Commit Graph

15 Commits (873bc290bc010fa24eed9b2953ebc7a8a6ef2e2e)

Author SHA1 Message Date
Mats Klepsland 3646234ac5 detect-tls-cert-fingerprint: move unittests to tests/ 7 years ago
Mats Klepsland 12d37b8b2c detect-tls: tidy up unittests
By doing the following:
- removing unnecessary locks
- moving variable declarations
- removing redundant function 'SigCleanSignatures'
7 years ago
Mats Klepsland 285855d928 detect-tls: remove NULL settings from keyword registration 7 years ago
Mats Klepsland 008f08c1b3 detect-tls: declare ssl_state as const in GetData() 7 years ago
Mats Klepsland 0f7f35bd85 detect-tls: check return values of functions on setup
Check the return values of DetectBufferSetActiveList() and
DetectSignatureSetAppProto().
7 years ago
Mats Klepsland 1c04d7cdae detect-tls: remove confusing underscores from variables
Remove confusing underscore prefix from variables in GetData() for
all tls keywords.
7 years ago
Jeff Lucovsky 7f102d95b6 detect: Modernize TLS keywords
This changeset adds keywords for "tls.<name>" and moves the existing
value of "tls_<name>" to an alias.
7 years ago
Victor Julien 0b3220a0df detect: improve inspect buffer handling
Fix and Optimize cleanup. For the simple single inspect buffer optimize
the cleanup by keeping track of the actually used buffers. This avoid
looping over unused buffers.

Fix the case of cleaning not being done after a tx if the next tx is
also inspected in the context of the same packet.

Fix cleanup of the multi-inspect buffers. Optimize in 2 ways. First
like with single keep track of which multi-inspect buffers have been
used. Second, keep a max of the buffers within a multi-inspect buffer.
Use this max to limit (nested) looping.
8 years ago
Mats Klepsland 2d2c01e772 detect-tls-cert-fingerprint: fix typo in unittest 8 years ago
Mats Klepsland 4671d57d7a detect-tls-cert-fingerprint: fix failing unittest
Fix unittest that failed with the content validation callback.
8 years ago
Mats Klepsland 2c5d5bbdaa detect-tls-cert-fingerprint: add warning if nocase is used 8 years ago
Mats Klepsland 52d9d45747 detect-tls-cert-fingerprint: add setup callback to lowercase content
Add setup callback that lowercase the content that follows
'tls_cert_fingerprint'.
8 years ago
Mats Klepsland f788719348 detect-tls-cert-fingerprint: add content validation callback
Validate that the content that follows the 'tls_cert_fingerprint'
keyword is on the correct form and has the correct length.
8 years ago
Mats Klepsland c3a329d6e9 detect-tls-cert-fingerprint: use *_Register2 API functions
Use *_Register2 API functions when registering 'tls_cert_fingerprint'
detection keyword.
9 years ago
Mats Klepsland 5e6b8c47df detect: add (mpm) keyword tls_cert_fingerprint
Reimplement keyword to match on SHA-1 fingerprint of TLS
certificate as a mpm keyword.

alert tls any any -> any (msg:"TLS cert fingerprint test";
       tls_cert_fingerprint;
       content:"4a:a3:66:76:82:cb:6b:23:bb:c3:58:47:23:a4:63:a7:78:a4:a1:18";
       sid:12345;)
9 years ago