Merge pull request #1477 from p-l-/zeek-52

Zeek: fix for 5.2
ivre · Jan 20, 2023 · 583a2ab · 583a2ab
2 parents 5f67435 + 4c12e66
commit 583a2ab
Showing 1 changed file with 4 additions and 4 deletions.
diff --git a/zeek/ivre/passiverecon/ja3.zeek b/zeek/ivre/passiverecon/ja3.zeek
@@ -1,7 +1,7 @@
 # This file is part of IVRE.
 #
 # Copyright 2017 salesforce.com, inc.
-# Copyright 2018 - 2020 Pierre LALET <pierre@droids-corp.org>
+# Copyright 2018 - 2023 Pierre LALET <pierre@droids-corp.org>
 #
 # IVRE is free software: you can redistribute it and/or modify it
 # under the terms of the GNU General Public License as published by
@@ -85,12 +85,12 @@ const grease: set[int] = {
 
 event ssl_extension(c: connection, is_orig: bool, code: count, val: string) {
     if (is_orig) {
+        if (code in grease) {
+            return;
+        }
         if (! c?$ivreja3c) {
             c$ivreja3c = IvreJA3CStore();
         }
-        if (code in grease) {
-            next;
-        }
         c$ivreja3c$extensions[|c$ivreja3c$extensions|] = cat(code);
     }
     else {