Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Merge branch 'topic/johanna/fix-logging-of-ssl-log-ext-in-some-cases'

Browse source 
* topic/johanna/fix-logging-of-ssl-log-ext-in-some-cases:
  Fix ssl-log-ext omitting data in some cases
This commit is contained in:
Johanna Amann 2024-01-16 13:08:32 +00:00
commit 273731e1ce
5 changed files with 40 additions and 25 deletions
Download patch file Download diff file Expand all files Collapse all files

13
CHANGES
View file

@ -1,3 +1,16 @@
6.2.0-dev.400 | 2024-01-16 13:08:32 +0000
* Fix ssl-log-ext omitting data in some cases (Johanna Amann, Corelight)
ssl-log-ext had a bug that caused data present in the SSL connection to
not be logged in some cases. Specifically, the script relied on the base
ssl script to initialize some data structures; however, this means that
protocol messages that arrive before a message is handled by the base
ssl script are not logged.
This commit changes the ssl-log-ext script to also initialize the data
structures; now messages are correctly included in the log in all cases.
6.2.0-dev.398 | 2024-01-15 15:18:32 +0100 6.2.0-dev.398 | 2024-01-15 15:18:32 +0100
* Session/Conn: Follow-up fix for hist_seen and history lift (Arne Welzel, Corelight) * Session/Conn: Follow-up fix for hist_seen and history lift (Arne Welzel, Corelight)

2
VERSION
View file

@ -1 +1 @@
6.2.0-dev.398 6.2.0-dev.400

42
scripts/policy/protocols/ssl/ssl-log-ext.zeek
View file

@ -4,6 +4,8 @@
@load base/protocols/ssl @load base/protocols/ssl
module SSL;
redef record SSL::Info += { redef record SSL::Info += {
## Numeric version of the server in the server hello ## Numeric version of the server in the server hello
server_version: count &log &optional; server_version: count &log &optional;
@ -48,8 +50,7 @@ redef record SSL::Info += {
event ssl_client_hello(c: connection, version: count, record_version: count, possible_ts: time, client_random: string, session_id: string, ciphers: index_vec, comp_methods: index_vec) event ssl_client_hello(c: connection, version: count, record_version: count, possible_ts: time, client_random: string, session_id: string, ciphers: index_vec, comp_methods: index_vec)
{ {
if ( ! c?$ssl ) set_session(c);
return;
c$ssl$client_ciphers = ciphers; c$ssl$client_ciphers = ciphers;
c$ssl$client_version = version; c$ssl$client_version = version;
@ -58,8 +59,7 @@ event ssl_client_hello(c: connection, version: count, record_version: count, pos
event ssl_server_hello(c: connection, version: count, record_version: count, possible_ts: time, server_random: string, session_id: string, cipher: count, comp_method: count) event ssl_server_hello(c: connection, version: count, record_version: count, possible_ts: time, server_random: string, session_id: string, cipher: count, comp_method: count)
{ {
if ( ! c?$ssl ) set_session(c);
return;
c$ssl$server_version = version; c$ssl$server_version = version;
c$ssl$comp_method = comp_method; c$ssl$comp_method = comp_method;
@ -67,16 +67,14 @@ event ssl_server_hello(c: connection, version: count, record_version: count, pos
event ssl_session_ticket_handshake(c: connection, ticket_lifetime_hint: count, ticket: string) event ssl_session_ticket_handshake(c: connection, ticket_lifetime_hint: count, ticket: string)
{ {
if ( ! c?$ssl ) set_session(c);
return;
c$ssl$ticket_lifetime_hint = ticket_lifetime_hint; c$ssl$ticket_lifetime_hint = ticket_lifetime_hint;
} }
event ssl_extension(c: connection, is_client: bool, code: count, val: string) event ssl_extension(c: connection, is_client: bool, code: count, val: string)
{ {
if ( ! c?$ssl ) set_session(c);
return;
if ( is_client ) if ( is_client )
{ {
@ -94,24 +92,27 @@ event ssl_extension(c: connection, is_client: bool, code: count, val: string)
event ssl_extension_ec_point_formats(c: connection, is_client: bool, point_formats: index_vec) event ssl_extension_ec_point_formats(c: connection, is_client: bool, point_formats: index_vec)
{ {
if ( ! c?$ssl || ! is_client ) if ( ! is_client )
return; return;
set_session(c);
c$ssl$point_formats = point_formats; c$ssl$point_formats = point_formats;
} }
event ssl_extension_elliptic_curves(c: connection, is_client: bool, curves: index_vec) event ssl_extension_elliptic_curves(c: connection, is_client: bool, curves: index_vec)
{ {
if ( ! c?$ssl || ! is_client ) if ( ! is_client )
return; return;
set_session(c);
c$ssl$client_curves = curves; c$ssl$client_curves = curves;
} }
event ssl_extension_application_layer_protocol_negotiation(c: connection, is_client: bool, names: string_vec) event ssl_extension_application_layer_protocol_negotiation(c: connection, is_client: bool, names: string_vec)
{ {
if ( ! c?$ssl ) set_session(c);
return;
if ( is_client ) if ( is_client )
c$ssl$orig_alpn = names; c$ssl$orig_alpn = names;
@ -119,8 +120,7 @@ event ssl_extension_application_layer_protocol_negotiation(c: connection, is_cli
event ssl_dh_server_params(c: connection, p: string, q: string, Ys: string) event ssl_dh_server_params(c: connection, p: string, q: string, Ys: string)
{ {
if ( ! c?$ssl ) set_session(c);
return;
local key_length = |Ys| * 8; # key length in bits local key_length = |Ys| * 8; # key length in bits
c$ssl$dh_param_size = key_length; c$ssl$dh_param_size = key_length;
@ -128,8 +128,7 @@ event ssl_dh_server_params(c: connection, p: string, q: string, Ys: string)
event ssl_extension_supported_versions(c: connection, is_client: bool, versions: index_vec) event ssl_extension_supported_versions(c: connection, is_client: bool, versions: index_vec)
{ {
if ( ! c?$ssl ) set_session(c);
return;
if ( is_client ) if ( is_client )
c$ssl$client_supported_versions = versions; c$ssl$client_supported_versions = versions;
@ -139,16 +138,17 @@ event ssl_extension_supported_versions(c: connection, is_client: bool, versions:
event ssl_extension_psk_key_exchange_modes(c: connection, is_client: bool, modes: index_vec) event ssl_extension_psk_key_exchange_modes(c: connection, is_client: bool, modes: index_vec)
{ {
if ( ! c?$ssl || ! is_client ) if ( ! is_client )
return; return;
set_session(c);
c$ssl$psk_key_exchange_modes = modes; c$ssl$psk_key_exchange_modes = modes;
} }
event ssl_extension_key_share(c: connection, is_client: bool, curves: index_vec) event ssl_extension_key_share(c: connection, is_client: bool, curves: index_vec)
{ {
if ( ! c?$ssl ) set_session(c);
return;
if ( is_client ) if ( is_client )
c$ssl$client_key_share_groups = curves; c$ssl$client_key_share_groups = curves;
@ -158,9 +158,11 @@ event ssl_extension_key_share(c: connection, is_client: bool, curves: index_vec)
event ssl_extension_signature_algorithm(c: connection, is_client: bool, signature_algorithms: signature_and_hashalgorithm_vec) event ssl_extension_signature_algorithm(c: connection, is_client: bool, signature_algorithms: signature_and_hashalgorithm_vec)
{ {
if ( ! c?$ssl || ! is_client ) if ( ! is_client )
return; return;
set_session(c);
local sigalgs: index_vec = vector(); local sigalgs: index_vec = vector();
local hashalgs: index_vec = vector(); local hashalgs: index_vec = vector();

6
testing/btest/Baseline/scripts.policy.protocols.ssl.ssl-log-ext/ssl-all.log
View file

@ -17,7 +17,7 @@ XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 192.168.18.50 62277 162.219.2.166 443 TLSv12
#open XXXX-XX-XX-XX-XX-XX #open XXXX-XX-XX-XX-XX-XX
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p version cipher curve server_name resumed last_alert next_protocol established ssl_history cert_chain_fps client_cert_chain_fps sni_matches_cert server_version client_version client_ciphers ssl_client_exts ssl_server_exts ticket_lifetime_hint dh_param_size point_formats client_curves orig_alpn client_supported_versions server_supported_version psk_key_exchange_modes client_key_share_groups server_key_share_group client_comp_methods sigalgs hashalgs #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p version cipher curve server_name resumed last_alert next_protocol established ssl_history cert_chain_fps client_cert_chain_fps sni_matches_cert server_version client_version client_ciphers ssl_client_exts ssl_server_exts ticket_lifetime_hint dh_param_size point_formats client_curves orig_alpn client_supported_versions server_supported_version psk_key_exchange_modes client_key_share_groups server_key_share_group client_comp_methods sigalgs hashalgs
#types time string addr port addr port string string string string bool string string bool string vector[string] vector[string] bool count count vector[count] vector[count] vector[count] count count vector[count] vector[count] vector[string] vector[count] count vector[count] vector[count] count vector[count] vector[count] vector[count] #types time string addr port addr port string string string string bool string string bool string vector[string] vector[string] bool count count vector[count] vector[count] vector[count] count count vector[count] vector[count] vector[string] vector[count] count vector[count] vector[count] count vector[count] vector[count] vector[count]
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 192.168.18.50 56981 74.125.239.97 443 TLSv12 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA secp256r1 - F - - T CsxknGIti a97a22b691caf62c1623d14abf8a31ac915f14d87f77d8a37c47eb4785b484ad,a047a37fa2d2e118a4f5095fe074d6cfe0e352425a7632bf8659c03919a6c81d,3c35cc963eb004451323d3275d05b353235053490d9cd83729a2faf5e7ca1cc0 (empty) - 771 771 49172,255 11,10,35,13,15 65281,11,35 100800 - - 14,13,25,11,12,24,9,10,22,23,8,6,7,20,21,4,5,18,19,1,2,3,15,16,17 - - - - - - 1,0 1,2,3,1,2,3,1,2,3,1,2,3,1,2,3 6,6,6,5,5,5,4,4,4,3,3,3,2,2,2 XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 192.168.18.50 56981 74.125.239.97 443 TLSv12 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA secp256r1 - F - - T CsxknGIti a97a22b691caf62c1623d14abf8a31ac915f14d87f77d8a37c47eb4785b484ad,a047a37fa2d2e118a4f5095fe074d6cfe0e352425a7632bf8659c03919a6c81d,3c35cc963eb004451323d3275d05b353235053490d9cd83729a2faf5e7ca1cc0 (empty) - 771 771 49172,255 11,10,35,13,15 65281,11,35 100800 - 0,1,2 14,13,25,11,12,24,9,10,22,23,8,6,7,20,21,4,5,18,19,1,2,3,15,16,17 - - - - - - 1,0 1,2,3,1,2,3,1,2,3,1,2,3,1,2,3 6,6,6,5,5,5,4,4,4,3,3,3,2,2,2
#close XXXX-XX-XX-XX-XX-XX #close XXXX-XX-XX-XX-XX-XX
#separator \x09 #separator \x09
#set_separator , #set_separator ,
@ -39,7 +39,7 @@ XXXXXXXXXX.XXXXXX C4J4Th3PJpwUYZZ6gc 192.150.187.164 58870 194.127.84.106 443 TL
#open XXXX-XX-XX-XX-XX-XX #open XXXX-XX-XX-XX-XX-XX
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p version cipher curve server_name resumed last_alert next_protocol established ssl_history cert_chain_fps client_cert_chain_fps sni_matches_cert server_version client_version client_ciphers ssl_client_exts ssl_server_exts ticket_lifetime_hint dh_param_size point_formats client_curves orig_alpn client_supported_versions server_supported_version psk_key_exchange_modes client_key_share_groups server_key_share_group client_comp_methods sigalgs hashalgs #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p version cipher curve server_name resumed last_alert next_protocol established ssl_history cert_chain_fps client_cert_chain_fps sni_matches_cert server_version client_version client_ciphers ssl_client_exts ssl_server_exts ticket_lifetime_hint dh_param_size point_formats client_curves orig_alpn client_supported_versions server_supported_version psk_key_exchange_modes client_key_share_groups server_key_share_group client_comp_methods sigalgs hashalgs
#types time string addr port addr port string string string string bool string string bool string vector[string] vector[string] bool count count vector[count] vector[count] vector[count] count count vector[count] vector[count] vector[string] vector[count] count vector[count] vector[count] count vector[count] vector[count] vector[count] #types time string addr port addr port string string string string bool string string bool string vector[string] vector[string] bool count count vector[count] vector[count] vector[count] count count vector[count] vector[count] vector[string] vector[count] count vector[count] vector[count] count vector[count] vector[count] vector[count]
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 192.168.17.58 62987 216.58.192.14 443 TLSv11 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA secp256r1 - F - - T CsxknGIti 22a920a5ec03c819b569ed0fa8b7df258e3e7ea11fdd15b83b6fa45f3e863036,9b759d41e3de30f9d2f902027d792b65d950a98bbb6d6d56be7f2528453bf8e9,3c35cc963eb004451323d3275d05b353235053490d9cd83729a2faf5e7ca1cc0 (empty) - 770 770 49172,49162,57,56,55,54,136,135,134,133,49167,49157,53,132,49171,49161,51,50,49,48,154,153,152,151,69,68,67,66,49166,49156,47,150,65,7,49169,49159,49164,49154,5,4,49170,49160,22,19,16,13,49165,49155,10,255 11,10,35,15 65281,35,11 100800 - - 23,25,28,27,24,26,22,14,13,11,12,9,10 - - - - - - 1,0 - - XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 192.168.17.58 62987 216.58.192.14 443 TLSv11 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA secp256r1 - F - - T CsxknGIti 22a920a5ec03c819b569ed0fa8b7df258e3e7ea11fdd15b83b6fa45f3e863036,9b759d41e3de30f9d2f902027d792b65d950a98bbb6d6d56be7f2528453bf8e9,3c35cc963eb004451323d3275d05b353235053490d9cd83729a2faf5e7ca1cc0 (empty) - 770 770 49172,49162,57,56,55,54,136,135,134,133,49167,49157,53,132,49171,49161,51,50,49,48,154,153,152,151,69,68,67,66,49166,49156,47,150,65,7,49169,49159,49164,49154,5,4,49170,49160,22,19,16,13,49165,49155,10,255 11,10,35,15 65281,35,11 100800 - 0,1,2 23,25,28,27,24,26,22,14,13,11,12,9,10 - - - - - - 1,0 - -
#close XXXX-XX-XX-XX-XX-XX #close XXXX-XX-XX-XX-XX-XX
#separator \x09 #separator \x09
#set_separator , #set_separator ,
@ -69,7 +69,7 @@ XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 192.168.17.58 60934 165.227.57.17 4400 DTLSv
#open XXXX-XX-XX-XX-XX-XX #open XXXX-XX-XX-XX-XX-XX
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p version cipher curve server_name resumed last_alert next_protocol established ssl_history cert_chain_fps client_cert_chain_fps sni_matches_cert server_version client_version client_ciphers ssl_client_exts ssl_server_exts ticket_lifetime_hint dh_param_size point_formats client_curves orig_alpn client_supported_versions server_supported_version psk_key_exchange_modes client_key_share_groups server_key_share_group client_comp_methods sigalgs hashalgs #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p version cipher curve server_name resumed last_alert next_protocol established ssl_history cert_chain_fps client_cert_chain_fps sni_matches_cert server_version client_version client_ciphers ssl_client_exts ssl_server_exts ticket_lifetime_hint dh_param_size point_formats client_curves orig_alpn client_supported_versions server_supported_version psk_key_exchange_modes client_key_share_groups server_key_share_group client_comp_methods sigalgs hashalgs
#types time string addr port addr port string string string string bool string string bool string vector[string] vector[string] bool count count vector[count] vector[count] vector[count] count count vector[count] vector[count] vector[string] vector[count] count vector[count] vector[count] count vector[count] vector[count] vector[count] #types time string addr port addr port string string string string bool string string bool string vector[string] vector[string] bool count count vector[count] vector[count] vector[count] count count vector[count] vector[count] vector[string] vector[count] count vector[count] vector[count] count vector[count] vector[count] vector[count]
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 192.168.186.133 43056 192.168.186.134 9090 TLSv13 TLS_AES_256_GCM_SHA384 secp256r1 - F - - T Cs - - - 771 771 4866 51,43,13,11,10,23 51,43 - - 0 25,24,23,21,19,16,256 - 772,771,770 772 - - 23 0 3,3,3,3,6,11,5,10,4,9,1,1,1,1,1 6,5,4,2,8,8,8,8,8,8,6,5,4,3,2 XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 192.168.186.133 43056 192.168.186.134 9090 TLSv13 TLS_AES_256_GCM_SHA384 secp256r1 - F - - T Cs - - - 771 771 4866 51,43,13,11,10,23 51,43 - - 0 25,24,23,21,19,16,256 - 772,771,770 772 - 23 23 0 3,3,3,3,6,11,5,10,4,9,1,1,1,1,1 6,5,4,2,8,8,8,8,8,8,6,5,4,3,2
#close XXXX-XX-XX-XX-XX-XX #close XXXX-XX-XX-XX-XX-XX
#separator \x09 #separator \x09
#set_separator , #set_separator ,

2
testing/external/commit-hash.zeek-testing vendored
View file

@ -1 +1 @@
43766922ec10cb7cf41d6b15156a8b5984808a44 3577ad0657c0cd61222d329a840e881dacf93f07