Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Handle empty cookies in JA4H Zeek parsing #158

Merged
merged 5 commits into from
Sep 9, 2024

Conversation

Squiblydoo
Copy link
Contributor

This PR fixes a bug mentioned here: #123

After the sorting of the cookies and before building the JA4H string, it checks to see if the JA4H_c_r and JA4H_d_r values are empty, if so, it assigns the JA4H_c or _d values with twelve 0s; if they are not empty, it will hash them as normal.

I confirmed that this works as expected, see parsing of Zeek logs below:

Screenshot from 2024-09-02 11-39-40

The PR looks like I changed a lot more than this, but the other thing I changed was the indentation.
Some parts of this script contain 2 spaces for the first level indent, followed by a 4 spaces for the second level indent. This felt inconsistent and made it more difficult to modify the code than it should have.
Other parts of the code use 4 spaces for the first level indent, so I modified this section to fit that pattern. (I did not modify all places where two spaces were used, as it seemed out of scope.)

I confirmed that the use of 4 spaces for the first level indent did not impact functionality, and the script appears to be working as expected.

Added if statement to identify when the cookie in the Ja4h were empty when being parsed with Zeek
Temporarily reverting my own build script for pushing upstream.
@Squiblydoo
Copy link
Contributor Author

Oh , I just noticed that someone else suggested a similar fix 2 days ago: #157

@john-althouse john-althouse merged commit 0a5e76c into FoxIO-LLC:main Sep 9, 2024
4 checks passed
@john-althouse
Copy link
Collaborator

Thanks @Squiblydoo! I like your implementation better because it assigns the value of "000000000000" to ja4h_c and ja4h_d - which is better for if someone were to build extra Zeek scripts and call these values.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants