Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-12 19:48:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Second try on the event interface.

Browse source 
Now the x509 opaque is wrapped in the certificate structure. After
pondering on it for a bit, this might not be the brightest idea.
This commit is contained in:
Bernhard Amann 2014-02-28 02:43:16 -08:00
parent 1735e33691
commit 7ba6bcff2c
7 changed files with 40 additions and 62 deletions
Download patch file Download diff file Expand all files Collapse all files

6
scripts/base/files/x509/main.bro
View file

@ -12,17 +12,17 @@ event x509_cert(f: fa_file, cert: X509::Certificate)
print cert;
}
event x509_extension(f: fa_file, ext: X509::Extension)
event x509_extension(f: fa_file, cert: X509::Certificate, ext: X509::Extension)
{
print ext;
}
event x509_ext_basic_constraints(f: fa_file, ext: X509::BasicConstraints)
event x509_ext_basic_constraints(f: fa_file, cert: X509::Certificate, ext: X509::BasicConstraints)
{
print ext;
}
event x509_ext_subject_alternative_name(f: fa_file, ext: X509::SubjectAlternativeName)
event x509_ext_subject_alternative_name(f: fa_file, cert: X509::Certificate, ext: X509::SubjectAlternativeName)
{
print ext;
}

25
scripts/base/init-bare.bro
View file

@ -2420,29 +2420,6 @@ global dns_skip_all_addl = T &redef;
## traffic and do not process it. Set to 0 to turn off this functionality.
global dns_max_queries = 5;
## An X509 certificate.
##
## .. bro:see:: x509_certificate
type X509: record {
version: count; ##< Version number.
serial: string; ##< Serial number.
subject: string; ##< Subject.
issuer: string; ##< Issuer.
not_valid_before: time; ##< Timestamp before when certificate is not valid.
not_valid_after: time; ##< Timestamp after when certificate is not valid.
};
## An X509 extension.
##
## .. bro:see:: x509_extension
type X509_extension_info: record {
name: string; ##< Long name of extension; oid if name not known.
short_name: string &optional; ##< Short name of extension if known.
oid: string; ##< Oid of extension.
critical: bool; ##< True if extension is critical.
value: string; ##< Extension content parsed to string for known extensions. Raw data otherwise.
};
## HTTP session statistics.
##
## .. bro:see:: http_stats
@ -2767,6 +2744,7 @@ export {
module X509;
export {
type X509::Certificate: record {
certificate: opaque of x509; ##< OpenSSL certificate reference
version: count; ##< Version number.
serial: string; ##< Serial number.
subject: string; ##< Subject.
@ -2799,7 +2777,6 @@ export {
type X509::SubjectAlternativeName: record {
names: vector of string;
};
}
module SOCKS;