Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-04 23:58:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

and more tiny ssl script fixes

Browse source
This commit is contained in:
Bernhard Amann 2014-05-21 11:12:19 -07:00
parent ff00c0786a
commit 9a8fc7a47d
2 changed files with 5 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

2
scripts/base/protocols/ssl/files.bro
View file

@ -127,7 +127,7 @@ event ssl_established(c: connection) &priority=6
c$ssl$issuer = c$ssl$cert_chain[0]$x509$certificate$issuer; c$ssl$issuer = c$ssl$cert_chain[0]$x509$certificate$issuer;
} }
if ( c$ssl?$client_cert_chain && |c$ssl$client_cert_chain| > 0 && c$ssl$cert_chain[0]?$x509 ) if ( c$ssl?$client_cert_chain && |c$ssl$client_cert_chain| > 0 && c$ssl$client_cert_chain[0]?$x509 )
{ {
c$ssl$client_subject = c$ssl$client_cert_chain[0]$x509$certificate$subject; c$ssl$client_subject = c$ssl$client_cert_chain[0]$x509$certificate$subject;
c$ssl$client_issuer = c$ssl$client_cert_chain[0]$x509$certificate$issuer; c$ssl$client_issuer = c$ssl$client_cert_chain[0]$x509$certificate$issuer;

5
scripts/policy/protocols/ssl/heartbleed.bro
View file

@ -136,7 +136,7 @@ event ssl_encrypted_heartbeat(c: connection, is_orig: bool, length: count)
]); ]);
else if ( duration < 1min ) else if ( duration < 1min )
NOTICE([$note=SSL_Heartbeat_Attack, NOTICE([$note=SSL_Heartbeat_Attack,
$msg=fmt("Heartbeat within first minute. Possible attack or scan. Length: %d, is_orig: %d, time: %d", length, is_orig, duration), $msg=fmt("Heartbeat within first minute. Possible attack or scan. Length: %d, is_orig: %d, time: %s", length, is_orig, duration),
$conn=c, $conn=c,
$n=length, $n=length,
$identifier=fmt("%s%s", c$uid, "early") $identifier=fmt("%s%s", c$uid, "early")
@ -225,6 +225,9 @@ event ssl_encrypted_heartbeat(c: connection, is_orig: bool, length: count)
event ssl_encrypted_data(c: connection, is_orig: bool, content_type: count, length: count) event ssl_encrypted_data(c: connection, is_orig: bool, content_type: count, length: count)
{ {
if ( !c?$ssl )
return;
if ( content_type == SSL::HEARTBEAT ) if ( content_type == SSL::HEARTBEAT )
event ssl_encrypted_heartbeat(c, is_orig, length); event ssl_encrypted_heartbeat(c, is_orig, length);
else if ( (content_type == SSL::APPLICATION_DATA) && (length > 0) ) else if ( (content_type == SSL::APPLICATION_DATA) && (length > 0) )