-
Notifications
You must be signed in to change notification settings - Fork 1.4k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Tls store v1.4 #33
Tls store v1.4 #33
Conversation
Creation of the log-tlslog file in order to log tls message. Need to add some information into suricata.yaml to work. - tls-log: enabled: yes # Log TLS connections. filename: tls.log # File to store TLS logs.
Adding util-crypt containing cryptographic functions as SHA1 and Base64.
Adding a pointer in ssl_state struct and compute fingerprint during certificate decoding.
Improve TLS logging by adding the certificate fingerprint to TLS Log file. Add the extending option to the tls-log entry in suricata.yaml.
Add the support for tls.fingerprint keyword in rules.
This patch adds a TLS store option to save certificate in PEM format. Each time the store action is met, a file and a metafile are created. Reworked-by: Eric Leblond <eric@regit.org>
When multiple certificates forming a chain are sent. A pointer to the start of each certificate is kept. This will allow treatment on certificates chains.
When using the tls.store command, a dump of all certificates in the chain is now done on the disk.
And delete a useless FIXME.
Building with nss/nspr fails: ./configure --prefix=/usr --sysconfdir=/etc --localstatedir=/var --enable-debug --enable-unittests --disable-gccmarch-native --enable-nfqueue --with-libnss-includes=/usr/include/nss/ --with-libnspr-includes=/usr/include/nspr/ gcc -DHAVE_CONFIG_H -I. -I.. -I../libhtp -I/usr/include/nspr/ -I/usr/include/nss/ -g -O2 -Wextra -Wall -fno-strict-aliasing -fno-tree-pre -Wno-unused-parameter -std=gnu99 -DUNITTESTS -DDEBUG -DNFQ -DHAVE_LIBNET11 -D_BSD_SOURCE -D__BSD_SOURCE -D__FAVOR_BSD -DHAVE_NET_ETHERNET_H -I/usr/include -DLIBPCAP_VERSION_MAJOR=1 -DHAVE_PCAP_SET_BUFF -DHAVE_LIBCAP_NG -DREVISION="f425bf5" -MT util-crypt.o -MD -MP -MF .deps/util-crypt.Tpo -c -o util-crypt.o util-crypt.c |
Yet Another Try.