Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

quic: Log client's source connection id, too.

Browse source 
Seem reasonable give we log the server SCID. Interestingly, the Chromium
examples actually have zero length (empty) source connection IDs. I wonder
if that's part of their "protocol ossification avoidance" effort.
This commit is contained in:
Arne Welzel 2024-01-26 20:32:04 +01:00
parent 33acfdc630
commit 1c516f738c
13 changed files with 43 additions and 37 deletions
Download patch file Download diff file Expand all files Collapse all files

9
scripts/base/protocols/quic/main.zeek
View file

@ -27,10 +27,13 @@ export {
## by client and server.
client_initial_dcid: string &log &optional;
## Client's Source Connection ID from the first INITIAL packet.
client_scid: string &log &optional;
## Server chosen Connection ID usually from server's first
## INITIAL packet. This is to be used by the client in
## subsequent packets.
server_scid: string &log &optional;
server_scid: string &log &optional;
## Server name extracted from SNI extension in ClientHello
## packet if available.
@ -122,7 +125,9 @@ function set_session(c: connection, is_orig: bool, version: count, dcid: string,
if ( is_orig && |dcid| > 0 && ! c$quic?$client_initial_dcid )
c$quic$client_initial_dcid = bytestring_to_hexstr(dcid);
if ( ! is_orig && |scid| > 0 )
if ( is_orig )
c$quic$client_scid = bytestring_to_hexstr(scid);
else
c$quic$server_scid = bytestring_to_hexstr(scid);
}