conn_key/fivetuple: Drop support for non conn_id records

Previously, we supported any records that happened to have orig_h,
resp_h, etc. fields, but it's not exactly clear why we ever did. Users
that relied on this can instantiate an explicit conn_id instance, too.
This commit is contained in:
Arne Welzel 2025-07-01 12:28:55 +02:00
parent f8eab9e9cf
commit 6eb0d4df32
2 changed files with 11 additions and 31 deletions

4
NEWS
View file

@ -16,6 +16,10 @@ Breaking Changes
files. We tested builds of all of the existing third-party packages and only noticed one
or two failures, but there is a possibility for breakage related to this cleanup.
- The ``lookup_connection()`` and ``connection_exists()`` builtin functions
now require ``conn_id`` instances as argument, rather than internally supporting
duck type matching ``conn_id``-like records.
- Network timestamps are not added to events by default anymore. Use the following
redef line to enable them: