static int JsonTlsLogger(ThreadVars *tv, void *thread_data, const Packet *p)
{
JsonTlsLogThread *aft = (JsonTlsLogThread *)thread_data;
MemBuffer *buffer = (MemBuffer *)aft->buffer;
OutputTlsCtx *tls_ctx = aft->tlslog_ctx;
if (unlikely(p->flow == NULL)) {
return 0;
}
/* check if we have TLS state or not */
FLOWLOCK_WRLOCK(p->flow);
uint16_t proto = FlowGetAppProtocol(p->flow);
if (proto != ALPROTO_TLS)
goto end;
SSLState *ssl_state = (SSLState *)FlowGetAppState(p->flow);
if (unlikely(ssl_state == NULL)) {
goto end;
}
if (ssl_state->server_connp.cert0_issuerdn == NULL || ssl_state->server_connp.cert0_subject == NULL)
goto end;
json_t *js = CreateJSONHeader((Packet *)p, 0, "tls");//TODO
if (unlikely(js == NULL))
goto end;
json_t *tjs = json_object();
if (tjs == NULL) {
free(js);
goto end;
}
/* reset */
MemBufferReset(buffer);
JsonTlsLogJSONBasic(tjs, ssl_state);
if (tls_ctx->flags & LOG_TLS_EXTENDED) {
JsonTlsLogJSONExtended(tjs, ssl_state);
}
json_object_set_new(js, "tls", tjs);
OutputJSONBuffer(js, tls_ctx->file_ctx, buffer);
json_object_clear(js);
json_decref(js);
/* we only log the state once */
ssl_state->flags |= SSL_AL_FLAG_STATE_LOGGED;
end:
FLOWLOCK_UNLOCK(p->flow);
return 0;
}
static void AlertJsonTls(const Flow *f, json_t *js)
{
SSLState *ssl_state = (SSLState *)FlowGetAppState(f);
if (ssl_state) {
json_t *tjs = json_object();
if (unlikely(tjs == NULL))
return;
JsonTlsLogJSONBasic(tjs, ssl_state);
JsonTlsLogJSONExtended(tjs, ssl_state);
json_object_set_new(js, "tls", tjs);
}
return;
}
static int JsonTlsLogger(ThreadVars *tv, void *thread_data, const Packet *p,
Flow *f, void *state, void *txptr, uint64_t tx_id)
{
JsonTlsLogThread *aft = (JsonTlsLogThread *)thread_data;
OutputTlsCtx *tls_ctx = aft->tlslog_ctx;
SSLState *ssl_state = (SSLState *)state;
if (unlikely(ssl_state == NULL)) {
return 0;
}
if (ssl_state->server_connp.cert0_issuerdn == NULL ||
ssl_state->server_connp.cert0_subject == NULL)
return 0;
json_t *js = CreateJSONHeader((Packet *)p, 0, "tls");
if (unlikely(js == NULL))
return 0;
json_t *tjs = json_object();
if (tjs == NULL) {
free(js);
return 0;
}
/* reset */
MemBufferReset(aft->buffer);
JsonTlsLogJSONBasic(tjs, ssl_state);
if (tls_ctx->flags & LOG_TLS_EXTENDED) {
JsonTlsLogJSONExtended(tjs, ssl_state);
}
json_object_set_new(js, "tls", tjs);
OutputJSONBuffer(js, tls_ctx->file_ctx, &aft->buffer);
json_object_clear(js);
json_decref(js);
return 0;
}