diff --git a/CHANGES b/CHANGES index e2025f36f5..653b57bcd9 100644 --- a/CHANGES +++ b/CHANGES @@ -1,3 +1,7 @@ +7.0.0-dev.284 | 2024-05-24 15:04:27 -0700 + + * Fix Zeekygen warning for QUIC::unrecognized_version event (Christian Kreibich, Corelight) + 7.0.0-dev.282 | 2024-05-24 10:49:31 -0700 * Update TLS consts, mainly new named curves. (Johanna Amann, Corelight) diff --git a/VERSION b/VERSION index a82b0b68eb..6085bd44c0 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -7.0.0-dev.282 +7.0.0-dev.284 diff --git a/scripts/base/protocols/quic/spicy-events.zeek b/scripts/base/protocols/quic/spicy-events.zeek index 5856ae5aa8..914c0d2f16 100644 --- a/scripts/base/protocols/quic/spicy-events.zeek +++ b/scripts/base/protocols/quic/spicy-events.zeek @@ -80,3 +80,17 @@ global QUIC::zero_rtt_packet: event(c: connection, is_orig: bool, version: count ## ## .. note:: Packets with CONNECTION_CLOSE frames are usually encrypted after connection establishment and not visible to Zeek. global QUIC::connection_close_frame: event(c: connection, is_orig: bool, version: count, dcid: string, scid: string, error_code: count, reason_phrase: string); + + +## Generated for an unrecognized QUIC version. +## +## c: The connection. +## +## is_orig: True if the packet is from the the connection's originator. +## +## version: The Version field. +## +## dcid: The Destination Connection ID field. +## +## scid: The Source Connection ID field. +global QUIC::unhandled_version: event(c: connection, is_orig: bool, version: count, dcid: string, scid: string);