Zeek_X509.functions.bif.zeek¶

GLOBAL¶

Namespace: GLOBAL

Summary¶

Functions¶

`sct_verify`: `function`	Verifies a Signed Certificate Timestamp as used for Certificate Transparency.
`x509_check_cert_hostname`: `function`	This function checks if a hostname matches one of the hostnames given in the certificate.
`x509_check_hostname`: `function`	This function checks a hostname against the name given in a certificate subject/SAN, including our interpretation of RFC6128 wildcard expansions.
`x509_from_der`: `function`	Constructs an opaque of X509 from a der-formatted string.
`x509_get_certificate_string`: `function`	Returns the string form of a certificate.
`x509_issuer_name_hash`: `function`	Get the hash of the issuer’s distinguished name.
`x509_ocsp_verify`: `function`	Verifies an OCSP reply.
`x509_parse`: `function`	Parses a certificate into an X509::Certificate structure.
`x509_set_certificate_cache`: `function`	This function can be used to set up certificate caching.
`x509_set_certificate_cache_hit_callback`: `function`	This function sets up the callback that is called when an entry is matched against the table set by `x509_set_certificate_cache`.
`x509_spki_hash`: `function`	Get the hash of the Subject Public Key Information of the certificate.
`x509_subject_name_hash`: `function`	Get the hash of the subject’s distinguished name.
`x509_verify`: `function`	Verifies a certificate.

Detailed Interface¶

Functions¶

sct_verify¶

Type: function (cert: opaque of x509, logid: string, log_key: string, signature: string, timestamp: count, hash_algorithm: count, issuer_key_hash: string &default = "" &optional) : bool

Verifies a Signed Certificate Timestamp as used for Certificate Transparency. See RFC6962 for more details.

Cert: Certificate against which the SCT should be validated.
Logid: Log id of the SCT.
Log_key: Public key of the Log that issued the SCT proof.
Timestamp: Timestamp at which the proof was generated.
Hash_algorithm: Hash algorithm that was used for the SCT proof.
Issuer_key_hash: The SHA-256 hash of the certificate issuer’s public key. This only has to be provided if the SCT was encountered in an X.509 certificate extension; in that case, it is necessary for validation.
Returns: T if the validation could be performed successfully, F otherwise.

x509_check_cert_hostname¶

Type: function (cert_opaque: opaque of x509, hostname: string) : string

This function checks if a hostname matches one of the hostnames given in the certificate.

For our matching we adhere to RFC6128 for the labels (see x509_check_hostname). Furthermore we adhere to RFC2818 and check only the names given in the SAN, if a SAN is present, ignoring CNs in the Subject. If no SAN is present, we will use the last CN in the subject for our tests.

Cert: The X509 certificate opaque handle.
Hostname: Hostname to check
Returns: empty string if the hostname does not match; matched name (which can contain wildcards) if it did.