zeek/scripts/base
Johanna Amann a6edbf8bcd Fix parsing of version field in SSLv2 client hello
It turns out that, for probably a long time, we have reported an
incorrect version when parsing an SSLv2 client hello. We always reported
this as SSLv2, no matter which version the client hello actually
contained.

This bug probably went unnoticed for a long time, as SSLv2 is
essentially unused nowadays, and as this field does not show up in the
default logs.

This was found due to a baseline difference when writing the Spicy SSL
analyzer.
2024-08-22 13:14:24 +01:00
..
files Copy timestamp from file object 2024-05-17 15:03:06 +02:00
frameworks Remove deprecated Cluster::Node::interface field 2024-08-07 11:58:22 -07:00
misc Parse and store localversion string 2024-04-17 14:17:22 -07:00
packet-protocols Add registration for GRE-over-UDP 2023-10-16 11:42:24 -07:00
protocols Fix parsing of version field in SSLv2 client hello 2024-08-22 13:14:24 +01:00
utils Clarify membership in the Site::private_address_space prefix list. [skip ci] 2024-05-04 11:21:26 -07:00
init-bare.zeek Add DNS TKEY event 2024-08-16 10:20:42 -04:00
init-default.zeek utils: Introduce packages.zeek with can_load() helper 2024-02-22 11:41:50 +01:00
init-frameworks-and-bifs.zeek Add necessary script-land changes 2024-05-31 13:30:31 -07:00
init-supervisor.zeek Establish a separate init script when using the supervisor 2021-07-08 13:12:53 -07:00