mirror of
https://github.com/zeek/zeek.git
synced 2025-10-07 09:08:20 +00:00
038fbf9b9e
This commit mostly does a lot of refactoring of the current SSL analyzer, which is split into several parts. The handshake protocol is completely taken out of the SSL analyzer and was refactored into its own analyzer (called tls-handshake-analyzer). This will also (finally) make it possible to deal with TLS record fragmentation. Apart from that, the parts of the SSL analyzer that are common to DTLS were split into their own pac files. Both the SSL analyzer and the (very basic, mostly nonfunctional) DTLS analyzer use their own pac files and those shared pac files. All SSL tests still pass after refactoring so I hope I did not break anything too badly. At the moment, we have two different modules in one directory and I guess the way I am doing this might be an abuse of the system. It seems to work though...
41 lines
874 B
JavaScript
41 lines
874 B
JavaScript
# binpac file for SSL analyzer
|
|
|
|
# split in three parts:
|
|
# - ssl-protocol.pac: describes the SSL protocol messages
|
|
# - ssl-analyzer.pac: contains the SSL analyzer code
|
|
# - ssl-record-layer.pac: describes the SSL record layer
|
|
|
|
%include binpac.pac
|
|
%include bro.pac
|
|
|
|
%extern{
|
|
#include "events.bif.h"
|
|
|
|
namespace analyzer { namespace ssl { class SSL_Analyzer; } }
|
|
typedef analyzer::ssl::SSL_Analyzer* SSLAnalyzer;
|
|
|
|
#include "SSL.h"
|
|
%}
|
|
|
|
extern type SSLAnalyzer;
|
|
|
|
analyzer SSL withcontext {
|
|
connection: SSL_Conn;
|
|
flow: SSL_Flow;
|
|
};
|
|
|
|
connection SSL_Conn(bro_analyzer: SSLAnalyzer) {
|
|
upflow = SSL_Flow(true);
|
|
downflow = SSL_Flow(false);
|
|
};
|
|
|
|
%include ssl-dtls-protocol.pac
|
|
%include ssl-protocol.pac
|
|
|
|
flow SSL_Flow(is_orig: bool) {
|
|
flowunit = SSLPDU(is_orig) withcontext(connection, this);
|
|
}
|
|
|
|
%include ssl-dtls-analyzer.pac
|
|
%include ssl-analyzer.pac
|
|
%include ssl-defs.pac
|