Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-09 01:58:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Finishing touches of the x509 file analyzer.

Browse source 
Mostly baseline updates and new tests.

addresses BIT-953, BIT-760, BIT-1150
This commit is contained in:
Bernhard Amann 2014-03-13 15:17:25 -07:00
parent 74d728656d
commit 4da0718511
44 changed files with 712 additions and 148 deletions
Download patch file Download diff file Expand all files Collapse all files

7
scripts/base/protocols/ssl/files.bro
View file

@ -70,8 +70,7 @@ function get_file_handle(c: connection, is_orig: bool): string
function describe_file(f: fa_file): string
{
# This shouldn't be needed, but just in case...
if ( f$source != "SSL" )
if ( f$source != "SSL" || ! f?$info || ! f$info?$x509 || ! f$info$x509?$certificate )
return "";
# It is difficult to reliably describe a certificate - especially since
@ -88,7 +87,9 @@ function describe_file(f: fa_file): string
}
}
return "";
return cat("Serial: ", f$info$x509$certificate$serial, " Subject: ",
f$info$x509$certificate$subject, " Issuer: ",
f$info$x509$certificate$issuer);
}
event bro_init() &priority=5