inliniac/suricata — pull request #904 by regit (2014-03-21 10:37:18+00:00)
Title: tls: fix problem with tls.store keyword

Pierre Chifflier pointed out that a rule like:
alert tls any any -> any any (msg:"TLS store"; tls.issuerdn:!"C=FR"; tls.store;)
was alerting but not storing the certificate. If the filter was
removed:
alert tls any any -> any any (msg:"TLS store"; tls.store;)
then tls.store is working as expected.

This was linked with fact that logging is only done once for a SSL
state. So without filter, once we have the info we can log and we
run the storage. But when there is a filter, we log and then there
is a filter analysis and alerting. And as logging as already be done
we don't enter in the logging function and there is no storage.

This patch forces the entrance in the log function when there is a
request for TLS storage. And it adds an exit in the logging function
to only do the storage part if the TLS state has already being logged.

This bug was introduced in 504f39ad aka "log-tls: convert to packet logger API"

Redmine ticket: https://redmine.openinfosecfoundation.org/issues/1151

PR builds:
- PR build: https://buildbot.suricata-ids.org/builders/regit/builds/124
- PR pcaps: https://buildbot.suricata-ids.org/builders/regit-pcap/builds/63