ssl-log-ext.bro

@load base/protocols/ssl

module SSL;

export {
	redef record SSL::Info += {
		client_ciphers: index_vec &log &optional;
		client_curves: index_vec &log &optional;
		extensions: index_vec &log &optional;
		point_formats: index_vec &log &optional;
	};
}

event ssl_client_hello (c: connection, version: count, possible_ts: time, client_random: string, session_id: string, ciphers: index_vec)
{
	if (!c?$ssl)
		return;
    if (|ciphers| == 0)
        return;

    c$ssl$client_ciphers = ciphers;
}

event ssl_extension (c: connection, is_orig: bool, code: count, val: string)
{
    if (!c?$ssl)
        return;
    if (!is_orig)
        return;

    c$ssl$extensions[|c$ssl$extensions|] = code;
}

event ssl_extension_elliptic_curves (c: connection, is_orig: bool, curves: index_vec)
{
    if (!c?$ssl)
        return;
    if (|curves| == 0)
        return;

    c$ssl$client_curves = curves;
}

event ssl_extension_ec_point_formats(c: connection, is_orig: bool, point_formats: index_vec)
{
    if (!c?$ssl)
        return;
    if (|point_formats| == 0)
        return;

    c$ssl$point_formats = point_formats;
}