zeek/scripts
Johanna Amann bea3075c1f TLS analyzer: change logic to track TLS 1.3 connection establishment
This commit changes the logic that is used to tracks connection
establishment - and moves it from scriptland into the core.

TLS 1.3 connection establishment is much more finnicky for us than the
establishment of earlier versions - since we cannot rely on the CCS
message anymore (which is meaningless and not sent in a lot of cases).

With this commit, the ssl_encrypted_data message gets raised for
encrypted TLS 1.3 handshake messages - which is much more correct than
the behavior before that just interpreted them as plaintext messages.

I will refine this a bit more - at the moment the connection established
event happens a bit too early - earlier than TLS 1.3 connections
actually can be estasblished.

Part of GH-1323
2020-12-14 19:51:05 +00:00
..
base TLS analyzer: change logic to track TLS 1.3 connection establishment 2020-12-14 19:51:05 +00:00
policy GH-352: Improve HTTP::match_sql_injection_uri regex 2020-11-12 16:19:35 -08:00
site Install zkg as part of the Zeek distribution. 2020-12-11 18:43:47 -08:00
zeekygen Fix misassociation of Zeekygen-style comments within function scopes 2020-12-04 19:29:11 -08:00
CMakeLists.txt No longer symlink local.zeek to local.bro. 2020-01-29 12:08:10 +00:00
test-all-policy.zeek GH-1221: Add unknown_protocols.log for logging packet analyzer lookup failures 2020-11-09 20:37:26 -07:00