mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 22:58:20 +00:00
95f1565498
This commit changes DPD matching for TLS connections. A one-sided match is enough to enable DPD now. This commit also removes DPD for SSLv2 connections. SSLv2 connections do basically no longer happen in the wild. SSLv2 is also really finnicky to identify correctly - there is very little data required to match it, and basically all matches today will be false positives. If DPD for SSLv2 is still desired, the optional signature in policy/protocols/ssl/dpd-v2.sig can be loaded. Fixes GH-1952
22 lines
607 B
Standard ML
22 lines
607 B
Standard ML
signature dpd_tls_server {
|
|
ip-proto == tcp
|
|
# SSL3 / TLS Server hello.
|
|
payload /^(\x15\x03[\x00\x01\x02\x03]....)?\x16\x03[\x00\x01\x02\x03]..\x02...((\x03[\x00\x01\x02\x03\x04])|(\x7F[\x00-\x50])).*/
|
|
tcp-state responder
|
|
enable "ssl"
|
|
}
|
|
|
|
signature dpd_tls_client {
|
|
ip-proto == tcp
|
|
# SSL3 / TLS Client hello.
|
|
payload /^\x16\x03[\x00\x01\x02\x03]..\x01...\x03[\x00\x01\x02\x03].*/
|
|
tcp-state originator
|
|
enable "ssl"
|
|
}
|
|
|
|
signature dpd_dtls_client {
|
|
ip-proto == udp
|
|
# Client hello.
|
|
payload /^\x16\xfe[\xff\xfd]\x00\x00\x00\x00\x00\x00\x00...\x01...........\xfe[\xff\xfd].*/
|
|
enable "dtls"
|
|
}
|