[Bro-Dev] #695: ssl_extension event doesn't indicate originator
Bro Tracker
bro at tracker.bro-ids.org
Wed Nov 23 08:35:57 PST 2011
#695: ssl_extension event doesn't indicate originator
----------------------+--------------------
Reporter: seth | Owner: seth
Type: Problem | Status: new
Priority: Normal | Milestone: Bro2.0
Component: Bro | Version:
Resolution: | Keywords:
----------------------+--------------------
Comment (by robin):
On Tue, Nov 22, 2011 at 17:07 -0000, you wrote:
> I forgot to include which side of the connection sent an ssl_extension.
> The ssl_alert, x509_extension, and x509_error events need similar
fields
> added as well.
>
> The fields should probably be named consistently with the other
analyzer
> generated events as well (is_orig). The x509_certificate event uses
> inconsistent naming (is_server) and should probably be renamed too.
I'm be fine fixing these for 2.0. Sounds easy enough to fix and worth
doing now before people start relying on it.
--
Robin Sommer * Phone +1 (510) 722-6541 * robin at icir.org
ICSI/LBNL * Fax +1 (510) 666-2956 * www.icir.org
--
Ticket URL: <http://tracker.bro-ids.org/bro/ticket/695#comment:0>
Bro Tracker <http://tracker.bro-ids.org/bro>
Bro Issue Tracker
More information about the bro-dev
mailing list