Enable ssl-log-ext by default

[philrz]

A community user inquired on a Slack thread:

It looks like Brim/Zui doesn’t process/store the TLS Client Hello records as I don’t see the array list of Client Cipher suites. Is my assumption correct here?

Per the docs at https://docs.zeek.org/en/master/scripts/policy/protocols/ssl/ssl-log-ext.zeek.html, this is one of the additional fields that's disabled by default. I confirmed with a separate Zeek install that adding the config @load policy/protocols/ssl/ssl-log-ext to local.zeek added these additional fields.

When informed of this, the community user said:

TBH with you at any day, I’d absolutely LOVE to have this TLS client_hello cipher suites parsing support natively for the Zui instance. It is a life saver feature if you ask me. 😛

When we get to updating the bundled Zeek, we could consider enabling this by default.

[philrz]

This issue is being transferred to the newer build-zeek repo where we're able to build current Zeek releases and hence could actually take up this work now.

[philrz]

Verified with an artifact based on build-zeek commit dc10ee9 created from this Actions run.

After processing this test wrccdc pcap with that Zeek artifact, here's how the ssl event now looks with the client ciphers and other additional detail now included.

$ cat ~/pcap/wrccdc.pcap | ./zeekrunner -

$ zq -Z 'head 1' ssl.log 
{
    _path: "ssl",
    ts: 2018-03-23T19:58:22.804636Z,
    uid: "Cv4yxi3RLWE11ovhsb",
    id: {
        orig_h: 10.47.2.156,
        orig_p: 49285 (port=uint16),
        resp_h: 52.85.83.187,
        resp_p: 443 (port)
    },
    version: "TLSv12",
    cipher: "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
    curve: "secp256r1",
    server_name: "activity-stream-icons.services.mozilla.com",
    resumed: false,
    last_alert: null (string),
    next_protocol: "h2",
    established: true,
    ssl_history: "CsxuknGIti",
    cert_chain_fps: [
        "98fb1f149e3d366db42b235da177ef6c438375135f5f12dfeac41b7671b20611",
        "154c433c491929c5ef686e838e323664a00e6a0d822ccc958fb4dab03e49a08f"
    ],
    client_cert_chain_fps: [] ([string]),
    sni_matches_cert: true,
    validation_status: "ok",
    ja3: "0ffee3ba8e615ad22535e7f771690a28",
    ja3s: "76cc3e2d3028143b23ec18e27dbd7ca9",
    server_version: 771 (uint64),
    client_version: 771 (uint64),
    client_ciphers: [
        49195 (uint64),
        49199 (uint64),
        52393 (uint64),
        52392 (uint64),
        49196 (uint64),
        49200 (uint64),
        49162 (uint64),
        49161 (uint64),
        49171 (uint64),
        49172 (uint64),
        51 (uint64),
        57 (uint64),
        47 (uint64),
        53 (uint64),
        10 (uint64)
    ],
    ssl_client_exts: [
        0 (uint64),
        23 (uint64),
        65281 (uint64),
        10 (uint64),
        11 (uint64),
        35 (uint64),
        16 (uint64),
        5 (uint64),
        13 (uint64)
    ],
    ssl_server_exts: [
        0 (uint64),
        65281 (uint64),
        11 (uint64),
        35 (uint64),
        5 (uint64),
        16 (uint64)
    ],
    ticket_lifetime_hint: 10800 (uint64),
    dh_param_size: null (uint64),
    point_formats: [
        0 (uint64)
    ],
    client_curves: [
        29 (uint64),
        23 (uint64),
        24 (uint64),
        25 (uint64)
    ],
    orig_alpn: [
        "h2",
        "http/1.1"
    ],
    client_supported_versions: null ([uint64]),
    server_supported_version: null (uint64),
    psk_key_exchange_modes: null ([uint64]),
    client_key_share_groups: null ([uint64]),
    server_key_share_group: null (uint64),
    client_comp_methods: [
        0 (uint64)
    ],
    sigalgs: [
        3 (uint64),
        3 (uint64),
        3 (uint64),
        4 (uint64),
        5 (uint64),
        6 (uint64),
        1 (uint64),
        1 (uint64),
        1 (uint64),
        3 (uint64),
        1 (uint64)
    ],
    hashalgs: [
        4 (uint64),
        5 (uint64),
        6 (uint64),
        8 (uint64),
        8 (uint64),
        8 (uint64),
        4 (uint64),
        5 (uint64),
        6 (uint64),
        2 (uint64),
        2 (uint64)
    ]
}