Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-10 02:28:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Merge remote-tracking branch 'origin/topic/johanna/certificate-req'

Browse source 
* origin/topic/johanna/certificate-req:
  SSL/TLS CertificateRequest message: Address review feedback
  SSL/TLS: Parse CertificateRequest message
This commit is contained in:
Johanna Amann 2023-03-15 10:02:52 +01:00
commit dcbc809189
19 changed files with 237 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

23
scripts/policy/protocols/ssl/certificate-request-info.zeek Normal file
View file

@ -0,0 +1,23 @@
##! When the server requests a client certificate, it optionally may specify a list of CAs that
##! it accepts. If the server does this, this script adds this list to ssl.log.
@load base/protocols/ssl
module SSL;
redef record SSL::Info += {
## List of cient certificate CAs accepted by the server
requested_client_certificate_authorities: vector of string &optional &log;
};
event ssl_certificate_request(c: connection, is_client: bool, certificate_types: index_vec, supported_signature_algorithms: SSL::SignatureAndHashAlgorithm, certificate_authorities: string_vec)
{
if ( is_client )
return;
local out: vector of string = vector();
for ( _, ca in certificate_authorities )
out += parse_distinguished_name(ca);
c$ssl$requested_client_certificate_authorities = out;
}

1
scripts/test-all-policy.zeek
View file

@ -122,6 +122,7 @@
@load protocols/ssh/geo-data.zeek
@load protocols/ssh/interesting-hostnames.zeek
@load protocols/ssh/software.zeek
@load protocols/ssl/certificate-request-info.zeek
@load protocols/ssl/decryption.zeek
@load protocols/ssl/expiring-certs.zeek
@load protocols/ssl/heartbleed.zeek