Commit Graph

15 Commits (270ea253a24f1759d9c36d6b34abd6360c5633b0)

Author SHA1 Message Date
Anoop Saldanha 270ea253a2 ssl parser fix/updates 13 years ago
Pierre Chifflier d866f38982 TLS: add variable to store the error code in the decoder
Use a variable to store the decoding error code if required, and remove
the calls to SCLogInfo and SCLogDebug.
13 years ago
Pierre Chifflier 3df341dbeb Add TLS decode events 13 years ago
Pierre Chifflier 8457ce3b11 TLS app layer: rewrite decoder to handle multiple messages in records
Since we now parse the content of the TLS messages, we need to handle
the case multiple messages are shipped in a single TLS record, and
taking care of the multiple levels of fragmentation (message, record,
and TCP).
Additionally, fix a bug where the parser state was not reset after an
empty record.
13 years ago
Eric Leblond ad0e05a112 TLS app layer: Add tls.issuerdn keyword. 13 years ago
Pierre Chifflier 53e5421a24 TLS handshake: get TLS ciphersuite and compression
Decode the SERVER_HELLO message to extract the ciphersuite and compression
chosen by the server.

Signed-off-by: Pierre Chifflier <pierre.chifflier@ssi.gouv.fr>
13 years ago
Pierre Chifflier 4be65fd016 TLS handshake: decode the SERVER_CERTIFICATE message
Add a decoder for the SERVER_CERTIFICATE during a TLS handshake, extracts the
certificates and keep the subject name.
Add the tls.subject keyword for substring match in rules (TLS layer).

Signed-off-by: Pierre Chifflier <pierre.chifflier@ssi.gouv.fr>
13 years ago
Anoop Saldanha 420befb180 Changed my email address to anoopsaldanha at gmail dot com from my current one 13 years ago
Victor Julien 71d0eabdec Add a few extra safety checks in new SSL code. 14 years ago
Anoop Saldanha 7a2046328c some naming changes in ssl parser and ssl related keywords 14 years ago
Anoop Saldanha b639718787 replace the contents of app-layer-ssl.[ch] with the contents from app-layer-tls.[ch] 14 years ago
Anoop Saldanha 4e8de99dcd tls/ssl parser modifications/fixes. We now have just one file doing all the ssl parsing stuff, i.e. app-layer-tls.[ch], instead of app-layer-ssl.[ch] and app-layer-tls.[ch] 14 years ago
Gurvinder Singh 8f8b1212af support for ssl_version keyword 14 years ago
Victor Julien fc248ca7a1 Many small performance updates. 15 years ago
Gurvinder Singh 5fe1dc1d24 support for sslv2/sslv3 their unit tests and better stream no reassembly flag handling 15 years ago