14 Commits (e8cf1d95cba7e93ad93e88e2fa1a046bee4453bd)

Author	SHA1	Message	Date
Shivani Bhardwaj	e8cf1d95cb	ssl: add TOO_MANY_SUBJECT_ALTERNATIVE_NAMES event ... In case there are way too many SANs parsed in a TLS packet, flag it as an anomaly instead of just dealing with it. Ticket: 8864	2 months ago
Philippe Antoine	eec4a44275	rules: SID allocation range is now documented in README.md ... directly in the repo, and not in an external wiki	6 months ago
Philippe Antoine	dd6baccabd	src: doc: remove more double-space typos ... Found with git grep -E '[a-z] [a-z]'	10 months ago
Victor Julien	45500acdc4	tls: implement alert parser ... Fatal alerts set the tx state to 'finished'. Add event for malformed alerts.	2 years ago
Jason Ish	2b1bbd08a3	rules/tls: sync with changes to the TLS events ... Sync rules with event changes in commit 01aef49cbd.	6 years ago
Mats Klepsland	10c93221fa	tls: increase max number of tls records per packet ... Tls packets may contain several records. This increase the number of allowed records per packet from 30 to 255, and adds a new and more informative decoder event when this limit is reached.	10 years ago
Mats Klepsland	7c36b11a84	rules: add rule for HANDSHAKE_INVALID_LENGTH event	10 years ago
Mats Klepsland	33fd710367	rules: add rules for TLS SNI app layer events	11 years ago
Victor Julien	db563ed4b0	tls: check SSL3/TLS version per record ... Set event if SSL3/TLS record isn't within the acceptable range.	13 years ago
Victor Julien	c5f43785f1	tls/heartbleed: add rule for invalid encrypted hb ... Add rule to tls-events.rules to match on the invalid encrypted heartbeat.	13 years ago
Pierre Chifflier	d476c654ee	TLS: add detection for malicious heartbeats (AKA heartbleed) ... The OpenSSL implementation of RFC 6520 (Heartbeat extension) does not check the payload length correctly, resulting in a copy of at most 64k of memory from the server (ref: CVE-2014-0160). This patch adds support for decoding heartbeat messages (if not encrypted), and checking several parts (type, length and padding). When an anomaly is detected, a TLS event is raised.	13 years ago
Anoop Saldanha	cd7f0273a2	Add decoder event rule for tls event "invalid_ssl_record", which will now be available "app-layer-event:tls.invalid_ssl_record".	13 years ago
Victor Julien	e3764b90c3	tls: debug compilation fixes, new tls decoder rule for tls.error_message_encountered event.	15 years ago
Victor Julien	e624c56c83	Add TLS decoder event rule file.	15 years ago