Alpn log/v3

[victorjulien]

SV_BRANCH=OISF/suricata-verify#1873

https://redmine.openinfosecfoundation.org/issues/7055

Looking for feedback on the logging format. From the test:

  "tls": {
    "sni": "cloudflare-quic.com",
    "version": "TLS 1.3",
    "client_alpns": [
      "h2",
      "http/1.1"
    ]
  }

Replaces #11198, adding tls.alpn keyword.

Example alert for rule

alert tls any any -> any any \
    (tls.subjectaltname; content:"p142-contacts.icloud.com"; tls.alpn; content:"http/1.1"; \
    sid:2;)

gives

{
  "timestamp": "2024-06-01T05:55:05.347344+0000",
  "flow_id": 373542629722761,
  "pcap_cnt": 15,
  "event_type": "alert",
  "src_ip": "17.248.236.64",
  "src_port": 443,
  "dest_ip": "10.84.1.49",
  "dest_port": 55349,
  "proto": "TCP",
  "pkt_src": "wire/pcap",
  "tx_id": 0,
  "alert": {
    "action": "allowed",
    "gid": 1,
    "signature_id": 2,
    "rev": 0,
    "signature": "",
    "category": "",
    "severity": 3
  },
  "tls": {
    "subject": "C=US, ST=California, O=Apple Inc., CN=p127-contacts.icloud.com",
    "issuerdn": "CN=Apple IST CA 2 - G1, OU=Certification Authority, O=Apple Inc., C=US",
    "subjectaltname": [
      "p127-contacts.icloud.com",
      "p128-contacts.icloud.com",
      "p129-contacts.icloud.com",
      "p130-contacts.icloud.com",
      "p131-contacts.icloud.com",
      "p132-contacts.icloud.com",
      "p133-contacts.icloud.com",
      "p134-contacts.icloud.com",
      "p135-contacts.icloud.com",
      "p136-contacts.icloud.com",
      "p137-contacts.icloud.com",
      "p138-contacts.icloud.com",
      "p139-contacts.icloud.com",
      "p140-contacts.icloud.com",
      "p141-contacts.icloud.com",
      "p142-contacts.icloud.com"
    ],
    "serial": "4A:96:B3:D3:5F:90:E4:49:E4:D7:ED:85:D4:9E:09:43",
    "fingerprint": "30:83:82:c5:9d:c2:3b:b4:a9:a6:1a:f2:29:3d:ea:2d:84:1a:19:2e",
    "sni": "p130-contacts.icloud.com",
    "version": "TLS 1.2",
    "notbefore": "2023-10-23T11:42:34",
    "notafter": "2024-11-21T11:42:33",
    "client_alpns": [
      "h2",
      "http/1.1"
    ],
    "server_alpns": [
      "http/1.1"
    ]
  },
  "app_proto": "tls",
  "direction": "to_client",
  "flow": {
    "pkts_toserver": 8,
    "pkts_toclient": 7,
    "bytes_toserver": 1038,
    "bytes_toclient": 5400,
    "start": "2024-06-01T05:55:05.283580+0000",
    "src_ip": "10.84.1.49",
    "dest_ip": "17.248.236.64",
    "src_port": 55349,
    "dest_port": 443
  }
}

[victorjulien]

Needs review, esp of log format. Also needs docs still.

[codecov]

Codecov Report

Attention: Patch coverage is 92.04545% with 7 lines in your changes are missing coverage. Please review.

Project coverage is 82.95%. Comparing base (aeb200e) to head (6c5b5fa).
Report is 3 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master   #11204      +/-   ##
==========================================
- Coverage   82.98%   82.95%   -0.03%     
==========================================
  Files         942      943       +1     
  Lines      250838   250641     -197     
==========================================
- Hits       208147   207927     -220     
- Misses      42691    42714      +23     

Flag	Coverage Δ
fuzzcorpus	61.30% <61.36%> (+<0.01%)	⬆️
livemode	18.70% <15.90%> (-0.08%)	⬇️
pcap	44.52% <60.22%> (-0.06%)	⬇️
suricata-verify	61.60% <90.90%> (-0.03%)	⬇️
unittests	60.64% <48.86%> (-0.02%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

[suricata-qa]

Information: QA ran without warnings.

Pipeline 20894

[catenacyber]

The format looks good to me.

What would be the alternative ?

  "tls": {
    "sni": "cloudflare-quic.com",
    "version": "TLS 1.3",
    "alpns": {
        "client": [
          "h2",
          "http/1.1"
        ],
        "server": ["http/1.1"]
    }
  }

[jasonish]

I think this looks OK:

"client_alpns": [
      "h2",
      "http/1.1"
    ],
    "server_alpns": [
      "http/1.1"
    ]

I didn't find any prior art, but:

1. The array makes sense
2. server_<???> and client_<???> seem to match what the OCSF is doing for such things.

[victorjulien]

Replaced by #11325