From 6736a0c4571783263a26ac8ed973a1a66ad8dc1b Mon Sep 17 00:00:00 2001
From: Ryan Victory <ryan@beerandraptors.com>
Date: Wed, 17 Jun 2020 10:41:33 -0500
Subject: [PATCH] Stricter checking if we have a dns field on the connection
 being processed

---
 scripts/policy/protocols/dns/log-original-query-case.zeek | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/policy/protocols/dns/log-original-query-case.zeek b/scripts/policy/protocols/dns/log-original-query-case.zeek
index a6213f4364..acf289dd01 100644
--- a/scripts/policy/protocols/dns/log-original-query-case.zeek
+++ b/scripts/policy/protocols/dns/log-original-query-case.zeek
@@ -14,6 +14,6 @@ export {
 
 event dns_request(c: connection, msg: dns_msg, query: string, qtype: count, qclass: count, original_query: string)
     {
-    if ( ! c$dns?$original_query )
+    if ( c?$dns && ! c$dns?$original_query )
         c$dns$original_query = original_query;
     }
\ No newline at end of file