Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-12 19:48:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

More SSL script cleanup.

Browse source
This commit is contained in:
Seth Hall 2011-06-30 16:45:13 -04:00
parent 06a0b2df67
commit 556bc55068
1 changed files with 5 additions and 18 deletions
Download patch file Download diff file Expand all files Collapse all files

23
policy/protocols/ssl/base.bro
View file

@ -18,7 +18,7 @@ export {
cipher: string &log &optional; cipher: string &log &optional;
validation_status:string &log &optional; validation_status:string &log &optional;
server_name: string &log &optional; server_name: string &log &optional;
server_subject: string &log &optional; subject: string &log &optional;
not_valid_before: time &log &optional; not_valid_before: time &log &optional;
not_valid_after: time &log &optional; not_valid_after: time &log &optional;
@ -95,7 +95,7 @@ event x509_certificate(c: connection, cert: X509, is_server: bool, chain_idx: co
c$ssl$cert = der_cert; c$ssl$cert = der_cert;
# Also save other certificate information about the primary cert. # Also save other certificate information about the primary cert.
c$ssl$server_subject = cert$subject; c$ssl$subject = cert$subject;
c$ssl$not_valid_before = cert$not_valid_before; c$ssl$not_valid_before = cert$not_valid_before;
c$ssl$not_valid_after = cert$not_valid_after; c$ssl$not_valid_after = cert$not_valid_after;
} }
@ -114,30 +114,17 @@ event ssl_extension(c: connection, code: count, val: string)
c$ssl$server_name = sub_bytes(val, 6, |val|); c$ssl$server_name = sub_bytes(val, 6, |val|);
} }
event ssl_alert(c: connection, level: count, desc: count)
{
#print level;
#print desc;
}
event x509_error(c: connection, err: count)
{
print err;
}
event x509_certificate(c: connection, cert: X509, is_server: bool, chain_idx: count, chain_len: count, der_cert: string) &priority=-5 event x509_certificate(c: connection, cert: X509, is_server: bool, chain_idx: count, chain_len: count, der_cert: string) &priority=-5
{ {
if ( chain_idx == chain_len-1 || chain_len == 1 ) if ( chain_idx == chain_len-1 || chain_len == 1 )
{ {
local result = x509_verify(c$ssl$cert, c$ssl$cert_chain, root_certs); local result = x509_verify(c$ssl$cert, c$ssl$cert_chain, root_certs);
#print fmt("verifying cert... %s", x509_err2str(result));
c$ssl$validation_status = x509_err2str(result); c$ssl$validation_status = x509_err2str(result);
if ( result != 0 ) if ( result != 0 )
{ {
#print c$ssl; local message = fmt("SSL certificate validation failed with (%s)", c$ssl$validation_status);
NOTICE([$note=Invalid_Server_Cert, $msg="validation failed", $conn=c]); NOTICE([$note=Invalid_Server_Cert, $msg=message,
$sub=c$ssl$subject, $conn=c]);
} }
} }
} }