tls: add check for 'subjectaltname'

As this was missing from the logs, ensure that there won't be any
regressions.

Related to
Bug #7332

diff --git a/tests/tls/tls-subjectaltname/suricata.yaml b/tests/tls/tls-subjectaltname/suricata.yaml
new file mode 100644 (file)
index 0000000..2596271
--- /dev/null
+++ b/tests/tls/tls-subjectaltname/suricata.yaml
@@ -0,0 +1,17 @@
+%YAML 1.1
+---
+
+outputs:
+  - eve-log:
+      enabled: yes
+      filetype: regular #regular|syslog|unix_dgram|unix_stream|redis
+      filename: eve.json
+      types:
+        - alert:
+            payload: no
+            payload-buffer-size: 4kb
+            payload-printable: no
+            packet: no
+            metadata: no
+        - tls:
+            custom: [subject, issuer, serial, fingerprint, sni, version, not_before, not_after, subjectaltname]

diff --git a/tests/tls/tls-subjectaltname/test.yaml b/tests/tls/tls-subjectaltname/test.yaml
index 81fdebf238a39b5d7d782b8d882f6bed5be68d19..278c0e29ce84ec99d1624cc9ff73db73dd848c8c 100644 (file)
--- a/tests/tls/tls-subjectaltname/test.yaml
+++ b/tests/tls/tls-subjectaltname/test.yaml
@@ -10,3 +10,8 @@ checks:
     match:
       alert.signature_id: 1
       event_type: alert
+- filter:
+    count: 28
+    match:
+      event_type: tls
+      has-key: tls.subjectaltname