Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-13 20:18:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3
4648 commits 387 branches 197 tags 273 MiB
Commit graph

17 commits

Author SHA1 Message Date
Robin Sommer
338d521003 Fixing removal of support analyzers, plus some tweaking and cleanup of 
CONNECT code.

Removal of support analyzers was broken. The code now actually doesn't
delete them immediately anymore but instead just flags them as
disabled. They'll be destroyed with the parent analyzer later.

Also includes a new leak tests exercising the CONNECT code.

Lines starting # with '#' will be ignored, and an empty message aborts
the commit. # On branch topic/robin/http-connect # Changes to be
committed: # modified: scripts/base/protocols/http/main.bro #
modified: scripts/base/protocols/ssl/consts.bro # modified:
src/analyzer/Analyzer.cc # modified: src/analyzer/Analyzer.h #
modified: src/analyzer/protocol/http/HTTP.cc # new file:
testing/btest/core/leaks/http-connect.bro # modified:
testing/btest/scripts/base/protocols/http/http-connect.bro # #
Untracked files: # .tags # changes.txt # conn.log # debug.log # diff #
mpls-in-vlan.patch # newfile.pcap # packet_filter.log # reporter.log #
src/PktSrc.cc.orig # weird.log #
 2014-03-02 13:52:32 -08:00
Daniel Thayer
8764850337 Fix typos and formatting in the ssl protocol docs 
Also changed one sentence (about setting the Mozilla root CA list) to make
it more clear that the user doesn't need to do anything.
 2013-10-16 17:36:27 -05:00
Bernhard Amann
00b622f54d IANA assigned a couple of new tls extension numbers 2013-10-08 13:52:44 -07:00
Bernhard Amann
737b15aef9 add 3 more really new ciphers. 2013-10-08 13:02:55 -07:00
Bernhard Amann
ea766d71bb add ciphers to cipher_desc table that were already present 
but apparently forgotten.
 2013-10-01 16:01:37 -07:00
Bernhard Amann
497ada12e8 ...and a few more ciphers. 2013-09-26 10:03:17 -07:00
Bernhard Amann
9264e2e7d3 add new tls cipher suites 2013-09-25 22:21:56 -07:00
Bernhard Amann
bff3cba129 Add two more TLS extension values that we see in live traffic. 
- origin_bound_certificates is a current draft
http://tools.ietf.org/html/draft-balfanz-tls-obc-01

- encrypted client certificates is a draft that
  expired yesterday.
http://tools.ietf.org/html/draft-agl-tls-encryptedclientcerts-00
 2012-04-27 16:18:14 -07:00
Seth Hall
c10ff6fd69 Add some extra TLS extension values. 
- extended_random is an expired draft rfc, but we see it
  in live traffic.
  - http://tools.ietf.org/html/draft-rescorla-tls-extended-random-01

- heartbeat RFC was ratified in Feb. 2012.
  - http://tools.ietf.org/html/rfc6520
 2012-04-24 16:58:03 -04:00
Seth Hall
87ad77cc10 Standardized on the &default function for SSL constants. 2012-02-29 22:34:31 -05:00
Seth Hall
4de670a10e Fixing some doc warnings. 2012-01-10 01:30:55 -05:00
Seth Hall
9b6373584c Forgot to add protocol identifier support for TLS 1.2 2012-01-10 01:09:35 -05:00
Seth Hall
911d7d8436 Finished SSL & syslog autodocs. 2012-01-10 00:56:12 -05:00
Seth Hall
8ab372ccff Adding the draft SSL extension type next_protocol_negotiation. 2012-01-09 22:53:53 -05:00
Seth Hall
ec721dffec Added is_orig fields to the SSL events and adapted script. 
- Added a field named $last_alert to the SSL log.  This doesn't even
  indicate the direction the alert was sent, but we need to start somewhere.

- The x509_certificate function has an is_orig field now instead of
  is_server and it's position in the argument list has moved.

- A bit of reorganization and cleanup in the core analyzer.
 2011-12-09 16:56:12 -05:00
Seth Hall
8661abe9d9 Small script refinements and documentation updates. 2011-10-21 13:58:58 -04:00
Seth Hall
597a4d6704 Hopefully the last major script reorganization. 
- policy/ renamed to scripts/

- By default BROPATH now contains:
	- scripts/
	- scripts/policy
	- scripts/site

- *Nearly* all tests pass.

- All of scripts/base/ is loaded by main.cc
	- Can be disabled by setting $BRO_NO_BASE_SCRIPTS
	- Scripts in scripts/base/ don't use relative path loading to ease use of BRO_NO_BASE_SCRIPTS (to copy and paste that script).

- The scripts in scripts/base/protocols/ only (or soon will only) do logging and state building.

- The scripts in scripts/base/frameworks/ add functionality without causing any additional overhead.

- All "detection" activity happens through scripts in scripts/policy/.

- Communications framework modified temporarily to need an environment variable to actually enable (ENABLE_COMMUNICATION=1)
	- This is so the communications framework can be loaded as part
	  of the base without causing trouble when it's not needed.
	- This will be removed once a resolution to ticket #540 is reached.
 2011-08-05 23:09:53 -04:00
Renamed from policy/protocols/ssl/consts.bro (Browse further)