mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 06:38:20 +00:00
fa48c88533
This instantiates the SSL analyzer when the client requests SSL so that Zeek now has a bit more visibility into encrypted MySQL connections. The pattern used is the same as in the IMAP, POP or XMPP analyzer.
38 lines
966 B
C++
38 lines
966 B
C++
// See the file "COPYING" in the main distribution directory for copyright.
|
|
|
|
#pragma once
|
|
|
|
#include "zeek/analyzer/protocol/mysql/events.bif.h"
|
|
#include "zeek/analyzer/protocol/mysql/mysql_pac.h"
|
|
#include "zeek/analyzer/protocol/tcp/TCP.h"
|
|
|
|
namespace zeek::analyzer::mysql
|
|
{
|
|
|
|
class MySQL_Analyzer final : public analyzer::tcp::TCP_ApplicationAnalyzer
|
|
{
|
|
|
|
public:
|
|
explicit MySQL_Analyzer(Connection* conn);
|
|
~MySQL_Analyzer() override;
|
|
|
|
// Overridden from Analyzer.
|
|
void Done() override;
|
|
|
|
void DeliverStream(int len, const u_char* data, bool orig) override;
|
|
void Undelivered(uint64_t seq, int len, bool orig) override;
|
|
|
|
// Overridden from analyzer::tcp::TCP_ApplicationAnalyzer.
|
|
void EndpointEOF(bool is_orig) override;
|
|
|
|
void StartTLS();
|
|
|
|
static analyzer::Analyzer* Instantiate(Connection* conn) { return new MySQL_Analyzer(conn); }
|
|
|
|
protected:
|
|
binpac::MySQL::MySQL_Conn* interp;
|
|
bool had_gap;
|
|
bool tls_active;
|
|
};
|
|
|
|
} // namespace zeek::analyzer::mysql
|