Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

X509 caching API change: callback gets entry directly

Browse source 
Suggestion from Jon: now the callback is passed the table-entry
directly. This allows us to skip one lookup.
This commit is contained in:
Johanna Amann 2020-03-12 11:31:13 -07:00
parent 3ed9379b9e
commit e228061f1d
6 changed files with 11 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

5
scripts/base/files/x509/main.zeek
View file

@ -68,7 +68,7 @@ export {
## ##
## It is possible to change this behavior/skip sending the events by ## It is possible to change this behavior/skip sending the events by
## installing a higher priority hook instead. ## installing a higher priority hook instead.
global x509_certificate_cache_replay: hook(f: fa_file, sha256: string); global x509_certificate_cache_replay: hook(f: fa_file, e: X509::Info, sha256: string);
## Event for accessing logged records. ## Event for accessing logged records.
global log_x509: event(rec: Info); global log_x509: event(rec: Info);
@ -120,7 +120,7 @@ event zeek_init() &priority=5
x509_set_certificate_cache_hit_callback(x509_certificate_cache_replay); x509_set_certificate_cache_hit_callback(x509_certificate_cache_replay);
} }
hook x509_certificate_cache_replay(f: fa_file, sha256: string) hook x509_certificate_cache_replay(f: fa_file, e: X509::Info, sha256: string)
{ {
# we encountered a cached cert. The X509 analyzer will skip it. Let's raise all the events that it typically # we encountered a cached cert. The X509 analyzer will skip it. Let's raise all the events that it typically
# raises by ourselfes. # raises by ourselfes.
@ -130,7 +130,6 @@ hook x509_certificate_cache_replay(f: fa_file, sha256: string)
if ( f$info?$x509 ) if ( f$info?$x509 )
return; return;
local e = certificate_cache[sha256];
event x509_certificate(f, e$handle, e$certificate); event x509_certificate(f, e$handle, e$certificate);
for ( i in e$extensions_cache ) for ( i in e$extensions_cache )
{ {

4
scripts/base/init-bare.zeek
View file

@ -512,12 +512,12 @@ type fa_file: record {
bof_buffer: string &optional; bof_buffer: string &optional;
} &redef; } &redef;
## A hook taking a fa_file and a string. Used by the X509 analyzer as callback. ## A hook taking a fa_file, an any, and a string. Used by the X509 analyzer as callback.
## ##
## .. todo:: We need this type definition only for declaring builtin functions ## .. todo:: We need this type definition only for declaring builtin functions
## via ``bifcl``. We should extend ``bifcl`` to understand composite types ## via ``bifcl``. We should extend ``bifcl`` to understand composite types
## directly and then remove this alias. ## directly and then remove this alias.
type string_file_hook: hook(f: fa_file, str: string); type string_any_file_hook: hook(f: fa_file, e: any, str: string);
## Metadata that's been inferred about a particular file. ## Metadata that's been inferred about a particular file.
type fa_metadata: record { type fa_metadata: record {

6
src/file_analysis/analyzer/x509/X509.cc
View file

@ -51,7 +51,8 @@ bool file_analysis::X509::EndOfFile()
hash_final(ctx, buf); hash_final(ctx, buf);
std::string cert_sha256 = sha256_digest_print(buf); std::string cert_sha256 = sha256_digest_print(buf);
auto index = make_intrusive<StringVal>(cert_sha256); auto index = make_intrusive<StringVal>(cert_sha256);
if ( certificate_cache->Lookup(index.get(), false) ) auto* entry = certificate_cache->Lookup(index.get(), false);
if ( entry )
// in this case, the certificate is in the cache and we do not // in this case, the certificate is in the cache and we do not
// do any further processing here. However, if there is a callback, we execute it. // do any further processing here. However, if there is a callback, we execute it.
{ {
@ -59,8 +60,9 @@ bool file_analysis::X509::EndOfFile()
return false; return false;
// yup, let's call the callback. // yup, let's call the callback.
val_list vl(2); val_list vl(3);
vl.push_back(GetFile()->GetVal()->Ref()); vl.push_back(GetFile()->GetVal()->Ref());
vl.push_back(entry->Ref());
vl.push_back(new StringVal(cert_sha256)); vl.push_back(new StringVal(cert_sha256));
IntrusivePtr<Val> v{AdoptRef{}, cache_hit_callback->Call(&vl)}; IntrusivePtr<Val> v{AdoptRef{}, cache_hit_callback->Call(&vl)};
return false; return false;

2
src/file_analysis/analyzer/x509/functions.bif
View file

@ -916,7 +916,7 @@ function x509_set_certificate_cache%(tbl: string_any_table%) : bool
## callback function if you are sure you will not conflict with the base scripts. ## callback function if you are sure you will not conflict with the base scripts.
## ##
## .. zeek:see:: x509_set_certificate_cache ## .. zeek:see:: x509_set_certificate_cache
function x509_set_certificate_cache_hit_callback%(f: string_file_hook%) : bool function x509_set_certificate_cache_hit_callback%(f: string_any_file_hook%) : bool
%{ %{
file_analysis::X509::SetCertificateCacheHitCallback({NewRef{}, f->AsFunc()}); file_analysis::X509::SetCertificateCacheHitCallback({NewRef{}, f->AsFunc()});

2
testing/btest/scripts/base/files/x509/caching-hook.test
View file

@ -7,7 +7,7 @@
redef X509::caching_required_encounters = 1; redef X509::caching_required_encounters = 1;
hook X509::x509_certificate_cache_replay(f: fa_file, sha256: string) &priority=1 hook X509::x509_certificate_cache_replay(f: fa_file, e: any, sha256: string) &priority=1
{ {
print "Encountered cached certificate not further handled by core", sha256; print "Encountered cached certificate not further handled by core", sha256;
break; break;

2
testing/btest/scripts/base/files/x509/caching.test
View file

@ -6,7 +6,7 @@
redef X509::caching_required_encounters = 1; redef X509::caching_required_encounters = 1;
hook X509::x509_certificate_cache_replay(f: fa_file, sha256: string) &priority=1 hook X509::x509_certificate_cache_replay(f: fa_file, e: any, sha256: string) &priority=1
{ {
print "Encountered cached certificate not further handled by core", sha256; print "Encountered cached certificate not further handled by core", sha256;
} }