From 9e0355023033956f89b705592a15b237044cb534 Mon Sep 17 00:00:00 2001 From: Eric Leblond Date: Fri, 21 Mar 2014 11:15:47 +0100 Subject: [PATCH] tls: fix problem with tls.store keyword Pierre Chifflier pointed out that a rule like: alert tls any any -> any any (msg:"TLS store"; tls.issuerdn:!"C=FR"; tls.store;) was alerting but not storing the certificate. If the filter was removed: alert tls any any -> any any (msg:"TLS store"; tls.store;) then tls.store is working as expected. This was linked with fact that logging is only done once for a SSL state. So without filter, once we have the info we can log and we run the storage. But when there is a filter, we log and then there is a filter analysis and alerting. And as logging as already be done we don't enter in the logging function and there is no storage. This patch forces the entrance in the log function when there is a request for TLS storage. And it adds an exit in the logging function to only do the storage part if the TLS state has already being logged. --- src/log-tlslog.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/src/log-tlslog.c b/src/log-tlslog.c index 74be9fe75b..8589f8b2b9 100644 --- a/src/log-tlslog.c +++ b/src/log-tlslog.c @@ -495,8 +495,10 @@ static int LogTlsCondition(ThreadVars *tv, const Packet *p) { goto dontlog; } - /* we only log the state once */ - if (ssl_state->flags & SSL_AL_FLAG_STATE_LOGGED) + /* we only log the state once if we don't have to write + * the cert due to tls.store keyword. */ + if (!(ssl_state->server_connp.cert_log_flag & SSL_TLS_LOG_PEM) && + (ssl_state->flags & SSL_AL_FLAG_STATE_LOGGED)) goto dontlog; if (ssl_state->server_connp.cert0_issuerdn == NULL || @@ -540,6 +542,11 @@ static int LogTlsLogger(ThreadVars *tv, void *thread_data, const Packet *p) { LogTlsLogPem(aft, p, ssl_state, hlog, ipproto); } + /* Don't log again the state. If we are here it was because we had + * to store the cert. */ + if (ssl_state->flags & SSL_AL_FLAG_STATE_LOGGED) + goto end; + CreateTimeString(&p->ts, timebuf, sizeof(timebuf)); #define PRINT_BUF_LEN 46 char srcip[PRINT_BUF_LEN], dstip[PRINT_BUF_LEN];