SG 42bf41aca1 check for the existance of f?$conns in file_sniff event in policy/protocols/ssl/log-hostcerts-only.zeek ... In using the corelight/bro-xor-exe-plugin (https://github.com/corelight/bro-xor-exe-plugin) I noticed this error when running the PCAP trace file in its tests directory: 1428602842.525435 expression error in /opt/zeek/share/zeek/policy/protocols/ssl/log-hostcerts-only.zeek, line 44: field value missing (X509::f$conns) Examining log-hostcerts-only.zeek, I saw that although f$conns is being checked for length, it's not being checked to see if it exists first. This commit changes "if ( |f$conns| != 1 )" to "if (( ! f?$conns ) || ( |f$conns| != 1 ))" so that the script returns if there is no f$conns field. In my local testing, this seems to fix the error. My testing was being done with v3.0.5, but I think this patch can be applied to both the 3.0.x and 3.1.x branches.		2020-04-16 10:19:59 -06:00
..
base	Merge remote-tracking branch 'origin/topic/jsiwek/alternate-hook-event-prototypes'	2020-04-13 15:00:25 -07:00
policy	check for the existance of f?$conns in file_sniff event in policy/protocols/ssl/log-hostcerts-only.zeek	2020-04-16 10:19:59 -06:00
site	Stop loading scan detection in local.zeek by default	2019-09-16 10:51:50 -07:00
zeekygen	Merge branch 'topic/jgras/dpd-late-match' of https://github.com/J-Gras/zeek	2019-09-17 11:17:41 -07:00
CMakeLists.txt	No longer symlink local.zeek to local.bro.	2020-01-29 12:08:10 +00:00
test-all-policy.zeek	Merge branch 'topic/jgras/dpd-late-match' of https://github.com/J-Gras/zeek	2019-09-17 11:17:41 -07:00