mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 14:48:21 +00:00
0cd0ffed13
The dpd signature missed a few cases that are used for TLS 1.3, especially when draft versions (which are all that we are seeing at the moment) are being negotiated. This fix mostly allows draft versions in the server hello (identified by 7F[version]; since we do not know how many drafts there will be, we are currently allowing a rather safe upper limit.
21 lines
704 B
Text
21 lines
704 B
Text
# @TEST-EXEC: bro -C -b -r $TRACES/tls/ssl-v2.trace %INPUT
|
|
# @TEST-EXEC: bro -b -r $TRACES/tls/ssl.v3.trace %INPUT
|
|
# @TEST-EXEC: bro -b -r $TRACES/tls/tls1.2.trace %INPUT
|
|
# @TEST-EXEC: bro -b -r $TRACES/tls/tls-early-alert.trace %INPUT
|
|
# @TEST-EXEC: bro -b -r $TRACES/tls/tls-13draft19-early-data.pcap %INPUT
|
|
# @TEST-EXEC: btest-diff .stdout
|
|
|
|
@load base/frameworks/dpd
|
|
@load base/frameworks/signatures
|
|
@load-sigs base/protocols/ssl/dpd.sig
|
|
|
|
event bro_init()
|
|
{
|
|
print "Start test run";
|
|
}
|
|
|
|
event ssl_client_hello(c: connection, version: count, possible_ts: time, client_random: string, session_id: string, ciphers: index_vec) &priority=5
|
|
{
|
|
print "Client hello", c$id$orig_h, c$id$resp_h, version;
|
|
}
|
|
|