From 04113b13d5de5b72037b404b91be480ebd93f5bc Mon Sep 17 00:00:00 2001
From: jeff-bb <38505668+jeff-bb@users.noreply.github.com>
Date: Fri, 20 Jan 2023 08:29:55 -0600
Subject: [PATCH] Avoid excessive fmt calls, return default behavior on unknown

Using "in" to query the language const. This also handles the case of not having a best guess and continue using the existing behavior.

Given
keyboard_layout = 1033 (0x0409), "keyboard-English - United States"
keyboard_layout = 66569 (0x00010409), "keyboard-English - United States (Best Guess)"
keyboard_layout = 12345 (0x3039), "keyboard-12345"
---
 scripts/base/protocols/rdp/main.zeek | 18 +++++++++++++-----
 1 file changed, 13 insertions(+), 5 deletions(-)

diff --git a/scripts/base/protocols/rdp/main.zeek b/scripts/base/protocols/rdp/main.zeek
index ea0222e167..310784073a 100644
--- a/scripts/base/protocols/rdp/main.zeek
+++ b/scripts/base/protocols/rdp/main.zeek
@@ -187,13 +187,21 @@ event rdp_client_core_data(c: connection, data: RDP::ClientCoreData) &priority=5
 	{
 	set_session(c);
 
-	c$rdp$keyboard_layout       = RDP::languages[data$keyboard_layout];
-	
-	if (c$rdp$keyboard_layout == fmt("keyboard-%d", data$keyboard_layout))
+	if (data$keyboard_layout in RDP::languages)
 		{
-		c$rdp$keyboard_layout = RDP::languages[data$keyboard_layout & 0xffff];
-		c$rdp$keyboard_layout = c$rdp$keyboard_layout + " (Best Guess)";
+		c$rdp$keyboard_layout = RDP::languages[data$keyboard_layout];
 		}
+	else
+		{
+		if (data$keyboard_layout & 0xffff in RDP::languages)
+			{
+			c$rdp$keyboard_layout = fmt("%s (Best Guess)", RDP::languages[data$keyboard_layout & 0xffff]);
+			}
+		else
+			{
+			c$rdp$keyboard_layout = fmt("keyboard-%d", data$keyboard_layout);
+			}
+	}
 	
 	c$rdp$client_build          = RDP::builds[data$client_build];
 	c$rdp$client_name           = data$client_name;