Commit Graph

10 Commits (3cf1b1206174eb3ae7c2030dafe6b0862b165390)

Author SHA1 Message Date
Victor Julien 7e4df3a1d1 tls-validity: fix memory handling 10 years ago
Mats Klepsland 10d827639e detect-tls-cert-validity: clean up unit tests
Remove locks, unnecessary function calls and conditional statements.
10 years ago
Mats Klepsland 1fea52dd8a detect: add keyword tls_cert_valid
Add keyword to check if TLS certificate is valid.
10 years ago
Mats Klepsland f7e0083269 detect-cert-validity: fix typos 10 years ago
Mats Klepsland f22c9d9781 detect: add keyword tls_cert_expired
Add keyword to check if TLS certificate is expired.
10 years ago
Mats Klepsland 07d2312d96 detect-tls-validity: use flags for modes
Use flags for modes to support using multiple modes at the same time.
10 years ago
Victor Julien e28e98bcaa tls_cert_subject: register inspect engine from keyword 10 years ago
Giuseppe Longo 675fa56497 app-layer: add ThreadVars to AppLayerParserParse
To be able to add a transaction counter we will need a ThreadVars
in the AppLayerParserParse function.
This function is massively used in unittests
and this result in an long commit.
10 years ago
Mats Klepsland dc8e0b3cf2 detect: add detect engine for tls validity keywords
Add detect engine for tls validity keywords (tls_cert_notbefore and
tls_cert_notafter).
10 years ago
Mats Klepsland ea5696812f detect: add tls_cert_notbefore and tls_cert_notafter keywords
Detection plugin for TLS certificate fields notBefore and notAfter.

Supports equal to, less than, greater than, and range operations
for both keywords. Dates can be represented as either ISO 8601 or
epoch (Unix time).

Examples:
alert tls [...] tls_cert_notafter:1445852105; [...]
alert tls [...] tls_cert_notbefore:<2015-10-22T23:59:59; [...]
alert tls [...] tls_cert_notbefore:>2015-10-22; [...]
alert tls [...] tls_cert_notafter:2000-10-22<>2020-05-15; [...]
10 years ago