mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 22:58:20 +00:00
a8e84c6192
This commit adds support for the connection_id extension, adds a trace that uses DTLS 1.3 connection IDs, and adds parsing for the DTLS 1.3 unified header, in case connection IDs are not used. In case connection IDs are used, parsing of the DTLS 1.3 unified header is skipped. This is due to the fact, that the header then contains a variable length element, with the length of the element not given in the header. Instead, the length is given in the client/server hello message of the opposite side of the connection (which we might have missed). Furthermore, parsing is not of a high importance, since we are not passing the connection ID, or any of the other parsed values of the unified header into scriptland.
30 lines
1.2 KiB
Text
30 lines
1.2 KiB
Text
# This tests a normal SSL connection and the log it outputs.
|
|
|
|
# @TEST-EXEC: zeek -C -r $TRACES/tls/dtls13-wolfssl.pcap %INPUT
|
|
# @TEST-EXEC: cp ssl.log ssl-all.log
|
|
# @TEST-EXEC: echo "start CID test"
|
|
# @TEST-EXEC: zeek -C -r $TRACES/tls/dtls13-cid.pcap %INPUT
|
|
# @TEST-EXEC: cat ssl.log >> ssl-all.log
|
|
# @TEST-EXEC: btest-diff ssl-all.log
|
|
# @TEST-EXEC: btest-diff .stdout
|
|
# @TEST-EXEC: test ! -f dpd.log
|
|
|
|
event ssl_client_hello(c: connection, version: count, record_version: count, possible_ts: time, client_random: string, session_id: string, ciphers: index_vec, comp_methods: index_vec)
|
|
{
|
|
print "CH", c$id, version, record_version;
|
|
}
|
|
|
|
event ssl_server_hello(c: connection, version: count, record_version: count, possible_ts: time, server_random: string, session_id: string, cipher: count, comp_method: count)
|
|
{
|
|
print "SH", c$id, version, record_version;
|
|
}
|
|
|
|
event ssl_extension_connection_id(c: connection, is_client: bool, cid: string)
|
|
{
|
|
print "CID", c$id, is_client, cid;
|
|
}
|
|
|
|
event ssl_encrypted_data(c: connection, is_client: bool, record_version: count, content_type: count, length: count)
|
|
{
|
|
print "Encrypted", c$id, is_client, record_version, content_type, length;
|
|
}
|