From 9a8fc7a47d64ced8d9924e16c648c954c5050029 Mon Sep 17 00:00:00 2001 From: Bernhard Amann Date: Wed, 21 May 2014 11:12:19 -0700 Subject: [PATCH] and more tiny ssl script fixes --- scripts/base/protocols/ssl/files.bro | 2 +- scripts/policy/protocols/ssl/heartbleed.bro | 5 ++++- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/scripts/base/protocols/ssl/files.bro b/scripts/base/protocols/ssl/files.bro index ae0957e00f..6e75ffa299 100644 --- a/scripts/base/protocols/ssl/files.bro +++ b/scripts/base/protocols/ssl/files.bro @@ -127,7 +127,7 @@ event ssl_established(c: connection) &priority=6 c$ssl$issuer = c$ssl$cert_chain[0]$x509$certificate$issuer; } - if ( c$ssl?$client_cert_chain && |c$ssl$client_cert_chain| > 0 && c$ssl$cert_chain[0]?$x509 ) + if ( c$ssl?$client_cert_chain && |c$ssl$client_cert_chain| > 0 && c$ssl$client_cert_chain[0]?$x509 ) { c$ssl$client_subject = c$ssl$client_cert_chain[0]$x509$certificate$subject; c$ssl$client_issuer = c$ssl$client_cert_chain[0]$x509$certificate$issuer; diff --git a/scripts/policy/protocols/ssl/heartbleed.bro b/scripts/policy/protocols/ssl/heartbleed.bro index b1dfff867d..77a5e9832a 100644 --- a/scripts/policy/protocols/ssl/heartbleed.bro +++ b/scripts/policy/protocols/ssl/heartbleed.bro @@ -136,7 +136,7 @@ event ssl_encrypted_heartbeat(c: connection, is_orig: bool, length: count) ]); else if ( duration < 1min ) NOTICE([$note=SSL_Heartbeat_Attack, - $msg=fmt("Heartbeat within first minute. Possible attack or scan. Length: %d, is_orig: %d, time: %d", length, is_orig, duration), + $msg=fmt("Heartbeat within first minute. Possible attack or scan. Length: %d, is_orig: %d, time: %s", length, is_orig, duration), $conn=c, $n=length, $identifier=fmt("%s%s", c$uid, "early") @@ -225,6 +225,9 @@ event ssl_encrypted_heartbeat(c: connection, is_orig: bool, length: count) event ssl_encrypted_data(c: connection, is_orig: bool, content_type: count, length: count) { + if ( !c?$ssl ) + return; + if ( content_type == SSL::HEARTBEAT ) event ssl_encrypted_heartbeat(c, is_orig, length); else if ( (content_type == SSL::APPLICATION_DATA) && (length > 0) )