mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 14:48:21 +00:00
e14eddeb97
This PR changes the way in which the SSL analyzer tracks the direction of connections. So far, the SSL analyzer assumed that the originator of a connection would send the client hello (and other associated client-side events), and that the responder would be the SSL servers. In some circumstances this is not true, and the initiator of a connection is the server, with the responder being the client. So far this confused some of the internal statekeeping logic and could lead to mis-parsing of extensions. This reversal of roles can happen in DTLS, if a connection uses STUN - and potentially in some StartTLS protocols. This PR tracks the direction of a TLS connection using the hello request, client hello and server hello handshake messages. Furthermore, it changes the SSL events from providing is_orig to providing is_client, where is_client is true for the client_side of a connection. Since the argument positioning in the event has not changed, old scripts will continue to work seamlessly - the new semantics are what everyone writing SSL scripts will have expected in any case. There is a new event that is raised when a connection is flipped. A weird is raised if a flip happens repeatedly. Addresses GH-2198. |
||
|---|---|---|
| .. | ||
| basic.test | ||
| common_name.test | ||
| comp_methods.test | ||
| cve-2015-3194.test | ||
| dhe.test | ||
| dpd.test | ||
| dtls-no-dtls.test | ||
| dtls-stun-dpd.test | ||
| dtls.test | ||
| ecdhe.test | ||
| ecdsa.test | ||
| fragment.test | ||
| handshake-events.test | ||
| keyexchange.test | ||
| ocsp-http-get.test | ||
| ocsp-request-only.test | ||
| ocsp-request-response.test | ||
| ocsp-response-only.test | ||
| ocsp-revoked.test | ||
| ocsp-stapling.test | ||
| signed_certificate_timestamp.test | ||
| tls-1.2-ciphers.test | ||
| tls-1.2-handshake-failure.test | ||
| tls-1.2-random.test | ||
| tls-1.2.test | ||
| tls-extension-events.test | ||
| tls1_1.test | ||
| tls13-experiment.test | ||
| tls13-version.test | ||
| tls13.test | ||
| tls13_encrypted_handshake_events.test | ||
| x509-invalid-extension.test | ||
| x509_extensions.test | ||