From 6d4cc39c02156999304338aec71aefde75333567 Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Tue, 23 Aug 2022 11:24:41 +0200 Subject: [PATCH] eve/tls: prepare for client cert logging Code cleanups that work on per direction "connp" instead of hard coding to the server side. --- src/output-json-tls.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/src/output-json-tls.c b/src/output-json-tls.c index 485932b170..972ce02c1e 100644 --- a/src/output-json-tls.c +++ b/src/output-json-tls.c @@ -255,13 +255,13 @@ static void JsonTlsLogJa3S(JsonBuilder *js, SSLState *ssl_state) } } -static void JsonTlsLogCertificate(JsonBuilder *js, SSLState *ssl_state) +static void JsonTlsLogCertificate(JsonBuilder *js, SSLStateConnp *connp) { - if (TAILQ_EMPTY(&ssl_state->server_connp.certs)) { + if (TAILQ_EMPTY(&connp->certs)) { return; } - SSLCertsChain *cert = TAILQ_FIRST(&ssl_state->server_connp.certs); + SSLCertsChain *cert = TAILQ_FIRST(&connp->certs); if (cert == NULL) { return; } @@ -269,16 +269,16 @@ static void JsonTlsLogCertificate(JsonBuilder *js, SSLState *ssl_state) jb_set_base64(js, "certificate", cert->cert_data, cert->cert_len); } -static void JsonTlsLogChain(JsonBuilder *js, SSLState *ssl_state) +static void JsonTlsLogChain(JsonBuilder *js, SSLStateConnp *connp) { - if (TAILQ_EMPTY(&ssl_state->server_connp.certs)) { + if (TAILQ_EMPTY(&connp->certs)) { return; } jb_open_array(js, "chain"); SSLCertsChain *cert; - TAILQ_FOREACH(cert, &ssl_state->server_connp.certs, next) { + TAILQ_FOREACH (cert, &connp->certs, next) { jb_append_base64(js, cert->cert_data, cert->cert_len); } @@ -338,11 +338,11 @@ static void JsonTlsLogJSONCustom(OutputTlsCtx *tls_ctx, JsonBuilder *js, /* tls certificate */ if (tls_ctx->fields & LOG_TLS_FIELD_CERTIFICATE) - JsonTlsLogCertificate(js, ssl_state); + JsonTlsLogCertificate(js, &ssl_state->server_connp); /* tls chain */ if (tls_ctx->fields & LOG_TLS_FIELD_CHAIN) - JsonTlsLogChain(js, ssl_state); + JsonTlsLogChain(js, &ssl_state->server_connp); /* tls ja3_hash */ if (tls_ctx->fields & LOG_TLS_FIELD_JA3) -- 2.47.2