mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 14:48:21 +00:00
7c0c48b290
The analyzer now detects partial connections at the beginning of a connection - and will skip them. This makes behavior more similar to the binpac analyzer. The decryption test is skipped. And some minor refacoring.
14 lines
674 B
Text
14 lines
674 B
Text
# @TEST-REQUIRES: grep -q "#define OPENSSL_HAVE_KDF_H" $BUILD/zeek-config.h
|
|
# @TEST-REQUIRES: ! grep -q "#define ENABLE_SPICY_SSL" $BUILD/zeek-config.h
|
|
|
|
# @TEST-EXEC: zeek -B dpd -C -r $TRACES/tls/tls12-decryption.pcap %INPUT
|
|
# @TEST-EXEC: btest-diff http.log
|
|
|
|
@load protocols/ssl/decryption
|
|
@load base/protocols/http
|
|
|
|
module SSL;
|
|
|
|
redef SSL::secrets += {
|
|
["\xb4\x0a\x24\x4b\x48\xe4\x2e\xac\x28\x71\x44\xb1\xb7\x39\x30\x57\xca\xa1\x31\xf9\x61\xa7\x8e\x38\xb0\xe7\x7c\x1e"] = "\xbd\x01\xe5\x89\xd1\x05\x19\x9e\x9a\xb5\xfc\x9b\xd7\x58\xb5\xf2\x88\xdb\x28\xfd\x80\xaa\x02\x26\x1e\x47\x65\xac\x13\x57\xd0\x07\xfd\x08\xc7\xbd\xab\x45\x45\x0e\x01\x5a\x01\xd0\x8e\x5e\x7c\xa6",
|
|
};
|