<commit_before># Copyright (c) 2013, The MITRE Corporation. All rights reserved.
# See TERMS.txt for complete terms.

#X509 Certificate -> CybOX Observables Script
#v0.2 **BETA**
#https://github.com/CybOXProject/Tools for latest version

import sys
import os
import cybox
from cybox.core import Observables, Observable, Object

#Supported X509 Keywords
x509_keywords = ['Version', 'Serial Number', 'Signature Algorithm', 'Issuer', 'Not Before', 'Not After ', 'Subject',
                 'Subject Public Key Info', 'Public Key Algorithm', 'RSA Public-Key', 'Public-Key', 'Modulus',
                 'RSA Public Key', 'Modulus (1024 bit)', 'Modulus (2048 bit)', 'Exponent', 'X509v3 Basic Constraints',
                 'X509v3 Name Constraints', 'X509v3 Policy Constraints', 'X509v3 Subject Alternative Name',
                 'X509v3 Issuer Alternative Name', 'X509v3 Subject Directory Attributes', 'X509v3 CRL Distribution Points',
                 'X509v3 Private Key Usage Period','X509v3 Certificate Policies', 'X509v3 Policy Mappings',
                 'X509v3 Subject Key Identifier', 'X509v3 Authority Key Identifier', 'Netscape Comment',
                 'Netscape Certificate Type', 'X509v3 Key Usage', 'X509v3 Extended Key Usage', '192.168.3.11', '172.16.58.3']
#Ignored X509 Keywords
ignored_keywords = ['X509v3 extensions', 'Validity', '-----BEGIN CERTIFICATE-----', '-----END CERTIFICATE-----']

def cert_to_cybox(cert_dict):
    'Parse the certificate dictionary and create the CybOX Observable representation from it'
    properties_dict = {'xsi:type' : 'X509CertificateObjectType'}
    properties_dict['certificate'] = {}
    properties_dict['certificate_signature'] = {}
    properties_dict['certificate']['subject_public_key'] = {}
    properties_dict['certificate']['validity'] = {}
    properties_dict['certificate']['standard_extensions'] = {}
    properties_dict['certificate']['non_standard_extensions'] = {}
    properties_dict['certificate']['subject_public_key']['rsa_public_key'] = {}
    x509_obj_dict = {'properties' : properties_dict}
    observable_dict = {'id': cybox.utils.IDGenerator('x509_to_cybox').create_id(prefix="observable"), 'object' : x509_obj_dict}

    for key, value in cert_dict.items():
        if key == 'Version' :
            split_version = value.split(' ')
            properties_dict['certificate']['version'] = split_version[0]
        elif key == 'Serial Number':
            properties_dict['certificate']['serial_number'] = value
        elif key == 'Subject':
            properties_dict['certificate']['subject'] = value
        elif key == 'Issuer':
            properties_dict['certificate']['issuer'] = value
        elif key == 'Signature Algorithm':
            properties_dict['certificate']['signature_algorithm'] = value
        elif key == 'Public Key Algorithm':
            properties_dict['certificate']['subject_public_key']['public_key_algorithm'] = value
        elif key == 'Modulus' or key == 'Modulus (2048 bit)' or key == 'Modulus (1024 bit)':
            properties_dict['certificate']['subject_public_key']['rsa_public_key']['modulus'] = value
        elif key == 'Exponent':
            split_exponent = value.split(' ')
            properties_dict['certificate']['subject_public_key']['rsa_public_key']['exponent'] = split_exponent[0]
        elif key == 'Not Before' : 
            properties_dict['certificate']['validity']['not_before'] = value
        elif key == 'Not After' : 
            properties_dict['certificate']['validity']['not_after'] = value
        elif key == 'Signature Algorithm_':
            split_signature = value.split(' ')
            if len(split_signature) == 2:
                properties_dict['certificate_signature']['signature_algorithm'] = split_signature[0]
                properties_dict['certificate_signature']['signature'] = split_signature[1]
            else:
                properties_dict['certificate_signature']['signature'] = value
        elif key == 'X509v3 Basic Constraints':
            properties_dict['certificate']['standard_extensions']['basic_constraints'] = value
        elif key == 'X509v3 Name Constraints':
            properties_dict['certificate']['standard_extensions']['name_constraints'] = value
        elif key == 'X509v3 Policy Constraints':
            properties_dict['certificate']['standard_extensions']['policy_constraints'] = value
        elif key == 'X509v3 Subject Key Identifier':
            properties_dict['certificate']['standard_extensions']['subject_key_identifier'] = value
        elif key == 'X509v3 Authority Key Identifier':
            properties_dict['certificate']['standard_extensions']['authority_key_identifier'] = value
        elif key == 'X509v3 Subject Alternative Name':
            properties_dict['certificate']['standard_extensions']['subject_alternative_name'] = value
        elif key == 'X509v3 Issuer Alternative Name':
            properties_dict['certificate']['standard_extensions']['issuer_alternative_name'] = value
        elif key == 'X509v3 Subject Directory Attributes':
            properties_dict['certificate']['standard_extensions']['subject_directory_attributes'] = value
        elif key == 'X509v3 CRL Distribution Points':
            properties_dict['certificate']['standard_extensions']['crl_distribution_points'] = value
        elif key == 'X509v3 Inhibit Any Policy':
            properties_dict['certificate']['standard_extensions']['inhibit_any_policy'] = value
        elif key == 'X509v3 Private Key Usage Period':
            properties_dict['certificate']['standard_extensions']['private_key_usage_period'] = value
        elif key == 'X509v3 Certificate Policies':
            properties_dict['certificate']['standard_extensions']['certificate_policies'] = value
        elif key == 'X509v3 Policy Mappings':
            properties_dict['certificate']['standard_extensions']['policy_mappings'] = value
        elif key == 'X509v3 Key Usage':
            properties_dict['certificate']['standard_extensions']['key_usage'] = value
        elif key == 'X509v3 Extended Key Usage':
            properties_dict['certificate']['standard_extensions']['extended_key_usage'] = value
        elif key == 'Netscape Comment':
            properties_dict['certificate']['non_standard_extensions']['netscape_comment'] = value
        elif key == 'Netscape Certificate Type':<commit_msg>Few minor tweaks to Netscape Certificate Type handling<commit_after># Copyright (c) 2013, The MITRE Corporation. All rights reserved.
# See TERMS.txt for complete terms.

#X509 Certificate -> CybOX Observables Script
#v0.2 **BETA**
#https://github.com/CybOXProject/Tools for latest version

import sys
import os
import cybox
from cybox.core import Observables, Observable, Object

#Supported X509 Keywords
x509_keywords = ['Version', 'Serial Number', 'Signature Algorithm', 'Issuer', 'Not Before', 'Not After ', 'Subject',
                 'Subject Public Key Info', 'Public Key Algorithm', 'RSA Public-Key', 'Public-Key', 'Modulus',
                 'RSA Public Key', 'Modulus (1024 bit)', 'Modulus (2048 bit)', 'Exponent', 'X509v3 Basic Constraints',
                 'X509v3 Name Constraints', 'X509v3 Policy Constraints', 'X509v3 Subject Alternative Name',
                 'X509v3 Issuer Alternative Name', 'X509v3 Subject Directory Attributes', 'X509v3 CRL Distribution Points',
                 'X509v3 Private Key Usage Period','X509v3 Certificate Policies', 'X509v3 Policy Mappings',
                 'X509v3 Subject Key Identifier', 'X509v3 Authority Key Identifier', 'Netscape Comment',
                 'Netscape Certificate Type', 'Netscape Cert Type', 'X509v3 Key Usage', 'X509v3 Extended Key Usage', 
                 '192.168.3.11', '172.16.58.3']
#Ignored X509 Keywords
ignored_keywords = ['X509v3 extensions', 'Validity', '-----BEGIN CERTIFICATE-----', '-----END CERTIFICATE-----']

def cert_to_cybox(cert_dict):
    'Parse the certificate dictionary and create the CybOX Observable representation from it'
    properties_dict = {'xsi:type' : 'X509CertificateObjectType'}
    properties_dict['certificate'] = {}
    properties_dict['certificate_signature'] = {}
    properties_dict['certificate']['subject_public_key'] = {}
    properties_dict['certificate']['validity'] = {}
    properties_dict['certificate']['standard_extensions'] = {}
    properties_dict['certificate']['non_standard_extensions'] = {}
    properties_dict['certificate']['subject_public_key']['rsa_public_key'] = {}
    x509_obj_dict = {'properties' : properties_dict}
    observable_dict = {'id': cybox.utils.IDGenerator('x509_to_cybox').create_id(prefix="observable"), 'object' : x509_obj_dict}

    for key, value in cert_dict.items():
        if key == 'Version' :
            split_version = value.split(' ')
            properties_dict['certificate']['version'] = split_version[0]
        elif key == 'Serial Number':
            properties_dict['certificate']['serial_number'] = value
        elif key == 'Subject':
            properties_dict['certificate']['subject'] = value
        elif key == 'Issuer':
            properties_dict['certificate']['issuer'] = value
        elif key == 'Signature Algorithm':
            properties_dict['certificate']['signature_algorithm'] = value
        elif key == 'Public Key Algorithm':
            properties_dict['certificate']['subject_public_key']['public_key_algorithm'] = value
        elif key == 'Modulus' or key == 'Modulus (2048 bit)' or key == 'Modulus (1024 bit)':
            properties_dict['certificate']['subject_public_key']['rsa_public_key']['modulus'] = value
        elif key == 'Exponent':
            split_exponent = value.split(' ')
            properties_dict['certificate']['subject_public_key']['rsa_public_key']['exponent'] = split_exponent[0]
        elif key == 'Not Before' : 
            properties_dict['certificate']['validity']['not_before'] = value
        elif key == 'Not After' : 
            properties_dict['certificate']['validity']['not_after'] = value
        elif key == 'Signature Algorithm_':
            split_signature = value.split(' ')
            if len(split_signature) == 2:
                properties_dict['certificate_signature']['signature_algorithm'] = split_signature[0]
                properties_dict['certificate_signature']['signature'] = split_signature[1]
            else:
                properties_dict['certificate_signature']['signature'] = value
        elif key == 'X509v3 Basic Constraints':
            properties_dict['certificate']['standard_extensions']['basic_constraints'] = value
        elif key == 'X509v3 Name Constraints':
            properties_dict['certificate']['standard_extensions']['name_constraints'] = value
        elif key == 'X509v3 Policy Constraints':
            properties_dict['certificate']['standard_extensions']['policy_constraints'] = value
        elif key == 'X509v3 Subject Key Identifier':
            properties_dict['certificate']['standard_extensions']['subject_key_identifier'] = value
        elif key == 'X509v3 Authority Key Identifier':
            properties_dict['certificate']['standard_extensions']['authority_key_identifier'] = value
        elif key == 'X509v3 Subject Alternative Name':
            properties_dict['certificate']['standard_extensions']['subject_alternative_name'] = value
        elif key == 'X509v3 Issuer Alternative Name':
            properties_dict['certificate']['standard_extensions']['issuer_alternative_name'] = value
        elif key == 'X509v3 Subject Directory Attributes':
            properties_dict['certificate']['standard_extensions']['subject_directory_attributes'] = value
        elif key == 'X509v3 CRL Distribution Points':
            properties_dict['certificate']['standard_extensions']['crl_distribution_points'] = value
        elif key == 'X509v3 Inhibit Any Policy':
            properties_dict['certificate']['standard_extensions']['inhibit_any_policy'] = value
        elif key == 'X509v3 Private Key Usage Period':
            properties_dict['certificate']['standard_extensions']['private_key_usage_period'] = value
        elif key == 'X509v3 Certificate Policies':
            properties_dict['certificate']['standard_extensions']['certificate_policies'] = value
        elif key == 'X509v3 Policy Mappings':
            properties_dict['certificate']['standard_extensions']['policy_mappings'] = value
        elif key == 'X509v3 Key Usage':
            properties_dict['certificate']['standard_extensions']['key_usage'] = value
        elif key == 'X509v3 Extended Key Usage':
            properties_dict['certificate']['standard_extensions']['extended_key_usage'] = value
        elif key == 'Netscape Comment':
            properties_dict['certificate']['non_standard_extensions']['netscape_comment'] = value
        elif key == 'Netscape Cert Type' or key == 'Netscape Certificate Type':
{'fraction_non_alphanumeric': 0.13079547216622733, 'fraction_numerical': 0.029151806481625058, 'mean_word_length': 3.719721917306989, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 5, 'https://': 2, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 4, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '2048017', 'n_tokens_mistral': 3618, 'n_tokens_neox': 3320, 'n_words': 796}