[Bro-Dev] #695: ssl_extension event doesn't indicate originator

Bro Tracker bro at tracker.bro-ids.org
Wed Nov 23 08:35:57 PST 2011


#695: ssl_extension event doesn't indicate originator
----------------------+--------------------
  Reporter:  seth     |      Owner:  seth
      Type:  Problem  |     Status:  new
  Priority:  Normal   |  Milestone:  Bro2.0
 Component:  Bro      |    Version:
Resolution:           |   Keywords:
----------------------+--------------------

Comment (by robin):

 On Tue, Nov 22, 2011 at 17:07 -0000, you wrote:

 >  I forgot to include which side of the connection sent an ssl_extension.
 >  The ssl_alert, x509_extension, and x509_error events need similar
 fields
 >  added as well.
 >
 >  The fields should probably be named consistently with the other
 analyzer
 >  generated events as well (is_orig).  The x509_certificate event uses
 >  inconsistent naming (is_server) and should probably be renamed too.

 I'm be fine fixing these for 2.0. Sounds easy enough to fix and worth
 doing now before people start relying on it.

 --
 Robin Sommer * Phone +1 (510) 722-6541 * robin at icir.org
 ICSI/LBNL    * Fax   +1 (510) 666-2956 *   www.icir.org

-- 
Ticket URL: <http://tracker.bro-ids.org/bro/ticket/695#comment:0>
Bro Tracker <http://tracker.bro-ids.org/bro>
Bro Issue Tracker



More information about the bro-dev mailing list