Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Add "U" to QUIC history docstrings and expand version string docs

Browse source 
Looks like we overlooked documenting "U" in zeek/zeek#3526 .
This commit is contained in:
Christian Kreibich 2025-03-27 13:21:06 -07:00
parent 656e88eaa8
commit 98c203b8cb
2 changed files with 7 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

3
scripts/base/protocols/quic/consts.zeek
View file

@ -1,6 +1,9 @@
module QUIC; module QUIC;
export { export {
## A mapping from QUIC's raw version numbers to readable strings.
## Unexpected versions become "unknown-<hex>", with a hexadecimal
## rendering of the version number.
const version_strings: table[count] of string = { const version_strings: table[count] of string = {
[0x00000001] = "1", [0x00000001] = "1",
[0x6b3343cf] = "quicv2", [0x6b3343cf] = "quicv2",

6
scripts/base/protocols/quic/main.zeek
View file

@ -1,4 +1,4 @@
##! Initial idea for a quic.log. ##! Implements base functionality for QUIC analysis. Generates quic.log.
@load base/frameworks/notice/weird @load base/frameworks/notice/weird
@load base/protocols/conn/removal-hooks @load base/protocols/conn/removal-hooks
@ -19,7 +19,8 @@ export {
id: conn_id &log; id: conn_id &log;
## QUIC version as found in the first INITIAL packet from ## QUIC version as found in the first INITIAL packet from
## the client. ## the client. This will often be "1" or "quicv2", but see
## the :zeek:see:`QUIC::version_strings` table for details.
version: string &log; version: string &log;
## First Destination Connection ID used by client. This is ## First Destination Connection ID used by client. This is
@ -57,6 +58,7 @@ export {
## R RETRY packet ## R RETRY packet
## C CONNECTION_CLOSE packet ## C CONNECTION_CLOSE packet
## S SSL Client/Server Hello ## S SSL Client/Server Hello
## U Unfamiliar QUIC version
## ====== ==================================================== ## ====== ====================================================
history: string &log &default=""; history: string &log &default="";