Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-17 05:58:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Deprecate EventMgr::QueueEvent() and update usages to Enqueue()

Browse source
This commit is contained in:
Jon Siwek 2020-03-25 13:07:30 -07:00
parent b667c637df
commit 0db484cc7a
14 changed files with 164 additions and 128 deletions
Download patch file Download diff file Expand all files Collapse all files

81
src/file_analysis/analyzer/x509/OCSP.cc
View file

@ -75,7 +75,7 @@ static bool OCSP_RESPID_bio(OCSP_BASICRESP* basic_resp, BIO* bio)
return true;
}
bool ocsp_add_cert_id(const OCSP_CERTID* cert_id, val_list* vl, BIO* bio)
static bool ocsp_add_cert_id(const OCSP_CERTID* cert_id, zeek::Args* vl, BIO* bio)
{
ASN1_OBJECT* hash_alg = nullptr;
ASN1_OCTET_STRING* issuer_name_hash = nullptr;
@ -89,10 +89,10 @@ bool ocsp_add_cert_id(const OCSP_CERTID* cert_id, val_list* vl, BIO* bio)
if ( ! res )
{
reporter->Weird("OpenSSL failed to get OCSP_CERTID info");
vl->push_back(val_mgr->GetEmptyString());
vl->push_back(val_mgr->GetEmptyString());
vl->push_back(val_mgr->GetEmptyString());
vl->push_back(val_mgr->GetEmptyString());
vl->emplace_back(AdoptRef{}, val_mgr->GetEmptyString());
vl->emplace_back(AdoptRef{}, val_mgr->GetEmptyString());
vl->emplace_back(AdoptRef{}, val_mgr->GetEmptyString());
vl->emplace_back(AdoptRef{}, val_mgr->GetEmptyString());
return false;
}
@ -101,22 +101,22 @@ bool ocsp_add_cert_id(const OCSP_CERTID* cert_id, val_list* vl, BIO* bio)
i2a_ASN1_OBJECT(bio, hash_alg);
int len = BIO_read(bio, buf, sizeof(buf));
vl->push_back(new StringVal(len, buf));
vl->emplace_back(make_intrusive<StringVal>(len, buf));
BIO_reset(bio);
i2a_ASN1_STRING(bio, issuer_name_hash, V_ASN1_OCTET_STRING);
len = BIO_read(bio, buf, sizeof(buf));
vl->push_back(new StringVal(len, buf));
vl->emplace_back(make_intrusive<StringVal>(len, buf));
BIO_reset(bio);
i2a_ASN1_STRING(bio, issuer_key_hash, V_ASN1_OCTET_STRING);
len = BIO_read(bio, buf, sizeof(buf));
vl->push_back(new StringVal(len, buf));
vl->emplace_back(make_intrusive<StringVal>(len, buf));
BIO_reset(bio);
i2a_ASN1_INTEGER(bio, serial_number);
len = BIO_read(bio, buf, sizeof(buf));
vl->push_back(new StringVal(len, buf));
vl->emplace_back(make_intrusive<StringVal>(len, buf));
BIO_reset(bio);
return true;
@ -430,14 +430,17 @@ void file_analysis::OCSP::ParseRequest(OCSP_REQUEST* req)
int req_count = OCSP_request_onereq_count(req);
for ( int i=0; i<req_count; i++ )
{
val_list rvl(5);
rvl.push_back(GetFile()->GetVal()->Ref());
zeek::Args rvl;
rvl.reserve(5);
rvl.emplace_back(NewRef{}, GetFile()->GetVal());
OCSP_ONEREQ *one_req = OCSP_request_onereq_get0(req, i);
OCSP_CERTID *cert_id = OCSP_onereq_get0_id(one_req);
ocsp_add_cert_id(cert_id, &rvl, bio);
mgr.QueueEvent(ocsp_request_certificate, std::move(rvl));
if ( ocsp_request_certificate )
mgr.Enqueue(ocsp_request_certificate, std::move(rvl));
}
BIO_free(bio);
@ -479,7 +482,8 @@ void file_analysis::OCSP::ParseResponse(OCSP_RESPONSE *resp)
//int len = BIO_read(bio, buf, sizeof(buf));
//BIO_reset(bio);
val_list vl(8);
zeek::Args vl;
vl.reserve(8);
// get the basic response
basic_resp = OCSP_response_get1_basic(resp);
@ -498,26 +502,26 @@ void file_analysis::OCSP::ParseResponse(OCSP_RESPONSE *resp)
}
#endif
vl.push_back(GetFile()->GetVal()->Ref());
vl.push_back(status_val);
vl.emplace_back(NewRef{}, GetFile()->GetVal());
vl.emplace_back(AdoptRef{}, status_val);
#if ( OPENSSL_VERSION_NUMBER < 0x10100000L ) || defined(LIBRESSL_VERSION_NUMBER)
vl.push_back(val_mgr->GetCount((uint64_t)ASN1_INTEGER_get(resp_data->version)));
vl.emplace_back(AdoptRef{}, val_mgr->GetCount((uint64_t)ASN1_INTEGER_get(resp_data->version)));
#else
vl.push_back(parse_basic_resp_data_version(basic_resp));
vl.emplace_back(AdoptRef{}, parse_basic_resp_data_version(basic_resp));
#endif
// responderID
if ( OCSP_RESPID_bio(basic_resp, bio) )
{
len = BIO_read(bio, buf, sizeof(buf));
vl.push_back(new StringVal(len, buf));
vl.emplace_back(make_intrusive<StringVal>(len, buf));
BIO_reset(bio);
}
else
{
reporter->Weird("OpenSSL failed to get OCSP responder id");
vl.push_back(val_mgr->GetEmptyString());
vl.emplace_back(AdoptRef{}, val_mgr->GetEmptyString());
}
// producedAt
@ -527,7 +531,7 @@ void file_analysis::OCSP::ParseResponse(OCSP_RESPONSE *resp)
produced_at = OCSP_resp_get0_produced_at(basic_resp);
#endif
vl.push_back(new Val(GetTimeFromAsn1(produced_at, GetFile(), reporter), TYPE_TIME));
vl.emplace_back(make_intrusive<Val>(GetTimeFromAsn1(produced_at, GetFile(), reporter), TYPE_TIME));
// responses
@ -540,8 +544,9 @@ void file_analysis::OCSP::ParseResponse(OCSP_RESPONSE *resp)
if ( !single_resp )
continue;
val_list rvl(10);
rvl.push_back(GetFile()->GetVal()->Ref());
zeek::Args rvl;
rvl.reserve(10);
rvl.emplace_back(NewRef{}, GetFile()->GetVal());
// cert id
const OCSP_CERTID* cert_id = nullptr;
@ -569,38 +574,39 @@ void file_analysis::OCSP::ParseResponse(OCSP_RESPONSE *resp)
reporter->Weird("OpenSSL failed to find status of OCSP response");
const char* cert_status_str = OCSP_cert_status_str(status);
rvl.push_back(new StringVal(strlen(cert_status_str), cert_status_str));
rvl.emplace_back(make_intrusive<StringVal>(strlen(cert_status_str), cert_status_str));
// revocation time and reason if revoked
if ( status == V_OCSP_CERTSTATUS_REVOKED )
{
rvl.push_back(new Val(GetTimeFromAsn1(revoke_time, GetFile(), reporter), TYPE_TIME));
rvl.emplace_back(make_intrusive<Val>(GetTimeFromAsn1(revoke_time, GetFile(), reporter), TYPE_TIME));
if ( reason != OCSP_REVOKED_STATUS_NOSTATUS )
{
const char* revoke_reason = OCSP_crl_reason_str(reason);
rvl.push_back(new StringVal(strlen(revoke_reason), revoke_reason));
rvl.emplace_back(make_intrusive<StringVal>(strlen(revoke_reason), revoke_reason));
}
else
rvl.push_back(new StringVal(0, ""));
rvl.emplace_back(make_intrusive<StringVal>(0, ""));
}
else
{
rvl.push_back(new Val(0.0, TYPE_TIME));
rvl.push_back(new StringVal(0, ""));
rvl.emplace_back(make_intrusive<Val>(0.0, TYPE_TIME));
rvl.emplace_back(make_intrusive<StringVal>(0, ""));
}
if ( this_update )
rvl.push_back(new Val(GetTimeFromAsn1(this_update, GetFile(), reporter), TYPE_TIME));
rvl.emplace_back(make_intrusive<Val>(GetTimeFromAsn1(this_update, GetFile(), reporter), TYPE_TIME));
else
rvl.push_back(new Val(0.0, TYPE_TIME));
rvl.emplace_back(make_intrusive<Val>(0.0, TYPE_TIME));
if ( next_update )
rvl.push_back(new Val(GetTimeFromAsn1(next_update, GetFile(), reporter), TYPE_TIME));
rvl.emplace_back(make_intrusive<Val>(GetTimeFromAsn1(next_update, GetFile(), reporter), TYPE_TIME));
else
rvl.push_back(new Val(0.0, TYPE_TIME));
rvl.emplace_back(make_intrusive<Val>(0.0, TYPE_TIME));
mgr.QueueEvent(ocsp_response_certificate, std::move(rvl));
if ( ocsp_response_certificate )
mgr.Enqueue(ocsp_response_certificate, std::move(rvl));
num_ext = OCSP_SINGLERESP_get_ext_count(single_resp);
for ( int k = 0; k < num_ext; ++k )
@ -616,10 +622,10 @@ void file_analysis::OCSP::ParseResponse(OCSP_RESPONSE *resp)
#if ( OPENSSL_VERSION_NUMBER < 0x10100000L ) || defined(LIBRESSL_VERSION_NUMBER)
i2a_ASN1_OBJECT(bio, basic_resp->signatureAlgorithm->algorithm);
len = BIO_read(bio, buf, sizeof(buf));
vl.push_back(new StringVal(len, buf));
vl.emplace_back(make_intrusive<StringVal>(len, buf));
BIO_reset(bio);
#else
vl.push_back(parse_basic_resp_sig_alg(basic_resp, bio, buf, sizeof(buf)));
vl.emplace_back(AdoptRef{}, parse_basic_resp_sig_alg(basic_resp, bio, buf, sizeof(buf)));
#endif
//i2a_ASN1_OBJECT(bio, basic_resp->signature);
@ -628,7 +634,7 @@ void file_analysis::OCSP::ParseResponse(OCSP_RESPONSE *resp)
//BIO_reset(bio);
certs_vector = new VectorVal(internal_type("x509_opaque_vector")->AsVectorType());
vl.push_back(certs_vector);
vl.emplace_back(AdoptRef{}, certs_vector);
#if ( OPENSSL_VERSION_NUMBER < 0x10100000L ) || defined(LIBRESSL_VERSION_NUMBER)
certs = basic_resp->certs;
@ -650,7 +656,8 @@ void file_analysis::OCSP::ParseResponse(OCSP_RESPONSE *resp)
}
}
mgr.QueueEvent(ocsp_response_bytes, std::move(vl));
if ( ocsp_response_bytes )
mgr.Enqueue(ocsp_response_bytes, std::move(vl));
// ok, now that we are done with the actual certificate - let's parse extensions :)
num_ext = OCSP_BASICRESP_get_ext_count(basic_resp);