JA4 for TLS and QUIC -- v6

[satta]

Previous PR: #9598

Link to redmine ticket: https://redmine.openinfosecfoundation.org/issues/6379

Changes to previous PR:

• Rebase.
• Mention in documentation that JA4 hash is not derived from real data and does not match the other hashes.
• Unify checks for whether to update the JA4 state to always check whether a) we have a JA4 object and b) we are in a client hello.
• Update Redmine ticket link in commit message to correct format.

SV_BRANCH=pr/1426

[codecov]

Codecov Report

Merging #9634 (6920b87) into master (1a132f4) will increase coverage by 0.10%.
The diff coverage is 92.50%.

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #9634      +/-   ##
==========================================
+ Coverage   82.28%   82.39%   +0.10%     
==========================================
  Files         968      970       +2     
  Lines      274275   274720     +445     
==========================================
+ Hits       225700   226346     +646     
+ Misses      48575    48374     -201     

Flag	Coverage Δ
fuzzcorpus	64.63% <65.09%> (+0.29%)	⬆️
suricata-verify	61.01% <85.64%> (+0.08%)	⬆️
unittests	62.88% <64.79%> (+0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

[catenacyber]

Thanks for the work Sascha :-)

• CI : green
• Code : ok for me
• Commits segmentation : Ok
• Commit messages : Ok, thanks
• Git ID set : looks fine for me
• CLA : you already contributed :-)
• Doc update : Ok
• Redmine ticket : ok
• Rustfmt : ok
• Tests : Suricata-verify tests still looks fine
• Dependencies added: none

[jasonish]

Just a note that there are questions with respect to the license and patent here. It should be made more clear if JA4 falls under patent restrictions soon: FoxIO-LLC/ja4#15 (or if its just JA4+).

[john-althouse]

Just a note that there are questions with respect to the license and patent here. It should be made more clear if JA4 falls under patent restrictions soon: FoxIO-LLC/ja4#15 (or if its just JA4+).

I've updated the thread and readme, there are no patent restrictions for JA4. Thanks for working on this!

[satta]

New PR: #10095