Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-09 10:08:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Very basic file-analyzer for x509 certificates. Mostly ripped from

Browse source 
the ssl-analyzer and the topic/bernhard/x509 branch.

Simply prints information about the encountered certificates (I have
not yet my mind up, what I will log...).

Next step: extensions...
This commit is contained in:
Bernhard Amann 2013-09-16 09:14:36 -07:00
parent 33a7e96268
commit e5a589dbfe
14 changed files with 449 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

1
scripts/base/protocols/ssl/__load__.bro
View file

@ -1,5 +1,6 @@
@load ./consts
@load ./main
@load ./mozilla-ca-list
@load ./files
@load-sigs ./dpd.sig

48
scripts/base/protocols/ssl/files.bro Normal file
View file

@ -0,0 +1,48 @@
@load ./main
@load base/utils/conn-ids
@load base/frameworks/files
module SSL;
export {
redef record Info += {
## An ordered vector of file unique IDs which contains
## all the certificates sent over the connection
fuids: vector of string &log &default=string_vec();
};
## Default file handle provider for SSL.
global get_file_handle: function(c: connection, is_orig: bool): string;
## Default file describer for SSL.
global describe_file: function(f: fa_file): string;
}
function get_file_handle(c: connection, is_orig: bool): string
{
return cat(Analyzer::ANALYZER_SMTP, c$start_time);
}
function describe_file(f: fa_file): string
{
# This shouldn't be needed, but just in case...
if ( f$source != "SSL" )
return "";
return "";
}
event bro_init() &priority=5
{
Files::register_protocol(Analyzer::ANALYZER_SSL,
[$get_file_handle = SSL::get_file_handle,
$describe = SSL::describe_file]);
}
event file_over_new_connection(f: fa_file, c: connection, is_orig: bool) &priority=5
{
if ( c?$ssl )
c$ssl$fuids[|c$ssl$fuids|] = f$id;
Files::add_analyzer(f, Files::ANALYZER_X509);
}