diff --git a/README.md b/README.md index 3bc7083..c3c2f18 100644 --- a/README.md +++ b/README.md @@ -24,10 +24,15 @@ This script calculates the percentage of the use of the different TLS cipher sui This script identifies certificates on the local network which will be impacted by the [Chrome SHA-1 sunset changes](http://googleonlinesecurity.blogspot.com/2014/09/gradually-sunsetting-sha-1.html). +[conn-workers.bro](conn-workers.bro) + +Short, simple script that adds the name of the node that processed a connection to conn.log. + [validate-certs-cache-intermediates.bro](validate-certs-cache-intermediates.bro) -------------------------------------------------------------------------------- This script performs certificate validation of all encountered X509 certificates. It mimics browser behavior by caching intermediate-certificates for future validations. -The script is a drop-in replacement for the [validate-certs](https://github.com/bro/bro/blob/master/scripts/policy/protocols/ssl/validate-certs.bro) -policy script. You cannot load both of them simultaneously. +The script was a drop-in replacement for the [validate-certs](https://github.com/bro/bro/blob/master/scripts/policy/protocols/ssl/validate-certs.bro) +policy script of Bro. It now replaced the old valida-certs script that was part of Bro +and is probably only of historic interest. diff --git a/conn-workers.bro b/conn-workers.bro new file mode 100644 index 0000000..2b5ffd4 --- /dev/null +++ b/conn-workers.bro @@ -0,0 +1,19 @@ +# Short, simple script that adds the name of the node that processed +# a connection to conn.log. + +@load base/frameworks/cluster + +@if ( Cluster::is_enabled() ) + +@load base/protocols/conn + +redef record Conn::Info += { + node: string &optional &log; +}; + +event connection_state_remove(c: connection) + { + c$conn$node = Cluster::node; + } + +@endif