Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1
19623 commits 387 branches 195 tags 255 MiB
Commit graph

9 commits

Author SHA1 Message Date
Klemens Nanni
397f7e5c0e Parse SVCB/HTTPS SvcParams list 
Add full support for RFC 9460's SvcParams list.

Amend the existing `dns_svcb_rr` record by a vector of new
`dns_svcb_param` records containing aptly typed SvcParamKey and
SvcParamValue pairs.  Example output:

```
@load base/protocols/dns
event dns_HTTPS( c: connection , msg: dns_msg , ans: dns_answer , https: dns_svcb_rr ) {
	for (_, param in https$svc_params)
		print to_json(param);  # filter uninitialised values
}
```

```
$ dig https cloudflare-ech.com +short | tr [:space:] \\n
1
.
alpn="h3,h2"
ipv4hint=104.18.10.118,104.18.11.118
ech=AEX+DQBBHgAgACBGL2e9TiFwjK/w1Zg9AmRm7mgXHz3PjffP0mTFNMxmDQAEAAEAAQASY2xvdWRmbGFyZS1lY2guY29tAAA=
ipv6hint=2606:4700::6812:a76,2606:4700::6812:b76
```

```
{"key":1,"alpn":["h3","h2"]}
{"key":4,"hint":["104.18.10.118","104.18.11.118"]}
{"key":5,"ech":"AEX+DQBBHgAgACBGL2e9TiFwjK/w1Zg9AmRm7mgXHz3PjffP0mTFNMxmDQAEAAEAAQASY2xvdWRmbGFyZS1lY2guY29tAAA="}
{"key":6,"hint":["2606:4700::6812:a76","2606:4700::6812:b76"]}
```

Values with malformed data or belonging to invalid/reserved keys
are passed raw bytes in network order for script-level inspection.

Follow up to "Initial Support to DNS SVCB/HTTPS RR"
https://github.com/zeek/zeek/pull/1808
 2025-09-03 09:53:55 +03:00
Tim Wojtulewicz
c9610ec45b Update DNS type strings to match correct mappings 2022-11-02 14:22:46 -07:00
Johanna Amann
303e84ad86 Merge branch 'master' of https://github.com/FlyingWithJerome/zeek 
Merge includes small changes, e.g. fixing the comsumption of remaining
raw data.

* 'master' of https://github.com/FlyingWithJerome/zeek:
  remove excussive fields in dns_svcb_rr
  address code reviews (formatting and type and intrusiveptr)
  newlines at the end of test outputs
  lazy commit
  use tabs in init-bare.zeek
  add svcb test case
  add a dns https test case
  remove test logs
  fix a few syntax errors
  initial commit for SVCB/HTTPS records
 2021-10-19 15:03:08 +02:00
FlyingWithJerome
c957e3e91e address code reviews (formatting and type and intrusiveptr) 2021-10-12 20:36:35 -04:00
FlyingWithJerome
8fce51bf83 initial commit for SVCB/HTTPS records 2021-10-12 17:43:32 -04:00
Johanna Amann
132b9ef2cc Add a few DNS query types. 2021-07-06 10:40:22 +01:00
FlyingWithJerome
74efbd0abc add EDNS cookie parsing 2020-08-20 09:04:56 -04:00
Jon Siwek
31d30bb47e GH-535: fix typo of "C_HESIOD" in DNS::classes 
Fixes GH-535
 2019-08-12 13:32:28 -07:00
Daniel Thayer
18bd74454b Rename all scripts to have ".zeek" file extension 2019-04-11 21:12:40 -05:00
Renamed from scripts/base/protocols/dns/consts.bro (Browse further)