Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Merge branch 'topic/christian/quic-history-u'

Browse source 
* topic/christian/quic-history-u:
  Add "U" to QUIC history docstrings and expand version string docs
This commit is contained in:
Christian Kreibich 2025-03-31 09:37:02 -07:00
commit f068f0da4f
4 changed files with 12 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

4
CHANGES
View file

@ -1,3 +1,7 @@
7.2.0-dev.451 | 2025-03-31 09:37:02 -0700
* GH-3526: Add "U" to QUIC history docstrings and expand version string docs (Christian Kreibich, Corelight)
7.2.0-dev.449 | 2025-03-31 15:08:05 +0200 7.2.0-dev.449 | 2025-03-31 15:08:05 +0200
* Use one-based index in warning message (Benjamin Bannier, Corelight) * Use one-based index in warning message (Benjamin Bannier, Corelight)

2
VERSION
View file

@ -1 +1 @@
7.2.0-dev.449 7.2.0-dev.451

3
scripts/base/protocols/quic/consts.zeek
View file

@ -1,6 +1,9 @@
module QUIC; module QUIC;
export { export {
## A mapping from QUIC's raw version numbers to readable strings.
## Unexpected versions become "unknown-<hex>", with a hexadecimal
## rendering of the version number.
const version_strings: table[count] of string = { const version_strings: table[count] of string = {
[0x00000001] = "1", [0x00000001] = "1",
[0x6b3343cf] = "quicv2", [0x6b3343cf] = "quicv2",

6
scripts/base/protocols/quic/main.zeek
View file

@ -1,4 +1,4 @@
##! Initial idea for a quic.log. ##! Implements base functionality for QUIC analysis. Generates quic.log.
@load base/frameworks/notice/weird @load base/frameworks/notice/weird
@load base/protocols/conn/removal-hooks @load base/protocols/conn/removal-hooks
@ -19,7 +19,8 @@ export {
id: conn_id &log; id: conn_id &log;
## QUIC version as found in the first INITIAL packet from ## QUIC version as found in the first INITIAL packet from
## the client. ## the client. This will often be "1" or "quicv2", but see
## the :zeek:see:`QUIC::version_strings` table for details.
version: string &log; version: string &log;
## First Destination Connection ID used by client. This is ## First Destination Connection ID used by client. This is
@ -57,6 +58,7 @@ export {
## R RETRY packet ## R RETRY packet
## C CONNECTION_CLOSE packet ## C CONNECTION_CLOSE packet
## S SSL Client/Server Hello ## S SSL Client/Server Hello
## U Unfamiliar QUIC version
## ====== ==================================================== ## ====== ====================================================
history: string &log &default=""; history: string &log &default="";