mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 22:58:20 +00:00
0cd0ffed13
The dpd signature missed a few cases that are used for TLS 1.3, especially when draft versions (which are all that we are seeing at the moment) are being negotiated. This fix mostly allows draft versions in the server hello (identified by 7F[version]; since we do not know how many drafts there will be, we are currently allowing a rather safe upper limit.
22 lines
678 B
Standard ML
22 lines
678 B
Standard ML
signature dpd_ssl_server {
|
|
ip-proto == tcp
|
|
# Server hello.
|
|
payload /^((\x15\x03[\x00\x01\x02\x03]....)?\x16\x03[\x00\x01\x02\x03]..\x02...((\x03[\x00\x01\x02\x03\x04])|(\x7F[\x00-\x50]))|...?\x04..\x00\x02).*/
|
|
requires-reverse-signature dpd_ssl_client
|
|
enable "ssl"
|
|
tcp-state responder
|
|
}
|
|
|
|
signature dpd_ssl_client {
|
|
ip-proto == tcp
|
|
# Client hello.
|
|
payload /^(\x16\x03[\x00\x01\x02\x03]..\x01...\x03[\x00\x01\x02\x03]|...?\x01[\x00\x03][\x00\x01\x02\x03\x04]).*/
|
|
tcp-state originator
|
|
}
|
|
|
|
signature dpd_dtls_client {
|
|
ip-proto == udp
|
|
# Client hello.
|
|
payload /^\x16\xfe[\xff\xfd]\x00\x00\x00\x00\x00\x00\x00...\x01...........\xfe[\xff\xfd].*/
|
|
enable "dtls"
|
|
}
|