Hi,
I have created a small patch (joigned) for detecting SSLv3(.cc) Extensions Length in bro v1.5.1.
Previous patch, connect on https web site with extensions (server_name for example) generate alert:
ssl.log:timestamp ** a.b.c.d/59973 > w.x.y.z/https: SSLv3x: Corrupt length fields in Client hello!
Regards
Rmkml
Crusoe-Researches.com
bro151srcsslv3_extensionslength.diff.gz (409 Bytes)