Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-08 01:28:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Add parsing of signed certificate timestamps out of X.509 certs.

Browse source 
This is a tiny bit evil because it uses parts of the SSL protocol
analyzer in the X.509 certificate parser. Which is the fault of the
protocol, which replicates the functionality.
This commit is contained in:
Johanna Amann 2017-02-07 13:31:21 -08:00
parent a51ee9e155
commit 5dd19f84a7
12 changed files with 140 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

7
testing/btest/scripts/base/files/x509/signed_certificate_timestamp.test Normal file
View file

@ -0,0 +1,7 @@
# @TEST-EXEC: bro -r $TRACES/tls/certificate-with-sct.pcap %INPUT
# @TEST-EXEC: btest-diff .stdout
event x509_ext_signed_certificate_timestamp(f: fa_file, version: count, logid: string, timestamp: time, hash_algorithm: count, signature_algorithm: count, signature: string)
{
print version, timestamp, hash_algorithm, signature_algorithm;
}