mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 22:58:20 +00:00
401e6c9102
The alert in this case is caused by the server name in the SNI not being recognized by the server, which triggers an alert. Since the server is an apache, and this might happen reasonably often, the new signature allows one TLS alert before the server hello is expected.
20 lines
631 B
Text
20 lines
631 B
Text
# @TEST-EXEC: bro -C -b -r $TRACES/tls/ssl-v2.trace %INPUT
|
|
# @TEST-EXEC: bro -b -r $TRACES/tls/ssl.v3.trace %INPUT
|
|
# @TEST-EXEC: bro -b -r $TRACES/tls/tls1.2.trace %INPUT
|
|
# @TEST-EXEC: bro -b -r $TRACES/tls/tls-early-alert.trace %INPUT
|
|
# @TEST-EXEC: btest-diff .stdout
|
|
|
|
@load base/frameworks/dpd
|
|
@load base/frameworks/signatures
|
|
@load-sigs base/protocols/ssl/dpd.sig
|
|
|
|
event bro_init()
|
|
{
|
|
print "Start test run";
|
|
}
|
|
|
|
event ssl_client_hello(c: connection, version: count, possible_ts: time, client_random: string, session_id: string, ciphers: index_vec) &priority=5
|
|
{
|
|
print "Client hello", c$id$orig_h, c$id$resp_h, version;
|
|
}
|
|
|