Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

quic: analyzer: Recognize and report unknown versions better

Browse source 
This makes the analyzer.log entry more informative by including the
actual version and also allows to handle this scenario in script land
if needed.
This commit is contained in:
Arne Welzel 2024-01-04 20:07:18 +01:00
parent 727091ed67
commit 50cdac922f
5 changed files with 26 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

2
src/analyzer/protocol/quic/QUIC.evt
View file

@ -20,3 +20,5 @@ on QUIC::ZeroRTTPacket -> event QUIC::zero_rtt_packet($conn, $is_orig, self.head
on QUIC::ConnectionClosePayload -> event QUIC::connection_close_frame($conn, $is_orig, self.header.version, self.header.dest_conn_id, self.header.src_conn_id,
self.error_code.result, self.reason_phrase);
on QUIC::UnhandledVersion -> event QUIC::unhandled_version($conn, $is_orig, self.header.version, self.header.dest_conn_id, self.header.src_conn_id);