mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 14:48:21 +00:00
41606e18fb
This patch allows users to provide the fuid or the connection id directly, in case they do not have access to either in the event that they handle. An example for this is the handling of certificates in SSL, where the fa_file record cannot be retained because this would create a cyclic data structure. This patch also provides file IDs for hostname matches in certificates, which was not possible with the previous API.
26 lines
786 B
Text
26 lines
786 B
Text
@load base/frameworks/intel
|
|
@load base/protocols/ssl
|
|
@load ./where-locations
|
|
|
|
event ssl_extension_server_name(c: connection, is_orig: bool, names: string_vec)
|
|
{
|
|
if ( is_orig && c?$ssl && c$ssl?$server_name )
|
|
Intel::seen([$indicator=c$ssl$server_name,
|
|
$indicator_type=Intel::DOMAIN,
|
|
$conn=c,
|
|
$where=SSL::IN_SERVER_NAME]);
|
|
}
|
|
|
|
event ssl_established(c: connection)
|
|
{
|
|
if ( ! c$ssl?$cert_chain || |c$ssl$cert_chain| == 0 ||
|
|
! c$ssl$cert_chain[0]?$x509 )
|
|
return;
|
|
|
|
if ( c$ssl$cert_chain[0]$x509?$certificate && c$ssl$cert_chain[0]$x509$certificate?$cn )
|
|
Intel::seen([$indicator=c$ssl$cert_chain[0]$x509$certificate$cn,
|
|
$indicator_type=Intel::DOMAIN,
|
|
$fuid=c$ssl$cert_chain_fuids[0],
|
|
$conn=c,
|
|
$where=X509::IN_CERT]);
|
|
}
|