a handshake problem).
This commit is contained in:
Bernhard Amann 2014-03-04 13:58:58 -08:00
parent d6d26a3ea7
commit ea1616bed5
5 changed files with 39 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

10
testing/btest/Baseline/scripts.base.protocols.ssl.tls-1.2-handshake-failure/ssl.log Normal file
View file

@ -0,0 +1,10 @@
#separator \x09
#set_separator ,
#empty_field (empty)
#unset_field -
#path ssl
#open 2014-03-04-21-57-58
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p version cipher server_name session_id subject issuer_subject not_valid_before not_valid_after last_alert client_subject client_issuer_subject established
#types time string addr port addr port string string string string string string time time string string string bool
1393957586.786031 CXWv6p3arKYeMETxOg 192.168.4.149 53525 74.125.239.37 443 - - - - - - - - handshake_failure - - F
#close 2014-03-04-21-57-58

BIN
testing/btest/Traces/tls-1.2-handshake-failure.trace Normal file
View file

Binary file not shown.

2
testing/btest/scripts/base/protocols/ssl/tls-1.2-handshake-failure.test Normal file
View file

@ -0,0 +1,2 @@
# @TEST-EXEC: bro -r $TRACES/tls-1.2-handshake-failure.trace %INPUT
# @TEST-EXEC: btest-diff ssl.log