zeek/scripts/base/files/x509/main.bro
Bernhard Amann df552ca87d parse out extension. One event for general extensions (just returns the
openssl-parsed string-value), one event for basicconstraints (is a certificate
a CA or not) and one event for subject-alternative-names (only DNS parts).
2013-09-19 14:41:34 -07:00

29 lines
426 B
Text

@load base/frameworks/files
module X509;
export {
redef enum Log::ID += { LOG };
}
event x509_cert(f: fa_file, cert: X509::Certificate)
{
print cert;
}
event x509_extension(f: fa_file, ext: X509::Extension)
{
print ext;
}
event x509_ext_basic_constraints(f: fa_file, ext: X509::BasicConstraints)
{
print ext;
}
event x509_ext_subject_alternative_name(f: fa_file, ext: X509::SubjectAlternativeName)
{
print ext;
}