From 38bb31e5f68984814d4f8c987d4e5c6ce904133e Mon Sep 17 00:00:00 2001
From: Sascha Steinbiss <satta@debian.org>
Date: Fri, 27 Sep 2024 11:24:26 +0200
Subject: [PATCH] tls: do not break custom fields when enabling JA4

Ticket: 7286
---
 src/output-json-tls.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/output-json-tls.c b/src/output-json-tls.c
index 88d6bdbda0..c91e80863f 100644
--- a/src/output-json-tls.c
+++ b/src/output-json-tls.c
@@ -592,7 +592,7 @@ static OutputTlsCtx *OutputTlsInitCtx(ConfNode *conf)
     /* In 7.0.x, ja4 hash is only logged when requested */
     const char *ja4 = ConfNodeLookupChildValue(conf, "ja4");
     if (ja4 && ConfValIsTrue(ja4)) {
-        tls_ctx->fields = LOG_TLS_FIELD_JA4;
+        tls_ctx->fields |= LOG_TLS_FIELD_JA4;
     }
 
     const char *session_resumption = ConfNodeLookupChildValue(conf, "session-resumption");
-- 
2.47.2