Quic ietf 4967 v9

[catenacyber]

Link to redmine ticket:
https://redmine.openinfosecfoundation.org/issues/4967
https://redmine.openinfosecfoundation.org/issues/5143
https://redmine.openinfosecfoundation.org/issues/5166

Describe changes:

• Parses standardized QUIC IETF v1
• bump up rust carte tls_parser already used by rep, so that it can be used by quic
• Rustfmt previous code

suricata-verify-pr: 783
OISF/suricata-verify#783

Replaces #7130 with review :

• log ja3 as is done in tls (object with string and hash)
• add events and rules on them
• improve parsing of old versions so as not to get decode errors
• remove quic.ja3 keyword and use generic ja3.string keyword instead for quic

Still to do more generally about quic : see https://redmine.openinfosecfoundation.org/issues/4966 (frame support)

[codecov]

Codecov Report

Merging #7144 (ebb4556) into master (3a490fb) will increase coverage by 0.05%.
The diff coverage is 54.83%.

@@            Coverage Diff             @@
##           master    #7144      +/-   ##
==========================================
+ Coverage   78.06%   78.12%   +0.05%     
==========================================
  Files         628      628              
  Lines      185266   185296      +30     
==========================================
+ Hits       144635   144761     +126     
+ Misses      40631    40535      -96     

Flag	Coverage Δ
fuzzcorpus	60.24% <23.33%> (+0.25%)	⬆️
suricata-verify	54.55% <48.38%> (-0.05%)	⬇️
unittests	63.11% <14.28%> (-0.01%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

[suricata-qa]

Information:

field	test	baseline	%
	tlpw1_stats_chk
.app_layer.error.quic.parser	1434	1810	79.23%
	tlpr1_stats_chk
.app_layer.tx.quic	713266	4198	16990.61%
.app_layer.error.quic.parser	26726	43951	60.81%

Pipeline 6580

[victorjulien]

Quick review comment: we should not have commits that introduce a feature quic.ja3 and then other that remove it again in a PR.

[victorjulien]

I see many "empty" version 0 txs, is that right?

{
  "timestamp": "2022-01-16T20:36:00.520099+0100",
  "flow_id": 2148421890797475,
  "pcap_cnt": 1146,
  "event_type": "quic",
  "src_ip": "192.168.0.30",
  "src_port": 54629,
  "dest_ip": "142.251.36.46",
  "dest_port": 443,
  "proto": "UDP",
  "quic": {
    "version": "0"
  }
}

Version distribution:

2356902 "0"
 319469 "1"
  26336 "faceb002"
  58647 "ff00001d"
   2754 "Q043"
    188 "Q046"

[catenacyber]

Quick review comment: we should not have commits that introduce a feature quic.ja3 and then other that remove it again in a PR.

Indeed.
I did so because I find it easier to review the diff between two versions of the PR (just look at the last commits)

Do you have some magic git command to do better ? (if I git diff the 2 branches, I also see the changes induced by the newest commits on master branch)

[catenacyber]

I see many "empty" version 0 txs, is that right?

I think these come from the packets with so-called short header for old versions. We should not make txs out of them.
I will fix this

[catenacyber]

Replaced by #7149