Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-04 07:38:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

SCT: pass timestamp as uint64 instead of time

Browse source 
For verification, we need the exact uint64 as it was seen on the wire;
converting it to a double might mean that we loose precision.
This commit is contained in:
Johanna Amann 2017-03-16 18:18:39 -07:00
parent dcf4907857
commit d50bddfbfb
6 changed files with 12 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

5
src/analyzer/protocol/ssl/events.bif
View file

@ -238,13 +238,14 @@ event ssl_extension_server_name%(c: connection, is_orig: bool, names: string_vec
## ##
## logid: 32 bit key id ## logid: 32 bit key id
## ##
## timestamp: the current NTP Time ## timestamp: the NTP Time when the entry was logged measured since
## the epoch, ignoring leap seconds, in milliseconds.
## ##
## signature_and_hashalgorithm: signature and hash algorithm used for the ## signature_and_hashalgorithm: signature and hash algorithm used for the
## digitally_signed struct ## digitally_signed struct
## ##
## signature: signature part of the digitally_signed struct ## signature: signature part of the digitally_signed struct
event ssl_extension_signed_certificate_timestamp%(c: connection, is_orig: bool, version: count, logid: string, timestamp: time, signature_and_hashalgorithm: SSL::SignatureAndHashAlgorithm, signature: string%); event ssl_extension_signed_certificate_timestamp%(c: connection, is_orig: bool, version: count, logid: string, timestamp: count, signature_and_hashalgorithm: SSL::SignatureAndHashAlgorithm, signature: string%);
## Generated at the end of an SSL/TLS handshake. SSL/TLS sessions start with ## Generated at the end of an SSL/TLS handshake. SSL/TLS sessions start with
## an unencrypted handshake, and Bro extracts as much information out of that ## an unencrypted handshake, and Bro extracts as much information out of that

2
src/analyzer/protocol/ssl/tls-handshake-analyzer.pac
View file

@ -259,7 +259,7 @@ refine connection Handshake_Conn += {
bro_analyzer()->Conn(), ${rec.is_orig}, bro_analyzer()->Conn(), ${rec.is_orig},
version, version,
new StringVal(logid.length(), reinterpret_cast<const char*>(logid.begin())), new StringVal(logid.length(), reinterpret_cast<const char*>(logid.begin())),
((double)timestamp)/1000, timestamp,
ha, ha,
new StringVal(digitally_signed_signature.length(), reinterpret_cast<const char*>(digitally_signed_signature.begin())) new StringVal(digitally_signed_signature.length(), reinterpret_cast<const char*>(digitally_signed_signature.begin()))
); );

5
src/file_analysis/analyzer/x509/events.bif
View file

@ -67,10 +67,11 @@ event x509_ext_subject_alternative_name%(f: fa_file, ext: X509::SubjectAlternati
## ##
## logid: 32 bit key id ## logid: 32 bit key id
## ##
## timestamp: the timestamp of the sct ## timestamp: the NTP Time when the entry was logged measured since
## the epoch, ignoring leap seconds, in milliseconds.
## ##
## signature_and_hashalgorithm: signature and hash algorithm used for the ## signature_and_hashalgorithm: signature and hash algorithm used for the
## digitally_signed struct ## digitally_signed struct
## ##
## signature: signature part of the digitally_signed struct ## signature: signature part of the digitally_signed struct
event x509_ocsp_ext_signed_certificate_timestamp%(f: fa_file, version: count, logid: string, timestamp: time, hash_algorithm: count, signature_algorithm: count, signature: string%); event x509_ocsp_ext_signed_certificate_timestamp%(f: fa_file, version: count, logid: string, timestamp: count, hash_algorithm: count, signature_algorithm: count, signature: string%);

2
src/file_analysis/analyzer/x509/x509-extension.pac
View file

@ -39,7 +39,7 @@ refine connection MockConnection += {
bro_analyzer()->GetFile()->GetVal()->Ref(), bro_analyzer()->GetFile()->GetVal()->Ref(),
version, version,
new StringVal(logid.length(), reinterpret_cast<const char*>(logid.begin())), new StringVal(logid.length(), reinterpret_cast<const char*>(logid.begin())),
((double)timestamp)/1000, timestamp,
digitally_signed_algorithms->HashAlgorithm(), digitally_signed_algorithms->HashAlgorithm(),
digitally_signed_algorithms->SignatureAlgorithm(), digitally_signed_algorithms->SignatureAlgorithm(),
new StringVal(digitally_signed_signature.length(), reinterpret_cast<const char*>(digitally_signed_signature.begin())) new StringVal(digitally_signed_signature.length(), reinterpret_cast<const char*>(digitally_signed_signature.begin()))

4
testing/btest/scripts/base/files/x509/signed_certificate_timestamp.test
View file

@ -1,7 +1,7 @@
# @TEST-EXEC: bro -r $TRACES/tls/certificate-with-sct.pcap %INPUT # @TEST-EXEC: bro -r $TRACES/tls/certificate-with-sct.pcap %INPUT
# @TEST-EXEC: btest-diff .stdout # @TEST-EXEC: btest-diff .stdout
event x509_ocsp_ext_signed_certificate_timestamp(f: fa_file, version: count, logid: string, timestamp: time, hash_algorithm: count, signature_algorithm: count, signature: string) event x509_ocsp_ext_signed_certificate_timestamp(f: fa_file, version: count, logid: string, timestamp: count, hash_algorithm: count, signature_algorithm: count, signature: string)
{ {
print version, SSL::ct_logs[logid]$description, timestamp, hash_algorithm, signature_algorithm; print version, SSL::ct_logs[logid]$description, double_to_time(timestamp/1000.0), hash_algorithm, signature_algorithm;
} }

4
testing/btest/scripts/base/protocols/ssl/signed_certificate_timestamp.test
View file

@ -1,7 +1,7 @@
# @TEST-EXEC: bro -r $TRACES/tls/signed_certificate_timestamp.pcap %INPUT # @TEST-EXEC: bro -r $TRACES/tls/signed_certificate_timestamp.pcap %INPUT
# @TEST-EXEC: btest-diff .stdout # @TEST-EXEC: btest-diff .stdout
event ssl_extension_signed_certificate_timestamp(c: connection, is_orig: bool, version: count, logid: string, timestamp: time, signature_and_hashalgorithm: SSL::SignatureAndHashAlgorithm, signature: string) event ssl_extension_signed_certificate_timestamp(c: connection, is_orig: bool, version: count, logid: string, timestamp: count, signature_and_hashalgorithm: SSL::SignatureAndHashAlgorithm, signature: string)
{ {
print version, SSL::ct_logs[logid]$description, timestamp, signature_and_hashalgorithm; print version, SSL::ct_logs[logid]$description, double_to_time(timestamp/1000.0), signature_and_hashalgorithm;
} }