TLS SubjectAltName sticky buffer/v5 #10750

inashivb · 2024-04-02T12:04:32Z

Link to redmine ticket: https://redmine.openinfosecfoundation.org/issues/5234

Previous PR: #10748

Changes since v4:

more SAN types handled on rust side
simplified checks during detection

So far, the SANs were available as a part of IssuerDN via x509_parser crate but SANs were not available to the SSLState* to be directly used to setup and match against a sticky buffer. Expose it to SSLStateConnp. Feature 5234

Add TLS SubjectAltName sticky buffer. Feature 5234

Feature 5234

suricata-qa · 2024-04-02T14:30:03Z

Information: QA ran without warnings.

Pipeline 19907

catenacyber

Looking good Shivani

CI : 🟢
Code : checking now
Commits segmentation : ok for me, even if I would squash the doc commit into the one adding the keyword
Commit messages : ok for me, git log | grep Feature shows usage of either : or #
Git ID set : looks fine for me
CLA : you already contributed :-)
Doc update : Ok, maybe mention "x509 certificate"
Redmine ticket : ok
Rustfmt : may be done on rust/src/x509/mod.rs
Tests : left a few questions there
Dependencies added: none

rust/src/x509/mod.rs

src/app-layer-ssl.c

src/detect-tls-subjectaltname.c

catenacyber · 2024-04-03T14:22:42Z

Is this ready for #10462 ?

inashivb · 2024-04-04T06:50:06Z

Is this ready for #10462 ?

Not yet. I have to incorporate the feedback that comes out of our discussions above.

inashivb added 3 commits April 2, 2024 17:32

tls: store list of subject alternative names

2c49aad

So far, the SANs were available as a part of IssuerDN via x509_parser crate but SANs were not available to the SSLState* to be directly used to setup and match against a sticky buffer. Expose it to SSLStateConnp. Feature 5234

detect/tls-subjectaltname: add sticky buffer

1c45bb4

Add TLS SubjectAltName sticky buffer. Feature 5234

doc: add description about tls.subjectaltname

8dd86e1

Feature 5234

inashivb marked this pull request as ready for review April 3, 2024 05:30

inashivb requested review from jasonish, jufajardini and victorjulien as code owners April 3, 2024 05:30