fix low tshark version use oid

tshark 3.2.3 use x509if_x509if_id
FoxIO-LLC · Nov 20, 2023 · 59765f1 · 59765f1
1 parent 75f1f98
commit 59765f1
Showing 1 changed file with 4 additions and 1 deletion.
diff --git a/python/ja4.py b/python/ja4.py
@@ -373,7 +373,10 @@ def layer_update(x, pkt, layer):
     if layer == 'x509af' and l:
         [ x.update({key: l[f'tls_tls_{item}']}) for key, item in keymap['tls'].items() if f'tls_tls_{item}' in l ]
         x.update({'issuer_sequence': l['x509if_x509if_rdnSequence']}) if 'x509if_x509if_rdnSequence' in l else None
-        x.update({'rdn_oids': l['x509if_x509if_id']}) if 'x509if_x509if_id' in l else None
+        if 'x509if_x509if_id' in l:
+            x.update({'rdn_oids':l['x509if_x509if_id']})
+        if 'x509if_x509if_oid' in l:
+            x.update({'rdn_oids':l['x509if_x509if_oid']})
         x.update({'printable_certs': l['x509sat_x509sat_printableString']}) if 'x509sat_x509sat_printableString' in l else None
 
     # Some extension types are a list bug #29