mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 14:48:21 +00:00
038fbf9b9e
This commit mostly does a lot of refactoring of the current SSL analyzer, which is split into several parts. The handshake protocol is completely taken out of the SSL analyzer and was refactored into its own analyzer (called tls-handshake-analyzer). This will also (finally) make it possible to deal with TLS record fragmentation. Apart from that, the parts of the SSL analyzer that are common to DTLS were split into their own pac files. Both the SSL analyzer and the (very basic, mostly nonfunctional) DTLS analyzer use their own pac files and those shared pac files. All SSL tests still pass after refactoring so I hope I did not break anything too badly. At the moment, we have two different modules in one directory and I guess the way I am doing this might be an abuse of the system. It seems to work though...
41 lines
1 KiB
C++
41 lines
1 KiB
C++
#ifndef ANALYZER_PROTOCOL_SSL_SSL_H
|
|
#define ANALYZER_PROTOCOL_SSL_SSL_H
|
|
|
|
#include "events.bif.h"
|
|
|
|
#include "analyzer/protocol/tcp/TCP.h"
|
|
|
|
namespace binpac { namespace SSL { class SSL_Conn; } }
|
|
|
|
namespace binpac { namespace TLSHandshake { class Handshake_Conn; } }
|
|
|
|
namespace analyzer { namespace ssl {
|
|
|
|
class SSL_Analyzer : public tcp::TCP_ApplicationAnalyzer {
|
|
public:
|
|
SSL_Analyzer(Connection* conn);
|
|
virtual ~SSL_Analyzer();
|
|
|
|
// Overriden from Analyzer.
|
|
virtual void Done();
|
|
virtual void DeliverStream(int len, const u_char* data, bool orig);
|
|
virtual void Undelivered(uint64 seq, int len, bool orig);
|
|
|
|
void SendHandshake(uint8 msg_type, uint32 length, const u_char* begin, const u_char* end, bool orig);
|
|
|
|
// Overriden from tcp::TCP_ApplicationAnalyzer.
|
|
virtual void EndpointEOF(bool is_orig);
|
|
|
|
static analyzer::Analyzer* Instantiate(Connection* conn)
|
|
{ return new SSL_Analyzer(conn); }
|
|
|
|
protected:
|
|
binpac::SSL::SSL_Conn* interp;
|
|
binpac::TLSHandshake::Handshake_Conn* handshake_interp;
|
|
bool had_gap;
|
|
|
|
};
|
|
|
|
} } // namespace analyzer::*
|
|
|
|
#endif
|