mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 06:38:20 +00:00
2d950ffde9
Several limitations still apply: - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 is the only supported cipher suite - Some tests are broken due to a failing assertion regarding bytestring - No newly written tests for decryption (the patch was tested extensively for our paper) - Several small open technical questions marked with FIXME - Architecture in the ssl module might not be optimal
57 lines
1.7 KiB
C++
57 lines
1.7 KiB
C++
#pragma once
|
|
|
|
#include "zeek/analyzer/protocol/pia/PIA.h"
|
|
#include "zeek/analyzer/protocol/tcp/TCP.h"
|
|
|
|
#include "zeek/analyzer/protocol/ssl/events.bif.h"
|
|
|
|
namespace binpac { namespace SSL { class SSL_Conn; } }
|
|
|
|
namespace binpac { namespace TLSHandshake { class Handshake_Conn; } }
|
|
|
|
namespace zeek::analyzer::ssl {
|
|
|
|
class SSL_Analyzer final : public analyzer::tcp::TCP_ApplicationAnalyzer {
|
|
public:
|
|
explicit SSL_Analyzer(Connection* conn);
|
|
~SSL_Analyzer() override;
|
|
|
|
// Overridden from Analyzer.
|
|
void Done() override;
|
|
void DeliverStream(int len, const u_char* data, bool orig) override;
|
|
void Undelivered(uint64_t seq, int len, bool orig) override;
|
|
|
|
void SendHandshake(uint16_t raw_tls_version, const u_char* begin, const u_char* end, bool orig);
|
|
|
|
// Tell the analyzer that encryption has started.
|
|
void StartEncryption();
|
|
// Get the TLS version that the server chose. 0 if not yet known.
|
|
uint16_t GetNegotiatedVersion() const;
|
|
|
|
// Overridden from analyzer::tcp::TCP_ApplicationAnalyzer.
|
|
void EndpointEOF(bool is_orig) override;
|
|
|
|
static analyzer::Analyzer* Instantiate(Connection* conn)
|
|
{ return new SSL_Analyzer(conn); }
|
|
|
|
// Key material for decryption
|
|
void SetSecret(const u_char* data, int len);
|
|
void SetKeys(const u_char* data, int len);
|
|
|
|
bool TryDecryptApplicationData(int len, const u_char* data, bool is_orig, uint8_t content_type, uint16_t raw_tls_version);
|
|
void ForwardDecryptedData(int len, const u_char* data, bool is_orig);
|
|
|
|
protected:
|
|
binpac::SSL::SSL_Conn* interp;
|
|
binpac::TLSHandshake::Handshake_Conn* handshake_interp;
|
|
bool had_gap;
|
|
|
|
// FIXME: should this be moved into the connection?
|
|
int c_seq;
|
|
int s_seq;
|
|
zeek::StringVal *secret;
|
|
zeek::StringVal *keys;
|
|
zeek::analyzer::pia::PIA_TCP *pia;
|
|
};
|
|
|
|
} // namespace zeek::analyzer::ssl
|