Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

TLS-JSON: Allow logging of client handshake parameters #12071

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

gtedesco-r7
Copy link

@gtedesco-r7 gtedesco-r7 commented Nov 1, 2024

Contribution style:

Our Contribution agreements:

Changes (if applicable):

Link to ticket: https://redmine.openinfosecfoundation.org/issues/6695

Description

Add a new custom log field "client_hello" which logs the following:

  1. TLS extensions, excluding GREASE, SNI and ALPN
  2. All cipher suites, excluding GREASE
  3. All signature algorithms, excluding GREASE

The use-case is for logging TLS handshake parameters in order to survey them, and so that JA4 hashes can be computed offline (in the case that they're not already computed for the purposes of rule matching).

My questions are:

  • should we exclude grease/SNI/ALPN or keep them in...
  • is this schema acceptable? or should I flatten it out?
  • in future should we looking at moving more things into rust, eg. put ALPNs and other parameters there to avoid duplication between C and rust structs, and have rust become something a "TLS handshake" struct, which can compute a JA3 or a JA4 as needed? It seems to me like that would simplify a lot and maximise the amount of safe code

Add a new custom log field "client_hello" which logs the following:
1. TLS extensions, excluding GREASE, SNI and ALPN
2. All cipher suites, excluding GREASE
3. All signature algorithms, excluding GREASE

The use-case is for logging TLS handshake parameters in order to survey
them, and so that JA4 hashes can be computed offline (in the case that
they're not already computed for the purposes of rule matching).
Copy link

github-actions bot commented Nov 2, 2024

NOTE: This PR may contain new authors.

Copy link

codecov bot commented Nov 2, 2024

Codecov Report

Attention: Patch coverage is 5.88235% with 32 lines in your changes missing coverage. Please review.

Project coverage is 83.35%. Comparing base (3a7eef8) to head (964961f).
Report is 2 commits behind head on master.

Additional details and impacted files
@@            Coverage Diff             @@
##           master   #12071      +/-   ##
==========================================
- Coverage   83.42%   83.35%   -0.07%     
==========================================
  Files         910      910              
  Lines      257642   257676      +34     
==========================================
- Hits       214949   214798     -151     
- Misses      42693    42878     +185     
Flag Coverage Δ
fuzzcorpus 61.50% <5.88%> (-0.15%) ⬇️
livemode 19.40% <0.00%> (-0.01%) ⬇️
pcap 44.49% <5.88%> (+<0.01%) ⬆️
suricata-verify 62.75% <5.88%> (-0.01%) ⬇️
unittests 59.36% <0.00%> (-0.01%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

Successfully merging this pull request may close these issues.

1 participant