Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-05 16:18:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Finish implementation of copy method.

Browse source 
All types (besides EntropyVal) now support a native copy operation,
which uses primitives of the underlying datatypes to perform a quick
copy, without serialization.

EntropyVal is the one exception - since that type is rather complex
(many members) and will probably not be copied a lot, if at all, it
makes sense to just use the serialization function.

This will have to be slightly re-written in the near-term-future to use
the new serialization function for that opaque type.

This change also introduces a new x509_from_der bif, which allows to
parse a der into an opaque of x509.

This change removes the d2i_X509_ wrapper function; this was a remnant
when d2i_X509 took non-const arguments. We directly use d2i_X509 at
several places assuming const-ness, so there does not seem to ba a
reason to keep the wrapper.

This change also exposed a problem in the File cache - cases in which an
object was brought back into the cache, and writing occurred in the
file_open event were never correctly handeled as far as I can tell.
This commit is contained in:
Johanna Amann 2019-05-22 11:36:52 -07:00
parent 2efbe76920
commit 74bb7716f6
22 changed files with 280 additions and 33 deletions
Download patch file Download diff file Expand all files Collapse all files

9
src/file_analysis/analyzer/x509/X509.cc
View file

@ -477,6 +477,15 @@ X509Val::~X509Val()
X509_free(certificate);
}
Val* X509Val::DoClone(CloneState* state)
{
auto copy = new X509Val();
if ( certificate )
copy->certificate = X509_dup(certificate);
return copy;
}
::X509* X509Val::GetCertificate() const
{
return certificate;

9
src/file_analysis/analyzer/x509/X509.h
View file

@ -123,6 +123,15 @@ public:
*/
explicit X509Val(::X509* certificate);
/**
* Clone an X509Val
*
* @param state certifies the state of the clone operation (duplicate tracking)
*
* @return A cloned X509Val.
*/
Val* DoClone(CloneState* state) override;
/**
* Destructor.
*/

29
src/file_analysis/analyzer/x509/functions.bif
View file

@ -13,20 +13,6 @@
// This is the indexed map of X509 certificate stores.
static map<Val*, X509_STORE*> x509_stores;
// ### NOTE: while d2i_X509 does not take a const u_char** pointer,
// here we assume d2i_X509 does not write to <data>, so it is safe to
// convert data to a non-const pointer. Could some X509 guru verify
// this?
X509* d2i_X509_(X509** px, const u_char** in, int len)
{
#ifdef OPENSSL_D2I_X509_USES_CONST_CHAR
return d2i_X509(px, in, len);
#else
return d2i_X509(px, (u_char**)in, len);
#endif
}
// construct an error record
RecordVal* x509_result_record(uint64_t num, const char* reason, Val* chainVector = 0)
{
@ -56,7 +42,7 @@ X509_STORE* x509_get_root_store(TableVal* root_certs)
StringVal *sv = root_certs->Lookup(key)->AsStringVal();
assert(sv);
const uint8* data = sv->Bytes();
X509* x = d2i_X509_(NULL, &data, sv->Len());
X509* x = d2i_X509(NULL, &data, sv->Len());
if ( ! x )
{
builtin_error(fmt("Root CA error: %s", ERR_error_string(ERR_get_error(),NULL)));
@ -203,6 +189,19 @@ function x509_parse%(cert: opaque of x509%): X509::Certificate
return file_analysis::X509::ParseCertificate(h);
%}
## Constructs an opaque of X509 from a der-formatted string.
##
## Note: this function is mostly meant for testing purposes
##
## .. zeek:see:: x509_certificate x509_extension x509_ext_basic_constraints
## x509_ext_subject_alternative_name x509_verify
## x509_get_certificate_string x509_parse
function x509_from_der%(der: string%): opaque of x509
%{
const u_char* data = der->Bytes();
return new file_analysis::X509Val(d2i_X509(nullptr, &data, der->Len()));
%}
## Returns the string form of a certificate.
##
## cert: The X509 certificate opaque handle.