tlslog: don't log as "resumed" without ServerHello

Don't log a session as "resumed" if a ServerHello record has not been
seen. This makes sure that incomplete TLS sessions where the ClientHello
contains a session ticket, is not logged as a session resumption.

diff --git a/src/log-tlslog.c b/src/log-tlslog.c
index 9ee272611c618566e8adf23effb0be840c3c3857..b9518aeaf1f581875dcab597170f97067ec2fc43 100644 (file)
--- a/src/log-tlslog.c
+++ b/src/log-tlslog.c
@@ -475,6 +475,7 @@ static int LogTlsLogger(ThreadVars *tv, void *thread_data, const Packet *p,
                been seen. */
             if ((ssl_state->server_connp.cert0_issuerdn == NULL) &&
                     (ssl_state->server_connp.cert0_subject == NULL) &&
+                    (ssl_state->flags & SSL_AL_FLAG_STATE_SERVER_HELLO) &&
                     ((ssl_state->flags & SSL_AL_FLAG_LOG_WITHOUT_CERT) == 0)) {
                 MemBufferWriteString(aft->buffer, " Session='resumed'");
             }