From 52c665ab70dfaf693e2b2c0bddf4389cd30a3bff Mon Sep 17 00:00:00 2001
From: Seth Grover <mero.mero.guero@gmail.com>
Date: Tue, 14 Mar 2023 15:05:13 -0600
Subject: [PATCH] address salesforce/ja3#87 next statement used outside of for
 or while statement

---
 zeek/ja3.zeek | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/zeek/ja3.zeek b/zeek/ja3.zeek
index 9705858..1897e08 100644
--- a/zeek/ja3.zeek
+++ b/zeek/ja3.zeek
@@ -62,11 +62,12 @@ event zeek_init() {
 
 event ssl_extension(c: connection, is_orig: bool, code: count, val: string)
 {
-if ( ! c?$tlsfp )
-    c$tlsfp=TLSFPStorage();
     if ( is_orig == T ) {
         if ( code in grease ) {
-            next;
+            return;
+        }
+        if ( ! c?$tlsfp ){
+            c$tlsfp=TLSFPStorage();
         }
         if ( c$tlsfp$extensions == "" ) {
             c$tlsfp$extensions = cat(code);
@@ -77,11 +78,12 @@ if ( ! c?$tlsfp )
     }
 }
 
+
 event ssl_extension_ec_point_formats(c: connection, is_orig: bool, point_formats: index_vec)
 {
-if ( !c?$tlsfp )
-    c$tlsfp=TLSFPStorage();
     if ( is_orig == T ) {
+        if ( !c?$tlsfp )
+            c$tlsfp=TLSFPStorage();
         for ( i in point_formats ) {
             if ( point_formats[i] in grease ) {
             next;