Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-17 14:08:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Finishing touches of the x509 file analyzer.

Browse source 
Mostly baseline updates and new tests.

addresses BIT-953, BIT-760, BIT-1150
This commit is contained in:
Bernhard Amann 2014-03-13 15:17:25 -07:00
parent 74d728656d
commit 4da0718511
44 changed files with 712 additions and 148 deletions
Download patch file Download diff file Expand all files Collapse all files

2
scripts/base/init-bare.bro
View file

@ -2764,8 +2764,6 @@ export {
key_length: count &optional; ##< key-length in bits
exponent: string &optional; ##< exponent, if RSA-certificate
curve: string &optional; ##< curve, if EC-certificate
#ca: bool &optional; ##< indicates the CA value in the X509v3 BasicConstraints extension
#path_len: count &optional; ##< indicates the path_length value in the X509v3 BasicConstraints extension
} &log;
type Extension: record {

4
scripts/base/init-default.bro
View file

@ -38,9 +38,6 @@
@load base/frameworks/sumstats
@load base/frameworks/tunnels
# needed for the SSL protocol
@load base/files/x509
@load base/protocols/conn
@load base/protocols/dhcp
@load base/protocols/dnp3
@ -60,6 +57,7 @@
@load base/files/hash
@load base/files/extract
@load base/files/unified2
@load base/files/x509
@load base/misc/find-checksum-offloading
@load base/misc/find-filtered-trace

7
scripts/base/protocols/ssl/files.bro
View file

@ -70,8 +70,7 @@ function get_file_handle(c: connection, is_orig: bool): string
function describe_file(f: fa_file): string
{
# This shouldn't be needed, but just in case...
if ( f$source != "SSL" )
if ( f$source != "SSL" || ! f?$info || ! f$info?$x509 || ! f$info$x509?$certificate )
return "";
# It is difficult to reliably describe a certificate - especially since
@ -88,7 +87,9 @@ function describe_file(f: fa_file): string
}
}
return "";
return cat("Serial: ", f$info$x509$certificate$serial, " Subject: ",
f$info$x509$certificate$subject, " Issuer: ",
f$info$x509$certificate$issuer);
}
event bro_init() &priority=5