Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Fixed parsing of V_ASN1_GENERALIZEDTIME timestamps in x509 certificates

Browse source
This commit is contained in:
Yun Zheng Hu 2015-09-10 10:50:35 +02:00
parent ab57c72251
commit 2327f5bba5
4 changed files with 52 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

32
src/file_analysis/analyzer/x509/X509.cc
View file

@ -620,15 +620,33 @@ double file_analysis::X509::GetTimeFromAsn1(const ASN1_TIME* atime, const char*
} }
tm lTime; tm lTime;
lTime.tm_sec = ((lBuffer[10] - '0') * 10) + (lBuffer[11] - '0'); size_t i;
lTime.tm_min = ((lBuffer[8] - '0') * 10) + (lBuffer[9] - '0'); if ( atime->type == V_ASN1_GENERALIZEDTIME )
lTime.tm_hour = ((lBuffer[6] - '0') * 10) + (lBuffer[7] - '0'); {
lTime.tm_mday = ((lBuffer[4] - '0') * 10) + (lBuffer[5] - '0'); // YYYY format
lTime.tm_mon = (((lBuffer[2] - '0') * 10) + (lBuffer[3] - '0')) - 1; lTime.tm_year = (lBuffer[0] - '0') * 1000;
lTime.tm_year = ((lBuffer[0] - '0') * 10) + (lBuffer[1] - '0'); lTime.tm_year += (lBuffer[1] - '0') * 100;
lTime.tm_year += (lBuffer[2] - '0') * 10;
lTime.tm_year += (lBuffer[3] - '0');
if ( lTime.tm_year > 1900)
lTime.tm_year -= 1900;
i = 4;
}
else
{
// YY format
lTime.tm_year = (lBuffer[0] - '0') * 10;
lTime.tm_year += (lBuffer[1] - '0');
if ( lTime.tm_year < 50 ) if ( lTime.tm_year < 50 )
lTime.tm_year += 100; // RFC 2459 lTime.tm_year += 100; // RFC 2459
i = 2;
}
lTime.tm_mon = ((lBuffer[i+0] - '0') * 10) + (lBuffer[i+1] - '0') - 1; // MM
lTime.tm_mday = ((lBuffer[i+2] - '0') * 10) + (lBuffer[i+3] - '0'); // DD
lTime.tm_hour = ((lBuffer[i+4] - '0') * 10) + (lBuffer[i+5] - '0'); // hh
lTime.tm_min = ((lBuffer[i+6] - '0') * 10) + (lBuffer[i+7] - '0'); // mm
lTime.tm_sec = ((lBuffer[i+8] - '0') * 10) + (lBuffer[i+9] - '0'); // ss
lTime.tm_wday = 0; lTime.tm_wday = 0;
lTime.tm_yday = 0; lTime.tm_yday = 0;

16
testing/btest/Baseline/core.x509-generalizedtime/output Normal file
View file

@ -0,0 +1,16 @@
----- x509_certificate ----
subject: CN=bro-generalizedtime-test,O=Bro,C=NL
not_valid_before: 2015-09-01-13:33:37.000000000 (epoch: 1441114417.0)
not_valid_after : 2025-09-01-13:33:37.000000000 (epoch: 1756733617.0)
----- x509_certificate ----
subject: CN=*.taleo.net,OU=Comodo PremiumSSL Wildcard,OU=Web,O=Taleo Inc.,street=4140 Dublin Boulevard,street=Suite 400,L=Dublin,ST=CA,postalCode=94568,C=US
not_valid_before: 2011-05-04-00:00:00.000000000 (epoch: 1304467200.0)
not_valid_after : 2016-07-04-23:59:59.000000000 (epoch: 1467676799.0)
----- x509_certificate ----
subject: CN=COMODO High-Assurance Secure Server CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
not_valid_before: 2010-04-16-00:00:00.000000000 (epoch: 1271376000.0)
not_valid_after : 2020-05-30-10:48:38.000000000 (epoch: 1590835718.0)
----- x509_certificate ----
subject: CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE
not_valid_before: 2000-05-30-10:48:38.000000000 (epoch: 959683718.0)
not_valid_after : 2020-05-30-10:48:38.000000000 (epoch: 1590835718.0)

BIN
testing/btest/Traces/tls/x509-generalizedtime.pcap Normal file
View file

Binary file not shown.

10
testing/btest/core/x509-generalizedtime.bro Normal file
View file

@ -0,0 +1,10 @@
# @TEST-EXEC: bro -C -r $TRACES/tls/x509-generalizedtime.pcap %INPUT >>output 2>&1
# @TEST-EXEC: bro -C -r $TRACES/tls/tls1.2.trace %INPUT >>output 2>&1
# @TEST-EXEC: btest-diff output
event x509_certificate(f: fa_file, cert_ref: opaque of x509, cert: X509::Certificate)
{
print "----- x509_certificate ----";
print fmt("subject: %s", cert$subject);
print fmt("not_valid_before: %T (epoch: %s)", cert$not_valid_before, cert$not_valid_before);
print fmt("not_valid_after : %T (epoch: %s)", cert$not_valid_after, cert$not_valid_after);
}