From: Sascha Steinbiss <satta@debian.org>
Date: Fri, 27 Sep 2024 09:24:26 +0000 (+0200)
Subject: tls: do not break custom fields when enabling JA4
X-Git-Tag: suricata-7.0.7~2
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=38bb31e5f68984814d4f8c987d4e5c6ce904133e;p=thirdparty%2Fsuricata.git

tls: do not break custom fields when enabling JA4

Ticket: 7286
---

diff --git a/src/output-json-tls.c b/src/output-json-tls.c
index 88d6bdbda0..c91e80863f 100644
--- a/src/output-json-tls.c
+++ b/src/output-json-tls.c
@@ -592,7 +592,7 @@ static OutputTlsCtx *OutputTlsInitCtx(ConfNode *conf)
     /* In 7.0.x, ja4 hash is only logged when requested */
     const char *ja4 = ConfNodeLookupChildValue(conf, "ja4");
     if (ja4 && ConfValIsTrue(ja4)) {
-        tls_ctx->fields = LOG_TLS_FIELD_JA4;
+        tls_ctx->fields |= LOG_TLS_FIELD_JA4;
     }
 
     const char *session_resumption = ConfNodeLookupChildValue(conf, "session-resumption");