From 4c12e664a49bb17a2e88a6a5e4f7921de6bff709 Mon Sep 17 00:00:00 2001
From: Pierre Lalet <pierre@droids-corp.org>
Date: Thu, 19 Jan 2023 22:12:55 +0100
Subject: [PATCH] Zeek: fix for 5.2

Fix provided on Github by @benjeems. See
<https://github.com/salesforce/ja3/issues/87>
---
 zeek/ivre/passiverecon/ja3.zeek | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/zeek/ivre/passiverecon/ja3.zeek b/zeek/ivre/passiverecon/ja3.zeek
index 64559ac154..1574675944 100644
--- a/zeek/ivre/passiverecon/ja3.zeek
+++ b/zeek/ivre/passiverecon/ja3.zeek
@@ -1,7 +1,7 @@
 # This file is part of IVRE.
 #
 # Copyright 2017 salesforce.com, inc.
-# Copyright 2018 - 2020 Pierre LALET <pierre@droids-corp.org>
+# Copyright 2018 - 2023 Pierre LALET <pierre@droids-corp.org>
 #
 # IVRE is free software: you can redistribute it and/or modify it
 # under the terms of the GNU General Public License as published by
@@ -85,12 +85,12 @@ const grease: set[int] = {
 
 event ssl_extension(c: connection, is_orig: bool, code: count, val: string) {
     if (is_orig) {
+        if (code in grease) {
+            return;
+        }
         if (! c?$ivreja3c) {
             c$ivreja3c = IvreJA3CStore();
         }
-        if (code in grease) {
-            next;
-        }
         c$ivreja3c$extensions[|c$ivreja3c$extensions|] = cat(code);
     }
     else {