# Getting SSL events into Python

**URL:** <https://community.zeek.org/t/getting-ssl-events-into-python/4629>\
**Category:** Zeek\
**Created:** [January 30, 2017, 2:34pm UTC](https://community.zeek.org/t/getting-ssl-events-into-python/4629 "2017-01-30T14:34:53Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Karol\_Babioch](https://avatars.discourse-cdn.com/v4/letter/k/e0b2c6/32.png) [@Karol\_Babioch](https://community.zeek.org/u/Karol_Babioch)\
**Post date:** [January 30, 2017, 2:34pm UTC](https://community.zeek.org/t/getting-ssl-events-into-python/4629/1 "2017-01-30T14:34:53Z")

</div>

Hi,

I'm currently researching SSL/TLS handshakes and want to process several  
events Bro provides with the SSL plugin. I've installed Bro along with  
broccoli and broccoli-python and the "broping" example (from the test  
directory) is working just fine. For each "ping" event I sent to Bro, a  
"pong" is received and processed in my Python script.

However, in case of the SSL my callbacks are never executed. The most  
simplified version looks something like this:

> #! /usr/bin/env python
> 
> from broccoli import \*
> 
> @event  
> def ssl\_established(c):  
> &nbsp;&nbsp;&nbsp;&nbsp;print('established')
> 
> bc = Connection("127.0.0.1:47760")
> 
> while True:  
> &nbsp;&nbsp;&nbsp;&nbsp;bc.processInput()

To my understanding I don't even have to load the SSL plugin, since it  
resides within "base", but nevertheless my local.bro contains the following:

> @load broping  
> @load base/protocols/ssl

When starting Bro and executing the Python script mentioned above,  
nothing happens, even if SSL traffic is going through the interface  
(and/or coming from a recorded pcap). I've also tried to register  
callbacks for various other SSL related events (ssl\_client\_hello,  
ssl\_server\_hello, etc.), but in no case were my callbacks invoked.

The only difference to the "broping.py" from the examples, is that I'm  
not sending any events, but just want to receive them (hence I'm calling  
processInput() regularly).

What am I missing here? Do I somehow need to enable the SSL  
functionality within Bro? How can I further debug the problem?

Any help is very much appreciated, since I've spent a fair amount of  
time on this already, with no real progress.

Thank you very much!

Best regards,  
Karol Babioch

---

<div class="post-metadata">

**Author:** ![johanna](https://avatars.discourse-cdn.com/v4/letter/j/50afbb/32.png) [@johanna](https://community.zeek.org/u/johanna)\
**Post date:** [February 14, 2017, 9:20pm UTC](https://community.zeek.org/t/getting-ssl-events-into-python/4629/2 "2017-02-14T21:20:49Z")

</div>

Hello Karol,

by default, events that are handled locally inside of Bro are not sent  
anywhere else; for core-raised events, you will have to re-raise them  
(with a different name to not cause any issues), and set your  
communication preferences so that the raised event will be forwarded to  
broccoli (like done in broping.bro).

I hope this helps,  
Johanna

---

<div class="post-metadata">

**Author:** ![Karol\_Babioch](https://avatars.discourse-cdn.com/v4/letter/k/e0b2c6/32.png) [@Karol\_Babioch](https://community.zeek.org/u/Karol_Babioch)\
**Post date:** [February 14, 2017, 10:26pm UTC](https://community.zeek.org/t/getting-ssl-events-into-python/4629/3 "2017-02-14T22:26:25Z")

</div>

Hello Johanna,

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:44pm UTC](https://community.zeek.org/t/getting-ssl-events-into-python/4629/4 "2022-05-06T15:44:34Z")

</div>