Add certificate parsing to webserver plugins#1415
Conversation
| yield WebserverCertificateRecord( | ||
| ts=cert_path.lstat().st_mtime, | ||
| webserver="nginx", | ||
| **cert._asdict(), |
There was a problem hiding this comment.
Nothing wrong with this pattern. Other options could've been using a webserver metadata RecordDescriptor in combination with GroupedRecord, or using extend_record. But it seems there are already other Webserver-like RecordDescriptors defined so I think this is fine.
It will however, overwrite the _source, _generated and _version fields. But depending if that's an issue or not, can be fixed by using cert._asdict(exclude=["_source", "_generated", "_version"]).
Schamper
left a comment
There was a problem hiding this comment.
Looks like the certlog plugin now has some field conflicts, can you resolve?
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## main #1415 +/- ##
==========================================
- Coverage 80.38% 80.38% -0.01%
==========================================
Files 392 393 +1
Lines 34446 34539 +93
==========================================
+ Hits 27691 27764 +73
- Misses 6755 6775 +20
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
Schamper
left a comment
There was a problem hiding this comment.
https://github.com/fox-it/dissect.target/actions/runs/20137146396/job/57795922605?pr=1415
Look like some test failures?
|
I am unable to reproduce the issue locally unfortunately. |
|
Seems pretty consistent on Windows 3.10 and 3.11. If you can't reproduce I'll take a look somewhere next week. |
I'm otherwise a very honest and dependable person. Anyway, the problem was that some fields that were typed as |
Co-authored-by: Erik Schamper <1254028+Schamper@users.noreply.github.com>
This PR adds basic x509 certificate parsing to the webserver plugins of apache and nginx.