Skip to content

Commit 3b3da76

Browse files
hynekkarhynekkar
committed
Moved ipfix probe TLS fields to already existing ones
1 parent e314e32 commit 3b3da76

File tree

1 file changed

+29
-33
lines changed

1 file changed

+29
-33
lines changed

‎extra_plugins/output/unirec/config/unirec-elements.txt‎

Lines changed: 29 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -139,44 +139,40 @@ HTTP_UA_APP_MIN uint16 flowmon:httpUaAppMin
139139
HTTP_UA_APP_BLD uint16 flowmon:httpUaAppBld
140140

141141

142-
# --- TLS elements ---
143-
TLS_SNI string e8057id808
144-
TLS_JA3 string e8057id830
145-
146142

147143
# --- Other fields ---
148144
IPV6_TUN_TYPE uint8 e16982id405 # IPv6 tunnel type
149145
APP_ID bytes e0id95 # Application ID from libprotoident / NBAR2 / Flowmon's NBAR plugin
150146

151-
# --- Flowmon TLS fields
152-
TLS_CONTENT_TYPE uint8 flowmon:tlsContentType # tlsContentType
153-
TLS_HANDSHAKE_TYPE uint32 flowmon:tlsHandshakeType # https://tools.ietf.org/html/rfc5246#appendix-A.4
154-
TLS_SETUP_TIME uint64 flowmon:tlsSetupTime # tlsSetupTime
155-
TLS_SERVER_VERSION uint16 flowmon:tlsServerVersion # 8b major and 8b minor, 0x0303 ~ TLS1.2
156-
TLS_SERVER_RANDOM bytes flowmon:tlsServerRandom # tlsServerRandom
157-
TLS_SERVER_SESSIONID bytes flowmon:tlsServerSessionId # tlsServerSessionId
158-
TLS_CIPHER_SUITE uint16 flowmon:tlsCipherSuite # https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-4
159-
TLS_ALPN string flowmon:tlsAlpn # TLS Application-Layer Protocol Negotiation https://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml#alpn-protocol-ids
160-
TLS_SNI string flowmon:tlsSni # Server Name Indication https://en.wikipedia.org/wiki/Server_Name_Indication
161-
TLS_SNI_LENGTH uint16 flowmon:tlsSniLength # Length of TLS_SNI field
162-
TLS_CLIENT_VERSION uint16 flowmon:tlsClientVersion # tlsClientVersion
163-
TLS_CIPHER_SUITES bytes flowmon:tlsCipherSuites # List of 2B ciphers, beware of network byte order. See https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-4
164-
TLS_CLIENT_RANDOM bytes flowmon:tlsClientRandom # tlsClientRandom
165-
TLS_CLIENT_SESSIONID bytes flowmon:tlsClientSessionId # tlsClientSessionId
166-
TLS_EXTENSION_TYPES bytes flowmon:tlsExtensionTypes # tlsExtensionTypes
167-
TLS_EXTENSION_LENGTHS bytes flowmon:tlsExtensionLengths # tlsExtensionLengths
168-
TLS_ELLIPTIC_CURVES bytes flowmon:tlsEllipticCurves # tlsEllipticCurves
169-
TLS_EC_POINTFORMATS bytes flowmon:tlsEcPointFormats # tlsEcPointFormats
170-
TLS_CLIENT_KEYLENGTH int32 flowmon:tlsClientKeyLength # Length of client's key
171-
TLS_ISSUER_CN string flowmon:tlsIssuerCn # Common name of certificate issuer
172-
TLS_SUBJECT_CN string flowmon:tlsSubjectCn # Certificate Common Name
173-
TLS_SUBJECT_ON string flowmon:tlsSubjectOn # Certificate Organization Name
174-
TLS_VALIDITY_NOTBEFORE int64 flowmon:tlsValidityNotBefore # UNIX timestamp of certificate creation
175-
TLS_VALIDITY_NOTAFTER int64 flowmon:tlsValidityNotAfter # UNIX timestamp of certificate expiration
176-
TLS_SIGNATURE_ALG uint16 flowmon:tlsSignatureAlg # tlsSignatureAlg
177-
TLS_PUBLIC_KEYALG uint16 flowmon:tlsPublicKeyAlg # tlsPublicKeyAlg
178-
TLS_PUBLIC_KEYLENGTH int32 flowmon:tlsPublicKeyLength # tlsPublicKeyLength
179-
TLS_JA_3FINGERPRINT bytes flowmon:tlsJa3Fingerprint # tlsJa3Fingerprint
147+
# --- TLS fields
148+
TLS_CONTENT_TYPE uint8 flowmon:tlsContentType # tlsContentType
149+
TLS_HANDSHAKE_TYPE uint32 flowmon:tlsHandshakeType # https://tools.ietf.org/html/rfc5246#appendix-A.4
150+
TLS_SETUP_TIME uint64 flowmon:tlsSetupTime # tlsSetupTime
151+
TLS_SERVER_VERSION uint16 flowmon:tlsServerVersion # 8b major and 8b minor, 0x0303 ~ TLS1.2
152+
TLS_SERVER_RANDOM bytes flowmon:tlsServerRandom # tlsServerRandom
153+
TLS_SERVER_SESSIONID bytes flowmon:tlsServerSessionId # tlsServerSessionId
154+
TLS_CIPHER_SUITE uint16 flowmon:tlsCipherSuite # https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-4
155+
TLS_ALPN string flowmon:tlsAlpn # TLS Application-Layer Protocol Negotiation https://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml#alpn-protocol-ids
156+
TLS_SNI string flowmon:tlsSni,e8057id808 # Server Name Indication https://en.wikipedia.org/wiki/Server_Name_Indication
157+
TLS_SNI_LENGTH uint16 flowmon:tlsSniLength # Length of TLS_SNI field
158+
TLS_CLIENT_VERSION uint16 flowmon:tlsClientVersion # tlsClientVersion
159+
TLS_CIPHER_SUITES bytes flowmon:tlsCipherSuites # List of 2B ciphers, beware of network byte order. See https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-4
160+
TLS_CLIENT_RANDOM bytes flowmon:tlsClientRandom # tlsClientRandom
161+
TLS_CLIENT_SESSIONID bytes flowmon:tlsClientSessionId # tlsClientSessionId
162+
TLS_EXTENSION_TYPES bytes flowmon:tlsExtensionTypes # tlsExtensionTypes
163+
TLS_EXTENSION_LENGTHS bytes flowmon:tlsExtensionLengths # tlsExtensionLengths
164+
TLS_ELLIPTIC_CURVES bytes flowmon:tlsEllipticCurves # tlsEllipticCurves
165+
TLS_EC_POINTFORMATS bytes flowmon:tlsEcPointFormats # tlsEcPointFormats
166+
TLS_CLIENT_KEYLENGTH int32 flowmon:tlsClientKeyLength # Length of client's key
167+
TLS_ISSUER_CN string flowmon:tlsIssuerCn # Common name of certificate issuer
168+
TLS_SUBJECT_CN string flowmon:tlsSubjectCn # Certificate Common Name
169+
TLS_SUBJECT_ON string flowmon:tlsSubjectOn # Certificate Organization Name
170+
TLS_VALIDITY_NOTBEFORE int64 flowmon:tlsValidityNotBefore # UNIX timestamp of certificate creation
171+
TLS_VALIDITY_NOTAFTER int64 flowmon:tlsValidityNotAfter # UNIX timestamp of certificate expiration
172+
TLS_SIGNATURE_ALG uint16 flowmon:tlsSignatureAlg # tlsSignatureAlg
173+
TLS_PUBLIC_KEYALG uint16 flowmon:tlsPublicKeyAlg # tlsPublicKeyAlg
174+
TLS_PUBLIC_KEYLENGTH int32 flowmon:tlsPublicKeyLength # tlsPublicKeyLength
175+
TLS_JA_3FINGERPRINT bytes flowmon:tlsJa3Fingerprint,e8057id830 # tlsJa3Fingerprint
180176

181177
# --- Per-Packet Information elements ---
182178
#PPI_TLS_REC_LENGTHS uint16* e0id291/e8057id1010 # basicList of TLS record lengths

0 commit comments

Comments
 (0)