mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 14:48:21 +00:00
ae90524027
Instead of sending the accumulated CRYPTO frames after processing an INITIAL packet, add logic to determine the total length of the TLS Client or Server Hello (by peeking into the first 4 byte). Once all CRYPTO frames have arrived, flush the reassembled data to the TLS analyzer at once.
12 lines
789 B
Text
12 lines
789 B
Text
# @TEST-DOC: Pcap with CRYPTO frames fragemented over multiple INITIAL packets. The pcap only contains 3 INITIAL packets. Check what logs are created.
|
|
|
|
# @TEST-REQUIRES: ${SCRIPTS}/have-spicy
|
|
# @TEST-EXEC: zeek -Cr $TRACES/quic/quic-multiple-initial-fragmented-crypto-only-initial.pcap base/protocols/quic
|
|
# @TEST-EXEC: test ! -f analyzer.log
|
|
# @TEST-EXEC: test ! -f dpd.log
|
|
# @TEST-EXEC: zeek-cut -m ts uid history service < conn.log > conn.log.cut
|
|
# @TEST-EXEC: btest-diff conn.log.cut
|
|
# @TEST-EXEC: zeek-cut -m ts uid server_name history < quic.log > quic.log.cut
|
|
# @TEST-EXEC: btest-diff quic.log.cut
|
|
# @TEST-EXEC: zeek-cut -m ts uid version cipher curve server_name resumed last_alert next_protocol established ssl_history < ssl.log > ssl.log.cut
|
|
# @TEST-EXEC: btest-diff ssl.log.cut
|