tls: fix problem with tls.store keyword

Pierre Chifflier pointed out that a rule like:
 alert tls any any -> any any (msg:"TLS store"; tls.issuerdn:!"C=FR"; tls.store;)
was alerting but not storing the certificate. If the filter was
removed:
 alert tls any any -> any any (msg:"TLS store"; tls.store;)
then tls.store is working as expected.

This was linked with fact that logging is only done once for a SSL
state. So without filter, once we have the info we can log and we
run the storage. But when there is a filter, we log and then there
is a filter analysis and alerting. And as logging as already be done
we don't enter in the logging function and there is no storage.

This patch forces the entrance in the log function when there is a
request for TLS storage. And it adds an exit in the logging function
to only do the storage part if the TLS state has already being logged.

diff --git a/src/log-tlslog.c b/src/log-tlslog.c
index 74be9fe75b35cfc210569b979164e3e1519cb246..8589f8b2b991cddd6283b244259c06c0ff8b781a 100644 (file)
--- a/src/log-tlslog.c
+++ b/src/log-tlslog.c
@@ -495,8 +495,10 @@ static int LogTlsCondition(ThreadVars *tv, const Packet *p) {
         goto dontlog;
     }
 
-    /* we only log the state once */
-    if (ssl_state->flags & SSL_AL_FLAG_STATE_LOGGED)
+    /* we only log the state once if we don't have to write
+     * the cert due to tls.store keyword. */
+    if (!(ssl_state->server_connp.cert_log_flag & SSL_TLS_LOG_PEM) &&
+        (ssl_state->flags & SSL_AL_FLAG_STATE_LOGGED))
         goto dontlog;
 
     if (ssl_state->server_connp.cert0_issuerdn == NULL ||
@@ -540,6 +542,11 @@ static int LogTlsLogger(ThreadVars *tv, void *thread_data, const Packet *p) {
         LogTlsLogPem(aft, p, ssl_state, hlog, ipproto);
     }
 
+    /* Don't log again the state. If we are here it was because we had
+     * to store the cert. */
+    if (ssl_state->flags & SSL_AL_FLAG_STATE_LOGGED)
+        goto end;
+
     CreateTimeString(&p->ts, timebuf, sizeof(timebuf));
 #define PRINT_BUF_LEN 46
     char srcip[PRINT_BUF_LEN], dstip[PRINT_BUF_LEN];