]> git.ipfire.org Git - thirdparty/suricata.git/commit
eve: only output ja3 and ja3s if present
authorEric Leblond <eric@regit.org>
Wed, 27 Jan 2021 10:38:34 +0000 (11:38 +0100)
committerVictor Julien <victor@inliniac.net>
Fri, 12 Feb 2021 13:52:32 +0000 (14:52 +0100)
commit730438943856e957032a38c11ca762bef73da1ef
tree43121d4b3d5e8578ef872e95e3a3218954c38e94
parentcbb03dbb39d76cf1a2770ef35ba07aac5c3657b5
eve: only output ja3 and ja3s if present

This will prevent JSON entries like the following that occur
with the dedault configuration (ja3 deactivated and extended
tls ouput activated):

  "tls": {
    "subject": "C=GB, ST=London, L=London, O=Global Security, OU=IT Department, CN=example.com",
    "issuerdn": "C=GB, ST=London, L=London, O=Global Security, OU=IT Department, CN=example.com",
    "serial": "00:9C:FC:DA:1D:A4:70:87:5D",
    "fingerprint": "b8:18:2d:cb:c9:f8:1a:66:75:13:18:31:24:e0:92:35:42:ab:96:89",
    "version": "TLSv1",
    "notbefore": "2020-05-03T11:07:28",
    "notafter": "2021-05-03T11:07:28",
    "ja3": {},
    "ja3s": {}
  }
src/output-json-tls.c