Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-08 01:28:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Revert change to only log certificates once per hour.

Browse source 
addresses BIT-953, BIT-760, BIT-1150
This commit is contained in:
Bernhard Amann 2014-03-13 13:38:44 -07:00
parent b0c3486fd6
commit 74d728656d
2 changed files with 18 additions and 50 deletions
Download patch file Download diff file Expand all files Collapse all files

36
scripts/base/protocols/ssl/files.bro
View file

@ -11,17 +11,17 @@ export {
## complete signing chain.
cert_chain: vector of Files::Info &optional;
## An ordered vector of all certicate sha1 hashes for the
## An ordered vector of all certicate file unique IDs for the
## certificates offered by the server.
cert_chain_sha1s: vector of string &optional &log;
cert_chain_fuids: vector of string &optional &log;
## Chain of certificates offered by the client to validate its
## complete signing chain.
client_cert_chain: vector of Files::Info &optional;
## An ordered vector of all certicate sha1 hashes for the
## An ordered vector of all certicate file unique IDs for the
## certificates offered by the client.
client_cert_chain_sha1s: vector of string &optional &log;
client_cert_chain_fuids: vector of string &optional &log;
## Subject of the X.509 certificate offered by the server.
subject: string &log &optional;
@ -107,22 +107,31 @@ event file_over_new_connection(f: fa_file, c: connection, is_orig: bool) &priori
{
c$ssl$cert_chain = vector();
c$ssl$client_cert_chain = vector();
c$ssl$cert_chain_fuids = string_vec();
c$ssl$client_cert_chain_fuids = string_vec();
}
if ( is_orig )
{
c$ssl$client_cert_chain[|c$ssl$client_cert_chain|] = f$info;
c$ssl$client_cert_chain_fuids[|c$ssl$client_cert_chain_fuids|] = f$id;
}
else
{
c$ssl$cert_chain[|c$ssl$cert_chain|] = f$info;
c$ssl$cert_chain_fuids[|c$ssl$cert_chain_fuids|] = f$id;
}
Files::add_analyzer(f, Files::ANALYZER_X509);
# always calculate hashes. SHA1 is always required for certificates.
# always calculate hashes. They are not necessary for base scripts
# but very useful for identification, and required for policy scripts
Files::add_analyzer(f, Files::ANALYZER_MD5);
Files::add_analyzer(f, Files::ANALYZER_SHA1);
}
event ssl_established(c: connection) &priority=6
{
# update subject and issuer information as well as sha1 hashes
# update subject and issuer information
if ( c$ssl?$cert_chain && |c$ssl$cert_chain| > 0 )
{
c$ssl$subject = c$ssl$cert_chain[0]$x509$certificate$subject;
@ -134,19 +143,4 @@ event ssl_established(c: connection) &priority=6
c$ssl$client_subject = c$ssl$client_cert_chain[0]$x509$certificate$subject;
c$ssl$client_issuer = c$ssl$client_cert_chain[0]$x509$certificate$issuer;
}
if ( c$ssl?$cert_chain )
{
c$ssl$cert_chain_sha1s = string_vec();
for ( i in c$ssl$cert_chain )
c$ssl$cert_chain_sha1s[i] = c$ssl$cert_chain[i]$x509$sha1;
}
if ( c$ssl?$client_cert_chain )
{
c$ssl$client_cert_chain_sha1s = string_vec();
for ( i in c$ssl$client_cert_chain )
c$ssl$client_cert_chain_sha1s[i] = c$ssl$client_cert_chain[i]$x509$sha1;
}
}