ssl: add TOO_MANY_SUBJECT_ALTERNATIVE_NAMES event

In case there are way too many SANs parsed in a TLS packet, flag it as
an anomaly instead of just dealing with it.

Ticket: 8864

rules/tls-events.rules

@@ -35,5 +35,6 @@ alert tls any any -> any any (msg:"SURICATA TLS certificate invalid subject"; fl
 alert tls any any -> any any (msg:"SURICATA TLS certificate invalid issuer"; flow:established; app-layer-event:tls.certificate_invalid_issuer; flowint:tls.anomaly.count,+,1; classtype:protocol-command-decode; sid:2230029; rev:1;)
 alert tls any any -> any any (msg:"SURICATA TLS certificate invalid validity"; flow:established; app-layer-event:tls.certificate_invalid_validity; flowint:tls.anomaly.count,+,1; classtype:protocol-command-decode; sid:2230030; rev:1;)
 alert tls any any -> any any (msg:"SURICATA TLS invalid alert message"; flow:established; app-layer-event:tls.invalid_alert_message; flowint:tls.anomaly.count,+,1; classtype:protocol-command-decode; sid:2230031; rev:1;)
+alert tls any any -> any any (msg:"SURICATA TLS certificate x509 too many subject alternative names"; flow:established; app-layer-event:tls.too_many_subject_alternative_names; flowint:tls.anomaly.count,+,1; classtype:protocol-command-decode; sid:2230032; rev:1;)
 
-#next sid is 2230032
+#next sid is 2230033

src/app-layer-ssl.c

@@ -161,6 +161,7 @@ SCEnumCharMap tls_decoder_event_table[] = {
     { "CERTIFICATE_INVALID_ISSUER", TLS_DECODER_EVENT_CERTIFICATE_INVALID_ISSUER },
     { "CERTIFICATE_INVALID_VALIDITY", TLS_DECODER_EVENT_CERTIFICATE_INVALID_VALIDITY },
     { "ERROR_MESSAGE_ENCOUNTERED", TLS_DECODER_EVENT_ERROR_MSG_ENCOUNTERED },
+    { "TOO_MANY_SUBJECT_ALTERNATIVE_NAMES", TLS_DECODER_EVENT_TOO_MANY_SUBJECT_ALTERNATIVE_NAMES },
     /* used as a generic error event */
     { "INVALID_SSL_RECORD", TLS_DECODER_EVENT_INVALID_SSL_RECORD },
     { NULL, -1 },
@@ -503,8 +504,12 @@ static int TlsDecodeHSCertificate(SSLState *ssl_state, SSLStateConnp *connp,
         }
 
         connp->cert0_sans_num = SCX509GetSubjectAltNameLen(x509);
+        if (connp->cert0_sans_num == TLS_MAX_SAN) {
+            SSLSetEvent(ssl_state, TLS_DECODER_EVENT_TOO_MANY_SUBJECT_ALTERNATIVE_NAMES);
+        }
         connp->cert0_sans = SCCalloc(connp->cert0_sans_num, sizeof(SSLSubjectAltName));
         if (connp->cert0_sans == NULL) {
+            connp->cert0_sans_num = 0;
             goto error;
         }
         for (uint16_t i = 0; i < connp->cert0_sans_num; i++) {

src/app-layer-ssl.h

@@ -72,6 +72,7 @@ enum {
     TLS_DECODER_EVENT_CERTIFICATE_INVALID_ISSUER,
     TLS_DECODER_EVENT_CERTIFICATE_INVALID_VALIDITY,
     TLS_DECODER_EVENT_ERROR_MSG_ENCOUNTERED,
+    TLS_DECODER_EVENT_TOO_MANY_SUBJECT_ALTERNATIVE_NAMES,
     TLS_DECODER_EVENT_INVALID_SSL_RECORD,
 };