Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

quic: Squashed follow-ups: quic.log, tests, various fixes, performance

Browse source
This commit is contained in:
Arne Welzel 2023-08-15 16:14:42 +02:00
parent 44d7c45723
commit 359f8d2ae6
65 changed files with 1194 additions and 532 deletions
Download patch file Download diff file Expand all files Collapse all files

21
src/analyzer/protocol/quic/QUIC.evt
View file

@ -1,10 +1,19 @@
protocol analyzer spicy::QUIC over UDP:
protocol analyzer QUIC over UDP:
parse originator with QUIC::RequestFrame,
parse responder with QUIC::ResponseFrame,
ports { 443/udp };
parse responder with QUIC::ResponseFrame;
import QUIC;
import Zeek_QUIC;
# TODO: Add actual events, instead of this dummy event
on QUIC::ResponseFrame -> event QUIC::example($conn);
# Make the enum available.
export QUIC::LongPacketType;
on QUIC::InitialPacket -> event QUIC::initial_packet($conn, $is_orig, self.header.version, self.header.dest_conn_id, self.header.src_conn_id);
on QUIC::RetryPacket -> event QUIC::retry_packet($conn, $is_orig, self.header.version, self.header.dest_conn_id, self.header.src_conn_id, self.retry_token, self.integrity_tag);
on QUIC::HandshakePacket -> event QUIC::handshake_packet($conn, $is_orig, self.header.version, self.header.dest_conn_id, self.header.src_conn_id);
on QUIC::ZeroRTTPacket -> event QUIC::zero_rtt_packet($conn, $is_orig, self.header.version, self.header.dest_conn_id, self.header.src_conn_id);
on QUIC::ConnectionClosePayload -> event QUIC::connection_close_frame($conn, $is_orig, self.header.version, self.header.dest_conn_id, self.header.src_conn_id,
self.error_code.result, self.reason_phrase);