-
Notifications
You must be signed in to change notification settings - Fork 75
Add certificate parsing to webserver plugins #1415
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
| yield WebserverCertificateRecord( | ||
| ts=cert_path.lstat().st_mtime, | ||
| webserver="nginx", | ||
| **cert._asdict(), |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@yunzheng what are your thoughts on this pattern?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Nothing wrong with this pattern. Other options could've been using a webserver metadata RecordDescriptor in combination with GroupedRecord, or using extend_record. But it seems there are already other Webserver-like RecordDescriptors defined so I think this is fine.
It will however, overwrite the _source, _generated and _version fields. But depending if that's an issue or not, can be fixed by using cert._asdict(exclude=["_source", "_generated", "_version"]).
Schamper
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Looks like the certlog plugin now has some field conflicts, can you resolve?
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## main #1415 +/- ##
==========================================
- Coverage 80.38% 80.38% -0.01%
==========================================
Files 392 393 +1
Lines 34446 34539 +93
==========================================
+ Hits 27691 27764 +73
- Misses 6755 6775 +20
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
Schamper
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
https://github.com/fox-it/dissect.target/actions/runs/20137146396/job/57795922605?pr=1415
Look like some test failures?
|
I am unable to reproduce the issue locally unfortunately. |
|
Seems pretty consistent on Windows 3.10 and 3.11. If you can't reproduce I'll take a look somewhere next week. |
I'm otherwise a very honest and dependable person. Anyway, the problem was that some fields that were typed as |
This PR adds basic x509 certificate parsing to the webserver plugins of apache and nginx.