mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 14:48:21 +00:00
401e6c9102
The alert in this case is caused by the server name in the SNI not being recognized by the server, which triggers an alert. Since the server is an apache, and this might happen reasonably often, the new signature allows one TLS alert before the server hello is expected.
22 lines
648 B
Standard ML
22 lines
648 B
Standard ML
signature dpd_ssl_server {
|
|
ip-proto == tcp
|
|
# Server hello.
|
|
payload /^((\x15\x03[\x00\x01\x02\x03]....)?\x16\x03[\x00\x01\x02\x03]..\x02...\x03[\x00\x01\x02\x03]|...?\x04..\x00\x02).*/
|
|
requires-reverse-signature dpd_ssl_client
|
|
enable "ssl"
|
|
tcp-state responder
|
|
}
|
|
|
|
signature dpd_ssl_client {
|
|
ip-proto == tcp
|
|
# Client hello.
|
|
payload /^(\x16\x03[\x00\x01\x02\x03]..\x01...\x03[\x00\x01\x02\x03]|...?\x01[\x00\x03][\x00\x01\x02\x03]).*/
|
|
tcp-state originator
|
|
}
|
|
|
|
signature dpd_dtls_client {
|
|
ip-proto == udp
|
|
# Client hello.
|
|
payload /^\x16\xfe[\xff\xfd]\x00\x00\x00\x00\x00\x00\x00...\x01...........\xfe[\xff\xfd].*/
|
|
enable "dtls"
|
|
}
|