Commit Graph

10 Commits (f631e8cd906d26a9c9ecdc3f5c9e0c3f8d1f05dd)

Author SHA1 Message Date
Mats Klepsland 5e6b8c47df detect: add (mpm) keyword tls_cert_fingerprint
Reimplement keyword to match on SHA-1 fingerprint of TLS
certificate as a mpm keyword.

alert tls any any -> any (msg:"TLS cert fingerprint test";
       tls_cert_fingerprint;
       content:"4a:a3:66:76:82:cb:6b:23:bb:c3:58:47:23:a4:63:a7:78:a4:a1:18";
       sid:12345;)
9 years ago
Mats Klepsland d6508e640a detect: add (mpm) keyword tls_cert_serial
Match on TLS certificate serial number using tls_cert_serial
keyword, e.g.:

alert tls any any -> any any (msg:"TLS cert serial test";
        tls_cert_serial; content:"5C:19:B7:B1:32:3B:1C:A1";
        sid:12345;)
10 years ago
Victor Julien bd456076a8 detect: pass SigMatchData to inspect functions 10 years ago
Victor Julien 2f87c975d4 detect: add SigMatch arg to inspect functions 10 years ago
Victor Julien bfd4bc8233 detect: constify Signature/SigMatch use at runtime 10 years ago
Victor Julien 08407b6d47 tls: mpm prefilter engines 10 years ago
Mats Klepsland dc8e0b3cf2 detect: add detect engine for tls validity keywords
Add detect engine for tls validity keywords (tls_cert_notbefore and
tls_cert_notafter).
10 years ago
Mats Klepsland 4172c4c8ac tls: add (mpm) keyword tls_cert_subject
This keyword is a replacement for tls.subject.
10 years ago
Mats Klepsland 9b2717799c tls: add (mpm) keyword tls_cert_issuer
This keyword is a replacement for tls.issuerdn.
10 years ago
Mats Klepsland a13df67864 detect: add (mpm) keyword for tls_sni
Match on server name indication (SNI) extension in TLS using tls_sni
keyword, e.g:

alert tls any any -> any any (msg:"SNI test"; tls_sni;
        content:"example.com"; sid:12345;)
11 years ago