Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-09 10:08:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Add compression methods to ssl_client_hello event.

Browse source 
This change adds compression methods to the ssl_client_hello event. It
not being included was an oversight from a long time ago.

This change means that the signature of ssl_client_hello changes
slightly and scripts will have to be adjusted; since this is a commonly
used event, the impact of it might be higher than usually for event
changes.
This commit is contained in:
Johanna Amann 2017-02-03 11:48:55 -08:00
parent 9db27a6d60
commit f721c74bad
11 changed files with 43 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

14
testing/btest/scripts/base/protocols/ssl/comp_methods.test Normal file
View file

@ -0,0 +1,14 @@
# This tests that the values sent for compression methods are correct.
# @TEST-EXEC: bro -r $TRACES/tls/tls-conn-with-extensions.trace %INPUT
# @TEST-EXEC: btest-diff .stdout
event ssl_client_hello(c: connection, version: count, possible_ts: time, client_random: string, session_id: string, ciphers: index_vec, comp_methods: index_vec)
{
print comp_methods;
}
event ssl_server_hello(c: connection, version: count, possible_ts: time, server_random: string, session_id: string, cipher: count, comp_method: count)
{
print comp_method;
}

2
testing/btest/scripts/base/protocols/ssl/dpd.test
View file

@ -13,7 +13,7 @@ event bro_init()
print "Start test run";
}
event ssl_client_hello(c: connection, version: count, possible_ts: time, client_random: string, session_id: string, ciphers: index_vec) &priority=5
event ssl_client_hello(c: connection, version: count, possible_ts: time, client_random: string, session_id: string, ciphers: index_vec, comp_methods: index_vec) &priority=5
{
print "Client hello", c$id$orig_h, c$id$resp_h, version;
}

2
testing/btest/scripts/base/protocols/ssl/dtls-stun-dpd.test
View file

@ -3,7 +3,7 @@
# @TEST-EXEC: touch dpd.log
# @TEST-EXEC: btest-diff dpd.log
event ssl_client_hello(c: connection, version: count, possible_ts: time, client_random: string, session_id: string, ciphers: index_vec)
event ssl_client_hello(c: connection, version: count, possible_ts: time, client_random: string, session_id: string, ciphers: index_vec, comp_methods: index_vec)
{
print version, client_random, session_id, ciphers;
}

2
testing/btest/scripts/base/protocols/ssl/tls-1.2-ciphers.test
View file

@ -1,7 +1,7 @@
# @TEST-EXEC: bro -r $TRACES/tls/tls1.2.trace %INPUT
# @TEST-EXEC: btest-diff .stdout
event ssl_client_hello(c: connection, version: count, possible_ts: time, client_random: string, session_id: string, ciphers: index_vec)
event ssl_client_hello(c: connection, version: count, possible_ts: time, client_random: string, session_id: string, ciphers: index_vec, comp_methods: index_vec)
{
print fmt("Got %d cipher suites", |ciphers|);
for ( i in ciphers )

6
testing/btest/scripts/base/protocols/ssl/tls-1.2-random.test
View file

@ -1,12 +1,12 @@
# @TEST-EXEC: bro -r $TRACES/tls/tls1.2.trace %INPUT
# @TEST-EXEC: btest-diff .stdout
event ssl_client_hello(c: connection, version: count, possible_ts: time, client_random: string, session_id: string, ciphers: index_vec)
event ssl_client_hello(c: connection, version: count, possible_ts: time, client_random: string, session_id: string, ciphers: index_vec, comp_methods: index_vec)
{
print client_random;
}
event ssl_server_hello(c: connection, version: count, possible_ts: time, server_random: string, session_id: string, cipher: count, comp_method: count)
event ssl_server_hello(c: connection, version: count, possible_ts: time, server_random: string, session_id: string, cipher: count, comp_method: count)
{
print server_random;
}