output/eve: add 'verdict' field to 'alert' and 'drop' events - v9

[jufajardini]

Link to redmine ticket:
https://redmine.openinfosecfoundation.org/issues/5464

Previous PR: #9162

Describe changes from previous PR:

• remove changes for adding verdict as new eve type
• change packet->action to PASS when a pass rule matches for a packet (this wasn't done anywhere, so verdict.action: pass never showed up
• take into account proto to decide on verdict.reject
• make verdict.reject an array instead of a string (json)
• incorporate other feedbacks from previous PR

SV_BRANCH=pr/1308

OISF/suricata-verify#1308

Some output samples:

# IPS mode, reject rule, TCP-reset
  "event_type": "alert",
  "src_ip": "10.16.1.11",
  "src_port": 54186,
  "dest_ip": "82.165.177.154",
  "dest_port": 80,
  "proto": "TCP",
  "pkt_src": "wire/pcap",
  "alert": {
    "action": "blocked",
    "gid": 1,
    "signature_id": 2,
    "rev": 1,
    "signature": "",
    "category": "",
    "severity": 3
  },
  "verdict": {
    "action": "drop",
    "reject_target": "destination",
    "reject": [
      "tcp-reset"
    ]
  }
# packet with alert and pass rules triggered:
{
 "event_type": "alert",
  "verdict": {
    "action": "pass"
  }
}

[codecov]

Codecov Report

Merging #9216 (40d30ed) into master (690b65a) will increase coverage by 0.03%.
The diff coverage is 97.72%.

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #9216      +/-   ##
==========================================
+ Coverage   82.36%   82.39%   +0.03%     
==========================================
  Files         968      968              
  Lines      273761   273803      +42     
==========================================
+ Hits       225470   225612     +142     
+ Misses      48291    48191     -100     

Flag	Coverage Δ
fuzzcorpus	64.66% <9.09%> (+0.01%)	⬆️
suricata-verify	60.83% <97.72%> (+0.07%)	⬆️
unittests	62.88% <0.00%> (-0.01%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

[suricata-qa]

Information: QA ran without warnings.

Pipeline 15124

[victorjulien]

hmm we had done quite a nice cleanup before, removing the flag from the Packet::action. Since it is only for logging, I wonder if we can keep it out of this field to make clear it's not used otherwise.

[jufajardini]

hmm we had done quite a nice cleanup before, removing the flag from the Packet::action. Since it is only for logging, I wonder if we can keep it out of this field to make clear it's not used otherwise.

Would it make sense to have a field for the verdict itself? I can try to access the last packet alert in the queue, which should be the one with the pass rule... 🤔

[victorjulien]

That last "empty" alert to just log verdict feels wrong to me. Maybe this is where we'd use the verdict event type.

[jufajardini]

Will update the SV tests that are currently failing with windows, I think I inadvertently removed a

requires:
  features:
    - LIBNET1.1

That must be there when we use reject

[jufajardini]

Trying a different approach for the empty alert: #9220