salesforce / ja3

JA3 is a standard for creating SSL client fingerprints in an easy to produce and shareable way.

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

ERROR - next statement used outside of for or while statement

benjeems opened this issue · comments

A next statement in the ja3.zeek errors out in Zeek v5.2 and above. It should be a return statement.

From https://github.com/zeek/zeek/blob/master/NEWS:

  • Usage of break and next statements is now validated. It was previously
    possible to place these outside of for, while or switch
    statements without any error indication.

Output when running the package errors out:
error in ./ja3/zeek/./ja3.zeek, line 69: next statement used outside of for or while statement

Offending code:
event ssl_extension(c: connection, is_orig: bool, code: count, val: string)
{
if ( ! c?$tlsfp )
c$tlsfp=TLSFPStorage();
if ( is_orig == T ) {
if ( code in grease ) {
next;
}
...

commented

Nice catch!

This can be closed now that #90 has been merged. Thanks @benjeems and @mmguero and @Cable-2-5 .

I use zeek version 6 with '@load ja3' since 1 year without problem.
Yesterday I added the ja4 folder from https://github.com/FoxIO-LLC/ja4/tree/main/zeek, and added the @load ja4 to the local.zeek file.
I also upgraded zeek to reach the zeek 6.1.0
Without rebooting the Ubuntu, I could extract all zeek logs correctly, including ja3 + ja4 fingerprint values
Today after a reboot of my laptop, the extraction crash and ja3 gives the error "error in ./ja3.zeek, line 69: next statement used outside of for or while statement. (next )"
if I comment @load ja3, the extraction works well with ja4 ...
If I comment @load ja4 to let only the @load ja3 (initial situation before usage of ja4 yesterday) the error persist ...
It means I cannot go back to my working version , even ja4 is not used ....

The environment is Ubuntu 22.04.3 LTS under WSL in Windows 11