Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-04 07:38:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

SCT: pass timestamp as uint64 instead of time

Browse source 
For verification, we need the exact uint64 as it was seen on the wire;
converting it to a double might mean that we loose precision.
This commit is contained in:
Johanna Amann 2017-03-16 18:18:39 -07:00
parent dcf4907857
commit d50bddfbfb
6 changed files with 12 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

5
src/file_analysis/analyzer/x509/events.bif
View file

@ -67,10 +67,11 @@ event x509_ext_subject_alternative_name%(f: fa_file, ext: X509::SubjectAlternati
##
## logid: 32 bit key id
##
## timestamp: the timestamp of the sct
## timestamp: the NTP Time when the entry was logged measured since
## the epoch, ignoring leap seconds, in milliseconds.
##
## signature_and_hashalgorithm: signature and hash algorithm used for the
## digitally_signed struct
##
## signature: signature part of the digitally_signed struct
event x509_ocsp_ext_signed_certificate_timestamp%(f: fa_file, version: count, logid: string, timestamp: time, hash_algorithm: count, signature_algorithm: count, signature: string%);
event x509_ocsp_ext_signed_certificate_timestamp%(f: fa_file, version: count, logid: string, timestamp: count, hash_algorithm: count, signature_algorithm: count, signature: string%);

2
src/file_analysis/analyzer/x509/x509-extension.pac
View file

@ -39,7 +39,7 @@ refine connection MockConnection += {
bro_analyzer()->GetFile()->GetVal()->Ref(),
version,
new StringVal(logid.length(), reinterpret_cast<const char*>(logid.begin())),
((double)timestamp)/1000,
timestamp,
digitally_signed_algorithms->HashAlgorithm(),
digitally_signed_algorithms->SignatureAlgorithm(),
new StringVal(digitally_signed_signature.length(), reinterpret_cast<const char*>(digitally_signed_signature.begin()))