mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 14:48:21 +00:00
95f1565498
This commit changes DPD matching for TLS connections. A one-sided match is enough to enable DPD now. This commit also removes DPD for SSLv2 connections. SSLv2 connections do basically no longer happen in the wild. SSLv2 is also really finnicky to identify correctly - there is very little data required to match it, and basically all matches today will be false positives. If DPD for SSLv2 is still desired, the optional signature in policy/protocols/ssl/dpd-v2.sig can be loaded. Fixes GH-1952
22 lines
801 B
Text
22 lines
801 B
Text
# @TEST-EXEC: zeek -C -b -r $TRACES/tls/ssl-v2.trace %INPUT
|
|
# @TEST-EXEC: zeek -b -r $TRACES/tls/ssl.v3.trace %INPUT
|
|
# @TEST-EXEC: zeek -b -r $TRACES/tls/tls1.2.trace %INPUT
|
|
# @TEST-EXEC: zeek -b -r $TRACES/tls/tls-early-alert.trace %INPUT
|
|
# @TEST-EXEC: zeek -b -r $TRACES/tls/tls-13draft19-early-data.pcap %INPUT
|
|
# @TEST-EXEC: btest-diff .stdout
|
|
|
|
@load base/frameworks/dpd
|
|
@load base/frameworks/signatures
|
|
@load-sigs base/protocols/ssl/dpd.sig
|
|
@load-sigs policy/protocols/ssl/dpd-v2.sig
|
|
|
|
event zeek_init()
|
|
{
|
|
print "Start test run";
|
|
}
|
|
|
|
event ssl_client_hello(c: connection, version: count, record_version: count, possible_ts: time, client_random: string, session_id: string, ciphers: index_vec, comp_methods: index_vec) &priority=5
|
|
{
|
|
print "Client hello", c$id$orig_h, c$id$resp_h, version;
|
|
}
|
|
|