Add a tag indicating session has a certificate-authority cert (arkime…

…#2388) * Add a tag indicating session has certificate-authority cert
mmguero-dev · Aug 31, 2023 · f8a88fa · f8a88fa
1 parent d362eb8
commit f8a88fa
Show file tree

Hide file tree

Showing 18 changed files with 56 additions and 9 deletions.
diff --git a/capture/parsers/tls.c b/capture/parsers/tls.c
@@ -473,6 +473,10 @@ LOCAL void tls_process_server_certificate(MolochSession_t *session, const unsign
             moloch_session_add_tag(session, "cert:self-signed");
         }
 
+        if (certs->isCA) {
+            moloch_session_add_tag(session, "cert:certificate-authority");
+        }
+
 
         if (!moloch_field_certsinfo_add(certsField, session, certs, clen*2)) {
             moloch_field_certsinfo_free(certs);

diff --git a/tests/api-multiunique.t b/tests/api-multiunique.t
@@ -93,6 +93,7 @@ eq_or_diff($txt,
 "byhost2, 7
 byip1, 1
 byip2, 1
+cert:certificate-authority, 3
 domainwise, 7
 dstip, 4
 hosttaggertest1, 7

diff --git a/tests/api-unique.t b/tests/api-unique.t
@@ -96,6 +96,7 @@ eq_or_diff($txt,
 "byhost2, 7
 byip1, 1
 byip2, 1
+cert:certificate-authority, 3
 domainwise, 7
 dstip, 4
 hosttaggertest1, 7

diff --git a/tests/pcap/https-connect.test b/tests/pcap/https-connect.test
@@ -214,6 +214,10 @@
             ],
             "srcOuiCnt" : 1,
             "srcPayload8" : "434f4e4e45435420",
+            "tags" : [
+               "cert:certificate-authority"
+            ],
+            "tagsCnt" : 1,
             "tcpflags" : {
                "ack" : 9,
                "dstZero" : 0,

diff --git a/tests/pcap/https-generalizedtime.test b/tests/pcap/https-generalizedtime.test
@@ -173,10 +173,11 @@
             "srcOuiCnt" : 1,
             "srcPayload8" : "1603010200010001",
             "tags" : [
+               "cert:certificate-authority",
                "dstip",
                "srcip"
             ],
-            "tagsCnt" : 2,
+            "tagsCnt" : 3,
             "tcpflags" : {
                "ack" : 2,
                "dstZero" : 0,

diff --git a/tests/pcap/https2-301-get.test b/tests/pcap/https2-301-get.test
@@ -182,6 +182,10 @@
             ],
             "srcOuiCnt" : 1,
             "srcPayload8" : "8080010301005700",
+            "tags" : [
+               "cert:certificate-authority"
+            ],
+            "tagsCnt" : 1,
             "tcpflags" : {
                "ack" : 8,
                "dstZero" : 0,

diff --git a/tests/pcap/https3-301-get.test b/tests/pcap/https3-301-get.test
@@ -188,6 +188,10 @@
             ],
             "srcOuiCnt" : 1,
             "srcPayload8" : "1603010072010000",
+            "tags" : [
+               "cert:certificate-authority"
+            ],
+            "tagsCnt" : 1,
             "tcpflags" : {
                "ack" : 8,
                "dstZero" : 0,

diff --git a/tests/pcap/openssl-ssl3.test b/tests/pcap/openssl-ssl3.test
@@ -242,9 +242,10 @@
             "srcOuiCnt" : 1,
             "srcPayload8" : "1603000087010000",
             "tags" : [
+               "cert:certificate-authority",
                "srcip"
             ],
-            "tagsCnt" : 1,
+            "tagsCnt" : 2,
             "tcpflags" : {
                "ack" : 10,
                "dstZero" : 0,

diff --git a/tests/pcap/openssl-tls1-tls1_2.test b/tests/pcap/openssl-tls1-tls1_2.test
@@ -243,9 +243,10 @@
             "srcOuiCnt" : 1,
             "srcPayload8" : "1603010102010000",
             "tags" : [
+               "cert:certificate-authority",
                "srcip"
             ],
-            "tagsCnt" : 1,
+            "tagsCnt" : 2,
             "tcpflags" : {
                "ack" : 10,
                "dstZero" : 0,

diff --git a/tests/pcap/openssl-tls1.test b/tests/pcap/openssl-tls1.test
@@ -242,9 +242,10 @@
             "srcOuiCnt" : 1,
             "srcPayload8" : "16030100a4010000",
             "tags" : [
+               "cert:certificate-authority",
                "srcip"
             ],
-            "tagsCnt" : 1,
+            "tagsCnt" : 2,
             "tcpflags" : {
                "ack" : 10,
                "dstZero" : 0,

diff --git a/tests/pcap/openssl-tls1_1.test b/tests/pcap/openssl-tls1_1.test
@@ -243,9 +243,10 @@
             "srcOuiCnt" : 1,
             "srcPayload8" : "16030100a4010000",
             "tags" : [
+               "cert:certificate-authority",
                "srcip"
             ],
-            "tagsCnt" : 1,
+            "tagsCnt" : 2,
             "tcpflags" : {
                "ack" : 10,
                "dstZero" : 0,

diff --git a/tests/pcap/openssl-tls1_2-tls1.test b/tests/pcap/openssl-tls1_2-tls1.test
@@ -240,9 +240,10 @@
             "srcOuiCnt" : 1,
             "srcPayload8" : "1603010102010000",
             "tags" : [
+               "cert:certificate-authority",
                "srcip"
             ],
-            "tagsCnt" : 1,
+            "tagsCnt" : 2,
             "tcpflags" : {
                "ack" : 8,
                "dstZero" : 0,

diff --git a/tests/pcap/openssl-tls1_2.test b/tests/pcap/openssl-tls1_2.test
@@ -243,9 +243,10 @@
             "srcOuiCnt" : 1,
             "srcPayload8" : "1603010102010000",
             "tags" : [
+               "cert:certificate-authority",
                "srcip"
             ],
-            "tagsCnt" : 1,
+            "tagsCnt" : 2,
             "tcpflags" : {
                "ack" : 10,
                "dstZero" : 0,

diff --git a/tests/pcap/pppoe.test b/tests/pcap/pppoe.test
@@ -158,6 +158,10 @@
             ],
             "srcOuiCnt" : 1,
             "srcPayload8" : "804c010300003300",
+            "tags" : [
+               "cert:certificate-authority"
+            ],
+            "tagsCnt" : 1,
             "srcRIR" : "ARIN",
             "tcpflags" : {
                "ack" : 4,

diff --git a/tests/pcap/smtp-starttls.test b/tests/pcap/smtp-starttls.test
@@ -253,10 +253,11 @@
             "srcOuiCnt" : 1,
             "srcPayload8" : "45484c4f20787878",
             "tags" : [
+               "cert:certificate-authority",
                "smtp:starttls",
                "srcip"
             ],
-            "tagsCnt" : 2,
+            "tagsCnt" : 3,
             "tcpflags" : {
                "ack" : 12,
                "dstZero" : 0,

diff --git a/tests/pcap/socks-https-example.test b/tests/pcap/socks-https-example.test
@@ -348,6 +348,10 @@
             ],
             "srcOuiCnt" : 1,
             "srcPayload8" : "040101bb5db8d877",
+            "tags" : [
+               "cert:certificate-authority"
+            ],
+            "tagsCnt" : 1,
             "tcpflags" : {
                "ack" : 15,
                "dstZero" : 0,
@@ -741,6 +745,10 @@
             ],
             "srcOuiCnt" : 1,
             "srcPayload8" : "040101bb00000001",
+            "tags" : [
+               "cert:certificate-authority"
+            ],
+            "tagsCnt" : 1,
             "tcpflags" : {
                "ack" : 15,
                "dstZero" : 0,
@@ -1143,6 +1151,10 @@
             ],
             "srcOuiCnt" : 1,
             "srcPayload8" : "0502000105010001",
+            "tags" : [
+               "cert:certificate-authority"
+            ],
+            "tagsCnt" : 1,
             "tcpflags" : {
                "ack" : 16,
                "dstZero" : 0,

diff --git a/tests/pcap/socks4-https.test b/tests/pcap/socks4-https.test
@@ -222,11 +222,12 @@
             "srcPayload8" : "040101bb00000001",
             "tags" : [
                "acked-unseen-segment-dst",
+               "cert:certificate-authority",
                "dstip",
                "out-of-order-dst",
                "srcip"
             ],
-            "tagsCnt" : 4,
+            "tagsCnt" : 5,
             "tcpflags" : {
                "ack" : 10,
                "dstZero" : 0,

diff --git a/tests/pcap/tls-alpn-h2.test b/tests/pcap/tls-alpn-h2.test
@@ -151,6 +151,10 @@
                "port" : 64034
             },
             "srcPayload8" : "16030100e8010000",
+            "tags" : [
+               "cert:certificate-authority"
+            ],
+            "tagsCnt" : 1,
             "tcpflags" : {
                "ack" : 5,
                "dstZero" : 0,