mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 22:58:20 +00:00
b56b856da9
This commit introduces parsing of the CertificateRequest message in the TLS handshake. It introduces a new event ssl_certificate_request, as well as a new function parse_distinguished_name, which can be used to parse part of the ssl_certificate_request event parameters. This commit also introduces a new policy script, which appends information about the CAs a TLS server requests in the CertificateRequest message, if it sends it.
22 lines
867 B
Text
22 lines
867 B
Text
# This tests the certificate_request message parsing
|
|
|
|
# @TEST-EXEC: zeek -b -r $TRACES/tls/client-certificate.pcap %INPUT > out
|
|
# @TEST-EXEC: zeek -C -b -r $TRACES/tls/certificate-request-failed.pcap %INPUT >> out
|
|
# @TEST-EXEC: zeek -C -b -r $TRACES/tls/webrtc-stun.pcap %INPUT >> out
|
|
# @TEST-EXEC: zeek -C -b -r $TRACES/mysql/encrypted.trace %INPUT >> out
|
|
# @TEST-EXEC: btest-diff out
|
|
|
|
@load base/protocols/ssl
|
|
@load base/protocols/mysql
|
|
|
|
event ssl_certificate_request(c: connection, is_client: bool, certificate_types: index_vec, supported_signature_algorithms: SSL::SignatureAndHashAlgorithm, certificate_authorities: string_vec)
|
|
{
|
|
print certificate_types;
|
|
print supported_signature_algorithms;
|
|
for ( i in certificate_authorities )
|
|
{
|
|
print certificate_authorities[i];
|
|
print parse_distinguished_name(certificate_authorities[i]);
|
|
}
|
|
print "========";
|
|
}
|