corelight / go-zeek-broker-ws Goto Github PK

The server cert used in btests is generated by minica which sets the expiry date too soon for comfort:

$ openssl x509 -in tests/Files/cert.pem -enddate | head -n1
notAfter=Jun  9 01:50:28 2025 GMT

From zeek/zeek/discussions/2879:

Mapping Zeek's records to Broker's data model expects records as a tuple of values, with each member in its own Broker-model rendering. The vector must cover the full list of fields, including Nones for optional ones.

This actually works. Assuming

type Foo: record {
  bar: string;
  baz: count;
};

...we could construct a value like this:

encoding.Vector(
  encoding.String("value of bar"),
  encoding.Count(42),
)

We could add support to go-zeek-broker-ws to encode Go structs in this manner, but given the discussion referenced above: should we?

When zeek is running with Broker::disable_ssl = T and we (incorrectly) use client.NewClient() with the weirdtls.BrokerDefaultTLSDialer, the underlying openssl connection function hangs indefinitely and NewClient() never returns.

One fix might be to use the go-openssl DialTimeout function instead, but this requires an API change in the library:

https://github.com/libp2p/go-openssl/blob/v0.1.0/net.go#L90