Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Enable GridFTP detection by default. Track/log SSL client certs.

Browse source 
In the *service* field of connection records, GridFTP control channels
are labeled as "gridftp" and data channels as "gridftp-data".

Added *client_subject* and *client_issuer_subject* as &log'd fields to
SSL::Info record.  Also added *client_cert* and *client_cert_chain*
fields to track client cert chain.
This commit is contained in:
Jon Siwek 2012-10-08 11:38:29 -05:00
parent d0b249a731
commit e34f6d9e3b
15 changed files with 238 additions and 132 deletions
Download patch file Download diff file Expand all files Collapse all files

18
testing/scripts/diff-remove-x509-names
View file

@ -3,7 +3,7 @@
# A diff canonifier that removes all X.509 Distinguished Name subject fields
# because that output can differ depending on installed OpenSSL version.
BEGIN { FS="\t"; OFS="\t"; s_col = -1; i_col = -1 }
BEGIN { FS="\t"; OFS="\t"; s_col = -1; i_col = -1; cs_col = -1; ci_col = -1 }
/^#fields/ {
for ( i = 2; i < NF; ++i )
@ -12,6 +12,10 @@ BEGIN { FS="\t"; OFS="\t"; s_col = -1; i_col = -1 }
s_col = i-1;
if ( $i == "issuer_subject" )
i_col = i-1;
if ( $i == "client_subject" )
cs_col = i-1;
if ( $i == "client_issuer_subject" )
ci_col = i-1;
}
}
@ -27,6 +31,18 @@ i_col >= 0 {
$i_col = "+";
}
cs_col >= 0 {
if ( $cs_col != "-" )
# Mark that it's set, but ignore content.
$cs_col = "+";
}
ci_col >= 0 {
if ( $ci_col != "-" )
# Mark that it's set, but ignore content.
$ci_col = "+";
}
{
print;
}