mirror of
https://github.com/zeek/zeek.git
synced 2025-10-12 03:28:19 +00:00
Merge remote-tracking branch 'origin/topic/johanna/xmpp-starttls'
* origin/topic/johanna/xmpp-starttls: XMPP: Add StartTLS event and update tests Add xmpp dpd sig and fix a few parsing problems for connections that do not upgrade to TLS. Add simple XMPP StartTLS analyzer. BIT-1579 #merged
This commit is contained in:
Robin Sommer
commit
abebd036bc
30 changed files with 410 additions and 19 deletions
8
NEWS
8
NEWS
|
|
@ -33,10 +33,10 @@ New Functionality
|
|||
|
||||
- Bro now supports the Radiotap header for 802.11 frames.
|
||||
|
||||
- Bro now has a rudimentary IMAP analyzer examinig the initial phase
|
||||
of the protocol. Right now the analyzer only identify STARTTLS
|
||||
sessions, handing them over to TLS analysis. The analyzer does not
|
||||
yet analyze any further IMAP content.
|
||||
- Bro now has rudimentary IMAP and XMPP analyzers examinig the initial
|
||||
phases of the protocol. Right now these analyzer only identify
|
||||
STARTTLS sessions, handing them over to TLS analysis. The analyzer
|
||||
does not yet analyze any further IMAP/XMPP content.
|
||||
|
||||
- Bro now tracks VLAN IDs. To record them inside the connection log,
|
||||
load protocols/conn/vlan-logging.bro.
|
||||
|
|
|
|||
|
|
@ -1 +1 @@
|
|||
Subproject commit edbbe445d92cc6a5c2557661195f486b784769db
|
||||
Subproject commit 4179f9f00f4df21e4bcfece0323ec3468f688e8a
|
||||
|
|
@ -65,6 +65,7 @@
|
|||
@load base/protocols/ssl
|
||||
@load base/protocols/syslog
|
||||
@load base/protocols/tunnels
|
||||
@load base/protocols/xmpp
|
||||
|
||||
@load base/files/pe
|
||||
@load base/files/hash
|
||||
|
|
|
|||
5
scripts/base/protocols/xmpp/README
Normal file
5
scripts/base/protocols/xmpp/README
Normal file
|
|
@ -0,0 +1,5 @@
|
|||
Support for the Extensible Messaging and Presence Protocol (XMPP).
|
||||
|
||||
Note that currently the XMPP analyzer only supports analyzing XMPP sessions
|
||||
until they do or do not switch to TLS using StartTLS. Hence, we do not get
|
||||
actual chat information from XMPP sessions, only X509 certificates.
|
||||
3
scripts/base/protocols/xmpp/__load__.bro
Normal file
3
scripts/base/protocols/xmpp/__load__.bro
Normal file
|
|
@ -0,0 +1,3 @@
|
|||
@load ./main
|
||||
|
||||
@load-sigs ./dpd.sig
|
||||
5
scripts/base/protocols/xmpp/dpd.sig
Normal file
5
scripts/base/protocols/xmpp/dpd.sig
Normal file
|
|
@ -0,0 +1,5 @@
|
|||
signature dpd_xmpp {
|
||||
ip-proto == tcp
|
||||
payload /^(<\?xml[^?>]*\?>)?[\n\r ]*<stream:stream [^>]*xmlns='jabber:/
|
||||
enable "xmpp"
|
||||
}
|
||||
11
scripts/base/protocols/xmpp/main.bro
Normal file
11
scripts/base/protocols/xmpp/main.bro
Normal file
|
|
@ -0,0 +1,11 @@
|
|||
|
||||
module XMPP;
|
||||
|
||||
const ports = { 5222/tcp, 5269/tcp };
|
||||
redef likely_server_ports += { ports };
|
||||
|
||||
event bro_init() &priority=5
|
||||
{
|
||||
Analyzer::register_for_ports(Analyzer::ANALYZER_XMPP, ports);
|
||||
}
|
||||
|
||||
|
|
@ -45,4 +45,5 @@ add_subdirectory(syslog)
|
|||
add_subdirectory(tcp)
|
||||
add_subdirectory(teredo)
|
||||
add_subdirectory(udp)
|
||||
add_subdirectory(xmpp)
|
||||
add_subdirectory(zip)
|
||||
|
|
|
|||
12
src/analyzer/protocol/xmpp/CMakeLists.txt
Normal file
12
src/analyzer/protocol/xmpp/CMakeLists.txt
Normal file
|
|
@ -0,0 +1,12 @@
|
|||
|
||||
include(BroPlugin)
|
||||
|
||||
include_directories(BEFORE ${CMAKE_CURRENT_SOURCE_DIR} ${CMAKE_CURRENT_BINARY_DIR})
|
||||
|
||||
bro_plugin_begin(Bro XMPP)
|
||||
bro_plugin_cc(Plugin.cc)
|
||||
bro_plugin_cc(XMPP.cc)
|
||||
bro_plugin_bif(events.bif)
|
||||
bro_plugin_pac(xmpp.pac xmpp-analyzer.pac xmpp-protocol.pac)
|
||||
bro_plugin_end()
|
||||
|
||||
23
src/analyzer/protocol/xmpp/Plugin.cc
Normal file
23
src/analyzer/protocol/xmpp/Plugin.cc
Normal file
|
|
@ -0,0 +1,23 @@
|
|||
// See the file in the main distribution directory for copyright.
|
||||
#include "plugin/Plugin.h"
|
||||
|
||||
#include "XMPP.h"
|
||||
|
||||
namespace plugin {
|
||||
namespace Bro_XMPP {
|
||||
|
||||
class Plugin : public plugin::Plugin {
|
||||
public:
|
||||
plugin::Configuration Configure()
|
||||
{
|
||||
AddComponent(new ::analyzer::Component("XMPP", ::analyzer::xmpp::XMPP_Analyzer::Instantiate));
|
||||
|
||||
plugin::Configuration config;
|
||||
config.name = "Bro::XMPP";
|
||||
config.description = "XMPP analyzer (StartTLS only)";
|
||||
return config;
|
||||
}
|
||||
} plugin;
|
||||
|
||||
}
|
||||
}
|
||||
85
src/analyzer/protocol/xmpp/XMPP.cc
Normal file
85
src/analyzer/protocol/xmpp/XMPP.cc
Normal file
|
|
@ -0,0 +1,85 @@
|
|||
// See the file "COPYING" in the main distribution directory for copyright.
|
||||
|
||||
#include "XMPP.h"
|
||||
#include "analyzer/protocol/tcp/TCP_Reassembler.h"
|
||||
#include "analyzer/Manager.h"
|
||||
|
||||
using namespace analyzer::xmpp;
|
||||
|
||||
XMPP_Analyzer::XMPP_Analyzer(Connection* conn)
|
||||
: tcp::TCP_ApplicationAnalyzer("XMPP", conn)
|
||||
{
|
||||
interp = unique_ptr<binpac::XMPP::XMPP_Conn>(new binpac::XMPP::XMPP_Conn(this));
|
||||
had_gap = false;
|
||||
tls_active = false;
|
||||
}
|
||||
|
||||
XMPP_Analyzer::~XMPP_Analyzer()
|
||||
{
|
||||
}
|
||||
|
||||
void XMPP_Analyzer::Done()
|
||||
{
|
||||
tcp::TCP_ApplicationAnalyzer::Done();
|
||||
|
||||
interp->FlowEOF(true);
|
||||
interp->FlowEOF(false);
|
||||
}
|
||||
|
||||
void XMPP_Analyzer::EndpointEOF(bool is_orig)
|
||||
{
|
||||
tcp::TCP_ApplicationAnalyzer::EndpointEOF(is_orig);
|
||||
interp->FlowEOF(is_orig);
|
||||
}
|
||||
|
||||
void XMPP_Analyzer::DeliverStream(int len, const u_char* data, bool orig)
|
||||
{
|
||||
tcp::TCP_ApplicationAnalyzer::DeliverStream(len, data, orig);
|
||||
|
||||
if ( tls_active )
|
||||
{
|
||||
// If TLS has been initiated, forward to child and abort further
|
||||
// processing
|
||||
ForwardStream(len, data, orig);
|
||||
return;
|
||||
}
|
||||
|
||||
assert(TCP());
|
||||
if ( TCP()->IsPartial() )
|
||||
return;
|
||||
|
||||
if ( had_gap )
|
||||
// If only one side had a content gap, we could still try to
|
||||
// deliver data to the other side if the script layer can
|
||||
// handle this.
|
||||
return;
|
||||
|
||||
try
|
||||
{
|
||||
interp->NewData(orig, data, data + len);
|
||||
}
|
||||
catch ( const binpac::Exception& e )
|
||||
{
|
||||
ProtocolViolation(fmt("Binpac exception: %s", e.c_msg()));
|
||||
}
|
||||
}
|
||||
|
||||
void XMPP_Analyzer::Undelivered(uint64 seq, int len, bool orig)
|
||||
{
|
||||
tcp::TCP_ApplicationAnalyzer::Undelivered(seq, len, orig);
|
||||
had_gap = true;
|
||||
interp->NewGap(orig, len);
|
||||
}
|
||||
|
||||
void XMPP_Analyzer::StartTLS()
|
||||
{
|
||||
// StartTLS was called. This means we saw a client starttls followed
|
||||
// by a server proceed. From here on, everything should be a binary
|
||||
// TLS datastream.
|
||||
|
||||
tls_active = true;
|
||||
|
||||
Analyzer* ssl = analyzer_mgr->InstantiateAnalyzer("SSL", Conn());
|
||||
if ( ssl )
|
||||
AddChildAnalyzer(ssl);
|
||||
}
|
||||
38
src/analyzer/protocol/xmpp/XMPP.h
Normal file
38
src/analyzer/protocol/xmpp/XMPP.h
Normal file
|
|
@ -0,0 +1,38 @@
|
|||
// See the file "COPYING" in the main distribution directory for copyright.
|
||||
|
||||
#ifndef ANALYZER_PROTOCOL_XMPP_XMPP_H
|
||||
#define ANALYZER_PROTOCOL_XMPP_XMPP_H
|
||||
|
||||
#include "analyzer/protocol/tcp/TCP.h"
|
||||
|
||||
#include "xmpp_pac.h"
|
||||
|
||||
namespace analyzer { namespace xmpp {
|
||||
|
||||
class XMPP_Analyzer : public tcp::TCP_ApplicationAnalyzer {
|
||||
public:
|
||||
XMPP_Analyzer(Connection* conn);
|
||||
virtual ~XMPP_Analyzer();
|
||||
|
||||
void Done() override;
|
||||
void DeliverStream(int len, const u_char* data, bool orig) override;
|
||||
void Undelivered(uint64 seq, int len, bool orig) override;
|
||||
|
||||
// Overriden from tcp::TCP_ApplicationAnalyzer.
|
||||
void EndpointEOF(bool is_orig) override;
|
||||
|
||||
void StartTLS();
|
||||
|
||||
static analyzer::Analyzer* Instantiate(Connection* conn)
|
||||
{ return new XMPP_Analyzer(conn); }
|
||||
|
||||
protected:
|
||||
std::unique_ptr<binpac::XMPP::XMPP_Conn> interp;
|
||||
bool had_gap;
|
||||
|
||||
bool tls_active;
|
||||
};
|
||||
|
||||
} } // namespace analyzer::*
|
||||
|
||||
#endif /* ANALYZER_PROTOCOL_XMPP_XMPP_H */
|
||||
5
src/analyzer/protocol/xmpp/events.bif
Normal file
5
src/analyzer/protocol/xmpp/events.bif
Normal file
|
|
@ -0,0 +1,5 @@
|
|||
## Generated when a XMPP connection goes encrypted after a successful
|
||||
## StartTLS exchange between the client and the server.
|
||||
##
|
||||
## c: The connection.
|
||||
event xmpp_starttls%(c: connection%);
|
||||
45
src/analyzer/protocol/xmpp/xmpp-analyzer.pac
Normal file
45
src/analyzer/protocol/xmpp/xmpp-analyzer.pac
Normal file
|
|
@ -0,0 +1,45 @@
|
|||
refine connection XMPP_Conn += {
|
||||
|
||||
%member{
|
||||
bool client_starttls;
|
||||
%}
|
||||
|
||||
%init{
|
||||
client_starttls = false;
|
||||
%}
|
||||
|
||||
function proc_xmpp_token(is_orig: bool, name: bytestring, rest: bytestring): bool
|
||||
%{
|
||||
string token = std_str(name);
|
||||
|
||||
if ( is_orig && token == "stream:stream" )
|
||||
// Yup, looks like xmpp...
|
||||
bro_analyzer()->ProtocolConfirmation();
|
||||
|
||||
if ( token == "success" || token == "message" || token == "db:result"
|
||||
|| token == "db:verify" || token == "presence" )
|
||||
// Handshake has passed the phase where we should see StartTLS. Simply skip from hereon...
|
||||
bro_analyzer()->SetSkip(true);
|
||||
|
||||
if ( is_orig && token == "starttls" )
|
||||
client_starttls = true;
|
||||
|
||||
if ( !is_orig && token == "proceed" && client_starttls )
|
||||
{
|
||||
bro_analyzer()->StartTLS();
|
||||
BifEvent::generate_xmpp_starttls(bro_analyzer(), bro_analyzer()->Conn());
|
||||
}
|
||||
else if ( !is_orig && token == "proceed" )
|
||||
reporter->Weird(bro_analyzer()->Conn(), "XMPP: proceed without starttls");
|
||||
|
||||
//printf("Processed: %d %s %s \n", is_orig, c_str(name), c_str(rest));
|
||||
|
||||
return true;
|
||||
%}
|
||||
|
||||
};
|
||||
|
||||
refine typeattr XMPP_TOKEN += &let {
|
||||
proc: bool = $context.connection.proc_xmpp_token(is_orig, name, rest);
|
||||
};
|
||||
|
||||
18
src/analyzer/protocol/xmpp/xmpp-protocol.pac
Normal file
18
src/analyzer/protocol/xmpp/xmpp-protocol.pac
Normal file
|
|
@ -0,0 +1,18 @@
|
|||
type XML_START = RE/</;
|
||||
type XML_END = RE/>/;
|
||||
type XML_NAME = RE/\/?[?:[:alnum:]]+/;
|
||||
type XML_REST = RE/[^<>]*/;
|
||||
type SPACING = RE/[ \r\n]*/;
|
||||
type CONTENT = RE/[^<>]*/;
|
||||
|
||||
type XMPP_PDU(is_orig: bool) = XMPP_TOKEN(is_orig)[] &until($input.length() == 0);
|
||||
|
||||
type XMPP_TOKEN(is_orig: bool) = record {
|
||||
: SPACING;
|
||||
: XML_START;
|
||||
name: XML_NAME;
|
||||
rest: XML_REST;
|
||||
: XML_END;
|
||||
tagcontent: CONTENT;
|
||||
};
|
||||
|
||||
38
src/analyzer/protocol/xmpp/xmpp.pac
Normal file
38
src/analyzer/protocol/xmpp/xmpp.pac
Normal file
|
|
@ -0,0 +1,38 @@
|
|||
# binpac file for the XMPP analyzer.
|
||||
# Note that we currently do not even try to parse the protocol
|
||||
# completely -- this is only supposed to be able to parse xmpp
|
||||
# till StartTLS does (or does not) kick in.
|
||||
|
||||
%include binpac.pac
|
||||
%include bro.pac
|
||||
|
||||
|
||||
%extern{
|
||||
#include "events.bif.h"
|
||||
|
||||
namespace analyzer { namespace xmpp { class XMPP_Analyzer; } }
|
||||
namespace binpac { namespace XMPP { class XMPP_Conn; } }
|
||||
typedef analyzer::xmpp::XMPP_Analyzer* XMPPAnalyzer;
|
||||
|
||||
#include "XMPP.h"
|
||||
%}
|
||||
|
||||
extern type XMPPAnalyzer;
|
||||
|
||||
analyzer XMPP withcontext {
|
||||
connection: XMPP_Conn;
|
||||
flow: XMPP_Flow;
|
||||
};
|
||||
|
||||
connection XMPP_Conn(bro_analyzer: XMPPAnalyzer) {
|
||||
upflow = XMPP_Flow(true);
|
||||
downflow = XMPP_Flow(false);
|
||||
};
|
||||
|
||||
%include xmpp-protocol.pac
|
||||
|
||||
flow XMPP_Flow(is_orig: bool) {
|
||||
datagram = XMPP_PDU(is_orig) withcontext(connection, this);
|
||||
};
|
||||
|
||||
%include xmpp-analyzer.pac
|
||||
|
|
@ -21,7 +21,9 @@
|
|||
1 5060
|
||||
1 5072
|
||||
1 514
|
||||
1 5222
|
||||
1 5223
|
||||
1 5269
|
||||
2 53
|
||||
1 5353
|
||||
1 5355
|
||||
|
|
@ -48,8 +50,8 @@
|
|||
1 992
|
||||
1 993
|
||||
1 995
|
||||
55 and
|
||||
54 or
|
||||
55 port
|
||||
37 tcp
|
||||
57 and
|
||||
56 or
|
||||
57 port
|
||||
39 tcp
|
||||
18 udp
|
||||
|
|
|
|||
|
|
@ -3,7 +3,7 @@
|
|||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path loaded_scripts
|
||||
#open 2016-04-26-18-11-39
|
||||
#open 2016-04-29-20-49-16
|
||||
#fields name
|
||||
#types string
|
||||
scripts/base/init-bare.bro
|
||||
|
|
@ -111,6 +111,7 @@ scripts/base/init-bare.bro
|
|||
build/scripts/base/bif/plugins/Bro_TCP.functions.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_Teredo.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_UDP.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_XMPP.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_ZIP.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_FileEntropy.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_FileExtract.events.bif.bro
|
||||
|
|
@ -132,4 +133,4 @@ scripts/base/init-bare.bro
|
|||
build/scripts/base/bif/plugins/Bro_SQLiteWriter.sqlite.bif.bro
|
||||
scripts/policy/misc/loaded-scripts.bro
|
||||
scripts/base/utils/paths.bro
|
||||
#close 2016-04-26-18-11-39
|
||||
#close 2016-04-29-20-49-16
|
||||
|
|
|
|||
|
|
@ -3,7 +3,7 @@
|
|||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path loaded_scripts
|
||||
#open 2016-04-26-18-11-49
|
||||
#open 2016-04-29-20-49-25
|
||||
#fields name
|
||||
#types string
|
||||
scripts/base/init-bare.bro
|
||||
|
|
@ -111,6 +111,7 @@ scripts/base/init-bare.bro
|
|||
build/scripts/base/bif/plugins/Bro_TCP.functions.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_Teredo.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_UDP.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_XMPP.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_ZIP.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_FileEntropy.events.bif.bro
|
||||
build/scripts/base/bif/plugins/Bro_FileExtract.events.bif.bro
|
||||
|
|
@ -295,6 +296,8 @@ scripts/base/init-default.bro
|
|||
scripts/base/protocols/syslog/consts.bro
|
||||
scripts/base/protocols/syslog/main.bro
|
||||
scripts/base/protocols/tunnels/__load__.bro
|
||||
scripts/base/protocols/xmpp/__load__.bro
|
||||
scripts/base/protocols/xmpp/main.bro
|
||||
scripts/base/files/pe/__load__.bro
|
||||
scripts/base/files/pe/consts.bro
|
||||
scripts/base/files/pe/main.bro
|
||||
|
|
@ -305,4 +308,4 @@ scripts/base/init-default.bro
|
|||
scripts/base/misc/find-checksum-offloading.bro
|
||||
scripts/base/misc/find-filtered-trace.bro
|
||||
scripts/policy/misc/loaded-scripts.bro
|
||||
#close 2016-04-26-18-11-49
|
||||
#close 2016-04-29-20-49-25
|
||||
|
|
|
|||
|
|
@ -57,6 +57,8 @@
|
|||
0.000000 MetaHookPost CallFunction(Analyzer::__register_for_port, <frame>, (Analyzer::ANALYZER_SSL, 995/tcp)) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Analyzer::__register_for_port, <frame>, (Analyzer::ANALYZER_SYSLOG, 514/udp)) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Analyzer::__register_for_port, <frame>, (Analyzer::ANALYZER_TEREDO, 3544/udp)) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Analyzer::__register_for_port, <frame>, (Analyzer::ANALYZER_XMPP, 5222/tcp)) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Analyzer::__register_for_port, <frame>, (Analyzer::ANALYZER_XMPP, 5269/tcp)) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Analyzer::disable_analyzer, <frame>, (Analyzer::ANALYZER_BACKDOOR)) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Analyzer::disable_analyzer, <frame>, (Analyzer::ANALYZER_INTERCONN)) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Analyzer::disable_analyzer, <frame>, (Analyzer::ANALYZER_STEPPINGSTONE)) -> <no result>
|
||||
|
|
@ -116,6 +118,8 @@
|
|||
0.000000 MetaHookPost CallFunction(Analyzer::register_for_port, <frame>, (Analyzer::ANALYZER_SSL, 995/tcp)) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Analyzer::register_for_port, <frame>, (Analyzer::ANALYZER_SYSLOG, 514/udp)) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Analyzer::register_for_port, <frame>, (Analyzer::ANALYZER_TEREDO, 3544/udp)) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Analyzer::register_for_port, <frame>, (Analyzer::ANALYZER_XMPP, 5222/tcp)) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Analyzer::register_for_port, <frame>, (Analyzer::ANALYZER_XMPP, 5269/tcp)) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Analyzer::register_for_ports, <frame>, (Analyzer::ANALYZER_AYIYA, {5072/udp})) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Analyzer::register_for_ports, <frame>, (Analyzer::ANALYZER_DHCP, {67<...>/udp})) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Analyzer::register_for_ports, <frame>, (Analyzer::ANALYZER_DNP3_TCP, {20000<...>/tcp})) -> <no result>
|
||||
|
|
@ -140,6 +144,7 @@
|
|||
0.000000 MetaHookPost CallFunction(Analyzer::register_for_ports, <frame>, (Analyzer::ANALYZER_SSL, {5223<...>/tcp})) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Analyzer::register_for_ports, <frame>, (Analyzer::ANALYZER_SYSLOG, {514/udp})) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Analyzer::register_for_ports, <frame>, (Analyzer::ANALYZER_TEREDO, {3544/udp})) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Analyzer::register_for_ports, <frame>, (Analyzer::ANALYZER_XMPP, {5222<...>/tcp})) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Cluster::is_enabled, <frame>, ()) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Cluster::is_enabled, <null>, ()) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Files::register_analyzer_add_callback, <frame>, (Files::ANALYZER_EXTRACT, FileExtract::on_add{ if (!FileExtract::args?$extract_filename) FileExtract::args$extract_filename = cat(extract-, FileExtract::f$last_active, -, FileExtract::f$source, -, FileExtract::f$id)FileExtract::f$info$extracted = FileExtract::args$extract_filenameFileExtract::args$extract_filename = build_path_compressed(FileExtract::prefix, FileExtract::args$extract_filename)mkdir(FileExtract::prefix)})) -> <no result>
|
||||
|
|
@ -233,7 +238,7 @@
|
|||
0.000000 MetaHookPost CallFunction(Log::__create_stream, <frame>, (Weird::LOG, [columns=<no value description>, ev=Weird::log_weird, path=weird])) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Log::__create_stream, <frame>, (X509::LOG, [columns=<no value description>, ev=X509::log_x509, path=x509])) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Log::__create_stream, <frame>, (mysql::LOG, [columns=<no value description>, ev=MySQL::log_mysql, path=mysql])) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Log::__write, <frame>, (PacketFilter::LOG, [ts=1461868125.285894, node=bro, filter=ip or not ip, init=T, success=T])) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Log::__write, <frame>, (PacketFilter::LOG, [ts=1461962978.799805, node=bro, filter=ip or not ip, init=T, success=T])) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Log::add_default_filter, <frame>, (Cluster::LOG)) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Log::add_default_filter, <frame>, (Communication::LOG)) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Log::add_default_filter, <frame>, (Conn::LOG)) -> <no result>
|
||||
|
|
@ -354,7 +359,7 @@
|
|||
0.000000 MetaHookPost CallFunction(Log::create_stream, <frame>, (Weird::LOG, [columns=<no value description>, ev=Weird::log_weird, path=weird])) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Log::create_stream, <frame>, (X509::LOG, [columns=<no value description>, ev=X509::log_x509, path=x509])) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Log::create_stream, <frame>, (mysql::LOG, [columns=<no value description>, ev=MySQL::log_mysql, path=mysql])) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Log::write, <frame>, (PacketFilter::LOG, [ts=1461868125.285894, node=bro, filter=ip or not ip, init=T, success=T])) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Log::write, <frame>, (PacketFilter::LOG, [ts=1461962978.799805, node=bro, filter=ip or not ip, init=T, success=T])) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(NetControl::check_plugins, <frame>, ()) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(NetControl::init, <null>, ()) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Notice::want_pp, <frame>, ()) -> <no result>
|
||||
|
|
@ -467,6 +472,7 @@
|
|||
0.000000 MetaHookPost LoadFile(./Bro_X509.events.bif.bro) -> -1
|
||||
0.000000 MetaHookPost LoadFile(./Bro_X509.functions.bif.bro) -> -1
|
||||
0.000000 MetaHookPost LoadFile(./Bro_X509.types.bif.bro) -> -1
|
||||
0.000000 MetaHookPost LoadFile(./Bro_XMPP.events.bif.bro) -> -1
|
||||
0.000000 MetaHookPost LoadFile(./Bro_ZIP.events.bif.bro) -> -1
|
||||
0.000000 MetaHookPost LoadFile(./acld) -> -1
|
||||
0.000000 MetaHookPost LoadFile(./addrs) -> -1
|
||||
|
|
@ -644,6 +650,7 @@
|
|||
0.000000 MetaHookPost LoadFile(base<...>/urls) -> -1
|
||||
0.000000 MetaHookPost LoadFile(base<...>/utils) -> -1
|
||||
0.000000 MetaHookPost LoadFile(base<...>/x509) -> -1
|
||||
0.000000 MetaHookPost LoadFile(base<...>/xmpp) -> -1
|
||||
0.000000 MetaHookPost QueueEvent(NetControl::init()) -> false
|
||||
0.000000 MetaHookPost QueueEvent(bro_init()) -> false
|
||||
0.000000 MetaHookPost QueueEvent(filter_change_tracking()) -> false
|
||||
|
|
@ -706,6 +713,8 @@
|
|||
0.000000 MetaHookPre CallFunction(Analyzer::__register_for_port, <frame>, (Analyzer::ANALYZER_SSL, 995/tcp))
|
||||
0.000000 MetaHookPre CallFunction(Analyzer::__register_for_port, <frame>, (Analyzer::ANALYZER_SYSLOG, 514/udp))
|
||||
0.000000 MetaHookPre CallFunction(Analyzer::__register_for_port, <frame>, (Analyzer::ANALYZER_TEREDO, 3544/udp))
|
||||
0.000000 MetaHookPre CallFunction(Analyzer::__register_for_port, <frame>, (Analyzer::ANALYZER_XMPP, 5222/tcp))
|
||||
0.000000 MetaHookPre CallFunction(Analyzer::__register_for_port, <frame>, (Analyzer::ANALYZER_XMPP, 5269/tcp))
|
||||
0.000000 MetaHookPre CallFunction(Analyzer::disable_analyzer, <frame>, (Analyzer::ANALYZER_BACKDOOR))
|
||||
0.000000 MetaHookPre CallFunction(Analyzer::disable_analyzer, <frame>, (Analyzer::ANALYZER_INTERCONN))
|
||||
0.000000 MetaHookPre CallFunction(Analyzer::disable_analyzer, <frame>, (Analyzer::ANALYZER_STEPPINGSTONE))
|
||||
|
|
@ -765,6 +774,8 @@
|
|||
0.000000 MetaHookPre CallFunction(Analyzer::register_for_port, <frame>, (Analyzer::ANALYZER_SSL, 995/tcp))
|
||||
0.000000 MetaHookPre CallFunction(Analyzer::register_for_port, <frame>, (Analyzer::ANALYZER_SYSLOG, 514/udp))
|
||||
0.000000 MetaHookPre CallFunction(Analyzer::register_for_port, <frame>, (Analyzer::ANALYZER_TEREDO, 3544/udp))
|
||||
0.000000 MetaHookPre CallFunction(Analyzer::register_for_port, <frame>, (Analyzer::ANALYZER_XMPP, 5222/tcp))
|
||||
0.000000 MetaHookPre CallFunction(Analyzer::register_for_port, <frame>, (Analyzer::ANALYZER_XMPP, 5269/tcp))
|
||||
0.000000 MetaHookPre CallFunction(Analyzer::register_for_ports, <frame>, (Analyzer::ANALYZER_AYIYA, {5072/udp}))
|
||||
0.000000 MetaHookPre CallFunction(Analyzer::register_for_ports, <frame>, (Analyzer::ANALYZER_DHCP, {67<...>/udp}))
|
||||
0.000000 MetaHookPre CallFunction(Analyzer::register_for_ports, <frame>, (Analyzer::ANALYZER_DNP3_TCP, {20000<...>/tcp}))
|
||||
|
|
@ -789,6 +800,7 @@
|
|||
0.000000 MetaHookPre CallFunction(Analyzer::register_for_ports, <frame>, (Analyzer::ANALYZER_SSL, {5223<...>/tcp}))
|
||||
0.000000 MetaHookPre CallFunction(Analyzer::register_for_ports, <frame>, (Analyzer::ANALYZER_SYSLOG, {514/udp}))
|
||||
0.000000 MetaHookPre CallFunction(Analyzer::register_for_ports, <frame>, (Analyzer::ANALYZER_TEREDO, {3544/udp}))
|
||||
0.000000 MetaHookPre CallFunction(Analyzer::register_for_ports, <frame>, (Analyzer::ANALYZER_XMPP, {5222<...>/tcp}))
|
||||
0.000000 MetaHookPre CallFunction(Cluster::is_enabled, <frame>, ())
|
||||
0.000000 MetaHookPre CallFunction(Cluster::is_enabled, <null>, ())
|
||||
0.000000 MetaHookPre CallFunction(Files::register_analyzer_add_callback, <frame>, (Files::ANALYZER_EXTRACT, FileExtract::on_add{ if (!FileExtract::args?$extract_filename) FileExtract::args$extract_filename = cat(extract-, FileExtract::f$last_active, -, FileExtract::f$source, -, FileExtract::f$id)FileExtract::f$info$extracted = FileExtract::args$extract_filenameFileExtract::args$extract_filename = build_path_compressed(FileExtract::prefix, FileExtract::args$extract_filename)mkdir(FileExtract::prefix)}))
|
||||
|
|
@ -882,7 +894,7 @@
|
|||
0.000000 MetaHookPre CallFunction(Log::__create_stream, <frame>, (Weird::LOG, [columns=<no value description>, ev=Weird::log_weird, path=weird]))
|
||||
0.000000 MetaHookPre CallFunction(Log::__create_stream, <frame>, (X509::LOG, [columns=<no value description>, ev=X509::log_x509, path=x509]))
|
||||
0.000000 MetaHookPre CallFunction(Log::__create_stream, <frame>, (mysql::LOG, [columns=<no value description>, ev=MySQL::log_mysql, path=mysql]))
|
||||
0.000000 MetaHookPre CallFunction(Log::__write, <frame>, (PacketFilter::LOG, [ts=1461868125.285894, node=bro, filter=ip or not ip, init=T, success=T]))
|
||||
0.000000 MetaHookPre CallFunction(Log::__write, <frame>, (PacketFilter::LOG, [ts=1461962978.799805, node=bro, filter=ip or not ip, init=T, success=T]))
|
||||
0.000000 MetaHookPre CallFunction(Log::add_default_filter, <frame>, (Cluster::LOG))
|
||||
0.000000 MetaHookPre CallFunction(Log::add_default_filter, <frame>, (Communication::LOG))
|
||||
0.000000 MetaHookPre CallFunction(Log::add_default_filter, <frame>, (Conn::LOG))
|
||||
|
|
@ -1003,7 +1015,7 @@
|
|||
0.000000 MetaHookPre CallFunction(Log::create_stream, <frame>, (Weird::LOG, [columns=<no value description>, ev=Weird::log_weird, path=weird]))
|
||||
0.000000 MetaHookPre CallFunction(Log::create_stream, <frame>, (X509::LOG, [columns=<no value description>, ev=X509::log_x509, path=x509]))
|
||||
0.000000 MetaHookPre CallFunction(Log::create_stream, <frame>, (mysql::LOG, [columns=<no value description>, ev=MySQL::log_mysql, path=mysql]))
|
||||
0.000000 MetaHookPre CallFunction(Log::write, <frame>, (PacketFilter::LOG, [ts=1461868125.285894, node=bro, filter=ip or not ip, init=T, success=T]))
|
||||
0.000000 MetaHookPre CallFunction(Log::write, <frame>, (PacketFilter::LOG, [ts=1461962978.799805, node=bro, filter=ip or not ip, init=T, success=T]))
|
||||
0.000000 MetaHookPre CallFunction(NetControl::check_plugins, <frame>, ())
|
||||
0.000000 MetaHookPre CallFunction(NetControl::init, <null>, ())
|
||||
0.000000 MetaHookPre CallFunction(Notice::want_pp, <frame>, ())
|
||||
|
|
@ -1116,6 +1128,7 @@
|
|||
0.000000 MetaHookPre LoadFile(./Bro_X509.events.bif.bro)
|
||||
0.000000 MetaHookPre LoadFile(./Bro_X509.functions.bif.bro)
|
||||
0.000000 MetaHookPre LoadFile(./Bro_X509.types.bif.bro)
|
||||
0.000000 MetaHookPre LoadFile(./Bro_XMPP.events.bif.bro)
|
||||
0.000000 MetaHookPre LoadFile(./Bro_ZIP.events.bif.bro)
|
||||
0.000000 MetaHookPre LoadFile(./acld)
|
||||
0.000000 MetaHookPre LoadFile(./addrs)
|
||||
|
|
@ -1293,6 +1306,7 @@
|
|||
0.000000 MetaHookPre LoadFile(base<...>/urls)
|
||||
0.000000 MetaHookPre LoadFile(base<...>/utils)
|
||||
0.000000 MetaHookPre LoadFile(base<...>/x509)
|
||||
0.000000 MetaHookPre LoadFile(base<...>/xmpp)
|
||||
0.000000 MetaHookPre QueueEvent(NetControl::init())
|
||||
0.000000 MetaHookPre QueueEvent(bro_init())
|
||||
0.000000 MetaHookPre QueueEvent(filter_change_tracking())
|
||||
|
|
@ -1355,6 +1369,8 @@
|
|||
0.000000 | HookCallFunction Analyzer::__register_for_port(Analyzer::ANALYZER_SSL, 995/tcp)
|
||||
0.000000 | HookCallFunction Analyzer::__register_for_port(Analyzer::ANALYZER_SYSLOG, 514/udp)
|
||||
0.000000 | HookCallFunction Analyzer::__register_for_port(Analyzer::ANALYZER_TEREDO, 3544/udp)
|
||||
0.000000 | HookCallFunction Analyzer::__register_for_port(Analyzer::ANALYZER_XMPP, 5222/tcp)
|
||||
0.000000 | HookCallFunction Analyzer::__register_for_port(Analyzer::ANALYZER_XMPP, 5269/tcp)
|
||||
0.000000 | HookCallFunction Analyzer::disable_analyzer(Analyzer::ANALYZER_BACKDOOR)
|
||||
0.000000 | HookCallFunction Analyzer::disable_analyzer(Analyzer::ANALYZER_INTERCONN)
|
||||
0.000000 | HookCallFunction Analyzer::disable_analyzer(Analyzer::ANALYZER_STEPPINGSTONE)
|
||||
|
|
@ -1414,6 +1430,8 @@
|
|||
0.000000 | HookCallFunction Analyzer::register_for_port(Analyzer::ANALYZER_SSL, 995/tcp)
|
||||
0.000000 | HookCallFunction Analyzer::register_for_port(Analyzer::ANALYZER_SYSLOG, 514/udp)
|
||||
0.000000 | HookCallFunction Analyzer::register_for_port(Analyzer::ANALYZER_TEREDO, 3544/udp)
|
||||
0.000000 | HookCallFunction Analyzer::register_for_port(Analyzer::ANALYZER_XMPP, 5222/tcp)
|
||||
0.000000 | HookCallFunction Analyzer::register_for_port(Analyzer::ANALYZER_XMPP, 5269/tcp)
|
||||
0.000000 | HookCallFunction Analyzer::register_for_ports(Analyzer::ANALYZER_AYIYA, {5072/udp})
|
||||
0.000000 | HookCallFunction Analyzer::register_for_ports(Analyzer::ANALYZER_DHCP, {67<...>/udp})
|
||||
0.000000 | HookCallFunction Analyzer::register_for_ports(Analyzer::ANALYZER_DNP3_TCP, {20000<...>/tcp})
|
||||
|
|
@ -1438,6 +1456,7 @@
|
|||
0.000000 | HookCallFunction Analyzer::register_for_ports(Analyzer::ANALYZER_SSL, {5223<...>/tcp})
|
||||
0.000000 | HookCallFunction Analyzer::register_for_ports(Analyzer::ANALYZER_SYSLOG, {514/udp})
|
||||
0.000000 | HookCallFunction Analyzer::register_for_ports(Analyzer::ANALYZER_TEREDO, {3544/udp})
|
||||
0.000000 | HookCallFunction Analyzer::register_for_ports(Analyzer::ANALYZER_XMPP, {5222<...>/tcp})
|
||||
0.000000 | HookCallFunction Cluster::is_enabled()
|
||||
0.000000 | HookCallFunction Files::register_analyzer_add_callback(Files::ANALYZER_EXTRACT, FileExtract::on_add{ if (!FileExtract::args?$extract_filename) FileExtract::args$extract_filename = cat(extract-, FileExtract::f$last_active, -, FileExtract::f$source, -, FileExtract::f$id)FileExtract::f$info$extracted = FileExtract::args$extract_filenameFileExtract::args$extract_filename = build_path_compressed(FileExtract::prefix, FileExtract::args$extract_filename)mkdir(FileExtract::prefix)})
|
||||
0.000000 | HookCallFunction Files::register_for_mime_type(Files::ANALYZER_PE, application/x-dosexec)
|
||||
|
|
@ -1530,7 +1549,7 @@
|
|||
0.000000 | HookCallFunction Log::__create_stream(Weird::LOG, [columns=<no value description>, ev=Weird::log_weird, path=weird])
|
||||
0.000000 | HookCallFunction Log::__create_stream(X509::LOG, [columns=<no value description>, ev=X509::log_x509, path=x509])
|
||||
0.000000 | HookCallFunction Log::__create_stream(mysql::LOG, [columns=<no value description>, ev=MySQL::log_mysql, path=mysql])
|
||||
0.000000 | HookCallFunction Log::__write(PacketFilter::LOG, [ts=1461868125.285894, node=bro, filter=ip or not ip, init=T, success=T])
|
||||
0.000000 | HookCallFunction Log::__write(PacketFilter::LOG, [ts=1461962978.799805, node=bro, filter=ip or not ip, init=T, success=T])
|
||||
0.000000 | HookCallFunction Log::add_default_filter(Cluster::LOG)
|
||||
0.000000 | HookCallFunction Log::add_default_filter(Communication::LOG)
|
||||
0.000000 | HookCallFunction Log::add_default_filter(Conn::LOG)
|
||||
|
|
@ -1651,7 +1670,7 @@
|
|||
0.000000 | HookCallFunction Log::create_stream(Weird::LOG, [columns=<no value description>, ev=Weird::log_weird, path=weird])
|
||||
0.000000 | HookCallFunction Log::create_stream(X509::LOG, [columns=<no value description>, ev=X509::log_x509, path=x509])
|
||||
0.000000 | HookCallFunction Log::create_stream(mysql::LOG, [columns=<no value description>, ev=MySQL::log_mysql, path=mysql])
|
||||
0.000000 | HookCallFunction Log::write(PacketFilter::LOG, [ts=1461868125.285894, node=bro, filter=ip or not ip, init=T, success=T])
|
||||
0.000000 | HookCallFunction Log::write(PacketFilter::LOG, [ts=1461962978.799805, node=bro, filter=ip or not ip, init=T, success=T])
|
||||
0.000000 | HookCallFunction NetControl::check_plugins()
|
||||
0.000000 | HookCallFunction NetControl::init()
|
||||
0.000000 | HookCallFunction Notice::want_pp()
|
||||
|
|
|
|||
|
|
@ -0,0 +1,10 @@
|
|||
#separator \x09
|
||||
#set_separator ,
|
||||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path ssl
|
||||
#open 2015-07-21-20-08-11
|
||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p version cipher curve server_name resumed last_alert next_protocol established cert_chain_fuids client_cert_chain_fuids subject issuer client_subject client_issuer
|
||||
#types time string addr port addr port string string string string bool string string bool vector[string] vector[string] string string string string
|
||||
1437091702.232293 CXWv6p3arKYeMETxOg 198.128.203.95 56048 146.255.57.229 5222 TLSv12 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 secp256r1 - F - - T F5Nz2G1vSZQ0QXM2s8,FUw8omi2keRxShDUa (empty) CN=jabber.ccc.de,O=Chaos Computer Club e.V.,L=Hamburg,ST=Hamburg,C=DE emailAddress=support@cacert.org,CN=CA Cert Signing Authority,OU=http://www.cacert.org,O=Root CA - -
|
||||
#close 2015-07-21-20-08-11
|
||||
|
|
@ -0,0 +1,10 @@
|
|||
#separator \x09
|
||||
#set_separator ,
|
||||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path ssl
|
||||
#open 2015-07-21-20-18-36
|
||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p version cipher curve server_name resumed last_alert next_protocol established cert_chain_fuids client_cert_chain_fuids subject issuer client_subject client_issuer
|
||||
#types time string addr port addr port string string string string bool string string bool vector[string] vector[string] string string string string
|
||||
1437506779.381295 CXWv6p3arKYeMETxOg 184.73.173.246 1193 104.236.167.107 5269 TLSv12 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 secp384r1 - F - - T FLFr7Z1TXmFDv9FwC2,FydVem3ToAkEIAHD29,FK07OA1VxtQi69Irde F3D2e62Vxl7iTnwbA4,FUCD5w4ABMG5N0YvSi,FxWUEd3mgvThYO2uod,FGOrVE2laVCPsCLMF6 CN=www.0xxon.net,OU=Free SSL,OU=Domain Control Validated CN=COMODO RSA Domain Validation Secure Server CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB CN=*.hosted.im,OU=Domain Control Validated CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\\, Inc.,L=Scottsdale,ST=Arizona,C=US
|
||||
#close 2015-07-21-20-18-36
|
||||
|
|
@ -0,0 +1,10 @@
|
|||
#separator \x09
|
||||
#set_separator ,
|
||||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path conn
|
||||
#open 2015-07-21-18-55-16
|
||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents
|
||||
#types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string]
|
||||
1437091701.732171 CXWv6p3arKYeMETxOg 198.128.203.95 56048 146.255.57.229 5222 tcp ssl,xmpp 2.213218 676 4678 SF - - 0 ShADadfFr 19 1676 15 5442 (empty)
|
||||
#close 2015-07-21-18-55-16
|
||||
|
|
@ -0,0 +1,10 @@
|
|||
#separator \x09
|
||||
#set_separator ,
|
||||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path ssl
|
||||
#open 2015-07-21-18-55-16
|
||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p version cipher curve server_name resumed last_alert next_protocol established cert_chain_fuids client_cert_chain_fuids subject issuer client_subject client_issuer
|
||||
#types time string addr port addr port string string string string bool string string bool vector[string] vector[string] string string string string
|
||||
1437091702.232293 CXWv6p3arKYeMETxOg 198.128.203.95 56048 146.255.57.229 5222 TLSv12 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 secp256r1 - F - - T F5Nz2G1vSZQ0QXM2s8,FUw8omi2keRxShDUa (empty) CN=jabber.ccc.de,O=Chaos Computer Club e.V.,L=Hamburg,ST=Hamburg,C=DE emailAddress=support@cacert.org,CN=CA Cert Signing Authority,OU=http://www.cacert.org,O=Root CA - -
|
||||
#close 2015-07-21-18-55-16
|
||||
|
|
@ -0,0 +1,11 @@
|
|||
#separator \x09
|
||||
#set_separator ,
|
||||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path x509
|
||||
#open 2015-07-21-18-55-16
|
||||
#fields ts id certificate.version certificate.serial certificate.subject certificate.issuer certificate.not_valid_before certificate.not_valid_after certificate.key_alg certificate.sig_alg certificate.key_type certificate.key_length certificate.exponent certificate.curve san.dns san.uri san.email san.ip basic_constraints.ca basic_constraints.path_len
|
||||
#types time string count string string string time time string string string count string string vector[string] vector[string] vector[string] vector[addr] bool count
|
||||
1437091702.407347 F5Nz2G1vSZQ0QXM2s8 3 0DF4F2 CN=jabber.ccc.de,O=Chaos Computer Club e.V.,L=Hamburg,ST=Hamburg,C=DE emailAddress=support@cacert.org,CN=CA Cert Signing Authority,OU=http://www.cacert.org,O=Root CA 1382043019.000000 1445115019.000000 rsaEncryption sha1WithRSAEncryption rsa 2048 65537 - jabber.ccc.de,conference.jabber.ccc.de,jabberd.jabber.ccc.de,pubsub.jabber.ccc.de,vjud.jabber.ccc.de - - - F -
|
||||
1437091702.407347 FUw8omi2keRxShDUa 3 00 emailAddress=support@cacert.org,CN=CA Cert Signing Authority,OU=http://www.cacert.org,O=Root CA emailAddress=support@cacert.org,CN=CA Cert Signing Authority,OU=http://www.cacert.org,O=Root CA 1049027389.000000 1995712189.000000 rsaEncryption md5WithRSAEncryption rsa 4096 65537 - - - - - T -
|
||||
#close 2015-07-21-18-55-16
|
||||
BIN
testing/btest/Traces/tls/xmpp-dialback-starttls.pcap
Normal file
BIN
testing/btest/Traces/tls/xmpp-dialback-starttls.pcap
Normal file
Binary file not shown.
BIN
testing/btest/Traces/tls/xmpp-starttls.pcap
Normal file
BIN
testing/btest/Traces/tls/xmpp-starttls.pcap
Normal file
Binary file not shown.
|
|
@ -0,0 +1,8 @@
|
|||
# @TEST-EXEC: bro -C -b -r $TRACES/tls/xmpp-starttls.pcap %INPUT
|
||||
# @TEST-EXEC: btest-diff ssl.log
|
||||
|
||||
@load base/frameworks/dpd
|
||||
@load base/frameworks/signatures
|
||||
@load base/protocols/ssl
|
||||
@load base/protocols/conn
|
||||
@load-sigs base/protocols/xmpp/dpd.sig
|
||||
|
|
@ -0,0 +1,8 @@
|
|||
# @TEST-EXEC: bro -C -b -r $TRACES/tls/xmpp-dialback-starttls.pcap %INPUT
|
||||
# @TEST-EXEC: btest-diff ssl.log
|
||||
|
||||
@load base/frameworks/dpd
|
||||
@load base/frameworks/signatures
|
||||
@load base/protocols/ssl
|
||||
@load base/protocols/conn
|
||||
@load-sigs base/protocols/xmpp/dpd.sig
|
||||
9
testing/btest/scripts/base/protocols/xmpp/starttls.test
Normal file
9
testing/btest/scripts/base/protocols/xmpp/starttls.test
Normal file
|
|
@ -0,0 +1,9 @@
|
|||
# @TEST-EXEC: bro -C -b -r $TRACES/tls/xmpp-starttls.pcap %INPUT
|
||||
# @TEST-EXEC: btest-diff conn.log
|
||||
# @TEST-EXEC: btest-diff ssl.log
|
||||
# @TEST-EXEC: btest-diff x509.log
|
||||
|
||||
@load base/protocols/conn
|
||||
@load base/frameworks/dpd
|
||||
@load base/protocols/ssl
|
||||
@load base/protocols/xmpp
|
||||
Loading…
Add table
Add a link
Reference in a new issue