From 005b7d60c9286dc00f014a7cac23fddf4c7d65f3 Mon Sep 17 00:00:00 2001 From: Bernhard Amann Date: Fri, 6 Jun 2014 12:15:38 -0700 Subject: [PATCH] re-add notice suppression for expiring certificates --- scripts/policy/protocols/ssl/expiring-certs.bro | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/scripts/policy/protocols/ssl/expiring-certs.bro b/scripts/policy/protocols/ssl/expiring-certs.bro index 9428923331..04ebeb3c5a 100644 --- a/scripts/policy/protocols/ssl/expiring-certs.bro +++ b/scripts/policy/protocols/ssl/expiring-certs.bro @@ -39,27 +39,31 @@ event ssl_established(c: connection) &priority=3 # If there are no certificates or we are not interested in the server, just return. if ( ! c$ssl?$cert_chain || |c$ssl$cert_chain| == 0 || ! addr_matches_host(c$id$resp_h, notify_certs_expiration) || - ! c$ssl$cert_chain[0]?$x509 ) + ! c$ssl$cert_chain[0]?$x509 || ! c$ssl$cert_chain[0]?$sha1 ) return; local fuid = c$ssl$cert_chain_fuids[0]; local cert = c$ssl$cert_chain[0]$x509$certificate; + local hash = c$ssl$cert_chain[0]$sha1; if ( cert$not_valid_before > network_time() ) NOTICE([$note=Certificate_Not_Valid_Yet, $conn=c, $suppress_for=1day, $msg=fmt("Certificate %s isn't valid until %T", cert$subject, cert$not_valid_before), + $identifier=cat(c$id$resp_h, c$id$resp_p, hash), $fuid=fuid]); else if ( cert$not_valid_after < network_time() ) NOTICE([$note=Certificate_Expired, $conn=c, $suppress_for=1day, $msg=fmt("Certificate %s expired at %T", cert$subject, cert$not_valid_after), + $identifier=cat(c$id$resp_h, c$id$resp_p, hash), $fuid=fuid]); else if ( cert$not_valid_after - notify_when_cert_expiring_in < network_time() ) NOTICE([$note=Certificate_Expires_Soon, $msg=fmt("Certificate %s is going to expire at %T", cert$subject, cert$not_valid_after), $conn=c, $suppress_for=1day, + $identifier=cat(c$id$resp_h, c$id$resp_p, hash), $fuid=fuid]); }