Enable GridFTP detection by default. Track/log SSL client certs.

In the *service* field of connection records, GridFTP control channels
are labeled as "gridftp" and data channels as "gridftp-data".

Added *client_subject* and *client_issuer_subject* as &log'd fields to
SSL::Info record.  Also added *client_cert* and *client_cert_chain*
fields to track client cert chain.
This commit is contained in:
Jon Siwek 2012-10-08 11:38:29 -05:00
parent d0b249a731
commit e34f6d9e3b
15 changed files with 238 additions and 132 deletions

View file

@ -0,0 +1,21 @@
# @TEST-EXEC: bro -r $TRACES/globus-url-copy.trace %INPUT
# @TEST-EXEC: btest-diff notice.log
# @TEST-EXEC: btest-diff conn.log
# @TEST-EXEC: btest-diff ssl.log
@load base/protocols/ftp/gridftp
module GridFTP;
redef size_threshold = 2;
redef enum Notice::Type += {
Data_Channel
};
event GridFTP::data_channel_detected(c: connection)
{
local msg = fmt("GridFTP data channel over threshold %d bytes",
size_threshold);
NOTICE([$note=Data_Channel, $msg=msg, $conn=c]);
}