tests/ja4: Enable ja4 tests for 7.0.6 and later

Issue: 7010

Enable the JA4 tests for Suricata 7.0.6 and later.

diff --git a/tests/ja4-quic-7.0.x-01/README.md b/tests/ja4-quic-7.0.x-01/README.md
new file mode 100644 (file)
index 0000000..fbec43a
--- /dev/null
+++ b/tests/ja4-quic-7.0.x-01/README.md
@@ -0,0 +1,119 @@
+# JA4 QUIC
+
+This test checks whether the correct JA4 fingerprints are calculated for the
+given pcap, according to the [reference implementation](https://github.com/FoxIO-LLC/ja4).
+
+## PCAP
+
+Pcap was created on developer machine using a short `tcpdump` session:
+```
+tcpdump -w out.pcap -i wlp61s0 'port 443 and udp'
+```
+
+## Result
+
+`q13d0310h3_55b375c5d22e_cd85d2d88918` which means
+
+* `q`: QUIC
+* `13`: TLS 1.3
+* `d`: SNI is set
+* `03`: 3 cipher suites in Client Hello
+* `10`: 10 extensions in Client Hello
+* `h3`: ALPN protocol
+
+and the hashes of the corresponding sorted extension codes.
+
+
+## Reference output:
+
+```
+$ ../ja4/binaries/linux/ja4 tests/ja4-quic/input.pcap
+- stream: 0
+  transport: udp
+  src: 192.168.178.25
+  dst: 142.250.181.201
+  src_port: 51333
+  dst_port: 443
+  tls_server_name: www.blogger.com
+  ja4: q13d0310h3_55b375c5d22e_cd85d2d88918
+- stream: 1
+  transport: udp
+  src: 192.168.178.25
+  dst: 142.251.209.129
+  src_port: 53371
+  dst_port: 443
+  tls_server_name: socpuppet.blogspot.com
+  ja4: q13d0310h3_55b375c5d22e_cd85d2d88918
+- stream: 2
+  transport: udp
+  src: 192.168.178.25
+  dst: 142.250.181.206
+  src_port: 50440
+  dst_port: 443
+  tls_server_name: apis.google.com
+  ja4: q13d0310h3_55b375c5d22e_cd85d2d88918
+- stream: 3
+  transport: udp
+  src: 192.168.178.25
+  dst: 142.250.181.201
+  src_port: 37252
+  dst_port: 443
+  tls_server_name: www.blogger.com
+  ja4: q13d0310h3_55b375c5d22e_cd85d2d88918
+- stream: 4
+  transport: udp
+  src: 192.168.178.25
+  dst: 142.250.181.206
+  src_port: 57334
+  dst_port: 443
+  tls_server_name: apis.google.com
+  ja4: q13d0310h3_55b375c5d22e_cd85d2d88918
+- stream: 5
+  transport: udp
+  src: 192.168.178.25
+  dst: 142.250.185.164
+  src_port: 38677
+  dst_port: 443
+  tls_server_name: www.google.com
+  ja4: q13d0310h3_55b375c5d22e_cd85d2d88918
+- stream: 6
+  transport: udp
+  src: 192.168.178.25
+  dst: 142.250.181.195
+  src_port: 42849
+  dst_port: 443
+  tls_server_name: www.gstatic.com
+  ja4: q13d0310h3_55b375c5d22e_cd85d2d88918
+- stream: 7
+  transport: udp
+  src: 192.168.178.25
+  dst: 142.251.209.131
+  src_port: 32997
+  dst_port: 443
+  tls_server_name: fonts.gstatic.com
+  ja4: q13d0310h3_55b375c5d22e_cd85d2d88918
+- stream: 8
+  transport: udp
+  src: 192.168.178.25
+  dst: 142.250.181.193
+  src_port: 60461
+  dst_port: 443
+  tls_server_name: 4.bp.blogspot.com
+  ja4: q13d0310h3_55b375c5d22e_cd85d2d88918
+- stream: 9
+  transport: udp
+  src: 192.168.178.25
+  dst: 142.250.181.193
+  src_port: 52446
+  dst_port: 443
+  tls_server_name: 1.bp.blogspot.com
+  ja4: q13d0310h3_55b375c5d22e_cd85d2d88918
+- stream: 10
+  transport: udp
+  src: 192.168.178.25
+  dst: 142.250.181.193
+  src_port: 41171
+  dst_port: 443
+  tls_server_name: 2.bp.blogspot.com
+  ja4: q13d0310h3_55b375c5d22e_cd85d2d88918
+```

diff --git a/tests/ja4-quic-7.0.x-01/suricata.yaml b/tests/ja4-quic-7.0.x-01/suricata.yaml
new file mode 100644 (file)
index 0000000..12691e1
--- /dev/null
+++ b/tests/ja4-quic-7.0.x-01/suricata.yaml
@@ -0,0 +1,11 @@
+%YAML 1.1
+---
+
+
+outputs:
+  - eve-log:
+      enabled: yes
+      filename: eve.json
+      types:
+        - quic:
+            ja4: off

diff --git a/tests/ja4-quic-7.0.x-01/test.yaml b/tests/ja4-quic-7.0.x-01/test.yaml
new file mode 100644 (file)
index 0000000..98bfc90
--- /dev/null
+++ b/tests/ja4-quic-7.0.x-01/test.yaml
@@ -0,0 +1,17 @@
+requires:
+  min-version: 7.0.6
+  lt-version: 8
+  features:
+    - HAVE_JA4
+
+pcap: ../ja4-quic/input.pcap
+
+args:
+  - -k none
+
+checks:
+  - filter:
+      count: 11
+      match:
+        event_type: quic
+        not-has-key: quic.ja4

diff --git a/tests/ja4-quic-7.0.x-02/README.md b/tests/ja4-quic-7.0.x-02/README.md
new file mode 100644 (file)
index 0000000..6a6640c
--- /dev/null
+++ b/tests/ja4-quic-7.0.x-02/README.md
@@ -0,0 +1,120 @@
+# JA4 QUIC
+
+This test checks whether the correct JA4 fingerprints are calculated for the
+given pcap, according to the [reference implementation](https://github.com/FoxIO-LLC/ja4)
+and logged.
+
+## PCAP
+
+Pcap was created on developer machine using a short `tcpdump` session:
+```
+tcpdump -w out.pcap -i wlp61s0 'port 443 and udp'
+```
+
+## Result
+
+`q13d0310h3_55b375c5d22e_cd85d2d88918` which means
+
+* `q`: QUIC
+* `13`: TLS 1.3
+* `d`: SNI is set
+* `03`: 3 cipher suites in Client Hello
+* `10`: 10 extensions in Client Hello
+* `h3`: ALPN protocol
+
+and the hashes of the corresponding sorted extension codes.
+
+
+## Reference output:
+
+```
+$ ../ja4/binaries/linux/ja4 tests/ja4-quic/input.pcap
+- stream: 0
+  transport: udp
+  src: 192.168.178.25
+  dst: 142.250.181.201
+  src_port: 51333
+  dst_port: 443
+  tls_server_name: www.blogger.com
+  ja4: q13d0310h3_55b375c5d22e_cd85d2d88918
+- stream: 1
+  transport: udp
+  src: 192.168.178.25
+  dst: 142.251.209.129
+  src_port: 53371
+  dst_port: 443
+  tls_server_name: socpuppet.blogspot.com
+  ja4: q13d0310h3_55b375c5d22e_cd85d2d88918
+- stream: 2
+  transport: udp
+  src: 192.168.178.25
+  dst: 142.250.181.206
+  src_port: 50440
+  dst_port: 443
+  tls_server_name: apis.google.com
+  ja4: q13d0310h3_55b375c5d22e_cd85d2d88918
+- stream: 3
+  transport: udp
+  src: 192.168.178.25
+  dst: 142.250.181.201
+  src_port: 37252
+  dst_port: 443
+  tls_server_name: www.blogger.com
+  ja4: q13d0310h3_55b375c5d22e_cd85d2d88918
+- stream: 4
+  transport: udp
+  src: 192.168.178.25
+  dst: 142.250.181.206
+  src_port: 57334
+  dst_port: 443
+  tls_server_name: apis.google.com
+  ja4: q13d0310h3_55b375c5d22e_cd85d2d88918
+- stream: 5
+  transport: udp
+  src: 192.168.178.25
+  dst: 142.250.185.164
+  src_port: 38677
+  dst_port: 443
+  tls_server_name: www.google.com
+  ja4: q13d0310h3_55b375c5d22e_cd85d2d88918
+- stream: 6
+  transport: udp
+  src: 192.168.178.25
+  dst: 142.250.181.195
+  src_port: 42849
+  dst_port: 443
+  tls_server_name: www.gstatic.com
+  ja4: q13d0310h3_55b375c5d22e_cd85d2d88918
+- stream: 7
+  transport: udp
+  src: 192.168.178.25
+  dst: 142.251.209.131
+  src_port: 32997
+  dst_port: 443
+  tls_server_name: fonts.gstatic.com
+  ja4: q13d0310h3_55b375c5d22e_cd85d2d88918
+- stream: 8
+  transport: udp
+  src: 192.168.178.25
+  dst: 142.250.181.193
+  src_port: 60461
+  dst_port: 443
+  tls_server_name: 4.bp.blogspot.com
+  ja4: q13d0310h3_55b375c5d22e_cd85d2d88918
+- stream: 9
+  transport: udp
+  src: 192.168.178.25
+  dst: 142.250.181.193
+  src_port: 52446
+  dst_port: 443
+  tls_server_name: 1.bp.blogspot.com
+  ja4: q13d0310h3_55b375c5d22e_cd85d2d88918
+- stream: 10
+  transport: udp
+  src: 192.168.178.25
+  dst: 142.250.181.193
+  src_port: 41171
+  dst_port: 443
+  tls_server_name: 2.bp.blogspot.com
+  ja4: q13d0310h3_55b375c5d22e_cd85d2d88918
+```

diff --git a/tests/ja4-quic-7.0.x-02/suricata.yaml b/tests/ja4-quic-7.0.x-02/suricata.yaml
new file mode 100644 (file)
index 0000000..9e637c4
--- /dev/null
+++ b/tests/ja4-quic-7.0.x-02/suricata.yaml
@@ -0,0 +1,11 @@
+%YAML 1.1
+---
+
+
+outputs:
+  - eve-log:
+      enabled: yes
+      filename: eve.json
+      types:
+        - quic:
+            ja4: on

diff --git a/tests/ja4-quic-7.0.x-02/test.yaml b/tests/ja4-quic-7.0.x-02/test.yaml
new file mode 100644 (file)
index 0000000..fa44196
--- /dev/null
+++ b/tests/ja4-quic-7.0.x-02/test.yaml
@@ -0,0 +1,18 @@
+requires:
+  min-version: 7.0.6
+  lt-version: 8
+  features:
+    - HAVE_JA4
+
+pcap: ../ja4-quic/input.pcap
+
+args:
+  - -k none
+
+checks:
+  - filter:
+      count: 11
+      match:
+        event_type: quic
+        has-key: quic.ja4
+        quic.ja4: q13d0310h3_55b375c5d22e_cd85d2d88918

diff --git a/tests/ja4-quic/test.yaml b/tests/ja4-quic/test.yaml
index a44b16c0fa44fdd8b7a98c9fe587660344eb28bc..ee275f56661ba2e572268417e6467c6adbd8445a 100644 (file)
--- a/tests/ja4-quic/test.yaml
+++ b/tests/ja4-quic/test.yaml
@@ -1,5 +1,5 @@
 requires:
-  min-version: 8.0.0
+  min-version: 8
   features:
     - HAVE_JA4
 

diff --git a/tests/ja4-rules-7.0.x-01/suricata.yaml b/tests/ja4-rules-7.0.x-01/suricata.yaml
new file mode 100644 (file)
index 0000000..b29ad7e
--- /dev/null
+++ b/tests/ja4-rules-7.0.x-01/suricata.yaml
@@ -0,0 +1,14 @@
+%YAML 1.1
+---
+
+
+outputs:
+  - eve-log:
+      enabled: yes
+      filename: eve.json
+      types:
+        - alert
+        - quic:
+            ja4: off
+        - tls:
+            ja4: off

diff --git a/tests/ja4-rules-7.0.x-01/test.rules b/tests/ja4-rules-7.0.x-01/test.rules
new file mode 100644 (file)
index 0000000..7339e7f
--- /dev/null
+++ b/tests/ja4-rules-7.0.x-01/test.rules
@@ -0,0 +1,4 @@
+alert quic any any -> any any (msg:"JA4 QUIC Test 1"; requires: feature ja4; ja4.hash; content: "q13d0310h3_55b375c5d22e_cd85d2d88918"; sid:1;)
+alert tls any any -> any any (msg:"JA4 TLS Test 1"; requires: feature ja4; ja4.hash; content: "t13d1516h2_8daaf6152771_e5627efa2ab1"; sid:2;)
+alert quic any any -> any any (msg:"JA4 QUIC Test 2"; requires: feature ja4; ja4.hash; content: "q13d0310h3_55b375c5d22e_cd85d2d88918X"; sid:3;)
+alert tls any any -> any any (msg:"JA4 TLS Test 2"; requires: feature ja4; ja4.hash; content: "t13d1516h2_8daaf6152771_e5627efa2ab1X"; sid:4;)

diff --git a/tests/ja4-rules-7.0.x-01/test.yaml b/tests/ja4-rules-7.0.x-01/test.yaml
new file mode 100644 (file)
index 0000000..139f0db
--- /dev/null
+++ b/tests/ja4-rules-7.0.x-01/test.yaml
@@ -0,0 +1,36 @@
+requires:
+  min-version: 7.0.6
+  lt-version: 8
+  features:
+    - HAVE_JA4
+
+pcap: ../ja4-rules/input.pcap
+
+args:
+  - -k none
+
+checks:
+  - filter:
+      count: 1
+      match:
+        event_type: tls
+        not-has-key: tls.ja4
+  - filter:
+      count: 3
+      match:
+        event_type: quic
+        not-has-key: quic.ja4
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        alert.signature_id: 1
+        alert.signature: JA4 QUIC Test 1
+        quic.ja4: q13d0310h3_55b375c5d22e_cd85d2d88918
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        alert.signature_id: 2
+        alert.signature: JA4 TLS Test 1
+        tls.ja4: t13d1516h2_8daaf6152771_e5627efa2ab1

diff --git a/tests/ja4-rules-7.0.x-02/suricata.yaml b/tests/ja4-rules-7.0.x-02/suricata.yaml
new file mode 100644 (file)
index 0000000..78c665e
--- /dev/null
+++ b/tests/ja4-rules-7.0.x-02/suricata.yaml
@@ -0,0 +1,12 @@
+%YAML 1.1
+---
+
+
+outputs:
+  - eve-log:
+      enabled: yes
+      filename: eve.json
+      types:
+        - alert:
+        - tls:
+            ja4: on

diff --git a/tests/ja4-rules-7.0.x-02/test.rules b/tests/ja4-rules-7.0.x-02/test.rules
new file mode 100644 (file)
index 0000000..7339e7f
--- /dev/null
+++ b/tests/ja4-rules-7.0.x-02/test.rules
@@ -0,0 +1,4 @@
+alert quic any any -> any any (msg:"JA4 QUIC Test 1"; requires: feature ja4; ja4.hash; content: "q13d0310h3_55b375c5d22e_cd85d2d88918"; sid:1;)
+alert tls any any -> any any (msg:"JA4 TLS Test 1"; requires: feature ja4; ja4.hash; content: "t13d1516h2_8daaf6152771_e5627efa2ab1"; sid:2;)
+alert quic any any -> any any (msg:"JA4 QUIC Test 2"; requires: feature ja4; ja4.hash; content: "q13d0310h3_55b375c5d22e_cd85d2d88918X"; sid:3;)
+alert tls any any -> any any (msg:"JA4 TLS Test 2"; requires: feature ja4; ja4.hash; content: "t13d1516h2_8daaf6152771_e5627efa2ab1X"; sid:4;)

diff --git a/tests/ja4-rules-7.0.x-02/test.yaml b/tests/ja4-rules-7.0.x-02/test.yaml
new file mode 100644 (file)
index 0000000..756080d
--- /dev/null
+++ b/tests/ja4-rules-7.0.x-02/test.yaml
@@ -0,0 +1,31 @@
+requires:
+  min-version: 7.0.6
+  lt-version: 8
+  features:
+    - HAVE_JA4
+
+pcap: ../ja4-rules/input.pcap
+
+args:
+  - -k none
+
+checks:
+  - filter:
+      count: 1
+      match:
+        event_type: tls
+        has-key: tls.ja4
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        alert.signature_id: 1
+        alert.signature: JA4 QUIC Test 1
+        quic.ja4: "q13d0310h3_55b375c5d22e_cd85d2d88918"
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        alert.signature_id: 2
+        alert.signature: JA4 TLS Test 1
+        tls.ja4: t13d1516h2_8daaf6152771_e5627efa2ab1

diff --git a/tests/ja4-rules-disabled/test.yaml b/tests/ja4-rules-disabled/test.yaml
index 8641447483c225b961b1d3297c3bb6cd86463d8b..079be32847ce2d52544487a693f360cd9f2dd0cd 100644 (file)
--- a/tests/ja4-rules-disabled/test.yaml
+++ b/tests/ja4-rules-disabled/test.yaml
@@ -1,5 +1,5 @@
 requires:
-  min-version: 8.0.0
+  min-version: 7.0.6
   files:
     - rust/src/ja4.rs
 

diff --git a/tests/ja4-rules-invalid/test.yaml b/tests/ja4-rules-invalid/test.yaml
index 682c2f27248393577063ebbe75231f0ca45b42de..81f114d5a8d7183f3cce858b12307a6b845d268c 100644 (file)
--- a/tests/ja4-rules-invalid/test.yaml
+++ b/tests/ja4-rules-invalid/test.yaml
@@ -1,5 +1,5 @@
 requires:
-  min-version: 8.0.0
+  min-version: 7.0.6
   pcap: false
   features:
     - HAVE_JA4

diff --git a/tests/ja4-rules-requires-off/test.yaml b/tests/ja4-rules-requires-off/test.yaml
index 7b3259cce7c870bbe1b06314ff6642ca1efb6f67..5bf55d6567f8b011003d6295683164dc6bb9b3a8 100644 (file)
--- a/tests/ja4-rules-requires-off/test.yaml
+++ b/tests/ja4-rules-requires-off/test.yaml
@@ -1,10 +1,11 @@
 requires:
-  min-version: 8.0.0
+  min-version: 7.0.6
   script:
     - ./src/suricata --build-info | grep "JA4 support" | grep no > /dev/null
 
 args:
   - -k none
+  - --set logging.default-log-level=info
 
 checks:
   - filter:

diff --git a/tests/ja4-rules-requires/test.yaml b/tests/ja4-rules-requires/test.yaml
index 64b17d44a18249d90c9b0c07f7c7c26f48a36db4..4ea60a726af8127a296c190097310d856b1f783c 100644 (file)
--- a/tests/ja4-rules-requires/test.yaml
+++ b/tests/ja4-rules-requires/test.yaml
@@ -1,10 +1,12 @@
 requires:
-  min-version: 8.0.0
+  min-version: 7.0.6
   features:
     - HAVE_JA4
 
 args:
-  - -k none --set app-layer.protocols.tls.ja4-fingerprints=no
+  - -k none
+  - --set app-layer.protocols.tls.ja4-fingerprints=no
+  - --set logging.default-log-level=info
 
 checks:
   - filter:

diff --git a/tests/ja4-rules/test.yaml b/tests/ja4-rules/test.yaml
index 6b3b8c50c97aa05385b04c6aea1ae92c0eafe537..df2a7a573dcf773aacdc9b01fa6678be7680d1b5 100644 (file)
--- a/tests/ja4-rules/test.yaml
+++ b/tests/ja4-rules/test.yaml
@@ -1,5 +1,5 @@
 requires:
-  min-version: 8.0.0
+  min-version: 8
   features:
     - HAVE_JA4
 

diff --git a/tests/ja4-tls-7.0.x/README.md b/tests/ja4-tls-7.0.x/README.md
new file mode 100644 (file)
index 0000000..935da61
--- /dev/null
+++ b/tests/ja4-tls-7.0.x/README.md
@@ -0,0 +1,35 @@
+# JA4 TLS
+
+This test checks whether the correct JA4 fingerprints are calculated for the
+given pcap, according to the [reference implementation](https://github.com/FoxIO-LLC/ja4).
+
+## PCAP
+
+Pcap was taken from another TLS Suricata-Verify test.
+
+## Result
+
+`t12i1810s1_27d4652c4487_06a4338d0495` which means
+
+* `t`: TCP
+* `12`: TLS 1.2
+* `i`: SNI not is set
+* `18`: 18 cipher suites in Client Hello
+* `10`: 10 extensions in Client Hello
+* `s1`: ALPN protocol (first and last character of `spdy/3.1` which is the first protocol listed in the extension)
+
+and the hashes of the corresponding sorted extension codes.
+
+
+## Reference output:
+
+```
+$ ../ja4/binaries/linux/ja4 tests/ja4-tls/input.pcap
+- stream: 0
+  transport: tcp
+  src: 192.168.56.1
+  dst: 192.168.56.101
+  src_port: 49365
+  dst_port: 443
+  ja4: t12i1810s1_27d4652c4487_06a4338d0495
+```

diff --git a/tests/ja4-tls-7.0.x/test.yaml b/tests/ja4-tls-7.0.x/test.yaml
new file mode 100644 (file)
index 0000000..5211801
--- /dev/null
+++ b/tests/ja4-tls-7.0.x/test.yaml
@@ -0,0 +1,17 @@
+requires:
+  min-version: 7.0.6
+  lt-version: 8
+  features:
+    - HAVE_JA4
+
+pcap: ../ja4-tls/input.pcap
+
+args:
+  - -k none --set app-layer.protocols.tls.ja4-fingerprints=yes
+
+checks:
+  - filter:
+      count: 1
+      match:
+        event_type: tls
+        not-has-key: tls.ja4

diff --git a/tests/ja4-tls-quic/test.yaml b/tests/ja4-tls-quic/test.yaml
index 70220d2ed851faaea537dbe3d7608c2cc852e041..1e53fcaa59c121584cd5db16a66ed1ec49093ede 100644 (file)
--- a/tests/ja4-tls-quic/test.yaml
+++ b/tests/ja4-tls-quic/test.yaml
@@ -1,5 +1,5 @@
 requires:
-  min-version: 7.0.0
+  min-version: 8
   features:
     - HAVE_JA4
 

diff --git a/tests/ja4-tls/test.yaml b/tests/ja4-tls/test.yaml
index 9486757390a5a9b9351203d06b71a3340524b1dc..29dc4cad0c8fca1417e6279d065f3b6c83aad616 100644 (file)
--- a/tests/ja4-tls/test.yaml
+++ b/tests/ja4-tls/test.yaml
@@ -1,5 +1,5 @@
 requires:
-  min-version: 7.0.0
+  min-version: 8
   features:
     - HAVE_JA4