]> git.ipfire.org Git - thirdparty/suricata.git/commit
tls: Introduce HandshakeParams object for tracking
authorRichard McConnell <Richard_McConnell@rapid7.com>
Wed, 23 Apr 2025 14:44:09 +0000 (15:44 +0100)
committerVictor Julien <victor@inliniac.net>
Fri, 16 May 2025 19:33:54 +0000 (21:33 +0200)
commit468a037daae704edcd0a931aa369d6fcf162ffab
tree0a685148ef7b593b009b133f82bd738c0f9f0ab1
parent4085cf44dbe0ce108e3af6612860a1f88ca83148
tls: Introduce HandshakeParams object for tracking

Ticket: 6695

This introduction splits the use of the handshake parameters into their
own object, HandshakeParams, which is populated by the TLS decoder. The
JA4 object is now very simple. It's a simple String object (the JA4
Hash) which is generated during new().

This introduction is part of a larger idea, which is to enable
outputting these raw parameters without JA3/JA4. These handshake
parameters are the components used to generate the JA4 hash, thus it
makes sense for it to be a user of HandshakeParams.
13 files changed:
rust/src/handshake.rs [new file with mode: 0644]
rust/src/ja4.rs
rust/src/lib.rs
rust/src/quic/detect.rs
rust/src/quic/frames.rs
rust/src/quic/logger.rs
rust/src/quic/quic.rs
src/Makefile.am
src/app-layer-ssl.c
src/app-layer-ssl.h
src/detect-ja4-hash.c
src/output-json-tls.c
src/util-ja4.h [deleted file]