mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 14:48:21 +00:00
c05e07cc90
This exposes the record layer version of the fragment in addition to the content type and the length. The ordering of the arguments in the event is the same as the ordering in the protocol message (first type, then version, then length). This also includes a slight change to the analyzer, no longer calling the generate function if the event is not used.
31 lines
1 KiB
Text
31 lines
1 KiB
Text
# @TEST-EXEC: bro -C -r $TRACES/tls/tls13draft16-chrome55.0.2879.0-canary-aborted.pcap %INPUT
|
|
# @TEST-EXEC: cat ssl.log > ssl-out.log
|
|
# @TEST-EXEC: bro -C -r $TRACES/tls/tls13draft16-chrome55.0.2879.0-canary.pcap %INPUT
|
|
# @TEST-EXEC: cat ssl.log >> ssl-out.log
|
|
# @TEST-EXEC: bro -C -r $TRACES/tls/tls13draft16-ff52.a01-aborted.pcap %INPUT
|
|
# @TEST-EXEC: cat ssl.log >> ssl-out.log
|
|
# @TEST-EXEC: bro -C -r $TRACES/tls/tls13draft16-ff52.a01.pcap %INPUT
|
|
# @TEST-EXEC: cat ssl.log >> ssl-out.log
|
|
# @TEST-EXEC: btest-diff ssl-out.log
|
|
# @TEST-EXEC: btest-diff .stdout
|
|
|
|
redef SSL::disable_analyzer_after_detection=F;
|
|
|
|
event ssl_extension_key_share(c: connection, is_orig: bool, curves: index_vec)
|
|
{
|
|
print "key_share", c$id, is_orig;
|
|
for ( i in curves )
|
|
{
|
|
print SSL::ec_curves[curves[i]];
|
|
}
|
|
}
|
|
|
|
event ssl_established(c: connection)
|
|
{
|
|
print "established", c$id;
|
|
}
|
|
|
|
event ssl_encrypted_data(c: connection, is_orig: bool, content_type: count, record_version: count, length: count)
|
|
{
|
|
print "encrypted", c$id, is_orig, SSL::version_strings[record_version], content_type;
|
|
}
|