base/files/x509/main.zeek
- X509
- Namespace:
X509
- Imports:
base/files/hash, base/frameworks/cluster, base/frameworks/files
Summary
Runtime Options
Maximum size of the known_log_certs table |
|
This option specifies if X.509 certificates are logged in file.log. |
|
By default, x509 certificates are deduplicated. |
Redefinable Options
The maximum number of elements a single container field can contain when logging. |
|
The maximum number of bytes that a single string field can contain when logging. |
|
The maximum total number of container elements a record may log. |
State Variables
|
The set that stores information about certificates that already have been logged and should not be logged again. |
Use broker stores to deduplicate certificates across the whole cluster. |
Types
The record type which contains the fields of the X.509 log. |
|
Type that is used to decide which certificates are duplicates for logging purposes. |
|
This record is used to store information about the SCTs that are encountered in Certificates. |
Redefinitions
|
|
Events
Event for accessing logged records. |
Hooks
Hook that is used to create the index value used for log deduplication. |
|
Functions
The hash function used for certificate hashes. |
Detailed Interface
Runtime Options
- X509::known_log_certs_maximum_size
-
Maximum size of the known_log_certs table
- X509::log_x509_in_files_log
-
This option specifies if X.509 certificates are logged in file.log. Typically, there is not much value to having the entry in files.log - especially since, by default, the file ID is not present in the X509 log.
- X509::relog_known_certificates_after
-
By default, x509 certificates are deduplicated. This configuration option configures the maximum time after which certificates are re-logged. Note - depending on other configuration options, this setting might only apply on a per-worker basis and you still might see certificates logged several times.
To disable deduplication completely, set this to 0secs.
Redefinable Options
- X509::default_max_field_container_elements
-
The maximum number of elements a single container field can contain when logging. If a container reaches this limit, the log output for the field will be truncated. Setting this to zero disables the limiting.
- X509::default_max_field_string_bytes
- Type:
- Attributes:
- Default:
4096- Redefinition:
from policy/protocols/ssl/log-certs-base64.zeek
=:0
The maximum number of bytes that a single string field can contain when logging. If a string reaches this limit, the log output for the field will be truncated. Setting this to zero disables the limiting.
See also:
Log::default_max_field_string_bytes
- X509::default_max_total_container_elements
-
The maximum total number of container elements a record may log. This is the sum of all container elements logged for the record. If this limit is reached, all further containers will be logged as empty containers. If the limit is reached while processing a container, the container will be truncated in the output. Setting this to zero disables the limiting.
State Variables
- X509::known_log_certs
- Type:
- Attributes:
- Default:
{}
The set that stores information about certificates that already have been logged and should not be logged again.
- X509::known_log_certs_use_broker
- Type:
- Default:
T
Use broker stores to deduplicate certificates across the whole cluster. This will cause log-deduplication to work cluster wide, but come at a slightly higher cost of memory and inter-node-communication.
This setting is ignored if Zeek is run in standalone mode.
Types
- X509::Info
- Type:
- Fields:
-
-
certificate:
X509::Certificate&log Basic information about the certificate.
-
extensions:
vectorofX509::Extension&default=[]&optional All extensions that were encountered in the certificate.
-
san:
X509::SubjectAlternativeName&optional&log Subject alternative name extension of the certificate.
-
basic_constraints:
X509::BasicConstraints&optional&log Basic constraints extension of the certificate.
-
extensions_cache:
vectorofany&default=[]&optional All extensions in the order they were raised. This is used for caching certificates that are commonly encountered and should not be relied on in user scripts.
-
host_cert:
bool&log&default=F&optional Indicates if this certificate was a end-host certificate, or sent as part of a chain
-
client_cert:
bool&log&default=F&optional Indicates if this certificate was sent from the client
-
deduplication_index:
X509::LogCertHash&optional Record that is used to deduplicate log entries.
-
always_raise_x509_events:
bool&default=F&optional (present if policy/files/x509/disable-certificate-events-known-certs.zeek is loaded)
Set to true to force certificate events to always be raised for this certificate.
-
cert:
string&log&optional (present if policy/protocols/ssl/log-certs-base64.zeek is loaded)
Base64 encoded X.509 certificate.
-
certificate:
The record type which contains the fields of the X.509 log.
- X509::LogCertHash
- Type:
- Fields:
Type that is used to decide which certificates are duplicates for logging purposes. When adding entries to this, also change the create_deduplication_index to update them.
- X509::SctInfo
- Type:
- Fields:
This record is used to store information about the SCTs that are encountered in Certificates.
Events
- X509::log_x509
- Type:
event(rec:X509::Info)
Event for accessing logged records.
Hooks
- X509::create_deduplication_index
- Type:
hook(c:X509::Info) :bool
Hook that is used to create the index value used for log deduplication.