tls

var Decoder = &decoder.StreamDecoder{
	Type:        types.Type_NC_TLSCertificate,
	Name:        serviceTLS,
	Description: "Transport Layer Security certificates extracted from TLS handshakes",
	PostInit: func(d *decoder.StreamDecoder) error {
		var err error
		tlsLog, _, err = logging.InitZapLogger(
			decoderconfig.Instance.Out,
			"tls",
			decoderconfig.Instance.Debug,
		)
		return err
	},
	CanDecode: func(client, server []byte) bool {

		if len(client) >= 6 {

			if client[0] == recordTypeHandshake &&
				(client[1] == 0x03 && client[2] <= 0x04) {
				if len(client) >= 6 && client[5] == handshakeTypeClientHello {
					tlsLog.Info("TLS traffic detected - CanDecode matched (ClientHello)",
						zap.Int("clientLen", len(client)),
						zap.Int("serverLen", len(server)),
					)
					return true
				}
			}
		}

		if len(server) >= 6 {
			if server[0] == recordTypeHandshake &&
				(server[1] == 0x03 && server[2] <= 0x04) {
				if len(server) >= 6 && server[5] == handshakeTypeServerHello {
					tlsLog.Info("TLS traffic detected - CanDecode matched (ServerHello)",
						zap.Int("clientLen", len(client)),
						zap.Int("serverLen", len(server)),
					)
					return true
				}
			}
		}

		tlsLog.Debug("TLS CanDecode check failed",
			zap.Int("clientLen", len(client)),
			zap.Int("serverLen", len(server)),
		)
		return false
	},
	DeInit: func(sd *decoder.StreamDecoder) error {

		err := flushCertificates(sd)
		if err != nil {
			tlsLog.Error("Failed to flush certificates", zap.Error(err))
		}
		return tlsLog.Sync()
	},
	Factory: &tlsReader{},
	Typ:     core.TCP,
}