[Bro-Dev] Potential of including TLSv1.3 support in Bro 2.5

[Johanna Amann]

I would be happy if you test this branch - however, you are actually 
unlikely to trigger the new code paths. TLS 1.3 is still in the 
development stage, so much that I doubt that you will even encounter a 
single connection that uses it. At the moment, you have to enable it by 
hand in the development edition of browsers, and more or less compile 
your own server that is able to speak it.

(That being said, I am quite confident the on-the-wire format won't 
change significantly enough anymore that the new analyzer won't be able 
to parse it.)

Johanna

On 7 Oct 2016, at 17:03, Aashish Sharma wrote:

> I think the current feature freeze is a self-imposed limit out of 
> coding discipline - but it ok to make exceptions.  Esp since 2.6 would 
> be long way away.
>
> Risky as it is, It seems like inclusion of this code isn't going to 
> cause any significant problems. FWIW, I can run this branch on my end 
> for until release happens.
>
> Aashish
>
> On Fri, Oct 07, 2016 at 02:06:53PM -0700, Johanna Amann wrote:
>> I just finished a branch that adds support for TLSv1.3 to Bro (branch
>> topic/johanna/tls13, important commit:
>> https://github.com/bro/bro/commit/fdef28ce7c3455d43267ab07dbb8ad96c9ea3890).
>>
>> What do people think of the idea of adding that patch to the upcoming 
>> Bro
>> 2.5 release?
>>
>> I know that we are quite late in the current release process and that 
>> we
>> should not really make any feature changes after releasing the beta.  
>> It
>> would, however, be neat to be able to support TLSv1.3 starting the 
>> moment
>> that people actually start to use it; without that support, we will 
>> only
>> have empty lines in ssl.log for these connections. Furthermore, the
>> changes that are needed to support TLSv1.3 have nearly no interaction 
>> with
>> the code that is used to parse earlier versions of TLS. Even if there 
>> are
>> problems with the code (or if the on-the-wire format still changes), 
>> the
>> only thing that should happen is that binpac throws errors. Which is
>> exactly what already happens now when throwing TLSv1.3 sessions at 
>> the
>> current master versions of Bro.
>>
>> Thanks,
>>  Johanna
>> _______________________________________________
>> bro-dev mailing list
>> bro-dev at bro.org
>> http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev
>