]> git.ipfire.org Git - people/ms/suricata.git/commit - src/app-layer-htp.c
app-layer: protocol change API
authorVictor Julien <victor@inliniac.net>
Fri, 17 Feb 2017 10:41:02 +0000 (11:41 +0100)
committerVictor Julien <victor@inliniac.net>
Mon, 8 May 2017 08:43:36 +0000 (10:43 +0200)
commit6f42ae91c7f3a92788801e024362d061a90ecaeb
tree591ab24a08d4e22d69556ba5d20208d6faca4b2e
parent72c757433aab3bab836eb41bc8dc5a2cb3d04116
app-layer: protocol change API

Add API calls to upgrade to TLS or to request a protocol change
without a specific protocol expectation.

If the HTTP CONNECT session includes a port on the url, use that to
look up the probing parser during protocol detection. Solves a
missed detection of a SSLv2 session that upgrades to TLSv1. SSLv2
relies on the probing parser which is limited to certain ports.

In case of STARTTLS in SMTP and FTP, the port is hardcoded to 443.

A new event APPLAYER_UNEXPECTED_PROTOCOL is set if there was a
mismatch.
rules/app-layer-events.rules
src/app-layer-detect-proto.c
src/app-layer-detect-proto.h
src/app-layer-events.c
src/app-layer-events.h
src/app-layer-ftp.c
src/app-layer-htp.c
src/app-layer-smtp.c
src/app-layer.c
src/flow-util.h
src/flow.h