zeek/scripts/base
Johanna Amann bea3075c1f TLS analyzer: change logic to track TLS 1.3 connection establishment
This commit changes the logic that is used to tracks connection
establishment - and moves it from scriptland into the core.

TLS 1.3 connection establishment is much more finnicky for us than the
establishment of earlier versions - since we cannot rely on the CCS
message anymore (which is meaningless and not sent in a lot of cases).

With this commit, the ssl_encrypted_data message gets raised for
encrypted TLS 1.3 handshake messages - which is much more correct than
the behavior before that just interpreted them as plaintext messages.

I will refine this a bit more - at the moment the connection established
event happens a bit too early - earlier than TLS 1.3 connections
actually can be estasblished.

Part of GH-1323
2020-12-14 19:51:05 +00:00
..
files Support for log filter policy hooks 2020-09-30 12:32:45 -07:00
frameworks Remove an extraneous Zeekygen-style comment 2020-12-04 19:20:57 -08:00
misc Tweak find-filtered-trace to not flag traces if they have non-TCP 2020-09-25 11:29:44 +00:00
packet-protocols Remove default_analyzer for Ethernet packet analzyer 2020-11-09 19:54:45 -07:00
protocols TLS analyzer: change logic to track TLS 1.3 connection establishment 2020-12-14 19:51:05 +00:00
utils Reverts the regex change in dead3226a5. 2020-11-18 15:35:17 -07:00
init-bare.zeek Move UnknownProtocol options to init-bare.zeek 2020-11-11 12:58:38 -08:00
init-default.zeek Add backtrace() and print_backtrace() 2020-07-03 14:09:31 -07:00
init-frameworks-and-bifs.zeek GH-1122: Allow initializing globals with calls to subdir BIFs 2020-08-27 12:20:37 -07:00