mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 06:38:20 +00:00
47500ceef4
Fixed most @load dependency issues in the process. The test is still failing in a "known" way due to hot.conn.bro and scan.bro. Adressess #545
33 lines
744 B
Text
33 lines
744 B
Text
@load base/frameworks/notice/main
|
|
@load base/protocols/ssl/main
|
|
|
|
module SSL;
|
|
|
|
export {
|
|
redef enum Notice::Type += {
|
|
Invalid_Server_Cert
|
|
};
|
|
|
|
redef record Info += {
|
|
validation_status: string &log &optional;
|
|
};
|
|
|
|
}
|
|
|
|
event ssl_established(c: connection) &priority=5
|
|
{
|
|
# If there aren't any certs we can't very well do certificate validation.
|
|
if ( !c$ssl?$cert || !c$ssl?$cert_chain )
|
|
return;
|
|
|
|
local result = x509_verify(c$ssl$cert, c$ssl$cert_chain, root_certs);
|
|
c$ssl$validation_status = x509_err2str(result);
|
|
if ( result != 0 )
|
|
{
|
|
local message = fmt("SSL certificate validation failed with (%s)", c$ssl$validation_status);
|
|
NOTICE([$note=Invalid_Server_Cert, $msg=message,
|
|
$sub=c$ssl$subject, $conn=c]);
|
|
}
|
|
}
|
|
|
|
|