suricata

Commit Graph

Author	SHA1	Message	Date
Victor Julien	6f42ae91c7	app-layer: protocol change API Add API calls to upgrade to TLS or to request a protocol change without a specific protocol expectation. If the HTTP CONNECT session includes a port on the url, use that to look up the probing parser during protocol detection. Solves a missed detection of a SSLv2 session that upgrades to TLSv1. SSLv2 relies on the probing parser which is limited to certain ports. In case of STARTTLS in SMTP and FTP, the port is hardcoded to 443. A new event APPLAYER_UNEXPECTED_PROTOCOL is set if there was a mismatch.	8 years ago
Mats Klepsland	72c757433a	app-layer: add decoder event for missing TLS after STARTTLS	8 years ago
Eric Leblond	bd0041470f	rules: add app layer events rules Some application layer events are defined but the corresponding rules were not available in the rules directory.	10 years ago

Author

SHA1

Message

Date

Victor Julien

6f42ae91c7

app-layer: protocol change API

Add API calls to upgrade to TLS or to request a protocol change
without a specific protocol expectation.

If the HTTP CONNECT session includes a port on the url, use that to
look up the probing parser during protocol detection. Solves a
missed detection of a SSLv2 session that upgrades to TLSv1. SSLv2
relies on the probing parser which is limited to certain ports.

In case of STARTTLS in SMTP and FTP, the port is hardcoded to 443.

A new event APPLAYER_UNEXPECTED_PROTOCOL is set if there was a
mismatch.

Mats Klepsland

72c757433a

app-layer: add decoder event for missing TLS after STARTTLS

Eric Leblond

bd0041470f

rules: add app layer events rules

Some application layer events are defined but the corresponding
rules were not available in the rules directory.

3 Commits (c06c4a663eea31878828e4407e3ec68dae6bc606)