Commit graph

4 commits

Author SHA1 Message Date
Johanna Amann
7c0f325d1b TLS: Update cipher consts and keyexchange parsing
Update cipher consts.

Furthermore some past updates have been applied to scriptland, but it
was not considered that some of these also have to be applied to binpac
code, to be able to correcly parse the ServerKeyExchange message.

(As a side-note - this was discovered due to a test discrepancy with the
Spicy parser)
2023-11-27 16:22:24 +00:00
Johanna Amann
8972676e92 GH-1634: Address feedback
This commit addreses feedback for GH-1643, changing typos and renaming
one of the fields in x509.log.
2021-07-02 15:12:58 +01:00
Johanna Amann
6ac158dedd Baseline updates for recent SSL changes. 2021-06-29 15:03:03 +01:00
Johanna Amann
e58b03a43f Add policy script suppressing certificate events
The added disable-certificate-events-known-certs.zeek disables repeated
X509 events in SSL connections, given that the connection terminates at
the same server and used the samt SNI as a previously seen connection
with the same certificate.

For people that see significant amounts of TLS 1.2 traffic, this could
reduce the amount of raised events significantly - especially when a
lot of connections are repeat connections to the same servers.

The practical impact of not raising these events is actually very little
- unless a script directly interacts with the x509 events, everything
works as before - the x509 variables in the connection records are still
being set (from the cache).
2021-06-29 11:39:18 +01:00