From 46e54bab76c817ebb7a86ef8a74bf9c6079036e4 Mon Sep 17 00:00:00 2001 From: Johanna Amann Date: Thu, 11 Jan 2024 16:31:01 +0000 Subject: [PATCH] Fix ssl-log-ext omitting data in some cases ssl-log-ext had a bug that caused data present in the SSL connection to not be logged in some cases. Specifically, the script relied on the base ssl script to initialize some data structures; however, this means that protocol messages that arrive before a message is handled by the base ssl script are not logged. This commit changes the ssl-log-ext script to also initialize the data structures; now messages are correctly included in the log in all cases. --- scripts/policy/protocols/ssl/ssl-log-ext.zeek | 42 ++++++++++--------- .../ssl-all.log | 6 +-- testing/external/commit-hash.zeek-testing | 2 +- 3 files changed, 26 insertions(+), 24 deletions(-) diff --git a/scripts/policy/protocols/ssl/ssl-log-ext.zeek b/scripts/policy/protocols/ssl/ssl-log-ext.zeek index 6fed64169a..003487c46f 100644 --- a/scripts/policy/protocols/ssl/ssl-log-ext.zeek +++ b/scripts/policy/protocols/ssl/ssl-log-ext.zeek @@ -4,6 +4,8 @@ @load base/protocols/ssl +module SSL; + redef record SSL::Info += { ## Numeric version of the server in the server hello server_version: count &log &optional; @@ -48,8 +50,7 @@ redef record SSL::Info += { event ssl_client_hello(c: connection, version: count, record_version: count, possible_ts: time, client_random: string, session_id: string, ciphers: index_vec, comp_methods: index_vec) { - if ( ! c?$ssl ) - return; + set_session(c); c$ssl$client_ciphers = ciphers; c$ssl$client_version = version; @@ -58,8 +59,7 @@ event ssl_client_hello(c: connection, version: count, record_version: count, pos event ssl_server_hello(c: connection, version: count, record_version: count, possible_ts: time, server_random: string, session_id: string, cipher: count, comp_method: count) { - if ( ! c?$ssl ) - return; + set_session(c); c$ssl$server_version = version; c$ssl$comp_method = comp_method; @@ -67,16 +67,14 @@ event ssl_server_hello(c: connection, version: count, record_version: count, pos event ssl_session_ticket_handshake(c: connection, ticket_lifetime_hint: count, ticket: string) { - if ( ! c?$ssl ) - return; + set_session(c); c$ssl$ticket_lifetime_hint = ticket_lifetime_hint; } event ssl_extension(c: connection, is_client: bool, code: count, val: string) { - if ( ! c?$ssl ) - return; + set_session(c); if ( is_client ) { @@ -94,24 +92,27 @@ event ssl_extension(c: connection, is_client: bool, code: count, val: string) event ssl_extension_ec_point_formats(c: connection, is_client: bool, point_formats: index_vec) { - if ( ! c?$ssl || ! is_client ) + if ( ! is_client ) return; + set_session(c); + c$ssl$point_formats = point_formats; } event ssl_extension_elliptic_curves(c: connection, is_client: bool, curves: index_vec) { - if ( ! c?$ssl || ! is_client ) + if ( ! is_client ) return; + set_session(c); + c$ssl$client_curves = curves; } event ssl_extension_application_layer_protocol_negotiation(c: connection, is_client: bool, names: string_vec) { - if ( ! c?$ssl ) - return; + set_session(c); if ( is_client ) c$ssl$orig_alpn = names; @@ -119,8 +120,7 @@ event ssl_extension_application_layer_protocol_negotiation(c: connection, is_cli event ssl_dh_server_params(c: connection, p: string, q: string, Ys: string) { - if ( ! c?$ssl ) - return; + set_session(c); local key_length = |Ys| * 8; # key length in bits c$ssl$dh_param_size = key_length; @@ -128,8 +128,7 @@ event ssl_dh_server_params(c: connection, p: string, q: string, Ys: string) event ssl_extension_supported_versions(c: connection, is_client: bool, versions: index_vec) { - if ( ! c?$ssl ) - return; + set_session(c); if ( is_client ) c$ssl$client_supported_versions = versions; @@ -139,16 +138,17 @@ event ssl_extension_supported_versions(c: connection, is_client: bool, versions: event ssl_extension_psk_key_exchange_modes(c: connection, is_client: bool, modes: index_vec) { - if ( ! c?$ssl || ! is_client ) + if ( ! is_client ) return; + set_session(c); + c$ssl$psk_key_exchange_modes = modes; } event ssl_extension_key_share(c: connection, is_client: bool, curves: index_vec) { - if ( ! c?$ssl ) - return; + set_session(c); if ( is_client ) c$ssl$client_key_share_groups = curves; @@ -158,9 +158,11 @@ event ssl_extension_key_share(c: connection, is_client: bool, curves: index_vec) event ssl_extension_signature_algorithm(c: connection, is_client: bool, signature_algorithms: signature_and_hashalgorithm_vec) { - if ( ! c?$ssl || ! is_client ) + if ( ! is_client ) return; + set_session(c); + local sigalgs: index_vec = vector(); local hashalgs: index_vec = vector(); diff --git a/testing/btest/Baseline/scripts.policy.protocols.ssl.ssl-log-ext/ssl-all.log b/testing/btest/Baseline/scripts.policy.protocols.ssl.ssl-log-ext/ssl-all.log index dfe68ac72e..a2cd6f882c 100644 --- a/testing/btest/Baseline/scripts.policy.protocols.ssl.ssl-log-ext/ssl-all.log +++ b/testing/btest/Baseline/scripts.policy.protocols.ssl.ssl-log-ext/ssl-all.log @@ -17,7 +17,7 @@ XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 192.168.18.50 62277 162.219.2.166 443 TLSv12 #open XXXX-XX-XX-XX-XX-XX #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p version cipher curve server_name resumed last_alert next_protocol established ssl_history cert_chain_fps client_cert_chain_fps sni_matches_cert server_version client_version client_ciphers ssl_client_exts ssl_server_exts ticket_lifetime_hint dh_param_size point_formats client_curves orig_alpn client_supported_versions server_supported_version psk_key_exchange_modes client_key_share_groups server_key_share_group client_comp_methods sigalgs hashalgs #types time string addr port addr port string string string string bool string string bool string vector[string] vector[string] bool count count vector[count] vector[count] vector[count] count count vector[count] vector[count] vector[string] vector[count] count vector[count] vector[count] count vector[count] vector[count] vector[count] -XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 192.168.18.50 56981 74.125.239.97 443 TLSv12 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA secp256r1 - F - - T CsxknGIti a97a22b691caf62c1623d14abf8a31ac915f14d87f77d8a37c47eb4785b484ad,a047a37fa2d2e118a4f5095fe074d6cfe0e352425a7632bf8659c03919a6c81d,3c35cc963eb004451323d3275d05b353235053490d9cd83729a2faf5e7ca1cc0 (empty) - 771 771 49172,255 11,10,35,13,15 65281,11,35 100800 - - 14,13,25,11,12,24,9,10,22,23,8,6,7,20,21,4,5,18,19,1,2,3,15,16,17 - - - - - - 1,0 1,2,3,1,2,3,1,2,3,1,2,3,1,2,3 6,6,6,5,5,5,4,4,4,3,3,3,2,2,2 +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 192.168.18.50 56981 74.125.239.97 443 TLSv12 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA secp256r1 - F - - T CsxknGIti a97a22b691caf62c1623d14abf8a31ac915f14d87f77d8a37c47eb4785b484ad,a047a37fa2d2e118a4f5095fe074d6cfe0e352425a7632bf8659c03919a6c81d,3c35cc963eb004451323d3275d05b353235053490d9cd83729a2faf5e7ca1cc0 (empty) - 771 771 49172,255 11,10,35,13,15 65281,11,35 100800 - 0,1,2 14,13,25,11,12,24,9,10,22,23,8,6,7,20,21,4,5,18,19,1,2,3,15,16,17 - - - - - - 1,0 1,2,3,1,2,3,1,2,3,1,2,3,1,2,3 6,6,6,5,5,5,4,4,4,3,3,3,2,2,2 #close XXXX-XX-XX-XX-XX-XX #separator \x09 #set_separator , @@ -39,7 +39,7 @@ XXXXXXXXXX.XXXXXX C4J4Th3PJpwUYZZ6gc 192.150.187.164 58870 194.127.84.106 443 TL #open XXXX-XX-XX-XX-XX-XX #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p version cipher curve server_name resumed last_alert next_protocol established ssl_history cert_chain_fps client_cert_chain_fps sni_matches_cert server_version client_version client_ciphers ssl_client_exts ssl_server_exts ticket_lifetime_hint dh_param_size point_formats client_curves orig_alpn client_supported_versions server_supported_version psk_key_exchange_modes client_key_share_groups server_key_share_group client_comp_methods sigalgs hashalgs #types time string addr port addr port string string string string bool string string bool string vector[string] vector[string] bool count count vector[count] vector[count] vector[count] count count vector[count] vector[count] vector[string] vector[count] count vector[count] vector[count] count vector[count] vector[count] vector[count] -XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 192.168.17.58 62987 216.58.192.14 443 TLSv11 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA secp256r1 - F - - T CsxknGIti 22a920a5ec03c819b569ed0fa8b7df258e3e7ea11fdd15b83b6fa45f3e863036,9b759d41e3de30f9d2f902027d792b65d950a98bbb6d6d56be7f2528453bf8e9,3c35cc963eb004451323d3275d05b353235053490d9cd83729a2faf5e7ca1cc0 (empty) - 770 770 49172,49162,57,56,55,54,136,135,134,133,49167,49157,53,132,49171,49161,51,50,49,48,154,153,152,151,69,68,67,66,49166,49156,47,150,65,7,49169,49159,49164,49154,5,4,49170,49160,22,19,16,13,49165,49155,10,255 11,10,35,15 65281,35,11 100800 - - 23,25,28,27,24,26,22,14,13,11,12,9,10 - - - - - - 1,0 - - +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 192.168.17.58 62987 216.58.192.14 443 TLSv11 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA secp256r1 - F - - T CsxknGIti 22a920a5ec03c819b569ed0fa8b7df258e3e7ea11fdd15b83b6fa45f3e863036,9b759d41e3de30f9d2f902027d792b65d950a98bbb6d6d56be7f2528453bf8e9,3c35cc963eb004451323d3275d05b353235053490d9cd83729a2faf5e7ca1cc0 (empty) - 770 770 49172,49162,57,56,55,54,136,135,134,133,49167,49157,53,132,49171,49161,51,50,49,48,154,153,152,151,69,68,67,66,49166,49156,47,150,65,7,49169,49159,49164,49154,5,4,49170,49160,22,19,16,13,49165,49155,10,255 11,10,35,15 65281,35,11 100800 - 0,1,2 23,25,28,27,24,26,22,14,13,11,12,9,10 - - - - - - 1,0 - - #close XXXX-XX-XX-XX-XX-XX #separator \x09 #set_separator , @@ -69,7 +69,7 @@ XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 192.168.17.58 60934 165.227.57.17 4400 DTLSv #open XXXX-XX-XX-XX-XX-XX #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p version cipher curve server_name resumed last_alert next_protocol established ssl_history cert_chain_fps client_cert_chain_fps sni_matches_cert server_version client_version client_ciphers ssl_client_exts ssl_server_exts ticket_lifetime_hint dh_param_size point_formats client_curves orig_alpn client_supported_versions server_supported_version psk_key_exchange_modes client_key_share_groups server_key_share_group client_comp_methods sigalgs hashalgs #types time string addr port addr port string string string string bool string string bool string vector[string] vector[string] bool count count vector[count] vector[count] vector[count] count count vector[count] vector[count] vector[string] vector[count] count vector[count] vector[count] count vector[count] vector[count] vector[count] -XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 192.168.186.133 43056 192.168.186.134 9090 TLSv13 TLS_AES_256_GCM_SHA384 secp256r1 - F - - T Cs - - - 771 771 4866 51,43,13,11,10,23 51,43 - - 0 25,24,23,21,19,16,256 - 772,771,770 772 - - 23 0 3,3,3,3,6,11,5,10,4,9,1,1,1,1,1 6,5,4,2,8,8,8,8,8,8,6,5,4,3,2 +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 192.168.186.133 43056 192.168.186.134 9090 TLSv13 TLS_AES_256_GCM_SHA384 secp256r1 - F - - T Cs - - - 771 771 4866 51,43,13,11,10,23 51,43 - - 0 25,24,23,21,19,16,256 - 772,771,770 772 - 23 23 0 3,3,3,3,6,11,5,10,4,9,1,1,1,1,1 6,5,4,2,8,8,8,8,8,8,6,5,4,3,2 #close XXXX-XX-XX-XX-XX-XX #separator \x09 #set_separator , diff --git a/testing/external/commit-hash.zeek-testing b/testing/external/commit-hash.zeek-testing index 79d8621fbe..1839cac466 100644 --- a/testing/external/commit-hash.zeek-testing +++ b/testing/external/commit-hash.zeek-testing @@ -1 +1 @@ -43766922ec10cb7cf41d6b15156a8b5984808a44 +f1ed3ca7dc6599d7d07ff55b8654c31c6438a6a3